On Thu, 2010-12-16 at 15:12 +0100, Eric Dumazet wrote: > Le jeudi 16 dÃcembre 2010 Ã 15:04 +0100, Jesper Dangaard Brouer a > > The vmalloc size is approx 19 MB (19.820.544 bytes) (see > > /proc/vmallocinfo). Looking through vmallocinfo I realized that > > even-though I only have 16 CPUs, there is 32 allocated rulesets > > "xt_alloc_table_info" (for the filter table). Thus, I have approx > > 634MB iptables filter rules in the kernel, half of which is totally > > unused. > > Boot your machine with : "maxcpus=16 possible_cpus=16", it will be much > better ;) Good, trick. I'll use that. > > Guess this is because we use: "for_each_possible_cpu" instead of > > "for_each_online_cpu". (Feel free to fix this, or point me to some > > documentation of this CPU hotplug stuff... I see we are missing > > get_cpu() and put_cpu() a lot of places). > > Are you really using cpu hotplug ? If not, the "maxcpus=16 > possible_cpus=16" trick should be enough for you. No, not using hotplug CPUs. Its just a pitty that we waste kernel memory on this, for every one which does not know the "maxcpus=16 possible_cpus=16" trick... But as I don't have a hotplug CPU system, I have no chance of testing an eventual code fix/patch. > > > > In order to accelerate, you could eventually pre-fill cpu cache before > the local_bh_disable() (just reading the table). So that critical > section is short, because mostly in your cpu cache. In my case I think this will not help. I'll kill the cache anyways, as the ruleset is 19MB and my CPU cache is 8MB. -- Med venlig hilsen / Best regards Jesper Brouer ComX Networks A/S Linux Network Kernel Developer Cand. Scient Datalog / MSc.CS Author of http://adsl-optimizer.dk LinkedIn: http://www.linkedin.com/in/brouer -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
