diff options
| author | Florian Westphal <fw@strlen.de> | 2023-01-03 13:47:17 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2023-01-18 13:05:25 +0100 |
| commit | d9e7891476057b24a1acbf10a491e5b9a1c4ae77 (patch) | |
| tree | e423897435657e7f0b9a485043b5cedb922fd776 /net/netfilter/Makefile | |
| parent | 2032e907d8d498fcabfe24b43550c50947817c6d (diff) | |
netfilter: nf_tables: avoid retpoline overhead for some ct expression calls
nft_ct expression cannot be made builtin to nf_tables without also
forcing the conntrack itself to be builtin.
However, this can be avoided by splitting retrieval of a few
selector keys that only need to access the nf_conn structure,
i.e. no function calls to nf_conntrack code.
Many rulesets start with something like
"ct status established,related accept"
With this change, this no longer requires an indirect call, which
gives about 1.8% more throughput with a simple conntrack-enabled
forwarding test (retpoline thunk used).
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'net/netfilter/Makefile')
| -rw-r--r-- | net/netfilter/Makefile | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile index 3754eb06fb41..ba2a6b5e93d9 100644 --- a/net/netfilter/Makefile +++ b/net/netfilter/Makefile @@ -98,6 +98,12 @@ nf_tables-objs += nft_set_pipapo_avx2.o endif endif +ifdef CONFIG_NFT_CT +ifdef CONFIG_RETPOLINE +nf_tables-objs += nft_ct_fast.o +endif +endif + obj-$(CONFIG_NF_TABLES) += nf_tables.o obj-$(CONFIG_NFT_COMPAT) += nft_compat.o obj-$(CONFIG_NFT_CONNLIMIT) += nft_connlimit.o |