Re: [PATCH nf,v2 2/3] netfilter: flowtable: IPIP tunnel hardware offload is not yet support

[Lorenzo Bianconi <lorenzo@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 4587 bytes --]

> No driver supports for IPIP tunnels yet, give up early on setting up the
> hardware offload for this scenario.
> 
> This patch adds a stub that can be enhanced to add more configuration
> that are currently not supported. As of now, the offload work is
> enqueued to the worker, then ignored if the hardware offload
> configuration is not supported.
> 
> Check the NF_FLOW_HW flag to know if this entry was already tried once
> to be offloaded so this is not retried on refresh when unsupported. Move
> NF_FLOW_HW flag check to nf_flow_offload_add(). If this NF_FLOW_HW flag
> is unset the _del and _stats variants are never called.
> 
> This can be updated later on to skip hardware offload work to be queued
> in case hardware offload does not support it.
> 
> Fixes: d98103575dcd ("netfilter: flowtable: Add IP6IP6 rx sw acceleration")
> Fixes: ab427db17885 ("netfilter: flowtable: Add IPIP rx sw acceleration")
> Reported-by: Yuan Tan <yuantan098@gmail.com>
> Reported-by: Xin Liu <bird@lzu.edu.cn>
> Reported-by: Zhengyang Chen <chzhengyang2023@lzu.edu.cn>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>

> ---
> v2: - set NF_FLOW_HW flag from nf_flow_offload_add(), after checking if it is supported.
>     - call nf_flow_offload_refresh() only if NF_FLOW_HW is set on.
> 
>  include/net/netfilter/nf_flow_table.h |  2 ++
>  net/netfilter/nf_flow_table_core.c    |  7 +++----
>  net/netfilter/nf_flow_table_offload.c | 22 ++++++++++++++++++++--
>  3 files changed, 25 insertions(+), 6 deletions(-)
> 
> diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h
> index 7b23b245a5a8..dc5c9b48e65a 100644
> --- a/include/net/netfilter/nf_flow_table.h
> +++ b/include/net/netfilter/nf_flow_table.h
> @@ -357,6 +357,8 @@ static inline int nf_flow_register_bpf(void)
>  
>  void nf_flow_offload_add(struct nf_flowtable *flowtable,
>  			 struct flow_offload *flow);
> +void nf_flow_offload_refresh(struct nf_flowtable *flowtable,
> +			     struct flow_offload *flow);
>  void nf_flow_offload_del(struct nf_flowtable *flowtable,
>  			 struct flow_offload *flow);
>  void nf_flow_offload_stats(struct nf_flowtable *flowtable,
> diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
> index 99c5b9d671a0..d06ce0848b68 100644
> --- a/net/netfilter/nf_flow_table_core.c
> +++ b/net/netfilter/nf_flow_table_core.c
> @@ -345,10 +345,8 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
>  
>  	nf_ct_refresh(flow->ct, NF_CT_DAY);
>  
> -	if (nf_flowtable_hw_offload(flow_table)) {
> -		__set_bit(NF_FLOW_HW, &flow->flags);
> +	if (nf_flowtable_hw_offload(flow_table))
>  		nf_flow_offload_add(flow_table, flow);
> -	}
>  
>  	return 0;
>  }
> @@ -369,7 +367,8 @@ void flow_offload_refresh(struct nf_flowtable *flow_table,
>  	    test_bit(NF_FLOW_CLOSING, &flow->flags))
>  		return;
>  
> -	nf_flow_offload_add(flow_table, flow);
> +	if (test_bit(NF_FLOW_HW, &flow->flags))
> +		nf_flow_offload_refresh(flow_table, flow);
>  }
>  EXPORT_SYMBOL_GPL(flow_offload_refresh);
>  
> diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
> index 002ec15d988b..d26874f1b15f 100644
> --- a/net/netfilter/nf_flow_table_offload.c
> +++ b/net/netfilter/nf_flow_table_offload.c
> @@ -1101,9 +1101,17 @@ nf_flow_offload_work_alloc(struct nf_flowtable *flowtable,
>  	return offload;
>  }
>  
> +static bool nf_flow_offload_unsupported(struct flow_offload *flow)
> +{
> +	if (flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.tun_num ||
> +	    flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.tun_num)
> +		return true;
>  
> -void nf_flow_offload_add(struct nf_flowtable *flowtable,
> -			 struct flow_offload *flow)
> +	return false;
> +}
> +
> +void nf_flow_offload_refresh(struct nf_flowtable *flowtable,
> +			     struct flow_offload *flow)
>  {
>  	struct flow_offload_work *offload;
>  
> @@ -1114,6 +1122,16 @@ void nf_flow_offload_add(struct nf_flowtable *flowtable,
>  	flow_offload_queue_work(offload);
>  }
>  
> +void nf_flow_offload_add(struct nf_flowtable *flowtable,
> +			 struct flow_offload *flow)
> +{
> +	if (nf_flow_offload_unsupported(flow))
> +		return;
> +
> +	__set_bit(NF_FLOW_HW, &flow->flags);
> +	nf_flow_offload_refresh(flowtable, flow);
> +}
> +
>  void nf_flow_offload_del(struct nf_flowtable *flowtable,
>  			 struct flow_offload *flow)
>  {
> -- 
> 2.47.3
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]