Aesni0: No SSE4.1 support.

MichelZ

Continuing the aesni0: No SSE4.1 support. thread here: https://forum.pfsense.org/index.php?topic=82960.15

Anything we can do to find out what feature that seems to be missing?
SSE4.1 has been around for some time now (since Penryn), and our VMWare Cluster EVC Mode definitely supports this.

Thanks
Michel

mreardon

I get the same problem with my VM running under Xen 4.5, so I don't believe the problem is exclusive to VMWare. Similarly to as stated in the forum, if I take the aesni.ko from a standard FreeBSD 10.1 build, the module loads up fine and acceleration appears to be working properly.

eri--

Two possibilites:

You have installed pfSense i386(32 bit) which is not supported by aesni.
Provide a VM to troubleshoot this issue

razer0r

@ermal:

Two possibilites:

You have installed pfSense i386(32 bit) which is not supported by aesni.

Provide a VM to troubleshoot this issue

I have the same issue, running ESXi 5.5 update 2

What would you exactly need?

eri--

VM to replicate the issue with pfSense loaded?

razer0r

https://cloud.breeze.be/public.php?service=files&t=23e71d66e049dd9f1966eb804012efda

password: ********

default install, only enabled the aes-ni extension from the Advanced menu

When booting you should already see the message about SSE4.1 not being available.

eri--

Ok give this module a shot.
Just replace the file under /boot/kernel with this one.
Need to rename it to aesni.ko before.

It attaches for me and the fix will be pushed to pfSense 2.2.+

aesni.ko.txt

razer0r

seems to load, and CPU offloading seems to work as well :-).

I only have one AES-NI capable firewall, so I can't see my max IPSec throughput, but the cpu went down from 90% to 28% with the same 80Mbit throughput test.

dmesg output shows this:

[2.2-RELEASE][root@firewall022]/root: dmesg | grep aes
aesni0: No SSE4.1 support.
aesni0: <aes-cbc,aes-xts,aes-gcm> on motherboard
warning: KLD '/boot/kernel/aesni.ko' is newer than the linker.hints file
aesni0: <aes-cbc,aes-xts,aes-gcm> on motherboard</aes-cbc,aes-xts,aes-gcm></aes-cbc,aes-xts,aes-gcm>

ACiD GRiM

+1 to confirm this works, went from 40Mbps to 77Mbps on a shared CPU VPS on VMWare with a drop from 75% to 30% CPU.

Thanks so much for this!

miloman

it works.

thank you ermal!