From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=91.216.245.30 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793979510; b=4KAWNpOmnYv0LEKWyVS4JPWvFxWbwtQU3d72iK2V5b93egEwrHJlzB7EJU8KeQ/lErL2 pTlao/j0ezqniaJWc6AxAlTeHYtLXQuKCeS6DQ16yFsaD3MabIuKZ6RlkvyBM+jz9OLXq 6x6pu08jmCBg+rut9PBF4qeRPhdpI9va7vS92sDjvH/6lUv/EJZ1QB7gjPMIWdWxxSPa9 w1gvGQJCEo5t9rvVCPQb+6n9TsqtKkhxj29/7YDtDa0/ES9evp8Mn7Rg7MSyrrDvdNYtY MPSDQtorFbfXf+ns9kriQafV+RwuvgCFv+iPkFNIrFXXS/l27tHof3mOBqDjLjphLNw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793979510; h=DMARC-Filter:Received:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=SqEEw2Kg4JJxBUsvU/5R9dQaEXMj+v2X3ZsOPAd1tDw=; b=kcFKOYgmL1Wi1JWAgbcIhqf3GSHw5xZ+HBU1/IWnk7AnBh3oHj0Jb5lyEKVT0SbIu952 F9EbvROEm4w5lliRgyoobm5483469qygHVsCk1MmNMQXCdLvLRBG4xW40FsxrghuUoWzy 4ZQjri1Kc7su/XrXozHuApw4Sna9vEAA4Tn+nfDu5dKlXuJPpNzPTOOXinaH3wLQSbZVw 0GNekdP1F6LKjqC7KXCOSMDwVoBWLRfgmT3K3E9f2KLTjH4+MqS9QzhoG/DWsZhj5Ixv+ vR3M7Ps6KXRVzy/2y8l7G6edcLK/Au9C3NUGRHDlqkHbn4fILZwLjE4ELrcxlPzGAPw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none header.from=strlen.de; spf=pass smtp.mailfrom=Chamillionaire.breakpoint.cc; arc=none smtp.remote-ip=91.216.245.30 Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [91.216.245.30]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AA2C9606A326 for ; Fri, 6 Nov 2026 15:38:29 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org AA2C9606A326 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=Chamillionaire.breakpoint.cc Received: by Chamillionaire.breakpoint.cc (Postfix, from userid 1003) id 0D5896060B; Fri, 06 Nov 2026 16:38:28 +0100 (CET) From: Florian Westphal To: Cc: herbert@gondor.apana.org.au, kadlec@netfilter.org, Florian Westphal Subject: [PATCH nf-next v7 2/6] netfilter: ipset: add rhashtable boilerplate stubs Date: Fri, 6 Nov 2026 16:38:04 +0100 Message-ID: <20261106153808.25148-3-fw@strlen.de> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261106153808.25148-1-fw@strlen.de> References: <20261106153808.25148-1-fw@strlen.de> X-Mailing-List: netfilter-devel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Preparation patch. Adds an rhashtable to the set and initialises and destroys it. No elements are ever added to this hashtable. This change is supposed to be devoid of side effects and is separate to reduce size of the conversion patch. Signed-off-by: Florian Westphal --- v7: add one extra blank line after mtype_flush_elem. net/netfilter/ipset/ip_set_hash_gen.h | 114 ++++++++++++++++++++++++-- 1 file changed, 109 insertions(+), 5 deletions(-) diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h index 80ca523f304b..a3f6c0aa47f7 100644 --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h @@ -8,6 +8,7 @@ #include #include #include +#include #include #include #include @@ -217,9 +218,16 @@ static const union nf_inet_addr zeromask = {}; #undef mtype_ahash_destroy #undef mtype_ext_cleanup +#undef mtype_rht_elem +#undef mtype_rht_hashfn +#undef mtype_rht_obj_hashfn +#undef mtype_rht_cmpfn +#undef mtype_rht_params + #undef mtype_add_cidr #undef mtype_del_cidr #undef mtype_del_cidr_all +#undef mtype_flush_elem #undef mtype_ahash_memsize #undef mtype_flush #undef mtype_destroy @@ -265,9 +273,17 @@ static const union nf_inet_addr zeromask = {}; #define mtype_ahash_destroy IPSET_TOKEN(MTYPE, _ahash_destroy) #define mtype_ext_cleanup IPSET_TOKEN(MTYPE, _ext_cleanup) + +#define mtype_rht_elem IPSET_TOKEN(MTYPE, _rht_elem) +#define mtype_rht_hashfn IPSET_TOKEN(MTYPE, _rht_hashfn) +#define mtype_rht_obj_hashfn IPSET_TOKEN(MTYPE, _rht_obj_hashfn) +#define mtype_rht_cmpfn IPSET_TOKEN(MTYPE, _rht_cmpfn) +#define mtype_rht_params IPSET_TOKEN(MTYPE, _rht_params) + #define mtype_add_cidr IPSET_TOKEN(MTYPE, _add_cidr) #define mtype_del_cidr IPSET_TOKEN(MTYPE, _del_cidr) #define mtype_del_cidr_all IPSET_TOKEN(MTYPE, _del_cidr_all) +#define mtype_flush_elem IPSET_TOKEN(MTYPE, _flush_elem) #define mtype_ahash_memsize IPSET_TOKEN(MTYPE, _ahash_memsize) #define mtype_flush IPSET_TOKEN(MTYPE, _flush) #define mtype_destroy IPSET_TOKEN(MTYPE, _destroy) @@ -300,6 +316,62 @@ static const union nf_inet_addr zeromask = {}; #define htype MTYPE +/* Per-element rhashtable object. Extensions follow the elem field inline; + * allocate as offsetof(struct mtype_rht_elem, elem) + set->dsize bytes. + */ +struct mtype_rht_elem { + struct rhash_head node; + struct rcu_head rcu; /* deferred free after removal */ + + /* element data; must be last. extensions follow. */ + struct mtype_elem elem __aligned(__alignof__(u64)); +}; + +/* jhash of the lookup key */ +static u32 mtype_rht_hashfn(const void *data, u32 len, u32 seed) +{ + BUILD_BUG_ON(HKEY_DATALEN % sizeof(u32) != 0); + return jhash2((const u32 *)data, HKEY_DATALEN / sizeof(u32), seed); +} + +/* jhash of an existing element object */ +static u32 mtype_rht_obj_hashfn(const void *obj, u32 len, u32 seed) +{ + const struct mtype_rht_elem *e = obj; +#ifdef IP_SET_HASH_WITH_NETS + /* Reset transient flags (e.g. nomatch) before hashing so that the + * object hash always equals the lookup-key hash computed by hashfn. + */ + struct mtype_elem tmp; + u8 flags = 0; + + memcpy(&tmp, &e->elem, HKEY_DATALEN); + mtype_data_reset_flags(&tmp, &flags); + return jhash2((const u32 *)&tmp, HKEY_DATALEN / sizeof(u32), seed); +#else + return jhash2((const u32 *)&e->elem, HKEY_DATALEN / sizeof(u32), seed); +#endif +} + +/* 0 = key matches object (equal), non-zero = not equal */ +static int mtype_rht_cmpfn(struct rhashtable_compare_arg *arg, const void *obj) +{ + const struct mtype_rht_elem *e = obj; + u32 multi = 0; + + return !mtype_data_equal(&e->elem, + (const struct mtype_elem *)arg->key, &multi); +} + +static const struct rhashtable_params mtype_rht_params = { + .head_offset = offsetof(struct mtype_rht_elem, node), + .key_offset = offsetof(struct mtype_rht_elem, elem), + .hashfn = mtype_rht_hashfn, + .obj_hashfn = mtype_rht_obj_hashfn, + .obj_cmpfn = mtype_rht_cmpfn, + .key_len = HKEY_DATALEN, +}; + #define HKEY(data, initval, htable_bits) \ ({ \ const u32 *__k = (const u32 *)data; \ @@ -313,6 +385,7 @@ static const union nf_inet_addr zeromask = {}; /* The generic hash structure */ struct htype { struct htable __rcu *table; /* the hash table */ + struct rhashtable ht; /* the hash table */ struct net_prefixes __rcu *rnets[IPSET_NET_COUNT]; /* cidr prefixes */ struct htable_gc gc; /* gc workqueue */ u32 maxelem; /* max elements in the hash */ @@ -482,6 +555,19 @@ mtype_del_cidr_all(struct ip_set *set, struct htype *h, const struct mtype_elem #endif } +/* Free one element: called by rhashtable_free_and_destroy */ +static void +mtype_flush_elem(void *ptr, void *arg) +{ + struct mtype_rht_elem *e = ptr; + struct ip_set *set = arg; + + rcu_read_lock(); + ip_set_ext_destroy(set, &e->elem); + kfree_rcu(e, rcu); + rcu_read_unlock(); +} + /* Calculate the actual memory size of the set data */ static size_t mtype_ahash_memsize(const struct htype *h, const struct htable *t) @@ -586,6 +672,8 @@ mtype_destroy(struct ip_set *set) struct htable *t = (__force struct htable *)h->table; struct list_head *l, *lt; + rhashtable_free_and_destroy(&h->ht, mtype_flush_elem, set); + list_for_each_safe(l, lt, &t->ad) { list_del(l); kfree(l); @@ -1652,6 +1740,7 @@ static int IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set, struct nlattr *tb[], u32 flags) { + struct rhashtable_params params; u32 hashsize = IPSET_DEFAULT_HASHSIZE, maxelem = IPSET_DEFAULT_MAXELEM; #ifdef IP_SET_HASH_WITH_MARKMASK u32 markmask; @@ -1668,6 +1757,7 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set, size_t hsize; struct htype *h; struct htable *t; + int err; u32 i; pr_debug("Create set %s with family %s\n", @@ -1749,15 +1839,27 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set, #ifdef IP_SET_PROTO_UNDEF hsize = sizeof(struct htype); + params = mtype_rht_params; #else - hsize = set->family == NFPROTO_IPV6 ? - sizeof(struct IPSET_TOKEN(HTYPE, 6)) : - sizeof(struct IPSET_TOKEN(HTYPE, 4)); + if (set->family == NFPROTO_IPV6) { + hsize = sizeof(struct IPSET_TOKEN(HTYPE, 6)); + params = IPSET_TOKEN(HTYPE, 6_rht_params); + } else { + hsize = sizeof(struct IPSET_TOKEN(HTYPE, 4)); + params = IPSET_TOKEN(HTYPE, 4_rht_params); + } #endif h = kzalloc(hsize, GFP_KERNEL); if (!h) return -ENOMEM; + /* maxsize: maximum bucket table size to expand to */ + params.max_size = maxelem; + + err = rhashtable_init(&h->ht, ¶ms); + if (err) + goto free_h; + /* Compute htable_bits from the user input parameter hashsize. * Assume that hashsize == 2^htable_bits, * otherwise round up to the first 2^n value. @@ -1765,10 +1867,10 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set, hbits = fls(hashsize - 1); hsize = htable_size(hbits); if (hsize == 0) - goto free_h; + goto free_rht; t = ip_set_alloc(hsize); if (!t) - goto free_h; + goto free_rht; t->hregion = ip_set_alloc(ahash_sizeof_regions(hbits)); if (!t->hregion) goto free_t; @@ -1855,6 +1957,8 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set, #endif free_t: ip_set_free(t); +free_rht: + rhashtable_destroy(&h->ht); free_h: kfree(h); return -ENOMEM; -- 2.56.0