From: Jakub Kicinski <jakub.kicinski@netronome.com>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: netdev@vger.kernel.org, davem@davemloft.net,
thomas.lendacky@amd.com, f.fainelli@gmail.com,
ariel.elior@cavium.com, michael.chan@broadcom.com,
madalin.bucur@nxp.com, yisen.zhuang@huawei.com,
salil.mehta@huawei.com, jeffrey.t.kirsher@intel.com,
tariqt@mellanox.com, saeedm@mellanox.com, jiri@mellanox.com,
idosch@mellanox.com, peppe.cavallaro@st.com,
grygorii.strashko@ti.com, andrew@lunn.ch,
vivien.didelot@gmail.com, alexandre.torgue@st.com,
joabreu@synopsys.com, linux-net-drivers@solarflare.com,
ogerlitz@mellanox.com, Manish.Chopra@cavium.com,
marcelo.leitner@gmail.com, mkubecek@suse.cz,
venkatkumar.duvvuru@broadcom.com, maxime.chevallier@bootlin.com,
cphealy@gmail.com, netfilter-devel@vger.kernel.org
Subject: Re: [PATCH net-next,v3 11/11] netfilter: nf_tables: add hardware offload support
Date: Mon, 8 Jul 2019 18:44:37 -0700 [thread overview]
Message-ID: <20190708184437.4d29648a@cakuba.netronome.com> (raw)
In-Reply-To: <20190708160614.2226-12-pablo@netfilter.org>
On Mon, 8 Jul 2019 18:06:13 +0200, Pablo Neira Ayuso wrote:
> This patch adds hardware offload support for nftables through the
> existing netdev_ops->ndo_setup_tc() interface, the TC_SETUP_CLSFLOWER
> classifier and the flow rule API. This hardware offload support is
> available for the NFPROTO_NETDEV family and the ingress hook.
>
> Each nftables expression has a new ->offload interface, that is used to
> populate the flow rule object that is attached to the transaction
> object.
>
> There is a new per-table NFT_TABLE_F_HW flag, that is set on to offload
> an entire table, including all of its chains.
>
> This patch supports for basic metadata (layer 3 and 4 protocol numbers),
> 5-tuple payload matching and the accept/drop actions; this also includes
> basechain hardware offload only.
>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Any particular reason to not fence this off with a device feature
(ethtool -k)? Then you wouldn't need that per-driver list abomination
until drivers start advertising it.. IDK if we want the per-device
offload enable flags or not in general, it seems like a good idea in
general for admin to be able to disable offload per device 🤷
> +static int nft_flow_offload_rule(struct nft_trans *trans,
> + enum tc_fl_command command)
> +{
> + struct nft_flow_rule *flow = nft_trans_flow_rule(trans);
> + struct nft_rule *rule = nft_trans_rule(trans);
> + struct tc_cls_flower_offload cls_flower = {};
> + struct nft_base_chain *basechain;
> + struct netlink_ext_ack extack;
> + __be16 proto = ETH_P_ALL;
> +
> + if (!nft_is_base_chain(trans->ctx.chain))
> + return -EOPNOTSUPP;
> +
> + basechain = nft_base_chain(trans->ctx.chain);
> +
> + if (flow)
> + proto = flow->proto;
> +
> + nft_flow_offload_common_init(&cls_flower.common, proto, &extack);
> + cls_flower.command = command;
> + cls_flower.cookie = (unsigned long) rule;
> + if (flow)
> + cls_flower.rule = flow->rule;
> +
> + return nft_setup_cb_call(basechain, TC_SETUP_CLSFLOWER, &cls_flower);
> +}
Are we 100% okay with using TC cls_flower structures and defines in nft
code?
next prev parent reply other threads:[~2019-07-09 1:44 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-08 16:06 [PATCH net-next,v3 00/11] netfilter: add hardware offload infrastructure Pablo Neira Ayuso
2019-07-08 16:06 ` [PATCH net-next,v3 01/11] net: flow_offload: add flow_block_cb_setup_simple() Pablo Neira Ayuso
2019-07-09 1:30 ` Jakub Kicinski
2019-07-08 16:06 ` [PATCH net-next,v3 02/11] net: flow_offload: rename TC_BLOCK_{UN}BIND to FLOW_BLOCK_{UN}BIND Pablo Neira Ayuso
2019-07-08 16:06 ` [PATCH net-next,v3 03/11] net: flow_offload: rename TCF_BLOCK_BINDER_TYPE_* to FLOW_BLOCK_BINDER_TYPE_* Pablo Neira Ayuso
2019-07-08 16:06 ` [PATCH net-next,v3 04/11] net: flow_offload: add flow_block_cb_alloc() and flow_block_cb_free() Pablo Neira Ayuso
2019-07-09 13:37 ` Jiri Pirko
2019-07-08 16:06 ` [PATCH net-next,v3 05/11] net: flow_offload: add list handling functions Pablo Neira Ayuso
2019-07-08 17:26 ` Jiri Pirko
2019-07-08 16:06 ` [PATCH net-next,v3 06/11] net: flow_offload: add flow_block_cb_{priv,incref,decref}() Pablo Neira Ayuso
2019-07-08 17:28 ` Jiri Pirko
2019-07-08 16:06 ` [PATCH net-next,v3 07/11] net: sched: use flow block API Pablo Neira Ayuso
2019-07-08 17:42 ` Jiri Pirko
2019-07-08 16:06 ` [PATCH net-next,v3 08/11] drivers: net: " Pablo Neira Ayuso
2019-07-09 1:35 ` Jakub Kicinski
2019-07-08 16:06 ` [PATCH net-next,v3 09/11] net: sched: remove tcf " Pablo Neira Ayuso
2019-07-08 16:06 ` [PATCH net-next,v3 10/11] net: flow_offload: add flow_block_cb_is_busy() and use it Pablo Neira Ayuso
2019-07-09 13:36 ` Jiri Pirko
2019-07-09 13:39 ` Jiri Pirko
2019-07-08 16:06 ` [PATCH net-next,v3 11/11] netfilter: nf_tables: add hardware offload support Pablo Neira Ayuso
2019-07-09 1:44 ` Jakub Kicinski [this message]
2019-07-09 6:20 ` Jiri Pirko
2019-07-08 21:39 ` [PATCH net-next,v3 00/11] netfilter: add hardware offload infrastructure David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190708184437.4d29648a@cakuba.netronome.com \
--to=jakub.kicinski@netronome.com \
--cc=Manish.Chopra@cavium.com \
--cc=alexandre.torgue@st.com \
--cc=andrew@lunn.ch \
--cc=ariel.elior@cavium.com \
--cc=cphealy@gmail.com \
--cc=davem@davemloft.net \
--cc=f.fainelli@gmail.com \
--cc=grygorii.strashko@ti.com \
--cc=idosch@mellanox.com \
--cc=jeffrey.t.kirsher@intel.com \
--cc=jiri@mellanox.com \
--cc=joabreu@synopsys.com \
--cc=linux-net-drivers@solarflare.com \
--cc=madalin.bucur@nxp.com \
--cc=marcelo.leitner@gmail.com \
--cc=maxime.chevallier@bootlin.com \
--cc=michael.chan@broadcom.com \
--cc=mkubecek@suse.cz \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=ogerlitz@mellanox.com \
--cc=pablo@netfilter.org \
--cc=peppe.cavallaro@st.com \
--cc=saeedm@mellanox.com \
--cc=salil.mehta@huawei.com \
--cc=tariqt@mellanox.com \
--cc=thomas.lendacky@amd.com \
--cc=venkatkumar.duvvuru@broadcom.com \
--cc=vivien.didelot@gmail.com \
--cc=yisen.zhuang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).