Re: athn(4) WPA2-PSK software crypto CPU loading
On Wed, Dec 24, 2014 at 09:15:03PM +0100, Christian Weisgerber wrote: Jonathan Thornburg: I have no experience with that configuration, but I had a broadly comparable setup where a Soekris net5501 (same CPU as the ALIX) did IPsec for a .11g network. What was the bandwidth of that network? .11g, 54 Mbit/s. Something like 2 Mbyte/s throughput into the wired network. Generally, it makes no sense to expect the maximum wifi throughput as a matter of course. You'll see it under optimal conditions which depend on a lot of factors. Most of the time a lower rate will be used to prevent excessive packet loss and retransmits. This is a balancing act. Our net80211 stack selects the rate using AMRR (Adaptive Multi Rate Retry). Our implementation of AMRR describes itself as naive, which probably means it's not optimised much. It also differs from what many other OSs do. ifconfig output indicates the currently selected data rate, e.g. mine has currently settled at 18Mbit/s: media: IEEE802.11 autoselect (OFDM18 mode 11g) Data transmit rate selection happens at both ends of the wifi link independently and can vary for each individual frame. The transmission rate for the data part of a frame is announced in the frame header (the header is usually transmitted at fixed 1MBit/s). Some 11n devices have more tricks up their sleeves (e.g. beam forming) but OpenBSD doesn't support any of those.
Re: athn(4) WPA2-PSK software crypto CPU loading
In http://marc.info/?l=openbsd-miscm=141928659802658w=1 I asked about the CPU overhead of doing wifi WPA2 crypto on a slow CPU. I have received two very useful off-list replies, which I'll summarize here for the archives: One person has a very similar setup to the one I described (athn(4), Atheros AR9220 radio), and wrote: My bottleneck seems to be the 802.11 stack of OpenBSD, it has some known performance issues: I get around 2MBps (16Mbit) data rates - the CPU could handle a lot more. Another person reported good results with ral(4) and a Sparklan WMIR-200N (Ralink RT2860/2850 chipset), which offloads the crypto to the hardware: over WPA2(PSK/AES/AES) it can push ~3MB/s at ~%33 cpu load, mostly interrupt handling. with the caveat that Under OpenBSD 5.3 ral(4) caused kernel panics maybe twice a year. I never tracked down the cause but it seemed to occur when unfamiliar nodes joined the network and then only in certain circumstances. ciao, -- -- Jonathan Thornburg [remove -animal to reply] jth...@astro.indiana-zebra.edu Dept of Astronomy IUCSS, Indiana University, Bloomington, Indiana, USA There was of course no way of knowing whether you were being watched at any given moment. How often, or on what system, the Thought Police plugged in on any individual wire was guesswork. It was even conceivable that they watched everybody all the time. -- George Orwell, 1984
Re: athn(4) WPA2-PSK software crypto CPU loading
In http://marc.info/?l=openbsd-miscm=141928659802658w=1 I asked Should I be worried about the CPU loading of software WPA2 crypto running on the (relatively slow) ALIX Geode processor? That is, is the software crypto likely to limit the available wifi data rate? In ttp://marc.info/?l=openbsd-miscm=141934666116217w=1 you replied I think the concern is warranted and yes, I expect this to be a bottleneck. I have no experience with that configuration, but I had a broadly comparable setup where a Soekris net5501 (same CPU as the ALIX) did IPsec for a .11g network. With AES-128-CBC + HMAC-SHA1, the box seemed to be able to saturate the wireless link, but it was mostly busy, and it profited from the CPU's glxsb(4) hardware acceleration for AES-128-CBC. With any other mode of encryption, e.g. AES-128-CTR, there just wasn't enough CPU. What was the bandwidth of that network? In my application there's no significant data traffic between different machines on the wifi network, i.e., all data is between wifi machines and the outside world. The link-to-the-outside-world offers at most 16 MBit/second, so I don't need to worry about making the wifi faster than that. thanks, ciao, -- -- Jonathan Thornburg [remove -animal to reply] jth...@astro.indiana-zebra.edu Dept of Astronomy IUCSS, Indiana University, Bloomington, Indiana, USA There was of course no way of knowing whether you were being watched at any given moment. How often, or on what system, the Thought Police plugged in on any individual wire was guesswork. It was even conceivable that they watched everybody all the time. -- George Orwell, 1984
Re: athn(4) WPA2-PSK software crypto CPU loading
Jonathan Thornburg: I have no experience with that configuration, but I had a broadly comparable setup where a Soekris net5501 (same CPU as the ALIX) did IPsec for a .11g network. What was the bandwidth of that network? .11g, 54 Mbit/s. Something like 2 Mbyte/s throughput into the wired network. -- Christian naddy Weisgerber na...@mips.inka.de
Re: athn(4) WPA2-PSK software crypto CPU loading
On 2014-12-22, Jonathan Thornburg jth...@astro.indiana.edu wrote: However, 'man athn' says The athn driver relies on the software 802.11 stack for both encryption and decryption of data frames. Should I be worried about the CPU loading of software WPA2 crypto running on the (relatively slow) ALIX Geode processor? That is, is the software crypto likely to limit the available wifi data rate? I think the concern is warranted and yes, I expect this to be a bottleneck. I have no experience with that configuration, but I had a broadly comparable setup where a Soekris net5501 (same CPU as the ALIX) did IPsec for a .11g network. With AES-128-CBC + HMAC-SHA1, the box seemed to be able to saturate the wireless link, but it was mostly busy, and it profited from the CPU's glxsb(4) hardware acceleration for AES-128-CBC. With any other mode of encryption, e.g. AES-128-CTR, there just wasn't enough CPU. Doing WPA2 means CCMP (= AES-128-CCM), so no acceleration on the Geode. AES-CCM may turn out to be more efficient than AES+SHA1, or it may not, but I doubt it will save the day. I think you need a box with more CPU. Also note that if kernel crypto monopolizes the CPU, userland processes will be starved. For instance, a nameserver running on the same machine will become unresponsive. -- Christian naddy Weisgerber na...@mips.inka.de
athn(4) WPA2-PSK software crypto CPU loading
I'm considering setting up a wifi access point using a PC Engines ALIX board (500 MHz AMD Geode LX800 CPU, 256 MB RAM). One way of providing the wifi is via a radio card (e.g., the PC Engines DNMA92) in the ALIX box. This uses the Atheros AR9220 chipset, which has good OpenBSD support -- including 802.11a/b/g WPA2-PSK support (though not 802.11n) -- via athn(4). However, 'man athn' says The athn driver relies on the software 802.11 stack for both encryption and decryption of data frames. Should I be worried about the CPU loading of software WPA2 crypto running on the (relatively slow) ALIX Geode processor? That is, is the software crypto likely to limit the available wifi data rate? ciao, -- -- Jonathan Thornburg [remove -animal to reply] jth...@astro.indiana-zebra.edu Dept of Astronomy IUCSS, Indiana University, Bloomington, Indiana, USA There was of course no way of knowing whether you were being watched at any given moment. How often, or on what system, the Thought Police plugged in on any individual wire was guesswork. It was even conceivable that they watched everybody all the time. -- George Orwell, 1984
