| Version 7 (modified by , 4 years ago) ( diff ) |
|---|
OcteonTX Trusted Boot
Trusted boot requires the -AUC or -AUS variant of the CN80XX processor which is not on Newport standard product boards.
The trusted boot documentation requires an NDA with Marvell directly.
Contact Gateworks sales if you wish to use Trusted boot on a Gateworks Custom or Special.
Newport TPM
The Newport GW630x and GW640x have an optional TPM, the Maxim DS28C22 for Secure Authentication and Encryption. This is available as an optional load on orders of 100 pieces or more. To get the part with secure pre-programmed keys requires the customer to work directly with Maxim. Typically this requires a significant volume order and is meant for larger volume deployments. Gateworks can provide un-programmed parts for smaller volumes and then it is up to the customer to program their own keys and maintain their own secure key storage. See here for datasheet.
OcteonTX Encryption
Compression / Decompression hardware engine (ZIP)
The ThunderX SoC's contains 2x compression/decompression hardware engines (ZIP unit)
The ZIP engine supports hardware accelerated compression and decompression. It includes 2 independent ZIP cores and supports:
- DEFLATE compression and decompression (RFC 1951)
- LZS compression and decompression (RFC 2395 and ANSI X3.241-1994)
- ADLER32 and CRC32 checksums for ZLIB (RFC 1950) and GZIP (RFC 1952)
- The ZIP engine is presented as a PCI device. It supports DMA and scatter-gather.
Cryptographic Accelerator Unit (CPT)
The ThunderX SoC's contain a Cryptographic Accelerator Unit (CPT) featuring:
- Symmetric CPT unit
- 16 SR-IOV compatible virtual functions (VFs) and related queues (VQs) shared with asymmetric
- 8 engine-groups
- 10 GigaCypher Symmetric Cryptographic Engines (SEs)
- AES256 (XCBC, CCM, CTR, ECB, CBC, GCM, OFM, CFB, XTS)
- AES512
- 3DES
- CRC
- Hashes: SHA1, SHA2 (SHA224, SHA384, SHA512), SHA3, MD5
- Up to 16 Gbit/sec/coprocessor-GHz aggregate bulk crypto (AES128 at IMIX sizes) encryption/decryption
- Up to 8 Gbit/sec/coprocessor-GHz aggregate inline IPSEC large packet encryption/decryption
- Up to 5 (TBD) Gbit/sec/coprocessor-GHz inline SSL large record encryption/decryption
- Asymmetric CPT unit
- 16 SR-IOV compatible virtual functions (VFs) and related queues (VQs) shared with symmetric
- 8 engine-groups
- 6 GigaCypher Asymmetric Cryptographic Engines (AEs)
- Modular exponentiation up to 8 Kbit (RSA 2048, RSA 4096, RSA 8192, DH)
- RSA encrypt/decrypt – up to 8192 bits
- Prime-field Elliptic Curve (ECC) point multiplication
- P256, P384, P521
- Known-point optimization (50%+ of point multiplies are known point)
- Up to 16K P256 ECC fixed-point multiplies/sec/coprocessor-GHz
- Up to 7.1K P256 ECC unknown-point multiplies/sec/coprocessor-GHz Cavium Confidential For Up to 5.4K 2048-bit RSA operations/sec/coprocessor-GHz
Linux Drivers
The Compression / Decompression hardware engine (ZIP) is supported by a Linux driver since v4.12 in drivers/crypto/cavium/zip enabled via CONFIG_CRYPTO_DEV_CAVIUM_ZIP. This driver registers 'deflate' and 'lzs' algorithms with the Linux crypto subsystem via crypto_register_alg and crypto_register_scomp calls.
The Cryptographic Accelerator Unit (CPT) is supported by a Linux driver since v4.11 in drivers/crpyto/cavium/cpt enabled via CONFIG_CAVIUM_CPT. This driver registers 'xts(aes), 'cbc(aes)',
'ecb(aes)', 'cfb(aes)', and 'cbc(des3_ede)' algorithms with the Linux crypto subsystem via crypto_register_algs call.
The CPT driver requires binary firmware be installed in /lib/firmware which must be obtained from the Marvell SDK (which requires an NDA with Marvell):
# ls /lib/firmware/cpt8x*
cpt8x-mc-ae.out
cpt8x-mc-se.out
- these are found in the OCTEONTX SDK-6.2.0 in linux/cavium-rootfs/tmp-rootfs/lib/firmware
Once enabled and firmware loaded, /proc/crypto will list out the system cipher and algorithm support:
# cat /proc/crypto name : ecb(des3_ede) driver : cavium-ecb-des3_ede module : cptvf priority : 4001 refcnt : 1 selftest : passed internal : no type : ablkcipher async : yes blocksize : 8 min keysize : 24 max keysize : 24 ivsize : 8 geniv : <default> name : cbc(des3_ede) driver : cavium-cbc-des3_ede module : cptvf priority : 4001 refcnt : 1 selftest : passed internal : no type : ablkcipher async : yes blocksize : 8 min keysize : 24 max keysize : 24 ivsize : 8 geniv : <default> name : cfb(aes) driver : cavium-cfb-aes module : cptvf priority : 4001 refcnt : 1 selftest : passed internal : no type : ablkcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 geniv : <default> name : ecb(aes) driver : cavium-ecb-aes module : cptvf priority : 4001 refcnt : 1 selftest : passed internal : no type : ablkcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 geniv : <default> name : cbc(aes) driver : cavium-cbc-aes module : cptvf priority : 4001 refcnt : 1 selftest : passed internal : no type : ablkcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 geniv : <default> name : xts(aes) driver : cavium-xts-aes module : cptvf priority : 4001 refcnt : 1 selftest : passed internal : no type : ablkcipher async : yes blocksize : 16 min keysize : 32 max keysize : 64 ivsize : 16 geniv : <default> name : crc32c driver : crc32c-arm64-ce module : crc32_ce priority : 200 refcnt : 1 selftest : passed internal : no type : shash blocksize : 1 digestsize : 4 name : crc32 driver : crc32-arm64-ce module : crc32_ce priority : 200 refcnt : 1 selftest : passed internal : no type : shash blocksize : 1 digestsize : 4 name : crct10dif driver : crct10dif-arm64-ce module : crct10dif_ce priority : 200 refcnt : 1 selftest : passed internal : no type : shash blocksize : 1 digestsize : 2 name : lzs driver : lzs-scomp module : kernel priority : 300 refcnt : 1 selftest : passed internal : no type : scomp name : deflate driver : deflate-scomp module : kernel priority : 300 refcnt : 1 selftest : passed internal : no type : scomp name : lzs driver : lzs-generic module : kernel priority : 300 refcnt : 1 selftest : passed internal : no type : compression name : deflate driver : deflate-generic module : kernel priority : 300 refcnt : 1 selftest : passed internal : no type : compression name : jitterentropy_rng driver : jitterentropy_rng module : kernel priority : 100 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0 name : stdrng driver : drbg_nopr_hmac_sha256 module : kernel priority : 207 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0 name : stdrng driver : drbg_nopr_hmac_sha512 module : kernel priority : 206 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0 name : stdrng driver : drbg_nopr_hmac_sha384 module : kernel priority : 205 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0 name : stdrng driver : drbg_nopr_hmac_sha1 module : kernel priority : 204 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0 name : stdrng driver : drbg_pr_hmac_sha256 module : kernel priority : 203 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0 name : stdrng driver : drbg_pr_hmac_sha512 module : kernel priority : 202 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0 name : stdrng driver : drbg_pr_hmac_sha384 module : kernel priority : 201 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0 name : stdrng driver : drbg_pr_hmac_sha1 module : kernel priority : 200 refcnt : 1 selftest : passed internal : no type : rng seedsize : 0 name : stdrng driver : ansi_cprng module : kernel priority : 100 refcnt : 1 selftest : passed internal : no type : rng seedsize : 48 name : crct10dif driver : crct10dif-generic module : kernel priority : 100 refcnt : 2 selftest : passed internal : no type : shash blocksize : 1 digestsize : 2 name : crc32 driver : crc32-generic module : kernel priority : 100 refcnt : 1 selftest : passed internal : no type : shash blocksize : 1 digestsize : 4 name : crc32c driver : crc32c-generic module : kernel priority : 100 refcnt : 2 selftest : passed internal : no type : shash blocksize : 1 digestsize : 4 name : aes driver : aes-generic module : kernel priority : 100 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 16 min keysize : 16 max keysize : 32 name : sha224 driver : sha224-generic module : kernel priority : 0 refcnt : 1 selftest : passed internal : no type : shash blocksize : 64 digestsize : 28 name : sha256 driver : sha256-generic module : kernel priority : 0 refcnt : 1 selftest : passed internal : no type : shash blocksize : 64 digestsize : 32 name : sha1 driver : sha1-generic module : kernel priority : 0 refcnt : 1 selftest : passed internal : no type : shash blocksize : 64 digestsize : 20 name : digest_null driver : digest_null-generic module : kernel priority : 0 refcnt : 1 selftest : passed internal : no type : shash blocksize : 1 digestsize : 0 name : compress_null driver : compress_null-generic module : kernel priority : 0 refcnt : 1 selftest : passed internal : no type : compression name : ecb(cipher_null) driver : ecb-cipher_null module : kernel priority : 100 refcnt : 1 selftest : passed internal : no type : blkcipher blocksize : 1 min keysize : 0 max keysize : 0 ivsize : 0 geniv : <default> name : cipher_null driver : cipher_null-generic module : kernel priority : 0 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 1 min keysize : 0 max keysize : 0 name : aes driver : aes-arm64 module : kernel priority : 200 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 16 min keysize : 16 max keysize : 32 name : sha224 driver : sha224-arm64-neon module : kernel priority : 150 refcnt : 1 selftest : passed internal : no type : shash blocksize : 64 digestsize : 28 name : sha256 driver : sha256-arm64-neon module : kernel priority : 150 refcnt : 1 selftest : passed internal : no type : shash blocksize : 64 digestsize : 32 name : sha224 driver : sha224-arm64 module : kernel priority : 100 refcnt : 1 selftest : passed internal : no type : shash blocksize : 64 digestsize : 28 name : sha256 driver : sha256-arm64 module : kernel priority : 100 refcnt : 1 selftest : passed internal : no type : shash blocksize : 64 digestsize : 32 name : xts(aes) driver : xts-aes-ce module : kernel priority : 300 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 32 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16 name : ctr(aes) driver : ctr-aes-ce module : kernel priority : 300 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16 name : cbc(aes) driver : cbc-aes-ce module : kernel priority : 300 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16 name : ecb(aes) driver : ecb-aes-ce module : kernel priority : 300 refcnt : 1 selftest : passed internal : no type : skcipher async : yes blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16 name : cbcmac(aes) driver : cbcmac-aes-ce module : kernel priority : 300 refcnt : 1 selftest : passed internal : no type : shash blocksize : 1 digestsize : 16 name : xcbc(aes) driver : xcbc-aes-ce module : kernel priority : 300 refcnt : 1 selftest : passed internal : no type : shash blocksize : 16 digestsize : 16 name : cmac(aes) driver : cmac-aes-ce module : kernel priority : 300 refcnt : 1 selftest : passed internal : no type : shash blocksize : 16 digestsize : 16 name : __xts(aes) driver : __xts-aes-ce module : kernel priority : 300 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 32 max keysize : 64 ivsize : 16 chunksize : 16 walksize : 16 name : ctr(aes) driver : ctr-aes-ce module : kernel priority : 299 refcnt : 1 selftest : passed internal : no type : skcipher async : no blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16 name : __ctr(aes) driver : __ctr-aes-ce module : kernel priority : 300 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 1 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16 name : __cbc(aes) driver : __cbc-aes-ce module : kernel priority : 300 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 16 chunksize : 16 walksize : 16 name : __ecb(aes) driver : __ecb-aes-ce module : kernel priority : 300 refcnt : 1 selftest : passed internal : yes type : skcipher async : no blocksize : 16 min keysize : 16 max keysize : 32 ivsize : 0 chunksize : 16 walksize : 16 name : ccm(aes) driver : ccm-aes-ce module : kernel priority : 300 refcnt : 1 selftest : passed internal : no type : aead async : no blocksize : 1 ivsize : 16 maxauthsize : 16 geniv : <none> name : aes driver : aes-ce module : kernel priority : 250 refcnt : 1 selftest : passed internal : no type : cipher blocksize : 16 min keysize : 16 max keysize : 32 name : gcm(aes) driver : gcm-aes-ce module : kernel priority : 300 refcnt : 1 selftest : passed internal : no type : aead async : no blocksize : 1 ivsize : 12 maxauthsize : 16 geniv : <none> name : ghash driver : ghash-ce module : kernel priority : 200 refcnt : 1 selftest : passed internal : no type : shash blocksize : 16 digestsize : 16 name : sha256 driver : sha256-ce module : kernel priority : 200 refcnt : 1 selftest : passed internal : no type : shash blocksize : 64 digestsize : 32 name : sha224 driver : sha224-ce module : kernel priority : 200 refcnt : 1 selftest : passed internal : no type : shash blocksize : 64 digestsize : 28 name : sha1 driver : sha1-ce module : kernel priority : 200 refcnt : 1 selftest : passed internal : no type : shash blocksize : 64 digestsize : 20
Note that the performance of this hardware cyprto offload is much slower than software crypto (see wiki:linux/encryption#PerformaceComparisons)
For information on how to use the Linux Kernel Crypto API consult the kernel documentation:
For more information on Linux Kernel Crypto API and how to use in Userspace see:
Note:
See TracWiki
for help on using the wiki.
