diff options
author | luigi <luigi@FreeBSD.org> | 2009-12-22 19:01:47 +0000 |
---|---|---|
committer | luigi <luigi@FreeBSD.org> | 2009-12-22 19:01:47 +0000 |
commit | 2043aec45642350832212819a4c7cf828ba2dffa (patch) | |
tree | 212a476e3a032fe33a57f72f211a5e84e676bbd4 /sys/net | |
parent | 69eb1537ebfe9e513651b7095899759cee1b96aa (diff) | |
download | FreeBSD-src-2043aec45642350832212819a4c7cf828ba2dffa.zip FreeBSD-src-2043aec45642350832212819a4c7cf828ba2dffa.tar.gz |
merge code from ipfw3-head to reduce contention on the ipfw lock
and remove all O(N) sequences from kernel critical sections in ipfw.
In detail:
1. introduce a IPFW_UH_LOCK to arbitrate requests from
the upper half of the kernel. Some things, such as 'ipfw show',
can be done holding this lock in read mode, whereas insert and
delete require IPFW_UH_WLOCK.
2. introduce a mapping structure to keep rules together. This replaces
the 'next' chain currently used in ipfw rules. At the moment
the map is a simple array (sorted by rule number and then rule_id),
so we can find a rule quickly instead of having to scan the list.
This reduces many expensive lookups from O(N) to O(log N).
3. when an expensive operation (such as insert or delete) is done
by userland, we grab IPFW_UH_WLOCK, create a new copy of the map
without blocking the bottom half of the kernel, then acquire
IPFW_WLOCK and quickly update pointers to the map and related info.
After dropping IPFW_LOCK we can then continue the cleanup protected
by IPFW_UH_LOCK. So userland still costs O(N) but the kernel side
is only blocked for O(1).
4. do not pass pointers to rules through dummynet, netgraph, divert etc,
but rather pass a <slot, chain_id, rulenum, rule_id> tuple.
We validate the slot index (in the array of #2) with chain_id,
and if successful do a O(1) dereference; otherwise, we can find
the rule in O(log N) through <rulenum, rule_id>
All the above does not change the userland/kernel ABI, though there
are some disgusting casts between pointers and uint32_t
Operation costs now are as follows:
Function Old Now Planned
-------------------------------------------------------------------
+ skipto X, non cached O(N) O(log N)
+ skipto X, cached O(1) O(1)
XXX dynamic rule lookup O(1) O(log N) O(1)
+ skipto tablearg O(N) O(1)
+ reinject, non cached O(N) O(log N)
+ reinject, cached O(1) O(1)
+ kernel blocked during setsockopt() O(N) O(1)
-------------------------------------------------------------------
The only (very small) regression is on dynamic rule lookup and this will
be fixed in a day or two, without changing the userland/kernel ABI
Supported by: Valeria Paoli
MFC after: 1 month
Diffstat (limited to 'sys/net')
-rw-r--r-- | sys/net/if_bridge.c | 15 | ||||
-rw-r--r-- | sys/net/if_ethersubr.c | 12 |
2 files changed, 16 insertions, 11 deletions
diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c index d7de38e..b380ef0 100644 --- a/sys/net/if_bridge.c +++ b/sys/net/if_bridge.c @@ -3039,20 +3039,23 @@ bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir) goto bad; } + /* XXX this section is also in if_ethersubr.c */ if (V_ip_fw_chk_ptr && pfil_ipfw != 0 && dir == PFIL_OUT && ifp != NULL) { struct dn_pkt_tag *dn_tag; error = -1; dn_tag = ip_dn_claim_tag(*mp); - if (dn_tag != NULL) { - if (dn_tag->rule != NULL && V_fw_one_pass) + if (dn_tag == NULL) { + args.slot = 0; + } else { + if (dn_tag->slot != 0 && V_fw_one_pass) /* packet already partially processed */ goto ipfwpass; - args.rule = dn_tag->rule; /* matching rule to restart */ - args.rule_id = dn_tag->rule_id; + args.slot = dn_tag->slot; /* next rule to use */ args.chain_id = dn_tag->chain_id; - } else - args.rule = NULL; + args.rulenum = dn_tag->rulenum; + args.rule_id = dn_tag->rule_id; + } args.m = *mp; args.oif = ifp; diff --git a/sys/net/if_ethersubr.c b/sys/net/if_ethersubr.c index 8d06926..95554ca 100644 --- a/sys/net/if_ethersubr.c +++ b/sys/net/if_ethersubr.c @@ -471,15 +471,17 @@ ether_ipfw_chk(struct mbuf **m0, struct ifnet *dst, int shared) dn_tag = ip_dn_claim_tag(*m0); - if (dn_tag != NULL) { - if (dn_tag->rule != NULL && V_fw_one_pass) + if (dn_tag == NULL) { + args.slot = 0; + } else { + if (dn_tag->slot != 0 && V_fw_one_pass) /* dummynet packet, already partially processed */ return (1); - args.rule = dn_tag->rule; /* matching rule to restart */ + args.slot = dn_tag->slot; /* matching rule to restart */ + args.rulenum = dn_tag->rulenum; args.rule_id = dn_tag->rule_id; args.chain_id = dn_tag->chain_id; - } else - args.rule = NULL; + } /* * I need some amt of data to be contiguous, and in case others need |