IPsec/IKE Asynchronous Cryptographic Support
Table of Contents >> IPsec/IKE Programmer's Reference
Asynchronous crypto support allows a task using the crypto engine to sleep while the crypto engine is processing the request. This is most useful when IPsec and IKE are run in their own task and the crypto engine support is offloaded to hardware. This allows the IPsec task, for example, to sleep while the hardware completes the request. During this timeframe, other tasks can be scheduled by the OS.
To enable asynchronous crypto support, define TM_USE_ASYNC_CRYPTO in <trsystem.h>.
When all data have been given to the crypto engine, call tfCryptoAsyncWait(). When crypto processing is complete, call tfCryptoAsyncSignal() from a task or tfCryptoAsyncSignalIsr() from an ISR.
Notes
- The user must be running in blocking mode to use asynchronous crypto capabilities.
- Asynchronous crypto is most useful when modules using the crypto engine are running in their own tasks.
- The user may need to add reentrancy protection to the crypto engine. For example, if IPsec and IKE are running in their own tasks and the IPsec task begins crypto processing then invokes tfCryptoAsyncWait(), the IKE task could then make a crypto call before the previous request had been completed.
Limitations
Asynchronous crypto functionality is only effective when used in a blocking environment with the modules that use encryption running in their own tasks. The current implementation of our crypto engine interface makes it nearly impossible to implement a pure encryption queueing mechanism; rather, the queueing must come above at the level of the modules using the crypto engine. Asynchronous crypto currently only supports a single lock. This means that if the user has more than one hardware encryption engine, they will all share the single lock/unlock point.
