From nobody Thu Feb 6 16:27:36 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YpjF466lcz5mh5b; Thu, 06 Feb 2025 16:27:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YpjF43qT5z4My8; Thu, 06 Feb 2025 16:27:36 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1738859256; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=k8M/GumOO2jICR1QPthn6lKcp1qSCltUo2sDS0jp2lk=; b=q13iSka49Q/XNhW41rq9pI+MvupgK04SKrff3oQajN36utE7sv3XNrOuQsb09nX8b+4WwF nxjufq5X9KLU1Rl2atMD0ee8ZlKusRcXHSvgxmEdbMzgO7oZuh2bQqjiJqs1q3zpG9raJk eOlBcfdxShq0AxGERtwzDidt6b2kWYf6l7SDI8/9bpNshHs4KbO4+d5eq92Jb6D8pn6bFZ R1m++ejs48TjTL2lLn19TIfSHhmm8LXdTPFEvkl9QfkFtUmEqv0pzLEIjWbzzk73JRTjFW SzmB3gSxdPVXcs5du0cw9qXDD1okas8z6CmTSMDFdPTf8O8hZTTX1lstauipRw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1738859256; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=k8M/GumOO2jICR1QPthn6lKcp1qSCltUo2sDS0jp2lk=; b=ysNsi5HWgiZX+b0zfNYSyHQdD/q8j/Mbw5hNlYQw+KN8863lTSZKX0k58Oj/DILqbfvnAL ztRylBBoh3qyJOO/cR06Mcst+lBCoMENMsvQ0ZVZsrZK6RwzGKyq28s2KSXiJrRVD5B6PC 26qJ7dqceb2e2/v1M4zguCVCxuw9nzL74VK5jbFO74BbveQt91EYFgCQzaTjCI9dWEQ4eV HpOPjttEc3nO7Ynap8Y3+CdmQzwESkJHnyw5yf71hi2R0YdSktEgdn+CrRA4s+7yOPnxJx mhfdL9u7VeANFKfu4Lha6fl8nl0t/2brkZyei9A5uLYHCBq4IbLgeaeZ6mGirQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1738859256; a=rsa-sha256; cv=none; b=V9jcMEi60Ka4RwfSustqnF4XbOmHmFLMJs6r+ZQirH/IWeu6qgsaUvqskCFTkHSNkSJnYk q1OIF0GHqhCLa4b1/fSN3oJafAxalVxt8n1WtmBBe66EkDcQYrEQ8q4jMLXHLS+qDky9PW YN80zYitSQJlYVuFrKTNPLmWSJ2n9wIjNpQehFj+Mmdr88+6NZ2iBc3XJLODUtSc8n7qO3 mBv2K5D4G98zbD97rgA11jQF1VMBVLt4mAag7X0Wg83Ph+tZChJ+Occm/BgSk7iunDYeh9 OGHRNF0t5e7GvWYYU5KeIdw1ubBBrBZI+PGnMYgx+1JUDsvuoWVWWKcFsUDj9Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YpjF43R1Jzm2s; Thu, 06 Feb 2025 16:27:36 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 516GRa8B095485; Thu, 6 Feb 2025 16:27:36 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 516GRanu095482; Thu, 6 Feb 2025 16:27:36 GMT (envelope-from git) Date: Thu, 6 Feb 2025 16:27:36 GMT Message-Id: <202502061627.516GRanu095482@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 7a66b3008693 - main - pf: Stop using net_epoch to synchronize access to eth rules List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 7a66b3008693ce61957e8b2a3d99829063e1e4af Auto-Submitted: auto-generated The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=7a66b3008693ce61957e8b2a3d99829063e1e4af commit 7a66b3008693ce61957e8b2a3d99829063e1e4af Author: Mark Johnston AuthorDate: 2025-02-06 14:36:20 +0000 Commit: Mark Johnston CommitDate: 2025-02-06 16:25:42 +0000 pf: Stop using net_epoch to synchronize access to eth rules Commit 20c4899a8eea4 modified pf_test_eth_rule() to not acquire the rules read lock, so pf_commit_eth() was changed to wait until the now-inactive rules are no longer in use before freeing them. In particular, it uses the net_epoch to schedule callbacks once the inactive rules are no longer visible to packet processing threads. However, since commit 812839e5aaaf4, pf_test_eth_rule() acquires the rules read lock, so this deferred action is unneeded. This patch reverts a portion of 20c4899a8eea4 such that we avoid using deferred callbacks to free inactive rules. The main motivation is performance: epoch_drain_callbacks() is quite slow, especially on busy systems, and its use in the DIOCXBEGIN handler in particular causes long stalls in relayd when reloading configuration. Reviewed by: kp MFC after: 2 weeks Sponsored by: Klara, Inc. Sponsored by: Modirum MDPay Differential Revision: https://reviews.freebsd.org/D48822 --- sys/net/pfvar.h | 1 - sys/netpfil/pf/pf.c | 9 +++------ sys/netpfil/pf/pf_ioctl.c | 32 +++----------------------------- 3 files changed, 6 insertions(+), 36 deletions(-) diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h index 3e2f17520b91..5ef7957f4fa0 100644 --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -687,7 +687,6 @@ struct pf_keth_ruleset { int open; uint32_t ticket; } active, inactive; - struct epoch_context epoch_ctx; struct vnet *vnet; struct pf_keth_anchor *anchor; }; diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 1cfd1a11db53..4d8a0f2aba31 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -5186,11 +5186,6 @@ pf_test_eth_rule(int dir, struct pfi_kkif *kif, struct mbuf **m0) return (PF_PASS); } - ruleset = V_pf_keth; - rules = ck_pr_load_ptr(&ruleset->active.rules); - r = TAILQ_FIRST(rules); - rm = NULL; - if (__predict_false(m->m_len < sizeof(struct ether_header)) && (m = *m0 = m_pullup(*m0, sizeof(struct ether_header))) == NULL) { DPFPRINTF(PF_DEBUG_URGENT, @@ -5234,7 +5229,9 @@ pf_test_eth_rule(int dir, struct pfi_kkif *kif, struct mbuf **m0) PF_RULES_RLOCK(); - while (r != NULL) { + ruleset = V_pf_keth; + rules = atomic_load_ptr(&ruleset->active.rules); + for (r = TAILQ_FIRST(rules), rm = NULL; r != NULL;) { counter_u64_add(r->evaluations, 1); SDT_PROBE2(pf, eth, test_rule, test, r->nr, r); diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index a45db33f38dc..b8e9a078baf2 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -107,7 +107,6 @@ static void pf_empty_kpool(struct pf_kpalist *); static int pfioctl(struct cdev *, u_long, caddr_t, int, struct thread *); static int pf_begin_eth(uint32_t *, const char *); -static void pf_rollback_eth_cb(struct epoch_context *); static int pf_rollback_eth(uint32_t, const char *); static int pf_commit_eth(uint32_t, const char *); static void pf_free_eth_rule(struct pf_keth_rule *); @@ -794,23 +793,6 @@ pf_begin_eth(uint32_t *ticket, const char *anchor) return (0); } -static void -pf_rollback_eth_cb(struct epoch_context *ctx) -{ - struct pf_keth_ruleset *rs; - - rs = __containerof(ctx, struct pf_keth_ruleset, epoch_ctx); - - CURVNET_SET(rs->vnet); - - PF_RULES_WLOCK(); - pf_rollback_eth(rs->inactive.ticket, - rs->anchor ? rs->anchor->path : ""); - PF_RULES_WUNLOCK(); - - CURVNET_RESTORE(); -} - static int pf_rollback_eth(uint32_t ticket, const char *anchor) { @@ -904,15 +886,12 @@ pf_commit_eth(uint32_t ticket, const char *anchor) pf_eth_calc_skip_steps(rs->inactive.rules); rules = rs->active.rules; - ck_pr_store_ptr(&rs->active.rules, rs->inactive.rules); + atomic_store_ptr(&rs->active.rules, rs->inactive.rules); rs->inactive.rules = rules; rs->inactive.ticket = rs->active.ticket; - /* Clean up inactive rules (i.e. previously active rules), only when - * we're sure they're no longer used. */ - NET_EPOCH_CALL(pf_rollback_eth_cb, &rs->epoch_ctx); - - return (0); + return (pf_rollback_eth(rs->inactive.ticket, + rs->anchor ? rs->anchor->path : "")); } #ifdef ALTQ @@ -5179,8 +5158,6 @@ DIOCCHANGEADDR_error: free(ioes, M_TEMP); break; } - /* Ensure there's no more ethernet rules to clean up. */ - NET_EPOCH_DRAIN_CALLBACKS(); PF_RULES_WLOCK(); for (i = 0, ioe = ioes; i < io->size; i++, ioe++) { ioe->anchor[sizeof(ioe->anchor) - 1] = '\0'; @@ -6805,9 +6782,6 @@ pf_unload_vnet(void) shutdown_pf(); PF_RULES_WUNLOCK(); - /* Make sure we've cleaned up ethernet rules before we continue. */ - NET_EPOCH_DRAIN_CALLBACKS(); - ret = swi_remove(V_pf_swi_cookie); MPASS(ret == 0); ret = intr_event_destroy(V_pf_swi_ie);