ocf-linux-users

[Ocf-linux-users] first time user

[Jan J. K. <ja...@ni...>]

hi all,

I'm trying to use ocf for the first time - the concept looks great, and 
I am very curious how the ocf drivers will perform compared to the 
(latest) openssl assembly code. However, I cannot even get a simple 
'cryptotest' to run on my Fedora 14 laptop:

[root@beijaflor crypto-tools]# uname -a
Linux beijaflor 2.6.35.14-106.fc14.x86_64 #1 SMP Wed Nov 23 13:07:52 UTC 
2011 x86_64 x86_64 x86_64 GNU/Linux
[root@beijaflor crypto-tools]# lsmod | grep crypto
[root@beijaflor crypto-tools]# modprobe ocf
[root@beijaflor crypto-tools]# modprobe cryptosoft
[root@beijaflor crypto-tools]# modprobe crypto_null
[root@beijaflor crypto-tools]# modprobe ocf-bench
FATAL: Error inserting ocf_bench 
(/lib/modules/2.6.35.14-106.fc14.x86_64/extra/ocf-bench.ko): Invalid 
argument
[root@beijaflor crypto-tools]# dmesg | tail -5
[ 9440.770735] alg: No test for digest_null (digest_null-generic)
[ 9440.770760] alg: No test for compress_null (compress_null-generic)
[ 9460.475287] Crypto Speed tests
[ 9460.475327] OCF: testing ...
[ 9461.476315] OCF: 47784 requests of 1488 bytes in 1001 jiffies 
(568.252 Mbps)
[root@beijaflor crypto-tools]# ls -al /dev/crypto
crw-r--r-- 1 root root 10, 70 Feb  6 16:04 /dev/crypto
[root@beijaflor crypto-tools]# ./cryptotest
cryptotest: /dev/crypto: No such device

what am I doing wrong here? also, 'openssl engine -v' will not list the 
cryptodev engine

Final question: is/will there be support for the cryptodev engine in 
openssl 1.0+ ?

TIA,

JJK

Re: [Ocf-linux-users] first time user

[David M. <dav...@mc...>]

Jivin Jan Just Keijser lays it down ...
> hi all,
> 
> I'm trying to use ocf for the first time - the concept looks great, and 
> I am very curious how the ocf drivers will perform compared to the 
> (latest) openssl assembly code. However, I cannot even get a simple 
> 'cryptotest' to run on my Fedora 14 laptop:

It is unlikely t obe faster than the openssl assembly code unless you have a
hardware crypto accelerator.

OCF passes the crypto from openssl to the kernel for processing,  just do
that alone is a very expensive task, so in order to benefit,  the kernel
crypto must be faster than software by an order of magnitude.

There are SMP cases when OCF+software can speed things up but it is unlikely
you have this scenario if you are running from user space.

> [root@beijaflor crypto-tools]# uname -a
> Linux beijaflor 2.6.35.14-106.fc14.x86_64 #1 SMP Wed Nov 23 13:07:52 UTC 
> 2011 x86_64 x86_64 x86_64 GNU/Linux
> [root@beijaflor crypto-tools]# lsmod | grep crypto
> [root@beijaflor crypto-tools]# modprobe ocf
> [root@beijaflor crypto-tools]# modprobe cryptosoft
> [root@beijaflor crypto-tools]# modprobe crypto_null

crypto_null is not for general use,  it is a dummy driver that does nothing.
Developers can use this to test the speed of all their code in the
theoretical situation of crypto being zero cost.  So it allows you to test
the raw speed of your ipsec stack with no crypto (when talking to another
similarly hacked ipsec stack).

You do not want crypto_null.

> [root@beijaflor crypto-tools]# modprobe ocf-bench
> FATAL: Error inserting ocf_bench 
> (/lib/modules/2.6.35.14-106.fc14.x86_64/extra/ocf-bench.ko): Invalid 
> argument

This is normal,  ocf-bench is a speed test driver that always fails to load.

> [root@beijaflor crypto-tools]# dmesg | tail -5
> [ 9440.770735] alg: No test for digest_null (digest_null-generic)
> [ 9440.770760] alg: No test for compress_null (compress_null-generic)
> [ 9460.475287] Crypto Speed tests
> [ 9460.475327] OCF: testing ...
> [ 9461.476315] OCF: 47784 requests of 1488 bytes in 1001 jiffies 
> (568.252 Mbps)

The output of ocf-bench is really only of use to developers and crypto
driver writers,  so don't read much into that.

> [root@beijaflor crypto-tools]# ls -al /dev/crypto
> crw-r--r-- 1 root root 10, 70 Feb  6 16:04 /dev/crypto
> [root@beijaflor crypto-tools]# ./cryptotest
> cryptotest: /dev/crypto: No such device
> 
> what am I doing wrong here? also, 'openssl engine -v' will not list the 
> cryptodev engine

You need to load the "cryptodev" driver as well.

	modprobe cryptodev

You will not have a cryptodev driver unless you patched your kernel.

Read through the README carefully and it will explain why this is and
why you probably do not want to be doing what you are doing.

Without hardware acceleration,  there is little point calling into OCF
from user space.

> Final question: is/will there be support for the cryptodev engine in 
> openssl 1.0+ ?

It should all be there and ready to go.  I believe the --with-cryptodev
option is still used to enable it in the latest openssl releases,

Cheers,
Davidm

-- 
David McCullough,      dav...@mc...,  Ph:+61 734352815
McAfee - SnapGear      http://www.mcafee.com         http://www.uCdot.org