Re: [PATCH v2 -next 1/2] netfilter: iptables: separate counters from iptables rules

[Florian Westphal <fw@strlen.de>]

Eric Dumazet <eric.dumazet@gmail.com> wrote:
> > How?  What address?  You mean relative offset to counter start?
> 
> No, the address itself. This is what I coded years ago.
> > when rule x matches, I need to increment the corresponding counter
> > for that rule.
> 
> Right. You have in the rule itself the storage for xt_counter. Thats 16
> bytes. You only need 8 bytes (on 64bit arch) to store the percpu
> address.

> Instead of leaving nothing in it, place the percpu address of the
> corresponding counter. access to it is in the cache line needed to
> analyze the entry anyway. Its free.

I'm dense.  So, what you're saying is that I should

alloc_percpu(sizeof(struct xt_counters));

for each rule and store the resulting address in ipt_entry?
Then it would be possible to get the correct location for current cpu
when counter has to be incremented.

Thanks Eric.