• Florian Westphal's avatar
    netfilter: nf_tables: avoid retpoline overhead for some ct expression calls · d9e78914
    Florian Westphal authored
    nft_ct expression cannot be made builtin to nf_tables without also
    forcing the conntrack itself to be builtin.
    
    However, this can be avoided by splitting retrieval of a few
    selector keys that only need to access the nf_conn structure,
    i.e. no function calls to nf_conntrack code.
    
    Many rulesets start with something like
    "ct status established,related accept"
    
    With this change, this no longer requires an indirect call, which
    gives about 1.8% more throughput with a simple conntrack-enabled
    forwarding test (retpoline thunk used).
    Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
    d9e78914
Makefile 9.53 KB