netfilter: nf_tables: avoid retpoline overhead for some ct expression calls

Browse source

nft_ct expression cannot be made builtin to nf_tables without also
forcing the conntrack itself to be builtin.

However, this can be avoided by splitting retrieval of a few
selector keys that only need to access the nf_conn structure,
i.e. no function calls to nf_conntrack code.

Many rulesets start with something like
"ct status established,related accept"

With this change, this no longer requires an indirect call, which
gives about 1.8% more throughput with a simple conntrack-enabled
forwarding test (retpoline thunk used).

Signed-off-by: Florian Westphal <fw@strlen.de>

...

This commit is contained in:

Florian Westphal 2023-01-03 13:47:17 +01:00

parent 2032e907d8

commit d9e7891476

5 changed files with 104 additions and 12 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

12

include/net/netfilter/nf_tables_core.h

View file

6

net/netfilter/Makefile

View file

3

net/netfilter/nf_tables_core.c

View file

39

net/netfilter/nft_ct.c

View file

56

net/netfilter/nft_ct_fast.c

View file