1. 20 Feb, 2009 2 commits
    • Hagen Paul Pfeifer's avatar
      netfilter: nf_conntrack: table max size should hold at least table size · e478075c
      Hagen Paul Pfeifer authored
      Table size is defined as unsigned, wheres the table maximum size is
      defined as a signed integer. The calculation of max is 8 or 4,
      multiplied the table size. Therefore the max value is aligned to
      unsigned.
      Signed-off-by: default avatarHagen Paul Pfeifer <hagen@jauu.net>
      Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      e478075c
    • Stephen Hemminger's avatar
      netfilter: iptables: lock free counters · 78454473
      Stephen Hemminger authored
      The reader/writer lock in ip_tables is acquired in the critical path of
      processing packets and is one of the reasons just loading iptables can cause
      a 20% performance loss. The rwlock serves two functions:
      
      1) it prevents changes to table state (xt_replace) while table is in use.
         This is now handled by doing rcu on the xt_table. When table is
         replaced, the new table(s) are put in and the old one table(s) are freed
         after RCU period.
      
      2) it provides synchronization when accesing the counter values.
         This is now handled by swapping in new table_info entries for each cpu
         then summing the old values, and putting the result back onto one
         cpu.  On a busy system it may cause sampling to occur at different
         times on each cpu, but no packet/byte counts are lost in the process.
      Signed-off-by: default avatarStephen Hemminger <shemminger@vyatta.com>
      
      Sucessfully tested on my dual quad core machine too, but iptables only (no ipv6 here)
      BTW, my new "tbench 8" result is 2450 MB/s, (it was 2150 MB/s not so long ago)
      Acked-by: default avatarEric Dumazet <dada1@cosmosbay.com>
      Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
      78454473
  2. 19 Feb, 2009 3 commits
  3. 18 Feb, 2009 35 commits