mirage/qubes-mirage-firewall

High CPU usage

Closed this issue · 6 comments

Maybe this is connected with #5. The CPU usage spikes with high bandwidth usage. See
mirage-firewall
The fedoraVM can handle the same load with ~2% CPU usage.

The does seem excessive. I tried a similar test here:

For download, I got 36 MB/s with 58% CPU use.
For upload, I got 3.5 MB/s with 6% CPU use.

I'm using a build of the current Git version, with a 20 MB RAM allocation (I see yours has a lot more RAM, but that shouldn't slow it down on average, although it might lead to longer pauses for GC).

I haven't tried doing any profiling of the firewall, but if you're interested in tracking this down, here's a guide to getting flame graphs from Mirage unikernels:

http://www.brendangregg.com/blog/2016-01-27/unikernel-profiling-from-dom0.html

Another thing would be to rebuild mirage-firewall with opam switch 4.03.0+flambda, which enables a load of compiler optimisations (also untested).

Could you try testing with this binary:

https://github.com/talex5/qubes-mirage-firewall/releases/download/flambda-test/mir-qubes-firewall.xen

This is built using 4.03.0-flambda. I'd be interested to know if it works better (I tested with 20 MB RAM allocated and 1 CPU).

With the flambda build I get 15MB/s with 18% CPU use.
If I have time I look into the profiling, looks interesting. I increased the RAM because I ran into the OOM issue.

Hi,

I was trying to test the flambda version using the suggestion from https://groups.google.com/forum/#!msg/qubes-users/5apbM_E0prc/aKCcpv37BAAJ

I was getting some Not Found errors when running apt-get install which I've finally fixed adding an 'apt-get update' in Dockerfile.

Well, after testing I got very similar CPU usage. Like 20% when downloading at 50Mbps.

It's acceptable. Far from bottleneck unless doing some local net transfer...

The new 0.5 release seems to be faster (see #45). Please reopen if you still see problems with that version.