misc/132277: poor performance using criptodevice for IPSEC

[Patrick Lamaizière]

The following reply was made to PR kern/132277; it has been noted by GNATS.

From: Patrick =?ISO-8859-15?Q?Lamaizi=E8re?= <patfbsd at davenulle.org>
To: bug-followup at FreeBSD.org
Cc: Vasile Marii <marii.vasile at gmail.com>
Subject: Re: misc/132277: poor performance using criptodevice for IPSEC
Date: Sun, 8 Mar 2009 20:56:01 +0100

 Le Tue, 3 Mar 2009 07:42:44 GMT,
 Vasile Marii <marii.vasile at gmail.com>:
 
 Hi,
 
 > Does anybody have any better results on glxsb or via?(i mean a netperf
 > test between two machines) or there is a hack or a setting in the
 > kernel or somewhere else?
 
 I've made some tests on IPsec with glxsb and the performances are very
 bad (around 14 Mbits).
 
 I think the problem is that glxsb handles only one request at a time.
 When it is busy, it blocks the Open Crypto Framework with ERESTART and
 it unblocks the OCF when the previous request is completed. Then the OCF
 has to wake up and to resubmit the request. It looks like this performs
 very badly when using it with IPsec.
 
 If glxsb processes the requests synchronously it performs quite better,
 around 50 Mbits.
 
 I will look for glxsb.