freebsd-dev/sys/netipsec
Robert Watson d4b5cae49b Reimplement the netisr framework in order to support parallel netisr
threads:

- Support up to one netisr thread per CPU, each processings its own
  workstream, or set of per-protocol queues.  Threads may be bound
  to specific CPUs, or allowed to migrate, based on a global policy.

  In the future it would be desirable to support topology-centric
  policies, such as "one netisr per package".

- Allow each protocol to advertise an ordering policy, which can
  currently be one of:

  NETISR_POLICY_SOURCE: packets must maintain ordering with respect to
    an implicit or explicit source (such as an interface or socket).

  NETISR_POLICY_FLOW: make use of mbuf flow identifiers to place work,
    as well as allowing protocols to provide a flow generation function
    for mbufs without flow identifers (m2flow).  Falls back on
    NETISR_POLICY_SOURCE if now flow ID is available.

  NETISR_POLICY_CPU: allow protocols to inspect and assign a CPU for
    each packet handled by netisr (m2cpuid).

- Provide utility functions for querying the number of workstreams
  being used, as well as a mapping function from workstream to CPU ID,
  which protocols may use in work placement decisions.

- Add explicit interfaces to get and set per-protocol queue limits, and
  get and clear drop counters, which query data or apply changes across
  all workstreams.

- Add a more extensible netisr registration interface, in which
  protocols declare 'struct netisr_handler' structures for each
  registered NETISR_ type.  These include name, handler function,
  optional mbuf to flow ID function, optional mbuf to CPU ID function,
  queue limit, and ordering policy.  Padding is present to allow these
  to be expanded in the future.  If no queue limit is declared, then
  a default is used.

- Queue limits are now per-workstream, and raised from the previous
  IFQ_MAXLEN default of 50 to 256.

- All protocols are updated to use the new registration interface, and
  with the exception of netnatm, default queue limits.  Most protocols
  register as NETISR_POLICY_SOURCE, except IPv4 and IPv6, which use
  NETISR_POLICY_FLOW, and will therefore take advantage of driver-
  generated flow IDs if present.

- Formalize a non-packet based interface between interface polling and
  the netisr, rather than having polling pretend to be two protocols.
  Provide two explicit hooks in the netisr worker for start and end
  events for runs: netisr_poll() and netisr_pollmore(), as well as a
  function, netisr_sched_poll(), to allow the polling code to schedule
  netisr execution.  DEVICE_POLLING still embeds single-netisr
  assumptions in its implementation, so for now if it is compiled into
  the kernel, a single and un-bound netisr thread is enforced
  regardless of tunable configuration.

In the default configuration, the new netisr implementation maintains
the same basic assumptions as the previous implementation: a single,
un-bound worker thread processes all deferred work, and direct dispatch
is enabled by default wherever possible.

Performance measurement shows a marginal performance improvement over
the old implementation due to the use of batched dequeue.

An rmlock is used to synchronize use and registration/unregistration
using the framework; currently, synchronized use is disabled
(replicating current netisr policy) due to a measurable 3%-6% hit in
ping-pong micro-benchmarking.  It will be enabled once further rmlock
optimization has taken place.  However, in practice, netisrs are
rarely registered or unregistered at runtime.

A new man page for netisr will follow, but since one doesn't currently
exist, it hasn't been updated.

This change is not appropriate for MFC, although the polling shutdown
handler should be merged to 7-STABLE.

Bump __FreeBSD_version.

Reviewed by:	bz
2009-06-01 10:41:38 +00:00
..
ah_var.h
ah.h
esp_var.h
esp.h
ipcomp_var.h
ipcomp.h
ipip_var.h Second round of putting global variables, which were virtualized 2008-12-13 19:13:03 +00:00
ipsec6.h Add sysctls to toggle the behaviour of the (former) IPSEC_FILTERTUNNEL 2009-05-23 16:42:38 +00:00
ipsec_input.c Reimplement the netisr framework in order to support parallel netisr 2009-06-01 10:41:38 +00:00
ipsec_mbuf.c Remove remain <= MHLEN restriction in m_makespace(), 2009-01-28 10:41:10 +00:00
ipsec_output.c Use NULL rather than 0 when comparing pointers. 2009-01-30 20:17:08 +00:00
ipsec.c Add sysctls to toggle the behaviour of the (former) IPSEC_FILTERTUNNEL 2009-05-23 16:42:38 +00:00
ipsec.h Add sysctls to toggle the behaviour of the (former) IPSEC_FILTERTUNNEL 2009-05-23 16:42:38 +00:00
key_debug.c Shuffle the vimage.h includes or add where missing. 2009-02-27 13:22:26 +00:00
key_debug.h Commit step 1 of the vimage project, (network stack) 2008-08-17 23:27:27 +00:00
key_var.h First steps towards IPSec cleanup. 2006-03-25 13:38:52 +00:00
key.c Lock SPTREE before parsing it in key_spddump() 2009-05-27 09:44:14 +00:00
key.h key_gettunnel() has been unsued with FAST_IPSEC (now IPSEC). 2009-04-27 21:04:16 +00:00
keydb.h First steps towards IPSec cleanup. 2006-03-25 13:38:52 +00:00
keysock.c For all files including net/vnet.h directly include opt_route.h and 2009-02-27 14:12:05 +00:00
keysock.h Unhide declarations of network stack virtualization structs from 2008-11-28 23:30:51 +00:00
vipsec.h Add sysctls to toggle the behaviour of the (former) IPSEC_FILTERTUNNEL 2009-05-23 16:42:38 +00:00
xform_ah.c Introduce vnet module registration / initialization framework with 2009-04-11 05:58:58 +00:00
xform_esp.c Introduce vnet module registration / initialization framework with 2009-04-11 05:58:58 +00:00
xform_ipcomp.c Introduce vnet module registration / initialization framework with 2009-04-11 05:58:58 +00:00
xform_ipip.c Introduce vnet module registration / initialization framework with 2009-04-11 05:58:58 +00:00
xform_tcp.c Change the curvnet variable from a global const struct vnet *, 2009-05-05 10:56:12 +00:00
xform.h Add sysctls to if_enc(4) to control whether the firewalls or 2007-11-28 22:33:53 +00:00