netfilter: share one hook among the instances of a percpu script

[lneto]

On master, with the percpu object (#772), the runner (#762) and the lookup (#780) merged: a percpu script registers one netfilter hook, shared by its instances.

netfilter.register refused a percpu instance because each instance would have registered its own nf_hook_ops and every packet would have been handled once per instance. The hook now belongs to the object the instances share: the first registration of a pf, hooknum and priority installs it, with the percpu object as the runtime, so lunatik_run resolves the instance of the CPU the packet arrived on; the others attach their callbacks, each found through its own registry by the hook they share. The hook goes with the last registration. A plain runtime registers as before, one hook per call, and a second registration of the same hook in one instance is refused. Exactly-once is structural: there is one hook.

The first commit gives an instance the object that owns it, next to its CPU id in the state, which is what lets a binding register for the object rather than the instance.

Tests: tests/runtime/percpu_netfilter counts marked ping requests through the shared hook with the ping pinned to the last online CPU, where the loopback delivers it: exactly COUNT, on the instance of that CPU; the duplicate registration; the plain runtime. With one hook per instance, as before, every instance counts the requests and the case fails; a hook that fires for an instance that did not register it is a failure too. The netfilter cases leave percpu_refuse, which keeps device.new.

Tested on 6.8.0-136 and, after a host reboot, 6.8.0-138 (aarch64): runtime, skb, xdp and tc suites, clean dmesg. The fixup adds the mark to the identity of a shared hook, so instances registering different marks get different hooks.

🤖 Generated with Claude Code