From patchwork Wed Apr 3 08:41:01 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 1919134 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=147.75.199.223; helo=ny.mirrors.kernel.org; envelope-from=netfilter-devel+bounces-1589-incoming=patchwork.ozlabs.org@vger.kernel.org; receiver=patchwork.ozlabs.org) Received: from ny.mirrors.kernel.org (ny.mirrors.kernel.org [147.75.199.223]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4V8dY10dZhz23v3 for ; Wed, 3 Apr 2024 19:42:29 +1100 (AEDT) Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ny.mirrors.kernel.org (Postfix) with ESMTPS id 39F8A1C216DF for ; Wed, 3 Apr 2024 08:42:27 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 8A0466D1B2; Wed, 3 Apr 2024 08:42:24 +0000 (UTC) X-Original-To: netfilter-devel@vger.kernel.org Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [91.216.245.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 77F3F56471 for ; Wed, 3 Apr 2024 08:42:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.216.245.30 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133744; cv=none; b=dqlHZ0nDyWTAJyl38cO7UrvKyNPWaRaA4vNhcKtXnuo2bmVHwNRhzozz6wcZJ1zGOsQ5Q5GwjeEXO9wFBWv86AuTQWFmKgkmHdAw0pcnUDfOSanwdEsyci8nudMO2a0nrvOxeOifFWYj7iMlJivJyK9s0WiUMuxPdqLC56ngcSA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133744; c=relaxed/simple; bh=UGYmTDlyQ0rn6p2xVf8UQutbArjRCWWeL6+2wkcV0Pw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PExGST5VTj6oDmz1tk8JMtOmOGIvhVTm6+dggAoc1ebrMHIKSEfitLW5qYzc7sLLaaiHnszrTpnOxRJ7kCBikYuO4dddlNs+vuzB9MDOq7zKmCnmHQs3bjheP8fAZlYI6Epz0zLI2CvNw9ywx4xJJqK2l/N5E3avyFmkF51WmmA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de; spf=pass smtp.mailfrom=breakpoint.cc; arc=none smtp.client-ip=91.216.245.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=breakpoint.cc Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1rrwCK-0005wg-Uu; Wed, 03 Apr 2024 10:42:20 +0200 From: Florian Westphal To: Cc: sbrivio@redhat.com, Florian Westphal Subject: [PATCH nf-next 1/9] netfilter: nft_set_pipapo: move prove_locking helper around Date: Wed, 3 Apr 2024 10:41:01 +0200 Message-ID: <20240403084113.18823-2-fw@strlen.de> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240403084113.18823-1-fw@strlen.de> References: <20240403084113.18823-1-fw@strlen.de> Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Preparation patch, the helper will soon get called from insert function too. Signed-off-by: Florian Westphal --- net/netfilter/nft_set_pipapo.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index df8de5090246..a05e5d62a78e 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1247,6 +1247,17 @@ static int pipapo_realloc_scratch(struct nft_pipapo_match *clone, return 0; } +static bool nft_pipapo_transaction_mutex_held(const struct nft_set *set) +{ +#ifdef CONFIG_PROVE_LOCKING + const struct net *net = read_pnet(&set->net); + + return lockdep_is_held(&nft_pernet(net)->commit_mutex); +#else + return true; +#endif +} + /** * nft_pipapo_insert() - Validate and insert ranged elements * @net: Network namespace @@ -1799,17 +1810,6 @@ static void nft_pipapo_commit(struct nft_set *set) priv->clone = new_clone; } -static bool nft_pipapo_transaction_mutex_held(const struct nft_set *set) -{ -#ifdef CONFIG_PROVE_LOCKING - const struct net *net = read_pnet(&set->net); - - return lockdep_is_held(&nft_pernet(net)->commit_mutex); -#else - return true; -#endif -} - static void nft_pipapo_abort(const struct nft_set *set) { struct nft_pipapo *priv = nft_set_priv(set); From patchwork Wed Apr 3 08:41:02 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 1919146 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2604:1380:40f1:3f00::1; helo=sy.mirrors.kernel.org; envelope-from=netfilter-devel+bounces-1590-incoming=patchwork.ozlabs.org@vger.kernel.org; receiver=patchwork.ozlabs.org) Received: from sy.mirrors.kernel.org (sy.mirrors.kernel.org [IPv6:2604:1380:40f1:3f00::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4V8dpW2Y4sz23tf for ; Wed, 3 Apr 2024 19:54:11 +1100 (AEDT) Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sy.mirrors.kernel.org (Postfix) with ESMTPS id 350DDB25603 for ; Wed, 3 Apr 2024 08:42:34 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id F22DC6D1AF; Wed, 3 Apr 2024 08:42:28 +0000 (UTC) X-Original-To: netfilter-devel@vger.kernel.org Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [91.216.245.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AFBEA56471 for ; Wed, 3 Apr 2024 08:42:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.216.245.30 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133748; cv=none; b=C8wbrTdcDgci2epLpw3IWjAMVtZC2wz5/Tth8YMzk3wb9WoNhkkBh8Tj1LKfdlprkf3txny3iBLByyl1ZthXCLFH9Uv1Qmkqk21oJgxvpsTTVZpP/vVNM5EAb/tDncgDevlSVn5L0weX3HUlwCT3TOVVyW6SCWPRIlO6kQXcyx0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133748; c=relaxed/simple; bh=EY+MUjdZX3tgnmyjbOooOf8nQmcDfqRZVDm4d8O7++Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=t9cdAib1SrZ6qM6eL7OwqQtGkEfVe0BAOV8IYbqs9Mw4XLNSu3e0X7qMBxckfssCcMRNYpIzDNL6PY5UlnLc+tPKDlzR0mzkWkkrICeBXG7vj2kBqzlFV9HGSQQsgy78B+oM84VGWWbyLdxc1NnR+hbia3PcRT4yp4722zJ7d8g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de; spf=pass smtp.mailfrom=breakpoint.cc; arc=none smtp.client-ip=91.216.245.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=breakpoint.cc Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1rrwCP-0005wz-8W; Wed, 03 Apr 2024 10:42:25 +0200 From: Florian Westphal To: Cc: sbrivio@redhat.com, Florian Westphal Subject: [PATCH nf-next 2/9] netfilter: nft_set_pipapo: make pipapo_clone helper return NULL Date: Wed, 3 Apr 2024 10:41:02 +0200 Message-ID: <20240403084113.18823-3-fw@strlen.de> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240403084113.18823-1-fw@strlen.de> References: <20240403084113.18823-1-fw@strlen.de> Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Currently it returns an error pointer, but the only possible failure is ENOMEM. After a followup patch, we'd need to discard the errno code, i.e. x = pipapo_clone() if (IS_ERR(x)) return NULL or make more changes to fix up callers to expect IS_ERR() code from set->ops->deactivate(). So simplify this and make it return ptr-or-null. Signed-off-by: Florian Westphal --- net/netfilter/nft_set_pipapo.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index a05e5d62a78e..48d5600f8836 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1395,7 +1395,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, * pipapo_clone() - Clone matching data to create new working copy * @old: Existing matching data * - * Return: copy of matching data passed as 'old', error pointer on failure + * Return: copy of matching data passed as 'old' or NULL. */ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) { @@ -1405,7 +1405,7 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) new = kmalloc(struct_size(new, f, old->field_count), GFP_KERNEL); if (!new) - return ERR_PTR(-ENOMEM); + return NULL; new->field_count = old->field_count; new->bsize_max = old->bsize_max; @@ -1477,7 +1477,7 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) free_percpu(new->scratch); kfree(new); - return ERR_PTR(-ENOMEM); + return NULL; } /** @@ -1797,7 +1797,7 @@ static void nft_pipapo_commit(struct nft_set *set) return; new_clone = pipapo_clone(priv->clone); - if (IS_ERR(new_clone)) + if (!new_clone) return; priv->dirty = false; @@ -1821,7 +1821,7 @@ static void nft_pipapo_abort(const struct nft_set *set) m = rcu_dereference_protected(priv->match, nft_pipapo_transaction_mutex_held(set)); new_clone = pipapo_clone(m); - if (IS_ERR(new_clone)) + if (!new_clone) return; priv->dirty = false; @@ -2266,8 +2266,8 @@ static int nft_pipapo_init(const struct nft_set *set, /* Create an initial clone of matching data for next insertion */ priv->clone = pipapo_clone(m); - if (IS_ERR(priv->clone)) { - err = PTR_ERR(priv->clone); + if (!priv->clone) { + err = -ENOMEM; goto out_free; } From patchwork Wed Apr 3 08:41:03 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 1919142 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=147.75.48.161; helo=sy.mirrors.kernel.org; envelope-from=netfilter-devel+bounces-1591-incoming=patchwork.ozlabs.org@vger.kernel.org; receiver=patchwork.ozlabs.org) Received: from sy.mirrors.kernel.org (sy.mirrors.kernel.org [147.75.48.161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4V8dg26JJ9z23tl for ; Wed, 3 Apr 2024 19:47:42 +1100 (AEDT) Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sy.mirrors.kernel.org (Postfix) with ESMTPS id 749E4B24F75 for ; Wed, 3 Apr 2024 08:42:48 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id BC8CE6EB79; Wed, 3 Apr 2024 08:42:32 +0000 (UTC) X-Original-To: netfilter-devel@vger.kernel.org Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [91.216.245.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 01EA36EB44 for ; Wed, 3 Apr 2024 08:42:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.216.245.30 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133752; cv=none; b=U1DvOOAOgy3FcuWhHVrKtZpdoIq9QbulanK2TTHEva0MacdFjGBXOMfKfqI+Qng5RpbcwK/AY4W0sFuyJUkfFJuA2RKo+fCUySp+ZkyQ4krUSaZi1gzC7NwBPkqRxJ8TqhMGZAEZxU1SzKqDAeMUTsx62qLWd86bKlXuvQuVjGo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133752; c=relaxed/simple; bh=VUwO9bzXm2JGtAjgFtJ/avSAYswyWnj90MWFDBbkkpA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ky8JMybDliUlsaZ0C9J9K8Iz+IPYeuYgLfheFeT5ZnxObDTJAqVxFoZBjglPujE84+MEXDnLHHPmn38LaSyVyq3yu1pfjoyCrlT+Iu8VcRGleaY4C5W7Soh3/R8Pi00HpUc9FJYBgRi5JeDRLrltp0ZOxjvEsHjiKyouCyAeRUA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de; spf=pass smtp.mailfrom=breakpoint.cc; arc=none smtp.client-ip=91.216.245.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=breakpoint.cc Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1rrwCT-0005xT-Hq; Wed, 03 Apr 2024 10:42:29 +0200 From: Florian Westphal To: Cc: sbrivio@redhat.com, Florian Westphal Subject: [PATCH nf-next 3/9] netfilter: nft_set_pipapo: prepare destroy function for on-demand clone Date: Wed, 3 Apr 2024 10:41:03 +0200 Message-ID: <20240403084113.18823-4-fw@strlen.de> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240403084113.18823-1-fw@strlen.de> References: <20240403084113.18823-1-fw@strlen.de> Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Once priv->clone can be NULL in case no insertions/removals occurred in the last transaction we need to drop set elements from priv->match if priv->clone is NULL. While at it, condense this function by reusing the pipapo_free_match helper instead of open-coded version. The rcu_barrier() is removed, its not needed: old call_rcu instances for pipapo_reclaim_match do not access struct nft_set. Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio --- net/netfilter/nft_set_pipapo.c | 27 ++++++--------------------- 1 file changed, 6 insertions(+), 21 deletions(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 48d5600f8836..d2ac2d5560e4 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -2323,33 +2323,18 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx, { struct nft_pipapo *priv = nft_set_priv(set); struct nft_pipapo_match *m; - int cpu; m = rcu_dereference_protected(priv->match, true); - if (m) { - rcu_barrier(); - - for_each_possible_cpu(cpu) - pipapo_free_scratch(m, cpu); - free_percpu(m->scratch); - pipapo_free_fields(m); - kfree(m); - priv->match = NULL; - } if (priv->clone) { - m = priv->clone; - - nft_set_pipapo_match_destroy(ctx, set, m); - - for_each_possible_cpu(cpu) - pipapo_free_scratch(priv->clone, cpu); - free_percpu(priv->clone->scratch); - - pipapo_free_fields(priv->clone); - kfree(priv->clone); + nft_set_pipapo_match_destroy(ctx, set, priv->clone); + pipapo_free_match(priv->clone); priv->clone = NULL; + } else { + nft_set_pipapo_match_destroy(ctx, set, m); } + + pipapo_free_match(m); } /** From patchwork Wed Apr 3 08:41:04 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 1919135 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=147.75.80.249; helo=am.mirrors.kernel.org; envelope-from=netfilter-devel+bounces-1592-incoming=patchwork.ozlabs.org@vger.kernel.org; receiver=patchwork.ozlabs.org) Received: from am.mirrors.kernel.org (am.mirrors.kernel.org [147.75.80.249]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4V8dYS5QwSz23tv for ; Wed, 3 Apr 2024 19:42:52 +1100 (AEDT) Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by am.mirrors.kernel.org (Postfix) with ESMTPS id 2247F1F28FA8 for ; Wed, 3 Apr 2024 08:42:50 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 326E26D1AF; Wed, 3 Apr 2024 08:42:37 +0000 (UTC) X-Original-To: netfilter-devel@vger.kernel.org Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [91.216.245.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 502B16CDDB for ; Wed, 3 Apr 2024 08:42:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.216.245.30 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133756; cv=none; b=CHuH3UshccxBfNFL917Nm6jwEpaCi63r5XEdZlJ1UU0s2lZLpiT7dddPYA60exJg2yjFHk+QiebjWMKNkXPlhkxkpdv/lQmyU555fcDdfdHMyqETBoGYr9ZQ1Tad0cl0cziiP+p8Hi9/pLjy+0iYNC2CbtyhG+4N7zNxW8YclV4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133756; c=relaxed/simple; bh=V7YmFkoPqtDzqXba5zz9g6jJQrUMM/Y3xt6qs3IMlls=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YscUEjicsCGSrLR8wGxllUru150VoBXL09yZvAxFjdDSXtIg/atCFXQSOMMdS9PFo1NsDhSJs2JAc34o9cTVPDnXvduhRJ93Wx9I8o1xsR86SejvxIaMdGXqlL5Xv0aSaKTaAaoprz5Yd9mcWaWs+pO/JsEIVubUmzHLedUjenA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de; spf=pass smtp.mailfrom=breakpoint.cc; arc=none smtp.client-ip=91.216.245.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=breakpoint.cc Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1rrwCX-0005xs-RL; Wed, 03 Apr 2024 10:42:33 +0200 From: Florian Westphal To: Cc: sbrivio@redhat.com, Florian Westphal Subject: [PATCH nf-next 4/9] netfilter: nft_set_pipapo: prepare walk function for on-demand clone Date: Wed, 3 Apr 2024 10:41:04 +0200 Message-ID: <20240403084113.18823-5-fw@strlen.de> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240403084113.18823-1-fw@strlen.de> References: <20240403084113.18823-1-fw@strlen.de> Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Right now, without pending updates, priv->clone and priv->match will point to different memory locations, but they have identical content. Future patch will make priv->clone == NULL if there are no pending changes. We cannot just fallback to the live data in this case because there are different types of walks: - set dump: this can fallback to the live copy. - flush walk: all set elements should be deactivated. If no single element was removed before, then we must first make a copy of the live data. - deactivate/activate walks during abort or commit. This would always have a non-null clone. The existing test is unreliable, if genmask is not equal to current one, we can't infer that the transaction mutex is held, we could be in a (lockless) dump. Its only safe at this time because both commit and abort paths will re-clone the live copy, so ->clone is always non-null -- something that is about to change. Next patch will add explicit iter type to tell when flushing is requested (i.e., when live data must be copied first). Signed-off-by: Florian Westphal --- net/netfilter/nft_set_pipapo.c | 54 +++++++++++++++++++++++----------- 1 file changed, 37 insertions(+), 17 deletions(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index d2ac2d5560e4..57b1508d3502 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -2102,33 +2102,23 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set, } /** - * nft_pipapo_walk() - Walk over elements + * __nft_pipapo_walk() - Walk over elements in m * @ctx: nftables API context * @set: nftables API set representation + * @m: matching data pointing to key mapping array * @iter: Iterator * * As elements are referenced in the mapping array for the last field, directly * scan that array: there's no need to follow rule mappings from the first * field. */ -static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, - struct nft_set_iter *iter) +static void __nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, + const struct nft_pipapo_match *m, + struct nft_set_iter *iter) { - struct nft_pipapo *priv = nft_set_priv(set); - struct net *net = read_pnet(&set->net); - const struct nft_pipapo_match *m; const struct nft_pipapo_field *f; unsigned int i, r; - rcu_read_lock(); - if (iter->genmask == nft_genmask_cur(net)) - m = rcu_dereference(priv->match); - else - m = priv->clone; - - if (unlikely(!m)) - goto out; - for (i = 0, f = m->f; i < m->field_count - 1; i++, f++) ; @@ -2148,13 +2138,43 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, iter->err = iter->fn(ctx, set, iter, &e->priv); if (iter->err < 0) - goto out; + return; cont: iter->count++; } +} + +/** + * nft_pipapo_walk() - Walk over elements + * @ctx: nftables API context + * @set: nftables API set representation + * @iter: Iterator + * + * Test if destructive action is needed or not, clone active backend if needed + * and call the real function to work on the data. + */ +static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, + struct nft_set_iter *iter) +{ + struct nft_pipapo *priv = nft_set_priv(set); + struct net *net = read_pnet(&set->net); + const struct nft_pipapo_match *m; + + rcu_read_lock(); + if (iter->genmask == nft_genmask_cur(net)) { + m = rcu_dereference(priv->match); + } else { + m = priv->clone; + if (!m) /* no pending updates */ + m = rcu_dereference(priv->match); + } + + if (m) + __nft_pipapo_walk(ctx, set, m, iter); + else + WARN_ON_ONCE(1); -out: rcu_read_unlock(); } From patchwork Wed Apr 3 08:41:05 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 1919137 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2604:1380:4601:e00::3; helo=am.mirrors.kernel.org; envelope-from=netfilter-devel+bounces-1593-incoming=patchwork.ozlabs.org@vger.kernel.org; receiver=patchwork.ozlabs.org) Received: from am.mirrors.kernel.org (am.mirrors.kernel.org [IPv6:2604:1380:4601:e00::3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4V8dYV3wYfz23tv for ; Wed, 3 Apr 2024 19:42:54 +1100 (AEDT) Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by am.mirrors.kernel.org (Postfix) with ESMTPS id DB1D41F2900C for ; Wed, 3 Apr 2024 08:42:51 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 4222B6DCE8; Wed, 3 Apr 2024 08:42:41 +0000 (UTC) X-Original-To: netfilter-devel@vger.kernel.org Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [91.216.245.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 53D9C6CDDB for ; Wed, 3 Apr 2024 08:42:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.216.245.30 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133761; cv=none; b=PU5sM8+o+nNGpbdwXlzJUVW5nyZaLEEv8y6SttwwtVTGYxn/yfP3yG1iQ6Jt5YAXI56mS6a4nOz8EstT8X5qqxUOmrnaGd05bRskJl602JX5HJBBmi04CYX8k65V5wHJdLYVw2GwHwaf2Wxx8neUFqD9fRwzXSY1sEyxLHs57lw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133761; c=relaxed/simple; bh=i1DSRNRAHRHJ97A86xhf72bNNzPysyMPqCTDTxPsFIQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=m7ZGDvekhyZ1zEkASAVbelEzzAVIhTNxT/n8LzMpjwn8VwkLCnfVeci/ymouduH8h0qonbzhPCYHTidv5kzuICsCeLCsk3xl668MdZ4WGvphvQzh6uPfvHBQV9JyAh4yqxgPM64l7aINw18J4qehFbszFIH+tvgh1ycRZ0hXxG8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de; spf=pass smtp.mailfrom=breakpoint.cc; arc=none smtp.client-ip=91.216.245.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=breakpoint.cc Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1rrwCc-0005yI-47; Wed, 03 Apr 2024 10:42:38 +0200 From: Florian Westphal To: Cc: sbrivio@redhat.com, Florian Westphal Subject: [PATCH nf-next 5/9] netfilter: nf_tables: pass new nft_iter_type hint to walker Date: Wed, 3 Apr 2024 10:41:05 +0200 Message-ID: <20240403084113.18823-6-fw@strlen.de> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240403084113.18823-1-fw@strlen.de> References: <20240403084113.18823-1-fw@strlen.de> Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 This will be needed by the 'pipapo' set backend. If this is set, then it needs to perform copy-on-write of the active set data storage. Its not possible to use genmask test, the walker function is also used by (rcu locked) set listing which can run in parallel to set updates. If priv->clone is null, then fallback to the active data storeage is safe EXCEPT for the flush case, which must do the copy. Signed-off-by: Florian Westphal --- include/net/netfilter/nf_tables.h | 12 +++++++++++ net/netfilter/nf_tables_api.c | 1 + net/netfilter/nft_set_pipapo.c | 35 +++++++++++++++++++++---------- 3 files changed, 37 insertions(+), 11 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index e27c28b612e4..9912a2621344 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -307,9 +307,21 @@ static inline void *nft_elem_priv_cast(const struct nft_elem_priv *priv) return (void *)priv; } + +/** + * enum nft_iter_type - nftables set iterator type + * + * @NFT_ITER_FLUSH: destructive iteration, transaction mutex must be held + */ +enum nft_iter_type { + /* undef == 0 */ + NFT_ITER_FLUSH = 1, +}; + struct nft_set; struct nft_set_iter { u8 genmask; + enum nft_iter_type type:8; unsigned int count; unsigned int skip; int err; diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index fd86f2720c9e..facd33e97dfe 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -7369,6 +7369,7 @@ static int nft_set_flush(struct nft_ctx *ctx, struct nft_set *set, u8 genmask) struct nft_set_iter iter = { .genmask = genmask, .fn = nft_setelem_flush, + .type = NFT_ITER_FLUSH, }; set->ops->walk(ctx, set, &iter); diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 57b1508d3502..eca81c5e5810 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -2161,21 +2161,34 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, struct net *net = read_pnet(&set->net); const struct nft_pipapo_match *m; - rcu_read_lock(); - if (iter->genmask == nft_genmask_cur(net)) { - m = rcu_dereference(priv->match); - } else { + switch (iter->type) { + case NFT_ITER_FLUSH: m = priv->clone; - if (!m) /* no pending updates */ - m = rcu_dereference(priv->match); - } + if (!m) { + iter->err = -ENOMEM; + return; + } - if (m) __nft_pipapo_walk(ctx, set, m, iter); - else - WARN_ON_ONCE(1); + break; + default: + rcu_read_lock(); + if (iter->genmask == nft_genmask_cur(net)) { + m = rcu_dereference(priv->match); + } else { + m = priv->clone; + if (!m) /* no pending updates */ + m = rcu_dereference(priv->match); + } - rcu_read_unlock(); + if (m) + __nft_pipapo_walk(ctx, set, m, iter); + else + WARN_ON_ONCE(1); + + rcu_read_unlock(); + break; + } } /** From patchwork Wed Apr 3 08:41:06 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 1919136 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2604:1380:45d1:ec00::1; helo=ny.mirrors.kernel.org; envelope-from=netfilter-devel+bounces-1594-incoming=patchwork.ozlabs.org@vger.kernel.org; receiver=patchwork.ozlabs.org) Received: from ny.mirrors.kernel.org (ny.mirrors.kernel.org [IPv6:2604:1380:45d1:ec00::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4V8dYV4DCGz23v3 for ; Wed, 3 Apr 2024 19:42:54 +1100 (AEDT) Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ny.mirrors.kernel.org (Postfix) with ESMTPS id CD73B1C20F10 for ; Wed, 3 Apr 2024 08:42:52 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 9BDDE6EB40; Wed, 3 Apr 2024 08:42:45 +0000 (UTC) X-Original-To: netfilter-devel@vger.kernel.org Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [91.216.245.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C98406E5F6 for ; Wed, 3 Apr 2024 08:42:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.216.245.30 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133765; cv=none; b=NDCW2xin8fLoFsRz+X1diioJXEKfV/kGGdW+BTOulb1EdGbPXBPapcln3TUFKQWwrmVZrwbAE+Sn34ak67aeFdCnuegw5ebB4T/1UlLLi5ZKE6HUuSMYd7QmjldYNLthJa7vqAD+TpiKC42pHYhAvV3vq+YmQeIii3oD8oh9uu0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133765; c=relaxed/simple; bh=hECGQXIBJztAHlQgIsKfHsJWGztFLIB2ROyZk7R+fX0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XDlhin8dtVbM34eBLgaOp8b/uyxeuQB2S43Y0Allx3Le1ULV0TEt8nj4rAKMys0i/aCa6kbCQl42OudIbo8usGM3qZQOfeAqe6loUJhhRNDMkP4+sAbU2emukiSrkCSS10jJ2omrOh2REpNPP8ojSWeidhc/NvpTo4PTFsxj+h0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de; spf=pass smtp.mailfrom=breakpoint.cc; arc=none smtp.client-ip=91.216.245.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=breakpoint.cc Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1rrwCg-0005yf-DL; Wed, 03 Apr 2024 10:42:42 +0200 From: Florian Westphal To: Cc: sbrivio@redhat.com, Florian Westphal Subject: [PATCH nf-next 6/9] netfilter: nft_set_pipapo: merge deactivate helper into caller Date: Wed, 3 Apr 2024 10:41:06 +0200 Message-ID: <20240403084113.18823-7-fw@strlen.de> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240403084113.18823-1-fw@strlen.de> References: <20240403084113.18823-1-fw@strlen.de> Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Its the only remaining call site so there is no need for this to be separated anymore. Signed-off-by: Florian Westphal --- net/netfilter/nft_set_pipapo.c | 39 ++++++++-------------------------- 1 file changed, 9 insertions(+), 30 deletions(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index eca81c5e5810..9dd6725ada4d 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1851,52 +1851,31 @@ static void nft_pipapo_activate(const struct net *net, } /** - * pipapo_deactivate() - Check that element is in set, mark as inactive + * nft_pipapo_deactivate() - Search for element and make it inactive * @net: Network namespace * @set: nftables API set representation - * @data: Input key data - * @ext: nftables API extension pointer, used to check for end element - * - * This is a convenience function that can be called from both - * nft_pipapo_deactivate() and nft_pipapo_flush(), as they are in fact the same - * operation. + * @elem: nftables API element representation containing key data * * Return: deactivated element if found, NULL otherwise. */ -static void *pipapo_deactivate(const struct net *net, const struct nft_set *set, - const u8 *data, const struct nft_set_ext *ext) +static struct nft_elem_priv * +nft_pipapo_deactivate(const struct net *net, const struct nft_set *set, + const struct nft_set_elem *elem) { struct nft_pipapo_elem *e; - e = pipapo_get(net, set, data, nft_genmask_next(net), - nft_net_tstamp(net), GFP_KERNEL); + e = pipapo_get(net, set, (const u8 *)elem->key.val.data, + nft_genmask_next(net), nft_net_tstamp(net), GFP_KERNEL); if (IS_ERR(e)) return NULL; nft_set_elem_change_active(net, set, &e->ext); - return e; -} - -/** - * nft_pipapo_deactivate() - Call pipapo_deactivate() to make element inactive - * @net: Network namespace - * @set: nftables API set representation - * @elem: nftables API element representation containing key data - * - * Return: deactivated element if found, NULL otherwise. - */ -static struct nft_elem_priv * -nft_pipapo_deactivate(const struct net *net, const struct nft_set *set, - const struct nft_set_elem *elem) -{ - const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); - - return pipapo_deactivate(net, set, (const u8 *)elem->key.val.data, ext); + return &e->priv; } /** - * nft_pipapo_flush() - Call pipapo_deactivate() to make element inactive + * nft_pipapo_flush() - make element inactive * @net: Network namespace * @set: nftables API set representation * @elem_priv: nftables API element representation containing key data From patchwork Wed Apr 3 08:41:07 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 1919138 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2604:1380:4601:e00::3; helo=am.mirrors.kernel.org; envelope-from=netfilter-devel+bounces-1595-incoming=patchwork.ozlabs.org@vger.kernel.org; receiver=patchwork.ozlabs.org) Received: from am.mirrors.kernel.org (am.mirrors.kernel.org [IPv6:2604:1380:4601:e00::3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4V8dYZ0zZNz23tv for ; Wed, 3 Apr 2024 19:42:58 +1100 (AEDT) Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by am.mirrors.kernel.org (Postfix) with ESMTPS id 632031F290EB for ; Wed, 3 Apr 2024 08:42:55 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id EB5EA6CDC2; Wed, 3 Apr 2024 08:42:49 +0000 (UTC) X-Original-To: netfilter-devel@vger.kernel.org Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [91.216.245.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2D2456CDDB for ; Wed, 3 Apr 2024 08:42:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.216.245.30 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133769; cv=none; b=uw0ES0xL3yxMzNh2g0g04ognV0lNAqXjbZ9jjQh8z30jV2PJti1ksr7CgDAOr5Og1vb7ZDu31ho8TKonu6Gk3Rb81MC5zJohF3U4ekTytPVm8iG7crYCEo88fHGZSdkZld+J1Vh3l6DAaNyl0wwtecGswhvblqjCBmqCvURH/gw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133769; c=relaxed/simple; bh=RrrtoX/2gJoj88hQZECitLOzQpICNQGmD/+wHz5fVgw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZdzKWXCE21kVuAT6x6tTOXOjVq/pCd5m/yRryKpE3/y3/aNKxSW09PDO1vAL70r0Pq1okXB98geNqIrBuzss9VQPSOOQ4rkUWz66t/+9W/uuCChho49dBvCKmKtwqKCQ0+N6C0kG1WHFv43Igsk+aokrNxnU4aH8bu9XjepmHMk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de; spf=pass smtp.mailfrom=breakpoint.cc; arc=none smtp.client-ip=91.216.245.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=breakpoint.cc Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1rrwCk-0005yy-Lk; Wed, 03 Apr 2024 10:42:46 +0200 From: Florian Westphal To: Cc: sbrivio@redhat.com, Florian Westphal Subject: [PATCH nf-next 7/9] netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone Date: Wed, 3 Apr 2024 10:41:07 +0200 Message-ID: <20240403084113.18823-8-fw@strlen.de> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240403084113.18823-1-fw@strlen.de> References: <20240403084113.18823-1-fw@strlen.de> Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 The helper uses priv->clone unconditionally which will fail once we do the clone conditionally on first insert or removal. 'nft get element' from userspace needs to use priv->match if priv->clone is null. Prepare for this by passing the match backend data as argument. Signed-off-by: Florian Westphal --- net/netfilter/nft_set_pipapo.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 9dd6725ada4d..2cc905e92889 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -504,6 +504,7 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, * pipapo_get() - Get matching element reference given key data * @net: Network namespace * @set: nftables API set representation + * @m: storage containing active/existing elements * @data: Key data to be matched against existing elements * @genmask: If set, check that element is active in given genmask * @tstamp: timestamp to check for expired elements @@ -517,17 +518,15 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, */ static struct nft_pipapo_elem *pipapo_get(const struct net *net, const struct nft_set *set, + const struct nft_pipapo_match *m, const u8 *data, u8 genmask, u64 tstamp, gfp_t gfp) { struct nft_pipapo_elem *ret = ERR_PTR(-ENOENT); - struct nft_pipapo *priv = nft_set_priv(set); unsigned long *res_map, *fill_map = NULL; - const struct nft_pipapo_match *m; const struct nft_pipapo_field *f; int i; - m = priv->clone; if (m->bsize_max == 0) return ret; @@ -612,9 +611,11 @@ static struct nft_elem_priv * nft_pipapo_get(const struct net *net, const struct nft_set *set, const struct nft_set_elem *elem, unsigned int flags) { + struct nft_pipapo *priv = nft_set_priv(set); + struct nft_pipapo_match *m = priv->clone; struct nft_pipapo_elem *e; - e = pipapo_get(net, set, (const u8 *)elem->key.val.data, + e = pipapo_get(net, set, m, (const u8 *)elem->key.val.data, nft_genmask_cur(net), get_jiffies_64(), GFP_ATOMIC); if (IS_ERR(e)) @@ -1288,7 +1289,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, else end = start; - dup = pipapo_get(net, set, start, genmask, tstamp, GFP_KERNEL); + dup = pipapo_get(net, set, m, start, genmask, tstamp, GFP_KERNEL); if (!IS_ERR(dup)) { /* Check if we already have the same exact entry */ const struct nft_data *dup_key, *dup_end; @@ -1310,7 +1311,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, if (PTR_ERR(dup) == -ENOENT) { /* Look for partially overlapping entries */ - dup = pipapo_get(net, set, end, nft_genmask_next(net), tstamp, + dup = pipapo_get(net, set, m, end, nft_genmask_next(net), tstamp, GFP_KERNEL); } @@ -1862,9 +1863,11 @@ static struct nft_elem_priv * nft_pipapo_deactivate(const struct net *net, const struct nft_set *set, const struct nft_set_elem *elem) { + const struct nft_pipapo *priv = nft_set_priv(set); + struct nft_pipapo_match *m = priv->clone; struct nft_pipapo_elem *e; - e = pipapo_get(net, set, (const u8 *)elem->key.val.data, + e = pipapo_get(net, set, m, (const u8 *)elem->key.val.data, nft_genmask_next(net), nft_net_tstamp(net), GFP_KERNEL); if (IS_ERR(e)) return NULL; From patchwork Wed Apr 3 08:41:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 1919139 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=139.178.88.99; helo=sv.mirrors.kernel.org; envelope-from=netfilter-devel+bounces-1596-incoming=patchwork.ozlabs.org@vger.kernel.org; receiver=patchwork.ozlabs.org) Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org [139.178.88.99]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4V8dYx1Yt5z23tv for ; Wed, 3 Apr 2024 19:43:17 +1100 (AEDT) Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 6AC9A283E2E for ; Wed, 3 Apr 2024 08:43:15 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 2615D6EB40; Wed, 3 Apr 2024 08:42:54 +0000 (UTC) X-Original-To: netfilter-devel@vger.kernel.org Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [91.216.245.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3A2556DCE8 for ; Wed, 3 Apr 2024 08:42:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.216.245.30 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133773; cv=none; b=MeDaICvEkYKb8bPSlWxjLXeQwF3xyVXJMpQ5QkzXazZZejt604AVgz8lkTx8m0JoG10ayC3ZT6FDhmE5v3Jnsxo9/hMkI4i6vHN/hCHFMnEXOIwVf5pznl+wdNvoazcIRRPWTTu+Als8FMF10WBoYhhWXQz1pj5IcLDSjTyWUYE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133773; c=relaxed/simple; bh=GC6ObPov90RkmR86T8IWped91KT5lgrIasfddPkEkLc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=X/d/NYDNi4HV/MdqQ8n5G83ZfC5pflsXmnzJQJY7vykExoEOoAMBYOBgbMNWPP8K0ST9ylsXwW5PhWK0VRaY8pIZ28AaJLdKFrntzDkMfJ04wQCHJ96rDDIFQt7cKRrURL9IwvUrRl0a3LXR1lG/hsZRZGRsGztwh4p7YUXQdvg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de; spf=pass smtp.mailfrom=breakpoint.cc; arc=none smtp.client-ip=91.216.245.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=breakpoint.cc Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1rrwCo-0005zM-Tx; Wed, 03 Apr 2024 10:42:50 +0200 From: Florian Westphal To: Cc: sbrivio@redhat.com, Florian Westphal Subject: [PATCH nf-next 8/9] netfilter: nft_set_pipapo: move cloning of match info to insert/removal path Date: Wed, 3 Apr 2024 10:41:08 +0200 Message-ID: <20240403084113.18823-9-fw@strlen.de> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240403084113.18823-1-fw@strlen.de> References: <20240403084113.18823-1-fw@strlen.de> Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 This set type keeps two copies of the sets' content, priv->match (live version, used to match from packet path) priv->clone (work-in-progress version of the 'future' priv->match). All additions and removals are done on priv->clone. When transaction completes, priv->clone becomes priv->match and a new clone is allocated for use by next transaction. Problem is that the cloning requires GFP_KERNEL allocations but we cannot fail at either commit or abort time. This patch defers the clone until we get an insertion or removal request. This allows us to handle OOM situations correctly. This also allows to remove ->dirty in a followup change: If ->clone exists, ->dirty is always true If ->clone is NULL, ->dirty is always false, no elements were added or removed (except catchall elements which are external to the specific set backend). Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio --- net/netfilter/nft_set_pipapo.c | 62 ++++++++++++++++++++++------------ 1 file changed, 41 insertions(+), 21 deletions(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 2cc905e92889..eef6a978561f 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -615,6 +615,9 @@ nft_pipapo_get(const struct net *net, const struct nft_set *set, struct nft_pipapo_match *m = priv->clone; struct nft_pipapo_elem *e; + if (!m) + m = rcu_dereference(priv->match); + e = pipapo_get(net, set, m, (const u8 *)elem->key.val.data, nft_genmask_cur(net), get_jiffies_64(), GFP_ATOMIC); @@ -1259,6 +1262,23 @@ static bool nft_pipapo_transaction_mutex_held(const struct nft_set *set) #endif } +static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old); + +static struct nft_pipapo_match *pipapo_maybe_clone(const struct nft_set *set) +{ + struct nft_pipapo *priv = nft_set_priv(set); + struct nft_pipapo_match *m; + + if (priv->clone) + return priv->clone; + + m = rcu_dereference_protected(priv->match, + nft_pipapo_transaction_mutex_held(set)); + priv->clone = pipapo_clone(m); + + return priv->clone; +} + /** * nft_pipapo_insert() - Validate and insert ranged elements * @net: Network namespace @@ -1275,8 +1295,8 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); union nft_pipapo_map_bucket rulemap[NFT_PIPAPO_MAX_FIELDS]; const u8 *start = (const u8 *)elem->key.val.data, *end; + struct nft_pipapo_match *m = pipapo_maybe_clone(set); struct nft_pipapo *priv = nft_set_priv(set); - struct nft_pipapo_match *m = priv->clone; u8 genmask = nft_genmask_next(net); struct nft_pipapo_elem *e, *dup; u64 tstamp = nft_net_tstamp(net); @@ -1284,6 +1304,9 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, const u8 *start_p, *end_p; int i, bsize_max, err = 0; + if (!m) + return -ENOMEM; + if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END)) end = (const u8 *)nft_set_ext_key_end(ext)->data; else @@ -1789,7 +1812,10 @@ static void pipapo_reclaim_match(struct rcu_head *rcu) static void nft_pipapo_commit(struct nft_set *set) { struct nft_pipapo *priv = nft_set_priv(set); - struct nft_pipapo_match *new_clone, *old; + struct nft_pipapo_match *old; + + if (!priv->clone) + return; if (time_after_eq(jiffies, priv->last_gc + nft_set_gc_interval(set))) pipapo_gc(set, priv->clone); @@ -1797,38 +1823,27 @@ static void nft_pipapo_commit(struct nft_set *set) if (!priv->dirty) return; - new_clone = pipapo_clone(priv->clone); - if (!new_clone) - return; - + old = rcu_replace_pointer(priv->match, priv->clone, + nft_pipapo_transaction_mutex_held(set)); + priv->clone = NULL; priv->dirty = false; - old = rcu_access_pointer(priv->match); - rcu_assign_pointer(priv->match, priv->clone); if (old) call_rcu(&old->rcu, pipapo_reclaim_match); - - priv->clone = new_clone; } static void nft_pipapo_abort(const struct nft_set *set) { struct nft_pipapo *priv = nft_set_priv(set); - struct nft_pipapo_match *new_clone, *m; if (!priv->dirty) return; - m = rcu_dereference_protected(priv->match, nft_pipapo_transaction_mutex_held(set)); - - new_clone = pipapo_clone(m); - if (!new_clone) + if (!priv->clone) return; - priv->dirty = false; - pipapo_free_match(priv->clone); - priv->clone = new_clone; + priv->clone = NULL; } /** @@ -1863,10 +1878,15 @@ static struct nft_elem_priv * nft_pipapo_deactivate(const struct net *net, const struct nft_set *set, const struct nft_set_elem *elem) { - const struct nft_pipapo *priv = nft_set_priv(set); - struct nft_pipapo_match *m = priv->clone; + struct nft_pipapo_match *m = pipapo_maybe_clone(set); struct nft_pipapo_elem *e; + /* removal must occur on priv->clone, if we are low on memory + * we have no choice and must fail the removal request. + */ + if (!m) + return NULL; + e = pipapo_get(net, set, m, (const u8 *)elem->key.val.data, nft_genmask_next(net), nft_net_tstamp(net), GFP_KERNEL); if (IS_ERR(e)) @@ -2145,7 +2165,7 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, switch (iter->type) { case NFT_ITER_FLUSH: - m = priv->clone; + m = pipapo_maybe_clone(set); if (!m) { iter->err = -ENOMEM; return; From patchwork Wed Apr 3 08:41:09 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 1919141 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2604:1380:45e3:2400::1; helo=sv.mirrors.kernel.org; envelope-from=netfilter-devel+bounces-1597-incoming=patchwork.ozlabs.org@vger.kernel.org; receiver=patchwork.ozlabs.org) Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org [IPv6:2604:1380:45e3:2400::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4V8dZF1s4xz23tv for ; Wed, 3 Apr 2024 19:43:33 +1100 (AEDT) Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 260D2284104 for ; Wed, 3 Apr 2024 08:43:31 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 37B7971B32; Wed, 3 Apr 2024 08:42:58 +0000 (UTC) X-Original-To: netfilter-devel@vger.kernel.org Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [91.216.245.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 70C836FE2A for ; Wed, 3 Apr 2024 08:42:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.216.245.30 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133777; cv=none; b=cMFFMbYr7ulw0XDekHJ4WAjjFccBnI8t5F7EvqNfMg2FwKbvFQ5/nXbxbdq1tVWnz1NbhmQflY9OrkBK1E+aDCl9X+FYCMsF/A7N+ACEfwHzcWmn2NykPeLB2YVBy08oqrsBm8LA2/0XZHqwvSEDVR5/a6C/b56UjNsaEQ/5fgY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712133777; c=relaxed/simple; bh=P7q5Y+lMgAhdGfVwBKH9cVCuvdxoL/RuvHCWpdH/tag=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=AH5XxpwPnd/kl6GEtcSdBFBhaihxlYVlS+6YFGsu9j7uNSZvjTPCIYRzBdaUlFBWt1hwqUdnH27PoUl64JxxS+f9kbykgEdRDdl90IbBiV9ZnRUmM8xFWxBXzwGH0fpUZOEcdc6Di0qZSp5DoEtsGlxn+7ux2Eo/8yPHh5t+4QA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de; spf=pass smtp.mailfrom=breakpoint.cc; arc=none smtp.client-ip=91.216.245.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=breakpoint.cc Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1rrwCt-0005zv-7s; Wed, 03 Apr 2024 10:42:55 +0200 From: Florian Westphal To: Cc: sbrivio@redhat.com, Florian Westphal Subject: [PATCH nf-next 9/9] netfilter: nft_set_pipapo: remove dirty flag Date: Wed, 3 Apr 2024 10:41:09 +0200 Message-ID: <20240403084113.18823-10-fw@strlen.de> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240403084113.18823-1-fw@strlen.de> References: <20240403084113.18823-1-fw@strlen.de> Precedence: bulk X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Its not needed anymore, after previous changes priv->clone != NULL during commit means priv->match needs to be updated with the clone. On abort, priv->clone needs to be discarded, it doesn't contain anything new anymore. Note that its now possible to resurrect ebd032fa8818 ("netfilter: nf_tables: do not remove elements if set backend implements .abort") to speed up the abort path, removal from pipapo sets is slow. Signed-off-by: Florian Westphal --- net/netfilter/nft_set_pipapo.c | 25 ------------------------- net/netfilter/nft_set_pipapo.h | 2 -- 2 files changed, 27 deletions(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index eef6a978561f..bb9a03426696 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1296,7 +1296,6 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, union nft_pipapo_map_bucket rulemap[NFT_PIPAPO_MAX_FIELDS]; const u8 *start = (const u8 *)elem->key.val.data, *end; struct nft_pipapo_match *m = pipapo_maybe_clone(set); - struct nft_pipapo *priv = nft_set_priv(set); u8 genmask = nft_genmask_next(net); struct nft_pipapo_elem *e, *dup; u64 tstamp = nft_net_tstamp(net); @@ -1367,8 +1366,6 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, } /* Insert */ - priv->dirty = true; - bsize_max = m->bsize_max; nft_pipapo_for_each_field(f, i, m) { @@ -1733,8 +1730,6 @@ static void pipapo_gc(struct nft_set *set, struct nft_pipapo_match *m) * NFT_SET_ELEM_DEAD_BIT. */ if (__nft_set_elem_expired(&e->ext, tstamp)) { - priv->dirty = true; - gc = nft_trans_gc_queue_sync(gc, GFP_KERNEL); if (!gc) return; @@ -1820,13 +1815,9 @@ static void nft_pipapo_commit(struct nft_set *set) if (time_after_eq(jiffies, priv->last_gc + nft_set_gc_interval(set))) pipapo_gc(set, priv->clone); - if (!priv->dirty) - return; - old = rcu_replace_pointer(priv->match, priv->clone, nft_pipapo_transaction_mutex_held(set)); priv->clone = NULL; - priv->dirty = false; if (old) call_rcu(&old->rcu, pipapo_reclaim_match); @@ -1836,12 +1827,8 @@ static void nft_pipapo_abort(const struct nft_set *set) { struct nft_pipapo *priv = nft_set_priv(set); - if (!priv->dirty) - return; - if (!priv->clone) return; - priv->dirty = false; pipapo_free_match(priv->clone); priv->clone = NULL; } @@ -2094,7 +2081,6 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set, } if (i == m->field_count) { - priv->dirty = true; pipapo_drop(m, rulemap); return; } @@ -2299,21 +2285,10 @@ static int nft_pipapo_init(const struct nft_set *set, f->mt = NULL; } - /* Create an initial clone of matching data for next insertion */ - priv->clone = pipapo_clone(m); - if (!priv->clone) { - err = -ENOMEM; - goto out_free; - } - - priv->dirty = false; - rcu_assign_pointer(priv->match, m); return 0; -out_free: - free_percpu(m->scratch); out_scratch: kfree(m); diff --git a/net/netfilter/nft_set_pipapo.h b/net/netfilter/nft_set_pipapo.h index 24cd1ff73f98..0d2e40e10f7f 100644 --- a/net/netfilter/nft_set_pipapo.h +++ b/net/netfilter/nft_set_pipapo.h @@ -155,14 +155,12 @@ struct nft_pipapo_match { * @match: Currently in-use matching data * @clone: Copy where pending insertions and deletions are kept * @width: Total bytes to be matched for one packet, including padding - * @dirty: Working copy has pending insertions or deletions * @last_gc: Timestamp of last garbage collection run, jiffies */ struct nft_pipapo { struct nft_pipapo_match __rcu *match; struct nft_pipapo_match *clone; int width; - bool dirty; unsigned long last_gc; };