From: Florian Westphal <fw@strlen.de>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Imre Palik <imrep.amz@gmail.com>,
David Miller <davem@davemloft.net>,
imrep@amazon.de, fw@strlen.de, bridge@lists.linux-foundation.org,
stephen@networkplumber.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, aliguori@amazon.com,
nbd@openwrt.org
Subject: Re: [RFC PATCH v2] bridge: make it possible for packets to traverse the bridge without hitting netfilter
Date: Fri, 6 Mar 2015 17:37:00 +0100 [thread overview]
Message-ID: <20150306163700.GC20382@breakpoint.cc> (raw)
In-Reply-To: <20150306142932.GA15926@salvia>
Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Fri, Mar 06, 2015 at 11:34:29AM +0100, Imre Palik wrote:
> > On 02/26/15 17:34, David Miller wrote:
> > > From: Imre Palik <imrep@amazon.de>
> > > Date: Thu, 26 Feb 2015 11:19:25 +0100
> > >
> > >> If you are looking for peculiarities in my setup then here they are:
> > >> I am on 4k pages, and perf is not working :-(
> > >> (I am trying to fix those too, but that is far from being a low hanging fruit.)
> > >> So my guess would be that the packet pipeline doesn't fit in the cache/tlb
> > >
> > > Pure specualtion until you can actually use perf to measure these
> > > things.
> > >
> > > And I don't want to apply patches which were designed based upon
> > > pure speculation.
> > >
> >
> > I did performance measurements in the following way:
> >
> > Removed those pieces of the packet pipeline that I don't necessarily
> > need one-by-one. Then measured their effect on small packet
> > performance.
> >
> > This was the only part that produced considerable effect.
> >
> > The pure speculation was about why the effect is more than 15%
> > increase in packet throughput, although the code path avoided
> > contains way less code than 15% of the packet pipeline. It seems,
> > Felix Fietkau profiled similar changes, and found my guess well
> > founded.
> >
> > Now could anybody explain me what else is wrong with my patch?
>
> We have to come up with a more generic solution for this.
Jiri Benc suggested to allowing to attach netfilter hooks e.g. via tc
action, maybe that would be an option worth investigating.
Then you could for instance add filtering rules only to the bridge port
that needs it.
> These sysfs tweaks you're proposing look to me like an obscure way to
> tune this.
I agree, adding more tunables isn't all that helpful, in the past this
only helped to prolong the problem.
next prev parent reply other threads:[~2015-03-06 16:37 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-02-23 15:26 [RFC PATCH v2] bridge: make it possible for packets to traverse the bridge without hitting netfilter Imre Palik
2015-02-23 16:06 ` Florian Westphal
2015-02-26 10:19 ` Imre Palik
2015-02-26 16:34 ` David Miller
2015-03-06 10:34 ` Imre Palik
2015-03-06 14:29 ` Pablo Neira Ayuso
2015-03-06 16:37 ` Florian Westphal [this message]
2018-03-09 15:31 ` David Woodhouse
2018-03-09 15:57 ` David Miller
2018-03-09 16:15 ` David Woodhouse
2018-03-09 16:26 ` Florian Westphal
2015-03-06 17:49 ` David Miller
2015-02-26 21:17 ` Felix Fietkau
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150306163700.GC20382@breakpoint.cc \
--to=fw@strlen.de \
--cc=aliguori@amazon.com \
--cc=bridge@lists.linux-foundation.org \
--cc=davem@davemloft.net \
--cc=imrep.amz@gmail.com \
--cc=imrep@amazon.de \
--cc=linux-kernel@vger.kernel.org \
--cc=nbd@openwrt.org \
--cc=netdev@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=stephen@networkplumber.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).