alg: No test for authenc(hmac(sha512),rfc3686(ctr(aes))) (authenc-hmac-sha512-rfc3686-ctr-aes-caam)
alg: No test for seqiv(authenc(hmac(sha512),rfc3686(ctr(aes)))) (seqiv-authenc-hmac-sha512-rfc3686-ctr-
aes-caam)
[...]
Examining the hardware statistics registers in debugfs
When using the JRI or QI backend, performance monitor registers can be checked, provided CONFIG_DEBUG_FS is enabled
in the kernel’s configuration. If debugfs is not automatically mounted at boot time, then a manual mount must be performed in
order to view these registers. This normally can be done with a superuser shell command:
$ mount -t debugfs none /sys/kernel/debug
Once done, the user can read controller registers in /sys/kernel/debug/1700000.crypto/ctl. It should be noted that debugfs will
provide a decimal integer view of most accessible registers provided, with the exception of the KEK/TDSK/TKEK registers; those
registers are long binary arrays, and should be filtered through a binary dump utility such as hexdump.
Specifically, the CAAM hardware statistics registers available are:
fault_addr, or FAR (Fault Address Register): - holds the value of the physical address where a read or write error occurred.
fault_detail, or FADR (Fault Address Detail Register): - holds details regarding the bus transaction where the error occurred.
fault_status, or CSTA (CAAM Status Register): - holds status information relevant to the entire CAAM block.
ib_bytes_decrypted: - holds contents of PC_IB_DECRYPT (Performance Counter Inbound Bytes Decrypted Register)
ib_bytes_validated: - holds contents of PC_IB_VALIDATED (Performance Counter Inbound Bytes Validated Register)
ib_rq_decrypted: - holds contents of PC_IB_DEC_REQ (Performance Counter Inbound Decrypt Requests Register)
kek: - holds contents of JDKEKR (Job Descriptor Key Encryption Key Register)
ob_bytes_encrypted: - holds contents of PC_OB_ENCRYPT (Performance Counter Outbound Bytes Encrypted Register)
ob_bytes_protected: - holds contents of PC_OB_PROTECT (Performance Counter Outbound Bytes Protected Register)
ob_rq_encrypted: - holds contents of PC_OB_ENC_REQ (Performance Counter Outbound Encrypt Requests Register)
rq_dequeued: - holds contents of PC_REQ_DEQ (Performance Counter Requests Dequeued Register)
tdsk: - holds contents of TDKEKR (Trusted Descriptor Key Encryption Key Register)
tkek: - holds contents of TDSKR (Trusted Descriptor Signing Key Register)
For more information see section "Performance Counter, Fault and Version ID Registers" in the Security (SEC) Reference Manual
(SECRM) of each SoC (available on company's website).
Note: for QI backend there is also
qi_congested
: SW-based counter that shows how many times queues going to / from CAAM
to QMan hit the congestion threshold.
Kernel configuration to support CAAM device drivers
Using the driver
Once enabled, the driver will forward kernel crypto API requests to the SEC hardware for processing.
Running IPsec
The IPsec stack built-in to the kernel (usually called NETKEY) will automatically use crypto drivers to offload crypto operations to
the SEC hardware. Documentation regarding how to set up an IPsec tunnel can be found in corresponding open source IPsec
suite packages, e.g. strongswan.org, openswan, setkey, etc. DPAA2-specific section contains a generic helper script to configure
IPsec tunnels.
Running OpenSSL
Linux kernel
Layerscape LS1028A BSP User Guide, Rev. 0.3, 04/2019
74
NXP Semiconductors
Содержание Layerscape LS1028A BSP
Страница 135: ......