hifn(4) (crypto hardware) and geli(8)

knarf · Apr 8, 2010

I've tried a vpn1401 (PCI card) in two different machines (both 8.0-RELEASE-p2, i386 and amd64). I've added hifn_load="YES" to the loader.conf and I saw "GEOM_ELI: Crypto: hardware" during kernel boot. But both systems stopped working when accessing the eli devices (zfs import in my case). The system works fine without the card.

Is anybody of you using this card successfully with 8.0-RELEASE?

eyebone · Apr 8, 2010

knarf said:
Is anybody of you using this card successfully with 8.0-RELEASE?

nope. but i was planning to test it in the next weeks as well. i have high interest at the performance plus for the symmetric crypto operations.

Zare · Apr 8, 2010

I thought that Soekris Engineering cards are fully supported on BSD.
Are you sure that card is ok? Have you tried using another PCI slot? Check the BIOS interrupt allocation also, see if it's sharing IRQs with something else.

knarf · Apr 8, 2010

Zare said:
Are you sure that card is ok?

No. But it's detected properly by FreeBSD and geli is willing to use it (output changes from GEOM_ELI: Crypto: software to hardware). And I was told it was working in a FreeBSD server a while ago.

Zare said:
Have you tried using another PCI slot? Check the BIOS interrupt allocation also, see if it's sharing IRQs with something else.

I've tried the card in two different systems with the same result. Both were PentiumIVs, so PCI-IRQ problems should not happen at all.

Maybe I should try to use the card in a system that does not use eli at all yet. Hmm, I think all of my swap partitions are encrypted.

knarf · Apr 8, 2010

eyebone said:
i have high interest at the performance plus for the symmetric crypto operations.

I do not expect a performance plus for the crypto operations.

If you're interested in a perfomance plus, get a current CPU. I've just switched from a PIV 3.0 GHz HT to a Core i7 920 (4x2.67GHz HT).

A zpool scrub of my 10 eli disk raidz2 (8.12TiB, 3.72TiB used) took 24 hours. Load was about 10. Now it takes 6 hours and load is about 40. Before the system was a bit slow during the scrub. Now it feels very comfortable.

(Most of) the disks are still at the same controller (3ware 9550SX-8LP, PCI-X, 133 MHz).

But I'd still like to use the card in the PIV machine. I like the idea of not using the CPU for encryption here, because I know the CPU is not able to handle full disk speed anyway and adding another "CPU" (for all the g_eli threads) can give me an _overall_ performance plus.

What benchmark should I use to compare the g_eli performance?

eyebone · Apr 9, 2010

knarf said:
I do not expect a performance plus for the crypto operations.
If you're interested in a perfomance plus, get a current CPU.

right right, crypto accelerators make more sense on the cpu side in systems which just have a small cpu but vpn's to handle. one thing it defintly can support is the delivery of better PRNG. btw. to my current knowledge the asymmetric crypto functions in the hifn card are not supported by *bsd.
(please have a look to obsd and fbsd manpages)

I've just switched from a PIV 3.0 GHz HT to a Core i7 920 (4x2.67GHz HT).

oh dear! this must have cost u a leg

the new intel series is crazy. i just testing a core i5 520M, 2 cores handling 2 threads + this turbo-boost thingie...i just wished they have got lost this highfrequent noise their cpus are make because of the speedstepping technology

What benchmark should I use to compare the g_eli performance?

i stick here to board tools, zfs iostat, iostat, dd and so on. maybe scripting something nice in the future.

regards,