netfilter-devel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org
Subject: [PATCH 01/12] netfilter: xt_CT: optimize XT_CT_NOTRACK
Date: Wed,  5 Jun 2013 22:40:22 +0200	[thread overview]
Message-ID: <1370464832-4216-2-git-send-email-pablo@netfilter.org> (raw)
In-Reply-To: <1370464832-4216-1-git-send-email-pablo@netfilter.org>

From: Eric Dumazet <edumazet@google.com>

The percpu untracked ct are not currently used for XT_CT_NOTRACK.

xt_ct_tg_check()/xt_ct_target() provides a single ct.

Thats not optimal as the ct->ct_general.use cache line will bounce among
cpus.

Use the intended [1] thing : xt_ct_target() should select the percpu
object.

[1] Refs :
commit 5bfddbd46a95c97 ("netfilter: nf_conntrack: IPS_UNTRACKED bit")
commit b3c5163fe0193a7 ("netfilter: nf_conntrack: per_cpu untracking")

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/xt_CT.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index a60261c..da35ac0 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -26,6 +26,9 @@ static inline int xt_ct_target(struct sk_buff *skb, struct nf_conn *ct)
 	if (skb->nfct != NULL)
 		return XT_CONTINUE;
 
+	/* special case the untracked ct : we want the percpu object */
+	if (!ct)
+		ct = nf_ct_untracked_get();
 	atomic_inc(&ct->ct_general.use);
 	skb->nfct = &ct->ct_general;
 	skb->nfctinfo = IP_CT_NEW;
@@ -186,8 +189,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 	int ret = -EOPNOTSUPP;
 
 	if (info->flags & XT_CT_NOTRACK) {
-		ct = nf_ct_untracked_get();
-		atomic_inc(&ct->ct_general.use);
+		ct = NULL;
 		goto out;
 	}
 
@@ -311,7 +313,7 @@ static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
 	struct nf_conn *ct = info->ct;
 	struct nf_conn_help *help;
 
-	if (!nf_ct_is_untracked(ct)) {
+	if (ct && !nf_ct_is_untracked(ct)) {
 		help = nfct_help(ct);
 		if (help)
 			module_put(help->helper->me);
@@ -319,8 +321,8 @@ static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
 		nf_ct_l3proto_module_put(par->family);
 
 		xt_ct_destroy_timeout(ct);
+		nf_ct_put(info->ct);
 	}
-	nf_ct_put(info->ct);
 }
 
 static void xt_ct_tg_destroy_v0(const struct xt_tgdtor_param *par)
-- 
1.7.10.4


  reply	other threads:[~2013-06-05 20:40 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-06-05 20:40 [PATCH 00/12] Netfilter/IPVS updates for net-next Pablo Neira Ayuso
2013-06-05 20:40 ` Pablo Neira Ayuso [this message]
2013-06-05 20:40 ` [PATCH 02/12] netfilter: xt_socket: use IP early demux Pablo Neira Ayuso
2013-06-05 20:40 ` [PATCH 03/12] bridge: netfilter: using strlcpy() instead of strncpy() Pablo Neira Ayuso
2013-06-05 20:40 ` [PATCH 04/12] netfilter: don't panic on error while walking through the init path Pablo Neira Ayuso
2013-06-05 20:40 ` [PATCH 05/12] netfilter: {ipt,ebt}_ULOG: rise warning on deprecation Pablo Neira Ayuso
2013-06-05 20:40 ` [PATCH 06/12] sched: add cond_resched_rcu() helper Pablo Neira Ayuso
2013-06-12 15:50   ` Paul E. McKenney
2013-06-05 20:40 ` [PATCH 07/12] ipvs: use cond_resched_rcu() helper when walking connections Pablo Neira Ayuso
2013-06-05 20:40 ` [PATCH 08/12] ipvs: change type of netns_ipvs->sysctl_sync_qlen_max Pablo Neira Ayuso
2013-06-05 20:40 ` [PATCH 10/12] netfilter: Implement RFC 1123 for FTP conntrack Pablo Neira Ayuso
2013-06-05 20:40 ` [PATCH 11/12] netfilter: nfnetlink_queue: cleanup copy_range usage Pablo Neira Ayuso
2013-06-05 20:40 ` [PATCH 12/12] netfilter: nfnetlink_queue: only add CAP_LEN attr when needed Pablo Neira Ayuso
2013-06-06  9:03 ` [PATCH 00/12] Netfilter/IPVS updates for net-next David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1370464832-4216-2-git-send-email-pablo@netfilter.org \
    --to=pablo@netfilter.org \
    --cc=davem@davemloft.net \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).