• Jesper Dangaard Brouer's avatar
    netfilter: conntrack: remove central spinlock nf_conntrack_lock · 93bb0ceb
    Jesper Dangaard Brouer authored
    nf_conntrack_lock is a monolithic lock and suffers from huge contention
    on current generation servers (8 or more core/threads).
    
    Perf locking congestion is clear on base kernel:
    
    -  72.56%  ksoftirqd/6  [kernel.kallsyms]    [k] _raw_spin_lock_bh
       - _raw_spin_lock_bh
          + 25.33% init_conntrack
          + 24.86% nf_ct_delete_from_lists
          + 24.62% __nf_conntrack_confirm
          + 24.38% destroy_conntrack
          + 0.70% tcp_packet
    +   2.21%  ksoftirqd/6  [kernel.kallsyms]    [k] fib_table_lookup
    +   1.15%  ksoftirqd/6  [kernel.kallsyms]    [k] __slab_free
    +   0.77%  ksoftirqd/6  [kernel.kallsyms]    [k] inet_getpeer
    +   0.70%  ksoftirqd/6  [nf_conntrack]       [k] nf_ct_delete
    +   0.55%  ksoftirqd/6  [ip_tables]          [k] ipt_do_table
    
    This patch change conntrack locking and provides a huge performance
    improvement.  SYN-flood attack tested on a 24-core E5-2695v2(ES) with
    10Gbit/s ixgbe (with tool trafgen):
    
     Base kernel:   810.405 new conntrack/sec
     After patch: 2.233.876 new conntrack/sec
    
    Notice other floods attack (SYN+ACK or ACK) can easily be deflected using:
     # iptables -A INPUT -m state --state INVALID -j DROP
     # sysctl -w net/netfilter/nf_conntrack_tcp_loose=0
    
    Use an array of hashed spinlocks to protect insertions/deletions of
    conntracks into the hash table. 1024 spinlocks seem to give good
    results, at minimal cost (4KB memory). Due to lockdep max depth,
    1024 becomes 8 if CONFIG_LOCKDEP=y
    
    The hash resize is a bit tricky, because we need to take all locks in
    the array. A seqcount_t is used to synchronize the hash table users
    with the resizing process.
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Reviewed-by: default avatarFlorian Westphal <fw@strlen.de>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    93bb0ceb
conntrack.h 2.63 KB