bpf, ipfw and before-and-after

[John Polstra]

In article <1566283957.1060103142 at melange.errno.com>,
Sam Leffler  <sam at errno.com> wrote:
> > In article <1564916751.1060101774 at melange.errno.com>,
> > Sam Leffler  <sam at errno.com> wrote:
> >> > My point is that the extra calls to bpf_mtap would harm performance
> >> > even when bpf wasn't being used.
> >>
> >> In -current I believe all the calls are prefixed with a check for
> >> ifp->if_bpf or similar.  So any slow down should only happen when BPF is
> >> active.
> >
> > That does not follow, because the check of ifp->if_bpf itself takes
> > time.  There is no way to avoid the performance penalty except at
> > compile time.  Yes, branch prediction helps, but it doesn't eliminate
> > the problem.  Even with gigabit ethernet those individual nanoseconds
> > add up quickly to the point where they matter.  With 10 Gb ethernet on
> > the way, it will only get worse.
> 
> You said there were calls to bpf_mtag and they would add noticeable 
> overhead even when BPF was not in use.  I said these are only made when BPF 
> is in use.  What doesn't follow?

What doesn't follow is, "So any slow down should only happen when
BPF is active."

John
-- 
  John Polstra
  John D. Polstra & Co., Inc.                        Seattle, Washington USA
  "Two buttocks cannot avoid friction."                     -- Malawi saying