Re:Re: Performance regression in ip_set_swap on 6.1.69

[Jozsef Kadlecsik]

Hi,

On Thu, 11 Jan 2024, David Wang wrote:

> At 2024-01-11 16:25:46, "Jozsef Kadlecsik" <kadlec@xxxxxxxxxxxxxxxxx> wrote:
> >
> >
> >Could you check that the patch below fixes the performance regression? 
> >Instead of waiting for the RCU grace period at swapping, call_rcu() is 
> >used at destroying the set.
> 
> Got a compiler error:
> net/netfilter/ipset/ip_set_core.c: In function ‘ip_set_destroy_set_rcu’:
> net/netfilter/ipset/ip_set_core.c:1017:9: error: implicit declaration of function ‘ip_set_destroy_set’; did you mean ‘ip_set_destroy_set_rcu’? [-Werror=implicit-function-declaration]
>  1017 |         ip_set_destroy_set(set);
>       |         ^~~~~~~~~~~~~~~~~~
>       |         ip_set_destroy_set_rcu
> net/netfilter/ipset/ip_set_core.c: At top level:
> net/netfilter/ipset/ip_set_core.c:1183:1: warning: conflicting types for ‘ip_set_destroy_set’; have ‘void(struct ip_set *)’
>  1183 | ip_set_destroy_set(struct ip_set *set)
>       | ^~~~~~~~~~~~~~~~~~
> net/netfilter/ipset/ip_set_core.c:1183:1: error: static declaration of ‘ip_set_destroy_set’ follows non-static declaration
>
>  I move the declaration of ip_set_destroy_set_rcu, make sure it is after 
> the declaration of ip_set_destroy_set, With this path, the performance 
> degradation of ipset_swap is gone,

Thanks! I wrote the patch for the ipset package code and while it applies 
to the vanilla kernel source, function definiton ordering got broken. 
Sorry, I should have to double check.

> but my test only stress ipset_swap, not a swap/destroy sequence. I will 
> adjust my code to stress a full swap/destroy/create/add sequence, and 
> update later.

The synchronize_rcu() in ip_set_swap() was added to exclude the parallel 
swap+destroy and kernel side add/del/test operations, which can be tested 
with the commands

    ipset create hash_ip1 hash:net family inet hashsize 1024 maxelem 1048576
    ipset add hash_ip1 172.20.0.0/16
    ipset add hash_ip1 192.168.0.0/16
    iptables -A INPUT -m set --match-set hash_ip1 src -j ACCEPT
    while [ 1 ]
    do
            # ... Ongoing traffic...
            ipset create hash_ip2 hash:net family inet hashsize 1024 maxelem 1048576
            ipset add hash_ip2 172.20.0.0/16
            ipset swap hash_ip1 hash_ip2
            ipset destroy hash_ip2
            sleep 0.05
    done

I have checked it but the virtual machine on my dev laptop might be too 
slow to trigger the case.

Best regards,
Jozsef
-- 
E-mail  : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxx
PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics
          H-1525 Budapest 114, POB. 49, Hungary