netfilter: nft_set_pipapo_avx2: add missing vzeroupper

Since pipapo_get_avx2() uses YMM registers, execute vzeroupper before
returning from it.  This is needed to avoid degrading the performance of
any later SSE code that may happen to be executed.

Fixes: 7400b06396 ("nft_set_pipapo: Introduce AVX2-based lookup implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Eric Biggers
2026-08-15 13:57:50 -07:00
committed by Pablo Neira Ayuso
parent b1881d362e
commit 55dd20f0f4

View File

@@ -1134,6 +1134,7 @@ struct nft_pipapo_elem *pipapo_get_avx2(const struct nft_pipapo_match *m,
struct nft_pipapo_scratch *scratch;
const struct nft_pipapo_field *f;
unsigned long *res, *fill, *map;
struct nft_pipapo_elem *e;
bool map_index;
int ret = 0;
int i;
@@ -1207,14 +1208,11 @@ struct nft_pipapo_elem *pipapo_get_avx2(const struct nft_pipapo_match *m,
next_match:
if (ret < 0) {
scratch->map_index = map_index;
kernel_fpu_end();
__local_unlock_nested_bh(&scratch->bh_lock);
return NULL;
e = NULL;
goto out;
}
if (last) {
struct nft_pipapo_elem *e;
e = f->mt[ret].e;
if (unlikely(__nft_set_elem_expired(&e->ext, tstamp) ||
!nft_set_elem_active(&e->ext, genmask))) {
@@ -1224,9 +1222,7 @@ struct nft_pipapo_elem *pipapo_get_avx2(const struct nft_pipapo_match *m,
}
scratch->map_index = map_index;
kernel_fpu_end();
__local_unlock_nested_bh(&scratch->bh_lock);
return e;
goto out;
}
map_index = !map_index;
@@ -1234,9 +1230,12 @@ struct nft_pipapo_elem *pipapo_get_avx2(const struct nft_pipapo_match *m,
data += NFT_PIPAPO_GROUPS_PADDED_SIZE(f);
}
e = NULL;
out:
asm volatile("vzeroupper");
kernel_fpu_end();
__local_unlock_nested_bh(&scratch->bh_lock);
return NULL;
return e;
}
/**