ipsec: Performance improvement of ipsec4_output_node using flow cache - vpp

diff options

author	Govindarajan Mohandoss <govindarajan.mohandoss@arm.com>	2021-03-19 19:20:49 +0000
committer	Damjan Marion <dmarion@me.com>	2021-10-12 16:43:18 +0000
commit	6d7dfcbfa4bc05f1308fc677f19ade44ea699da1 (patch)
tree	eb17ffe94db34644ccfb870732a8c6e3d6ba58b7 /test/vpp_bvi_interface.py
parent	d9e9870dd941bfb826530815e3196ced0b544b5d (diff)

ipsec: Performance improvement of ipsec4_output_node using flow cache

Adding flow cache support to improve outbound IPv4/IPSec SPD lookup performance. Details about flow cache: Mechanism: 1. First packet of a flow will undergo linear search in SPD table. Once a policy match is found, a new entry will be added into the flow cache. From 2nd packet onwards, the policy lookup will happen in flow cache. 2. The flow cache is implemented using bihash without collision handling. This will avoid the logic to age out or recycle the old flows in flow cache. Whenever a collision occurs, old entry will be overwritten by the new entry. Worst case is when all the 256 packets in a batch result in collision and fall back to linear search. Average and best case will be O(1). 3. The size of flow cache is fixed and decided based on the number of flows to be supported. The default is set to 1 million flows. This can be made as a configurable option as a next step. 4. Whenever a SPD rule is added/deleted by the control plane, the flow cache entries will be completely deleted (reset) in the control plane. The assumption here is that SPD rule add/del is not a frequent operation from control plane. Flow cache reset is done, by putting the data plane in fall back mode, to bypass flow cache and do linear search till the SPD rule add/delete operation is complete. Once the rule is successfully added/deleted, the data plane will be allowed to make use of the flow cache. The flow cache will be reset only after flushing out the inflight packets from all the worker cores using vlib_worker_wait_one_loop(). Details about bihash usage: 1. A new bihash template (16_8) is added to support IPv4 5 tuple. BIHASH_KVP_PER_PAGE and BIHASH_KVP_AT_BUCKET_LEVEL are set to 1 in the new template. It means only one KVP is supported per bucket. 2. Collision handling is avoided by calling BV (clib_bihash_add_or_overwrite_stale) function. Through the stale callback function pointer, the KVP entry will be overwritten during collision. 3. Flow cache reset is done using BV (clib_bihash_foreach_key_value_pair) function. Through the callback function pointer, the KVP value is reset to ~0ULL. MRR performance numbers with 1 core, 1 ESP Tunnel, null-encrypt, 64B for different SPD policy matching indices: SPD Policy index : 1 10 100 1000 Throughput : MPPS/MPPS MPPS/MPPS MPPS/MPPS KPPS/MPPS (Baseline/Optimized) ARM Neoverse N1 : 5.2/4.84 4.55/4.84 2.11/4.84 329.5/4.84 ARM TX2 : 2.81/2.6 2.51/2.6 1.27/2.6 176.62/2.6 INTEL SKX : 4.93/4.48 4.29/4.46 2.05/4.48 336.79/4.47 Next Steps: Following can be made as a configurable option through startup conf at IPSec level: 1. Enable/Disable Flow cache. 2. Bihash configuration like number of buckets and memory size. 3. Dual/Quad loop unroll can be applied around bihash to further improve the performance. 4. The same flow cache logic can be applied for IPv6 as well as in IPSec inbound direction. A deeper and wider flow cache using bihash_40_8 can replace existing bihash_16_8, to make it common for both IPv4 and IPv6 in both outbound and inbound directions. Following changes are made based on the review comments: 1. ON/OFF flow cache through startup conf. Default: OFF 2. Flow cache stale entry detection using epoch counter. 3. Avoid host order endianness conversion during flow cache lookup. 4. Move IPSec startup conf to a common file. 5. Added SPD flow cache unit test case 6. Replaced bihash with vectors to implement flow cache. 7. ipsec_add_del_policy API is not mpsafe. Cleaned up inflight packets check in control plane. Type: improvement Signed-off-by: mgovind <govindarajan.Mohandoss@arm.com> Signed-off-by: Zachary Leaf <zachary.leaf@arm.com> Tested-by: Jieqiang Wang <jieqiang.wang@arm.com> Change-Id: I62b4d6625fbc6caf292427a5d2046aa5672b2006

Diffstat (limited to 'test/vpp_bvi_interface.py')

0 files changed, 0 insertions, 0 deletions

/* * Copyright (c) 2018 Cisco and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ /** * @file * @brief NAT66 global declarations */ #ifndef __included_nat66_h__ #define __included_nat66_h__ #include <vppinfra/bihash_24_8.h> #include <nat/nat.h> typedef struct { ip6_address_t l_addr; ip6_address_t e_addr; u32 fib_index; } nat66_static_mapping_t; typedef struct { union { struct { ip6_address_t addr; u32 fib_index; u32 rsvd; }; u64 as_u64[3]; }; } nat66_sm_key_t; typedef struct { /** Interface pool */ snat_interface_t *interfaces; /** Static mapping pool */ nat66_static_mapping_t *sm; /** Static mapping by local address lookup table */ clib_bihash_24_8_t sm_l; /** Static mapping by external address lookup table */ clib_bihash_24_8_t sm_e; /** Session counters */ vlib_combined_counter_main_t session_counters; u32 outside_vrf_id; u32 outside_fib_index; } nat66_main_t; extern nat66_main_t nat66_main; extern vlib_node_registration_t nat66_in2out_node; extern vlib_node_registration_t nat66_out2in_node; void nat66_init (void); typedef int (*nat66_interface_walk_fn_t) (snat_interface_t * i, void *ctx); void nat66_interfaces_walk (nat66_interface_walk_fn_t fn, void *ctx); int nat66_interface_add_del (u32 sw_if_index, u8 is_inside, u8 is_add); typedef int (*nat66_static_mapping_walk_fn_t) (nat66_static_mapping_t * sm, void *ctx); void nat66_static_mappings_walk (nat66_static_mapping_walk_fn_t fn, void *ctx); nat66_static_mapping_t *nat66_static_mapping_get (ip6_address_t * addr, u32 fib_index, u8 is_local); int nat66_static_mapping_add_del (ip6_address_t * l_addr, ip6_address_t * e_addr, u32 vrf_id, u8 is_add); #endif /* __included_nat66_h__ */ /* * fd.io coding-style-patch-verification: ON * * Local Variables: * eval: (c-set-style "gnu") * End: */


context:
space:
mode: