ZFS encrypted raw send via 10 GBit network

After replacing my 4x 1000 MBit link aggregation with ASUS XG-C100C networking (10 GBit via Cat5e cables :D), I was astonished how slow data transfer took place. There were Several pitfalls which I debugged and here are some important points:

Before you debug your network, make sure, you solve the local problems first!

Linux GPL-only exports and ZFS CDDL module

For license reasons, kernel FPU functions are no longer exported for modules whose licenses differ from GPL. This led to an extreme performance drop in ZFS encryption, etc…
( factor 6 slower on some test equipment ). There are patches available for private usage which violate kernel GPL license, which is okay if not distributed and for research, you know 😉 However, I used an older kernel and I was not hit at all by this license quarrel. So this was not the problem for my bad transfer speed.

You debug this as follows:

look if fpu functions are global symbols:

grep fpu_begin /proc/kallsyms
0000000000000000 T __kernel_fpu_begin
0000000000000000 T kernel_fpu_begin
0000000000000000 r __ksymtab___kernel_fpu_begin
0000000000000000 r __ksymtab_kernel_fpu_begin
0000000000000000 r __kstrtab_kernel_fpu_begin
0000000000000000 r __kstrtab___kernel_fpu_begin

capital T tells global symbol is there

cat /sys/module/zcommon/parameters/zfs_fletcher_4_impl
[fastest] scalar superscalar superscalar4 sse2 ssse3

cat /sys/module/icp/parameters/icp_aes_impl 
cycle [fastest] generic x86_64 aesni

SSH is slow, don’t use it

If you send an encrypted stream, what sense does it make to encrypt it further by SSH? None! And SSH is quite slow – talking bout 90 MB/s on my machine with zfs send -w | ssh target zfs receive … It’s better to use netcat.

netcat is not netcat

There exist two versions of netcat. One is gnu-netcat the other is openbsd-netcat. The latter supports TCP windowing. Without this feature, I got around 88 MB/s, so even less than with SSH or at least not better. With openbsd-netcat however, I got 194 MB/s, which is approx the read speed of my spinning HDD I read from. (Yes, ZFS on a single disk… I know, I know).

A very handy debug method is ‚yes‘.

yes | netcat target port

Or classic with ‚dd‘:

netcat -l -p 4444 | dd of=/dev/null
dd if=/dev/zero | netcat localhost 4444

2772497408 bytes (2,8 GB, 2,6 GiB) copied, 5,52469 s, 502 MB/s

So as you can see, I cannot exceed 4 GBit locally, so I will never reach 10 Gbit by network. I have to buy faster hardware to do so. As long as the limiting factor is from the disks, I am fine with it.

 

Current limitation with transistor circuit

Some circuits require the input voltage to be current-limited. This can be achieved by a simple circuit using two transistors and two resistors.

In this example we have an input voltage VBB_BURN of 59 Volts, that has to be limited to 100 mA before it goes to the socket (VBB_SOCKET). Initially, the transistor Q2 on the right blocks and current flows through the transistor Q1, which is in saturation mode.
The voltage UEB is around 0.7 Volts giving 58.3 Volts on the upper point of R49.  The base current is therefore 59V / (R48 + R49).

Resistor R48 is the sense-resistor. If the voltage across it reaches around 0,7 Volts, Q2 will turn on which brings the base potential of Q1 to the same level as of the emitter. This stops the current through Q1 and the voltage across R48 will decrease again, until Q2 opens. This way, the circuit regulates itself at

I = 0.7 V / R48, flowing to VBB_SOCKET (at maximum).

Note: It is important that Q1 has a heat-sink, because if it goes out of saturation mode, it dissipates power, depending on the transistor type.

IBM XT-BIOS compilation and testing on temporary systems

Compile the IBM XT-BIOS from source

Dedicated to my friend Peer (as he loves the IBM PC and not the Mac, he just doesn’t know that he does)

Prerequisites

Steps

1. Create a hard disk for your toolchain environment

We will create a virtual harddisk with 3000 cylinders, 6 heads and
19 sectors per track, giving a total of `3000*6*19*512` Bytes.

$ dd if=/dev/zero of=hdd.img bs=512 count=$((3000*6*19))

2. Create a boot disk image file for later use with the IBM PC

MS-DOS 6 will not like it, when you create a partition with parted, because the partition has a too big offset. Just take a bootable disk and start with this floppy to natively format the hard drive with MS-DOS.

3. Now create a floppy that we will later use to boot the emulated IBM PC

$ dd if=/dev/zero of=bootdisk.img bs=512 count=$((40*2*9))

4. Boot the virtual machine with MS-DOS 6 and the `bootdisk.img`.

MS-DOS will start and you can run `fdisk`.

A:\>fdisk

Tell fdisk that you want to use the whole fixed disk and the system should restart.

Boot from floppy again and run

A:\>format C: /s
A:\>md C:\DOS
A:\>copy A:*.* C:\DOS

Assuming that the DOS binaries and files are all in the root directory of A:. If not, adapt the last command accordingly.

5. Stop the simulator and copy the Intel toolchain into the hdd image

First get the offset of the partition on `C:`

$ parted hdd.img
(parted) p

This will display the offset of the partition, which was `9728B` for my case. Then you can mount the partition in linux having this offset.

sudo mount -o offset=9728 hdd.img /mnt

Please only work with 8.3 file names now in capital letters, just because!

mkdir /mnt/INTEL
cp <intel-toolchain-dir>/* /mnt/INTEL

6. Copy the source listing of the BIOS to `C:\BIOS`

mkdir /mnt/BIOS
cp <bios-listing>/XTBIOS.ASM /mnt/BIOS

Now you can either unmount and change the BIOS listing later with `edit` in MS-DOS or in Linux with vim.

7. Patch the source code

The following changes must be made to the source:

In the part ‚DTERMINE CONFIGURATION AND MFG. MODE‘, line 616, there is

MOVE DATA_WORD[OFFSET EQUIP_FLAG],AX

Change it to

MOVE DATA_WORD[OFFSET EQUIP_FLAG],0000000000101101B

This means that there is one floppy drive and that we can boot from it
as well as we have CGA and start with 80×25.

At line 1237, I had a

AND AL, 00000001B ; ‚LOOP POST‘ SWITCH ON
JNZ F15B ; ‚ CONTINUE WITH BRING-UP

Which is nonsense. Since ‚LOOP POST‘ will do a loop in the post and NOT continue bring up, the jump should be executed when the bit is 0 and not non-zero. However, only the comment is wrong, because the switch is not ‚LOOP POST‘ but ‚BOOT FROM FLOPPY‘ or something like this. The function would be okay. However in my case, I patched this, before I touched the config switches read-in, so I had patched this to

OR AL, 00000001B
JNZ F15B ; ‚ CONTINUE WITH BRING-UP

So that it will always continue booting here, no matter what any switches value says.

Furthermore, there is a checksum function, that also checks the non-existant BASIC ROM at `F6000` which must be faked to always return true for the moment (the BASE ROM also has a wrong / non existing checksum).

At line 5246 in the `ROS CHECKSUM SUBROUTINE` we have

OR AL, AL ; SUM = 0?

Change this to

XOR AL, AL

Then every checksum test will be successful.

8. Compile the code

Now we can compile this code. For future changes to the code it is conveniant to have a DOS batch file for not always having to type in all the commands.

\INTEL\ASM86 XTBIOS.ASM
\INTEL\LINK86 XTBIOS.OBJ
\INTEL\LOC86 XTBIOS.OBJ
\INTEL\OH86 XTBIOS
\INTEL\DXC XTBIOS.HEX

This will produce an `XTBIOS.IMG` with a siye of `1FFE` or `8190 bytes`.

9. Deploy the image for the emulator

Copy it out of the image. By the way, it is easier if you copy the file to a floppy in the emulator, i.e. to the bootdisk and then use

$ mcopy -i bootdisk.img ::/XTBIOS.IMG .

The `mcopy` tool is written to work with DOS drive letters in linux and the `::` special drive letter means, that it refers to the image file.

10. Create a test boot disk for the emulated IBM PC

Install the MS-DOS system files and boot sector on the previously created 360K floppy image:

C:\>format /s /f:360 B:

Thats it.

11. Run the PC emulator with the `XTBIOS.IMG` and the 360K boot disk image.

./pce-ibmpc -c my.cfg

cga_init

post

dosboot

arcade

New Bathroom – Part 1

„How can you use this?“ – a friend asked me. He added „Your bathroom is the most terrible I have ever seen! I first didn’t notice… but it really is f***** up !!“

Well – he was right 🙂 So… also a nice bathroom can be quite attractive to women… I decided to get rid of it and renew everything. I mean it is around 50 years old. I remember my grandfather using it, who died in 1989. And even then… it was old.

20161223_205833

Yeah… and it mostly was in a great mess… actually it was only used for washing cloths… so quite unusable.

One day before Christmas, I tried how difficult it was to remove the tiles, which was quite easy.

20161223_205819

To be able to do any serious work… I had to move the washing machine into the first floor. The stairs are really narrow and I could never have lifted it alone, so I ordered a hand truck for stairs. After I got it, the manual said „do not use on stairs, do not move backwards“ – well… that was what I bought it for…

20161226_132048 20161226_13411620161226_150412

After moving the washing machine upstairs, free space increased by around 30% 😛

20161227_140508

2016/12/29

I found out that the bath tube was enclosed by a Ytong wall. I bought a 12 kg hammer and did some full hits onto the tube, which helped in setting it free. I continued with the tiles…

20161229_13362820161229_135226

20161229_184341 20161229_140159 20161229_195639 20161229_195647

2016/12/30

Actually, I wanted to flex the tube apart. However, besides setting the bath room under sparks, the tube did not mind and I only carved a few scratches into it… I assumed it was no steel sheet but cast iron and I abandoned that idea. Instead I got angry and pulled on it forcefully and finally managed to move it outside.

Interestingly, behind the tube, the wall was not plastered and one of the water pipes was standing out of the wall… even better was the connection of the grounding wires… which came together from all over the place and met just in the center of the tube. WTF.

img-20161230-wa001020161230_13593320161230_135955 20161230_142018

2016/12/31

Yeah, the garden looked spooky and the sun rays gave me the impression of god blessing my work so I just continued with that mess 😛 I was hoping to be able to remove the concrete like screed with my new drill hammer… well it kind of worked…

img-20161231-wa0003img-20161231-wa0005img-20161231-wa0009

2017/01/01

4 hours later…

20170101_172635

2017/01/02

20170102_214446

2017/01/03

4 hours later again…

20170103_233731

2017/01/04

and another 3 hours…

20170104_215426

2017/01/06

And finally… I felt like giving a party for having removed that monster screed… I had numbered the tiles that were removed accidentally to restore them later.

20170106_132933  20170106_132941

Now, it’s time to start turning this bathroom into something cool…

20170106_152629

Systemd – How to setup a openvpn connection

Enabled services: systemd-resolved

NOTE: Replace ${systemconfig} by your etc directory. I am not allowed to write this directory path due to
server policy rules I cannot change.

Assuming you have a working openvpn configuration named

${systemconfig}/openvpn/client.conf

then the only step to activate the openvpn connection is to type

systemctl start openvpn@client.service

which automatically looks for the client.conf file. If you use systemd-resolved and have
${systemconfig}/resolv.conf pointing to /run/systemd/resolve/resolv.conf, you can create a simple bash
script to temporarily overwrite the DNS entries appropriate for your VPN tunnel.

For example, you can create an executable file in ${systemconfig}/openvpn/update-systemd-resolved:

cat > ${systemconfig}/resolv.conf <<EOF
search blah.server.com server.com
nameserver xxx.yyy.zzz.vvv
EOF

with according IP addresses and search entries. Then you can use this script as a hook by
adding the following to your ${systemconfig}/openvpn/client.conf:

script-security 2
setenv PATH /usr/bin
up ${systemconfig}/openvpn/update-systemd-resolved

After starting the connection with systemctl, the name resolution should work according
to your vpn settings. After stopping the openvpn@client.service, the resolv.conf should
be automatically generated again.

Samsung CLP-320 Printer with Cups

Required packages: cups, ghostscript, gsfonts, gutenprint

When you plug-in your printer via USB, you should see similar kernel messages via ‚dmesg -H‘:

usb 4-1.1: reset high-speed USB device number 3 using ehci-pci
[ 2576.915714] usblp 4-1.1:1.0: usblp1: USB Bidirectional printer dev 3 if 0 alt 0 proto 2 vid 0x04E8 pid 0x329F

The printer is accessible via /dev/usb/lp1

Next step is to register the printer in the cups server. You can access the server via http://localhost:631.

For administration, you have to log-in with root access. You should activate your root account and set a password with ’sudo passwd root‘. I did not manage to gain access with another user, despite I added local groups to SystemGroups in cupsd.conf.

You need a working pdd file for the printer. I downloaded the Samsung printer driver for linux and got the file from the ‚uld/noarch/share/ppd‚ directory. You can use this file inside the administration panel of cups web interface when you register the printer.

PulseAudio and Alsa

Alsa is the standard sound system with hardware support and PulseAudio is an additional system which can use Alsa devices.

PulseAudio is necessary for flash videos in firefox to play with sound and also my skype installation needed PulseAudio.

For volume control one can easily use amixer from Alsa. Most problems arose from wrong default devices selected by PulseAudio.
You can change those with the pacmd command and use the corresponding index.

The commands for pacmd are

list-sinks, list-sources, set-default-sink, set-default-source

where you can give the index of the propper Alsa device.

If timidity server is running in background it blocks Alsa on my system. I have to manually stop the timidity-daemon before I can access Alsa devices from other software.

Setting up WLAN

Required: Kernel supports network adapters
Required packages: iw wpa_supplicant dialog

You can check, if your kernel has a module loaded for a specific hardware by using the lsmod and the lspci commands. You can issue lspci -k to see a list of pci devices together with the loaded kernel module.

If your networking device is supported by the kernel, you can issue the command

wifi-menu -o

to connect to an existing wlan. The -o option creates a corresopnding connection profile in the /etc /netctl folder.

To startup the wifi connection automatically on boot, run

netctl enable PROFILENAME

and to disable

netctl disable PROFILENAME

These commands create/remove symbolic links for the systemd daemon. You can list all available profiles with

netctl -l