We store the rule blob per (possible) cpu. Unfortunately this means we can waste lot of memory on big smp machines. ipt_entry structure ('rule head') is 112 byte, so e.g. with maxcpu=64 one single rule eats close to 8k RAM. Since previous patch made counters percpu it appears there is nothing left in the rule blob that needs to be percpu. On my test system (144 possible cpus, 400k dummy rules) this change saves close to 9 Gigabyte of RAM.
Showing the changes to include/linux/netfilter (1 of 5 files). Show all
Unified · Split
| @@ -224,9 +224,9 @@ struct xt_table_info { · 223 unmodified lines | ||
| 224 | 224 | unsigned int stacksize; |
| 225 | 225 | unsigned int __percpu *stackptr; |
| 226 | 226 | void ***jumpstack; |
| 227 | − /* ipt_entry tables: one per CPU */ | |
| 227 | + | |
| 228 | 228 | /* Note : this field MUST be the last one, see XT_TABLE_INFO_SZ */ |
| 229 | − void *entries[1]; | |
| 229 | + void *entries; | |
| 230 | 230 | }; |
| 231 | 231 | |
| 232 | 232 | #define XT_TABLE_INFO_SZ (offsetof(struct xt_table_info, entries) \ |