1 From: Felix Fietkau <nbd@nbd.name>
2 Date: Thu, 15 Mar 2018 20:46:31 +0100
3 Subject: [PATCH] netfilter: nf_flow_table: support hw offload through
6 There are hardware offload devices that support offloading VLANs and
7 PPPoE devices. Additionally, it is useful to be able to offload packets
8 routed through bridge interfaces as well.
9 Add support for finding the path to the offload device through these
10 virtual interfaces, while collecting useful parameters for the offload
11 device, like VLAN ID/protocol, PPPoE session and Ethernet MAC address.
13 Signed-off-by: Felix Fietkau <nbd@nbd.name>
16 --- a/include/linux/netdevice.h
17 +++ b/include/linux/netdevice.h
18 @@ -827,6 +827,7 @@ struct xfrmdev_ops {
22 +struct flow_offload_hw_path;
24 enum flow_offload_type {
26 @@ -1064,8 +1065,15 @@ enum flow_offload_type {
27 * int (*ndo_bridge_dellink)(struct net_device *dev, struct nlmsghdr *nlh,
30 + * int (*ndo_flow_offload_check)(struct flow_offload_hw_path *path);
31 + * For virtual devices like bridges, vlan, and pppoe, fill in the
32 + * underlying network device that can be used for offloading connections.
33 + * Return an error if offloading is not supported.
35 * int (*ndo_flow_offload)(enum flow_offload_type type,
36 - * struct flow_offload *flow);
37 + * struct flow_offload *flow,
38 + * struct flow_offload_hw_path *src,
39 + * struct flow_offload_hw_path *dest);
40 * Adds/deletes flow entry to/from net device flowtable.
42 * int (*ndo_change_carrier)(struct net_device *dev, bool new_carrier);
43 @@ -1292,8 +1300,11 @@ struct net_device_ops {
44 int (*ndo_bridge_dellink)(struct net_device *dev,
47 + int (*ndo_flow_offload_check)(struct flow_offload_hw_path *path);
48 int (*ndo_flow_offload)(enum flow_offload_type type,
49 - struct flow_offload *flow);
50 + struct flow_offload *flow,
51 + struct flow_offload_hw_path *src,
52 + struct flow_offload_hw_path *dest);
53 int (*ndo_change_carrier)(struct net_device *dev,
55 int (*ndo_get_phys_port_id)(struct net_device *dev,
56 --- a/include/net/netfilter/nf_flow_table.h
57 +++ b/include/net/netfilter/nf_flow_table.h
58 @@ -86,6 +86,21 @@ struct flow_offload {
62 +#define FLOW_OFFLOAD_PATH_ETHERNET BIT(0)
63 +#define FLOW_OFFLOAD_PATH_VLAN BIT(1)
64 +#define FLOW_OFFLOAD_PATH_PPPOE BIT(2)
66 +struct flow_offload_hw_path {
67 + struct net_device *dev;
70 + u8 eth_src[ETH_ALEN];
71 + u8 eth_dest[ETH_ALEN];
77 #define NF_FLOW_TIMEOUT (30 * HZ)
79 struct nf_flow_route {
80 --- a/net/netfilter/nf_flow_table_hw.c
81 +++ b/net/netfilter/nf_flow_table_hw.c
82 @@ -19,48 +19,75 @@ struct flow_offload_hw {
83 enum flow_offload_type type;
84 struct flow_offload *flow;
86 - possible_net_t flow_hw_net;
88 + struct flow_offload_hw_path src;
89 + struct flow_offload_hw_path dest;
92 -static int do_flow_offload_hw(struct net *net, struct flow_offload *flow,
94 +static void flow_offload_check_ethernet(struct flow_offload_tuple *tuple,
95 + struct flow_offload_hw_path *path)
97 - struct net_device *indev;
99 + struct net_device *dev = path->dev;
100 + struct neighbour *n;
102 - ifindex = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.iifidx;
103 - indev = dev_get_by_index(net, ifindex);
104 - if (WARN_ON(!indev))
106 + if (dev->type != ARPHRD_ETHER)
109 - mutex_lock(&nf_flow_offload_hw_mutex);
110 - ret = indev->netdev_ops->ndo_flow_offload(type, flow);
111 - mutex_unlock(&nf_flow_offload_hw_mutex);
112 + memcpy(path->eth_src, path->dev->dev_addr, ETH_ALEN);
113 + n = dst_neigh_lookup(tuple->dst_cache, &tuple->src_v4);
118 + memcpy(path->eth_dest, n->ha, ETH_ALEN);
119 + path->flags |= FLOW_OFFLOAD_PATH_ETHERNET;
124 +static int flow_offload_check_path(struct net *net,
125 + struct flow_offload_tuple *tuple,
126 + struct flow_offload_hw_path *path)
128 + struct net_device *dev;
130 + dev = dev_get_by_index_rcu(net, tuple->iifidx);
135 + flow_offload_check_ethernet(tuple, path);
137 + if (dev->netdev_ops->ndo_flow_offload_check)
138 + return dev->netdev_ops->ndo_flow_offload_check(path);
143 -static void flow_offload_hw_work_add(struct flow_offload_hw *offload)
144 +static int do_flow_offload_hw(struct flow_offload_hw *offload)
147 + struct net_device *src_dev = offload->src.dev;
148 + struct net_device *dest_dev = offload->dest.dev;
151 - if (nf_ct_is_dying(offload->ct))
153 + ret = src_dev->netdev_ops->ndo_flow_offload(offload->type,
158 - net = read_pnet(&offload->flow_hw_net);
159 - ret = do_flow_offload_hw(net, offload->flow, FLOW_OFFLOAD_ADD);
161 - offload->flow->flags |= FLOW_OFFLOAD_HW;
162 + /* restore devices in case the driver mangled them */
163 + offload->src.dev = src_dev;
164 + offload->dest.dev = dest_dev;
169 -static void flow_offload_hw_work_del(struct flow_offload_hw *offload)
170 +static void flow_offload_hw_free(struct flow_offload_hw *offload)
172 - struct net *net = read_pnet(&offload->flow_hw_net);
174 - do_flow_offload_hw(net, offload->flow, FLOW_OFFLOAD_DEL);
175 + dev_put(offload->src.dev);
176 + dev_put(offload->dest.dev);
178 + nf_conntrack_put(&offload->ct->ct_general);
179 + list_del(&offload->list);
183 static void flow_offload_hw_work(struct work_struct *work)
184 @@ -73,18 +100,22 @@ static void flow_offload_hw_work(struct
185 spin_unlock_bh(&flow_offload_hw_pending_list_lock);
187 list_for_each_entry_safe(offload, next, &hw_offload_pending, list) {
188 + mutex_lock(&nf_flow_offload_hw_mutex);
189 switch (offload->type) {
190 case FLOW_OFFLOAD_ADD:
191 - flow_offload_hw_work_add(offload);
192 + if (nf_ct_is_dying(offload->ct))
195 + if (do_flow_offload_hw(offload) >= 0)
196 + offload->flow->flags |= FLOW_OFFLOAD_HW;
198 case FLOW_OFFLOAD_DEL:
199 - flow_offload_hw_work_del(offload);
200 + do_flow_offload_hw(offload);
204 - nf_conntrack_put(&offload->ct->ct_general);
205 - list_del(&offload->list);
207 + mutex_unlock(&nf_flow_offload_hw_mutex);
209 + flow_offload_hw_free(offload);
213 @@ -97,20 +128,55 @@ static void flow_offload_queue_work(stru
214 schedule_work(&nf_flow_offload_hw_work);
217 +static struct flow_offload_hw *
218 +flow_offload_hw_prepare(struct net *net, struct flow_offload *flow)
220 + struct flow_offload_hw_path src = {};
221 + struct flow_offload_hw_path dest = {};
222 + struct flow_offload_tuple *tuple;
223 + struct flow_offload_hw *offload = NULL;
225 + rcu_read_lock_bh();
227 + tuple = &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple;
228 + if (flow_offload_check_path(net, tuple, &src))
231 + tuple = &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple;
232 + if (flow_offload_check_path(net, tuple, &dest))
235 + if (!src.dev->netdev_ops->ndo_flow_offload)
238 + offload = kzalloc(sizeof(struct flow_offload_hw), GFP_ATOMIC);
243 + dev_hold(dest.dev);
244 + offload->src = src;
245 + offload->dest = dest;
246 + offload->flow = flow;
249 + rcu_read_unlock_bh();
254 static void flow_offload_hw_add(struct net *net, struct flow_offload *flow,
257 struct flow_offload_hw *offload;
259 - offload = kmalloc(sizeof(struct flow_offload_hw), GFP_ATOMIC);
260 + offload = flow_offload_hw_prepare(net, flow);
264 nf_conntrack_get(&ct->ct_general);
265 offload->type = FLOW_OFFLOAD_ADD;
267 - offload->flow = flow;
268 - write_pnet(&offload->flow_hw_net, net);
270 flow_offload_queue_work(offload);
272 @@ -119,14 +185,11 @@ static void flow_offload_hw_del(struct n
274 struct flow_offload_hw *offload;
276 - offload = kmalloc(sizeof(struct flow_offload_hw), GFP_ATOMIC);
277 + offload = flow_offload_hw_prepare(net, flow);
281 offload->type = FLOW_OFFLOAD_DEL;
282 - offload->ct = NULL;
283 - offload->flow = flow;
284 - write_pnet(&offload->flow_hw_net, net);
286 flow_offload_queue_work(offload);
288 @@ -153,12 +216,8 @@ static void __exit nf_flow_table_hw_modu
289 nf_flow_table_hw_unregister(&flow_offload_hw);
290 cancel_work_sync(&nf_flow_offload_hw_work);
292 - list_for_each_entry_safe(offload, next, &hw_offload_pending, list) {
294 - nf_conntrack_put(&offload->ct->ct_general);
295 - list_del(&offload->list);
298 + list_for_each_entry_safe(offload, next, &hw_offload_pending, list)
299 + flow_offload_hw_free(offload);
302 module_init(nf_flow_table_hw_module_init);