History

netfilter: nf_tables: add register tracking infrastructure

This patch adds new infrastructure to skip redundant selector store operations on the same register to achieve a performance boost from the packet path. This is particularly noticeable in pure linear rulesets but it also helps in rulesets which are already heaving relying in maps to avoid ruleset linear inspection. The idea is to keep data of the most recurrent store operations on register to reuse them with cmp and lookup expressions. This infrastructure allows for dynamic ruleset updates since the ruleset blob reduction happens from the kernel. Userspace still needs to be updated to maximize register utilization to cooperate to improve register data reuse / reduce number of store on register operations.

Pablo Neira Ayuso committed 4 years ago

Commit 12e4ecf1 parent 642c8ef2 files · +23 −0Browse files

Showing the changes to include (1 of 2 files). Show all

Unified · Split

include/net/netfilter/nf_tables.h+12−0
@@ -122,6 +122,16 @@ struct nft_regs { · 121 unmodified lines
122122 };
123123 };
124124
125+struct nft_regs_track {
126+ struct {
127+ const struct nft_expr *selector;
128+ const struct nft_expr *bitwise;
129+ } regs[NFT_REG32_NUM];
130+
131+ const struct nft_expr *cur;
132+ const struct nft_expr *last;
133+};
134+
125135 /* Store/load an u8, u16 or u64 integer to/from the u32 data register.
126136 *
127137 * Note, when using concatenations, register allocation happens at 32-bit
@@ -886,6 +896,8 @@ struct nft_expr_ops { · 758 unmodified lines
886896 int (*validate)(const struct nft_ctx *ctx,
887897 const struct nft_expr *expr,
888898 const struct nft_data **data);
899+ bool (*reduce)(struct nft_regs_track *track,
900+ const struct nft_expr *expr);
889901 bool (*gc)(struct net *net,
890902 const struct nft_expr *expr);
891903 int (*offload)(struct nft_offload_ctx *ctx,

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t