Is pf (kernel module) SMP capable ?

wuffe

Hi,

Did some searching in this forum also tried google on this topic - found answers pointing in different directions.

Clearly the userspace parts of pfSense (GUI, daemons etc) will support SMP - but how about the kernel parts of pf ?

I found some olders notes indicating that pf is not very finegrained in its internal locking.

Could someone shed some light on this issue in respect to pfSense and FreeBSD releases ?

Thanks in advance.

kind regards Uffe

eri--

Since it runs on a SMP enabled kernel the answer is YES.
Since it can keep up to speed with its friends i wonder why this question is being done seems to me more provocative than towards knowledge. I say this cause questions like this come when you see problems and limitations on your tests but this seems purely speculative.

Just for completeness.
The locking that is present in the version of pf that pfSense is using totally makes sense and there is no analysis on showing that anything more fine grained will do better than this since it really hard to come up with a more fine grained locking schema that actually makes sense taking in cosideration how does packet processing on FreeBSD happens(hint: pfil(9)).

wuffe

@ermal:

Since it can keep up to speed with its friends

please explain "friends" - english is not my native language

i wonder why this question is being done seems to me more provocative than towards knowledge.

Well you are wrong - question is being done out of pure theoretical interest for the internal architecture of pf in respect to its surroundings (FreeBSD)

I say this cause questions like this come when you see problems and limitations on your tests but this seems purely speculative.

I'm not testing anything (if I did I'd written that in my initial post) it was a pure theoretical question.

The locking that is present in the version of pf that pfSense is using totally makes sense and there is no analysis on showing that anything more fine grained will do better than this since it really hard to come up with a more fine grained locking schema that actually makes sense taking in cosideration how does packet processing on FreeBSD happens(hint: pfil(9)).

http://pf4freebsd.love2party.net/pflock/

Thanks for your answer.

eri--

Yes but you are forgetting context.
This is a pfSense forum and that is a FreeBSD analisis for a version of FreeBSD which is still not marked stable yet.

Just FYI that analysis is done by my mentor on FreeBSD ;).

wuffe

@ermal:

Yes but you are forgetting context.
This is a pfSense forum and that is a FreeBSD analisis for a version of FreeBSD which is still not marked stable yet.

No - I did notice that the article it related to freebsd 8
And I was specificly asking the pfsense forum if the version of pf that pfsense include have any known bottlenecks or other global locking defects - your answer to this was: no it is perfect as it is. And frankly I do not doubt what you wrote. I can only conclude that freebsd 8 must be much more scalable (kernel wise) since there is need to change/optimize pf for freebsd 8.

scottnguyen

why speculate on something far down the road?

wuffe

@scottnguyen:

why speculate on something far down the road?

Is illegal to ask theoretical questions - just out of pure interest ?