Re: [IPsec] Discussion of draft-pwouters-ipsecme-multi-sa-performance

2022-10-18 Thread Valery Smyslov
Hi Paul, > On Mon, 17 Oct 2022, Valery Smyslov wrote: > > [leaving cache/linux implementation details to Steffen to answer] > > > Another issue that is not clear from the draft - > > how per-CPU SAs are created. Consider the situation when > > an outgoing packet is handled by a CPU > > and there

Re: [IPsec] Discussion of draft-pwouters-ipsecme-multi-sa-performance

2022-10-18 Thread Valery Smyslov
Hi Paul, > On Mon, 17 Oct 2022, Valery Smyslov wrote: > > > implementation with say 10 CPUs. Does it make any difference for this > > implementation > > If it receives CPU_QUEUES with 100 or with 1000? It seems to me that in > > both cases > > it will follow its own local policy for limiting th

Re: [IPsec] Discussion of draft-pwouters-ipsecme-multi-sa-performance

2022-10-18 Thread Paul Wouters
On Tue, 18 Oct 2022, Valery Smyslov wrote: I think this is implementation specific. You could install an temporary rule into the SPD that would give the fallback SA more priority than the per-CPU policy installed, so it wouldn't generate ACQUIRES for a while. Why for a while? And for how long?

Re: [IPsec] Discussion of draft-pwouters-ipsecme-multi-sa-performance

2022-10-18 Thread Paul Wouters
On Tue, 18 Oct 2022, Valery Smyslov wrote: implementation with say 10 CPUs. Does it make any difference for this implementation If it receives CPU_QUEUES with 100 or with 1000? It seems to me that in both cases it will follow its own local policy for limiting the number of per-CPU SAs, most pr