From owner-freebsd-stable@FreeBSD.ORG Thu Mar 19 01:36:31 2015 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id E5DE9221 for ; Thu, 19 Mar 2015 01:36:31 +0000 (UTC) Received: from smarthost1.sentex.ca (smarthost1.sentex.ca [IPv6:2607:f3e0:0:1::12]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "smarthost.sentex.ca", Issuer "smarthost.sentex.ca" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 6C16FD30 for ; Thu, 19 Mar 2015 01:36:31 +0000 (UTC) Received: from [IPv6:2607:f3e0:0:4:f025:8813:7603:7e4a] (saphire3.sentex.ca [IPv6:2607:f3e0:0:4:f025:8813:7603:7e4a]) by smarthost1.sentex.ca (8.14.9/8.14.9) with ESMTP id t2J1aTEU028351; Wed, 18 Mar 2015 21:36:29 -0400 (EDT) (envelope-from mike@sentex.net) Message-ID: <550A280B.5030107@sentex.net> Date: Wed, 18 Mar 2015 21:36:11 -0400 From: Mike Tancsa Organization: Sentex Communications User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 MIME-Version: 1.0 To: Matt Smith , John-Mark Gurney , FreeBSD-STABLE Mailing List Subject: Re: 35-40% performance drop releng9 vs releng10 openvpn References: <5506250A.2000506@sentex.net> <20150316132055.GQ32288@funkthat.com> <5509D6C6.4050204@sentex.net> <20150318211457.GL51048@funkthat.com> <5509FC19.2020201@sentex.net> <20150318224034.GG1271@xtaz.uk> <550A110A.6070301@sentex.net> In-Reply-To: <550A110A.6070301@sentex.net> Content-Type: multipart/mixed; boundary="------------020102090000090903010509" X-Scanned-By: MIMEDefang 2.75 X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Mar 2015 01:36:32 -0000 This is a multi-part message in MIME format. --------------020102090000090903010509 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit And compiling 1.0.1l on RELENG_9 shows the same performance profile on RELENG_10. Smaller packets are slower, larger are faster 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 20245.49k 21646.52k 22179.87k 55431.85k 55981.40k R10 34178.77k 35559.29k 36305.70k 36481.34k 36495.49k R9 20278.40k 21642.28k 22170.71k 56873.98k 57387.69k R9Port But for my application, I still get better speeds on RELENG_9, even when using the same version of openssl across RELENGs. I do the test with the 3 FreeBSD boxes server1 ---- apu ---- server2 server1 is connected to the apu with openvpn. I then usr /usr/src/tools/tools/netrate/netblast to send across the openvpn tunnel to server2 on RELENG9 I get 83-85Mb/s on RELENG10 61Mb/s Using polarSSL does not make much of a difference either way. Its perhaps 1Mb slower on both, so 82-83 vs 83-85 on R9 and 59-60Mbs vs 61-20Mb/s on RELENG10. But, on RELENG_9, if I install openssl from the ports, and compile openvpn and link against it, I get 85-87Mb/s of throughput on RELENG_9. So while there are speed differences between the versions of openssl, it doesnt seem to matter in the OpenVPN case, as its the base OS that makes the difference since both versions of OpenSSL on RELENG9 give similar performance in my openvpn test On RELENG_9, the dtrace command I use on 10 does not seem to work 0{alix_APU1c4}# dtrace -x stackframes=100 -n 'profile-997 /arg0/ { @[stack()] = count(); } tick-60s { exit(0); }' -o out.kern_stacks9 dtrace: invalid probe specifier profile-997 /arg0/ { @[stack()] = count(); } tick-60s { exit(0); }: "/usr/lib/dtrace/regs_x86.d", line 2: type redeclared: struct devinfo 1{alix_APU1c4}# ---Mike On 3/18/2015 7:58 PM, Mike Tancsa wrote: > On 3/18/2015 6:40 PM, Matt Smith wrote: >> Isn't OpenSSL in the base on releng9 the 0.9.8 version whereas in >> releng10 it's the 1.0.1 version? This could make a significant >> difference. I've heard rumours before that the newer version is a lot >> slower but I've never had cause to believe it. >> > > openssl speed aes-128-cbc > > 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes > 20245.49k 21646.52k 22179.87k 55431.85k 55981.40k R10 > 34178.77k 35559.29k 36305.70k 36481.34k 36495.49k R9 > > R9 OpenSSL 0.9.8zd-freebsd 8 Jan 2015 > R10 OpenSSL 1.0.1l-freebsd 15 Jan 2015 > > Interesting, its mixed based on size > > ---Mike > > > > _______________________________________________ > freebsd-stable@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-stable > To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org" > -- ------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike@sentex.net Providing Internet services since 1994 www.sentex.net Cambridge, Ontario Canada http://www.tancsa.com/ --------------020102090000090903010509 Content-Type: text/plain; charset=windows-1252; name="openssl.txt" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="openssl.txt" RELENG_10 0(alix_APU1c4)# openssl speed aes-128-cbc Doing aes-128 cbc for 3s on 16 size blocks: 3884998 aes-128 cbc's in 3.07s Doing aes-128 cbc for 3s on 64 size blocks: 1064886 aes-128 cbc's in 3.15s Doing aes-128 cbc for 3s on 256 size blocks: 261951 aes-128 cbc's in 3.02s Doing aes-128 cbc for 3s on 1024 size blocks: 162398 aes-128 cbc's in 3.00s Doing aes-128 cbc for 3s on 8192 size blocks: 20501 aes-128 cbc's in 3.00s OpenSSL 1.0.1l-freebsd 15 Jan 2015 built on: date not available options:bn(64,64) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) compiler: clang The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128 cbc 20245.49k 21646.52k 22179.87k 55431.85k 55981.40k 0(alix_APU1c4)# RELENG9 1{alix_APU1c4}# openssl speed aes-128-cbc To get the most accurate results, try to run this program when this computer is idle. Doing aes-128 cbc for 3s on 16 size blocks: 6396101 aes-128 cbc's in 2.99s Doing aes-128 cbc for 3s on 64 size blocks: 1666730 aes-128 cbc's in 3.00s Doing aes-128 cbc for 3s on 256 size blocks: 425420 aes-128 cbc's in 3.00s Doing aes-128 cbc for 3s on 1024 size blocks: 106883 aes-128 cbc's in 3.00s Doing aes-128 cbc for 3s on 8192 size blocks: 13367 aes-128 cbc's in 3.00s OpenSSL 0.9.8zd-freebsd 8 Jan 2015 built on: date not available options:bn(64,64) md2(int) rc4(ptr,int) des(idx,cisc,16,int) aes(partial) blowfish(idx) compiler: cc available timing options: USE_TOD HZ=128 [sysconf value] timing function used: getrusage The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128 cbc 34178.77k 35559.29k 36305.70k 36481.34k 36495.49k 0{alix_APU1c4}# RELENG9 from the ports 0{alix_APU1c4}# /usr/local/bin/openssl speed aes-128-cbc WARNING: can't open config file: /usr/local/openssl/openssl.cnf Doing aes-128 cbc for 3s on 16 size blocks: 3792299 aes-128 cbc's in 2.99s Doing aes-128 cbc for 3s on 64 size blocks: 1014482 aes-128 cbc's in 3.00s Doing aes-128 cbc for 3s on 256 size blocks: 259813 aes-128 cbc's in 3.00s Doing aes-128 cbc for 3s on 1024 size blocks: 166623 aes-128 cbc's in 3.00s Doing aes-128 cbc for 3s on 8192 size blocks: 21016 aes-128 cbc's in 3.00s OpenSSL 1.0.1l 15 Jan 2015 built on: Thu Mar 19 00:11:03 2015 options:bn(64,64) md2(int) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) compiler: cc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -pthread -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -DL_ENDIAN -DTERMIOS -O3 -Wall -O2 -pipe -fstack-protector -fno-strict-aliasing -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSH A256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128 cbc 20278.40k 21642.28k 22170.71k 56873.98k 57387.69k 0{alix_APU1c4}# /usr/local/bin/openssl version WARNING: can't open config file: /usr/local/openssl/openssl.cnf OpenSSL 1.0.1l 15 Jan 2015 --------------020102090000090903010509--