From: Nikolay Aleksandrov <razor@blackwall.org>
To: netdev@vger.kernel.org
Cc: idosch@nvidia.com, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com, horms@kernel.org,
bridge@lists.linux.dev, Nikolay Aleksandrov <razor@blackwall.org>,
Pablo Neira Ayuso <pablo@netfilter.org>,
Florian Westphal <fw@strlen.de>, Phil Sutter <phil@nwl.cc>,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org
Subject: [PATCH net-next 12/12] net: bridge: fdb: avoid VLAN lookups in unicast forwarding
Date: Wed, 30 Sep 2026 10:14:11 +0300 [thread overview]
Message-ID: <20260930071411.2786201-13-razor@blackwall.org> (raw)
In-Reply-To: <20260930071411.2786201-1-razor@blackwall.org>
Pass the complete fdb destination to br_forward(). The tagged value is
decoded once into br_fwd_dst on entry so all subsequent forwarding checks
use the decoded port and VLAN. A cached port-VLAN is then used to avoid two
VLAN hash lookups in the standard unicast forwarding path. A backup-port
redirect also uses a raw destination because the cached VLAN belongs to the
original port.
[1] 64 byte vlan packets, 4k randomized fdb hits with 4k fdbs, 5 million
packets passed 5 times for every case
VIDs Ports Mpps Gbps CPU1 cycles/input
before after gain before after before after reduction
64 8/2 2.375486 2.635811 11.0% 1.216 1.350 1724.6 1553.7 9.9%
64 8/4 2.376731 2.636459 10.9% 1.217 1.350 1714.8 1554.7 9.3%
64 8/8 2.376621 2.635783 10.9% 1.217 1.350 1722.6 1553.2 9.8%
64 32/2 2.375876 2.637897 11.0% 1.216 1.351 1726.7 1552.3 10.1%
64 32/16 2.376442 2.636426 10.9% 1.217 1.350 1721.3 1554.2 9.7%
64 32/32 2.376763 2.636268 10.9% 1.217 1.350 1726.8 1553.5 10.0%
64 64/2 2.375678 2.638707 11.1% 1.216 1.351 1725.0 1552.1 10.0%
64 64/32 2.376681 2.637359 11.0% 1.217 1.350 1725.1 1555.9 9.8%
64 64/64 2.376787 2.638396 11.0% 1.217 1.351 1722.8 1550.9 10.0%
1024 8/2 2.263768 2.498881 10.4% 1.159 1.279 1808.5 1637.1 9.5%
1024 8/4 2.264519 2.499075 10.4% 1.159 1.280 1807.6 1638.8 9.3%
1024 8/8 2.263551 2.499231 10.4% 1.159 1.280 1812.0 1640.2 9.5%
1024 32/2 2.263841 2.499120 10.4% 1.159 1.280 1806.8 1639.6 9.3%
1024 32/16 2.263990 2.499562 10.4% 1.159 1.280 1806.1 1639.2 9.2%
1024 32/32 2.263719 2.498905 10.4% 1.159 1.279 1807.7 1639.3 9.3%
1024 64/2 2.263635 2.501889 10.5% 1.159 1.281 1809.4 1635.6 9.6%
1024 64/32 2.264467 2.500359 10.4% 1.159 1.280 1806.5 1633.0 9.6%
1024 64/64 2.240494 2.470246 10.3% 1.147 1.265 1810.0 1637.1 9.6%
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org>
---
CC: Pablo Neira Ayuso <pablo@netfilter.org>
CC: Florian Westphal <fw@strlen.de>
CC: Phil Sutter <phil@nwl.cc>
CC: netfilter-devel@vger.kernel.org
CC: coreteam@netfilter.org
net/bridge/br_device.c | 2 +-
net/bridge/br_forward.c | 24 +++++++++++++-----------
net/bridge/br_input.c | 2 +-
net/bridge/br_mrp.c | 6 +++---
net/bridge/br_private.h | 2 +-
net/bridge/netfilter/nft_reject_bridge.c | 8 ++++----
6 files changed, 23 insertions(+), 21 deletions(-)
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 2423d69f2498..0a1ce9e59a4d 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -108,7 +108,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
else
br_flood(br, vlan, skb, BR_PKT_MULTICAST, false, true);
} else if ((dst = br_fdb_find_rcu(br, dest, vid)) != NULL) {
- br_forward(br_fdb_dst_port(dst), skb, false, true);
+ br_forward(br_fdb_dst_read(dst), skb, false, true);
} else {
br_flood(br, vlan, skb, BR_PKT_UNICAST, false, true);
}
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index b5eece1ff9e8..82645db32efb 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -17,7 +17,7 @@
#include "br_private.h"
struct br_fwd_dst {
- const struct net_bridge_port *port;
+ struct net_bridge_port *port;
struct net_bridge_vlan *vlan;
};
@@ -149,35 +149,37 @@ static int deliver_clone(const struct br_fwd_dst *fwd,
/**
* br_forward - forward a packet to a specific port
- * @to: destination port
+ * @dst: bridge destination
* @skb: packet being forwarded
* @local_rcv: packet will be received locally after forwarding
* @local_orig: packet is locally originated
*
* Should be called with rcu_read_lock.
*/
-void br_forward(const struct net_bridge_port *to,
+void br_forward(struct net_bridge_dst dst,
struct sk_buff *skb, bool local_rcv, bool local_orig)
{
struct br_fwd_dst fwd;
- if (unlikely(!to))
+ br_dst_decode(dst, &fwd.port, &fwd.vlan);
+
+ if (unlikely(!fwd.port))
goto out;
/* redirect to backup link if the destination port is down */
- if (rcu_access_pointer(to->backup_port) &&
- (!netif_carrier_ok(to->dev) || !netif_running(to->dev))) {
+ if (rcu_access_pointer(fwd.port->backup_port) &&
+ (!netif_carrier_ok(fwd.port->dev) ||
+ !netif_running(fwd.port->dev))) {
struct net_bridge_port *backup_port;
- backup_port = rcu_dereference(to->backup_port);
+ backup_port = rcu_dereference(fwd.port->backup_port);
if (unlikely(!backup_port))
goto out;
- BR_INPUT_SKB_CB(skb)->backup_nhid = READ_ONCE(to->backup_nhid);
- to = backup_port;
+ BR_INPUT_SKB_CB(skb)->backup_nhid = READ_ONCE(fwd.port->backup_nhid);
+ fwd.port = backup_port;
+ fwd.vlan = NULL;
}
- fwd.port = to;
- fwd.vlan = NULL;
if (should_deliver(&fwd, skb)) {
if (local_rcv)
deliver_clone(&fwd, skb, local_orig);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 44a217d65e7f..fc2e381c4fe0 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -225,7 +225,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
if (now != READ_ONCE(dst->used))
WRITE_ONCE(dst->used, now);
- br_forward(br_fdb_dst_port(dst), skb, local_rcv, false);
+ br_forward(br_fdb_dst_read(dst), skb, local_rcv, false);
} else {
if (!mcast_hit)
br_flood(br, vlan, skb, pkt_type, local_rcv, false);
diff --git a/net/bridge/br_mrp.c b/net/bridge/br_mrp.c
index dce6efa96c4c..c8cd5b4f3af8 100644
--- a/net/bridge/br_mrp.c
+++ b/net/bridge/br_mrp.c
@@ -1219,11 +1219,11 @@ static int br_mrp_rcv(struct net_bridge_port *p,
forward:
if (p_dst)
- br_forward(p_dst, skb, true, false);
+ br_forward(br_port_to_dst(p_dst), skb, true, false);
if (s_dst)
- br_forward(s_dst, skb, true, false);
+ br_forward(br_port_to_dst(s_dst), skb, true, false);
if (i_dst)
- br_forward(i_dst, skb, true, false);
+ br_forward(br_port_to_dst(i_dst), skb, true, false);
no_forward:
return 1;
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index a1c5b1abc1ef..05921192ebda 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -1045,7 +1045,7 @@ enum br_pkt_type {
BR_PKT_BROADCAST
};
int br_dev_queue_push_xmit(struct net *net, struct sock *sk, struct sk_buff *skb);
-void br_forward(const struct net_bridge_port *to, struct sk_buff *skb,
+void br_forward(struct net_bridge_dst dst, struct sk_buff *skb,
bool local_rcv, bool local_orig);
int br_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb);
void br_flood(struct net_bridge *br, struct net_bridge_vlan *v,
diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
index cd2b04236a99..92b488793914 100644
--- a/net/bridge/netfilter/nft_reject_bridge.c
+++ b/net/bridge/netfilter/nft_reject_bridge.c
@@ -55,7 +55,7 @@ static void nft_reject_br_send_v4_tcp_reset(struct net *net,
nft_reject_br_push_etherhdr(oldskb, nskb);
- br_forward(br_port_get_rcu(dev), nskb, false, true);
+ br_forward(br_port_to_dst(br_port_get_rcu(dev)), nskb, false, true);
}
static void nft_reject_br_send_v4_unreach(struct net *net,
@@ -71,7 +71,7 @@ static void nft_reject_br_send_v4_unreach(struct net *net,
nft_reject_br_push_etherhdr(oldskb, nskb);
- br_forward(br_port_get_rcu(dev), nskb, false, true);
+ br_forward(br_port_to_dst(br_port_get_rcu(dev)), nskb, false, true);
}
static void nft_reject_br_send_v6_tcp_reset(struct net *net,
@@ -87,7 +87,7 @@ static void nft_reject_br_send_v6_tcp_reset(struct net *net,
nft_reject_br_push_etherhdr(oldskb, nskb);
- br_forward(br_port_get_rcu(dev), nskb, false, true);
+ br_forward(br_port_to_dst(br_port_get_rcu(dev)), nskb, false, true);
}
@@ -104,7 +104,7 @@ static void nft_reject_br_send_v6_unreach(struct net *net,
nft_reject_br_push_etherhdr(oldskb, nskb);
- br_forward(br_port_get_rcu(dev), nskb, false, true);
+ br_forward(br_port_to_dst(br_port_get_rcu(dev)), nskb, false, true);
}
static void nft_reject_bridge_eval(const struct nft_expr *expr,
--
2.47.3
next prev parent reply other threads:[~2026-09-30 7:15 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-30 7:13 [PATCH net-next 00/12] net: bridge: vlan: optimize standard fdb fwding path Nikolay Aleksandrov
2026-09-30 7:14 ` [PATCH net-next 01/12] net: bridge: introduce a bridge destination type Nikolay Aleksandrov
2026-10-01 7:24 ` Nikolay Aleksandrov
2026-10-02 19:45 ` Jakub Kicinski
2026-10-02 20:09 ` Nikolay Aleksandrov
2026-10-02 20:18 ` Jakub Kicinski
2026-09-30 7:14 ` [PATCH net-next 02/12] net: bridge: use net_bridge_dst for fdb destinations Nikolay Aleksandrov
2026-09-30 7:14 ` [PATCH net-next 03/12] net: bridge: add VLAN support to bridge destinations Nikolay Aleksandrov
2026-10-01 11:59 ` netdev-bot+sashiko
2026-10-01 12:03 ` Nikolay Aleksandrov
2026-09-30 7:14 ` [PATCH net-next 04/12] net: bridge: vlan: return VLAN entries from ingress helpers Nikolay Aleksandrov
2026-09-30 7:14 ` [PATCH net-next 05/12] net: bridge: fdb: pass VLAN entries to learning updates Nikolay Aleksandrov
2026-09-30 7:14 ` [PATCH net-next 06/12] net: bridge: fdb: consolidate port-VLAN cleanup Nikolay Aleksandrov
2026-10-01 11:59 ` netdev-bot+sashiko
2026-10-01 12:05 ` Nikolay Aleksandrov
2026-09-30 7:14 ` [PATCH net-next 07/12] net: bridge: vlan: split unpublishing from deletion Nikolay Aleksandrov
2026-09-30 7:14 ` [PATCH net-next 08/12] net: bridge: vlan: quiesce readers before freeing port VLANs Nikolay Aleksandrov
2026-10-01 7:28 ` Nikolay Aleksandrov
2026-10-01 11:59 ` netdev-bot+sashiko
2026-10-01 12:07 ` Nikolay Aleksandrov
2026-10-02 19:50 ` Jakub Kicinski
2026-10-02 19:59 ` Nikolay Aleksandrov
2026-09-30 7:14 ` [PATCH net-next 09/12] net: bridge: fdb: factor out existing entry updates Nikolay Aleksandrov
2026-09-30 7:14 ` [PATCH net-next 10/12] net: bridge: fdb: cache port VLANs in learned entries Nikolay Aleksandrov
2026-09-30 7:14 ` [PATCH net-next 11/12] net: bridge: fdb: cache VLAN destinations in configured entries Nikolay Aleksandrov
2026-10-01 7:36 ` Nikolay Aleksandrov
2026-09-30 7:14 ` Nikolay Aleksandrov [this message]
2026-10-02 20:00 ` [PATCH net-next 00/12] net: bridge: vlan: optimize standard fdb fwding path patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260930071411.2786201-13-razor@blackwall.org \
--to=razor@blackwall.org \
--cc=bridge@lists.linux.dev \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=horms@kernel.org \
--cc=idosch@nvidia.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
--cc=phil@nwl.cc \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox