Logical cores / SMT with WireGuard

Logical cores / SMT with WireGuard

[Lee Yates]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256


Hi everyone,

I have a small form-factor Dell Optiplex 7010 (Core i7 3700, 8GB DDR3,
128GB SSD) with a quad port Intel Pro 1000PT NIC, running Arch Linux, as
my edge router. It covers two local subnets (trusted LAN, and
DMZ/servers/IoT), with the trusted LAN clients all being routed out via
an AzireVPN WireGuard tunnel on WAN. It works great for this and 15
minute load averages are in the order of 0.1!

My question is about multithreading/SMT on that Core i7. At the moment I
have it enabled, and WireGuard seems to simmer nicely across all 8
threads. However, with the known Intel security issues and
recommendations to disable HT, I got to wondering how much - if at all -
disabling HT would impact on WireGuard's real world performance. I mean,
it obviously can utilise logical cores/threads, but is there a real
world throughput benefit vs just using the real cores?

While my router is overkill anyway (about 18% to 20% usage under full
network load with 4c8t), I obviously still want to run it in the most
efficient way possible. Is WireGuard making real use of those logical
cores/threads? Or will it run just as well on 4 'real' cores as on 4
cores and 4 HT threads?

I know the obvious answer is to test it out, but the router runs
headless and is awkward to get a monitor to so I can access the BIOS. I
did try for a short time when I first set it up, and aside from CPU
usage going up (because of having half the available 'resources' with HT
disabled) nothing seemed to change. My WAN is 'only' 400Mbps anyway so
hardly a taxing test. Because of this, I can't really learn about how
much WireGuard benefits from the extra threads, if it does at all, as
either way I have headroom to spare for my current WAN provision.

So, technically speaking, is WireGuard able/programmed to take
demonstrable real world advantage of logical SMT/HT threads; or is more
real cores the only proper way to scale performance with it?

Cheers,

Lee Yates
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEExF+G9PyiAB1cKHnz7yXLzDsoqZIFAlxlrS0ACgkQ7yXLzDso
qZJROwf/b76RT+dFoo88KU36UJYRifluCBQ8TMfmj0DbWSQuyvQouJFqovYtt18/
UHSL/6KTgcHEkGFSaIQqAyP3xT7VjWjFhqyaOmBM1oAQ3HuVzmxnwkE4vumnhmHF
CrkIHcLNG/8jT1Xddd5q9rVcABqgGqOjT8lyF83id3MCPWj2njxBczQvILXq7i21
jvkzfnpEA94qG5IdV2xtGBQbtLwbHIu+ek7ayVj+NbyjLfv708wvMhUAf/1pQHew
WKBqv4tENMbKgrARhhS4YYHOo4nl14iRHQTDSm7a27xMdaDUW+M6+EtY+/citllx
OH0s5SYkkUClWRLCsooXJipfVWkw1A==
=Is7v
-----END PGP SIGNATURE-----
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: Logical cores / SMT with WireGuard

[Roman Mamedov]

On Thu, 14 Feb 2019 18:02:26 +0000
Lee Yates <rainmakerraw@icloud.com> wrote:

> recommendations to disable HT, I got to wondering how much - if at all -
> disabling HT would impact on WireGuard's real world performance. I mean,
> it obviously can utilise logical cores/threads, but is there a real
> world throughput benefit vs just using the real cores?

This sounds like something YOU are in a great position to test, and then write
an interesting blog post or mailing list message summarising the results. :)

-- 
With respect,
Roman
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: Logical cores / SMT with WireGuard

[Roman Mamedov]

On Thu, 14 Feb 2019 18:02:26 +0000
Lee Yates <rainmakerraw@icloud.com> wrote:

Sorry, hit "send" before reading the rest of your message.

> the router runs headless and is awkward to get a monitor to so I can access
> the BIOS.

You can toggle it without needing the BIOS.
It is possible to disable SMT from grub, with Linux kernel boot arguments.
It even seems possible to disable/enable it without a reboot.
See https://www.golinuxhub.com/2018/01/how-to-disable-or-enable-hyper.html

> My WAN is 'only' 400Mbps anyway so
> hardly a taxing test. Because of this, I can't really learn about how
> much WireGuard benefits from the extra threads, if it does at all, as
> either way I have headroom to spare for my current WAN provision.

Set up a separate WG network with a peer on your Gbit LAN. Or even run a
virtual machine on the same host, and run WG between host and VM, which should
get you multi-Gbit raw throughput and likely make WG encryption the
bottleneck. That way you can observe not only the CPU load, but also the
transfer speed reached changing with HT on/off.

-- 
With respect,
Roman
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: Logical cores / SMT with WireGuard

[Tom Li]

On Sun, Feb 17, 2019 at 04:01:36PM +0500, Roman Mamedov wrote:
> On Thu, 14 Feb 2019 18:02:26 +0000
> Lee Yates <rainmakerraw@icloud.com> wrote:
> 
> Sorry, hit "send" before reading the rest of your message.
> 
> > the router runs headless and is awkward to get a monitor to so I can access
> > the BIOS.
> 
> You can toggle it without needing the BIOS.
> It is possible to disable SMT from grub, with Linux kernel boot arguments.
> It even seems possible to disable/enable it without a reboot.
> See https://www.golinuxhub.com/2018/01/how-to-disable-or-enable-hyper.html

Hi all.

The information provided by the original link is out-of-date, it works, but
it's tedious and easy to make a mistake and disable the wrong logical CPU. The
new Linux kernel with L1TF fixes has introduced a SMT kill switch, which is the
standard interface to control SMT.

It's located at

    /sys/devices/system/cpu/smt/control

You can disable SMT by,

    echo "off" > /sys/devices/system/cpu/smt/control

enable it by,

    echo "on" > /sys/devices/system/cpu/smt/control

Or permanently disable it until reboot,

    echo "forceoff" > /sys/devices/system/cpu/smt/control.

More information is available at,

    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/admin-guide/l1tf.rst

I hope it helps.

Cheers,
Tom Li
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard