Encrypting raid5 volume with geli

[Ivan Voras]

Ulf Lilleengen wrote:
> On Fri, Dec 12, 2008 at 11:07:40AM +0100, Ivan Voras wrote:
>> Ulf Lilleengen wrote:
>>> On tor, des 11, 2008 at 10:01:37pm -0600, Rick C. Petty wrote:
>>> *snip*
>>>> There are a set of patches that lulf@ has which I believe put the volume in
>>>> "up" state initially instead of "down", but maybe it only works for
>>>> mirrors.  The code in current and RELENG_7 does initially put the volume in
>>>> "down" state.
>>>>
>>> Yes, it only works for mirrors, since I thought it doesn't really matter if a
>>> mirror is properly initialized, since the user need to put data into the
>>> mirror for it to be useful anyway. The same goes for RAID-5 I guess, but I
>>> was not sure if it might trigger some weird behaviour since parity would not
>>> match if reading the volume. I will test out a small modification I made,
>>> which removes the need to run 'gvinum start' on the raid5 plexes.
>> It doesn't have to be "weird" behaviour, depending on whether gvinum
>> checks parity on reads (does it?). If it does, it will only have to
>> ignore checksum errors in this case.
> It does check parity on reads. But I think it doesn't matter, since no sane data
> has been written in that block anyway. 
> 
> But as you say, one way to handle it is to ignore the checksums if the data
> is known to not be initialized, but then wouldn't one have to keep track of
> which blocks have a valid parity and which who does not?
> 
>> I suppose people will want to run utilities like diskinfo -vt on the
>> volume with invalid parities so it's not a theoretical scenario :)
>>
> I guess, but I then one can just initialize the volume anyway.

In the interest of simplicity, maybe a single, well documented flag that
says "don't check checksums on reads" will do best. It will also
probably help read performance.

Of course, it should be off by default and its implications explained in
the man page :)

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 252 bytes
Desc: OpenPGP digital signature
Url : http://lists.freebsd.org/pipermail/freebsd-geom/attachments/20081212/8fb2f51f/signature.pgp