Hi,
On Thu, 11 Jan 2024, David Wang wrote:
> At 2024-01-11 16:25:46, "Jozsef Kadlecsik" <kadlec@xxxxxxxxxxxxxxxxx> wrote:
> >
> >
> >Could you check that the patch below fixes the performance regression?
> >Instead of waiting for the RCU grace period at swapping, call_rcu() is
> >used at destroying the set.
>
> Got a compiler error:
> net/netfilter/ipset/ip_set_core.c: In function ‘ip_set_destroy_set_rcu’:
> net/netfilter/ipset/ip_set_core.c:1017:9: error: implicit declaration of function ‘ip_set_destroy_set’; did you mean ‘ip_set_destroy_set_rcu’? [-Werror=implicit-function-declaration]
> 1017 | ip_set_destroy_set(set);
> | ^~~~~~~~~~~~~~~~~~
> | ip_set_destroy_set_rcu
> net/netfilter/ipset/ip_set_core.c: At top level:
> net/netfilter/ipset/ip_set_core.c:1183:1: warning: conflicting types for ‘ip_set_destroy_set’; have ‘void(struct ip_set *)’
> 1183 | ip_set_destroy_set(struct ip_set *set)
> | ^~~~~~~~~~~~~~~~~~
> net/netfilter/ipset/ip_set_core.c:1183:1: error: static declaration of ‘ip_set_destroy_set’ follows non-static declaration
>
> I move the declaration of ip_set_destroy_set_rcu, make sure it is after
> the declaration of ip_set_destroy_set, With this path, the performance
> degradation of ipset_swap is gone,
Thanks! I wrote the patch for the ipset package code and while it applies
to the vanilla kernel source, function definiton ordering got broken.
Sorry, I should have to double check.
> but my test only stress ipset_swap, not a swap/destroy sequence. I will
> adjust my code to stress a full swap/destroy/create/add sequence, and
> update later.
The synchronize_rcu() in ip_set_swap() was added to exclude the parallel
swap+destroy and kernel side add/del/test operations, which can be tested
with the commands
ipset create hash_ip1 hash:net family inet hashsize 1024 maxelem 1048576
ipset add hash_ip1 172.20.0.0/16
ipset add hash_ip1 192.168.0.0/16
iptables -A INPUT -m set --match-set hash_ip1 src -j ACCEPT
while [ 1 ]
do
# ... Ongoing traffic...
ipset create hash_ip2 hash:net family inet hashsize 1024 maxelem 1048576
ipset add hash_ip2 172.20.0.0/16
ipset swap hash_ip1 hash_ip2
ipset destroy hash_ip2
sleep 0.05
done
I have checked it but the virtual machine on my dev laptop might be too
slow to trigger the case.
Best regards,
Jozsef
--
E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxx
PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics
H-1525 Budapest 114, POB. 49, Hungary
