perf: SoA expire deadlines + write-coalescing + forced-minimum NAT GC + pool health metrics

[w180112]

Summary

Step 3 of the NAT rework (step 1: #73, step 2: #74). Closes the two remaining gaps after the dual-hash rework:

• GC scan cost: the amortized GC scan walked full 64B addr_table entries just to read one 8-byte expire_at, sharing cache lines with fields packet processing writes.
• Unconditional per-packet expire writes: expire_at was stored on every packet, including twice per TCP data packet (once from the NAT-level refresh, once from the TCP conntrack ESTABLISHED self-loop), with no coalescing — and GC only ran on nb_rx == 0 (pure idle), so sustained near-line-rate traffic could starve reclaim with zero visibility into pool health.

Structure-of-arrays (SoA) split

expire_at moves out of addr_table_t into a parallel per-subscriber array, nat_expire_at[MAX_NAT_ENTRIES] (8 deadlines/cache-line vs. 1 per 64B entry). The GC hot loop now reads only this dense array — 0 means free, skip — and only touches the full entry once a deadline is confirmed expired: an 8x reduction in scan footprint. Each addr_table_t keeps a back-pointer, expire_slot, bound once in nat_table_reset and read-only after, so tcp_conntrack.c's handlers (which only see a bare struct addr_table *, not the owning ppp_ccb) can still reach their own SoA slot.

Write-coalescing

Two disciplines replace the single unconditional atomic write:

• nat_expire_set() — unconditional store, for transitions where a deadline must shrink immediately (e.g. ESTABLISHED -> FIN_WAIT).
• nat_expire_refresh() — reads the current value first, only stores when the new target exceeds cur + NAT_EXPIRE_COALESCE_SEC (1s), for same-state refreshes.

Applied to the NAT-level per-packet refresh paths (nat_reverse_lookup, both fast-path hits in nat_learning_port_reuse) and to TCP conntrack: a new handler, tcp_act_refresh_established, replaces tcp_act_timeout_established on the (ESTABLISHED, ACK) -> ESTABLISHED self-loop — the row hit by every data packet of an established flow — while transitions into ESTABLISHED keep the unconditional setter. Net effect: per-flow expire writes drop from once per packet to about once per second, removing the cross-core cache-line ping-pong the SoA split would otherwise reintroduce under concurrent refresh from RSS/distributor cores.

GC trigger

Widened from nb_rx == 0 to nb_rx < BURST_SIZE (any non-full burst, not just fully idle polls), moved to after burst/TX processing so it never adds latency ahead of packets, plus a per-lcore backpressure counter (NAT_GC_FORCE_PERIOD = 1024) that forces one GC chunk every 1024 consecutive full-burst polls — so sustained line-rate traffic still gets a guaranteed minimum reclaim rate. Worst case: one 512-slot SoA scan per 1024x32 packets (~1.5%).

Pool health observability

Two new per-subscriber counters: ppp_ccb->nat_enospc (learning failures: ports exhausted, pool dry, or hash full) and nat_gc_reclaimed (entries reclaimed by GC), both relaxed atomics on cold paths. Exposed as three new Prometheus metrics and documented in docs/metrics.md:

• fastrg_node_per_user_nat_entries_used
• fastrg_node_per_user_nat_alloc_fail_total
• fastrg_node_per_user_nat_gc_reclaimed_total

Tests

Add-only, no existing case modified: test_expire_refresh_coalescing and test_stats_counters in nat_test.c; test_established_refresh_coalesced in tcp_conntrack_test.c (verifies a fresh deadline skips the coalesced refresh, a >1s-stale one forces a store, and the FIN -> FIN_WAIT shortening transition stays immediate). Mechanical migration of existing expire_at accesses in both test files from rte_atomic64_set/read to nat_expire_set/expire_slot.

Test plan

• make — clean production build
• make test — 1167/1167
• e2e_test/run_e2e_test.sh — 73/73 pass, 0 fail, 0 skip

🤖 Generated with Claude Code