On Thu, Sep 22, 2005 at 03:03:21PM +0200, Andi Kleen wrote: > > > 1) No more central rwlock protecting each table (filter, nat, mangle, raw), > > but one lock per CPU. It avoids cache line ping pongs for each packet. > > Another useful change would be to not take the lock when there are no > rules. Currently just loading iptables has a large overhead. This is partially due to the netfilter hooks that are registered (so we always take nf_hook_slow() in the NF_HOOK() macro). The default policies inside an iptables chain are internally implemented as a rule. Thus, policies as built-in rules have packet/byte counters. Therefore, without making a semantic change, we cannot do any of the following optimizations: 1) not take a lock when the chain is empty 2) not register at the netfilter hook when the chain is empty. This is well-known, but I don't think we can change the semantics for the user during a stable kernel series. That's one point where not having 2.7.x really hurts. -- - Harald Welte <[email protected]> http://netfilter.org/ ============================================================================ "Fragmentation is like classful addressing -- an interesting early architectural error that shows how much experimentation was going on while IP was being designed." -- Paul Vixie
Attachment:
pgpL5tLBAF0Oz.pgp
Description: PGP signature
- Follow-Ups:
- References:
- [PATCH] Adds sys_set_mempolicy() in include/linux/syscalls.h
- From: Eric Dumazet <[email protected]>
- [PATCH 0/3] netfilter : 3 patches to boost ip_tables performance
- From: Eric Dumazet <[email protected]>
- Re: [PATCH 0/3] netfilter : 3 patches to boost ip_tables performance
- From: Andi Kleen <[email protected]>
- [PATCH] Adds sys_set_mempolicy() in include/linux/syscalls.h
- Prev by Date: Re: The system works (2.6.14-rc2): functional k8n-dl
- Next by Date: PCI/IRQ regressions in 2.6.13.2
- Previous by thread: Re: [PATCH 0/3] netfilter : 3 patches to boost ip_tables performance
- Next by thread: Re: [PATCH 0/3] netfilter : 3 patches to boost ip_tables performance
- Index(es):
