Re: [RFC net-next] net: tc: flow indirect framework issue

From: Mattias Forsblad <mattias.forsblad@gmail.com>
To: Jakub Kicinski <kuba@kernel.org>,
	Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Vladimir Oltean <olteanv@gmail.com>,
	Baowen Zheng <baowen.zheng@corigine.com>,
	"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
	"roid@nvidia.com" <roid@nvidia.com>,
	"vladbu@nvidia.com" <vladbu@nvidia.com>,
	Eli Cohen <elic@nvidia.com>, Jiri Pirko <jiri@resnulli.us>,
	Tobias Waldekranz <tobias@waldekranz.com>
Subject: Re: [RFC net-next] net: tc: flow indirect framework issue
Date: Mon, 25 Apr 2022 09:52:49 +0200	[thread overview]
Message-ID: <4bb1c769-4539-bc97-b32b-a4b884dd297b@gmail.com> (raw)
In-Reply-To: <20220414105701.54c3fba4@kernel.org>

On 2022-04-14 10:57, Jakub Kicinski wrote:
>> I think some people believe doing things fully transparent is good, at
>> the cost of adding more kernel complexity and hiding details that are
>> relevant to the user (such as if hardware offload is enabled for
>> vxlan0 and what is the real device that is actually being used for the
>> vxlan0 to be offloaded).
>>
>> So, there are no flags when setting up the vxlan0 device for the user
>> to say: "I would like to hardware offload vxlan0", and going slightly
>> further there is not "please attach this vxlan0 device to eth0 for
>> hardware offload". Any real device could be potentially used to
>> offload vxlan0, the user does not know which one is actually used.
>>
>> Exposing this information is a bit more work on top of the user, but:
>>
>> 1) it will be transparent: the control plane shows that the vxlan0 is
>>    hardware offloaded. Then if eth0 is gone, vxlan0 tc ingress can be
>>    removed too, because it depends on eth0.
>>
>> 2) The control plane validates if hardware offload for vxlan0. If this
>>    is not possible, display an error to the user: "sorry, I cannot
>>    offload vxlan0 on eth0 for reason X".
>>
>> Since this is not exposed to the control plane, the existing
>> infrastructure follows a snooping scheme, but tracking devices that
>> might be able to hardware offload.
>>
>> There is no obvious way to relate vxlan0 with the real device
>> (eth0) that is actually performing the hardware offloading.
> 
> Let's not over-complicate things, Mattias just needs replay to work.
> 90% sure it worked when we did the work back in the day with John H,
> before the nft rewrite etc.

To me the first thing to determine is how flow_indr_dev_register should work?
With only a superficial knowledge of tc I'd seem to me that if we
have a function called tcf_action_reoffload_cb and tc has all the information
about current blocks/filters/rules it should really reoffload those. The other way
would mean bookkeeping the same information at multiple places. It also
means restrictions on which sequence one should setup a network topology.
Would we like it that way?