From owner-freebsd-hackers@FreeBSD.ORG Sat Oct 18 20:43:43 2008 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id D9344106568B for ; Sat, 18 Oct 2008 20:43:43 +0000 (UTC) (envelope-from sam@freebsd.org) Received: from ebb.errno.com (ebb.errno.com [69.12.149.25]) by mx1.freebsd.org (Postfix) with ESMTP id AC2C48FC08 for ; Sat, 18 Oct 2008 20:43:43 +0000 (UTC) (envelope-from sam@freebsd.org) Received: from trouble.errno.com (trouble.errno.com [10.0.0.248]) (authenticated bits=0) by ebb.errno.com (8.13.6/8.12.6) with ESMTP id m9IKPNWE060744 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sat, 18 Oct 2008 13:25:23 -0700 (PDT) (envelope-from sam@freebsd.org) Message-ID: <48FA4633.9090500@freebsd.org> Date: Sat, 18 Oct 2008 13:25:23 -0700 From: Sam Leffler Organization: FreeBSD Project User-Agent: Thunderbird 2.0.0.9 (X11/20071125) MIME-Version: 1.0 To: Max Laier References: <200810181655.m9IGtxWk089117@freefall.freebsd.org> <48FA1756.1080708@freebsd.org> <200810182018.13757.max@love2party.net> In-Reply-To: <200810182018.13757.max@love2party.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-DCC--Metrics: ebb.errno.com; whitelist Cc: freebsd-net@freebsd.org, freebsd-hackers@freebsd.org Subject: Re: conf/128030: [request] Isn't it time to enable IPsec in GENERIC? X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Oct 2008 20:43:43 -0000 Max Laier wrote: > On Saturday 18 October 2008 19:05:26 Sam Leffler wrote: > >> gavin@freebsd.org wrote: >> >>> Synopsis: [request] Isn't it time to enable IPsec in GENERIC? >>> >>> Responsible-Changed-From-To: freebsd-bugs->freebsd-net >>> Responsible-Changed-By: gavin >>> Responsible-Changed-When: Sat Oct 18 16:55:14 UTC 2008 >>> Responsible-Changed-Why: >>> Over to maintainer(s) for consideration >>> >>> http://www.freebsd.org/cgi/query-pr.cgi?pr=128030 >>> >> Last I checked IPSEC added noticeable overhead. Before anyone does this >> you need to measure the cost of having it enabled but not used. >> > > It should be possible to turn IPSEC into a module - maybe only loadable on > boot to avoid locking issues. This would reduce the overhead to a handful of > function pointer checks that should not impact performance (thanks to modern > branch prediction and cache sizes). This would have to be measured as well, > of course. Maybe this should go to the project page? It's a good junior > kernel hacker project, I believe. > > I believe the most important issue are the SADB checks in the tx path. It used to be possible to do them cheaply by checking a single ptr value but now it's much more expensive. My memory is hazy as it's been a while. Sam