Posts

The disassembled output of filter.o looks not cache-line friendly, with the current generated code two cache-lines must be hit – at least. A switch statement with two case statements is translated into a sequence of conditional branches like this (arch: @x86_64@): 4b8: 8b 06 mov (%rsi),%eax 4ba: 66 83 f8 35 cmp $0x35,%ax 4be: 0f 84 d8 02 00 00 je 79c <sk_run_filter+0x325> 4c4: 0f 87 07 01 00 00 ja 5d1 <sk_run_filter+0x15a> 4ca: 66 83 f8 15 cmp $0x15,%ax 4ce: 0f 84 cd 02 00 00 je 7a1 <sk_run_filter+0x32a> 4d4: 77 73 ja 549 <sk_run_filter+0xd2> 4d6: 66 83 f8 04 cmp $0x4,%ax 4da: 0f 84 1f 02 00 00 je 6ff <sk_run_filter+0x288> 4e0: 77 29 ja 50b <sk_run_filter+0x94> The whole switch/case jump construct in @run_filter()@ eat exactly 567 byte ....

If the IP packet size exceed the link layer maximum transmission unit (MTU, 1500 byte for Ethernet v2) a packet must be fragmented. Yesterday Changli Gao submited a patch that optimize the reassembling process in the kernel. Changli assumption was that fragments arrived in accureate ascending order. He optimized the processing behavior by optimizing the list processing of inet_frag_queue for IPv4 and IPv6 by introducing an additional pointer, called fragments_tail that points to the end of the list....

Lately in the IRC after looking at some “Linuxtag”:http://www.linuxtag.org/ photos (19:43) < h**> http://www.flickr.com/photos/linuxtag/4699311928/ (19:44) < h**> thomas und drei linux chicks! ;-) (20:02) < n***> open-source-babes sind halt immer nur son community-produkt ;) (20:04) < l***> he, das waren nur die angestellten von Beach at the box (20:14) < c***> n***: na dafuer darfste open-source-babes nach belieben nutzen und weiterreichen ;) (20:17) < k**> yeah, und wenn sie unter einer bsd-lizenz steht darfst du die auch kommerziell weitervertreiben (20:17) < w*****> :D (20:21) < h**> ;) (20:31) < n***> jo, GPL-babes haben den weiteren nachteil, dass man jegliche modifikationen, die man an ihnen vornimmt, publizieren muss ;) (20:36) < h**> warum n0-1?...

A tiny drawback of quagga is a missing feature to signal the host environment when routes change. So it is not simple to start/stop scripts if routes are added or deleted. For example: if you want to add or delete a security association if a route changes then it is not directly possible via quagga. But Linux and other operating systems provides a monitor mode where all relevant network events can be caught by the user space....

Optimization changed over time - optimization today does not address CPU cycle/instruction, rather reduced memory transaction are the key to success. Keep the code small and keep the code in the cacheline and reduce memory loads. A cache miss is equivalent to 100 instructions during a CPU stall. Therefore keeping the @.text@ footprint small can boost your application more then some sophisticated CPU tweaks. Pahole provides a feeling how the @....

| Filter Rule | Processing Time | | — | | no filter | 469.231535129662 us | | “icmp” | 524.893505343705 us | | “icmp and host 127.0.0.1” | 367.231761850006 us | | “icmp and host 127.0.0.1 and ‘ip[6] = 64’” | 598.401917125821 us | | “icmp and host 127.0.0.1 and ‘ip[6] = 64’ and ‘ip[2:2] > 1’” | 649.767235335359 us | Processing delay sampling (needs smoothing, of course): The generated OPCODES:...

Stumbling over the Urgent Pointer code in @tcp_recvmsg()@ and reading some specs. Urgent data allows the sender to signal the receiver that “urgent data” of some form has been placed into the packet. The receiver on the other hand must deal with this condition and is forced by himself to handle this condition. If not handled the data is silently ignored. Therefore, it must be negotiated at a higher level that urgent data is transmitted and properly handled at the receiver side....

The posted flash advisory list is really long so I tried to update the player. But unfortunately Adobe skipped their 64 bit “support”:http://labs.adobe.com/technologies/flashplayer10/64bit.html (what a piece of software is this anyway - in 2010?) which actually means I had no change to run flash any more! 32 bit combat mode - no thank you, buggy software no thank you. I installed the dev version of “firefox”:http://nightly.mozilla.org/webm/ with webm support which works great....

I started to analyse the BPF optimizer. Several options helped me: “-d” to dump the generated instructions and “-O” to disable the packet-matching code optimizer (normally only useful if you suspect a bug in the optimizer). So my modified kernel (I will post the kernel patch after I reworked the tracing ring buffer implementation) and the tcpdump possibilities we are now in the ability to analyse exactly how the optimizer works....

Today after some time-killing IETF debates I started to analyze the in-kernel BPF filter execution time for different BDP filters. Starting with no filter, which is translated into a simple @BPF_RET|BPF_K@ OPCODE till some more complex instructions. The average execution time lies somewhere at 300ns for no filter and somewhere above 350ns for a simple ICMP filter with 17 CPU instructions on my x86_64 (excluding call overhead). The next image illustrates this (statistically sampled data):