Thanks for this; I will send a v2 in the next two days.
-Aaron
Florian Westphal writes:
> Aaron Conole wrote:
>> --- a/net/netfilter/core.c
>> +++ b/net/netfilter/core
> [..]
>> +#define nf_entry_dereference(e) \
>> +rcu_dereference_protected(e,
On Sat, Jul 09, 2016 at 01:30:38AM +0200, Florian Westphal wrote:
> Aaron Conole wrote:
> > --- a/net/netfilter/core.c
> > +++ b/net/netfilter/core
> [..]
> > +#define nf_entry_dereference(e) \
> > + rcu_dereference_protected(e, lockdep_is_held(_hook_mutex))
> >
> >
Aaron Conole wrote:
> --- a/net/netfilter/core.c
> +++ b/net/netfilter/core
[..]
> +#define nf_entry_dereference(e) \
> + rcu_dereference_protected(e, lockdep_is_held(_hook_mutex))
>
> -static struct list_head *nf_find_hook_list(struct net *net,
> -
The netfilter hook list never uses the prev pointer, and so can be
trimmed to be a smaller singly-linked list.
In addition to having a more light weight structure for hook traversal,
struct net becomes 5568 bytes (down from 6400) and struct net_device
becomes 2176 bytes (down from 2240).