Skip to content

L
linux
Commit 022748a9 authored by Denys Vlasenko's avatar Denys Vlasenko Committed by David S. Miller
Browse files
Options

[NETFILTER]: {ip,ip6}_tables: remove some inlines 

This patch removes inlines except those which are used
by packet matching code and thus are performance-critical.

Before:

$ size */*/*/ip*tables*.o
   text    data     bss     dec     hex filename
   6402     500      16    6918    1b06 net/ipv4/netfilter/ip_tables.o
   7130     500      16    7646    1dde net/ipv6/netfilter/ip6_tables.o

After:

$ size */*/*/ip*tables*.o
   text    data     bss     dec     hex filename
   6307     500      16    6823    1aa7 net/ipv4/netfilter/ip_tables.o
   7010     500      16    7526    1d66 net/ipv6/netfilter/ip6_tables.o
Signed-off-by: default avatarDenys Vlasenko <vda.linux@googlemail.com>
Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f9ef8a23
Hide whitespace changes
Inline Side-by-side
Showing with 50 additions and 39 deletions
net/ipv4/netfilter/ip_tables.c
View file @ 022748a9
...@@ -75,6 +75,7 @@ do { \ ...@@ -75,6 +75,7 @@ do { \
Hence the start of any table is given by get_table() below. */ Hence the start of any table is given by get_table() below. */
/* Returns whether matches rule or not. */ /* Returns whether matches rule or not. */
/* Performance critical - called for every packet */
static inline bool static inline bool
ip_packet_match(const struct iphdr *ip, ip_packet_match(const struct iphdr *ip,
const char *indev, const char *indev,
...@@ -153,7 +154,7 @@ ip_packet_match(const struct iphdr *ip, ...@@ -153,7 +154,7 @@ ip_packet_match(const struct iphdr *ip,
return true; return true;
} }
static inline bool static bool
ip_checkentry(const struct ipt_ip *ip) ip_checkentry(const struct ipt_ip *ip)
{ {
if (ip->flags & ~IPT_F_MASK) { if (ip->flags & ~IPT_F_MASK) {
...@@ -183,8 +184,9 @@ ipt_error(struct sk_buff *skb, ...@@ -183,8 +184,9 @@ ipt_error(struct sk_buff *skb,
return NF_DROP; return NF_DROP;
} }
static inline /* Performance critical - called for every packet */
bool do_match(struct ipt_entry_match *m, static inline bool
do_match(struct ipt_entry_match *m,
const struct sk_buff *skb, const struct sk_buff *skb,
const struct net_device *in, const struct net_device *in,
const struct net_device *out, const struct net_device *out,
...@@ -199,6 +201,7 @@ bool do_match(struct ipt_entry_match *m, ...@@ -199,6 +201,7 @@ bool do_match(struct ipt_entry_match *m,
return false; return false;
} }
/* Performance critical */
static inline struct ipt_entry * static inline struct ipt_entry *
get_entry(void *base, unsigned int offset) get_entry(void *base, unsigned int offset)
{ {
...@@ -206,6 +209,7 @@ get_entry(void *base, unsigned int offset) ...@@ -206,6 +209,7 @@ get_entry(void *base, unsigned int offset)
} }
/* All zeroes == unconditional rule. */ /* All zeroes == unconditional rule. */
/* Mildly perf critical (only if packet tracing is on) */
static inline int static inline int
unconditional(const struct ipt_ip *ip) unconditional(const struct ipt_ip *ip)
{ {
...@@ -221,7 +225,7 @@ unconditional(const struct ipt_ip *ip) ...@@ -221,7 +225,7 @@ unconditional(const struct ipt_ip *ip)
#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \ #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE) defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
static const char *hooknames[] = { static const char *const hooknames[] = {
[NF_INET_PRE_ROUTING] = "PREROUTING", [NF_INET_PRE_ROUTING] = "PREROUTING",
[NF_INET_LOCAL_IN] = "INPUT", [NF_INET_LOCAL_IN] = "INPUT",
[NF_INET_FORWARD] = "FORWARD", [NF_INET_FORWARD] = "FORWARD",
...@@ -235,7 +239,7 @@ enum nf_ip_trace_comments { ...@@ -235,7 +239,7 @@ enum nf_ip_trace_comments {
NF_IP_TRACE_COMMENT_POLICY, NF_IP_TRACE_COMMENT_POLICY,
}; };
static const char *comments[] = { static const char *const comments[] = {
[NF_IP_TRACE_COMMENT_RULE] = "rule", [NF_IP_TRACE_COMMENT_RULE] = "rule",
[NF_IP_TRACE_COMMENT_RETURN] = "return", [NF_IP_TRACE_COMMENT_RETURN] = "return",
[NF_IP_TRACE_COMMENT_POLICY] = "policy", [NF_IP_TRACE_COMMENT_POLICY] = "policy",
...@@ -251,6 +255,7 @@ static struct nf_loginfo trace_loginfo = { ...@@ -251,6 +255,7 @@ static struct nf_loginfo trace_loginfo = {
}, },
}; };
/* Mildly perf critical (only if packet tracing is on) */
static inline int static inline int
get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e, get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
char *hookname, char **chainname, char *hookname, char **chainname,
...@@ -567,7 +572,7 @@ mark_source_chains(struct xt_table_info *newinfo, ...@@ -567,7 +572,7 @@ mark_source_chains(struct xt_table_info *newinfo,
return 1; return 1;
} }
static inline int static int
cleanup_match(struct ipt_entry_match *m, unsigned int *i) cleanup_match(struct ipt_entry_match *m, unsigned int *i)
{ {
if (i && (*i)-- == 0) if (i && (*i)-- == 0)
...@@ -579,7 +584,7 @@ cleanup_match(struct ipt_entry_match *m, unsigned int *i) ...@@ -579,7 +584,7 @@ cleanup_match(struct ipt_entry_match *m, unsigned int *i)
return 0; return 0;
} }
static inline int static int
check_entry(struct ipt_entry *e, const char *name) check_entry(struct ipt_entry *e, const char *name)
{ {
struct ipt_entry_target *t; struct ipt_entry_target *t;
...@@ -600,7 +605,8 @@ check_entry(struct ipt_entry *e, const char *name) ...@@ -600,7 +605,8 @@ check_entry(struct ipt_entry *e, const char *name)
return 0; return 0;
} }
static inline int check_match(struct ipt_entry_match *m, const char *name, static int
check_match(struct ipt_entry_match *m, const char *name,
const struct ipt_ip *ip, const struct ipt_ip *ip,
unsigned int hookmask, unsigned int *i) unsigned int hookmask, unsigned int *i)
{ {
...@@ -623,7 +629,7 @@ static inline int check_match(struct ipt_entry_match *m, const char *name, ...@@ -623,7 +629,7 @@ static inline int check_match(struct ipt_entry_match *m, const char *name,
return ret; return ret;
} }
static inline int static int
find_check_match(struct ipt_entry_match *m, find_check_match(struct ipt_entry_match *m,
const char *name, const char *name,
const struct ipt_ip *ip, const struct ipt_ip *ip,
...@@ -652,7 +658,7 @@ find_check_match(struct ipt_entry_match *m, ...@@ -652,7 +658,7 @@ find_check_match(struct ipt_entry_match *m,
return ret; return ret;
} }
static inline int check_target(struct ipt_entry *e, const char *name) static int check_target(struct ipt_entry *e, const char *name)
{ {
struct ipt_entry_target *t; struct ipt_entry_target *t;
struct xt_target *target; struct xt_target *target;
...@@ -673,7 +679,7 @@ static inline int check_target(struct ipt_entry *e, const char *name) ...@@ -673,7 +679,7 @@ static inline int check_target(struct ipt_entry *e, const char *name)
return ret; return ret;
} }
static inline int static int
find_check_entry(struct ipt_entry *e, const char *name, unsigned int size, find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
unsigned int *i) unsigned int *i)
{ {
...@@ -717,7 +723,7 @@ find_check_entry(struct ipt_entry *e, const char *name, unsigned int size, ...@@ -717,7 +723,7 @@ find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
return ret; return ret;
} }
static inline int static int
check_entry_size_and_hooks(struct ipt_entry *e, check_entry_size_and_hooks(struct ipt_entry *e,
struct xt_table_info *newinfo, struct xt_table_info *newinfo,
unsigned char *base, unsigned char *base,
...@@ -760,7 +766,7 @@ check_entry_size_and_hooks(struct ipt_entry *e, ...@@ -760,7 +766,7 @@ check_entry_size_and_hooks(struct ipt_entry *e,
return 0; return 0;
} }
static inline int static int
cleanup_entry(struct ipt_entry *e, unsigned int *i) cleanup_entry(struct ipt_entry *e, unsigned int *i)
{ {
struct ipt_entry_target *t; struct ipt_entry_target *t;
...@@ -916,7 +922,7 @@ get_counters(const struct xt_table_info *t, ...@@ -916,7 +922,7 @@ get_counters(const struct xt_table_info *t,
} }
} }
static inline struct xt_counters * alloc_counters(struct xt_table *table) static struct xt_counters * alloc_counters(struct xt_table *table)
{ {
unsigned int countersize; unsigned int countersize;
struct xt_counters *counters; struct xt_counters *counters;
...@@ -1304,7 +1310,7 @@ do_replace(void __user *user, unsigned int len) ...@@ -1304,7 +1310,7 @@ do_replace(void __user *user, unsigned int len)
/* We're lazy, and add to the first CPU; overflow works its fey magic /* We're lazy, and add to the first CPU; overflow works its fey magic
* and everything is OK. */ * and everything is OK. */
static inline int static int
add_counter_to_entry(struct ipt_entry *e, add_counter_to_entry(struct ipt_entry *e,
const struct xt_counters addme[], const struct xt_counters addme[],
unsigned int *i) unsigned int *i)
...@@ -1465,7 +1471,7 @@ compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr, ...@@ -1465,7 +1471,7 @@ compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
return ret; return ret;
} }
static inline int static int
compat_find_calc_match(struct ipt_entry_match *m, compat_find_calc_match(struct ipt_entry_match *m,
const char *name, const char *name,
const struct ipt_ip *ip, const struct ipt_ip *ip,
...@@ -1489,7 +1495,7 @@ compat_find_calc_match(struct ipt_entry_match *m, ...@@ -1489,7 +1495,7 @@ compat_find_calc_match(struct ipt_entry_match *m,
return 0; return 0;
} }
static inline int static int
compat_release_match(struct ipt_entry_match *m, unsigned int *i) compat_release_match(struct ipt_entry_match *m, unsigned int *i)
{ {
if (i && (*i)-- == 0) if (i && (*i)-- == 0)
...@@ -1499,7 +1505,7 @@ compat_release_match(struct ipt_entry_match *m, unsigned int *i) ...@@ -1499,7 +1505,7 @@ compat_release_match(struct ipt_entry_match *m, unsigned int *i)
return 0; return 0;
} }
static inline int static int
compat_release_entry(struct compat_ipt_entry *e, unsigned int *i) compat_release_entry(struct compat_ipt_entry *e, unsigned int *i)
{ {
struct ipt_entry_target *t; struct ipt_entry_target *t;
...@@ -1514,7 +1520,7 @@ compat_release_entry(struct compat_ipt_entry *e, unsigned int *i) ...@@ -1514,7 +1520,7 @@ compat_release_entry(struct compat_ipt_entry *e, unsigned int *i)
return 0; return 0;
} }
static inline int static int
check_compat_entry_size_and_hooks(struct compat_ipt_entry *e, check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
struct xt_table_info *newinfo, struct xt_table_info *newinfo,
unsigned int *size, unsigned int *size,
...@@ -1637,7 +1643,8 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr, ...@@ -1637,7 +1643,8 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
return ret; return ret;
} }
static inline int compat_check_entry(struct ipt_entry *e, const char *name, static int
compat_check_entry(struct ipt_entry *e, const char *name,
unsigned int *i) unsigned int *i)
{ {
int j, ret; int j, ret;
......
net/ipv6/netfilter/ip6_tables.c
View file @ 022748a9
...@@ -90,6 +90,7 @@ ip6t_ext_hdr(u8 nexthdr) ...@@ -90,6 +90,7 @@ ip6t_ext_hdr(u8 nexthdr)
} }
/* Returns whether matches rule or not. */ /* Returns whether matches rule or not. */
/* Performance critical - called for every packet */
static inline bool static inline bool
ip6_packet_match(const struct sk_buff *skb, ip6_packet_match(const struct sk_buff *skb,
const char *indev, const char *indev,
...@@ -182,7 +183,7 @@ ip6_packet_match(const struct sk_buff *skb, ...@@ -182,7 +183,7 @@ ip6_packet_match(const struct sk_buff *skb,
} }
/* should be ip6 safe */ /* should be ip6 safe */
static inline bool static bool
ip6_checkentry(const struct ip6t_ip6 *ipv6) ip6_checkentry(const struct ip6t_ip6 *ipv6)
{ {
if (ipv6->flags & ~IP6T_F_MASK) { if (ipv6->flags & ~IP6T_F_MASK) {
...@@ -212,8 +213,9 @@ ip6t_error(struct sk_buff *skb, ...@@ -212,8 +213,9 @@ ip6t_error(struct sk_buff *skb,
return NF_DROP; return NF_DROP;
} }
static inline /* Performance critical - called for every packet */
bool do_match(struct ip6t_entry_match *m, static inline bool
do_match(struct ip6t_entry_match *m,
const struct sk_buff *skb, const struct sk_buff *skb,
const struct net_device *in, const struct net_device *in,
const struct net_device *out, const struct net_device *out,
...@@ -236,6 +238,7 @@ get_entry(void *base, unsigned int offset) ...@@ -236,6 +238,7 @@ get_entry(void *base, unsigned int offset)
} }
/* All zeroes == unconditional rule. */ /* All zeroes == unconditional rule. */
/* Mildly perf critical (only if packet tracing is on) */
static inline int static inline int
unconditional(const struct ip6t_ip6 *ipv6) unconditional(const struct ip6t_ip6 *ipv6)
{ {
...@@ -251,7 +254,7 @@ unconditional(const struct ip6t_ip6 *ipv6) ...@@ -251,7 +254,7 @@ unconditional(const struct ip6t_ip6 *ipv6)
#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \ #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE) defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
/* This cries for unification! */ /* This cries for unification! */
static const char *hooknames[] = { static const char *const hooknames[] = {
[NF_INET_PRE_ROUTING] = "PREROUTING", [NF_INET_PRE_ROUTING] = "PREROUTING",
[NF_INET_LOCAL_IN] = "INPUT", [NF_INET_LOCAL_IN] = "INPUT",
[NF_INET_FORWARD] = "FORWARD", [NF_INET_FORWARD] = "FORWARD",
...@@ -265,7 +268,7 @@ enum nf_ip_trace_comments { ...@@ -265,7 +268,7 @@ enum nf_ip_trace_comments {
NF_IP6_TRACE_COMMENT_POLICY, NF_IP6_TRACE_COMMENT_POLICY,
}; };
static const char *comments[] = { static const char *const comments[] = {
[NF_IP6_TRACE_COMMENT_RULE] = "rule", [NF_IP6_TRACE_COMMENT_RULE] = "rule",
[NF_IP6_TRACE_COMMENT_RETURN] = "return", [NF_IP6_TRACE_COMMENT_RETURN] = "return",
[NF_IP6_TRACE_COMMENT_POLICY] = "policy", [NF_IP6_TRACE_COMMENT_POLICY] = "policy",
...@@ -281,6 +284,7 @@ static struct nf_loginfo trace_loginfo = { ...@@ -281,6 +284,7 @@ static struct nf_loginfo trace_loginfo = {
}, },
}; };
/* Mildly perf critical (only if packet tracing is on) */
static inline int static inline int
get_chainname_rulenum(struct ip6t_entry *s, struct ip6t_entry *e, get_chainname_rulenum(struct ip6t_entry *s, struct ip6t_entry *e,
char *hookname, char **chainname, char *hookname, char **chainname,
...@@ -595,7 +599,7 @@ mark_source_chains(struct xt_table_info *newinfo, ...@@ -595,7 +599,7 @@ mark_source_chains(struct xt_table_info *newinfo,
return 1; return 1;
} }
static inline int static int
cleanup_match(struct ip6t_entry_match *m, unsigned int *i) cleanup_match(struct ip6t_entry_match *m, unsigned int *i)
{ {
if (i && (*i)-- == 0) if (i && (*i)-- == 0)
...@@ -607,7 +611,7 @@ cleanup_match(struct ip6t_entry_match *m, unsigned int *i) ...@@ -607,7 +611,7 @@ cleanup_match(struct ip6t_entry_match *m, unsigned int *i)
return 0; return 0;
} }
static inline int static int
check_entry(struct ip6t_entry *e, const char *name) check_entry(struct ip6t_entry *e, const char *name)
{ {
struct ip6t_entry_target *t; struct ip6t_entry_target *t;
...@@ -628,7 +632,7 @@ check_entry(struct ip6t_entry *e, const char *name) ...@@ -628,7 +632,7 @@ check_entry(struct ip6t_entry *e, const char *name)
return 0; return 0;
} }
static inline int check_match(struct ip6t_entry_match *m, const char *name, static int check_match(struct ip6t_entry_match *m, const char *name,
const struct ip6t_ip6 *ipv6, const struct ip6t_ip6 *ipv6,
unsigned int hookmask, unsigned int *i) unsigned int hookmask, unsigned int *i)
{ {
...@@ -651,7 +655,7 @@ static inline int check_match(struct ip6t_entry_match *m, const char *name, ...@@ -651,7 +655,7 @@ static inline int check_match(struct ip6t_entry_match *m, const char *name,
return ret; return ret;
} }
static inline int static int
find_check_match(struct ip6t_entry_match *m, find_check_match(struct ip6t_entry_match *m,
const char *name, const char *name,
const struct ip6t_ip6 *ipv6, const struct ip6t_ip6 *ipv6,
...@@ -680,7 +684,7 @@ find_check_match(struct ip6t_entry_match *m, ...@@ -680,7 +684,7 @@ find_check_match(struct ip6t_entry_match *m,
return ret; return ret;
} }
static inline int check_target(struct ip6t_entry *e, const char *name) static int check_target(struct ip6t_entry *e, const char *name)
{ {
struct ip6t_entry_target *t; struct ip6t_entry_target *t;
struct xt_target *target; struct xt_target *target;
...@@ -701,7 +705,7 @@ static inline int check_target(struct ip6t_entry *e, const char *name) ...@@ -701,7 +705,7 @@ static inline int check_target(struct ip6t_entry *e, const char *name)
return ret; return ret;
} }
static inline int static int
find_check_entry(struct ip6t_entry *e, const char *name, unsigned int size, find_check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
unsigned int *i) unsigned int *i)
{ {
...@@ -745,7 +749,7 @@ find_check_entry(struct ip6t_entry *e, const char *name, unsigned int size, ...@@ -745,7 +749,7 @@ find_check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
return ret; return ret;
} }
static inline int static int
check_entry_size_and_hooks(struct ip6t_entry *e, check_entry_size_and_hooks(struct ip6t_entry *e,
struct xt_table_info *newinfo, struct xt_table_info *newinfo,
unsigned char *base, unsigned char *base,
...@@ -788,7 +792,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e, ...@@ -788,7 +792,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
return 0; return 0;
} }
static inline int static int
cleanup_entry(struct ip6t_entry *e, unsigned int *i) cleanup_entry(struct ip6t_entry *e, unsigned int *i)
{ {
struct ip6t_entry_target *t; struct ip6t_entry_target *t;
...@@ -944,7 +948,7 @@ get_counters(const struct xt_table_info *t, ...@@ -944,7 +948,7 @@ get_counters(const struct xt_table_info *t,
} }
} }
static inline struct xt_counters *alloc_counters(struct xt_table *table) static struct xt_counters *alloc_counters(struct xt_table *table)
{ {
unsigned int countersize; unsigned int countersize;
struct xt_counters *counters; struct xt_counters *counters;
...@@ -1494,7 +1498,7 @@ compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr, ...@@ -1494,7 +1498,7 @@ compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
return ret; return ret;
} }
static inline int static int
compat_find_calc_match(struct ip6t_entry_match *m, compat_find_calc_match(struct ip6t_entry_match *m,
const char *name, const char *name,
const struct ip6t_ip6 *ipv6, const struct ip6t_ip6 *ipv6,
...@@ -1518,7 +1522,7 @@ compat_find_calc_match(struct ip6t_entry_match *m, ...@@ -1518,7 +1522,7 @@ compat_find_calc_match(struct ip6t_entry_match *m,
return 0; return 0;
} }
static inline int static int
compat_release_match(struct ip6t_entry_match *m, unsigned int *i) compat_release_match(struct ip6t_entry_match *m, unsigned int *i)
{ {
if (i && (*i)-- == 0) if (i && (*i)-- == 0)
...@@ -1528,7 +1532,7 @@ compat_release_match(struct ip6t_entry_match *m, unsigned int *i) ...@@ -1528,7 +1532,7 @@ compat_release_match(struct ip6t_entry_match *m, unsigned int *i)
return 0; return 0;
} }
static inline int static int
compat_release_entry(struct compat_ip6t_entry *e, unsigned int *i) compat_release_entry(struct compat_ip6t_entry *e, unsigned int *i)
{ {
struct ip6t_entry_target *t; struct ip6t_entry_target *t;
...@@ -1543,7 +1547,7 @@ compat_release_entry(struct compat_ip6t_entry *e, unsigned int *i) ...@@ -1543,7 +1547,7 @@ compat_release_entry(struct compat_ip6t_entry *e, unsigned int *i)
return 0; return 0;
} }
static inline int static int
check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e, check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
struct xt_table_info *newinfo, struct xt_table_info *newinfo,
unsigned int *size, unsigned int *size,
...@@ -1666,7 +1670,7 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr, ...@@ -1666,7 +1670,7 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
return ret; return ret;
} }
static inline int compat_check_entry(struct ip6t_entry *e, const char *name, static int compat_check_entry(struct ip6t_entry *e, const char *name,
unsigned int *i) unsigned int *i)
{ {
int j, ret; int j, ret;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7