Docunext Technology

14 Responses to “Geode AES + OCF + Cryptodev + OpenSSL”

1. 1 mello
   Jan 9th, 2008 at 6:18 am

   Hi i followed your instruction on ubuntu gutsy and created patched deb for:
   libssl0.9.8_0.9.8e-5ubuntu3.1_i386.deb
   linux-image-2.6.22-14-generic_2.6.22-14.46_i386.deb
   openssh-client_4.6p1-5build1_i386.deb
   openssh-server_4.6p1-5build1_i386.deb

   with openssl all was fine but with ssh under heavy traffic i got “CORRUPTED MAC”, too. (all was fine, but slow, if i removed geode_aes module)
   Googling around i found another person with the same problem (on different crypto hardware), and the problem was driver of crypto device not waiting when busy.
   So i searched on crypto list and found many submitted patch to geode_aes module, one in particular was interesting:
   http://www.mail-archive.com/linux-crypto@vger.kernel.org/msg01214.html

   So i downloaded last source from git (be careful that you need the new aes.h under include/crypto/) and recompiled geode_aes (and geode_rng too).
   Now ALL WORKS!!!!

2. 2 Albert
   Jan 9th, 2008 at 12:32 pm

   Thanks for that mello - awesome! I’m very interested in getting ssh to work without that corrupted mac issue. I wrote into the list about it but the maintainer was about to go on vacation… glad to hear its been resolved.

3. 3 Ulrich Müller
   Feb 7th, 2008 at 4:51 am

   I’m not sure if I got the same problem with the buggy geode_aes while crypting the harddrive. Using geode_aes the filesystem gets crippled. I’m using Ubuntu 7.10. server on an alix1c board. May be I will give the patches a chance …

4. 4 Albert
   Feb 7th, 2008 at 12:09 pm

   Hi Ulrich - which method are you using to crypt the file system? Luks? dm-crypt? I just setup an encrypted home for the first time with a Via C7, so I’ll try out my ALIXC1 board and see if I have the same results as you.

5. 5 Ben
   Feb 15th, 2008 at 1:12 pm

   I have all of this working which is great, but how do you get OpenVPN to utilize cryptodev?

6. 6 Albert
   Feb 16th, 2008 at 12:56 am

   Hi Ben - I believe OpenVPN uses OpenSSL - so if you can set that up to use cryptodev, openvpn should do the same. Are you using a C7?

7. 7 Ben
   Feb 16th, 2008 at 11:27 am

   Recompiling OpenVPN with the new OpenSSL libs was all it required to get it to show up in OpenVPN’s supported engines - however i’m seeing “cryptosoft: setkey failed -22 (crt_flags=0×200000)” when testing OpenVPN (when using aes-128), and i noticed the message also appears when doing the openssl test despite the noticeable speed increase during the test. the difference is that OpenVPN temporarily locks the machine when that string appears in dmesg.

8. 8 Ulrich Müller
   Feb 17th, 2008 at 5:19 am

   * rmmod aes-i586
   * modprobe geode-aes
   * cryptsetup -c aes -s 128 -h sha256 luksFormat /dev/hda6
   * cryptsetup luksOpen /dev/hda6 cryptohome — I’m using luks
   * mkfs.ext3 /dev/mapper/cryptohome
   * mount /dev/mapper/cryptohome /home
   Sometimes problemes already started here! Superblocks werde damaged right after the fs was created.
   * If I could mount, copying some larger files definitivly killed the fs.

   I’m using Ubuntu 7.10

9. 9 Ulrich Müller
   Feb 17th, 2008 at 5:22 am

   # rmmod aes-i586
   # modprobe geode-aes
   # cryptsetup -c aes -s 128 -h sha256 luksFormat /dev/hda6
   # cryptsetup luksOpen /dev/hda6 cryptohome
   # mkfs.ext3 /dev/mapper/cryptohome
   # mount /dev/mapper/cryptohome /home

   Sometimes even mounting right after the mkfs didn’t work because of a corrupted superblock. Copying several larger files kill the fs anyway.

10. 10 Albert
    Feb 19th, 2008 at 12:41 pm

    This is a real problem - it appears that every use of the geode-aes module results in problems. Its very hard to say where the problem lies, but my gut is pointing me towards OpenBSD so that I can try out their driver. I just pasted the man page here:

    http://www.docunext.com/wiki/Geode_LX_AES_Security_Block

11. 11 Albert
    Feb 19th, 2008 at 12:42 pm

    Looks like some folks are having problems with that too:

    http://kerneltrap.org/mailarchive/openbsd-misc/2007/11/10/402146

12. 12 Mark
    Apr 18th, 2008 at 1:48 am

    Has anybody ported the ocf-linux patch to 2.6.24?
    It seems that there has been some recent refactoring work
    done in the scratchlist area (sg_page)

13. 13 Albert
    Apr 18th, 2008 at 10:29 am

    I just checked the ocf-linux page and it says the patch set will work with most 2.4 and 2.6 kernels up to and include 2.4.34 and 2.6.23. Unless the website needs to be updated, looks like it hasn’t happened yet.

14. 14 Mark
    Apr 27th, 2008 at 11:39 am

    …there is an interim patch available which allows you to use ocf-linux on more recent kernels. Check the ocf-linux mailing list.

Leave a Reply