1. Mar 18, 2014
  2. Mar 17, 2014
    • Florian Westphal's avatar
      netfilter: connlimit: use rbtree for per-host conntrack obj storage · 7d084877
      Florian Westphal authored
      
      
      With current match design every invocation of the connlimit_match
      function means we have to perform (number_of_conntracks % 256) lookups
      in the conntrack table [ to perform GC/delete stale entries ].
      This is also the reason why ____nf_conntrack_find() in perf top has
      > 20% cpu time per core.
      
      This patch changes the storage to rbtree which cuts down the number of
      ct objects that need testing.
      
      When looking up a new tuple, we only test the connections of the host
      objects we visit while searching for the wanted host/network (or
      the leaf we need to insert at).
      
      The slot count is reduced to 32.  Increasing slot count doesn't
      speed up things much because of rbtree nature.
      
      before patch (50kpps rx, 10kpps tx):
      +  20.95%  ksoftirqd/0  [nf_conntrack] [k] ____nf_conntrack_find
      +  20.50%  ksoftirqd/1  [nf_conntrack] [k] ____nf_conntrack_find
      +  20.27%  ksoftirqd/2  [nf_conntrack] [k] ____nf_conntrack_find
      +   5.76%  ksoftirqd/1  [nf_conntrack] [k] hash_conntrack_raw
      +   5.39%  ksoftirqd/2  [nf_conntrack] [k] hash_conntrack_raw
      +   5.35%  ksoftirqd/0  [nf_conntrack] [k] hash_conntrack_raw
      
      after (90kpps, 51kpps tx):
      +  17.24%       swapper  [nf_conntrack]    [k] ____nf_conntrack_find
      +   6.60%   ksoftirqd/2  [nf_conntrack]    [k] ____nf_conntrack_find
      +   2.73%       swapper  [nf_conntrack]    [k] hash_conntrack_raw
      +   2.36%       swapper  [xt_connlimit]    [k] count_tree
      
      Obvious disadvantages to previous version are the increase in code
      complexity and the increased memory cost.
      
      Partially based on Eric Dumazets fq scheduler.
      
      Reviewed-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      7d084877
    • Florian Westphal's avatar
      netfilter: connlimit: make same_source_net signed · 50e0e9b1
      Florian Westphal authored
      
      
      currently returns 1 if they're the same.  Make it work like mem/strcmp
      so it can be used as rbtree search function.
      
      Reviewed-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      50e0e9b1
    • Florian Westphal's avatar
      netfilter: connlimit: use keyed locks · 1442e750
      Florian Westphal authored
      
      
      connlimit currently suffers from spinlock contention, example for
      4-core system with rps enabled:
      
      +  20.84%   ksoftirqd/2  [kernel.kallsyms] [k] _raw_spin_lock_bh
      +  20.76%   ksoftirqd/1  [kernel.kallsyms] [k] _raw_spin_lock_bh
      +  20.42%   ksoftirqd/0  [kernel.kallsyms] [k] _raw_spin_lock_bh
      +   6.07%   ksoftirqd/2  [nf_conntrack]    [k] ____nf_conntrack_find
      +   6.07%   ksoftirqd/1  [nf_conntrack]    [k] ____nf_conntrack_find
      +   5.97%   ksoftirqd/0  [nf_conntrack]    [k] ____nf_conntrack_find
      +   2.47%   ksoftirqd/2  [nf_conntrack]    [k] hash_conntrack_raw
      +   2.45%   ksoftirqd/0  [nf_conntrack]    [k] hash_conntrack_raw
      +   2.44%   ksoftirqd/1  [nf_conntrack]    [k] hash_conntrack_raw
      
      May allow parallel lookup/insert/delete if the entry is hashed to
      another slot.  With patch:
      
      +  20.95%  ksoftirqd/0  [nf_conntrack] [k] ____nf_conntrack_find
      +  20.50%  ksoftirqd/1  [nf_conntrack] [k] ____nf_conntrack_find
      +  20.27%  ksoftirqd/2  [nf_conntrack] [k] ____nf_conntrack_find
      +   5.76%  ksoftirqd/1  [nf_conntrack] [k] hash_conntrack_raw
      +   5.39%  ksoftirqd/2  [nf_conntrack] [k] hash_conntrack_raw
      +   5.35%  ksoftirqd/0  [nf_conntrack] [k] hash_conntrack_raw
      +   2.00%  ksoftirqd/1  [kernel.kallsyms] [k] __rcu_read_unlock
      
      Improved rx processing rate from ~35kpps to ~50 kpps.
      
      Reviewed-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
      Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
      1442e750
  3. Mar 15, 2014