VPP: Kernel Tuning and Cosmetic Fixes

- Added missing Kernel Tuning section in system settings for VPP
- Fixed inconsistent section hierarchy in NAT44 configuration documentation
- Fixed lost `netlink` from configuration commands in LCP settings
- Clarified CPU settings logic

1 files changed, 112 insertions, 0 deletions

diff --git a/docs/vpp/configuration/dataplane/system.rst b/docs/vpp/configuration/dataplane/system.rst
index ff8bfb61..5ed3b5e6 100644
--- a/docs/vpp/configuration/dataplane/system.rst
+++ b/docs/vpp/configuration/dataplane/system.rst
@@ -52,3 +52,115 @@ Both settings are automatically calculated based on configured hugepages.
 Kernel Tuning
 =============
 
+VPP performance greatly benefits from proper kernel tuning, especially CPU isolation and disabling unnecessary kernel features. These optimizations ensure dedicated CPU cores are available exclusively for VPP dataplane processing without interference from the kernel scheduler or other system processes.
+
+.. warning::
+
+   Kernel tuning changes require a system reboot to take effect.
+
+   Improper CPU isolation can lead to system instability if essential system processes are starved of CPU resources.
+
+CPU Isolation and Optimization
+-------------------------------
+
+CPU isolation is crucial for VPP performance as it dedicates specific CPU cores exclusively to VPP dataplane processing. The isolated cores are removed from the kernel scheduler and will not run regular system processes.
+
+**Disable NMI Watchdog**
+
+The NMI (Non-Maskable Interrupt) watchdog can interfere with VPP performance by generating interrupts on isolated cores and is not compatible with nohz-full mode:
+
+.. cfgcmd:: set system option kernel cpu disable-nmi-watchdog
+
+   Disables the NMI watchdog for detecting hard CPU lockups. This prevents unnecessary interrupts on VPP worker cores.
+
+**CPU Core Isolation**
+
+.. cfgcmd:: set system option kernel cpu isolate-cpus <cpu-range>
+
+   Isolates specified CPUs from the kernel scheduler. Isolated cores will not run regular system processes and are dedicated to applications like VPP.
+
+   The ``<cpu-range>`` can be:
+   
+   * Single core: ``2``
+   * Range: ``2-5``
+   * Mixed: ``1,3-5,7``
+
+   ..important:: 
+
+      Always reserve at least 1-2 cores for the operating system to ensure system stability. For example, on a 4-core system, isolate cores 2-3 for VPP and leave cores 0-1 for the OS.
+
+      Assign the first isolated core as the VPP main core and the remaining isolated cores as VPP worker cores. Ensure that VPP CPU assignments match the isolated CPU range.
+
+**Adaptive-Tick Mode**
+
+.. cfgcmd:: set system option kernel cpu nohz-full <cpu-range>
+
+   Enables adaptive-tick mode (NO_HZ_FULL) for specified CPUs. This causes the kernel to avoid sending scheduling-clock interrupts to CPUs that have only one runnable task, significantly reducing interrupt overhead for dedicated workloads like VPP.
+
+   Use the same CPU range as configured for ``isolate-cpus``.
+
+**RCU Callback Offloading**
+
+.. cfgcmd:: set system option kernel cpu rcu-no-cbs <cpu-range>
+
+   Offloads Read-Copy-Update (RCU) callback processing from specified CPUs. This ensures that RCU callbacks do not prevent the specified CPUs from entering dyntick-idle or adaptive-tick mode, which is essential for nohz-full functionality.
+
+   Use the same CPU range as configured for ``isolate-cpus``.
+
+System Optimization
+--------------------
+
+Additional kernel optimizations can further improve VPP performance by disabling unnecessary features and reducing system overhead.
+
+**Disable High Precision Event Timer**
+
+.. cfgcmd:: set system option kernel disable-hpet
+
+   Disables the High Precision Event Timer (HPET). HPET can cause additional interrupts and overhead that may impact VPP performance.
+
+**Disable Machine Check Exceptions**
+
+.. cfgcmd:: set system option kernel disable-mce
+
+   Disables Machine Check Exception (MCE) reporting and handling. While MCE provides hardware error detection, it can introduce latency in high-performance scenarios.
+
+**Disable CPU Power Saving**
+
+.. cfgcmd:: set system option kernel disable-power-saving
+
+   Disables CPU power saving mechanisms (C-states). This keeps CPU cores at maximum performance levels, eliminating latency from power state transitions.
+
+**Disable Soft Lockup Detection**
+
+.. cfgcmd:: set system option kernel disable-softlockup
+
+   Disables the soft lockup detector for kernel threads. This prevents false positives when VPP worker threads are busy processing packets.
+
+**Disable CPU Mitigations**
+
+.. cfgcmd:: set system option kernel disable-mitigations
+
+   Disables all optional CPU mitigations for security vulnerabilities (e.g., Spectre, Meltdown). This may improve performance on some platforms.
+
+Optimal Configuration Example
+-----------------------------
+
+For a system with 4 CPU cores (0-3) where cores 2-3 are dedicated to VPP:
+
+.. code-block:: none
+
+   # Kernel CPU optimizations
+   set system option kernel cpu disable-nmi-watchdog
+   set system option kernel cpu isolate-cpus '2-3'
+   set system option kernel cpu nohz-full '2-3'
+   set system option kernel cpu rcu-no-cbs '2-3'
+   
+   # System optimizations
+   set system option kernel disable-hpet
+   set system option kernel disable-mce
+   set system option kernel disable-power-saving
+   set system option kernel disable-softlockup
+   
+   # VPP CPU assignment (matches isolated cores)
+   set vpp settings cpu main-core '2'
+   set vpp settings cpu corelist-workers '3'