• Jesper Dangaard Brouer's avatar
    net: reduce cycles spend on ICMP replies that gets rate limited · c0303efe
    Jesper Dangaard Brouer authored
    This patch split the global and per (inet)peer ICMP-reply limiter
    code, and moves the global limit check to earlier in the packet
    processing path.  Thus, avoid spending cycles on ICMP replies that
    gets limited/suppressed anyhow.
    
    The global ICMP rate limiter icmp_global_allow() is a good solution,
    it just happens too late in the process.  The kernel goes through the
    full route lookup (return path) for the ICMP message, before taking
    the rate limit decision of not sending the ICMP reply.
    
    Details: The kernels global rate limiter for ICMP messages got added
    in commit 4cdf507d ("icmp: add a global rate limitation").  It is
    a token bucket limiter with a global lock.  It brilliantly avoids
    locking congestion by only updating when 20ms (HZ/50) were elapsed. It
    can then avoids taking lock when credit is exhausted (when under
    pressure) and time constraint for refill is not yet meet.
    Signed-off-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
    Acked-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    c0303efe
icmp.c 25.3 KB