devnp-mpcsec.so

Hardware Crypto Engine driver

---

This driver is shipped only with the BSPs that need it.

---

Syntax:

io-pkt-variant -d mpcsec [option[,option ...]] ... &

where variant is one of v4, v4-hc, or v6-hc.

Runs on:

Neutrino

Options:

---

Use commas, not spaces, to separate the options. Use these options to override the defaults.

---

irq=N

IRQ of the interface. The driver will attempt to autodetect the IRQ; if that doesn't work, you can specify it manually using this option. Note that the 85xx sec interrupt is 29 (decimal), and the 83xx sec interrupt is 11 (decimal).

verbose=num

Be verbose. If num is 1, the driver displays configuration data; if num is 2, it also runs initialization tests and displays diagnostic counters periodically.

Description:

The devnp-mpcsec.so shared object is a Hardware Crypto Engine driver. This is a native io-pkt driver; its interface names are in the form tsecX, where X is an integer.

Some devices support hardware checksums, although some might do so in only one direction; to determine if your device does, type:

ifconfig tsecX

and look for the following in the list of supported options:

• ip4csum, ip4csum-rx, ip4csum-tx
• tcp4csum, tcp4csum-rx, tcp4csum-tx
• tcp6csum, tcp6csum-rx, tcp6csum-tx
• udp4csum, udp4csum-rx, udp4csum-tx
• udp6csum, udp6csum-rx, udp6csum-tx

You can then use ifconfig to enable or disable whichever of these options your device supports.

Examples:

On the 85xx, start the v6 TCP/IP variant of io-pkt, using the devnp-mpcsec.so SEC driver and the TSEC Ethernet driver with IPsec enabled in the stack:

io-pkt-v6-hc -d /proc/boot/devnp-mpcsec.so verbose=2 -p tcpip-v6 \
 ipsec -d /proc/boot/devnp-mpc85xx.so mac=00112233AABBCC
# config the (2nd) ethernet port
ifconfig tsec1 10.42.110.239
# config md5-hmac ah and des-cbc esp for IPsec to peer 10.42.110.212
setkey -c << EOF
add 10.42.110.212 10.42.110.239 ah 9877 -A hmac-md5 "1234567890123456";
add 10.42.110.239 10.42.110.212 ah 9878 -A hmac-md5 "1234567890123456";
add 10.42.110.212 10.42.110.239 esp 9881 -E des-cbc "12345678";
add 10.42.110.239 10.42.110.212 esp 9882 -E des-cbc "12345678";
spdadd 10.42.110.239 10.42.110.212 any -P out ipsec esp/transport//use ah/transport//use;
EOF

# on peer 10.42.110.212 run this:
setkey -c << EOF
add 10.42.110.212 10.42.110.239 ah 9877 -A hmac-md5 "1234567890123456";
add 10.42.110.239 10.42.110.212 ah 9878 -A hmac-md5 "1234567890123456";
add 10.42.110.212 10.42.110.239 esp 9881 -E des-cbc "12345678";
add 10.42.110.239 10.42.110.212 esp 9882 -E des-cbc "12345678";
spdadd 10.42.110.212 10.42.110.239 any -P out ipsec esp/transport//use ah/transport//use;
EOF

See also:

devn-*, devnp-*, ifconfig, io-pkt