Page MenuHomeFreeBSD

pf: Don't allocate per-table entry counters unless requested.
ClosedPublic

Authored by markj on May 10 2020, 10:13 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Jun 5, 6:24 PM
Unknown Object (File)
Thu, May 23, 11:29 PM
Unknown Object (File)
May 18 2024, 1:53 AM
Unknown Object (File)
May 5 2024, 8:10 AM
Unknown Object (File)
May 5 2024, 3:31 AM
Unknown Object (File)
Apr 30 2024, 7:52 PM
Unknown Object (File)
Apr 27 2024, 2:14 AM
Unknown Object (File)
Apr 27 2024, 2:13 AM

Details

Summary

pf by default does not do table address accounting unless the "counters"
keyword is specified in the corresponding pf.conf entry. (There doesn't
appear to be a way to specify this at all when adding a table using
pfctl directly.) Yet, we always allocate counters. For large tables,
the memory overhead of the counters is quite significant since we
allocate 12 per table entry. (Plus 12 pointers in the table entry itself.)
Moreover, reloading a table definition from pf.conf causes all counters
to be zeroed, which corresponds to 12 SMP rendezvous operations per
entry, while holding the rules lock.

A further refinement might add a pfr_kentry counter array UMA zone, so
that we can allocate a contiguous array of counters and thus reduce
pointer overhead. We should also try to find a way to reduce the
overhead of counter zeroing.

Mitigate the problem by checking for PFR_TFLAG_COUNTERS before
performing any allocation.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj edited the summary of this revision. (Show Details)

It'd be nice (but it's not required for this to proceed) to have a test to exercise this, i.e. create a table with counters, send some traffic through, check that the counters incremented.

This revision is now accepted and ready to land.May 11 2020, 7:52 AM
In D24803#545731, @kp wrote:

It'd be nice (but it's not required for this to proceed) to have a test to exercise this, i.e. create a table with counters, send some traffic through, check that the counters incremented.

Ok, I will write one.