Enabling Scalable I/O for IpSec packets

[rajkum]

Hi linux experts!

I wanted to know how I can enable scalable I/O in the case of IPSec encrypted packets to support RSS supported Intel NIC cards.

To explain a little more details, we have a system with a heavy n/w i/o traffic of IPSec encrypted packets. The system that we use is 8 core Intel Nehalam machine. What we see is that if IPSec is enabled, the whole load of encryption/decryption is getting loaded into only one of the 8 cores! But without IPSec, packets received from n/w are getting distributed across to all 8 cores.

I happened to know that Intel NIC supports RSS and if we wanted to distribute encrypted packets across to all 8 cores, we need to enable scalable I/O in linux 2.6.x kernel.

So, it would be of great great help if any of you can throw some light on this!!!

With lots of hope,
Rajesh

[Rubberman]

I don't know for sure, but I suspect that the IPSec sub-system is not reintrant, so all kernel calls to it have to queue, probably on a mutex or other semaphore. You need to dig into this and change it if possible. This will result in a custom kernel most likely, though if the code is in a loadable kernel module you might get away with just changing that instead of creating an entirely new kernel. As I said, I don't know for sure because I haven't got this deep into the network stack.

[rajkum]

Hi Rubberman,

Many thanks!

But unfortunately, I don't have the resources/expertise/time to make such kernel level changes.

I got to know from the Intel NIC support that if we can enable the scalable I/O in Linux kernel, then this traffic distribution across all the cores should be possible.

But do you know how to enable/configure scalable I/O in linux?

thanks,
-Rajesh

[Rubberman]

Hi Rubberman,

Many thanks!

But unfortunately, I don't have the resources/expertise/time to make such kernel level changes.

I got to know from the Intel NIC support that if we can enable the scalable I/O in Linux kernel, then this traffic distribution across all the cores should be possible.

But do you know how to enable/configure scalable I/O in linux?

thanks,
-Rajesh

Well, I think that's a kernel / driver issue. Without researching the kernel-level IPSec source code, I can't say what's involved, but I strongly suspect that to get what you want, load balancing across all CPU cores, then you are going to need to delve therein.