awnumar/memguard

High CPU Usage of core.NewCoffer

pzeinlinger opened this issue · 5 comments

pzeinlinger commented

Describe the bug
I noticed high cpu usage (0.1 became >2%) of my service after adding memguard.
Although no active memguard.Buffer is in use, the cpu usage is noticably higher.
I guess it has something to do with core.Coffer's Rekey routine.

To Reproduce
You can clone my test repo from gitlab.com/pzeinlinger/memguardcputest
It starts a webserver and only opens the enclave when a request is made.

Screenshots
pprof
htop

System (please complete the following information):

  • OS and Kernel Versions: 4.19.59-1-MANJARO
  • Memguard Version: 0.17.3
awnumar commented

Thanks for the report.

Those CPU numbers seem reasonable to me but I have pushed a branch with a function allowing the caller to update the interval. The default is 8 milliseconds. I would suggest that you keep your choice below 1000ms.

Could you test with a different interval to see if the change resolves the issue for you?

pzeinlinger commented

Thank you! Much better. Would you consider a higher interval a security risk?

awnumar commented

The choice of the interval value is the classic security/performance trade-off. A lower interval is better but any low value should be sufficient. The original source states a value of 1 second.

By "much better" I assume you mean you've tested the change? What kind of loads are you now getting for what choice of interval value?

  • 👍1
pzeinlinger commented

Using 1 second results in no apparent increase of cpu usage compared to a project without memgurad.

awnumar commented

Great. It might be worth looking into the lowest such value that results in no noticeable load.