This patch adds a blob layout per chain to represent the ruleset in the packet datapath. size (unsigned long) struct nft_rule_dp struct nft_expr ... struct nft_rule_dp struct nft_expr ... struct nft_rule_dp (is_last=1) The new structure nft_rule_dp represents the rule in a more compact way (smaller memory footprint) compared to the control-plane nft_rule structure. The ruleset blob is a read-only data structure. The first field contains the blob size, then the rules containing expressions. There is a trailing rule which is used by the tracing infrastructure which is equivalent to the NULL rule marker in the previous representation. The blob size field does not include the size of this trailing rule marker. The ruleset blob is generated from the commit path. This patch reuses the infrastructure available since 0cbc06b3faba ("netfilter: nf_tables: remove synchronize_rcu in commit phase") to build the array of rules per chain.
Showing the changes to include (1 of 4 files). Show all
Unified · Split
| @@ -974,6 +974,20 @@ static inline void nft_set_elem_update_expr(const struct nft_set_ext *ext, · 973 unmodified lines | |||
| 974 | 974 | ||
| 975 | #define NFT_CHAIN_POLICY_UNSET U8_MAX | 975 | #define NFT_CHAIN_POLICY_UNSET U8_MAX |
| 976 | 976 | ||
| 977 | struct nft_rule_dp { | ||
| 978 | u64 is_last:1, | ||
| 979 | dlen:12, | ||
| 980 | handle:42; /* for tracing */ | ||
| 981 | unsigned char data[] | ||
| 982 | __attribute__((aligned(__alignof__(struct nft_expr)))); | ||
| 983 | }; | ||
| 984 | |||
| 985 | struct nft_rule_blob { | ||
| 986 | unsigned long size; | ||
| 987 | unsigned char data[] | ||
| 988 | __attribute__((aligned(__alignof__(struct nft_rule_dp)))); | ||
| 989 | }; | ||
| 990 | |||
| 977 | /** | 991 | /** |
| 978 | * struct nft_chain - nf_tables chain | 992 | * struct nft_chain - nf_tables chain |
| 979 | * | 993 | * |
| @@ -987,8 +1001,8 @@ static inline void nft_set_elem_update_expr(const struct nft_set_ext *ext, · 7 unmodified lines | |||
| 987 | * @name: name of the chain | 1001 | * @name: name of the chain |
| 988 | */ | 1002 | */ |
| 989 | struct nft_chain { | 1003 | struct nft_chain { |
| 990 | struct nft_rule *__rcu *rules_gen_0; | 1004 | struct nft_rule_blob __rcu *blob_gen_0; |
| 991 | struct nft_rule *__rcu *rules_gen_1; | 1005 | struct nft_rule_blob __rcu *blob_gen_1; |
| 992 | struct list_head rules; | 1006 | struct list_head rules; |
| 993 | struct list_head list; | 1007 | struct list_head list; |
| 994 | struct rhlist_head rhlhead; | 1008 | struct rhlist_head rhlhead; |
| @@ -1003,7 +1017,7 @@ struct nft_chain { · 8 unmodified lines | |||
| 1003 | u8 *udata; | 1017 | u8 *udata; |
| 1004 | 1018 | ||
| 1005 | /* Only used during control plane commit phase: */ | 1019 | /* Only used during control plane commit phase: */ |
| 1006 | struct nft_rule **rules_next; | 1020 | struct nft_rule_blob *blob_next; |
| 1007 | }; | 1021 | }; |
| 1008 | 1022 | ||
| 1009 | int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain); | 1023 | int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain); |
| @@ -1321,7 +1335,7 @@ struct nft_traceinfo { · 311 unmodified lines | |||
| 1321 | const struct nft_pktinfo *pkt; | 1335 | const struct nft_pktinfo *pkt; |
| 1322 | const struct nft_base_chain *basechain; | 1336 | const struct nft_base_chain *basechain; |
| 1323 | const struct nft_chain *chain; | 1337 | const struct nft_chain *chain; |
| 1324 | const struct nft_rule *rule; | 1338 | const struct nft_rule_dp *rule; |
| 1325 | const struct nft_verdict *verdict; | 1339 | const struct nft_verdict *verdict; |
| 1326 | enum nft_trace_types type; | 1340 | enum nft_trace_types type; |
| 1327 | bool packet_dumped; | 1341 | bool packet_dumped; |