Some progress from my side with userspace crypto acceleration on the HH5a. I created an image with the OpenSSL 1.1.0h cryptodev and afalg engines, and benchmarked them against OpenSSL software crypto.
The OpenSSL afalg engine requires AIO support from the Linux kernel. Since the official images ship with AIO disabled, it is necessary to build OpenWrt from source. I used the OpenSSL 1.1.0h packaging provided by @cotequeiroz. Here is a log of my steps:
git clone git://git.openwrt.org/openwrt/openwrt.git
cd openwrt
git remote add github git://github.com/openwrt/openwrt.git
git fetch github pull/965/head:openssl-1.1-cotequeiroz
git checkout openssl-1.1-cotequeiroz
scripts/feeds update packages
scripts/feeds install cryptodev-linux libpam
make menuconfig
Target System (Lantiq)
Subtarget (XRX200)
Target Profile (BT Home Hub 5A)
<Exit>, save configuration
make defconfig
make menuconfig
Global build settings > Kernel build options >
[*] Compile the kernel with asynchronous IO support
Kernel modules > Cryptographic API modules >
<*> kmod-cryptodev
<*> kmod-crypto-user
<*> kmod-ltq-deu-vr9 # already selected
# optionally, for each crypto module, select <*>
Libraries > SSL >
<*> libopenssl >
[*] Enable engine support
[*] Enable acceleration support through AF_ALG engine
[*] Acceleration support through /dev/crypto
[*] Digest acceleration support
Utilities >
<*> openssl-util
<Exit>, save configuration
make download
make -j5
install firmware image from bin/targets/lantiq/xrx200/ to router:
root@OpenWrt:~# sysupgrade -n /tmp/openwrt-lantiq-xrx200-bt_homehub-v5a-squashfs-sysupgrade.bin
(automatic reboot)
check if installation succeeded:
root@OpenWrt:~# cat /etc/openwrt_version
r6952+4-5399de754dde
OpenSSL engine capabilities and benchmarks:
root@OpenWrt:~# openssl engine cryptodev afalg -c -t
(cryptodev) BSD cryptodev engine
[RSA, DSA, DH, DES-CBC, AES-128-CBC, AES-192-CBC, AES-256-CBC, hmacWithMD5, hmacWithSHA1, MD5, SHA1]
[ available ]
(afalg) AFALG engine support
[AES-128-CBC]
[ available ]
root@OpenWrt:~# openssl speed -elapsed aes-128-cbc
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes
aes-128 cbc 5844.07k 6527.51k 6730.33k 6782.63k 6793.90k 6777.51k
root@OpenWrt:~# openssl speed -elapsed -engine cryptodev -evp aes-128-cbc
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes
aes-128-cbc 1006.32k 3708.12k 11407.79k 23379.97k 32093.53k 33057.45k
root@OpenWrt:~# openssl speed -elapsed -engine afalg -evp aes-128-cbc
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes
aes-128-cbc 151.67k 600.19k 2247.51k 7308.29k 19901.10k 22446.08k
This confirms previous benchmarks that cryptodev is much faster than afalg, at least in the way OpenSSL uses them here.
I also tried aes-256-cbc even though it is not supported by the afalg engine:
root@OpenWrt:~# openssl speed -elapsed -engine afalg -evp aes-256-cbc
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes
aes-256-cbc 997.25k 3621.27k 10722.82k 20876.97k 28407.13k 29185.37k
This is faster than the previous aes-128-cbc on afalg. I'd be surprised if this was true.
Let's compare this to aes-256-cbc on the cryptodev engine:
root@OpenWrt:~# openssl speed -elapsed -engine cryptodev -evp aes-256-cbc
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes
aes-256-cbc 990.45k 3595.48k 10724.95k 20851.71k 28428.97k 29207.21k
For aes-256-cbc, the results are nearly identical between afalg and cryptodev.
Could it be that openssl speed silently switches to cryptodev when afalg doesn't support the requested algorithm? This would also explain the surprising cryptodev requirements when afalg was requested.