From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [PATCH ipsec-next 00/11] xfrm: policy: add inexact policy search tree Date: Thu, 08 Nov 2018 19:00:14 -0800 (PST) Message-ID: <20181108.190014.1425864633966867348.davem@davemloft.net> References: <20181107220041.26205-1-fw@strlen.de> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org To: fw@strlen.de Return-path: Received: from shards.monkeyblade.net ([23.128.96.9]:41858 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727238AbeKIMit (ORCPT ); Fri, 9 Nov 2018 07:38:49 -0500 In-Reply-To: <20181107220041.26205-1-fw@strlen.de> Sender: netdev-owner@vger.kernel.org List-ID: From: Florian Westphal Date: Wed, 7 Nov 2018 23:00:30 +0100 > This series attempts to improve xfrm policy lookup performance when > a lot of (several hundred or even thousands) inexact policies exist > on a system. > > On insert, a policy is either placed in hash table (all direct (/32 for > ipv4, /128 policies, or all policies matching a user-configured threshold). > All other policies get inserted into inexact list as per priority. > > Lookup then scans inexact list for first matching entry. > > This series instead makes it so that inexact policy is added to exactly > one of four different search list classes. > > 1. "Any:Any" list, containing policies where both saddr and daddr are > wildcards or have very coarse prefixes, e.g. 10.0.0.0/8 and the like. > 2. "saddr:any" list, containing policies with a fixed saddr/prefixlen, > but without destination restrictions. > These lists are stored in rbtree nodes; each node contains those > policies matching saddr/prefixlen. > 3. "Any:daddr" list. Similar to 2), except for policies where only the > destinations are specified. > 4. "saddr:daddr" lists, containing policies that match the given > source/destination network. > > The root of the saddr/daddr tree is stored in the nodes of the > 'daddr' tree. ... > Comments or questions welcome. Acked-by: David S. Miller This looks really great. Nice work Florian.