VIA Padlock (C3/C7) Crypto engine question

[strafelife]

I googled around, and searched the forums for an answer…Perhaps I'm missing the clue on how to answer this.  I've deployed several pfSense boxes on some VIA C3 / C7 boxes, and I configured IPsec to use aes-128, at least knowing that the Padlock engine accelerates AES.

Saw this little bit:  http://www.docunext.com/wiki/PfSense_test_results_of_the_padlock_kernel_driver_on_a_VIA_C7

How do I verify that pfSense makes optimal use of padlock?  With Hifn the cards are recognized and displayed in the System overview.  I ran the openssl benchmarks, and validated that padlock works (confirming at least that FBSD can make use of it) without loading kldload padlock...

Is there a "top" equivalent for crypto? Is kldload padlock required anymore (doesn't work with 1.2.3RC2: pfSense-Full-Update-1.2.3-20090722-0348 )

I apologize ahead of time if I missed a previous discussion on this, but I wasn't able to find answers here.  thank you!

[joebarnhart]

I would also like to know about padlock and pfSense.  This could be a killer feature for users of VPNs.

I'd like to know if pfSense currently supports the Via padlock feature, and if so how to enable it on ipsec and openvpn.

Pretty please!

[dotdash]

My build of 1.2.3 shows:
kldstat -v | grep padlock
(nothing)
safe, ubsec, and hifn show as compiled in.
You could try copying the module from stock 7.2 and kldloading it. You could look for the thread on glxsb, there are some notes and the procedure would be essentially the same with the padlock module.
My advice would be to manually load it, test, then submit a feature request to have it included in future builds.

[joebarnhart]

Ah.  Thanks for the answer.  Maybe someone with more FreeBSD chops will take a look at it.  The Via is a pretty popular platform so someone will add it eventually…

[jimp]

Have you looked at this?

http://doc.pfsense.org/index.php/Are_cryptographic_accelerators_supported

I'm using cryptodev just fine on ALIX hardware in a few places.

Not sure if anything benefits from padlock though, I don't know that I have any hardware running pfSense that has real padlock support.

[fastcon68]

I saw the eval command and thought I run it against my virtual machine(quad phemon 2.5 GHZ processor).  I have 2 processors dedicated to my firewall.

$ openssl speed -evp aes-128-cbc
OpenSSL 0.9.8e 23 Feb 2007
built on: Fri May 15 13:50:54 EDT 2009
options:bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) aes(partial) blowfish(idx)
compiler: cc
available timing options: USE_TOD HZ=128 [sysconf value]
timing function used: getrusage
The 'numbers' are in 1000s of bytes per second processed.
type            16 bytes    64 bytes    256 bytes  1024 bytes  8192 bytes
aes-128-cbc      68862.24k    74318.49k    76634.68k    77303.50k    77649.46k

$ openssl speed -evp aes-128-cbc -engine cryptodev
OpenSSL 0.9.8e 23 Feb 2007
built on: Fri May 15 13:50:54 EDT 2009
options:bn(64,32) md2(int) rc4(idx,int) des(ptr,risc1,16,long) aes(partial) blowfish(idx)
compiler: cc
available timing options: USE_TOD HZ=128 [sysconf value]
timing function used: getrusage
The 'numbers' are in 1000s of bytes per second processed.
type            16 bytes    64 bytes    256 bytes  1024 bytes  8192 bytes
aes-128-cbc      68590.93k    74215.00k    76918.08k    77146.59k    77406.33k

I don't have any encryption hardware.  That is supported at this time.  How do my numbers compare to other people's systems.  I thinking about moving some hardware around and debating about replacing a server.  I don't what to take to big of a performance hit.
RC