 @@ -94,27 +94,27 @@
  *	performing their own lookup using different key.  Recursive call
  *	to npf_conn_inspect() is not allowed.  The ALGs ought to use the
  *	npf_conn_lookup() function for this purpose.
+ *
  * Lock order
+ *
  *	npf->config_lock ->
  *		conn_lock ->
  *			npf_conn_t::c_lock
  */
 #ifdef _KERNEL
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npf_conn.c,v 1.33 2021/01/25 17:18:55 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npf_conn.c,v 1.34 2022/02/13 19:20:23 riastradh Exp $");
 #include <sys/param.h>
 #include <sys/types.h>
 #include <netinet/in.h>
 #include <netinet/tcp.h>
 #include <sys/atomic.h>
 #include <sys/kmem.h>
 #include <sys/mutex.h>
 #include <net/pfil.h>
 #include <sys/pool.h>
 #include <sys/queue.h>
 @@ -211,28 +211,27 @@ npf_conn_load(npf_t *npf, npf_conndb_t *
 	npf_conndb_t *odb = NULL;
 	KASSERT(npf_config_locked_p(npf));
 	/*
 	 * The connection database is in the quiescent state.
 	 * Prevent G/C thread from running and install a new database.
 	 */
 	mutex_enter(&npf->conn_lock);
 	if (ndb) {
 		KASSERT(atomic_load_relaxed(&npf->conn_tracking)
 		    == CONN_TRACKING_OFF);
 		odb = atomic_load_relaxed(&npf->conn_db);
-		membar_sync();
+		atomic_store_release(&npf->conn_db, ndb);
 		atomic_store_relaxed(&npf->conn_db, ndb);
+	}
 	if (track) {
 		/* After this point lookups start flying in. */
 		membar_producer();
 		atomic_store_relaxed(&npf->conn_tracking, CONN_TRACKING_ON);
+	}
 	mutex_exit(&npf->conn_lock);
 	if (odb) {
 		/*
 		 * Flush all, no sync since the caller did it for us.
 		 * Also, release the pool cache memory.
 		 */
 @@ -482,27 +481,27 @@ npf_conn_establish(npf_cache_t *npc, con
 	/*
 	 * Set last activity time for a new connection and acquire
 	 * a reference for the caller before we make it visible.
 	 */
 	conn_update_atime(con);
 	atomic_store_relaxed(&con->c_refcnt, 1);
 	/*
 	 * Insert both keys (entries representing directions) of the
 	 * connection.  At this point it becomes visible, but we activate
 	 * the connection later.
 	 */
 	mutex_enter(&con->c_lock);
-	conn_db = atomic_load_relaxed(&npf->conn_db);
+	conn_db = atomic_load_consume(&npf->conn_db);
 	if (!npf_conndb_insert(conn_db, fw, con, NPF_FLOW_FORW)) {
 		error = EISCONN;
 		goto err;
+	}
 	if (!npf_conndb_insert(conn_db, bk, con, NPF_FLOW_BACK)) {
 		npf_conn_t *ret __diagused;
 		ret = npf_conndb_remove(conn_db, fw);
 		KASSERT(ret == con);
 		error = EISCONN;
 		goto err;
+	}
 err:
 	/*
 @@ -587,27 +586,27 @@ npf_conn_setnat(const npf_cache_t *npc,
 		mutex_exit(&con->c_lock);
 		return EINVAL;
+	}
 	KASSERT((flags & CONN_REMOVED) == 0);
 	if (__predict_false(con->c_nat != NULL)) {
 		/* Race with a duplicate packet. */
 		mutex_exit(&con->c_lock);
 		npf_stats_inc(npc->npc_ctx, NPF_STAT_RACE_NAT);
 		return EISCONN;
+	}
 	/* Remove the "backwards" key. */
-	conn_db = atomic_load_relaxed(&npf->conn_db);
+	conn_db = atomic_load_consume(&npf->conn_db);
 	bk = npf_conn_getbackkey(con, con->c_alen);
 	ret = npf_conndb_remove(conn_db, bk);
 	KASSERT(ret == con);
 	/* Set the source/destination IDs to the translation values. */
 	npf_conn_adjkey(bk, taddr, tport, nat_type_which[ntype]);
 	/* Finally, re-insert the "backwards" key. */
 	if (!npf_conndb_insert(conn_db, bk, con, NPF_FLOW_BACK)) {
 		/*
 		 * Race: we have hit the duplicate, remove the "forwards"
 		 * key and expire our connection; it is no longer valid.
 		 */
 @@ -752,27 +751,27 @@ npf_conn_remove(npf_conndb_t *cd, npf_co
+	}
 	/* Flag the removal and expiration. */
 	atomic_or_uint(&con->c_flags, CONN_REMOVED | CONN_EXPIRE);
 	mutex_exit(&con->c_lock);
+}
 /*
  * npf_conn_worker: G/C to run from a worker thread or via npfk_gc().
  */
 void
 npf_conn_worker(npf_t *npf)
+{
-	npf_conndb_t *conn_db = atomic_load_relaxed(&npf->conn_db);
+	npf_conndb_t *conn_db = atomic_load_consume(&npf->conn_db);
 	npf_conndb_gc(npf, conn_db, false, true);
+}
 /*
  * npf_conndb_export: construct a list of connections prepared for saving.
  * Note: this is expected to be an expensive operation.
  */
 int
 npf_conndb_export(npf_t *npf, nvlist_t *nvl)
+{
 	npf_conn_t *head, *con;
 	npf_conndb_t *conn_db;