[{"id":3676751,"web_url":"http://patchwork.ozlabs.org/comment/3676751/","msgid":"","list_archive_url":null,"date":"2026-04-13T13:27:44","subject":"Re: [PATCH nf-next] netfilter: nf_conncount: make number of hash\n slots configurable","submitter":{"id":90904,"url":"http://patchwork.ozlabs.org/api/people/90904/","name":"Fernando Fernandez Mancera","email":"fmancera@suse.de"},"content":"On 4/13/26 2:37 PM, Vladimir Vdovin wrote:\n> Some workloads with high conntrack rate\n> generate high lock contention on insert_tree(), so\n> constant 256 CONNCOUNT_SLOTS can be too small.\n> \n> Signed-off-by: Vladimir Vdovin \n> ---\n\nHi Vladimir,\n\ndo you have a good way to reproduce such situation? I have been looking \nfor ways to improve conncount and its testing.\n\nThanks,\nFernando.\n\n> net/netfilter/Kconfig | 12 ++++++++++++\n> net/netfilter/nf_conncount.c | 2 +-\n> 2 files changed, 13 insertions(+), 1 deletion(-)\n> \n> diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig\n> index 6cdc994fdc8a..38df2829d4d6 100644\n> --- a/net/netfilter/Kconfig\n> +++ b/net/netfilter/Kconfig\n> @@ -111,6 +111,18 @@ if NF_CONNTRACK\n> config NETFILTER_CONNCOUNT\n> \ttristate\n> \n> +config NF_CONNCOUNT_SLOTS\n> +\tint \"Number of hash slots for nf_conncount\"\n> +\tdepends on NF_CONNTRACK\n> +\tdefault 256\n> +\trange 1 4096\n> +\thelp\n> +\t Number of hash slots used by the nf_conncount module.\n> +\t Each slot has its own spinlock and rb-tree, so increasing\n> +\t this value reduces lock contention at the cost of additional\n> +\t memory.\n> +\t Default is 256. Allowed range: 1 - 4096.\n> +\n> config NF_CONNTRACK_MARK\n> \tbool 'Connection mark tracking support'\n> \tdepends on NETFILTER_ADVANCED\n> diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c\n> index 00eed5b4d1b1..bdb9081a6c05 100644\n> --- a/net/netfilter/nf_conncount.c\n> +++ b/net/netfilter/nf_conncount.c\n> @@ -32,7 +32,7 @@\n> #include \n> #include \n> \n> -#define CONNCOUNT_SLOTS\t\t256U\n> +#define CONNCOUNT_SLOTS\t\tCONFIG_NF_CONNCOUNT_SLOTS\n> \n> #define CONNCOUNT_GC_MAX_NODES\t\t8\n> #define CONNCOUNT_GC_MAX_COLLECT\t64\n> \n> base-commit: 028ef9c96e96197026887c0f092424679298aae8","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=suse.de header.i=@suse.de header.a=rsa-sha256\n header.s=susede2_rsa header.b=vbqgL98n;\n\tdkim=pass header.d=suse.de header.i=@suse.de header.a=ed25519-sha256\n header.s=susede2_ed25519 header.b=rHDOD3oC;\n\tdkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.a=rsa-sha256 header.s=susede2_rsa header.b=vbqgL98n;\n\tdkim=neutral header.d=suse.de header.i=@suse.de header.a=ed25519-sha256\n header.s=susede2_ed25519 header.b=rHDOD3oC;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11845-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"vbqgL98n\";\n\tdkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"rHDOD3oC\";\n\tdkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"vbqgL98n\";\n\tdkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"rHDOD3oC\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=195.135.223.131","smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=suse.de","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=suse.de","smtp-out2.suse.de;\n\tnone"],"Received":["from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fvT0z4NTrz1xtJ\n\tfor ; Mon, 13 Apr 2026 23:34:59 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 5E8853033D21\n\tfor ; Mon, 13 Apr 2026 13:27:50 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id B70F33BE16C;\n\tMon, 13 Apr 2026 13:27:49 +0000 (UTC)","from smtp-out2.suse.de (smtp-out2.suse.de [195.135.223.131])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id B97E73A8FE6\n\tfor ; Mon, 13 Apr 2026 13:27:47 +0000 (UTC)","from imap1.dmz-prg2.suse.org (unknown [10.150.64.97])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest\n SHA256)\n\t(No client certificate requested)\n\tby smtp-out2.suse.de (Postfix) with ESMTPS id A457D5BDA7;\n\tMon, 13 Apr 2026 13:27:45 +0000 (UTC)","from imap1.dmz-prg2.suse.org (localhost [127.0.0.1])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest\n SHA256)\n\t(No client certificate requested)\n\tby imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id 450DB4AEE5;\n\tMon, 13 Apr 2026 13:27:45 +0000 (UTC)","from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167])\n\tby imap1.dmz-prg2.suse.org with ESMTPSA\n\tid TMLeDVHv3GkFRAAAD6G6ig\n\t(envelope-from ); Mon, 13 Apr 2026 13:27:45 +0000"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776086869; cv=none;\n b=V7XdffObTBvW/V26P61dxE2kxga4i7hzG7pFG3OsZwamtoXlyGQay40B9HEcjYb1noRK/b56hjARQilDrB+q3ta9z1pZaUPwuOOSpG0QYzHmFwIkoiu8imRAG7EJ7LmX8z56jMuQ7gE7feBLfMpRieQng5TrFiuz19JLM4PKT3s=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776086869; c=relaxed/simple;\n\tbh=hldHgMD5A0O9DKvInt91qdUqLWxjlhCYrW776ljAE48=;\n\th=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From:\n\t In-Reply-To:Content-Type;\n b=ILA4TBwW1LkyVKrafgvEu0sZ9xYPum6m31Y3JU5v6QunxgpyeNMLZ4zWL0YGHsiBK3LPQKgt8HcswGBWWb1C2njaFX0BALvK2Hf/i8K0AdYXgTe08NqeKHLRry/XMDoORSSXSYmxmN5J260kOz9mxC5kQuD/1Z4c6EYhdHBo9PY=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=suse.de;\n spf=pass smtp.mailfrom=suse.de;\n dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=vbqgL98n;\n dkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=rHDOD3oC;\n dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=vbqgL98n;\n dkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=rHDOD3oC; arc=none smtp.client-ip=195.135.223.131","DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de;\n s=susede2_rsa;\n\tt=1776086865;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:content-type:content-type:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=VgYzPyFA6x5DxkGE81tTZvWFfyANnk7qrhW+RxfJSSk=;\n\tb=vbqgL98nH2aibKU0jk76DgEjklSqPmHkUt/hOljAnjrPNm9KQRJqqoXVJ2cIhrT5IDkYf4\n\tNLh724RZ/GC9LlSHIFRAboQom4udP5MoJkP6Y5w++eYraqLy53UXO3nGBBHpj5Q6NttkQa\n\tw3uh/fbZ6GpJpujuUR3imhAX9oOFtac=","v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de;\n\ts=susede2_ed25519; t=1776086865;\n\th=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:content-type:content-type:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=VgYzPyFA6x5DxkGE81tTZvWFfyANnk7qrhW+RxfJSSk=;\n\tb=rHDOD3oCzGWReh3D1mpmjJG7RqbN07Sd35Jnr4G1DPnmQVzNxRUnEx1zBoncUOFah8SjUz\n\th+HZ9RiX1Q3PFlBA==","v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de;\n s=susede2_rsa;\n\tt=1776086865;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:content-type:content-type:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=VgYzPyFA6x5DxkGE81tTZvWFfyANnk7qrhW+RxfJSSk=;\n\tb=vbqgL98nH2aibKU0jk76DgEjklSqPmHkUt/hOljAnjrPNm9KQRJqqoXVJ2cIhrT5IDkYf4\n\tNLh724RZ/GC9LlSHIFRAboQom4udP5MoJkP6Y5w++eYraqLy53UXO3nGBBHpj5Q6NttkQa\n\tw3uh/fbZ6GpJpujuUR3imhAX9oOFtac=","v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de;\n\ts=susede2_ed25519; t=1776086865;\n\th=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:content-type:content-type:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=VgYzPyFA6x5DxkGE81tTZvWFfyANnk7qrhW+RxfJSSk=;\n\tb=rHDOD3oCzGWReh3D1mpmjJG7RqbN07Sd35Jnr4G1DPnmQVzNxRUnEx1zBoncUOFah8SjUz\n\th+HZ9RiX1Q3PFlBA=="],"Message-ID":"","Date":"Mon, 13 Apr 2026 15:27:44 +0200","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH nf-next] netfilter: nf_conncount: make number of hash\n slots configurable","To":"Vladimir Vdovin , netfilter-devel@vger.kernel.org","Cc":"pablo@netfilter.org, fw@strlen.de, coreteam@netfilter.org, phil@nwl.cc","References":"<20260413123712.42993-1-deliran@verdict.gg>","Content-Language":"en-US","From":"Fernando Fernandez Mancera ","In-Reply-To":"<20260413123712.42993-1-deliran@verdict.gg>","Content-Type":"text/plain; charset=UTF-8; format=flowed","Content-Transfer-Encoding":"7bit","X-Spamd-Result":"default: False [-4.30 / 50.00];\n\tBAYES_HAM(-3.00)[100.00%];\n\tNEURAL_HAM_LONG(-1.00)[-1.000];\n\tNEURAL_HAM_SHORT(-0.20)[-1.000];\n\tMIME_GOOD(-0.10)[text/plain];\n\tFUZZY_RATELIMITED(0.00)[rspamd.com];\n\tRCVD_VIA_SMTP_AUTH(0.00)[];\n\tMIME_TRACE(0.00)[0:+];\n\tARC_NA(0.00)[];\n\tTO_DN_SOME(0.00)[];\n\tMID_RHS_MATCH_FROM(0.00)[];\n\tRCVD_TLS_ALL(0.00)[];\n\tDKIM_SIGNED(0.00)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519];\n\tFROM_HAS_DN(0.00)[];\n\tRCPT_COUNT_FIVE(0.00)[6];\n\tFROM_EQ_ENVFROM(0.00)[];\n\tTO_MATCH_ENVRCPT_ALL(0.00)[];\n\tRCVD_COUNT_TWO(0.00)[2];\n\tDBL_BLOCKED_OPENRESOLVER(0.00)[imap1.dmz-prg2.suse.org:helo,suse.de:mid]","X-Spam-Flag":"NO","X-Spam-Score":"-4.30","X-Spam-Level":""}},{"id":3676793,"web_url":"http://patchwork.ozlabs.org/comment/3676793/","msgid":"","list_archive_url":null,"date":"2026-04-13T14:26:19","subject":"Re: [PATCH nf-next] netfilter: nf_conncount: make number of hash\n slots configurable","submitter":{"id":1025,"url":"http://patchwork.ozlabs.org/api/people/1025/","name":"Florian Westphal","email":"fw@strlen.de"},"content":"Vladimir Vdovin wrote:\n> Some workloads with high conntrack rate\n> generate high lock contention on insert_tree(), so\n> constant 256 CONNCOUNT_SLOTS can be too small.\n\nNo. Compile time options suck. No distro is going\nto alter the value away from the default.\n\nMaybe change the code to size the array dynamically\nbased on e.g. number of online cpus?","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=172.234.253.10; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11846-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=91.216.245.30","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=strlen.de"],"Received":["from sea.lore.kernel.org (sea.lore.kernel.org [172.234.253.10])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fvVJN4HYKz1yDF\n\tfor ; Tue, 14 Apr 2026 00:33:24 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id CC09D3038A77\n\tfor ; Mon, 13 Apr 2026 14:26:25 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 03FD83DE445;\n\tMon, 13 Apr 2026 14:26:25 +0000 (UTC)","from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc\n [91.216.245.30])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 906A56BFCE\n\tfor ; Mon, 13 Apr 2026 14:26:22 +0000 (UTC)","by Chamillionaire.breakpoint.cc (Postfix, from userid 1003)\n\tid D327660966; Mon, 13 Apr 2026 16:26:19 +0200 (CEST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776090384; cv=none;\n b=MwK2qMMujwc6YvKeuE7Oph1238ToMpVwKIiLR63l025DCbMneKSbSZz31FZa1rV0PkEowaw9EN7NJyun4PCvu7SZkf7EaxfapeU6P+BYGsgm3XFm3IoODwodUHCelM5d8l1JbZLkKQcMbl6kODLH2630rKxSPEXr+EPpIBASpw8=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776090384; c=relaxed/simple;\n\tbh=38ONMHZin6AGukIFxXmEGOlhxnenE8QJ7jdXj/gi3Ew=;\n\th=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:\n\t Content-Type:Content-Disposition:In-Reply-To;\n b=F1RUzP47ULBg0QCfVcWkMxVUv1ChiR92FH58rI3okEocCe23I7Se07S6+jVgAWI7eUOjl2+anwdPvPb0JXQa4I412z4ekd7dcLh9FtG0Q9UzRkYmqLDD275Wb1Gyv0y5zV2USebgHxvCc9QEzpuuT14GID4d9bkSB86PrAbuJvc=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de;\n spf=pass smtp.mailfrom=strlen.de; arc=none smtp.client-ip=91.216.245.30","Date":"Mon, 13 Apr 2026 16:26:19 +0200","From":"Florian Westphal ","To":"Vladimir Vdovin ","Cc":"netfilter-devel@vger.kernel.org, pablo@netfilter.org,\n\tcoreteam@netfilter.org, phil@nwl.cc","Subject":"Re: [PATCH nf-next] netfilter: nf_conncount: make number of hash\n slots configurable","Message-ID":"","References":"<20260413123712.42993-1-deliran@verdict.gg>","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":"<20260413123712.42993-1-deliran@verdict.gg>"}},{"id":3677667,"web_url":"http://patchwork.ozlabs.org/comment/3677667/","msgid":"","list_archive_url":null,"date":"2026-04-15T13:29:05","subject":"Re: [PATCH nf-next] netfilter: nf_conncount: make number of hash\n slots configurable","submitter":{"id":93133,"url":"http://patchwork.ozlabs.org/api/people/93133/","name":"Vladimir Vdovin","email":"deliran@verdict.gg"},"content":"On Mon Apr 13, 2026 at 4:27 PM MSK, Fernando Fernandez Mancera wrote:\n> On 4/13/26 2:37 PM, Vladimir Vdovin wrote:\n>> Some workloads with high conntrack rate\n>> generate high lock contention on insert_tree(), so\n>> constant 256 CONNCOUNT_SLOTS can be too small.\n>> \n>> Signed-off-by: Vladimir Vdovin \n>> ---\n>\n> Hi Vladimir,\n>\n> do you have a good way to reproduce such situation? I have been looking \n> for ways to improve conncount and its testing.\n>\n> Thanks,\n> Fernando.\n>\nHi Fernando,\n\nI am testing it in our \"cloud\" enviroment where we have ovs with per zone conncount,\nsending syn flood between vms in different zones and different hypervisors.\nNot very good way for reproducing, imho ;) \n\nI will take some time, to try to reproduce in local enviroment betweens namespaces for example.\n\nBest Regards,\nVladimir.\n\n>> net/netfilter/Kconfig | 12 ++++++++++++\n>> net/netfilter/nf_conncount.c | 2 +-\n>> 2 files changed, 13 insertions(+), 1 deletion(-)\n>> \n>> diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig\n>> index 6cdc994fdc8a..38df2829d4d6 100644\n>> --- a/net/netfilter/Kconfig\n>> +++ b/net/netfilter/Kconfig\n>> @@ -111,6 +111,18 @@ if NF_CONNTRACK\n>> config NETFILTER_CONNCOUNT\n>> \ttristate\n>> \n>> +config NF_CONNCOUNT_SLOTS\n>> +\tint \"Number of hash slots for nf_conncount\"\n>> +\tdepends on NF_CONNTRACK\n>> +\tdefault 256\n>> +\trange 1 4096\n>> +\thelp\n>> +\t Number of hash slots used by the nf_conncount module.\n>> +\t Each slot has its own spinlock and rb-tree, so increasing\n>> +\t this value reduces lock contention at the cost of additional\n>> +\t memory.\n>> +\t Default is 256. Allowed range: 1 - 4096.\n>> +\n>> config NF_CONNTRACK_MARK\n>> \tbool 'Connection mark tracking support'\n>> \tdepends on NETFILTER_ADVANCED\n>> diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c\n>> index 00eed5b4d1b1..bdb9081a6c05 100644\n>> --- a/net/netfilter/nf_conncount.c\n>> +++ b/net/netfilter/nf_conncount.c\n>> @@ -32,7 +32,7 @@\n>> #include \n>> #include \n>> \n>> -#define CONNCOUNT_SLOTS\t\t256U\n>> +#define CONNCOUNT_SLOTS\t\tCONFIG_NF_CONNCOUNT_SLOTS\n>> \n>> #define CONNCOUNT_GC_MAX_NODES\t\t8\n>> #define CONNCOUNT_GC_MAX_COLLECT\t64\n>> \n>> base-commit: 028ef9c96e96197026887c0f092424679298aae8","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=verdict.gg header.i=@verdict.gg header.a=rsa-sha256\n header.s=sig1 header.b=L/NJQPMh;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=172.232.135.74; helo=sto.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11919-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=verdict.gg header.i=@verdict.gg\n header.b=\"L/NJQPMh\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=57.103.90.142","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=verdict.gg","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=verdict.gg"],"Received":["from sto.lore.kernel.org (sto.lore.kernel.org [172.232.135.74])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fwhnb02YWz1yHM\n\tfor ; Wed, 15 Apr 2026 23:29:22 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sto.lore.kernel.org (Postfix) with ESMTP id 273A13012225\n\tfor ; Wed, 15 Apr 2026 13:29:20 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 701A93A7828;\n\tWed, 15 Apr 2026 13:29:19 +0000 (UTC)","from outbound.ci.icloud.com (ci-2006b-snip4-1.eps.apple.com\n [57.103.90.142])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 3C73D3A7591\n\tfor ; Wed, 15 Apr 2026 13:29:13 +0000 (UTC)","from outbound.ci.icloud.com (unknown [127.0.0.2])\n\tby p00-icloudmta-asmtp-us-central-1k-10-percent-2 (Postfix) with ESMTPS id\n E7B691800166;\n\tWed, 15 Apr 2026 13:29:10 +0000 (UTC)","from localhost (unknown [17.57.156.36])\n\tby p00-icloudmta-asmtp-us-central-1k-10-percent-2 (Postfix) with ESMTPSA id\n 64A1C1800154;\n\tWed, 15 Apr 2026 13:29:08 +0000 (UTC)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776259757; cv=none;\n b=dnlsd551gkLHcmkLnQaRHczfgHT/QK5bhehuhU0fuNx4euGDLBYf4BWEEN1WveEXkunk3NTmAuL+S08b2WAJAMn4iGRf1T39JWz7/Mr6CYlAAoHwMex4dMx4e6+kMTqtIAn3kQkExnyaZ6O9ow4XoTHzBzsJBc392bFWVY75Z7s=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776259757; c=relaxed/simple;\n\tbh=kc3nyj2S/CoT/yupVoBmgLG6fYrk5Z6eYW5jU0BFtA0=;\n\th=Mime-Version:Content-Type:Date:Message-Id:To:Cc:Subject:From:\n\t References:In-Reply-To;\n b=dpL+m39lQbgaYjQICwAereKDKBvqI54UkZnZ9qCFfMFEK5Z6bWmbseP98sm8gC7Q4vcp9sOTtfMsnnxZjQ9xDV2ezhknEg3aI8HqGhLFDgAwfbF4QbIJWh83OU4lXW32hckrDMCyMgNlgmocxdshmreBDZuA2mFQFfuh90XAPx4=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=verdict.gg;\n spf=pass smtp.mailfrom=verdict.gg;\n dkim=pass (2048-bit key) header.d=verdict.gg header.i=@verdict.gg\n header.b=L/NJQPMh; arc=none smtp.client-ip=57.103.90.142","Dkim-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=verdict.gg; s=sig1;\n t=1776259753; x=1778851753; bh=TZmBGhbRB2EGv3OnqTFZvoVIkpJZ4CU7CoPOD0IhoYA=;\n h=Mime-Version:Content-Type:Date:Message-Id:To:Subject:From:x-icloud-hme;\n b=L/NJQPMhs+aNCgDE3AfD7RCnf3RXltrTbUxXZSss6eg3VCno25C2Wu8SiQSEcR3tDjeVetlENBx39QQFh2KGIs/ck9gBHdqaYpnl2r/G7tkBtRwMGWARHOb/MT61x/LdD87zy5R4/Y4il/ACd+LerQ0Oaw1C4PYg6ebiZrT2P2rVuWzxKB/i58f9kFytiFh8flvr3OYqcSuhx8gAiBmhlLQfxFV/pE4gbyujD9+DnI7Y+rVFP/3wIdDuhQ/SdBF45DcaHYtF6XzTlkzpfwAl4O6O2+qNGpvwX318Qdb9Pxan3NdYMoNXndGWdWOLSeF6t21Q7eDy0dJFCF64FaG1Dw==","mail-alias-created-date":"1621344842221","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","Mime-Version":"1.0","Content-Transfer-Encoding":"quoted-printable","Content-Type":"text/plain; charset=UTF-8","Date":"Wed, 15 Apr 2026 16:29:05 +0300","Message-Id":"","To":"\"Fernando Fernandez Mancera\" , \"Vladimir Vdovin\"\n , ","Cc":", , ,\n ","Subject":"Re: [PATCH nf-next] netfilter: nf_conncount: make number of hash\n slots configurable","From":"\"Vladimir Vdovin\" ","X-Mailer":"aerc 0.21.0","References":"<20260413123712.42993-1-deliran@verdict.gg>\n ","In-Reply-To":"","X-Proofpoint-GUID":"kG3mQVFi9yMEEQXyPN4s_zcZaIhsQ6z8","X-Authority-Info-Out":"v=2.4 cv=GIoF0+NK c=1 sm=1 tr=0 ts=69df92a7\n cx=c_apl:c_pps:t_out a=2G65uMN5HjSv0sBfM2Yj2w==:117\n a=2G65uMN5HjSv0sBfM2Yj2w==:17 a=IkcTkHD0fZMA:10 a=A5OVakUREuEA:10\n a=VkNPw1HP01LnGYTKEx00:22 a=x_lt9X2gik-7htSF0NIA:9 a=QEXdDO2ut3YA:10","X-Proofpoint-Spam-Details-Enc":"AW1haW4tMjYwNDE1MDEyNSBTYWx0ZWRfX/fGwBTXxEbLG\n ZkGS1Rd6g2b5MTCOCDEvTaezlnATCHG64zFtd6IhcMBbXIkh8VeON6ZFbkcMVTJleHAtXC1qT5b\n cJpPOPBmIQFMXjKkITFZU7bS8shXaLoGAy3e54rbeh8Yup2pWifzxEMlG9z9AeqKEK85jrSEB/E\n qVo2UGFiQIL2+R5AT4jIAx2auHyNQFHDC9qGnPusYDT4/PEUonlapc9XIuUPYa0X2UPEpJ5Sg6a\n GEm0JFcUP4PPQEvVPEfZhTtQH3nxd9CJ+q2+Pp7smfPRkpNcr6VdnsBH+6EexPEOv4d6b4vdE5F\n Afl0FAOhLov2sCCOgqfI9bV617CehN3QRQ66PUsdkcQdVu64dhd/j1q2Dv6iuo=","X-Proofpoint-ORIG-GUID":"kG3mQVFi9yMEEQXyPN4s_zcZaIhsQ6z8","X-Proofpoint-Virus-Version":"vendor=baseguard\n engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49\n definitions=2026-04-15_01,2026-04-13_04,2025-10-01_01","X-Proofpoint-Spam-Details":"rule=notspam policy=default score=0 mlxscore=0\n clxscore=1030 bulkscore=0 malwarescore=0 mlxlogscore=651 phishscore=0\n suspectscore=0 adultscore=0 lowpriorityscore=0 spamscore=0 classifier=spam\n authscore=0 adjust=0 reason=mlx scancount=1 engine=8.22.0-2601150000\n definitions=main-2604150125"}},{"id":3677669,"web_url":"http://patchwork.ozlabs.org/comment/3677669/","msgid":"","list_archive_url":null,"date":"2026-04-15T13:32:05","subject":"Re: [PATCH nf-next] netfilter: nf_conncount: make number of hash\n slots configurable","submitter":{"id":93133,"url":"http://patchwork.ozlabs.org/api/people/93133/","name":"Vladimir Vdovin","email":"deliran@verdict.gg"},"content":"On Mon Apr 13, 2026 at 5:26 PM MSK, Florian Westphal wrote:\n> Vladimir Vdovin wrote:\n>> Some workloads with high conntrack rate\n>> generate high lock contention on insert_tree(), so\n>> constant 256 CONNCOUNT_SLOTS can be too small.\n>\n> No. Compile time options suck. No distro is going\n> to alter the value away from the default.\n>\n> Maybe change the code to size the array dynamically\n> based on e.g. number of online cpus?\nHi Florian,\n\nMay be we could move it to module params?\n(not sure that this params have to depend on number of cpu)\nMay be use number of cpus as default value?\n\nBest Regards,\nVladimir","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=verdict.gg header.i=@verdict.gg header.a=rsa-sha256\n header.s=sig1 header.b=pLE6sugv;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=104.64.211.4; helo=sin.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11920-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=verdict.gg header.i=@verdict.gg\n header.b=\"pLE6sugv\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=57.103.79.33","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=verdict.gg","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=verdict.gg"],"Received":["from sin.lore.kernel.org (sin.lore.kernel.org [104.64.211.4])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fwhsB47FHz1yDF\n\tfor ; Wed, 15 Apr 2026 23:32:30 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sin.lore.kernel.org (Postfix) with ESMTP id 935EA3016141\n\tfor ; Wed, 15 Apr 2026 13:32:26 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 618393B0AEE;\n\tWed, 15 Apr 2026 13:32:24 +0000 (UTC)","from outbound.st.icloud.com\n (p-east2-cluster5-host7-snip4-10.eps.apple.com [57.103.79.33])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 381723AE1A0\n\tfor ; Wed, 15 Apr 2026 13:32:20 +0000 (UTC)","from outbound.st.icloud.com (unknown [127.0.0.2])\n\tby p00-icloudmta-asmtp-us-east-1a-100-percent-8 (Postfix) with ESMTPS id\n 06818180166B;\n\tWed, 15 Apr 2026 13:32:17 +0000 (UTC)","from localhost (unknown [17.42.251.67])\n\tby p00-icloudmta-asmtp-us-east-1a-100-percent-8 (Postfix) with ESMTPSA id\n 83E4F1802032;\n\tWed, 15 Apr 2026 13:32:08 +0000 (UTC)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776259942; cv=none;\n b=fQZ0jaYvLmR5A5bBNcVFkKKgM+uUuGi2ZGzpkIrABM4mQo8kZ3CJKdYOXyWzzFbkxPyWtiVpdfAAlU0AdHirjo+s/qc1LvHNZd2gb646TO26KLhOF3uGH9QfxY6+sPc0fcvRPT7iFTp39i3FYpxhAWQb/j4Esol78uUewrMrmXU=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776259942; c=relaxed/simple;\n\tbh=5ZWvuFdlS0YvkfaiTFpe0RlMufW3MfEuCTwAYN2GkWk=;\n\th=Mime-Version:Content-Type:Date:Message-Id:Cc:Subject:From:To:\n\t References:In-Reply-To;\n b=UWyry6oxLMl0Cqde5twcy2NUSV0pQz9w8jR9NKiuWZbboK9eNYc2ExglZRvE+yLllkh24XZF2yGFSwWT+/2dqz3Kln8J3JwevOcDrNwQ0/RY3svjVhrakSWj0lf+yrrnYaX1wG1w+KYf41U+J2IWwLe4HVpLXsZHRQZQMe55bko=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=verdict.gg;\n spf=pass smtp.mailfrom=verdict.gg;\n dkim=pass (2048-bit key) header.d=verdict.gg header.i=@verdict.gg\n header.b=pLE6sugv; arc=none smtp.client-ip=57.103.79.33","Dkim-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=verdict.gg; s=sig1;\n t=1776259940; x=1778851940; bh=A2ATZWYN52HMj7WUMHq3O41V5zm1dherqzOB7RtxdUU=;\n h=Mime-Version:Content-Type:Date:Message-Id:Subject:From:To:x-icloud-hme;\n b=pLE6sugvomZACbVRYRAHpoS+1uOcbxpQC5Ng5KsXtuJXaaQ8eQ37qLNhQecB/Q7AaffkOS5ylGIoKMIuIzDKUzJCVKasPAFV+xMMbpSw3mnmZkMHlPHjf4O8nw3l51I4KtHg2amrYvU3m45M4QyPGMIQpBa7e4TCY9yyNX2OwRE0MPSfW6ysXXZdWZAhVs3L+JyQHtaqXmPVobhDLFhfW0ghUfjdgKwjTPKBYpl4LE5nktp7nAmJZPZ1gCor+8XGL2hGnXu+I+1bevmy/70retvKgbGuFM0DMXFszS5zaEQDBJSVx9a1uVrZKMFWQYXBYEhKI6aOmkifDqQ0+cl1Vg==","mail-alias-created-date":"1621344842221","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","Mime-Version":"1.0","Content-Transfer-Encoding":"quoted-printable","Content-Type":"text/plain; charset=UTF-8","Date":"Wed, 15 Apr 2026 16:32:05 +0300","Message-Id":"","Cc":", ,\n , ","Subject":"Re: [PATCH nf-next] netfilter: nf_conncount: make number of hash\n slots configurable","From":"\"Vladimir Vdovin\" ","To":"\"Florian Westphal\" , \"Vladimir Vdovin\"\n ","X-Mailer":"aerc 0.21.0","References":"<20260413123712.42993-1-deliran@verdict.gg>\n ","In-Reply-To":"","X-Proofpoint-ORIG-GUID":"67OUaV59TmjcmBavejuDHJt41JfiZ9hh","X-Proofpoint-GUID":"67OUaV59TmjcmBavejuDHJt41JfiZ9hh","X-Authority-Info-Out":"v=2.4 cv=TYWbdBQh c=1 sm=1 tr=0 ts=69df9362\n cx=c_apl:c_pps:t_out a=YrL12D//S6tul8v/L+6tKg==:117\n a=YrL12D//S6tul8v/L+6tKg==:17 a=IkcTkHD0fZMA:10 a=A5OVakUREuEA:10\n a=VkNPw1HP01LnGYTKEx00:22 a=4z1_H52H5aT_0pXROGQA:9 a=QEXdDO2ut3YA:10","X-Proofpoint-Spam-Details-Enc":"AW1haW4tMjYwNDE1MDEyNiBTYWx0ZWRfX7LPysoHNURJL\n Gtc4Sq8hgq5AhmJoaiXo2I9bN7AQyLyJKf9gSDCHyqz8tm0u2rGIAbYGu0b2usnHIM3oFywb47i\n zyL8Ag/nTAMlE0ikjIZBLSWu2XwcAen0vTBcL9QmW/bnAdP/UH5nTF37orDw0yJD18lWsu0syIN\n GkZmE+atr53BgF03DGjZpD+wq/Zm1GUEvfJvALlpPvNNz0VwmWlIzVBPDvLUVyw3xXkYzVpdSSZ\n w73py11u7Q4iBKGGVdoe4Rn+QYHl/9mqnPJpvJm90WjkhKw38qYVIitrtHYHZbGpsc4vordwPP2\n KdPa63iIBQQP4B3WGMy++O6SJ9p/5S5oG937wcG5tjGQrSL3wx/c/HRDgIU44w=","X-Proofpoint-Virus-Version":"vendor=baseguard\n engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49\n definitions=2026-04-15_01,2026-04-13_04,2025-10-01_01","X-Proofpoint-Spam-Details":"rule=notspam policy=default score=0 suspectscore=0\n malwarescore=0 mlxlogscore=523 spamscore=0 phishscore=0 mlxscore=0\n clxscore=1030 bulkscore=0 adultscore=0 lowpriorityscore=0 classifier=spam\n authscore=0 adjust=0 reason=mlx scancount=1 engine=8.22.0-2601150000\n definitions=main-2604150126"}},{"id":3677677,"web_url":"http://patchwork.ozlabs.org/comment/3677677/","msgid":"","list_archive_url":null,"date":"2026-04-15T13:44:40","subject":"Re: [PATCH nf-next] netfilter: nf_conncount: make number of hash\n slots configurable","submitter":{"id":1025,"url":"http://patchwork.ozlabs.org/api/people/1025/","name":"Florian Westphal","email":"fw@strlen.de"},"content":"Vladimir Vdovin wrote:\n> > Maybe change the code to size the array dynamically\n> > based on e.g. number of online cpus?\n> Hi Florian,\n> \n> May be we could move it to module params?\n> (not sure that this params have to depend on number of cpu)\n> May be use number of cpus as default value?\n\nI would prefer autotuning based on online cpus so this doesn't have to\nbe changed at all.\n\nHow many cores does your platfrom have? The current value was set 2014.","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=172.234.253.10; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11921-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=91.216.245.30","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=strlen.de"],"Received":["from sea.lore.kernel.org (sea.lore.kernel.org [172.234.253.10])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fwj7h66P6z1yCv\n\tfor ; Wed, 15 Apr 2026 23:45:04 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 299CA30329B6\n\tfor ; Wed, 15 Apr 2026 13:44:51 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 7FEF639447C;\n\tWed, 15 Apr 2026 13:44:50 +0000 (UTC)","from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc\n [91.216.245.30])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B73733A031\n\tfor ; Wed, 15 Apr 2026 13:44:48 +0000 (UTC)","by Chamillionaire.breakpoint.cc (Postfix, from userid 1003)\n\tid CF1BE602AB; Wed, 15 Apr 2026 15:44:45 +0200 (CEST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776260690; cv=none;\n b=EbC52/nzVFDOBhIrufIOuFfC58eLhYTbdv8UKZimLDKaiuGXKYsHCWp+nnlznPNiRHOrXS1z7aADBJSb+OA8xa9ChoMVEYUylgjXQ2ZeMOzYaCyJGZkKWhQ8T71eoRL8m8BMSSsEOjJ4fOFZvpYHAL38StC/irEqD2MHRu2vBfU=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776260690; c=relaxed/simple;\n\tbh=mbcIAsxip3Je0Mce9MUdGsnyf6RaeI4A9/9IGvcUjKQ=;\n\th=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:\n\t Content-Type:Content-Disposition:In-Reply-To;\n b=a8eBViQEWIe0DZpWhioSLC6AHQTcpUyO0nTzDdM5BDKuUrLKtpDSHlNXbar7bqMuVJtZUzvdRxq97y2prj0ZRLobDigR6quiPQ+AuXt0NJV6wwQDV0/dFpN1uaCsnFo9VFJWLgUIAhTR3qr1dtJVTC6B2pCesUpphqFs3FdIWac=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de;\n spf=pass smtp.mailfrom=strlen.de; arc=none smtp.client-ip=91.216.245.30","Date":"Wed, 15 Apr 2026 15:44:40 +0200","From":"Florian Westphal ","To":"Vladimir Vdovin ","Cc":"netfilter-devel@vger.kernel.org, pablo@netfilter.org,\n\tcoreteam@netfilter.org, phil@nwl.cc","Subject":"Re: [PATCH nf-next] netfilter: nf_conncount: make number of hash\n slots configurable","Message-ID":"","References":"<20260413123712.42993-1-deliran@verdict.gg>\n \n ","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":""}},{"id":3677692,"web_url":"http://patchwork.ozlabs.org/comment/3677692/","msgid":"","list_archive_url":null,"date":"2026-04-15T14:10:03","subject":"Re: [PATCH nf-next] netfilter: nf_conncount: make number of hash\n slots configurable","submitter":{"id":93133,"url":"http://patchwork.ozlabs.org/api/people/93133/","name":"Vladimir Vdovin","email":"deliran@verdict.gg"},"content":"On Wed Apr 15, 2026 at 4:44 PM MSK, Florian Westphal wrote:\n> Vladimir Vdovin wrote:\n>> > Maybe change the code to size the array dynamically\n>> > based on e.g. number of online cpus?\n>> Hi Florian,\n>> \n>> May be we could move it to module params?\n>> (not sure that this params have to depend on number of cpu)\n>> May be use number of cpus as default value?\n>\n> I would prefer autotuning based on online cpus so this doesn't have to\n> be changed at all.\n>\n> How many cores does your platfrom have? The current value was set 2014.\nTested on 160 cores with SMT and 2 nodes.(40*2 + 40*2)","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=verdict.gg header.i=@verdict.gg header.a=rsa-sha256\n header.s=sig1 header.b=q2oczayP;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c04:e001:36c::12fc:5321; helo=tor.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11923-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=verdict.gg header.i=@verdict.gg\n header.b=\"q2oczayP\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=57.103.88.174","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=verdict.gg","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=verdict.gg"],"Received":["from tor.lore.kernel.org (tor.lore.kernel.org\n [IPv6:2600:3c04:e001:36c::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fwjkk1BYvz1yHd\n\tfor ; Thu, 16 Apr 2026 00:11:58 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id 68FAD30457D5\n\tfor ; Wed, 15 Apr 2026 14:11:55 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id C09133D1CA4;\n\tWed, 15 Apr 2026 14:11:54 +0000 (UTC)","from outbound.ci.icloud.com (ci-2002e-snip4-3.eps.apple.com\n [57.103.88.174])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 0DB442DEA64\n\tfor ; Wed, 15 Apr 2026 14:11:50 +0000 (UTC)","from outbound.ci.icloud.com (unknown [127.0.0.2])\n\tby p00-icloudmta-asmtp-us-central-1k-100-percent-5 (Postfix) with ESMTPS id\n 4CADF1804AD7;\n\tWed, 15 Apr 2026 14:11:48 +0000 (UTC)","from localhost (unknown [17.57.156.36])\n\tby p00-icloudmta-asmtp-us-central-1k-100-percent-5 (Postfix) with ESMTPSA id\n 33AD81804889;\n\tWed, 15 Apr 2026 14:10:06 +0000 (UTC)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776262313; cv=none;\n b=Asqe2dClMzidydoAn7DtOz2krcCT3O10RMFgkYgyjzhS2r4oD3ho1qvwKwiXBr6pA9FQDcopeHtOtMbxd4x+uTgzwdIQYpev8MKGyI0Th4dKQLD9VEixEw3m6KI2kqLOLsT8D5LLfX7gt4dV5vjLGBfpD2keapnRm/3IW4yk91A=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776262313; c=relaxed/simple;\n\tbh=cJiX6ZYqG89KoksfRtI/8BDmqJk7UCwer4kzZs4/SQw=;\n\th=Mime-Version:Content-Type:Date:Message-Id:Cc:Subject:From:To:\n\t References:In-Reply-To;\n b=BvnQ+Qsicwmwaod/HM+3wHumN8T0WQ0KqpjH9F5lzb60KiejU2EjTiLKy2ZF335lCDV67TeL0CEQ24yFJyH7QK6eSK5fZX11RBUE885brfoBf4fvq/l/IGPgupYL0KIbqSfvOqKBtJgIHDIlishP4yaJtKimZUzcxsVrkIKaZrY=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=verdict.gg;\n spf=pass smtp.mailfrom=verdict.gg;\n dkim=pass (2048-bit key) header.d=verdict.gg header.i=@verdict.gg\n header.b=q2oczayP; arc=none smtp.client-ip=57.103.88.174","Dkim-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=verdict.gg; s=sig1;\n t=1776262310; x=1778854310; bh=qMaF9uKrTIvJy/HDEnFngLK6LwtFNKYHIz7gR76jnAU=;\n h=Mime-Version:Content-Type:Date:Message-Id:Subject:From:To:x-icloud-hme;\n b=q2oczayPohGr+LoslZh9ovxolGOoXiDWgS6kgEbMAwUkB8ytsICn9rW6fTEB+cjjXbQIg4aQ9kO4CDee/JH1ZJza5ZWnB2H5Ks40kRGe0SbUjbJOElL7UoT1NCetj0DkqSkUaGQYPaB0LhnEq5PX2CuiVDWuqws1T5be/EiqyctiNjjt0u7FBJWc+Fw6Cj+ZEh4S6TeX2qenzJDveCWyMrAggA+0BOrNEE/vMNBKHgQLs0RyjJ2hSHjFbNXWk3NwZOqcrBAA9dTv/rKYmjFPIay/MUd0O2S6CwTxORenfk6lhSaVfY0+40wp2kphoRGtXMGUgDFYqNK+qfT3HfYntQ==","mail-alias-created-date":"1621344842221","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","Mime-Version":"1.0","Content-Transfer-Encoding":"quoted-printable","Content-Type":"text/plain; charset=UTF-8","Date":"Wed, 15 Apr 2026 17:10:03 +0300","Message-Id":"","Cc":", ,\n , ","Subject":"Re: [PATCH nf-next] netfilter: nf_conncount: make number of hash\n slots configurable","From":"\"Vladimir Vdovin\" ","To":"\"Florian Westphal\" , \"Vladimir Vdovin\"\n ","X-Mailer":"aerc 0.21.0","References":"<20260413123712.42993-1-deliran@verdict.gg>\n \n ","In-Reply-To":"","X-Authority-Info-Out":"v=2.4 cv=BIu+bVQG c=1 sm=1 tr=0 ts=69df9ca4\n cx=c_apl:c_pps:t_out a=2G65uMN5HjSv0sBfM2Yj2w==:117\n a=2G65uMN5HjSv0sBfM2Yj2w==:17 a=IkcTkHD0fZMA:10 a=A5OVakUREuEA:10\n a=VkNPw1HP01LnGYTKEx00:22 a=5bbbQDbFjiGO6tJvQg0A:9 a=QEXdDO2ut3YA:10","X-Proofpoint-GUID":"OFSuFx5EQmoKNW-IMxkDLkft60C9jUN0","X-Proofpoint-ORIG-GUID":"OFSuFx5EQmoKNW-IMxkDLkft60C9jUN0","X-Proofpoint-Spam-Details-Enc":"AW1haW4tMjYwNDE1MDEzMiBTYWx0ZWRfX79f9T8WqResc\n XJVV2GEkcDq87lyRIJXuHVBj73fGMHZkHwk61I4iRi/4zyPzbxqTpQmEbZcwpxxhHrnxAKTk9dX\n FGSXGK8QqgXHHUPBvou5qHBSkto/mjeHksnRhMaSaiPbRwcATxvMuHB37Wq+csWToXrm6L8xb3G\n ZqKHXCcOdhsDRWo2JxL5ABbiGQUL11SNzg6UShr35uwoMgwVR/pKtcoPPukPNNr56QWyYCfd7Ia\n fd8EiJo3c0O12DUOofISJDs/5eMk117KGJTjI/+HCLAn57IIAW7xCFOuC2f0Br39uR3tJS+NpeI\n MyZ3m0dg8xy85cm487S3LCK3lpYf4hj/tN1S+a4TeGqqzQbBTPRcT7TKaBnLQk=","X-Proofpoint-Virus-Version":"vendor=baseguard\n engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49\n definitions=2026-04-15_01,2026-04-13_04,2025-10-01_01","X-Proofpoint-Spam-Details":"rule=notspam policy=default score=0 bulkscore=0\n malwarescore=0 phishscore=0 adultscore=0 lowpriorityscore=0 spamscore=0\n mlxscore=0 clxscore=1030 mlxlogscore=379 suspectscore=0 classifier=spam\n authscore=0 adjust=0 reason=mlx scancount=1 engine=8.22.0-2601150000\n definitions=main-2604150132"}},{"id":3677710,"web_url":"http://patchwork.ozlabs.org/comment/3677710/","msgid":"","list_archive_url":null,"date":"2026-04-15T14:43:06","subject":"Re: [PATCH nf-next] netfilter: nf_conncount: make number of hash\n slots configurable","submitter":{"id":1025,"url":"http://patchwork.ozlabs.org/api/people/1025/","name":"Florian Westphal","email":"fw@strlen.de"},"content":"Florian Westphal wrote:\n> Vladimir Vdovin wrote:\n> > > Maybe change the code to size the array dynamically\n> > > based on e.g. number of online cpus?\n> > Hi Florian,\n> > \n> > May be we could move it to module params?\n> > (not sure that this params have to depend on number of cpu)\n> > May be use number of cpus as default value?\n> \n> I would prefer autotuning based on online cpus so this doesn't have to\n> be changed at all.\n\nAnd we should also do something like this.\nAs-is, different netns will block same slot if the key is the same.\nAs OVS uses conntrack zones and those can easily overlap, they hash\nto same slot internally even if they use different data structures\nand could run in parallel.\n\ndiff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c\nindex 00eed5b4d1b1..ab28b47395bd 100644\n--- a/net/netfilter/nf_conncount.c\n+++ b/net/netfilter/nf_conncount.c\n@@ -58,6 +58,7 @@ static spinlock_t nf_conncount_locks[CONNCOUNT_SLOTS] __cacheline_aligned_in_smp\n \n struct nf_conncount_data {\n \tunsigned int keylen;\n+\tu32 initval;\n \tstruct rb_root root[CONNCOUNT_SLOTS];\n \tstruct net *net;\n \tstruct work_struct gc_work;\n@@ -65,7 +66,6 @@ struct nf_conncount_data {\n \tunsigned int gc_tree;\n };\n \n-static u_int32_t conncount_rnd __read_mostly;\n static struct kmem_cache *conncount_rb_cachep __read_mostly;\n static struct kmem_cache *conncount_conn_cachep __read_mostly;\n \n@@ -496,7 +496,7 @@ count_tree(struct net *net,\n \tstruct nf_conncount_rb *rbconn;\n \tunsigned int hash;\n \n-\thash = jhash2(key, data->keylen, conncount_rnd) % CONNCOUNT_SLOTS;\n+\thash = jhash2(key, data->keylen, data->initval) % CONNCOUNT_SLOTS;\n \troot = &data->root[hash];\n \n \tparent = rcu_dereference_raw(root->rb_node);\n@@ -630,8 +630,6 @@ struct nf_conncount_data *nf_conncount_init(struct net *net, unsigned int keylen\n \t keylen == 0)\n \t\treturn ERR_PTR(-EINVAL);\n \n-\tnet_get_random_once(&conncount_rnd, sizeof(conncount_rnd));\n-\n \tdata = kmalloc_obj(*data);\n \tif (!data)\n \t\treturn ERR_PTR(-ENOMEM);\n@@ -641,6 +639,7 @@ struct nf_conncount_data *nf_conncount_init(struct net *net, unsigned int keylen\n \n \tdata->keylen = keylen / sizeof(u32);\n \tdata->net = net;\n+\tdata->initval = get_random_u32();\n \tINIT_WORK(&data->gc_work, tree_gc_worker);\n \n \treturn data;","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c09:e001:a7::12fc:5321; helo=sto.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11925-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=91.216.245.30","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=strlen.de"],"Received":["from sto.lore.kernel.org (sto.lore.kernel.org\n [IPv6:2600:3c09:e001:a7::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fwkQs5mPFz1yHc\n\tfor ; Thu, 16 Apr 2026 00:43:17 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sto.lore.kernel.org (Postfix) with ESMTP id 6E12D300C302\n\tfor ; Wed, 15 Apr 2026 14:43:14 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id DF8603A75AB;\n\tWed, 15 Apr 2026 14:43:10 +0000 (UTC)","from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc\n [91.216.245.30])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id ACFC0199FAB\n\tfor ; Wed, 15 Apr 2026 14:43:08 +0000 (UTC)","by Chamillionaire.breakpoint.cc (Postfix, from userid 1003)\n\tid D4BD560490; Wed, 15 Apr 2026 16:43:06 +0200 (CEST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776264190; cv=none;\n b=VbJRbuO7cMBJyBUJ9TLZ9C1O/iCenaeO5HjNsBzAzoW7WlvroAQqWSTd4SUtnaiuwYb/U7eHbHu65nQPvUdhad9ps99KQ1ZfH2eLlgxygR1UIrlV8B1hwpg47M/xUNSuAoYWEppDDRhxjzDQMMnIcecyXJpBL2UJllnaQaxTkXY=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776264190; c=relaxed/simple;\n\tbh=gO9LghzNSNvQPuJKSpRfW8Iem+en2fzkZjygbU3URTY=;\n\th=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:\n\t Content-Type:Content-Disposition:In-Reply-To;\n b=O89RvM8xmTwWiUCYEtsxof8OfURBQm9D6wBmFUsTD+zEHXMVy+fASGzrKSYZ5As2FTyTJHbkDJnbZh1WTZwvAS5l3qcZmt3JUkZGkEwulWDtmMGawx5asVPgksqKJDc5Ps/j9/6Yr4SInq8GO9Y7HF3sHJdCUxvfYkxiK+Jiw/o=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de;\n spf=pass smtp.mailfrom=strlen.de; arc=none smtp.client-ip=91.216.245.30","Date":"Wed, 15 Apr 2026 16:43:06 +0200","From":"Florian Westphal ","To":"Vladimir Vdovin ","Cc":"netfilter-devel@vger.kernel.org, pablo@netfilter.org,\n\tcoreteam@netfilter.org, phil@nwl.cc","Subject":"Re: [PATCH nf-next] netfilter: nf_conncount: make number of hash\n slots configurable","Message-ID":"","References":"<20260413123712.42993-1-deliran@verdict.gg>\n \n \n ","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":""}}]