tcpdump mailing list archives

Ineffective filter optimization


From: Alexander Motin <mav () FreeBSD org>
Date: Sun, 24 Feb 2008 15:43:49 +0200

Hi.

I have found an odd filter optimizer behaviour case.

For example:
%tcpdump -i lo0 -d 'src net 10.0.1.0/24 or src net 10.0.2.0/24'
(000) ld [0]
(001) jeq #0x2000000 jt 2 jf 9
(002) ld [16]
(003) and #0xffffff00
(004) jeq #0xa000100 jt 8 jf 5
(005) ld [16]
(006) and #0xffffff00
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
(007) jeq #0xa000200 jt 8 jf 9
(008) ret #96
(009) ret #0

In this case instructions 5 and 6 could be easily removed.

At the same time if expression becomes some more complicated optimizer is
able to handle that:
tcpdump -i lo0 -d 'src port 25 and ( src net 10.0.1.0/24 or src net
10.0.2.0/24)'
(000) ld [0]
(001) jeq #0x1c000000 jt 17 jf 2
(002) jeq #0x2000000 jt 3 jf 17
(003) ldb [13]
(004) jeq #0x84 jt 7 jf 5
(005) jeq #0x6 jt 7 jf 6
(006) jeq #0x11 jt 7 jf 17
(007) ldh [10]
(008) jset #0x1fff jt 17 jf 9
(009) ldxb 4*([4]&0xf)
(010) ldh [x + 4]
(011) jeq #0x19 jt 12 jf 17
(012) ld [16]
(013) and #0xffffff00
(014) jeq #0xa000100 jt 16 jf 15
(015) jeq #0xa000200 jt 16 jf 17
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
(016) ret #96
(017) ret #0

I think such optimization should significantly increase filter execution
performance.

...........................

It looks like I have found the reason.
In first example X register is not ever used. So expression xval != 0 in
optimize.c:1264
will never be true to permit optimization. IMHO if some register was
undefined before us
and left undefined after us why does it should keep us from removing this
statement?

...........................

Could somebody comment that my post?
http://sourceforge.net/tracker/index.php?func=detail&aid=1889037&group_id=53067&atid=469577

--
Alexander Motin
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.


Current thread: