From mboxrd@z Thu Jan 1 00:00:00 1970 From: Patrick McHardy Subject: Re: Quota on SMP AGAIN Date: Sun, 30 Dec 2007 18:36:52 +0100 Message-ID: <4777D734.7090405@trash.net> References: <4773C13D.1040106@simm.ru> <477515BB.1060303@trash.net> <477520C3.8040501@trash.net> <47752958.3010601@trash.net> <47767699.2020302@trash.net> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: Krzysztof Oledzki , gpf , Netfilter Developer Mailing List , Eric Dumazet To: Jan Engelhardt Return-path: Received: from stinky.trash.net ([213.144.137.162]:52789 "EHLO stinky.trash.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751212AbXL3RhH (ORCPT ); Sun, 30 Dec 2007 12:37:07 -0500 In-Reply-To: Sender: netfilter-devel-owner@vger.kernel.org List-ID: Jan Engelhardt wrote: > On Dec 29 2007 19:54, Krzysztof Oledzki wrote: > >>> That doesn't help, the problem is that we keep only the counters on >>> CPU0 up to date, but the data copied to userspace during iptables -L >>> is chosen by the CPU the iptables command is running on. >>> >> As a short-term workaround one can use taskset to force running iptables on >> CPU#0. >> >> > > Actually, on one (but fixed) arbitrary core. Indeed, what a mess. I was just about to commit a patch to always use first_cpu(cpu_possible_map) for copy_entries_to_user, but thats no enough, we also need to force ruleset replacement to choose the same CPU. This effectively eliminates all performance improvements of the NUMA optimizations during ruleset updates. Its ugly (not much more than other parts of iptables though), but we should be able to keep half the improvement by using raw_smp_processor_id() for ruleset replacements and storing that number for the next copy_entries_to_user operations. Alternatively we could flag the matches and targets requiring this and fix them up during the second pass (counter fixup). Most of them are rather rarely used I guess (limit, hashlimit, quota and statistic). Eric, do you have any better suggestions how to fix this?