Differential D31111

pf: bound DIOCGETSTATESV2 memory use
ClosedPublic
Actions

Authored by kp on Jul 8 2021, 4:27 PM.

Tags

None

Referenced Files

	F157117207: D31111.id91979.diff
	Mon, May 18, 1:47 PM

	Unknown Object (File)
	Sun, May 17, 5:53 PM

	Unknown Object (File)
	Sun, May 17, 5:22 PM

	Unknown Object (File)
	Sat, May 16, 1:10 AM

	Unknown Object (File)
	Sat, May 16, 1:10 AM

	Unknown Object (File)
	Sat, May 16, 1:10 AM

	Unknown Object (File)
	Fri, May 15, 12:26 PM

	Unknown Object (File)
	Mon, Apr 27, 3:46 PM

Subscribers

Details

Reviewers

Group Reviewers

network
pfsense

Commits

rG4feb5667f59d: pf: bound DIOCGETSTATESV2 memory use
rG569798e0824a: pf: bound DIOCGETSTATESV2 memory use
rG3fc12ae04204: pf: bound DIOCGETSTATESV2 memory use

Summary

Rather than allocating however much memory userspace asks for we only
allocate enough for a handful of states, and copy to userspace for each
completed row.
We start out with enough space for 16 states (per row), but grow that as
required. In most configurations we expect at most a handful of states
per row (more than that would have other negative effects on packet
processing performance).

MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository

rS FreeBSD src repository - subversion

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 40395
Build 37284: arc lint + arc unit

Event Timeline

kp created this revision.Jul 8 2021, 4:27 PM

Herald added subscribers: melifaro, farrokhi, imp. · View Herald TranscriptJul 8 2021, 4:27 PM

kp requested review of this revision.Jul 8 2021, 4:27 PM

Harbormaster completed remote builds in B40395: Diff 91979.Jul 8 2021, 4:27 PM

The previous DIOCGETSTATES call should get the same treatment.

This is a little simplistic as it could load up more and be faster for it, but it is a step forward.

This revision is now accepted and ready to land.Jul 8 2021, 6:46 PM

In D31111#699939, @mjg wrote:

This is a little simplistic as it could load up more and be faster for it, but it is a step forward.

We're at about 3 seconds for a million states with this version, so I'd prefer to keep it as simple as possible.

Closed by commit rG3fc12ae04204: pf: bound DIOCGETSTATESV2 memory use (authored by kp). · Explain WhyJul 9 2021, 9:17 AM

This revision was automatically updated to reflect the committed changes.

kp added a commit: rG3fc12ae04204: pf: bound DIOCGETSTATESV2 memory use.

kp added a commit: rG569798e0824a: pf: bound DIOCGETSTATESV2 memory use.Jul 16 2021, 11:55 AM

kp added a commit: rG4feb5667f59d: pf: bound DIOCGETSTATESV2 memory use.

Revision Contents
Changeset List

Path

Size

sys/

netpfil/

pf/

48 lines

Diff 91979

sys/netpfil/pf/pf_ioctl.c

Loading...