Re: [PATCH nf 2/3] netfilter: flowtable: IPIP tunnel hardware offload is not yet support

[Lorenzo Bianconi <lorenzo@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 2658 bytes --]

On Jun 29, Pablo Neira Ayuso wrote:
> No driver supports for IPIP tunnels yet, give up early on setting up the
> hardware offload for this scenario.
> 
> This patch adds a stub that can be enhanced to add more configuration
> that are currently not supported. As of now, the offload work is
> enqueued to the worker, then ignored if the hardware offload
> configuration is not supported.
> 
> This can be updated later on to skip hardware offload work to be queued
> in case hardware offload does not support it.
> 
> Fixes: d98103575dcd ("netfilter: flowtable: Add IP6IP6 rx sw acceleration")
> Fixes: ab427db17885 ("netfilter: flowtable: Add IPIP rx sw acceleration")
> Reported-by: Yuan Tan <yuantan098@gmail.com>
> Reported-by: Xin Liu <bird@lzu.edu.cn>
> Reported-by: Zhengyang Chen <chzhengyang2023@lzu.edu.cn>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>

> ---
>  net/netfilter/nf_flow_table_offload.c | 17 +++++++++++++++++
>  1 file changed, 17 insertions(+)
> 
> diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
> index 002ec15d988b..3e87117e724b 100644
> --- a/net/netfilter/nf_flow_table_offload.c
> +++ b/net/netfilter/nf_flow_table_offload.c
> @@ -1101,12 +1101,23 @@ nf_flow_offload_work_alloc(struct nf_flowtable *flowtable,
>  	return offload;
>  }
>  
> +static bool nf_flow_offload_unsupported(struct flow_offload *flow)
> +{
> +	if (flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.tun_num ||
> +	    flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.tun_num)
> +		return true;
> +
> +	return false;
> +}
>  
>  void nf_flow_offload_add(struct nf_flowtable *flowtable,
>  			 struct flow_offload *flow)
>  {
>  	struct flow_offload_work *offload;
>  
> +	if (nf_flow_offload_unsupported(flow))
> +		return;
> +
>  	offload = nf_flow_offload_work_alloc(flowtable, flow, FLOW_CLS_REPLACE);
>  	if (!offload)
>  		return;
> @@ -1119,6 +1130,9 @@ void nf_flow_offload_del(struct nf_flowtable *flowtable,
>  {
>  	struct flow_offload_work *offload;
>  
> +	if (nf_flow_offload_unsupported(flow))
> +		return;
> +
>  	offload = nf_flow_offload_work_alloc(flowtable, flow, FLOW_CLS_DESTROY);
>  	if (!offload)
>  		return;
> @@ -1133,6 +1147,9 @@ void nf_flow_offload_stats(struct nf_flowtable *flowtable,
>  	struct flow_offload_work *offload;
>  	__s32 delta;
>  
> +	if (nf_flow_offload_unsupported(flow))
> +		return;
> +
>  	delta = nf_flow_timeout_delta(flow->timeout);
>  	if ((delta >= (9 * flow_offload_get_timeout(flow)) / 10))
>  		return;
> -- 
> 2.47.3
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]