Bug#629636: linux-image-2.6.32-5-kirkwood: IPsec aes-sha1 with kirkwood/mv_cesa causes CPU to spin

[Arnaud Patard (Rtp) <arnaud.patard@rtp-net.org>]

Sebastian Andrzej Siewior <sebastian@breakpoint.cc> writes:

Hi,

> * Alexander Clouter | 2011-06-08 09:54:58 [+0000]:
>
>>Whilst deploying IPsec (with strongswan-ike2) I ran into a complication[1]
>>that causes mv_cesa to spin the CPU when the system receives an IPsec ESP
>>packet; it seems to be able to send traffic (before the CPU spin) as a
>>ICMP Echo request (a la pin) out from the system out is okay, until the
>>ICMP Reply comes back.  The packet never 'arrives' as far as userspace is
>>concerned and the only way to stop the CPU spinning is a reboot.
>
> I've been working on that and forgot about it in the meantime. The
> problem is that incremental sha1 checksum are wrong i.e. the previous
> state is ignored by the hardware.

if it's known to be broken, what about disabling it and enable it when
it's working ?
Also, I'm not familiar with cesa support but from what I understand in
the manual, you need to change the mode bit of the 0x3dd18 regiter to
configure continuous mode and I don't see anything for that [ feel free
to correct me if I'm wrong on that ].

Also, do you have a small test case to reproduce that ?

> Kernel's auto-test droppped an error message which disappeared in later
> a kernel so I assumed that it was fixed. This was not case but
> "oldconfig" disabled the algorithm test.

You're talking of CRYPTO_MANAGER_DISABLE_TESTS, right ?

Arnaud