From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Jakub Kicinski <kuba@kernel.org>
Cc: netfilter-devel@vger.kernel.org, davem@davemloft.net,
netdev@vger.kernel.org, pabeni@redhat.com,
Felix Fietkau <nbd@nbd.name>
Subject: Re: [PATCH net-next 06/11] netfilter: nf_flow_table: count and limit hw offloaded entries
Date: Fri, 20 May 2022 09:44:57 +0200 [thread overview]
Message-ID: <YodG+REOiDa2PMUl@salvia> (raw)
In-Reply-To: <20220519161136.32fdba19@kernel.org>
On Thu, May 19, 2022 at 04:11:36PM -0700, Jakub Kicinski wrote:
> On Fri, 20 May 2022 00:02:01 +0200 Pablo Neira Ayuso wrote:
> > To improve hardware offload debuggability and scalability introduce
> > 'nf_flowtable_count_hw' and 'nf_flowtable_max_hw' sysctl entries in new
> > dedicated 'net/netfilter/ft' namespace. Add new pernet struct nf_ft_net in
> > order to store the counter and sysctl header of new sysctl table.
> >
> > Count the offloaded flows in workqueue add task handler. Verify that
> > offloaded flow total is lower than allowed maximum before calling the
> > driver callbacks. To prevent spamming the 'add' workqueue with tasks when
> > flows can't be offloaded anymore also check that count is below limit
> > before queuing offload work. This doesn't prevent all redundant workqueue
> > task since counter can be taken by concurrent work handler after the check
> > had been performed but before the offload job is executed but it still
> > greatly reduces such occurrences. Note that flows that were not offloaded
> > due to counter being larger than the cap can still be offloaded via refresh
> > function.
> >
> > Ensure that flows are accounted correctly by verifying IPS_HW_OFFLOAD_BIT
> > value before counting them. This ensures that add/refresh code path
> > increments the counter exactly once per flow when setting the bit and
> > decrements it only for accounted flows when deleting the flow with the bit
> > set.
>
> Why a sysctl and not a netlink attr per table or per device?
Per-device is not an option, because the flowtable represents a
compound of devices.
Moreover, in tc ct act the flowtable is not bound to a device, while
in netfilter/nf_tables it is.
tc ct act does not expose flowtables to userspace in any way, they
internally allocate one flowtable per zone. I assume there os no good
netlink interface for them.
For netfilter/nftables, it should be possible to add per-flowtable
netlink attributes, my plan is to extend the flowtable netlink
attribute to add a flowtable maximum size.
This sysctl count and limit hw will just work as a global limit (which
is optional), my plan is that the upcoming per-flowtable limit will
just override this global limit.
I think it is a reasonable tradeoff for the different requirements of
the flowtable infrastructure users given there are two clients
currently for this code.
next prev parent reply other threads:[~2022-05-20 7:45 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-19 22:01 [PATCH net-next 00/11] Netfilter updates for net-next Pablo Neira Ayuso
2022-05-19 22:01 ` [PATCH net-next 01/11] netfilter: Use l3mdev flow key when re-routing mangled packets Pablo Neira Ayuso
2022-05-20 5:00 ` patchwork-bot+netdevbpf
2022-05-19 22:01 ` [PATCH net-next 02/11] netfilter: nf_conncount: reduce unnecessary GC Pablo Neira Ayuso
2022-05-19 22:01 ` [PATCH net-next 03/11] netfilter: conntrack: remove pr_debug callsites from tcp tracker Pablo Neira Ayuso
2022-05-19 22:01 ` [PATCH net-next 04/11] netfilter: ctnetlink: fix up for "netfilter: conntrack: remove unconfirmed list" Pablo Neira Ayuso
2022-05-19 22:02 ` [PATCH net-next 05/11] net/sched: act_ct: set 'net' pointer when creating new nf_flow_table Pablo Neira Ayuso
2022-05-19 22:02 ` [PATCH net-next 06/11] netfilter: nf_flow_table: count and limit hw offloaded entries Pablo Neira Ayuso
2022-05-19 23:11 ` Jakub Kicinski
2022-05-20 4:55 ` Jakub Kicinski
2022-05-20 7:44 ` Pablo Neira Ayuso [this message]
2022-05-20 17:56 ` Jakub Kicinski
2022-05-20 22:17 ` Pablo Neira Ayuso
2022-05-20 23:16 ` Jakub Kicinski
2022-05-19 22:02 ` [PATCH net-next 07/11] netfilter: nf_flow_table: count pending offload workqueue tasks Pablo Neira Ayuso
2022-05-19 22:02 ` [PATCH net-next 08/11] netfilter: nfnetlink: fix warn in nfnetlink_unbind Pablo Neira Ayuso
2022-05-19 22:02 ` [PATCH net-next 09/11] netfilter: conntrack: re-fetch conntrack after insertion Pablo Neira Ayuso
2022-05-19 22:02 ` [PATCH net-next 10/11] netfilter: cttimeout: fix slab-out-of-bounds read in cttimeout_net_exit Pablo Neira Ayuso
2022-05-19 22:02 ` [PATCH net-next 11/11] netfilter: nf_tables: set element extended ACK reporting support Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YodG+REOiDa2PMUl@salvia \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=nbd@nbd.name \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).