path: root/net/netfilter
diff options
authorPablo Neira Ayuso <pablo@netfilter.org>2022-01-09 17:11:21 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2022-01-09 23:35:17 +0100
commit12e4ecfa244be2f117ef5304d2d866b65e70bff3 (patch)
tree1deb284a2e6bfd58e9ff3fe6a7153dbd05615c43 /net/netfilter
parentnetfilter: nf_tables: add NFT_REG32_NUM (diff)
netfilter: nf_tables: add register tracking infrastructure
This patch adds new infrastructure to skip redundant selector store operations on the same register to achieve a performance boost from the packet path. This is particularly noticeable in pure linear rulesets but it also helps in rulesets which are already heaving relying in maps to avoid ruleset linear inspection. The idea is to keep data of the most recurrent store operations on register to reuse them with cmp and lookup expressions. This infrastructure allows for dynamic ruleset updates since the ruleset blob reduction happens from the kernel. Userspace still needs to be updated to maximize register utilization to cooperate to improve register data reuse / reduce number of store on register operations. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter')
1 files changed, 11 insertions, 0 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 2317429ea35e..83ce82212cbb 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -8259,6 +8259,7 @@ EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work);
static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
const struct nft_expr *expr, *last;
+ struct nft_regs_track track = {};
unsigned int size, data_size;
void *data, *data_boundary;
struct nft_rule_dp *prule;
@@ -8298,7 +8299,17 @@ static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *cha
if (WARN_ON_ONCE(data > data_boundary))
return -ENOMEM;
+ size = 0;
+ track.last = last;
nft_rule_for_each_expr(expr, last, rule) {
+ track.cur = expr;
+ if (expr->ops->reduce &&
+ expr->ops->reduce(&track, expr)) {
+ expr = track.cur;
+ continue;
+ }
if (WARN_ON_ONCE(data + expr->ops->size > data_boundary))
return -ENOMEM;