Florian Westphal 482cfc3185 netfilter: xtables: avoid percpu ruleset duplication ... We store the rule blob per (possible) cpu. Unfortunately this means we can waste lot of memory on big smp machines. ipt_entry structure ('rule head') is 112 byte, so e.g. with maxcpu=64 one single rule eats close to 8k RAM. Since previous patch made counters percpu it appears there is nothing left in the rule blob that needs to be percpu. On my test system (144 possible cpus, 400k dummy rules) this change saves close to 9 Gigabyte of RAM. Reported-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Acked-by: Jesper Dangaard Brouer <brouer@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2015-06-12 14:27:10 +02:00
..
ipset	netfilter: ipset: deinline ip_set_put_extensions()	2015-05-14 12:51:19 +02:00
ipvs	ipv6: Set FLOWI_FLAG_KNOWN_NH at flowi6_flags	2015-05-25 13:25:34 -04:00
core.c	netfilter: add netfilter ingress hook after handle_ing() under unique static key	2015-05-14 01:10:05 -04:00
Kconfig	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2015-05-31 00:02:30 -07:00
Makefile	netfilter: nf_tables: add netdev table to filter from ingress	2015-05-26 18:41:23 +02:00
nf_conntrack_acct.c	netfilter: Remove uses of seq_<foo> return values	2015-03-18 10:51:35 +01:00
nf_conntrack_amanda.c
nf_conntrack_broadcast.c
nf_conntrack_core.c
nf_conntrack_ecache.c
nf_conntrack_expect.c	netfilter: Remove uses of seq_<foo> return values	2015-03-18 10:51:35 +01:00
nf_conntrack_extend.c
nf_conntrack_ftp.c
nf_conntrack_h323_asn1.c
nf_conntrack_h323_main.c	ipv6: Remove external dependency on rt6i_gateway and RTF_ANYCAST	2015-05-25 13:25:33 -04:00
nf_conntrack_h323_types.c
nf_conntrack_helper.c
nf_conntrack_irc.c
nf_conntrack_l3proto_generic.c
nf_conntrack_labels.c
nf_conntrack_netbios_ns.c
nf_conntrack_netlink.c
nf_conntrack_pptp.c
nf_conntrack_proto.c
nf_conntrack_proto_dccp.c
nf_conntrack_proto_generic.c	netfilter: conntrack: warn the user if there is a better helper to use	2015-06-12 14:06:24 +02:00
nf_conntrack_proto_gre.c
nf_conntrack_proto_sctp.c
nf_conntrack_proto_tcp.c	conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition	2015-05-15 20:50:56 +02:00
nf_conntrack_proto_udp.c
nf_conntrack_proto_udplite.c
nf_conntrack_sane.c
nf_conntrack_seqadj.c
nf_conntrack_sip.c
nf_conntrack_snmp.c
nf_conntrack_standalone.c
nf_conntrack_tftp.c
nf_conntrack_timeout.c
nf_conntrack_timestamp.c
nf_internals.h	netfilter: Create and use nf_hook_state.	2015-04-04 12:17:40 -04:00
nf_log.c	netfilter: restore rule tracing via nfnetlink_log	2015-03-19 11:14:48 +01:00
nf_log_common.c	netfilter: bridge: add helpers for fetching physin/outdev	2015-04-08 16:49:08 +02:00
nf_nat_amanda.c
nf_nat_core.c
nf_nat_ftp.c
nf_nat_helper.c
nf_nat_irc.c
nf_nat_proto_common.c
nf_nat_proto_dccp.c
nf_nat_proto_sctp.c
nf_nat_proto_tcp.c
nf_nat_proto_udp.c
nf_nat_proto_udplite.c
nf_nat_proto_unknown.c
nf_nat_redirect.c
nf_nat_sip.c
nf_nat_tftp.c
nf_queue.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2015-04-08 18:30:21 +02:00
nf_sockopt.c
nf_synproxy_core.c
nf_tables_api.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2015-05-31 00:02:30 -07:00
nf_tables_core.c	netfilter: nf_tables: switch registers to 32 bit addressing	2015-04-13 17:17:29 +02:00
nf_tables_inet.c
nf_tables_netdev.c	netfilter: nf_tables: add netdev table to filter from ingress	2015-05-26 18:41:23 +02:00
nfnetlink.c
nfnetlink_acct.c
nfnetlink_cthelper.c	netfilter: Zero the tuple in nfnl_cthelper_parse_tuple()	2015-03-12 13:07:36 +01:00
nfnetlink_cttimeout.c
nfnetlink_log.c	netfilter: nfnetlink_{log,queue}: Register pernet in first place	2015-05-20 13:46:48 +02:00
nfnetlink_queue_core.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2015-05-23 01:22:35 -04:00
nfnetlink_queue_ct.c
nft_bitwise.c	netfilter: nf_tables: support variable sized data in nft_data_init()	2015-04-13 17:17:30 +02:00
nft_byteorder.c	netfilter: nf_tables: switch registers to 32 bit addressing	2015-04-13 17:17:29 +02:00
nft_cmp.c	netfilter: nf_tables: support variable sized data in nft_data_init()	2015-04-13 17:17:30 +02:00
nft_compat.c	netfilter: x_tables: add context to know if extension runs from nft_compat	2015-05-15 20:14:07 +02:00
nft_counter.c	netfilter: nf_tables: mark stateful expressions	2015-04-13 20:12:31 +02:00
nft_ct.c	netfilter: nf_tables: switch registers to 32 bit addressing	2015-04-13 17:17:29 +02:00
nft_dynset.c	netfilter: nft_dynset: dynamic stateful expression instantiation	2015-04-13 20:19:55 +02:00
nft_exthdr.c	netfilter: nf_tables: switch registers to 32 bit addressing	2015-04-13 17:17:29 +02:00
nft_hash.c	netfilter: nf_tables: variable sized set element keys / data	2015-04-13 17:17:31 +02:00
nft_immediate.c	netfilter: nf_tables: support variable sized data in nft_data_init()	2015-04-13 17:17:30 +02:00
nft_limit.c	netfilter: nf_tables: mark stateful expressions	2015-04-13 20:12:31 +02:00
nft_log.c	netfilter: nf_tables: get rid of NFT_REG_VERDICT usage	2015-04-13 17:17:07 +02:00
nft_lookup.c	netfilter: nf_tables: add flag to indicate set contains expressions	2015-04-13 20:12:32 +02:00
nft_masq.c
nft_meta.c	netfilter: nf_tables: switch registers to 32 bit addressing	2015-04-13 17:17:29 +02:00
nft_nat.c	netfilter: nf_tables: switch registers to 32 bit addressing	2015-04-13 17:17:29 +02:00
nft_payload.c	netfilter: nf_tables: switch registers to 32 bit addressing	2015-04-13 17:17:29 +02:00
nft_queue.c	netfilter: nf_tables: get rid of NFT_REG_VERDICT usage	2015-04-13 17:17:07 +02:00
nft_rbtree.c	netfilter: nf_tables: variable sized set element keys / data	2015-04-13 17:17:31 +02:00
nft_redir.c	netfilter: nf_tables: add register parsing/dumping helpers	2015-04-13 17:17:28 +02:00
nft_reject.c	netfilter; Add some missing default cases to switch statements in nft_reject.	2015-04-27 13:20:34 -04:00
nft_reject_inet.c	netfilter; Add some missing default cases to switch statements in nft_reject.	2015-04-27 13:20:34 -04:00
x_tables.c	netfilter: xtables: avoid percpu ruleset duplication	2015-06-12 14:27:10 +02:00
xt_addrtype.c	ipv6: Remove external dependency on rt6i_gateway and RTF_ANYCAST	2015-05-25 13:25:33 -04:00
xt_AUDIT.c
xt_bpf.c
xt_cgroup.c	netfilter: x_tables: fix cgroup matching on non-full sks	2015-04-01 11:26:42 +02:00
xt_CHECKSUM.c
xt_CLASSIFY.c
xt_cluster.c
xt_comment.c
xt_connbytes.c
xt_connlabel.c
xt_connlimit.c
xt_connmark.c
xt_CONNSECMARK.c
xt_conntrack.c
xt_cpu.c
xt_CT.c
xt_dccp.c
xt_devgroup.c
xt_dscp.c
xt_DSCP.c
xt_ecn.c
xt_esp.c
xt_hashlimit.c
xt_helper.c
xt_hl.c
xt_HL.c
xt_HMARK.c
xt_IDLETIMER.c
xt_ipcomp.c
xt_iprange.c
xt_ipvs.c
xt_l2tp.c
xt_LED.c
xt_length.c
xt_limit.c
xt_LOG.c
xt_mac.c
xt_mark.c	netfilter: xt_MARK: Add ARP support	2015-05-14 13:00:27 +02:00
xt_multiport.c
xt_nat.c
xt_NETMAP.c
xt_nfacct.c
xt_NFLOG.c
xt_NFQUEUE.c
xt_osf.c
xt_owner.c
xt_physdev.c	netfilter: physdev: use helpers	2015-04-08 16:49:09 +02:00
xt_pkttype.c
xt_policy.c
xt_quota.c
xt_RATEEST.c
xt_rateest.c
xt_realm.c
xt_recent.c
xt_REDIRECT.c
xt_repldata.h
xt_sctp.c
xt_SECMARK.c
xt_set.c	netfilter: ipset: Use better include files in xt_set.c	2015-05-13 18:21:13 +02:00
xt_socket.c	netfilter: x_tables: don't extract flow keys on early demuxed sks in socket match	2015-04-08 16:47:49 +02:00
xt_state.c
xt_statistic.c
xt_string.c
xt_TCPMSS.c	netfilter: x_tables: add context to know if extension runs from nft_compat	2015-05-15 20:14:07 +02:00
xt_tcpmss.c
xt_TCPOPTSTRIP.c
xt_tcpudp.c
xt_TEE.c	ipv6: Set FLOWI_FLAG_KNOWN_NH at flowi6_flags	2015-05-25 13:25:34 -04:00
xt_time.c
xt_TPROXY.c	tcp/dccp: get rid of central timewait timer	2015-04-13 16:40:05 -04:00
xt_TRACE.c
xt_u32.c