• Pablo Neira Ayuso's avatar
    netfilter: nf_tables: add register tracking infrastructure · 12e4ecfa
    Pablo Neira Ayuso authored
    This patch adds new infrastructure to skip redundant selector store
    operations on the same register to achieve a performance boost from
    the packet path.
    
    This is particularly noticeable in pure linear rulesets but it also
    helps in rulesets which are already heaving relying in maps to avoid
    ruleset linear inspection.
    
    The idea is to keep data of the most recurrent store operations on
    register to reuse them with cmp and lookup expressions.
    
    This infrastructure allows for dynamic ruleset updates since the ruleset
    blob reduction happens from the kernel.
    
    Userspace still needs to be updated to maximize register utilization to
    cooperate to improve register data reuse / reduce number of store on
    register operations.
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    12e4ecfa
nf_tables_api.c 240 KB