hifn accelerator slows things down?

Machine A is a Soekris net4801, capable of taking a vpn1411 (which,
when present, is handled by the hifn driver).  The CPU is

cpu0 at mainbus0: (uniprocessor)
cpu0: National Semiconductor Geode GX1 (586-class), 266.67 MHz, id 0x540
cpu0: features 808131<FPU,TSC,MSR,CX8>
cpu0: features 808131<CMOV,MMX>
cpu0: I-cache 12K uOp cache 8-way

Machine B is a Pentium III at 550MHz, sufficiently overmuscled that I
doubt it is responsible; it's

cpu0 at mainbus0: (uniprocessor)
cpu0: Intel Pentium III (686-class), 551.29 MHz, id 0x681
cpu0: features 383f9ff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,SEP,MTRR>
cpu0: features 383f9ff<PGE,MCA,CMOV,PAT,PSE36,MMX>
cpu0: features 383f9ff<FXSR,SSE>
cpu0: I-cache 16 KB 32B/line 4-way, D-cache 16 KB 32B/line 4-way
cpu0: L2 cache 256 KB 32B/line 8-way
cpu0: ITLB 32 4 KB entries 4-way, 2 4 MB entries fully associative
cpu0: DTLB 64 4 KB entries 4-way, 8 4 MB entries 4-way
cpu0: 8 page colors

Both are running 2.0.  I've installed OpenVPN from pkgsrc
(net/openvpn).

I find that having the vpn1411 in place actually makes things slower.

The Soekris is on 10Mb.  I can copy 10MB of /dev/zero over the net from
A to B in some 10-12 seconds when using the underlying network directly
(this is approximately line rate, not surprisingly).  When going
through the openvpn tunnel, with the hifn in place it takes about 21
seocnds, without, 16.

At first sight this seems surprising - an accelerator makes things
slower? - but on reflection it's not all that impossible; presumably
the syscall overhead cost is swamping the crypto speedup.  (I assume
the hifn would actually help something like IPsec that's entirely
in-kernel and hence doesn't have to pay a syscall cost to talk to the
accelerator chip.)

Is this to be expected?  Or does it indicate something's busted?

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email protected]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B