Page MenuHomeFreeBSD

pf: Stop using net_epoch to synchronize access to eth rules
ClosedPublic

Authored by markj on Feb 3 2025, 7:30 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Oct 3, 11:06 AM
Unknown Object (File)
Thu, Oct 2, 5:40 AM
Unknown Object (File)
Sun, Sep 14, 6:41 AM
Unknown Object (File)
Sep 14 2025, 12:23 AM
Unknown Object (File)
Sep 13 2025, 6:13 AM
Unknown Object (File)
Sep 13 2025, 5:11 AM
Unknown Object (File)
Sep 8 2025, 1:19 AM
Unknown Object (File)
Aug 22 2025, 11:48 PM

Details

Summary

Commit 20c4899a8eea4 modified pf_test_eth_rule() to not acquire the
rules read lock, so pf_commit_eth() was changed to wait until the
now-inactive rules are no longer in use before freeing them. In
particular, it uses the net_epoch to schedule callbacks once the
inactive rules are no longer visible to packet processing threads.

However, since commit 812839e5aaaf4, pf_test_eth_rule() acquires the
rules read lock, so this deferred action is unneeded. This patch
reverts a portion of 20c4899a8eea4 such that we avoid using deferred
callbacks to free inactive rules.

The main motivation is performance: epoch_drain_callbacks() is quite
slow, especially on busy systems, and its use in the DIOCXBEGIN handler
causes long stalls in relayd when reloading configuration. I am working
on trying to make epoch_drain_callbacks() smarter, but here it's better
to simply do less work.

Sponsored by: Klara, Inc.
Sponsored by: Modirum MDPay

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable