netfilter: nf_tables: add register tracking infrastructure

This patch adds new infrastructure to skip redundant selector store operations on the same register to achieve a performance boost from the packet path. This is particularly noticeable in pure linear rulesets but it also helps in rulesets which are already heaving relying in maps to avoid ruleset linear inspection. The idea is to keep data of the most recurrent store operations on register to reuse them with cmp and lookup expressions. This infrastructure allows for dynamic ruleset updates since the ruleset blob reduction happens from the kernel. Userspace still needs to be updated to maximize register utilization to cooperate to improve register data reuse / reduce number of store on register operations.

Pablo Neira Ayuso committed 4 years ago

Commit 12e4ecf1 parent 642c8ef2 files · +23 −0Browse files

Unified · Split

2 files

include/net/netfilter/nf_tables.h +12 −0
net/netfilter/nf_tables_api.c +11 −0

include/net/netfilter/nf_tables.h+12−0

@@ -122,6 +122,16 @@ struct nft_regs { · 121 unmodified lines
122	122	};
123	123	};
124	124
	125	+struct nft_regs_track {
	126	+ struct {
	127	+ const struct nft_expr *selector;
	128	+ const struct nft_expr *bitwise;
	129	+ } regs[NFT_REG32_NUM];
	130	+
	131	+ const struct nft_expr *cur;
	132	+ const struct nft_expr *last;
	133	+};
	134	+
125	135	/* Store/load an u8, u16 or u64 integer to/from the u32 data register.
126	136	*
127	137	* Note, when using concatenations, register allocation happens at 32-bit
@@ -886,6 +896,8 @@ struct nft_expr_ops { · 758 unmodified lines
886	896	int (validate)(const struct nft_ctx ctx,
887	897	const struct nft_expr *expr,
888	898	const struct nft_data **data);
	899	+ bool (reduce)(struct nft_regs_track track,
	900	+ const struct nft_expr *expr);
889	901	bool (gc)(struct net net,
890	902	const struct nft_expr *expr);
891	903	int (offload)(struct nft_offload_ctx ctx,

net/netfilter/nf_tables_api.c+11−0

@@ -8259,6 +8259,7 @@ EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work); · 8258 unmodified lines
8259	8259	static int nf_tables_commit_chain_prepare(struct net net, struct nft_chain chain)
8260	8260	{
8261	8261	const struct nft_expr expr, last;
	8262	+ struct nft_regs_track track = {};
8262	8263	unsigned int size, data_size;
8263	8264	void data, data_boundary;
8264	8265	struct nft_rule_dp *prule;
@@ -8298,7 +8299,17 @@ static int nf_tables_commit_chain_prepare(struct net net, struct nft_chain cha · 33 unmodified lines
8298	8299	if (WARN_ON_ONCE(data > data_boundary))
8299	8300	return -ENOMEM;
8300	8301
	8302	+ size = 0;
	8303	+ track.last = last;
8301	8304	nft_rule_for_each_expr(expr, last, rule) {
	8305	+ track.cur = expr;
	8306	+
	8307	+ if (expr->ops->reduce &&
	8308	+ expr->ops->reduce(&track, expr)) {
	8309	+ expr = track.cur;
	8310	+ continue;
	8311	+ }
	8312	+
8302	8313	if (WARN_ON_ONCE(data + expr->ops->size > data_boundary))
8303	8314	return -ENOMEM;
8304	8315

netfilter: nf_tables: add register tracking infrastructure

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code