search

WireGuard / wireguard-vyatta-ubnt

WireGuard for Ubiquiti Devices
https://www.wireguard.com/
GNU General Public License v3.0
1.46k stars 70 forks source link

Speedtest killing CPU on E100 #43

Open lkthomas opened 4 years ago

lkthomas commented 4 years ago

I am using E100 router OS version 1.x, I am successfully run wg0 without a problem when I do a speed test from my android phone, it uses CPU 100% and packet loss did happen.

isn't TCP traffic will be handle by the network processor?

dmfr commented 4 years ago

I am using E100 on v2. Connection is 900/500 that ERL is able to handle with no issue. If I run a file transfer through wireguard VPN, I am getting about 80M throughput with 100% cpu load, which is fine.

I am just worried about the ksoftirqd CPU usage, see below. Besides, under full wireguard load the router becomes so sluggish that CLI is hardly responsive and a simple DNS forward for regular internet takes up to 2-3 secs. Is this part of normal behavior ? Is full wireguard throughput supposed to cripple the router at that point ?

Top output :


Tasks: 101 total,   4 running,  97 sleeping,   0 stopped,   0 zombie
%Cpu(s):  0.3 us, 35.2 sy,  0.0 ni,  3.3 id,  0.0 wa,  0.0 hi, 61.3 si,  0.0 st
KiB Mem :   491552 total,   235364 free,    88704 used,   167484 buff/cache
KiB Swap:        0 total,        0 free,        0 used.   389168 avail Mem 

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND                                                                                                            
   16 root      20   0       0      0      0 R  39.6  0.0   4:22.27 ksoftirqd/1                                                                                                        
    3 root      20   0       0      0      0 R  31.7  0.0   3:31.65 ksoftirqd/0                                                                                                        
    4 root      20   0       0      0      0 S  19.4  0.0   1:09.12 kworker/0:0                                                                                                        
 4820 root      20   0       0      0      0 R  18.8  0.0   1:00.52 kworker/1:3                                                                                                        
 4532 root      20   0       0      0      0 S  17.3  0.0   0:49.15 kworker/0:2                                                                                                        
   17 root      20   0       0      0      0 S  15.5  0.0   1:29.97 kworker/1:0                                                                                                        
 5294 root      20   0       0      0      0 S  13.5  0.0   0:02.76 kworker/1:1                                                                                                        
 5329 root      20   0       0      0      0 S  12.9  0.0   0:02.60 kworker/1:2                                                                                                        
 5330 root      20   0       0      0      0 S  10.3  0.0   0:02.58 kworker/0:3                                                                                                        
 5345 ubnt      20   0    6860   3148   2656 R   2.9  0.6   0:00.51 top                                                                                                                ```
lkthomas commented 4 years ago

that's my question as well, looks like some offload feature isn't enabled on wireguard by default ?

dmfr commented 4 years ago

I don't think you can expect wireguard crypto to be "offloaded". Again, throughput is very decent for E100. Especially compared to OpenVPN and even IPSEC.

The point is the high soft interrupts load and the overall sluggishness during maximum WG load. I don't remember seeing various unix boxes becoming so unresponsive even with 100% cpu load.

Digging into this (kernel prios / IRQs / timer / scheduler / ...) is just over my skills J