Contributed by merdely on from the turbo-boosted dept.
Earlier today, mcbride@ committed code that only calls add_net_randomness() once per interrupt instead of once per packet. This significantly improves performance on Soekris boxes.
Then henning@ committed some changes that double PF performance by removing mbuf tag usage.
Edit: And even later, henning@ committed more changes to pf that gains another 10%+ performance with PF.
Commit messages below.Ryan's commit:
CVSROOT: /cvs Module name: src Changes by: mcbride a t cvs openbsd org 2007/05/28 02:48:15 Modified files: sys/net : if.c netisr.h netisr_dispatch.h Log message: Only call add_net_randomness() once per interrupt instead of once per packet. If \ multiple packets come in on a single interrupt the times mixed into the randomness \ pool will be identical or predictably close anyways, and nanotime() is expensive. ok toby jason miod claudio
Henning's commit:
CVSROOT: /cvs Module name: src Changes by: henning a t cvs openbsd org 2007/05/28 11:16:39 Modified files: sys/altq : altq_cbq.c altq_hfsc.c altq_priq.c altq_red.c sys/kern : uipc_mbuf.c sys/net : if_bridge.c pf.c pf_norm.c pfvar.h sys/netinet : ip_input.c ipsec_input.c ipsec_output.c sys/netinet6 : ip6_forward.c ip6_input.c sys/sys : mbuf.h Log message: double pf performance. boring details: pf used to use an mbuf tag to keep track of route-to etc, altq, tags, routing table IDs, packets redirected to localhost etc. so each and every packet going through pf got an mbuf tag. mbuf tags use malloc'd memory, and that is knda slow. instead, stuff the information into the mbuf header directly. bridging soekris with just "pass" as ruleset went from 29 MBit/s to 58 MBit/s with that (before ryan's randomness fix, now it is even betterer) thanks to chris for the test setup! ok ryan ryan ckuethe reyk
More henning@ goodness:
CVSROOT: /cvs Module name: src Changes by: henning a t cvs openbsd org 2007/05/28 18:50:41 Modified files: sys/net : pf.c Log message: gain us another 10+% of performance. boring details: long time ago (in r1.313) code was added to handle protocol checksums: > Check protocol (TCP/UDP/ICMP/ICMP6) checksums of all incoming packets, > and drop packets with invalid checksums. Without such a check, pf would > return RST/ICMP errors even for packets with invalid checksums, which > could be used to detect the presence of the firewall, reported by > "Ed White" in http://www.phrack.org/phrack/60/p60-0x0c.txt. that meant we did the checksumming for each and every packet traversing pf. now only do the checksumming right before we send an RST back, so in all other cases we save that work. ok bob theo
[Edit: Better phrack link]
Wow! Just Wow!
(Comments are closed)
By Pete (80.203.236.21) on
This and the ospf/bgp stuff is starting to make a serious PC based router...
Am I being cynical that this is being worked on due to incoming 10GE stuff, and it's associated paket rates... ;-)
thanks devs.
/Pete
Comments
By Motley Fool (MotleyFool) on
>
> thanks devs.
>
> /Pete
ahhh, I see I'm not the only one watching the commits. ;-)
By henning (66.38.248.100) on
it is actually not related to the 10G stuff. I have had the idea to do this for about ... what, more than a year. and now I finally did it.
i had no idea it would be making THAT much of a difference :)
Comments
By Motley Fool (MotleyFool) on
Comments
By David Gwynne (dlg) on
interrupt mitigation is enabled in each nics driver, so fixing fxp doesnt really help 10Gb unless you can fit 100 of them in a machine :)
Comments
By Motley Fool (MotleyFool) on
>
> interrupt mitigation is enabled in each nics driver, so fixing fxp doesnt really help 10Gb unless you can fit 100 of them in a machine :)
oops, see y'all get me all excited about all the network performance tweaks going on at the hackathon, I forget to look at the modified files.
now if only my Acer Labs USB 2.0 Data Link cable, AKA cdce(4), would work as well. ;-)
By Motley Fool (MotleyFool) motleyfool@dieselrepower.org on
the other things I'm watching is work going on to support the Chelsio 10G NIC hopefully to have a manpage soon as che(4)
By Chl (82.240.25.187) on
By Srebrenko Sehic (ssehic) ssehic@gmail.com on
By Timo Myyrä (195.212.29.92) on
If only there was this kind of progress in ACPI and WPA support...
Comments
By Mathieu Sauve-Frankel (66.38.248.100) msf@openbsd.org on
> If only there was this kind of progress in ACPI and WPA support..
some of you are just never content with anything are you ?
泣き虫
By Anonymous Coward (203.65.245.11) on
>
> If only there was this kind of progress in ACPI and WPA support...
If you do a bit of research you'll find that (according to reyk@) at least WPA shard-key support will be implemented sometime in the, far or nearer, If you want to speed the progress up there's always the option of paying someone to do it.
By folays (82.229.223.133) on
> Module name: src
> Changes by: henning a t cvs openbsd org 2007/05/28 18:50:41
>
> Modified files:
> sys/net : pf.c
>
> Log message:
> gain us another 10+% of performance.
> boring details:
> [...]
> that meant we did the checksumming for each and every packet traversing pf.
> now only do the checksumming right before we send an RST back, so in all other cases we save that work.
> ok bob theo
Does the traffic normalization "scrub in" rule make pf do checksumming on those packets?
Thanks all for the good work, myself owner of a soekris...!
Comments
By henning (66.38.248.100) on
> on those packets?
no. these are the PROTOCOL checksums, not ip checksums. only endpoints are supposed to ever look at them.
btw, for all the soekris lovers, I switched to a liantec now. it has GigE, and I can get the CPU down to 72 MHz using sysctl hw.setperf :)
Comments
By mike (192.18.4.200) on
> > on those packets?
>
> no. these are the PROTOCOL checksums, not ip checksums. only endpoints are supposed to ever look at them.
>
> btw, for all the soekris lovers, I switched to a liantec now. it has
> GigE, and I can get the CPU down to 72 MHz using sysctl hw.setperf :)
and how does it operates w/ a gige nic and 72mhz cpu? ;)
and a serious question: i believed em(4) to be a overcomplicated driver
full of magic numbers and magic reg reads/writes. it was very hard to
understand and fix (eventually) from the startup. do intel shitz work
well with em(4) now?
By Anonymous Coward (83.5.193.217) on
> btw, for all the soekris lovers, I switched to a liantec now. it has GigE, and I can get the CPU down to 72 MHz using sysctl hw.setperf :)
btw II, the Geode SC1100 is EOL'd, pcengines is replacing SC based WRAP boards with the Geode 800LX: http://www.pcengines.ch/alix1b.htm
soekris is also phasing out 4801 production, in favour of LX based 5501: http://soekris.com/net5501.html
http://www.nabble.com/net48xx-EOL--t3539197.html
if anyone wants to see a dmesg for alix, I can post it as I'm beta-testing it.
Comments
By Timo Schoeler (eclipser) timo AT riscworks.net on http://riscworks.net
yes, please :)
Comments
By Anonymous Coward (83.5.220.96) on
OpenBSD 4.1 (GENERIC) #1435: Sat Mar 10 19:07:45 MST 2007
deraadt@i386.openbsd.org:/usr/src/sys/arch/i386/compile/GENERIC
cpu0: Geode(TM) Integrated Processor by AMD PCS ("AuthenticAMD" 586-class) 499 M
Hz
cpu0: FPU,DE,PSE,TSC,MSR,CX8,SEP,PGE,CMOV,CFLUSH,MMX
real mem = 259284992 (253208K)
avail mem = 228904960 (223540K)
using 3195 buffers containing 13086720 bytes (12780K) of memory
mainbus0 (root)
bios0 at mainbus0: AT/286+ BIOS, date 03/19/07, BIOS32 rev. 0 @ 0xfaac0
apm0 at bios0: Power Management spec V1.2
apm0: AC on, battery charge unknown
apm0: flags 70102 dobusy 1 doidle 1
pcibios0 at bios0: rev 2.1 @ 0xf0000/0xdfb4
pcibios0: PCI IRQ Routing Table rev 1.0 @ 0xfdf40/112 (5 entries)
pcibios0: bad IRQ table checksum
pcibios0: PCI BIOS has 5 Interrupt Routing table entries
pcibios0: PCI Exclusive IRQs: 5 10 11
pcibios0: no compatible PCI ICU found
pcibios0: Warning, unable to fix up PCI interrupt routing
pcibios0: PCI bus #0 is the last bus
bios0: ROM list: 0xc0000/0x8000 0xef000/0x1000!
acpi at mainbus0 not configured
cpu0 at mainbus0
pci0 at mainbus0 bus 0: configuration mode 1 (bios)
pchb0 at pci0 dev 1 function 0 "AMD Geode LX" rev 0x31
vga1 at pci0 dev 1 function 1 "AMD Geode LX Video" rev 0x00
wsdisplay0 at vga1 mux 1: console (80x25, vt100 emulation)
wsdisplay0: screen 1-5 added (80x25, vt100 emulation)
glxsb0 at pci0 dev 1 function 2 "AMD Geode LX Crypto" rev 0x00: RNG AES
vr0 at pci0 dev 13 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 11, address 0
0:0d:b9:0c:d2:c4
ukphy0 at vr0 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI 0x004063,
model 0x0034
pcib0 at pci0 dev 15 function 0 "AMD CS5536 ISA" rev 0x03
pciide0 at pci0 dev 15 function 2 "AMD CS5536 IDE" rev 0x01: DMA, channel 0 wire
d to compatibility, channel 1 wired to compatibility
wd0 at pciide0 channel 0 drive 0: <SAMSUNG CF/ATA>
wd0: 1-sector PIO, LBA, 499MB, 1022112 sectors
wd0(pciide0:0:0): using PIO mode 4
pciide0: channel 1 ignored (disabled)
"AMD CS5536 Audio" rev 0x01 at pci0 dev 15 function 3 not configured
ohci0 at pci0 dev 15 function 4 "AMD CS5536 USB" rev 0x02: irq 5, version 1.0, l
egacy support
usb0 at ohci0: USB revision 1.0
uhub0 at usb0
uhub0: AMD OHCI root hub, rev 1.00/1.00, addr 1
uhub0: 4 ports with 4 removable, self powered
ehci0 at pci0 dev 15 function 5 "AMD CS5536 USB" rev 0x02: irq 5
usb1 at ehci0: USB revision 2.0
uhub1 at usb1
uhub1: AMD EHCI root hub, rev 2.00/1.00, addr 1
uhub1: 4 ports with 4 removable, self powered
isa0 at pcib0
isadma0 at isa0
pckbc0 at isa0 port 0x60/5
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard, using wsdisplay0
pcppi0 at isa0 port 0x61
midi0 at pcppi0: <PC speaker>
spkr0 at pcppi0
lpt0 at isa0 port 0x378/4 irq 7
lm0 at isa0 port 0x290/8: W83627HF
npx0 at isa0 port 0xf0/16: reported by CPUID; using exception 16
pccom0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
pccom0: console
pccom1 at isa0 port 0x2f8/8 irq 3: ns16550a, 16 byte fifo
biomask f765 netmask ff65 ttymask ffe7
pctr: user-level cycle counter enabled
mtrr: K6-family MTRR support (2 registers)
dkcsum: wd0 matches BIOS drive 0x80
root on wd0a
rootdev=0x0 rrootdev=0x300 rawdev=0x302
Comments
By sthen (85.158.44.149) on
note this:
> glxsb0 at pci0 dev 1 function 2 "AMD Geode LX Crypto" rev 0x00: RNG AES
is quite useful in some situations.
By dm (71.17.162.48) on
Wow, I just took a look at their products and they seem really good. They don't include pricing on their site and give the impression that they are geared towards bulk purchases, though.
Which model do you have? How easy was it to get the product? Did you purchase it as customer or receive it as a developer sample? If you purchased it, what kind of price are we looking at?
Great work, BTW.
Thanks.
dm
Comments
By henning (66.38.248.100) on
>
> Wow, I just took a look at their products and they seem really good. They don't include pricing on their site and give the impression that they are geared towards bulk purchases, though.
>
> Which model do you have?
i can testify it has a black case and a 600MHz celeron and 4 ems
> How easy was it to get the product?
very easy: walk over to ckuethe, ask for a slow machine with gigabit :)
btw, the packet generator and receiver boxes are slightly different puppies...
cpu0: Dual-Core AMD Opteron(tm) Processor 2210, 1800.36 MHz
hw.vendor=Dell Inc.
hw.product=PowerEdge SC1435
iperf sucks, I need to find sth better
Comments
By Jonathan (84.238.19.192) on
>
> i can testify it has a black case and a 600MHz celeron and 4 ems
Then it probably is a EMB-5842 and you can buy it from wim.
By Motley Fool (MotleyFool) on
>
> very easy: walk over to ckuethe, ask for a slow machine with gigabit :)
So is ckuethe no longer using commell boards? I have a couple LE-564's but the LS-570 looks pretty good.
Also, does the Liantec support serial console? That's what really gets me about a lot of small "embedded" intel arch based systems, the serial console support sucks. The Soekris is the only I've found so far that has a decent serial BIOS interface.
By Stryder (209.89.51.221) on
> >
> > Wow, I just took a look at their products and they seem really good. They don't include pricing on their site and give the impression that they are geared towards bulk purchases, though.
> >
> > Which model do you have?
>
> i can testify it has a black case and a 600MHz celeron and 4 ems
>
> > How easy was it to get the product?
>
> very easy: walk over to ckuethe, ask for a slow machine with gigabit :)
>
> btw, the packet generator and receiver boxes are slightly different puppies...
> cpu0: Dual-Core AMD Opteron(tm) Processor 2210, 1800.36 MHz
> hw.vendor=Dell Inc.
> hw.product=PowerEdge SC1435
>
> iperf sucks, I need to find sth better
>
You guys should write an OpenIperf, under a pretty BSD license .. =)
Seriously though, iperf does suck yet unfortunately I use it for work all the time ... Any recommendations for something better?
Comments
By dm (71.17.162.48) on
> > iperf sucks, I need to find sth better
> >
>
> You guys should write an OpenIperf, under a pretty BSD license .. =)
I think when a developer makes a comment like that he is fishing for a sucker^H^H^H^H^H^H, er, volunteer to take up this boring^H^H^H^H^H^H, er, wonderful project. :)
dm
By sthen (85.158.44.149) on
netrate, search ports@
By wim (217.237.166.98) wim@kd85.com on http://liantec.kd85.com
> btw, for all the soekris lovers, I switched to a liantec now. it has GigE, and I can get the CPU down to 72 MHz using sysctl hw.setperf :)
I'm still waiting to post the liantec 5740 (Via C7) dmesg, but here is a boring intel one for now:
OpenBSD 4.1-stable (liantec) #0: Mon May 21 19:39:27 CEST 2007
build@liantec.kd85.com:/home/obj/liantec
cpu0: Intel(R) Pentium(R) M processor 1.60GHz ("GenuineIntel" 686-class) 1.61 GHz
cpu0:FPU,V86,DE,PSE,TSC,MSR,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,CFLUSH,DS,AC
PI,MMX,FXSR,SSE,SSE2,SS,TM,SBF,EST,TM2
real mem = 502870016 (491084K)
avail mem = 451055616 (440484K)
using 4278 buffers containing 25268224 bytes (24676K) of memory
mainbus0 (root)
bios0 at mainbus0: AT/286+ BIOS, date 04/14/05, BIOS32 rev. 0 @ 0xfb1c0, SMBIOS
rev. 2.2 @ 0xf0800 (34 entries)
apm0 at bios0: Power Management spec V1.2
apm0: AC on, battery charge unknown
apm0: flags 70102 dobusy 1 doidle 1
pcibios0 at bios0: rev 2.1 @ 0xf0000/0xdf64
pcibios0: PCI IRQ Routing Table rev 1.0 @ 0xfde40/272 (15 entries)
pcibios0: PCI Exclusive IRQs: 5 7 10 11 12
pcibios0: PCI Interrupt Router at 000:31:0 ("Intel 6300ESB LPC" rev 0x00)
pcibios0: PCI bus #2 is the last bus
bios0: ROM list: 0xc0000/0xd400!
cpu0 at mainbus0
cpu0: Enhanced SpeedStep 1600 MHz (1340 mV): speeds: 1600, 1400, 1200, 1000, 800
, 600 MHz
pci0 at mainbus0 bus 0: configuration mode 1 (no bios)
pchb0 at pci0 dev 0 function 0 "Intel 82852GM Hub-PCI" rev 0x02
"Intel 82852GM Memory" rev 0x02 at pci0 dev 0 function 1 not configured
"Intel 82852GM Configuration" rev 0x02 at pci0 dev 0 function 3 not configured
vga1 at pci0 dev 2 function 0 "Intel 82852GM AGP" rev 0x02: aperture at 0xd80000
00, size 0x8000000
wsdisplay0 at vga1 mux 1: console (80x25, vt100 emulation)
wsdisplay0: screen 1-5 added (80x25, vt100 emulation)
"Intel 82852GM AGP" rev 0x02 at pci0 dev 2 function 1 not configured
ppb0 at pci0 dev 28 function 0 "Intel 6300ESB PCIX" rev 0x02
pci1 at ppb0 bus 1
uhci0 at pci0 dev 29 function 0 "Intel 6300ESB USB" rev 0x02: irq 11
usb0 at uhci0: USB revision 1.0
uhub0 at usb0
uhub0: Intel UHCI root hub, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhci1 at pci0 dev 29 function 1 "Intel 6300ESB USB" rev 0x02: irq 5
usb1 at uhci1: USB revision 1.0
uhub1 at usb1
uhub1: Intel UHCI root hub, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
"Intel 6300ESB WDT" rev 0x02 at pci0 dev 29 function 4 not configured
"Intel 6300ESB APIC" rev 0x02 at pci0 dev 29 function 5 not configured
ehci0 at pci0 dev 29 function 7 "Intel 6300ESB USB" rev 0x02: irq 7
usb2 at ehci0: USB revision 2.0
uhub2 at usb2
uhub2: Intel EHCI root hub, rev 2.00/1.00, addr 1
uhub2: 4 ports with 4 removable, self powered
ppb1 at pci0 dev 30 function 0 "Intel 82801BA AGP" rev 0x0a
pci2 at ppb1 bus 2
em0 at pci2 dev 10 function 0 "Intel PRO/1000MT (82541GI)" rev 0x05: irq 12, add
ress 00:06:93:f0:2e:1d
em1 at pci2 dev 11 function 0 "Intel PRO/1000MT (82541GI)" rev 0x05: irq 10, add
ress 00:06:93:f0:2e:1e
em2 at pci2 dev 12 function 0 "Intel PRO/1000MT (82541GI)" rev 0x05: irq 11, add
ress 00:06:93:f0:2e:1f
em3 at pci2 dev 13 function 0 "Intel PRO/1000MT (82541GI)" rev 0x05: irq 5, addr
ess 00:06:93:f0:2e:20
ichpcib0 at pci0 dev 31 function 0 "Intel 6300ESB LPC" rev 0x02
pciide0 at pci0 dev 31 function 1 "Intel 6300ESB IDE" rev 0x02: DMA, channel 0 c
onfigured to compatibility, channel 1 configured to compatibility
wd0 at pciide0 channel 0 drive 1: <SILICONSYSTEMS INC 4GB>
wd0: 1-sector PIO, LBA, 4029MB, 8251488 sectors
wd0(pciide0:0:1): using PIO mode 4, DMA mode 2
pciide0: channel 1 disabled (no drives)
ichiic0 at pci0 dev 31 function 3 "Intel 6300ESB SMBus" rev 0x02: irq 10
iic0 at ichiic0
isa0 at ichpcib0
isadma0 at isa0
pckbc0 at isa0 port 0x60/5
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard, using wsdisplay0
pcppi0 at isa0 port 0x61
midi0 at pcppi0: <PC speaker>
spkr0 at pcppi0
lm0 at isa0 port 0x290/8: W83627HF
npx0 at isa0 port 0xf0/16: reported by CPUID; using exception 16
pccom0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
pccom0: console
pccom1 at isa0 port 0x2f8/8 irq 3: ns16550a, 16 byte fifo
fdc0 at isa0 port 0x3f0/6 irq 6 drq 2
biomask efe5 netmask ffe5 ttymask ffe7
pctr: 686-class user-level performance counters enabled
mtrr: Pentium Pro MTRR support
dkcsum: wd0 matches BIOS drive 0x80
root on wd0a
rootdev=0x0 rrootdev=0x300 rawdev=0x302
By Anonymous Coward (24.37.242.64) on
Comments
By Paladdin (213.97.233.52) on
Sure! As a matter of fact, it applies to all platforms. But as little devices tend to reach their limits quicker, Soekris -and the like- are good platforms to test performance increases :)
By chris_g_g (81.179.99.37) on
This worked: http://www.phrack.org/issues.html?issue=60&id=12#article
By Anonymous Coward (87.194.34.157) on
Module name: src
Changes by: henning@cvs.openbsd.org 2007/05/29 11:46:24
Modified files:
sys/netinet : ip_input.c ip_output.c
Log message:
gain another 5+% in ip forwarding performance.
boring details:
skip looking for ipsec tags and descending into ip_spd_lookup if there
are no ipsec flows, except in one case in ip_output (spotted by markus)
where we have to if we have a pcb. ip_spd_lookup has the shortcut already,
but there is enough work done before so that skipping that gains us about
5%. ok theo, markus
By Venture37 (venture37) venture37@hotmail.com on www.geeklan.co.uk
Comments
By David Gwynne (dlg) on
No, we're keeping them for 4.2 Ultimate Edition which will be available for the low low price of $595.00. If you can afford fast network gear you can afford a fast operating system ;)
Comments
By Anonymous Coward (70.162.93.223) on
>
> No, we're keeping them for 4.2 Ultimate Edition
Is that the same one you can run inside virtual machines?
Comments
By David Gwynne (dlg) on
of course you have to pay for a working vic(4) driver.
By Venture37 (venture37) on www.geeklan.co.uk
>
> No, we're keeping them for 4.2 Ultimate Edition which will be available for the low low price of $595.00. If you can afford fast network gear you can afford a fast operating system ;)
OOh!
Sold!
Hang on a minute!
wd(4) disks have the security feature frozen before being attached to prevent malicious users setting a password that would prevent the contents of the drive from being accessed.
Bah!
Not as Ultime as Windows is it!
Back to Vista I go!
hehehe ;)
By Motley Fool (MotleyFool) on
Okay, I have to be sarcastic here. Yo duh!!!! Why do you think they have hackathons? So they can hang (hung?) together in a big manlove orgy and drink beer? Oh wait, maybe that is why they have hackathons. Oh geez, now my whole view of OpenBSD developers has changed, all because of your post. :-(
seriously, yes.
Comments
By Venture37 (venture37) on www.geeklan.co.uk
drugs are bad Mmmkay! :D
By Anonymous Coward (87.230.108.20) on
I tried to make the necessary changes myself but ran into problems with other changes that were made since 4.1 release and now. I'll probably try again with smaller steps if noone else will...
Comments
By Brad (brad) brad at comstyle dot com on
>
> I tried to make the necessary changes myself but ran into problems with other changes that were made since 4.1 release and now. I'll probably try again with smaller steps if noone else will...
You're crazy. Use a snapshot.
You are more likely to break something with your frankenstein system.
By dm (71.17.162.48) on
I think that it is more likely that DARPA will help fund the next hackathon.
Unfortunately, you will have to follow current, wait for 4.2, or try to patch it together yourself. Good luck!
dm
Comments
By Motley Fool (MotleyFool) on
nah, DARPA is so passe, I'm thinking it's more likely DHSARPA will fund the next hackathon.
By gwyllion (134.58.253.57) on