From owner-freebsd-security@FreeBSD.ORG Sun May 24 20:47:30 2015 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 831233CE for ; Sun, 24 May 2015 20:47:30 +0000 (UTC) (envelope-from cmt@burggraben.net) Received: from smtp.burggraben.net (smtp.burggraben.net [IPv6:2a01:4f8:140:50a2::3:1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "ns.exwg.net", Issuer "Christoph Moench-Tegeder" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 43FF3375 for ; Sun, 24 May 2015 20:47:30 +0000 (UTC) (envelope-from cmt@burggraben.net) Received: from localhost (localhost [127.0.0.1]) by smtp.burggraben.net (Postfix) with ESMTP id BA52B600098 for ; Sun, 24 May 2015 22:47:27 +0200 (CEST) X-Spam-Scanned: by amavisd-new at exwg.net Received: from smtp.burggraben.net ([127.0.0.1]) by localhost (ns.burggraben.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IENXdpsGoZUg for ; Sun, 24 May 2015 22:47:23 +0200 (CEST) Received: from elch.exwg.net (dslb-088-066-008-054.088.066.pools.vodafone-ip.de [88.66.8.54]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "elch.exwg.net", Issuer "Christoph Moench-Tegeder" (not verified)) by smtp.burggraben.net (Postfix) with ESMTPS for ; Sun, 24 May 2015 22:47:23 +0200 (CEST) Received: by elch.exwg.net (Postfix, from userid 1000) id 4886242; Sun, 24 May 2015 22:47:23 +0200 (CEST) Date: Sun, 24 May 2015 22:47:23 +0200 From: Christoph Moench-Tegeder To: freebsd-security@freebsd.org Subject: Re: Atom C2758 - loading aesni(4) reduces performance Message-ID: <20150524204723.GA2853@elch.exwg.net> References: <6BA42026-C785-40B5-B9CF-DD4280693C41@dragondata.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6BA42026-C785-40B5-B9CF-DD4280693C41@dragondata.com> User-Agent: Mutt/1.5.23 (2014-03-12) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 May 2015 20:47:30 -0000 ## Kevin Day (toasty@dragondata.com): > Is this expected here, or is something broken? I'd expect there's something wrong (I don't have access to an AES-NI capable Atom, but on my i7 there's no such impact). The performance numbers for the "openssl speed" suite show heavy fluctutation even under light load - was this a one-shot test or is this reproducable on a "unloaded" (yes, I know, system stuff...) system? Can you run multiple tests in each configuration and check average, median and standard deviation? (just to make sure this is significant). Anyways, openssl does not use crypto(4) by default (and therefore cannot use aesni(4)). openssl detects the cpu features by itself and uses the AES-NI instruction set if available - unless told otherwise (see OPENSSL_ia32cap(3)). To make the long manual short - you can force openssl not to use AES-NI by setting the environment OPENSSL_ia32cap="~0x0200000000000000". From my tests I estimate (I did only a few tests) that this option alone cuts aes-256-cbc by 50 to 60%. Loading (or not) aesni(4) has no obvious effect on the numbers in both cases (variations are in the order of the usual noise). Regards, Christoph -- Spare Space