Re: [PATCH RFC nf-next 00/12] netfilter: ipset: convert to rhashtable

Hi Florian,

Thank you your hard work on converting from hash-array to rhashtable! In 
the next days I'll go through the whole patchset.

Best regards,
Jozsef

On Tue, 14 Jul 2026, Florian Westphal wrote:

> Hi,
>
> This is an initial RFC patchset to convert the hash types to rhashtable.
> Main conversion is in patch 8.  First patches contain small drive-by
> fixes, patches after 8 contain further simplifications/cleanups.
> Last patch adds back the FORCEADD support dropped in the conversion
> commit (diff was getting too large...).
>
> The next step is to go through the ipset test failures and figure out
> which ones hint at actual bugs and which ones are just harmless cosmetic
> issues (that could be suppressed by tinkering with diff.sh in ipset tests).
>
> Notable likely valid remaining bugs:
> - iphash: IP: Compare sorted save and restore: [..] FAILED
> - hash:net,iface.t: Check 10.0.1.1 with eth0:
> Failed test: ../src/ipset [..] 10.0.1.1,eth0
> Warning: 10.0.1.1,eth0 is in set test.
>
> I'd like to eventually get rid of more set->lock places, remove all
> usage of rcu_dereference_protected(.. , 1), but thats not too urgent
> atm.
>
> 1) Rework ipset CIDR bookkeeping.  I had to remove this one from the last
> nf batch at the last minute because of a buildbot report. See next patch.
>
> 2) Fix a few nits in patch 1), to be squash-merged.
>
> 3) Add small wrappers for hash and bucket sizes to reduce noise in the
> actual conversion patch.
>
> 4) add and use tmtype_del_cidr_all helper to simplify the upcoming
> rewrite.
>
> 5) Use ip_set_init_comment_slow to prevent race conditions in hash ipset
> types. Add lockdep annotations.
>
> 6) Same as 5, but for remove: adds ip_set_ext_destroy_slow.
>
> 7) Add rhashtable boilerplate stubs to ipset. Initialize and destroy the
> rhashtable without ever adding elements.
>
> 8) Replace ipset's internal hash table with rhashtable.  FORCEADD is
> removed here, and added back in last patch.
>
> 9) Use plain rcu_read_lock, not _bh variants.
>
> 10) Better lockdep annotations in ipset_dereference. Add assertions to
> more places.
>
> 11) Remove the last region lock usage in ipset. Move lock responsibility to
> kadt, uadt, and flush callbacks.
>
> 12) Re-add forceadd support for rhashtable in ipset. Implement
> mtype_remove_random() to evict elements when the set is full.
>
> Florian Westphal (11):
>  netfilter: ipset: rework cidr bookkeeping fixups
>  netfilter: ipset: add small wrappers for hash and bucket sizes
>  netfilter: ipset: add and use mtype_del_cidr_all helper
>  netfilter: ipset: add and use ip_set_init_comment_slow
>  netfilter: ipset: add and use ip_set_ext_destroy_slow
>  netfilter: ipset: add rhashtable boilerplate stubs
>  netfilter: ipset: replace internal hash table with rhashtable
>  netfilter: ipset: use plain rcu_read_lock
>  netfilter: ipset: use correct lockdep annotation in ipset_dereference
>  netfilter: ipset: remove last region lock usage
>  netfilter: ipset: re-add forceadd support for rhashtable
>
> Jozsef Kadlecsik (1):
>  netfilter: ipset: rework cidr bookkeeping
>
> include/linux/netfilter/ipset/ip_set.h       |   44 +-
> net/netfilter/ipset/ip_set_bitmap_gen.h      |    6 +
> net/netfilter/ipset/ip_set_bitmap_ip.c       |   11 +-
> net/netfilter/ipset/ip_set_bitmap_ipmac.c    |    9 +-
> net/netfilter/ipset/ip_set_bitmap_port.c     |   11 +-
> net/netfilter/ipset/ip_set_core.c            |   35 +-
> net/netfilter/ipset/ip_set_hash_gen.h        | 1552 ++++++------------
> net/netfilter/ipset/ip_set_hash_ipportnet.c  |    4 +-
> net/netfilter/ipset/ip_set_hash_net.c        |    4 +-
> net/netfilter/ipset/ip_set_hash_netiface.c   |    4 +-
> net/netfilter/ipset/ip_set_hash_netnet.c     |   12 +-
> net/netfilter/ipset/ip_set_hash_netport.c    |    4 +-
> net/netfilter/ipset/ip_set_hash_netportnet.c |   12 +-
> net/netfilter/ipset/ip_set_list_set.c        |   13 +
> 14 files changed, 629 insertions(+), 1092 deletions(-)
>
> -- 
> 2.54.0
>