Modern CPUs AES-NI enabling system wide

classic Classic list List threaded Threaded
9 messages Options
Reply | Threaded
Open this post in threaded view
|

Modern CPUs AES-NI enabling system wide

Denis Lapshin-2
How to enable AES-NI AES system wide hardware acceleration support for
crypto disciplines like LibreSSL, softraid0 crypto etc?

Reply | Threaded
Open this post in threaded view
|

Re: Modern CPUs AES-NI enabling system wide

Juan Francisco Cantero Hurtado
On Sun, Feb 03, 2019 at 11:35:52AM +0300, Denis wrote:
> How to enable AES-NI AES system wide hardware acceleration support for
> crypto disciplines like LibreSSL, softraid0 crypto etc?

If your CPU supports AES-NI, the kernel and base software will use it by
default.


--
Juan Francisco Cantero Hurtado http://juanfra.info

Reply | Threaded
Open this post in threaded view
|

Re: Modern CPUs AES-NI enabling system wide

Solene Rapenne
In reply to this post by Denis Lapshin-2
Denis <[hidden email]> wrote:
> How to enable AES-NI AES system wide hardware acceleration support for
> crypto disciplines like LibreSSL, softraid0 crypto etc?

Hi, just enable it in bios.

Reply | Threaded
Open this post in threaded view
|

Re: Modern CPUs AES-NI enabling system wide

Stuart Henderson
In reply to this post by Juan Francisco Cantero Hurtado
On 2019-02-03, Juan Francisco Cantero Hurtado <[hidden email]> wrote:
> On Sun, Feb 03, 2019 at 11:35:52AM +0300, Denis wrote:
>> How to enable AES-NI AES system wide hardware acceleration support for
>> crypto disciplines like LibreSSL, softraid0 crypto etc?
>
> If your CPU supports AES-NI, the kernel and base software will use it by
> default.

You do need to pick suitable ciphers though. And it is only supported
on OpenBSD/amd64 not OpenBSD/i386.


Reply | Threaded
Open this post in threaded view
|

Re: Modern CPUs AES-NI enabling system wide

Christian Weisgerber
On 2019-02-03, Stuart Henderson <[hidden email]> wrote:

>> If your CPU supports AES-NI, the kernel and base software will use it by
>> default.
>
> You do need to pick suitable ciphers though. And it is only supported
> on OpenBSD/amd64 not OpenBSD/i386.

Only the kernel support (IPsec, softraid crypto) is limited to
amd64.  The userland can still use AES-NI on i386; specifically,
LibreSSL does.  Of course all CPUs that support AES-NI can also run
amd64.

--
Christian "naddy" Weisgerber                          [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: Modern CPUs AES-NI enabling system wide

Denis Lapshin-2
Thank you for answers.

As I understand you right amd64 kernel supports AES-NI for ipsec,
softraid, and LibreSSL only. Right?

Just wonder, how to check softraid discipline exactly utilizes AES-NI
instruction set on amd64 machine?

Softraid created bioctl -r 8192 (for test purposes) works relatively
slow ~10~12Mb/s on AES-NI enabled machines. Tested for Intel and AMD CPUs.

cp command utilizes about 22% of CPU usage while copying.

On 2/4/2019 1:49 AM, Christian Weisgerber wrote:

> On 2019-02-03, Stuart Henderson <[hidden email]> wrote:
>
>>> If your CPU supports AES-NI, the kernel and base software will use it by
>>> default.
>>
>> You do need to pick suitable ciphers though. And it is only supported
>> on OpenBSD/amd64 not OpenBSD/i386.
>
> Only the kernel support (IPsec, softraid crypto) is limited to
> amd64.  The userland can still use AES-NI on i386; specifically,
> LibreSSL does.  Of course all CPUs that support AES-NI can also run
> amd64.
>

Reply | Threaded
Open this post in threaded view
|

Re: Modern CPUs AES-NI enabling system wide

Theo de Raadt-2
Denis <[hidden email]> wrote:

> Thank you for answers.
>
> As I understand you right amd64 kernel supports AES-NI for ipsec,
> softraid, and LibreSSL only. Right?

That word "only".... what does it mean... AES-NI isn't used to blink the
cursor?  Please be careful of what you imply.

> Just wonder, how to check softraid discipline exactly utilizes AES-NI
> instruction set on amd64 machine?

AES-NI is used.  You've been told so.

> Softraid created bioctl -r 8192 (for test purposes) works relatively
> slow ~10~12Mb/s on AES-NI enabled machines. Tested for Intel and AMD CPUs.
>
> cp command utilizes about 22% of CPU usage while copying.

So you ignored the cost of doing IO to the disk.

Can you get to the point about what you believe is going?  I think you are
grasping at straws.







Reply | Threaded
Open this post in threaded view
|

Re: Modern CPUs AES-NI enabling system wide

Denis Lapshin-2
They in his usual style...

I understand, thanks for reply. Expecting better IO results only.

On 2/4/2019 12:00 PM, Theo de Raadt wrote:

> Denis <[hidden email]> wrote:
>
>> Thank you for answers.
>>
>> As I understand you right amd64 kernel supports AES-NI for ipsec,
>> softraid, and LibreSSL only. Right?
>
> That word "only".... what does it mean... AES-NI isn't used to blink the
> cursor?  Please be careful of what you imply.
>
>> Just wonder, how to check softraid discipline exactly utilizes AES-NI
>> instruction set on amd64 machine?
>
> AES-NI is used.  You've been told so.
>
>> Softraid created bioctl -r 8192 (for test purposes) works relatively
>> slow ~10~12Mb/s on AES-NI enabled machines. Tested for Intel and AMD CPUs.
>>
>> cp command utilizes about 22% of CPU usage while copying.
>
> So you ignored the cost of doing IO to the disk.
>
> Can you get to the point about what you believe is going?  I think you are
> grasping at straws.
>
>
>
>
>
>
>

Reply | Threaded
Open this post in threaded view
|

Re: Modern CPUs AES-NI enabling system wide

Jordan Geoghegan
In reply to this post by Denis Lapshin-2

On 02/04/19 00:54, Denis wrote:
> Softraid created bioctl -r 8192 (for test purposes) works relatively
> slow ~10~12Mb/s on AES-NI enabled machines. Tested for Intel and AMD CPUs.
>

I am able to read and write over 100MB/s from my softraid volume... I
just backed up my home folder to my NAS and was able to hit gigabit line
speed with CPU usage remaining low. I'm able to do this on my i7 3770
system and my Ryzen 2600x system.