Encrypting raid5 volume with geli

[Ulf Lilleengen]

On Fri, Dec 12, 2008 at 11:07:40AM +0100, Ivan Voras wrote:
> Ulf Lilleengen wrote:
> > On tor, des 11, 2008 at 10:01:37pm -0600, Rick C. Petty wrote:
> > *snip*
> >> There are a set of patches that lulf@ has which I believe put the volume in
> >> "up" state initially instead of "down", but maybe it only works for
> >> mirrors.  The code in current and RELENG_7 does initially put the volume in
> >> "down" state.
> >>
> > Yes, it only works for mirrors, since I thought it doesn't really matter if a
> > mirror is properly initialized, since the user need to put data into the
> > mirror for it to be useful anyway. The same goes for RAID-5 I guess, but I
> > was not sure if it might trigger some weird behaviour since parity would not
> > match if reading the volume. I will test out a small modification I made,
> > which removes the need to run 'gvinum start' on the raid5 plexes.
> 
> It doesn't have to be "weird" behaviour, depending on whether gvinum
> checks parity on reads (does it?). If it does, it will only have to
> ignore checksum errors in this case.
It does check parity on reads. But I think it doesn't matter, since no sane data
has been written in that block anyway. 

But as you say, one way to handle it is to ignore the checksums if the data
is known to not be initialized, but then wouldn't one have to keep track of
which blocks have a valid parity and which who does not?

> I suppose people will want to run utilities like diskinfo -vt on the
> volume with invalid parities so it's not a theoretical scenario :)
> 
I guess, but I then one can just initialize the volume anyway.

-- 
Ulf Lilleengen