ipfw: Reindent; no functional changes.

ipfw: Simplify sockopt.

ipfw: Rework states and tracks.

- Use RB tree for states and tracks. And put them into their own RB
trees. This avoid worst case hash collision.
- Make states per-cpu. Upper limit is still shar

ipfw: Rework states and tracks.

- Use RB tree for states and tracks. And put them into their own RB
trees. This avoid worst case hash collision.
- Make states per-cpu. Upper limit is still shared, and is managed in
the same fashion as our slab allocator's upper limit, i.e. loosely
updated, which allows 5% over-allocation at most.
- Use two tiers for tracks. The top tier is shared, which maintains
the counter. The second tier is per-cpu, most of the track looking
up should be coverd by this tier. Track counters are updated by
atomic ops, since per-track upper limit is usually too small to use
loose updating.
- Implement progressive state/track expiration and keepalive. It is
mainly intended to make the packet processing latency more smooth.
- Fix fast TCP state recycling issue by tracking the SEQs in addition
to the ACKs.

This drastically improves performance, and reduces/stablizes latency.

For exmaple, nginx, 1KB web object, 30K concurrent connections,
1 request/connection. ipfw is running on the server side.

ipfw non-default setting:
- Max # of states for new-ipfw is 100K (~14MB memory).
- Max # of states for old-ipfw is 500K, and # of hash buckets is 64K.

ipfw rules:
ipfw add 1 check-state
ipfw add allow tcp from any to me 80 setup keep-state
(default deny)

| perf-avg | lat-avg | lat-stdev | lat-99% | lat-max
| (tps) | (ms) | (ms) | (ms) | (ms)
---------+-----------+---------+-----------+---------+---------
no-ipfw | 210658.80 | 58.01 | 5.20 | 68.73 | 146.46
---------+-----------+---------+-----------+---------+---------
new-ipfw | 191626.58 | 64.74 | 5.69 | 75.87 | 166.08
---------+-----------+---------+-----------+---------+---------
old-ipfw | 43481.19 | 153.76 | 47.32 | 296.61 | 425.09

If it is compared w/ no-ipfw case, the performance and latency impacts
of the ipfw after this commit are pretty small.

show more ...

Initial import of binutils 2.22 on the new vendor branch

Future versions of binutils will also reside on this branch rather
than continuing to create new binutils branches for each new version.

Move ipfw(4) related bits into ip_fw2_glue.c

- Add macro for cpu_portfn(0), on which all ipfw configuration should happen
- Add assertion macro to make sure a msgport is IPFW_CFGPORT

Dispatch ipfw control to netisr0. To avoid possible dangling netmsg handler,
create ip_fw2_glue.c, which will be built if inet is built. IPFW_LOADED is
checked again after netmsg's handler is runni

Dispatch ipfw control to netisr0. To avoid possible dangling netmsg handler,
create ip_fw2_glue.c, which will be built if inet is built. IPFW_LOADED is
checked again after netmsg's handler is running, since ipfw unload netmsg may
be processed before this ipfw control netmsg.

show more ...

network - Major netmsg retooling, part 1

* Remove all the netmsg shims and make all pr_usrreqs and some proto->pr_*
requests directly netmsg'd.

* Fix issues with tcp implied connects and tcp6->tc

network - Major netmsg retooling, part 1

* Remove all the netmsg shims and make all pr_usrreqs and some proto->pr_*
requests directly netmsg'd.

* Fix issues with tcp implied connects and tcp6->tcp4 fallbacks with
implied connects.

* Fix an issue with a stack-based udp netmsg (allocate it)

* Consolidate struct ip6protosw and struct protosw into a single
structure and normalize the API functions which differed between
the two (primarily proto->pr_input()).

* Remove protosw->pr_soport()

* Replace varargs protocol *_input() functions (ongoing) with fixed
arguments.

show more ...

network - Move socket from netmsg ext to netmsg header, add port to socket

These changes should make it easier to debug mbufs routed to the wrong
protocol threads. Note that IPV6 is routed to netis

network - Move socket from netmsg ext to netmsg header, add port to socket

These changes should make it easier to debug mbufs routed to the wrong
protocol threads. Note that IPV6 is routed to netisr0, even for tcp and udp
packets, so for now we do not KKASSERT that the port matches directly.

The TCP code still KKASSERTs that the timers are running on the correct cpu,
since the cpu is still correct for IPV6 TCP/UDP packets even when the
protocol thread is wrong (netisr_cpu 0 instead of tcp_thread 0 or
udp_thread 0).

* Instead of recalculating the port based on the inp or mbuf all the time,
add a so_port field to the socket structure directly.

* The socket pointer is now part of the netmsg header, even though some
subsystems do not need it. This allows us to validate the message port
more easily.

show more ...