Hi,
The current workaround to disable parallel IPsec does not work.
Variable nettaskqs must not change at runtime. Interface input
queues choose the thread during init with ifiq_softnet = net_tq().
So it cannot be modified after pfkeyv2_send() sets the first SA in
kernel. Also changing the calculation in net_tq() may call task_del()
with a different taskq than task_add().
Instead of restricting the index of the first softnet task, use an
exclusive lock.
For now just move the comment. We can still decide if a write net
lock or kernel lock is better.
ok?
bluhm
Index: net/if.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/net/if.c,v
retrieving revision 1.642
diff -u -p -r1.642 if.c
--- net/if.c 30 Jun 2021 13:23:33 -0000 1.642
+++ net/if.c 20 Jul 2021 13:38:51 -0000
@@ -834,6 +834,12 @@ if_input_process(struct ifnet *ifp, stru
* to PF globals, pipex globals, unicast and multicast addresses
* lists and the socket layer.
*/
+
+ /*
+ * XXXSMP IPsec data structures are not ready to be accessed
+ * by multiple network threads in parallel. In this case
+ * use an exclusive lock.
+ */
NET_LOCK();
while ((m = ml_dequeue(ml)) != NULL)
(*ifp->if_input)(ifp, m);
@@ -3311,17 +3317,14 @@ unhandled_af(int af)
panic("unhandled af %d", af);
}
-/*
- * XXXSMP This tunable is here to work around the fact that IPsec
- * globals aren't ready to be accessed by multiple threads in
- * parallel.
- */
-int nettaskqs = NET_TASKQ;
-
struct taskq *
net_tq(unsigned int ifindex)
{
struct taskq *t = NULL;
+ static int nettaskqs;
+
+ if (nettaskqs == 0)
+ nettaskqs = min(NET_TASKQ, ncpus);
t = nettqmp[ifindex % nettaskqs];
Index: net/pfkeyv2.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/net/pfkeyv2.c,v
retrieving revision 1.218
diff -u -p -r1.218 pfkeyv2.c
--- net/pfkeyv2.c 14 Jul 2021 22:39:26 -0000 1.218
+++ net/pfkeyv2.c 20 Jul 2021 12:48:30 -0000
@@ -2019,14 +2019,6 @@ pfkeyv2_send(struct socket *so, void *me
}
TAILQ_INSERT_HEAD(&ipsec_policy_head, ipo, ipo_list);
ipsec_in_use++;
- /*
- * XXXSMP IPsec data structures are not ready to be
- * accessed by multiple Network threads in parallel,
- * so force all packets to be processed by the first
- * one.
- */
- extern int nettaskqs;
- nettaskqs = 1;
} else {
ipo->ipo_last_searched = ipo->ipo_flags = 0;
}
