This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

AM623: How to use Hardware Security Accelerator

Part Number: AM623
Other Parts Discussed in Thread: SHA-256

#1. I operated on Linux SDK following:https://software-dl.ti.com/processor-sdk-linux/esd/AM62X/11_01_05_03/exports/docs/linux/Foundational_Components/Kernel/Kernel_Drivers/Crypto/SA2UL_OMAP.html#

check module loaded:

root@am62xx-evm:/home# uname -a
Linux am62xx-evm 6.6.32-ti-g6de6e418c80e-dirty #1 SMP PREEMPT Fri Jul 26 14:32:20 UTC 2024 aarch64 GNU/Linux

root@am62xx-evm:~# lsmod |grep sa2ul
sa2ul                  32768  0
authenc                12288  1 sa2ul

root@am62xx-evm:~# lsmod |grep cryptodev
cryptodev              49152  0

#2. Tested with two type command: sha256sum <file and openssl dgst -sha256  <file, the CPU loading and time spend with openssl is higher than sha256sum with small file.

What is the difference between sha256sum and openssl dgst -sha256? 

root@am62xx-evm:/home# time -v openssl dgst -sha256 <test.c
SHA2-256(stdin)= 25ef07f7d7f36f9c67ea3a357f66bb16028e3165e624ff007323ebc6ac780cb5
        Command being timed: "openssl dgst -sha256"
        User time (seconds): 0.01
        System time (seconds): 0.00
        Percent of CPU this job got: 72%
        Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 0.01s
        Average shared text size (kbytes): 0
        Average unshared data size (kbytes): 0
        Average stack size (kbytes): 0
        Average total size (kbytes): 0
        Maximum resident set size (kbytes): 23552
        Average resident set size (kbytes): 0
        Major (requiring I/O) page faults: 0
        Minor (reclaiming a frame) page faults: 279
        Voluntary context switches: 2
        Involuntary context switches: 0
        Swaps: 0
        File system inputs: 16
        File system outputs: 0
        Socket messages sent: 0
        Socket messages received: 0
        Signals delivered: 0
        Page size (bytes): 4096
        Exit status: 0
        
root@am62xx-evm:/home# time -v openssl dgst -sha256 <test.c
SHA2-256(stdin)= 25ef07f7d7f36f9c67ea3a357f66bb16028e3165e624ff007323ebc6ac780cb5
        Command being timed: "openssl dgst -sha256"
        User time (seconds): 0.00
        System time (seconds): 0.00
        Percent of CPU this job got: 85%
        Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 0.01s
        Average shared text size (kbytes): 0
        Average unshared data size (kbytes): 0
        Average stack size (kbytes): 0
        Average total size (kbytes): 0
        Maximum resident set size (kbytes): 23552
        Average resident set size (kbytes): 0
        Major (requiring I/O) page faults: 0
        Minor (reclaiming a frame) page faults: 278
        Voluntary context switches: 1
        Involuntary context switches: 0
        Swaps: 0
        File system inputs: 0
        File system outputs: 0
        Socket messages sent: 0
        Socket messages received: 0
        Signals delivered: 0
        Page size (bytes): 4096
        Exit status: 0


root@am62xx-evm:/home# time -v sha256sum <test.c
25ef07f7d7f36f9c67ea3a357f66bb16028e3165e624ff007323ebc6ac780cb5  -
        Command being timed: "sha256sum"
        User time (seconds): 0.00
        System time (seconds): 0.00
        Percent of CPU this job got: 66%
        Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 0.00s
        Average shared text size (kbytes): 0
        Average unshared data size (kbytes): 0
        Average stack size (kbytes): 0
        Average total size (kbytes): 0
        Maximum resident set size (kbytes): 5120
        Average resident set size (kbytes): 0
        Major (requiring I/O) page faults: 0
        Minor (reclaiming a frame) page faults: 54
        Voluntary context switches: 1
        Involuntary context switches: 0
        Swaps: 0
        File system inputs: 0
        File system outputs: 0
        Socket messages sent: 0
        Socket messages received: 0
        Signals delivered: 0
        Page size (bytes): 4096
        Exit status: 0
root@am62xx-evm:/home#

Test with larger size file

#3.   unload cryptodev

root@am62xx-evm:/home# modprobe -r cryptodev
[ 1210.056652] cryptodev: driver unloaded.
root@am62xx-evm:/home# lsmod |grep sa2ul
sa2ul                  32768  0
authenc                12288  1 sa2ul
root@am62xx-evm:/home# lsmod |grep cryptodev
root@am62xx-evm:/home#

sha256sum 

root@am62xx-evm:/home# time -v sha256sum <tisdk-default-image-am62xx-evm-11.00.09.04.rootfs.wic.xz
80724f3bc5a5e22b544d9510d12a077e537b65c473a56d7e109a316f4a447e1d  -
        Command being timed: "sha256sum"
        User time (seconds): 10.01
        System time (seconds): 0.60
        Percent of CPU this job got: 99%
        Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 10.67s
        Average shared text size (kbytes): 0
        Average unshared data size (kbytes): 0
        Average stack size (kbytes): 0
        Average total size (kbytes): 0
        Maximum resident set size (kbytes): 5120
        Average resident set size (kbytes): 0
        Major (requiring I/O) page faults: 0
        Minor (reclaiming a frame) page faults: 60
        Voluntary context switches: 1
        Involuntary context switches: 7
        Swaps: 0
        File system inputs: 0
        File system outputs: 0
        Socket messages sent: 0
        Socket messages received: 0
        Signals delivered: 0
        Page size (bytes): 4096
        Exit status: 0

openssl dgst -sha256: quite faster.

root@am62xx-evm:/home# time -v openssl dgst -sha256 <tisdk-default-image-am62xx-evm-11.00.09.04.rootfs.wic.xz
SHA2-256(stdin)= 80724f3bc5a5e22b544d9510d12a077e537b65c473a56d7e109a316f4a447e1d
        Command being timed: "openssl dgst -sha256"
        User time (seconds): 1.48
        System time (seconds): 0.99
        Percent of CPU this job got: 98%
        Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 2.52s
        Average shared text size (kbytes): 0
        Average unshared data size (kbytes): 0
        Average stack size (kbytes): 0
        Average total size (kbytes): 0
        Maximum resident set size (kbytes): 23552
        Average resident set size (kbytes): 0
        Major (requiring I/O) page faults: 0
        Minor (reclaiming a frame) page faults: 278
        Voluntary context switches: 1
        Involuntary context switches: 4
        Swaps: 0
        File system inputs: 0
        File system outputs: 0
        Socket messages sent: 0
        Socket messages received: 0
        Signals delivered: 0
        Page size (bytes): 4096
        Exit status: 0

 With cryptodev loaded:

root@am62xx-evm:/home# lsmod |grep sa2ul
sa2ul                  32768  0
authenc                12288  1 sa2ul
root@am62xx-evm:/home# lsmod |grep cryptodev
cryptodev              49152  0
root@am62xx-evm:/home#
root@am62xx-evm:/home# time -v sha256sum <tisdk-default-image-am62xx-evm-11.00.09.04.rootfs.wic.xz
80724f3bc5a5e22b544d9510d12a077e537b65c473a56d7e109a316f4a447e1d  -
        Command being timed: "sha256sum"
        User time (seconds): 10.09
        System time (seconds): 1.44
        Percent of CPU this job got: 98%
        Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 11.67s
        Average shared text size (kbytes): 0
        Average unshared data size (kbytes): 0
        Average stack size (kbytes): 0
        Average total size (kbytes): 0
        Maximum resident set size (kbytes): 4608
        Average resident set size (kbytes): 0
        Major (requiring I/O) page faults: 3
        Minor (reclaiming a frame) page faults: 58
        Voluntary context switches: 16
        Involuntary context switches: 305
        Swaps: 0
        File system inputs: 1698576
        File system outputs: 0
        Socket messages sent: 0
        Socket messages received: 0
        Signals delivered: 0
        Page size (bytes): 4096
        Exit status: 0
root@am62xx-evm:/home# time -v openssl dgst -sha256 <tisdk-default-image-am62xx-evm-11.00.09.04.rootfs.wic.xz
SHA2-256(stdin)= 80724f3bc5a5e22b544d9510d12a077e537b65c473a56d7e109a316f4a447e1d
        Command being timed: "openssl dgst -sha256"
        User time (seconds): 1.61
        System time (seconds): 1.07
        Percent of CPU this job got: 97%
        Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 2.74s
        Average shared text size (kbytes): 0
        Average unshared data size (kbytes): 0
        Average stack size (kbytes): 0
        Average total size (kbytes): 0
        Maximum resident set size (kbytes): 23552
        Average resident set size (kbytes): 0
        Major (requiring I/O) page faults: 14
        Minor (reclaiming a frame) page faults: 273
        Voluntary context switches: 11
        Involuntary context switches: 3
        Swaps: 0
        File system inputs: 1736
        File system outputs: 0
        Socket messages sent: 0
        Socket messages received: 0
        Signals delivered: 0
        Page size (bytes): 4096
        Exit status: 0
root@am62xx-evm:/home#

 

Conclusion:

#1. The benchmark are quite difference between checksum256 and openssl dgst -sha256 , with openssl is much quick.

#2. With cryptodev loaded or not, not obviously diffidence to each test method's benchmark.

Question:

#1. How to know whether hardware security accelerator is used or not. if unload the module means it won't be used, why the benchmark is almost same?

#2. Is there suggestion when to use sha256sum or openssl dgst -sha256, for example for difference data size?

  • #1. How to know whether hardware security accelerator is used or not. if unload the module means it won't be used, why the benchmark is almost same?

    Please refer to the kernel crypto driver link
    https://software-dl.ti.com/processor-sdk-linux/esd/AM62X/11_01_05_03/exports/docs/linux/Foundational_Components/Kernel/Kernel_Drivers/Crypto/SA2UL_OMAP.html#using-cryptographic-hardware-accelerators-from-openssl
    "Cryptodev is itself a special device driver which provides a general interface for higher level applications such as OpenSSL to access hardware accelerators..."
    "When the cryptodev driver is removed, OpenSSL reverts to the software implementation of the crypto algorithm..."

    #2. Is there suggestion when to use sha256sum or openssl dgst -sha256, for example for difference data size?

    - "sha256sum" is a single-purpose utility designed specifically for calculating and checking SHA-256 hashes of files.
    - "openssl dgst -sha256" is a versatile command within the comprehensive OpenSSL toolkit used for various cryptographic operations (hashing, signing, encryption, etc.).
    where "sha256sum" is generally SW implementation, whereases "openssl dgst -sha256" is either SW implementation or HW crypto engine based.

    Best,
    -Hong

  • Hi Hong,

    In my first post, I viewed this user guide page, then I tested either and get different result,  I make a table below to help understanding.

    first of all, all test result arm same, so I assume result are right.

    #1. In short, crypto loaded or not doesn't impact either sha256sum or openssl benchmark.

    #2. openssl sha256 result in below table looks  

    SDK10.1

    Linux am62xx-evm 6.6.58-rt45-ti-rt-01780-gc79d7ef3a56f-dirty #1 SMP PREEMPT_RT Wed Nov 27 14:15:26 UTC 2024 aarch64 GNU/Linux
    
    root@am62xx-evm:~# lsmod |grep cryptode
    cryptodev              40960  0
    root@am62xx-evm:~# lsmod |grep sa2ul
    sa2ul                  28672  0

    time -v sha256sum < 
    tisdk-default-image-am62xx-evm-11.00.09.04.rootfs.wic.xz
    time -v openssl dgst -sha256 <
    tisdk-default-image-am62xx-evm-11.00.09.04.rootfs.wic.xz

    crypto loaded:

    root@am62xx-evm:~# lsmod |grep sa2ul
    sa2ul                  32768  0
    authenc                12288  1 sa2ul
     Command being timed: "sha256sum"
      User time (seconds): 10.09
     System time (seconds): 1.44
     Percent of CPU this job got: 98%
     Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 11.67s
     Command being timed: "openssl dgst -sha256"
     User time (seconds): 1.61
    System time (seconds): 1.07 Percent of CPU this job got: 97% Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 2.74s

    crypto unloaded

    root@am62xx-evm:~# modprobe -r cryptodev
    [ 1210.056652] cryptodev: driver unloaded.
    Command being timed: "sha256sum"
    User time (seconds): 10.01
    System time (seconds): 0.60
    Percent of CPU this job got: 99%
    Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 10.67s
     Command being timed: "openssl dgst -sha256"
     User time (seconds): 1.48
     System time (seconds): 0.99
     Percent of CPU this job got: 98%
     Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 2.52s

    #2. SDK11.01.05.03:cryptodev module is not installed.in default, but benchmark is similar as upper table result.

    root@am62xx-evm:/home# modprobe -r cryptodev
    modprobe: FATAL: Module cryptodev not found.
    
    Linux am62xx-evm 6.12.35-ge3e551586dfa-dirty #1 SMP PREEMPT Fri Dec  5 11:20:58 CST 2025 aarch64 GNU/Linux
    root@am62xx-evm:~#


    time -v sha256sum < 
    tisdk-default-image-am62xx-evm-11.00.09.04.rootfs.wic.xz
    time -v openssl dgst -sha256 <
    tisdk-default-image-am62xx-evm-11.00.09.04.rootfs.wic.xz
    root@am62xx-evm:/home# modprobe -r cryptodev
    modprobe: FATAL: Module cryptodev not found.
    Command being timed: "sha256sum"
    User time (seconds): 10.14
    System time (seconds): 0.46
    Percent of CPU this job got: 99%
    Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 10.67s
    Command being timed: "openssl dgst -sha256"
    User time (seconds): 1.62
    System time (seconds): 0.89
    Percent of CPU this job got: 98%
    Elapsed (wall clock) time (h:mm:ss or m:ss): 0m 2.56s

    In the user guide mentioned no further configuration needed: 

    Build the Cryptodev kernel module using SDK

    For using OpenSSL to access the Crypto Hardware Accelerator Drivers above, the Cryptodev is required (can be built as module). The framework is not officially in the kernel and was ported to Linux under the name “cryptodev”. It is built as part of the SDK and no further configuration is needed

    Is hardware accelerator not used at all. Or always used with openssl ?

    #3. How to use/call hardware SA2UL/hardware sha256 from application C code to accelerate. 

  • Hi Tony,

    - "sha256sum" is system call utility which is only SW implementation.
    - "openssl dgst -sha256" can be configured to run SAx_UL engine based crypto operation.
    Please refer to the link for HW crypto performance and cpu load for your reference
    https://software-dl.ti.com/processor-sdk-linux/esd/AM62X/11_01_05_03/exports/docs/devices/AM62X/linux/Linux_Performance_Guide.html#crypto-driver

    It is possible to call openssl crypto lib in application c code, but I'm not aware of SAx_UL engine support available.

    Best,
    -Hong

  • Hong,

    Did you look at my test result, the time spent on the same file is same with or without crypto module

  • Hi Tony,

    SW crypto operations running on A53 @1.4 GHz can perform crypto operation compatible with HW crypto SAx_UL @400MHz. The performance also depends on the payload size. One of benefits running the HW crypto engine is CPU offloading. Have we checked the CPU loading with HW crypto engine & SW implementation.

    Best,
    -Hong