On 2015-09-02 19:47, Sven Eckelmann wrote:
> commit r30917 ("kernel: bypass all netfilter hooks if the sysctls for that
> functionality have been disabled - eliminates the overhead of enabling
> CONFIG_BRIDGE_NETFILTER in the kernel config") introduced an optimization
> which should reduce/eliminate the overhead for traffic send over bridges on
> kernels compiled with CONFIG_BRIDGE_NETFILTER=y. But this optimization
> breaks the nf_call_iptables per bridge setting which is more fine grained
> than the global sysctl net.bridge.bridge-nf-call-iptables setting.
>
> A test reflecting a real world setup was created to identify if this really
> eliminates the overhead and if per-bridge nf_call_iptables could be used in
> some setups to increase the throughput. A Qualcomm Atheros QCA9558 based
> system with one ethernet and an ath9k wifi 3x3 in HT40 mode was used.
> Cables from the AP to the wifi station were used to reduce interference
> problems during the tests.
>
> The wlan interface was put in one bridge interface called br-wlan. This
> bridge usually contains some more wlan interfaces. The eth0 was put in a
> second bridge called br-lan. This usually contains some other privileged
> wlan or mesh interfaces. Routing was added between br-lan and br-wlan.
>
> Three kernels were tested:
>
> * (default) OpenWrt kernel for this device
> * (brfilter-global) OpenWrt kernel with CONFIG_BRIDGE_NETFILTER=y
> * (brfilter-local) OpenWrt kernel with CONFIG_BRIDGE_NETFILTER=y and
> without 644-bridge_optimize_netfilter_hooks.patch
>
> The changes to the the netfilter settings of the bridge were done via:
>
> * (brfilter-global) /sbin/sysctl -w net.bridge.bridge-nf-call-iptables=1
> * (brfilter-lobal) echo 1 > /sys/class/net/br-lan/bridge/nf_call_iptables
> and/or echo 1 > /sys/class/net/br-wan/bridge/nf_call_iptables
>
> A station connected to the wlan0 (AP) interface was used to send traffic to
> a PC connected via ethernet. iperf with 3 concurrent transmissions was used
> to generate the traffic.
>
> | kernel | br-nf-* global | nf-call* iface | download | upload |
> |-----------------|----------------|----------------|----------|----------|
> | default | 0 | - | 209 | 268 |
> | brfilter-global | 0 | - | 185 | 243 |
> | brfilter-local | 0 | - | 187 | 243 |
> | brfilter-local | 0 | br-lan | 157 | 226 |
> | brfilter-local | 0 | br-lan br-wlan | 139 | 161 |
> | brfilter-global | 1 | - | 136 | 162 |
>
> Download/upload results in Mibit/s
>
> It can be seen that the patch doesn't eliminate the overhead. It can also
> be seen that the throughput of brfilter-global and brfilter-local with
> disabled filtering is the roughly the same. Also the throughput for
> brfilter-global and brfilter-local for enabled filtering on all bridges is
> roughly the same.
>
> But also the brfilter-local throughput is higher when only br-lan requires
> the filtering. This setting would not be possible with
> 644-bridge_optimize_netfilter_hooks.patch applied and thus can only be
> compared with brfilter-global and filtering enabled for all interfacese
Did your test have the ebtables modules loaded or not? If I remember
correctly, the patch you're removing was added mainly for the case where
CONFIG_BRIDGE_NETFILTER=y is set, but ebtables is not loaded.
- Felix
_______________________________________________
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel
