Commit c386578f authored by Steffen Klassert's avatar Steffen Klassert

xfrm: Let the flowcache handle its size by default.

The xfrm flowcache size is limited by the flowcache limit
(4096 * number of online cpus) and the xfrm garbage collector
threshold (2 * 32768), whatever is reached first. This means
that we can hit the garbage collector limit only on systems
with more than 16 cpus. On such systems we simply refuse
new allocations if we reach the limit, so new flows are dropped.
On syslems with 16 or less cpus, we hit the flowcache limit.
In this case, we shrink the flow cache instead of refusing new
flows.

We increase the xfrm garbage collector threshold to INT_MAX
to get the same behaviour, independent of the number of cpus.

The xfrm garbage collector threshold can still be set below
the flowcache limit to reduce the memory usage of the flowcache.
Tested-by: default avatarDan Streetman <dan.streetman@canonical.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 8a4683a5
...@@ -1199,7 +1199,8 @@ tag - INTEGER ...@@ -1199,7 +1199,8 @@ tag - INTEGER
xfrm4_gc_thresh - INTEGER xfrm4_gc_thresh - INTEGER
The threshold at which we will start garbage collecting for IPv4 The threshold at which we will start garbage collecting for IPv4
destination cache entries. At twice this value the system will destination cache entries. At twice this value the system will
refuse new allocations. refuse new allocations. The value must be set below the flowcache
limit (4096 * number of online cpus) to take effect.
igmp_link_local_mcast_reports - BOOLEAN igmp_link_local_mcast_reports - BOOLEAN
Enable IGMP reports for link local multicast groups in the Enable IGMP reports for link local multicast groups in the
...@@ -1645,7 +1646,8 @@ ratelimit - INTEGER ...@@ -1645,7 +1646,8 @@ ratelimit - INTEGER
xfrm6_gc_thresh - INTEGER xfrm6_gc_thresh - INTEGER
The threshold at which we will start garbage collecting for IPv6 The threshold at which we will start garbage collecting for IPv6
destination cache entries. At twice this value the system will destination cache entries. At twice this value the system will
refuse new allocations. refuse new allocations. The value must be set below the flowcache
limit (4096 * number of online cpus) to take effect.
IPv6 Update by: IPv6 Update by:
......
...@@ -246,7 +246,7 @@ static struct dst_ops xfrm4_dst_ops = { ...@@ -246,7 +246,7 @@ static struct dst_ops xfrm4_dst_ops = {
.destroy = xfrm4_dst_destroy, .destroy = xfrm4_dst_destroy,
.ifdown = xfrm4_dst_ifdown, .ifdown = xfrm4_dst_ifdown,
.local_out = __ip_local_out, .local_out = __ip_local_out,
.gc_thresh = 32768, .gc_thresh = INT_MAX,
}; };
static struct xfrm_policy_afinfo xfrm4_policy_afinfo = { static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
......
...@@ -287,7 +287,7 @@ static struct dst_ops xfrm6_dst_ops = { ...@@ -287,7 +287,7 @@ static struct dst_ops xfrm6_dst_ops = {
.destroy = xfrm6_dst_destroy, .destroy = xfrm6_dst_destroy,
.ifdown = xfrm6_dst_ifdown, .ifdown = xfrm6_dst_ifdown,
.local_out = __ip6_local_out, .local_out = __ip6_local_out,
.gc_thresh = 32768, .gc_thresh = INT_MAX,
}; };
static struct xfrm_policy_afinfo xfrm6_policy_afinfo = { static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment