Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 18 Mar 2015 21:36:11 -0400
From:      Mike Tancsa <mike@sentex.net>
To:        Matt Smith <fbsd@xtaz.co.uk>, John-Mark Gurney <jmg@funkthat.com>, FreeBSD-STABLE Mailing List <freebsd-stable@freebsd.org>
Subject:   Re: 35-40% performance drop releng9 vs releng10 openvpn
Message-ID:  <550A280B.5030107@sentex.net>
In-Reply-To: <550A110A.6070301@sentex.net>
References:  <5506250A.2000506@sentex.net> <20150316132055.GQ32288@funkthat.com> <5509D6C6.4050204@sentex.net> <20150318211457.GL51048@funkthat.com> <5509FC19.2020201@sentex.net> <20150318224034.GG1271@xtaz.uk> <550A110A.6070301@sentex.net>

next in thread | previous in thread | raw e-mail | index | archive | help
This is a multi-part message in MIME format.
--------------020102090000090903010509
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit


And compiling 1.0.1l on RELENG_9 shows the same performance profile on 
RELENG_10.  Smaller packets are slower, larger are faster


16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
20245.49k    21646.52k    22179.87k    55431.85k    55981.40k  R10
34178.77k    35559.29k    36305.70k    36481.34k    36495.49k  R9
20278.40k    21642.28k    22170.71k    56873.98k    57387.69k  R9Port


But for my application, I still get better speeds on RELENG_9, even when 
using the same version of openssl across RELENGs.

I do the test with the 3 FreeBSD boxes

server1 ---- apu ---- server2

server1 is connected to the apu with openvpn.
I then usr /usr/src/tools/tools/netrate/netblast
to send across the openvpn tunnel to server2

on RELENG9 I get 83-85Mb/s
on RELENG10      61Mb/s

Using polarSSL does not make much of a difference either way. Its 
perhaps 1Mb slower on both, so 82-83 vs 83-85 on R9 and 59-60Mbs vs 
61-20Mb/s on RELENG10.

But, on RELENG_9, if I install openssl from the ports, and compile 
openvpn and link against it, I get 85-87Mb/s of throughput on RELENG_9. 
  So while there are speed differences between the versions of openssl, 
it doesnt seem to matter in the OpenVPN case, as its the base OS that 
makes the difference since both versions of OpenSSL on RELENG9 give 
similar performance in my openvpn test

On RELENG_9, the dtrace command I use on 10 does not seem to work
0{alix_APU1c4}# dtrace -x stackframes=100 -n 'profile-997 /arg0/ { 
@[stack()] = count(); } tick-60s { exit(0); }' -o out.kern_stacks9
dtrace: invalid probe specifier profile-997 /arg0/ { @[stack()] = 
count(); } tick-60s { exit(0); }: "/usr/lib/dtrace/regs_x86.d", line 2: 
type redeclared: struct devinfo
1{alix_APU1c4}#




	---Mike





On 3/18/2015 7:58 PM, Mike Tancsa wrote:
> On 3/18/2015 6:40 PM, Matt Smith wrote:
>> Isn't OpenSSL in the base on releng9 the 0.9.8 version whereas in
>> releng10 it's the 1.0.1 version? This could make a significant
>> difference. I've heard rumours before that the newer version is a lot
>> slower but I've never had cause to believe it.
>>
>
>   openssl speed aes-128-cbc
>
> 16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
> 20245.49k    21646.52k    22179.87k    55431.85k    55981.40k  R10
> 34178.77k    35559.29k    36305.70k    36481.34k    36495.49k  R9
>
> R9 OpenSSL 0.9.8zd-freebsd 8 Jan 2015
> R10 OpenSSL 1.0.1l-freebsd 15 Jan 2015
>
> Interesting, its mixed based on size
>
>      ---Mike
>
>
>
> _______________________________________________
> freebsd-stable@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-stable
> To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org"
>


-- 
-------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike@sentex.net
Providing Internet services since 1994 www.sentex.net
Cambridge, Ontario Canada   http://www.tancsa.com/

--------------020102090000090903010509
Content-Type: text/plain; charset=windows-1252;
 name="openssl.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
 filename="openssl.txt"


RELENG_10

0(alix_APU1c4)# openssl speed aes-128-cbc
Doing aes-128 cbc for 3s on 16 size blocks: 3884998 aes-128 cbc's in 3.07s
Doing aes-128 cbc for 3s on 64 size blocks: 1064886 aes-128 cbc's in 3.15s
Doing aes-128 cbc for 3s on 256 size blocks: 261951 aes-128 cbc's in 3.02s
Doing aes-128 cbc for 3s on 1024 size blocks: 162398 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 8192 size blocks: 20501 aes-128 cbc's in 3.00s
OpenSSL 1.0.1l-freebsd 15 Jan 2015
built on: date not available
options:bn(64,64) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) 
compiler: clang
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128 cbc      20245.49k    21646.52k    22179.87k    55431.85k    55981.40k
0(alix_APU1c4)#

RELENG9

1{alix_APU1c4}# openssl speed aes-128-cbc
To get the most accurate results, try to run this
program when this computer is idle.
Doing aes-128 cbc for 3s on 16 size blocks: 6396101 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 64 size blocks: 1666730 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 256 size blocks: 425420 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 1024 size blocks: 106883 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 8192 size blocks: 13367 aes-128 cbc's in 3.00s
OpenSSL 0.9.8zd-freebsd 8 Jan 2015
built on: date not available
options:bn(64,64) md2(int) rc4(ptr,int) des(idx,cisc,16,int) aes(partial) blowfish(idx) 
compiler: cc
available timing options: USE_TOD HZ=128 [sysconf value]
timing function used: getrusage
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128 cbc      34178.77k    35559.29k    36305.70k    36481.34k    36495.49k
0{alix_APU1c4}#


RELENG9 from the ports
0{alix_APU1c4}# /usr/local/bin/openssl speed aes-128-cbc
WARNING: can't open config file: /usr/local/openssl/openssl.cnf
Doing aes-128 cbc for 3s on 16 size blocks: 3792299 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 64 size blocks: 1014482 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 256 size blocks: 259813 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 1024 size blocks: 166623 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 8192 size blocks: 21016 aes-128 cbc's in 3.00s
OpenSSL 1.0.1l 15 Jan 2015
built on: Thu Mar 19 00:11:03 2015
options:bn(64,64) md2(int) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx)
compiler: cc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -pthread -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -DL_ENDIAN
 -DTERMIOS -O3 -Wall -O2 -pipe -fstack-protector -fno-strict-aliasing -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSH
A256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128 cbc      20278.40k    21642.28k    22170.71k    56873.98k    57387.69k
0{alix_APU1c4}# /usr/local/bin/openssl version
WARNING: can't open config file: /usr/local/openssl/openssl.cnf
OpenSSL 1.0.1l 15 Jan 2015

--------------020102090000090903010509--



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?550A280B.5030107>