netfilter: nf_conntrack: speed up module removal path if netns in use
The patch introduces nf_conntrack_cleanup_net_list(), which cleanups nf_conntrack for a list of netns and calls synchronize_net() only once for them all. This should reduce netns destruction time. I've measured cleanup time for 1k dummy net ns. Here are the results: <without the patch> # modprobe nf_conntrack # time modprobe -r nf_conntrack real 0m10.337s user 0m0.000s sys 0m0.376s <with the patch> # modprobe nf_conntrack # time modprobe -r nf_conntrack real 0m5.661s user 0m0.000s sys 0m0.216s Signed-off-by: Vladimir Davydov <vdavydov@parallels.com> Cc: Patrick McHardy <kaber@trash.net> Cc: "David S. Miller" <davem@davemloft.net> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Acked-by: Gao feng <gaofeng@cn.fujitsu.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
493763684f
commit
dece40e848
|
@ -27,6 +27,7 @@ extern unsigned int nf_conntrack_in(struct net *net,
|
||||||
|
|
||||||
extern int nf_conntrack_init_net(struct net *net);
|
extern int nf_conntrack_init_net(struct net *net);
|
||||||
extern void nf_conntrack_cleanup_net(struct net *net);
|
extern void nf_conntrack_cleanup_net(struct net *net);
|
||||||
|
extern void nf_conntrack_cleanup_net_list(struct list_head *net_exit_list);
|
||||||
|
|
||||||
extern int nf_conntrack_proto_pernet_init(struct net *net);
|
extern int nf_conntrack_proto_pernet_init(struct net *net);
|
||||||
extern void nf_conntrack_proto_pernet_fini(struct net *net);
|
extern void nf_conntrack_proto_pernet_fini(struct net *net);
|
||||||
|
|
|
@ -1365,30 +1365,48 @@ void nf_conntrack_cleanup_end(void)
|
||||||
*/
|
*/
|
||||||
void nf_conntrack_cleanup_net(struct net *net)
|
void nf_conntrack_cleanup_net(struct net *net)
|
||||||
{
|
{
|
||||||
|
LIST_HEAD(single);
|
||||||
|
|
||||||
|
list_add(&net->exit_list, &single);
|
||||||
|
nf_conntrack_cleanup_net_list(&single);
|
||||||
|
}
|
||||||
|
|
||||||
|
void nf_conntrack_cleanup_net_list(struct list_head *net_exit_list)
|
||||||
|
{
|
||||||
|
int busy;
|
||||||
|
struct net *net;
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* This makes sure all current packets have passed through
|
* This makes sure all current packets have passed through
|
||||||
* netfilter framework. Roll on, two-stage module
|
* netfilter framework. Roll on, two-stage module
|
||||||
* delete...
|
* delete...
|
||||||
*/
|
*/
|
||||||
synchronize_net();
|
synchronize_net();
|
||||||
i_see_dead_people:
|
i_see_dead_people:
|
||||||
nf_ct_iterate_cleanup(net, kill_all, NULL);
|
busy = 0;
|
||||||
nf_ct_release_dying_list(net);
|
list_for_each_entry(net, net_exit_list, exit_list) {
|
||||||
if (atomic_read(&net->ct.count) != 0) {
|
nf_ct_iterate_cleanup(net, kill_all, NULL);
|
||||||
|
nf_ct_release_dying_list(net);
|
||||||
|
if (atomic_read(&net->ct.count) != 0)
|
||||||
|
busy = 1;
|
||||||
|
}
|
||||||
|
if (busy) {
|
||||||
schedule();
|
schedule();
|
||||||
goto i_see_dead_people;
|
goto i_see_dead_people;
|
||||||
}
|
}
|
||||||
|
|
||||||
nf_ct_free_hashtable(net->ct.hash, net->ct.htable_size);
|
list_for_each_entry(net, net_exit_list, exit_list) {
|
||||||
nf_conntrack_proto_pernet_fini(net);
|
nf_ct_free_hashtable(net->ct.hash, net->ct.htable_size);
|
||||||
nf_conntrack_helper_pernet_fini(net);
|
nf_conntrack_proto_pernet_fini(net);
|
||||||
nf_conntrack_ecache_pernet_fini(net);
|
nf_conntrack_helper_pernet_fini(net);
|
||||||
nf_conntrack_tstamp_pernet_fini(net);
|
nf_conntrack_ecache_pernet_fini(net);
|
||||||
nf_conntrack_acct_pernet_fini(net);
|
nf_conntrack_tstamp_pernet_fini(net);
|
||||||
nf_conntrack_expect_pernet_fini(net);
|
nf_conntrack_acct_pernet_fini(net);
|
||||||
kmem_cache_destroy(net->ct.nf_conntrack_cachep);
|
nf_conntrack_expect_pernet_fini(net);
|
||||||
kfree(net->ct.slabname);
|
kmem_cache_destroy(net->ct.nf_conntrack_cachep);
|
||||||
free_percpu(net->ct.stat);
|
kfree(net->ct.slabname);
|
||||||
|
free_percpu(net->ct.stat);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls)
|
void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls)
|
||||||
|
|
|
@ -545,16 +545,20 @@ out_init:
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
static void nf_conntrack_pernet_exit(struct net *net)
|
static void nf_conntrack_pernet_exit(struct list_head *net_exit_list)
|
||||||
{
|
{
|
||||||
nf_conntrack_standalone_fini_sysctl(net);
|
struct net *net;
|
||||||
nf_conntrack_standalone_fini_proc(net);
|
|
||||||
nf_conntrack_cleanup_net(net);
|
list_for_each_entry(net, net_exit_list, exit_list) {
|
||||||
|
nf_conntrack_standalone_fini_sysctl(net);
|
||||||
|
nf_conntrack_standalone_fini_proc(net);
|
||||||
|
}
|
||||||
|
nf_conntrack_cleanup_net_list(net_exit_list);
|
||||||
}
|
}
|
||||||
|
|
||||||
static struct pernet_operations nf_conntrack_net_ops = {
|
static struct pernet_operations nf_conntrack_net_ops = {
|
||||||
.init = nf_conntrack_pernet_init,
|
.init = nf_conntrack_pernet_init,
|
||||||
.exit = nf_conntrack_pernet_exit,
|
.exit_batch = nf_conntrack_pernet_exit,
|
||||||
};
|
};
|
||||||
|
|
||||||
static int __init nf_conntrack_standalone_init(void)
|
static int __init nf_conntrack_standalone_init(void)
|
||||||
|
|
Loading…
Reference in a new issue