542970fa2d
Having IPSEC compiled into the kernel imposes a non-trivial performance penalty on multi-threaded workloads due to IPSEC refcounting. In my benchmarks of multi-threaded UDP transmit (connected sockets), I've seen a roughly 20% performance penalty when the IPSEC option is included in the kernel (16.8Mpps vs 13.8Mpps with 32 senders on a 14 core / 28 HTT Xeon 2697v3)). This is largely due to key_addref() incrementing and decrementing an atomic reference count on the default policy. This cause all CPUs to stall on the same cacheline, as it bounces between different CPUs. Given that relatively few users use ipsec, and that it can be loaded as a module, it seems reasonable to ask those users to load the ipsec module so as to avoid imposing this penalty on the GENERIC kernel. Its my hope that this will make FreeBSD look better in "out of the box" benchmark comparisons with other operating systems. Many thanks to ae for fixing auto-loading of ipsec.ko when ifconfig tries to configure ipsec, and to cy for volunteering to ensure the the racoon ports will load the ipsec.ko module Reviewed by: cem, cy, delphij, gnn, jhb, jpaetzel Differential Revision: https://reviews.freebsd.org/D20163
86 lines
3.8 KiB
Plaintext
86 lines
3.8 KiB
Plaintext
# Standard kernel config items for all ARMv7 systems.
|
|
#
|
|
# $FreeBSD$
|
|
|
|
options HZ=1000
|
|
options ARM_L2_PIPT # Only L2 PIPT is supported
|
|
options INTRNG # All arm systems use INTRNG these days
|
|
options PREEMPTION # Enable kernel thread preemption
|
|
options VIMAGE # Subsystem virtualization, e.g. VNET
|
|
options INET # InterNETworking
|
|
options INET6 # IPv6 communications protocols
|
|
options TCP_HHOOK # hhook(9) framework for TCP
|
|
device crypto # core crypto support
|
|
options IPSEC_SUPPORT # Allow kldload of ipsec and tcpmd5
|
|
options SCTP # Stream Control Transmission Protocol
|
|
options FFS # Berkeley Fast Filesystem
|
|
options SOFTUPDATES # Enable FFS soft updates support
|
|
options UFS_ACL # Support for access control lists
|
|
options UFS_DIRHASH # Improve performance on big directories
|
|
options UFS_GJOURNAL # Enable gjournal-based UFS journaling
|
|
options QUOTA # Enable disk quotas for UFS
|
|
options NFSCL # Network Filesystem Client
|
|
options NFSLOCKD # Network Lock Manager
|
|
options NFS_ROOT # NFS usable as /, requires NFSCL
|
|
options MSDOSFS # MSDOS Filesystem
|
|
options CD9660 # ISO 9660 Filesystem
|
|
options PROCFS # Process filesystem (requires PSEUDOFS)
|
|
options PSEUDOFS # Pseudo-filesystem framework
|
|
options TMPFS # Efficient memory filesystem
|
|
options GEOM_PART_GPT # GUID Partition Tables
|
|
options GEOM_PART_BSD # BSD partition scheme
|
|
options GEOM_PART_MBR # MBR partition scheme
|
|
options GEOM_LABEL # Provides labelization
|
|
options COMPAT_43 # Compatible with BSD 4.3 [KEEP THIS!]
|
|
options SCSI_DELAY=5000 # Delay (in ms) before probing SCSI
|
|
options KTRACE # ktrace(1) support
|
|
options SYSVSHM # SYSV-style shared memory
|
|
options SYSVMSG # SYSV-style message queues
|
|
options SYSVSEM # SYSV-style semaphores
|
|
options _KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions
|
|
options PRINTF_BUFR_SIZE=128 # Prevent printf output being interspersed.
|
|
options KBD_INSTALL_CDEV # install a CDEV entry in /dev
|
|
options HWPMC_HOOKS # Necessary kernel hooks for hwpmc(4)
|
|
options CAPABILITY_MODE # Capsicum capability mode
|
|
options CAPABILITIES # Capsicum capabilites
|
|
options FREEBSD_BOOT_LOADER # Process metadata passed from loader(8)
|
|
options VFP # Enable floating point hardware support
|
|
options MAC # Support for Mandatory Access Control (MAC)
|
|
|
|
options COMPAT_FREEBSD10 # Compatible with FreeBSD10
|
|
options COMPAT_FREEBSD11 # Compatible with FreeBSD11
|
|
options COMPAT_FREEBSD12 # Compatible with FreeBSD12
|
|
|
|
# DTrace support
|
|
options KDTRACE_HOOKS # Kernel DTrace hooks
|
|
options DDB_CTF # all architectures - kernel ELF linker loads CTF data
|
|
makeoptions WITH_CTF=1
|
|
|
|
# Debugging support. Always need this:
|
|
makeoptions DEBUG=-g # Build kernel with gdb(1) debug symbols
|
|
options KDB # Enable kernel debugger support.
|
|
options KDB_TRACE # Print a stack trace for a panic.
|
|
|
|
# For full debugger support use (turn off in stable branch):
|
|
options DDB # Support DDB
|
|
#options DEADLKRES # Enable the deadlock resolver
|
|
options INVARIANTS # Enable calls of extra sanity checking
|
|
options INVARIANT_SUPPORT # Extra sanity checks of internal structures, required by INVARIANTS
|
|
options WITNESS # Enable checks to detect deadlocks and cycles
|
|
options WITNESS_SKIPSPIN # Don't run witness on spinlocks for speed
|
|
options MALLOC_DEBUG_MAXZONES=8 # Separate malloc(9) zones
|
|
options ALT_BREAK_TO_DEBUGGER # Enter debugger on keyboard escape sequence
|
|
options USB_DEBUG # Enable usb debug support code
|
|
options VERBOSE_SYSINIT=0 # Support debug.verbose_sysinit, off by default
|
|
|
|
# Optional extras, never enabled by default:
|
|
#options BOOTVERBOSE
|
|
#options DEBUG # May result in extreme spewage
|
|
#options KTR
|
|
#options KTR_COMPILE=KTR_ALL
|
|
#options KTR_ENTRIES=16384
|
|
#options KTR_MASK=(KTR_SPARE2)
|
|
#options KTR_VERBOSE=0
|
|
#options USB_REQ_DEBUG
|
|
#options USB_VERBOSE
|