From patchwork Fri Apr 14 13:01:31 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 1768998 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4Pyc625GTCz1yZr for ; Fri, 14 Apr 2023 23:01:46 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229450AbjDNNBp (ORCPT ); Fri, 14 Apr 2023 09:01:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46096 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229778AbjDNNBp (ORCPT ); Fri, 14 Apr 2023 09:01:45 -0400 Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [IPv6:2a0a:51c0:0:237:300::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 57CCA1BFD for ; Fri, 14 Apr 2023 06:01:44 -0700 (PDT) Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1pnJ3e-0001qZ-Tn; Fri, 14 Apr 2023 15:01:42 +0200 From: Florian Westphal To: Cc: Florian Westphal Subject: [PATCH nf-next 1/4] netfilter: nf_tables: remove unneeded conditional Date: Fri, 14 Apr 2023 15:01:31 +0200 Message-Id: <20230414130134.29040-2-fw@strlen.de> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230414130134.29040-1-fw@strlen.de> References: <20230414130134.29040-1-fw@strlen.de> MIME-Version: 1.0 X-Spam-Status: No, score=-4.0 required=5.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_MED,SPF_HELO_PASS,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org This helper is inlined, so keep it as small as possible. If the static key is true, there is only a very small chance that info->trace is false: 1. tracing was enabled at this very moment, the static key was updated to active right after nft_do_table was called. 2. tracing was disabled at this very moment. trace->info is already false, the static key is about to be patched to false soon. In both cases, no event will be sent because info->trace is false (checked in noinline slowpath). info->nf_trace is irrelevant. The nf_trace update is redunant in this case, but this will only happen for short duration, when static key flips. text data bss dec hex filename old: 2980 192 32 3204 c84 nf_tables_core.o new: 2964 192 32 3188 c74i nf_tables_core.o Signed-off-by: Florian Westphal --- net/netfilter/nf_tables_core.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c index 89c05b64c2a2..bed855638050 100644 --- a/net/netfilter/nf_tables_core.c +++ b/net/netfilter/nf_tables_core.c @@ -67,10 +67,8 @@ static inline void nft_trace_packet(const struct nft_pktinfo *pkt, static inline void nft_trace_copy_nftrace(const struct nft_pktinfo *pkt, struct nft_traceinfo *info) { - if (static_branch_unlikely(&nft_trace_enabled)) { - if (info->trace) - info->nf_trace = pkt->skb->nf_trace; - } + if (static_branch_unlikely(&nft_trace_enabled)) + info->nf_trace = pkt->skb->nf_trace; } static void nft_bitwise_fast_eval(const struct nft_expr *expr, From patchwork Fri Apr 14 13:01:32 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 1768999 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4Pyc671zxtz1yZr for ; Fri, 14 Apr 2023 23:01:51 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229870AbjDNNBu (ORCPT ); Fri, 14 Apr 2023 09:01:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46124 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229778AbjDNNBt (ORCPT ); Fri, 14 Apr 2023 09:01:49 -0400 Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [IPv6:2a0a:51c0:0:237:300::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 76C6A1BFD for ; Fri, 14 Apr 2023 06:01:48 -0700 (PDT) Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1pnJ3j-0001qq-2D; Fri, 14 Apr 2023 15:01:47 +0200 From: Florian Westphal To: Cc: Florian Westphal Subject: [PATCH nf-next 2/4] netfilter: nf_tables: do not store pktinfo in traceinfo structure Date: Fri, 14 Apr 2023 15:01:32 +0200 Message-Id: <20230414130134.29040-3-fw@strlen.de> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230414130134.29040-1-fw@strlen.de> References: <20230414130134.29040-1-fw@strlen.de> MIME-Version: 1.0 X-Spam-Status: No, score=-4.0 required=5.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_MED,SPF_HELO_PASS,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org pass it as argument. No change in object size. stack usage decreases by 8 byte: nf_tables_core.c:254 nft_do_chain 320 static Signed-off-by: Florian Westphal --- include/net/netfilter/nf_tables.h | 5 ++--- net/netfilter/nf_tables_core.c | 21 ++++++++++++--------- net/netfilter/nf_tables_trace.c | 5 ++--- 3 files changed, 16 insertions(+), 15 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index 7b9f141120a1..298e9faa647b 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -1402,7 +1402,6 @@ void nft_unregister_flowtable_type(struct nf_flowtable_type *type); * @type: event type (enum nft_trace_types) * @skbid: hash of skb to be used as trace id * @packet_dumped: packet headers sent in a previous traceinfo message - * @pkt: pktinfo currently processed * @basechain: base chain currently processed * @rule: rule that was evaluated * @verdict: verdict given by rule @@ -1413,7 +1412,6 @@ struct nft_traceinfo { bool packet_dumped; enum nft_trace_types type:8; u32 skbid; - const struct nft_pktinfo *pkt; const struct nft_base_chain *basechain; const struct nft_rule_dp *rule; const struct nft_verdict *verdict; @@ -1423,7 +1421,8 @@ void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt, const struct nft_verdict *verdict, const struct nft_chain *basechain); -void nft_trace_notify(struct nft_traceinfo *info); +void nft_trace_notify(const struct nft_pktinfo *pkt, + struct nft_traceinfo *info); #define MODULE_ALIAS_NFT_CHAIN(family, name) \ MODULE_ALIAS("nft-chain-" __stringify(family) "-" name) diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c index bed855638050..776eb2b9f632 100644 --- a/net/netfilter/nf_tables_core.c +++ b/net/netfilter/nf_tables_core.c @@ -41,7 +41,8 @@ static inline bool nf_skip_indirect_calls(void) { return false; } static inline void nf_skip_indirect_calls_enable(void) { } #endif -static noinline void __nft_trace_packet(struct nft_traceinfo *info, +static noinline void __nft_trace_packet(const struct nft_pktinfo *pkt, + struct nft_traceinfo *info, enum nft_trace_types type) { if (!info->trace || !info->nf_trace) @@ -49,7 +50,7 @@ static noinline void __nft_trace_packet(struct nft_traceinfo *info, info->type = type; - nft_trace_notify(info); + nft_trace_notify(pkt, info); } static inline void nft_trace_packet(const struct nft_pktinfo *pkt, @@ -60,7 +61,7 @@ static inline void nft_trace_packet(const struct nft_pktinfo *pkt, if (static_branch_unlikely(&nft_trace_enabled)) { info->nf_trace = pkt->skb->nf_trace; info->rule = rule; - __nft_trace_packet(info, type); + __nft_trace_packet(pkt, info, type); } } @@ -105,7 +106,8 @@ static void nft_cmp16_fast_eval(const struct nft_expr *expr, regs->verdict.code = NFT_BREAK; } -static noinline void __nft_trace_verdict(struct nft_traceinfo *info, +static noinline void __nft_trace_verdict(const struct nft_pktinfo *pkt, + struct nft_traceinfo *info, const struct nft_regs *regs) { enum nft_trace_types type; @@ -123,20 +125,21 @@ static noinline void __nft_trace_verdict(struct nft_traceinfo *info, type = NFT_TRACETYPE_RULE; if (info->trace) - info->nf_trace = info->pkt->skb->nf_trace; + info->nf_trace = pkt->skb->nf_trace; break; } - __nft_trace_packet(info, type); + __nft_trace_packet(pkt, info, type); } -static inline void nft_trace_verdict(struct nft_traceinfo *info, +static inline void nft_trace_verdict(const struct nft_pktinfo *pkt, + struct nft_traceinfo *info, const struct nft_rule_dp *rule, const struct nft_regs *regs) { if (static_branch_unlikely(&nft_trace_enabled)) { info->rule = rule; - __nft_trace_verdict(info, regs); + __nft_trace_verdict(pkt, info, regs); } } @@ -300,7 +303,7 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) break; } - nft_trace_verdict(&info, rule, ®s); + nft_trace_verdict(pkt, &info, rule, ®s); switch (regs.verdict.code & NF_VERDICT_MASK) { case NF_ACCEPT: diff --git a/net/netfilter/nf_tables_trace.c b/net/netfilter/nf_tables_trace.c index 3d9b83d84a84..0a0dcf2587fd 100644 --- a/net/netfilter/nf_tables_trace.c +++ b/net/netfilter/nf_tables_trace.c @@ -183,9 +183,9 @@ static const struct nft_chain *nft_trace_get_chain(const struct nft_traceinfo *i return last->chain; } -void nft_trace_notify(struct nft_traceinfo *info) +void nft_trace_notify(const struct nft_pktinfo *pkt, + struct nft_traceinfo *info) { - const struct nft_pktinfo *pkt = info->pkt; const struct nft_chain *chain; struct nlmsghdr *nlh; struct sk_buff *skb; @@ -305,7 +305,6 @@ void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt, info->trace = true; info->nf_trace = pkt->skb->nf_trace; info->packet_dumped = false; - info->pkt = pkt; info->verdict = verdict; net_get_random_once(&trace_key, sizeof(trace_key)); From patchwork Fri Apr 14 13:01:33 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 1769000 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4Pyc6D4MVQz1yZr for ; Fri, 14 Apr 2023 23:01:56 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229820AbjDNNBz (ORCPT ); Fri, 14 Apr 2023 09:01:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46162 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229778AbjDNNBy (ORCPT ); Fri, 14 Apr 2023 09:01:54 -0400 Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [IPv6:2a0a:51c0:0:237:300::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 857C83A84 for ; Fri, 14 Apr 2023 06:01:52 -0700 (PDT) Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1pnJ3n-0001r8-5d; Fri, 14 Apr 2023 15:01:51 +0200 From: Florian Westphal To: Cc: Florian Westphal Subject: [PATCH nf-next 3/4] netfilter: nf_tables: do not store verdict in traceinfo structure Date: Fri, 14 Apr 2023 15:01:33 +0200 Message-Id: <20230414130134.29040-4-fw@strlen.de> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230414130134.29040-1-fw@strlen.de> References: <20230414130134.29040-1-fw@strlen.de> MIME-Version: 1.0 X-Spam-Status: No, score=-4.0 required=5.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_MED,SPF_HELO_PASS,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Just pass it as argument to nft_trace_notify. Stack is reduced by 8 bytes: nf_tables_core.c:256 nft_do_chain 312 static Signed-off-by: Florian Westphal --- include/net/netfilter/nf_tables.h | 4 +--- net/netfilter/nf_tables_core.c | 14 ++++++++------ net/netfilter/nf_tables_trace.c | 21 +++++++++++---------- 3 files changed, 20 insertions(+), 19 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index 298e9faa647b..a11fde72c87e 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -1404,7 +1404,6 @@ void nft_unregister_flowtable_type(struct nf_flowtable_type *type); * @packet_dumped: packet headers sent in a previous traceinfo message * @basechain: base chain currently processed * @rule: rule that was evaluated - * @verdict: verdict given by rule */ struct nft_traceinfo { bool trace; @@ -1414,14 +1413,13 @@ struct nft_traceinfo { u32 skbid; const struct nft_base_chain *basechain; const struct nft_rule_dp *rule; - const struct nft_verdict *verdict; }; void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt, - const struct nft_verdict *verdict, const struct nft_chain *basechain); void nft_trace_notify(const struct nft_pktinfo *pkt, + const struct nft_verdict *verdict, struct nft_traceinfo *info); #define MODULE_ALIAS_NFT_CHAIN(family, name) \ diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c index 776eb2b9f632..6debe8b2623f 100644 --- a/net/netfilter/nf_tables_core.c +++ b/net/netfilter/nf_tables_core.c @@ -42,6 +42,7 @@ static inline void nf_skip_indirect_calls_enable(void) { } #endif static noinline void __nft_trace_packet(const struct nft_pktinfo *pkt, + const struct nft_verdict *verdict, struct nft_traceinfo *info, enum nft_trace_types type) { @@ -50,10 +51,11 @@ static noinline void __nft_trace_packet(const struct nft_pktinfo *pkt, info->type = type; - nft_trace_notify(pkt, info); + nft_trace_notify(pkt, verdict, info); } static inline void nft_trace_packet(const struct nft_pktinfo *pkt, + struct nft_verdict *verdict, struct nft_traceinfo *info, const struct nft_rule_dp *rule, enum nft_trace_types type) @@ -61,7 +63,7 @@ static inline void nft_trace_packet(const struct nft_pktinfo *pkt, if (static_branch_unlikely(&nft_trace_enabled)) { info->nf_trace = pkt->skb->nf_trace; info->rule = rule; - __nft_trace_packet(pkt, info, type); + __nft_trace_packet(pkt, verdict, info, type); } } @@ -129,7 +131,7 @@ static noinline void __nft_trace_verdict(const struct nft_pktinfo *pkt, break; } - __nft_trace_packet(pkt, info, type); + __nft_trace_packet(pkt, ®s->verdict, info, type); } static inline void nft_trace_verdict(const struct nft_pktinfo *pkt, @@ -264,7 +266,7 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) info.trace = false; if (static_branch_unlikely(&nft_trace_enabled)) - nft_trace_init(&info, pkt, ®s.verdict, basechain); + nft_trace_init(&info, pkt, basechain); do_chain: if (genbit) blob = rcu_dereference(chain->blob_gen_1); @@ -296,7 +298,7 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) nft_trace_copy_nftrace(pkt, &info); continue; case NFT_CONTINUE: - nft_trace_packet(pkt, &info, rule, + nft_trace_packet(pkt, ®s.verdict, &info, rule, NFT_TRACETYPE_RULE); continue; } @@ -336,7 +338,7 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) goto next_rule; } - nft_trace_packet(pkt, &info, NULL, NFT_TRACETYPE_POLICY); + nft_trace_packet(pkt, ®s.verdict, &info, NULL, NFT_TRACETYPE_POLICY); if (static_branch_unlikely(&nft_counters_enabled)) nft_update_chain_stats(basechain, pkt); diff --git a/net/netfilter/nf_tables_trace.c b/net/netfilter/nf_tables_trace.c index 0a0dcf2587fd..e635104a42be 100644 --- a/net/netfilter/nf_tables_trace.c +++ b/net/netfilter/nf_tables_trace.c @@ -124,6 +124,7 @@ static int nf_trace_fill_pkt_info(struct sk_buff *nlskb, } static int nf_trace_fill_rule_info(struct sk_buff *nlskb, + const struct nft_verdict *verdict, const struct nft_traceinfo *info) { if (!info->rule || info->rule->is_last) @@ -135,7 +136,7 @@ static int nf_trace_fill_rule_info(struct sk_buff *nlskb, * Since no rule matched, the ->rule pointer is invalid. */ if (info->type == NFT_TRACETYPE_RETURN && - info->verdict->code == NFT_CONTINUE) + verdict->code == NFT_CONTINUE) return 0; return nla_put_be64(nlskb, NFTA_TRACE_RULE_HANDLE, @@ -143,7 +144,8 @@ static int nf_trace_fill_rule_info(struct sk_buff *nlskb, NFTA_TRACE_PAD); } -static bool nft_trace_have_verdict_chain(struct nft_traceinfo *info) +static bool nft_trace_have_verdict_chain(const struct nft_verdict *verdict, + struct nft_traceinfo *info) { switch (info->type) { case NFT_TRACETYPE_RETURN: @@ -153,7 +155,7 @@ static bool nft_trace_have_verdict_chain(struct nft_traceinfo *info) return false; } - switch (info->verdict->code) { + switch (verdict->code) { case NFT_JUMP: case NFT_GOTO: break; @@ -184,6 +186,7 @@ static const struct nft_chain *nft_trace_get_chain(const struct nft_traceinfo *i } void nft_trace_notify(const struct nft_pktinfo *pkt, + const struct nft_verdict *verdict, struct nft_traceinfo *info) { const struct nft_chain *chain; @@ -217,8 +220,8 @@ void nft_trace_notify(const struct nft_pktinfo *pkt, nla_total_size(sizeof(u32)) + /* nfproto */ nla_total_size(sizeof(u32)); /* policy */ - if (nft_trace_have_verdict_chain(info)) - size += nla_total_size(strlen(info->verdict->chain->name)); /* jump target */ + if (nft_trace_have_verdict_chain(verdict, info)) + size += nla_total_size(strlen(verdict->chain->name)); /* jump target */ skb = nlmsg_new(size, GFP_ATOMIC); if (!skb) @@ -245,7 +248,7 @@ void nft_trace_notify(const struct nft_pktinfo *pkt, if (nla_put_string(skb, NFTA_TRACE_TABLE, chain->table->name)) goto nla_put_failure; - if (nf_trace_fill_rule_info(skb, info)) + if (nf_trace_fill_rule_info(skb, verdict, info)) goto nla_put_failure; switch (info->type) { @@ -254,11 +257,11 @@ void nft_trace_notify(const struct nft_pktinfo *pkt, break; case NFT_TRACETYPE_RETURN: case NFT_TRACETYPE_RULE: - if (nft_verdict_dump(skb, NFTA_TRACE_VERDICT, info->verdict)) + if (nft_verdict_dump(skb, NFTA_TRACE_VERDICT, verdict)) goto nla_put_failure; /* pkt->skb undefined iff NF_STOLEN, disable dump */ - if (info->verdict->code == NF_STOLEN) + if (verdict->code == NF_STOLEN) info->packet_dumped = true; else mark = pkt->skb->mark; @@ -295,7 +298,6 @@ void nft_trace_notify(const struct nft_pktinfo *pkt, } void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt, - const struct nft_verdict *verdict, const struct nft_chain *chain) { static siphash_key_t trace_key __read_mostly; @@ -305,7 +307,6 @@ void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt, info->trace = true; info->nf_trace = pkt->skb->nf_trace; info->packet_dumped = false; - info->verdict = verdict; net_get_random_once(&trace_key, sizeof(trace_key)); From patchwork Fri Apr 14 13:01:34 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 1769001 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=2620:137:e000::1:20; helo=out1.vger.email; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by legolas.ozlabs.org (Postfix) with ESMTP id 4Pyc6M3yVPz1yZr for ; Fri, 14 Apr 2023 23:02:03 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229778AbjDNNCC (ORCPT ); Fri, 14 Apr 2023 09:02:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46204 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230036AbjDNNB6 (ORCPT ); Fri, 14 Apr 2023 09:01:58 -0400 Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [IPv6:2a0a:51c0:0:237:300::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B30A54ED5 for ; Fri, 14 Apr 2023 06:01:56 -0700 (PDT) Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1pnJ3r-0001rM-9A; Fri, 14 Apr 2023 15:01:55 +0200 From: Florian Westphal To: Cc: Florian Westphal Subject: [PATCH nf-next 4/4] netfilter: nf_tables: do not store rule in traceinfo structure Date: Fri, 14 Apr 2023 15:01:34 +0200 Message-Id: <20230414130134.29040-5-fw@strlen.de> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230414130134.29040-1-fw@strlen.de> References: <20230414130134.29040-1-fw@strlen.de> MIME-Version: 1.0 X-Spam-Status: No, score=-4.0 required=5.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_MED,SPF_HELO_PASS,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org pass it as argument instead. This reduces size of traceinfo to 16 bytes. Total stack usage: nf_tables_core.c:252 nft_do_chain 304 static While its possible to also pass basechain as argument, doing so increases nft_do_chaininfo function size. Unlike pktinfo/verdict/rule the basechain info isn't used in the expression evaluation path. gcc places it on the stack, which results in extra push/pop when it gets passed to the trace helpers as argument rather than as part of the traceinfo structure. Signed-off-by: Florian Westphal --- include/net/netfilter/nf_tables.h | 3 +-- net/netfilter/nf_tables_core.c | 15 +++++++-------- net/netfilter/nf_tables_trace.c | 14 ++++++++------ 3 files changed, 16 insertions(+), 16 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index a11fde72c87e..36df00f854e0 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -1403,7 +1403,6 @@ void nft_unregister_flowtable_type(struct nf_flowtable_type *type); * @skbid: hash of skb to be used as trace id * @packet_dumped: packet headers sent in a previous traceinfo message * @basechain: base chain currently processed - * @rule: rule that was evaluated */ struct nft_traceinfo { bool trace; @@ -1412,7 +1411,6 @@ struct nft_traceinfo { enum nft_trace_types type:8; u32 skbid; const struct nft_base_chain *basechain; - const struct nft_rule_dp *rule; }; void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt, @@ -1420,6 +1418,7 @@ void nft_trace_init(struct nft_traceinfo *info, const struct nft_pktinfo *pkt, void nft_trace_notify(const struct nft_pktinfo *pkt, const struct nft_verdict *verdict, + const struct nft_rule_dp *rule, struct nft_traceinfo *info); #define MODULE_ALIAS_NFT_CHAIN(family, name) \ diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c index 6debe8b2623f..4d0ce12221f6 100644 --- a/net/netfilter/nf_tables_core.c +++ b/net/netfilter/nf_tables_core.c @@ -43,6 +43,7 @@ static inline void nf_skip_indirect_calls_enable(void) { } static noinline void __nft_trace_packet(const struct nft_pktinfo *pkt, const struct nft_verdict *verdict, + const struct nft_rule_dp *rule, struct nft_traceinfo *info, enum nft_trace_types type) { @@ -51,7 +52,7 @@ static noinline void __nft_trace_packet(const struct nft_pktinfo *pkt, info->type = type; - nft_trace_notify(pkt, verdict, info); + nft_trace_notify(pkt, verdict, rule, info); } static inline void nft_trace_packet(const struct nft_pktinfo *pkt, @@ -62,8 +63,7 @@ static inline void nft_trace_packet(const struct nft_pktinfo *pkt, { if (static_branch_unlikely(&nft_trace_enabled)) { info->nf_trace = pkt->skb->nf_trace; - info->rule = rule; - __nft_trace_packet(pkt, verdict, info, type); + __nft_trace_packet(pkt, verdict, rule, info, type); } } @@ -110,6 +110,7 @@ static void nft_cmp16_fast_eval(const struct nft_expr *expr, static noinline void __nft_trace_verdict(const struct nft_pktinfo *pkt, struct nft_traceinfo *info, + const struct nft_rule_dp *rule, const struct nft_regs *regs) { enum nft_trace_types type; @@ -131,7 +132,7 @@ static noinline void __nft_trace_verdict(const struct nft_pktinfo *pkt, break; } - __nft_trace_packet(pkt, ®s->verdict, info, type); + __nft_trace_packet(pkt, ®s->verdict, rule, info, type); } static inline void nft_trace_verdict(const struct nft_pktinfo *pkt, @@ -139,10 +140,8 @@ static inline void nft_trace_verdict(const struct nft_pktinfo *pkt, const struct nft_rule_dp *rule, const struct nft_regs *regs) { - if (static_branch_unlikely(&nft_trace_enabled)) { - info->rule = rule; - __nft_trace_verdict(pkt, info, regs); - } + if (static_branch_unlikely(&nft_trace_enabled)) + __nft_trace_verdict(pkt, info, rule, regs); } static bool nft_payload_fast_eval(const struct nft_expr *expr, diff --git a/net/netfilter/nf_tables_trace.c b/net/netfilter/nf_tables_trace.c index e635104a42be..6d41c0bd3d78 100644 --- a/net/netfilter/nf_tables_trace.c +++ b/net/netfilter/nf_tables_trace.c @@ -125,9 +125,10 @@ static int nf_trace_fill_pkt_info(struct sk_buff *nlskb, static int nf_trace_fill_rule_info(struct sk_buff *nlskb, const struct nft_verdict *verdict, + const struct nft_rule_dp *rule, const struct nft_traceinfo *info) { - if (!info->rule || info->rule->is_last) + if (!rule || rule->is_last) return 0; /* a continue verdict with ->type == RETURN means that this is @@ -140,7 +141,7 @@ static int nf_trace_fill_rule_info(struct sk_buff *nlskb, return 0; return nla_put_be64(nlskb, NFTA_TRACE_RULE_HANDLE, - cpu_to_be64(info->rule->handle), + cpu_to_be64(rule->handle), NFTA_TRACE_PAD); } @@ -166,9 +167,9 @@ static bool nft_trace_have_verdict_chain(const struct nft_verdict *verdict, return true; } -static const struct nft_chain *nft_trace_get_chain(const struct nft_traceinfo *info) +static const struct nft_chain *nft_trace_get_chain(const struct nft_rule_dp *rule, + const struct nft_traceinfo *info) { - const struct nft_rule_dp *rule = info->rule; const struct nft_rule_dp_last *last; if (!rule) @@ -187,6 +188,7 @@ static const struct nft_chain *nft_trace_get_chain(const struct nft_traceinfo *i void nft_trace_notify(const struct nft_pktinfo *pkt, const struct nft_verdict *verdict, + const struct nft_rule_dp *rule, struct nft_traceinfo *info) { const struct nft_chain *chain; @@ -199,7 +201,7 @@ void nft_trace_notify(const struct nft_pktinfo *pkt, if (!nfnetlink_has_listeners(nft_net(pkt), NFNLGRP_NFTRACE)) return; - chain = nft_trace_get_chain(info); + chain = nft_trace_get_chain(rule, info); size = nlmsg_total_size(sizeof(struct nfgenmsg)) + nla_total_size(strlen(chain->table->name)) + @@ -248,7 +250,7 @@ void nft_trace_notify(const struct nft_pktinfo *pkt, if (nla_put_string(skb, NFTA_TRACE_TABLE, chain->table->name)) goto nla_put_failure; - if (nf_trace_fill_rule_info(skb, verdict, info)) + if (nf_trace_fill_rule_info(skb, verdict, rule, info)) goto nla_put_failure; switch (info->type) {