Messages in this thread | | | From | Andi Kleen <> | Subject | Re: [PATCH 0/3] netfilter : 3 patches to boost ip_tables performance | Date | Tue, 27 Sep 2005 18:23:18 +0200 |
| |
On Friday 23 September 2005 19:09, Harald Welte wrote: > On Thu, Sep 22, 2005 at 03:03:21PM +0200, Andi Kleen wrote: > > > 1) No more central rwlock protecting each table (filter, nat, mangle, > > > raw), but one lock per CPU. It avoids cache line ping pongs for each > > > packet. > > > > Another useful change would be to not take the lock when there are no > > rules. Currently just loading iptables has a large overhead. > > This is partially due to the netfilter hooks that are registered (so we > always take nf_hook_slow() in the NF_HOOK() macro).
Not sure it's that. nf_hook_slow uses RCU, so it should be quite fast.
> The default policies inside an iptables chain are internally implemented > as a rule. Thus, policies as built-in rules have packet/byte counters.
That could be special cased and done lockless, with the counting done per CPU.
-Andi - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |