[Helios4 - Cryptographic Engines And Security Accelerator (CESA) Benchmarking]

11 hours ago, m4110c said:

I have a Helios 4 (last batch) and just wanted to ask if CESA is still not functional with the current Buster release?

I'm on Armbian 21.08.2 Buster with Linux 5.10.60-mvebu and CESA is not functional.

 

Regards,

James

[Helios4 - Cryptographic Engines And Security Accelerator (CESA) Benchmarking]

Hi @djurny, here you go:

cryptsetup benchmark:

# Tests are approximate using memory only (no storage IO).
PBKDF2-sha1       258524 iterations per second for 256-bit key
PBKDF2-sha256     364595 iterations per second for 256-bit key
PBKDF2-sha512     179550 iterations per second for 256-bit key
PBKDF2-ripemd160  191345 iterations per second for 256-bit key
PBKDF2-whirlpool   28370 iterations per second for 256-bit key
argon2i       4 iterations, 71599 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)
argon2id      4 iterations, 73566 memory, 4 parallel threads (CPUs) for 256-bit key (requested 2000 ms time)
#     Algorithm |       Key |      Encryption |      Decryption
        aes-cbc        128b        95.1 MiB/s        98.1 MiB/s
    serpent-cbc        128b        27.6 MiB/s        30.7 MiB/s
    twofish-cbc        128b        40.3 MiB/s        45.4 MiB/s
        aes-cbc        256b        90.7 MiB/s        93.1 MiB/s
    serpent-cbc        256b        28.0 MiB/s        31.3 MiB/s
    twofish-cbc        256b        41.2 MiB/s        46.2 MiB/s
        aes-xts        256b        62.7 MiB/s        54.9 MiB/s
    serpent-xts        256b        29.7 MiB/s        31.1 MiB/s
    twofish-xts        256b        44.0 MiB/s        45.7 MiB/s
        aes-xts        512b        47.7 MiB/s        41.5 MiB/s
    serpent-xts        512b        29.8 MiB/s        31.1 MiB/s
    twofish-xts        512b        44.0 MiB/s        45.7 MiB/s

 

interesting, I do see CESA interrupts count up from the cryptsetup benchmark:

 48:      24618          0     GIC-0  51 Level     f1090000.crypto
 49:          0          0     GIC-0  52 Level     f1090000.crypto

 

syslog: https://pastebin.com/AacFP5R8

 

Thanks!

[Helios4 - Cryptographic Engines And Security Accelerator (CESA) Benchmarking]

@djurny, I have a /proc/crypto (but not /proc/cryptinfo), link at the bottom.

 

Apologies, I should have explained using the mmc device: that was used just to confirm the issue still existed when starting afresh using matzman666's instructions. I had some spare space available on that mmc device, and when using it I was only checking the CESA interrupt count in /proc/interrupts. My real storage is a pair of hard drives that each can read sequentially at ~180 MB/s (tested with dd).

 

uname -a:

Linux helios4 5.10.21-mvebu #21.02.3 SMP Mon Mar 8 00:59:48 UTC 2021 armv7l GNU/Linux

 

/proc/crypto:

https://pastebin.com/QuSpD5u5

[Helios4 - Cryptographic Engines And Security Accelerator (CESA) Benchmarking]

Hi there!

 

I have been using LUKS2 encrypted disks on my helios4, and I've noticed that the encryption/decryption is no longer making use of the CESA accelerator. I don't see the relevant interrupts counting up:

 48:          0          0     GIC-0  51 Level     f1090000.crypto
 49:          0          0     GIC-0  52 Level     f1090000.crypto

and my decryption speed is a lot lower (~45 MB/s) than it used to be (~100 MB/s). This used to be working on this OS install (Ambian Debian stretch, apt dist-upgrade'd to buster 21.02.3), and I wonder if there may have been a regression somewhere along the line.

 

I've also tested using matzman666's examples above for setting up a LUKS2 encrypted disk, and I still have the same issue: I don't see any CESA HW acceleration with LUKS2. I checked and I do have the marvell_cesa module loaded. Here is the cryptsetup command:

cryptsetup -s 256 -c aes-cbc-essiv:sha256 --sector-size 4096 --type luks2 luksFormat /dev/mmcblk0p2

 

I have also tried a fresh install of the latest Armbian Debian buster 21.02.3 and Armbian Ubuntu focal 21.02.3, and I still have no CESA acceleration.

 

Has anyone seen this issue? How do we get LUKS2 to use the CESA hardware these days?

 

Regards,

James