Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <00000000000075fe86057ca6367e@google.com> <20181210124724.iuver2va3yjdsokf@breakpoint.cc>
 <20181210.095856.580441946779980596.davem@davemloft.net> <2559562.n5nkmlqv4s@stwm.de>
 <20181214143532.43zgy2hwkdskwfn2@breakpoint.cc>
In-Reply-To: <20181214143532.43zgy2hwkdskwfn2@breakpoint.cc>
From:   Christophe Gouault <christophe.gouault@6wind.com>
Date:   Fri, 14 Dec 2018 17:04:51 +0100
Message-ID: <CADdy8HpgzxLB-6QA+D5JfvhJmjyFUoFM1fQfz0rFAO6LEvRBAQ@mail.gmail.com>
Subject: Re: INFO: rcu detected stall in xfrm_hash_rebuild
To:     Florian Westphal <fw@strlen.de>
Cc:     Wolfgang Walter <linux@stwm.de>,
        David Miller <davem@davemloft.net>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
        Steffen Klassert <steffen.klassert@secunet.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Le ven. 14 d=C3=A9c. 2018 =C3=A0 15:35, Florian Westphal <fw@strlen.de> a =
=C3=A9crit :
> Ok.  An alternative would be to remove the support for
> policy hash table thresholds (which decide what kinds of policies
> go to exact table and which ones go into inexact ones), i.e.
> partially revert 880a6fab8f6ba5b5abe59ea6
> ("xfrm: configure policy hash table thresholds by netlink").
>
> This would remove the need for the rehashing support that
> re-sorts the policies into either exact/inexact lists) when the
> those tunables are changed.
>
> We could also easily convert the exact table to an rhashtable
> then if we wanted to.
>
> I guess we should probably wait to get some operational feedback on the
> inexact storage first to see if it really improves things enough to
> make threshold tuning unneccessary.
>
> Christophe, whats your take?

Hi Florian,

The main use cases I have encountered and tried to address with the
hash-based lookup were network operator use cases:
- a lot of dynamic /32 <=3D> /32 policies (protecting GTP tunnels)
- or a lot of dynamic policies with the same prefix lengths (e.g. /16 <=3D>=
 /24)
and a few non-hashed policies stored in the linked list.

This solutions gives good performance for both lookup *and*
configuration with a big number of SPs. The lookup time is essential,
but so is the IKE negotiation rate. And the configuration time has a
direct impact on it.

I have not yet had time to benchmark the new tree-based implementation.

Could you verify how the configuration time would behave in such use
cases if the hash-based lookup was replaced by a tree-based lookup?

Regards
Christophe