[PATCH 0/10]: Improve SA insert/delete performance

[PATCH 0/10]: Improve SA insert/delete performance

[David Miller]

[ Jamal, you saw the first 5 patches already, the rest is new
  stuff. ]

These patches against the net-2.6 GIT tree try to address some
serious IPSEC SA insert/delete performance problems noticed
by Jamal.

1) Use dynamic hash table sizing for the xfrm_state lookup
   tables.

2) Do not walk all policies and flush bundles on xfrm_state
   changes, instead:
   a) On delete, just allow pending references to deleted
      xfrm_state objects to be handled by policy GC and
      xfrm_dst_check() which runs on every use of a cached
      xfrm dst route
   b) On insert, find xfrm_state objects that might alias with
      the one we are about to insert.  For all such aliases,
      update their generation cound which will force
      xfrm_bundle_ok() (and thus xfrm_dst_check) to consider
      the route stale, forcing a relookup.

Patches forthcoming.

Re: [PATCH 0/10]: Improve SA insert/delete performance

[jamal]

On Tue, 2006-15-08 at 04:37 -0700, David Miller wrote:
> [ Jamal, you saw the first 5 patches already, the rest is new
>   stuff. ]


Very cool ;-> Will test today.

cheers,
jamal

Re: [PATCH 0/10]: Improve SA insert/delete performance

[jamal]

On Tue, 2006-15-08 at 08:15 -0400, jamal wrote:

> Very cool ;-> Will test today.
> 

I can see in the range of ~50K SA adds per second ;->
I only went to about 350K SAs. A dual Xeon 2.6Ghz (sadly only with 1G
RAM).
So a small improvement from just the 5 initial patches; but nevertheless
a huge improvement from the current status quo. 
Good stuff!

cheers,
jamal