Hi JJK, thanks for your reply. >>what kind of hardware cryptodev accelerator is on the Intel board? We don't >>have extra accelerator used in INTEL board, just enable cryptodev in kernel >>and installed cryptodev-linux-1.7.tar.gz , then i can got improved >>performance in openssl test. but i believe the cryptodev must be called CPU >>hardware encryption accelerator, here is my kernel configuration >>-----CONFIG_CRYPTO=y ## Crypto core or helper#CONFIG_CRYPTO_ALGAPI=yCONFIG_CRYPTO_ALGAPI2=yCONFIG_CRYPTO_AEAD=yCONFIG_CRYPTO_AEAD2=yCONFIG_CRYPTO_BLKCIPHER=yCONFIG_CRYPTO_BLKCIPHER2=yCONFIG_CRYPTO_HASH=yCONFIG_CRYPTO_HASH2=yCONFIG_CRYPTO_RNG=yCONFIG_CRYPTO_RNG2=yCONFIG_CRYPTO_PCOMP2=yCONFIG_CRYPTO_MANAGER=yCONFIG_CRYPTO_MANAGER2=y# CONFIG_CRYPTO_USER is not setCONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y# CONFIG_CRYPTO_GF128MUL is not set# CONFIG_CRYPTO_NULL is not set# CONFIG_CRYPTO_PCRYPT is not setCONFIG_CRYPTO_WORKQUEUE=y# CONFIG_CRYPTO_CRYPTD is not set# CONFIG_CRYPTO_MCRYPTD is not setCONFIG_CRYPTO_AUTHENC=y# CONFIG_CRYPTO_TEST is not set ## Authenticated Encryption with Associated Data#CONFIG_CRYPTO_CCM=y# CONFIG_CRYPTO_GCM is not setCONFIG_CRYPTO_SEQIV=y ## Block modes#CONFIG_CRYPTO_CBC=yCONFIG_CRYPTO_CTR=y# CONFIG_CRYPTO_CTS is not set# CONFIG_CRYPTO_ECB is not set# CONFIG_CRYPTO_LRW is not set# CONFIG_CRYPTO_PCBC is not set# CONFIG_CRYPTO_XTS is not set ## Hash modes## CONFIG_CRYPTO_CMAC is not setCONFIG_CRYPTO_HMAC=y# CONFIG_CRYPTO_XCBC is not set# CONFIG_CRYPTO_VMAC is not set## Digest#CONFIG_CRYPTO_CRC32C=y# CONFIG_CRYPTO_CRC32C_INTEL is not set# CONFIG_CRYPTO_CRC32 is not set# CONFIG_CRYPTO_CRC32_PCLMUL is not set# CONFIG_CRYPTO_CRCT10DIF is not set# CONFIG_CRYPTO_GHASH is not set# CONFIG_CRYPTO_MD4 is not setCONFIG_CRYPTO_MD5=y# CONFIG_CRYPTO_MICHAEL_MIC is not set# CONFIG_CRYPTO_RMD128 is not set# CONFIG_CRYPTO_RMD160 is not set# CONFIG_CRYPTO_RMD256 is not set# CONFIG_CRYPTO_RMD320 is not setCONFIG_CRYPTO_SHA1=y# CONFIG_CRYPTO_SHA1_SSSE3 is not set# CONFIG_CRYPTO_SHA256_SSSE3 is not set# CONFIG_CRYPTO_SHA512_SSSE3 is not set# CONFIG_CRYPTO_SHA1_MB is not setCONFIG_CRYPTO_SHA256=mCONFIG_CRYPTO_SHA512=m# CONFIG_CRYPTO_ANSI_CPRNG is not set# CONFIG_CRYPTO_DRBG_MENU is not set# CONFIG_CRYPTO_USER_API_HASH is not set# CONFIG_CRYPTO_USER_API_SKCIPHER is not setCONFIG_CRYPTO_HW=y# CONFIG_CRYPTO_DEV_PADLOCK is not set# CONFIG_CRYPTO_DEV_CCP is not setCONFIG_CRYPTO_DEV_QAT=mCONFIG_CRYPTO_DEV_QAT_DH895xCC=m# CONFIG_ASYMMETRIC_KEY_TYPE is not setCONFIG_HAVE_KVM=yCONFIG_VIRTUALIZATION=y# CONFIG_KVM is not setCONFIG_BINARY_PRINTF=y----->>how did you enable it in openssl ?i used openssl-1.0.2d and manual compile it by with "./config -DHAVE_CRYPTODEV -DUSE_CRYPTDEV_DIGESTS" ----root@ubuntu:/usr/src# /usr/local/ssl/bin/openssl engine(cryptodev) BSD cryptodev engine(rdrand) Intel RDRAND engine(dynamic) Dynamic engine loading support(4758cca) IBM 4758 CCA hardware engine support(aep) Aep hardware engine support(atalla) Atalla hardware engine support(cswift) CryptoSwift hardware engine support(chil) CHIL hardware engine support(nuron) Nuron hardware engine support(sureware) SureWare hardware engine support(ubsec) UBSEC hardware engine support(gost) Reference implementation of GOST engine---- >>from the numbers you post I can see that there must be some external >>accelerator which is not part of the CPU.there is no external accelerator, i >>just enable the hardware cryptodev in kernel and compiled and installed >>cryptodev-linux-1.7.tar.gz then insert the cryptodev.ko in test. >>OpenVPN can be made to use such accelerators but you must load the engine in >>OpenVPN in the right manner - which of the engines are using for your openssl >>test? what does openssl engine -c -t report? i think so, but why the cryptodev can not working properly, i am confused :( . and just enabled the cryptodev.ko in test. and openssl engine -c -t show as following ------- root@ubuntu:/usr/src# /usr/local/ssl/bin/openssl engine -c -t(cryptodev) BSD cryptodev engine [RSA, DSA, DH, DES-CBC, DES-EDE3-CBC, AES-128-CBC, AES-192-CBC, AES-256-CBC] [ available ](rdrand) Intel RDRAND engine [RAND] [ available ](dynamic) Dynamic engine loading support [ unavailable ](4758cca) IBM 4758 CCA hardware engine support [RSA, RAND] [ unavailable ](aep) Aep hardware engine support [RSA, DSA, DH] [ unavailable ](atalla) Atalla hardware engine support [RSA, DSA, DH] [ unavailable ](cswift) CryptoSwift hardware engine support [RSA, DSA, DH, RAND] [ unavailable ](chil) CHIL hardware engine support [RSA, DH, RAND] [ unavailable ](nuron) Nuron hardware engine support [RSA, DSA, DH] [ unavailable ](sureware) SureWare hardware engine support [RSA, DSA, DH, RAND] [ unavailable ](ubsec) UBSEC hardware engine support [RSA, DSA, DH] [ unavailable ](gost) Reference implementation of GOST engine [gost89, gost89-cnt, md_gost94, gost-mac, gost94, gost2001, gost-mac] [ available ]root@ubuntu:/usr/src#----any suggestion, i really need openvpn get working :( Yuqian
