1 From: Felix Fietkau <nbd@nbd.name>
2 Date: Thu, 15 Mar 2018 20:46:31 +0100
3 Subject: [PATCH] netfilter: nf_flow_table: support hw offload through
6 There are hardware offload devices that support offloading VLANs and
7 PPPoE devices. Additionally, it is useful to be able to offload packets
8 routed through bridge interfaces as well.
9 Add support for finding the path to the offload device through these
10 virtual interfaces, while collecting useful parameters for the offload
11 device, like VLAN ID/protocol, PPPoE session and Ethernet MAC address.
13 Signed-off-by: Felix Fietkau <nbd@nbd.name>
16 --- a/include/linux/netdevice.h
17 +++ b/include/linux/netdevice.h
18 @@ -919,6 +919,7 @@ struct dev_ifalias {
22 +struct flow_offload_hw_path;
24 enum flow_offload_type {
26 @@ -1157,8 +1158,15 @@ enum flow_offload_type {
27 * int (*ndo_bridge_dellink)(struct net_device *dev, struct nlmsghdr *nlh,
30 + * int (*ndo_flow_offload_check)(struct flow_offload_hw_path *path);
31 + * For virtual devices like bridges, vlan, and pppoe, fill in the
32 + * underlying network device that can be used for offloading connections.
33 + * Return an error if offloading is not supported.
35 * int (*ndo_flow_offload)(enum flow_offload_type type,
36 - * struct flow_offload *flow);
37 + * struct flow_offload *flow,
38 + * struct flow_offload_hw_path *src,
39 + * struct flow_offload_hw_path *dest);
40 * Adds/deletes flow entry to/from net device flowtable.
42 * int (*ndo_change_carrier)(struct net_device *dev, bool new_carrier);
43 @@ -1388,8 +1396,11 @@ struct net_device_ops {
44 int (*ndo_bridge_dellink)(struct net_device *dev,
47 + int (*ndo_flow_offload_check)(struct flow_offload_hw_path *path);
48 int (*ndo_flow_offload)(enum flow_offload_type type,
49 - struct flow_offload *flow);
50 + struct flow_offload *flow,
51 + struct flow_offload_hw_path *src,
52 + struct flow_offload_hw_path *dest);
53 int (*ndo_change_carrier)(struct net_device *dev,
55 int (*ndo_get_phys_port_id)(struct net_device *dev,
56 --- a/include/net/netfilter/nf_flow_table.h
57 +++ b/include/net/netfilter/nf_flow_table.h
58 @@ -86,6 +86,21 @@ struct flow_offload {
62 +#define FLOW_OFFLOAD_PATH_ETHERNET BIT(0)
63 +#define FLOW_OFFLOAD_PATH_VLAN BIT(1)
64 +#define FLOW_OFFLOAD_PATH_PPPOE BIT(2)
66 +struct flow_offload_hw_path {
67 + struct net_device *dev;
70 + u8 eth_src[ETH_ALEN];
71 + u8 eth_dest[ETH_ALEN];
77 #define NF_FLOW_TIMEOUT (30 * HZ)
79 struct nf_flow_route {
80 --- a/net/netfilter/nf_flow_table_hw.c
81 +++ b/net/netfilter/nf_flow_table_hw.c
82 @@ -19,48 +19,75 @@ struct flow_offload_hw {
83 enum flow_offload_type type;
84 struct flow_offload *flow;
86 - possible_net_t flow_hw_net;
88 + struct flow_offload_hw_path src;
89 + struct flow_offload_hw_path dest;
92 -static int do_flow_offload_hw(struct net *net, struct flow_offload *flow,
94 +static void flow_offload_check_ethernet(struct flow_offload_tuple *tuple,
95 + struct flow_offload_hw_path *path)
97 - struct net_device *indev;
99 + struct net_device *dev = path->dev;
100 + struct neighbour *n;
102 - ifindex = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.iifidx;
103 - indev = dev_get_by_index(net, ifindex);
104 - if (WARN_ON(!indev))
107 - mutex_lock(&nf_flow_offload_hw_mutex);
108 - ret = indev->netdev_ops->ndo_flow_offload(type, flow);
109 - mutex_unlock(&nf_flow_offload_hw_mutex);
110 + if (dev->type != ARPHRD_ETHER)
114 + memcpy(path->eth_src, path->dev->dev_addr, ETH_ALEN);
115 + n = dst_neigh_lookup(tuple->dst_cache, &tuple->src_v4);
120 + memcpy(path->eth_dest, n->ha, ETH_ALEN);
121 + path->flags |= FLOW_OFFLOAD_PATH_ETHERNET;
125 -static void flow_offload_hw_work_add(struct flow_offload_hw *offload)
126 +static int flow_offload_check_path(struct net *net,
127 + struct flow_offload_tuple *tuple,
128 + struct flow_offload_hw_path *path)
132 + struct net_device *dev;
134 - if (nf_ct_is_dying(offload->ct))
136 + dev = dev_get_by_index_rcu(net, tuple->iifidx);
141 + flow_offload_check_ethernet(tuple, path);
143 - net = read_pnet(&offload->flow_hw_net);
144 - ret = do_flow_offload_hw(net, offload->flow, FLOW_OFFLOAD_ADD);
146 - offload->flow->flags |= FLOW_OFFLOAD_HW;
147 + if (dev->netdev_ops->ndo_flow_offload_check)
148 + return dev->netdev_ops->ndo_flow_offload_check(path);
153 -static void flow_offload_hw_work_del(struct flow_offload_hw *offload)
154 +static int do_flow_offload_hw(struct flow_offload_hw *offload)
156 - struct net *net = read_pnet(&offload->flow_hw_net);
157 + struct net_device *src_dev = offload->src.dev;
158 + struct net_device *dest_dev = offload->dest.dev;
161 + ret = src_dev->netdev_ops->ndo_flow_offload(offload->type,
166 + /* restore devices in case the driver mangled them */
167 + offload->src.dev = src_dev;
168 + offload->dest.dev = dest_dev;
173 - do_flow_offload_hw(net, offload->flow, FLOW_OFFLOAD_DEL);
174 +static void flow_offload_hw_free(struct flow_offload_hw *offload)
176 + dev_put(offload->src.dev);
177 + dev_put(offload->dest.dev);
179 + nf_conntrack_put(&offload->ct->ct_general);
180 + list_del(&offload->list);
184 static void flow_offload_hw_work(struct work_struct *work)
185 @@ -73,18 +100,22 @@ static void flow_offload_hw_work(struct
186 spin_unlock_bh(&flow_offload_hw_pending_list_lock);
188 list_for_each_entry_safe(offload, next, &hw_offload_pending, list) {
189 + mutex_lock(&nf_flow_offload_hw_mutex);
190 switch (offload->type) {
191 case FLOW_OFFLOAD_ADD:
192 - flow_offload_hw_work_add(offload);
193 + if (nf_ct_is_dying(offload->ct))
196 + if (do_flow_offload_hw(offload) >= 0)
197 + offload->flow->flags |= FLOW_OFFLOAD_HW;
199 case FLOW_OFFLOAD_DEL:
200 - flow_offload_hw_work_del(offload);
201 + do_flow_offload_hw(offload);
205 - nf_conntrack_put(&offload->ct->ct_general);
206 - list_del(&offload->list);
208 + mutex_unlock(&nf_flow_offload_hw_mutex);
210 + flow_offload_hw_free(offload);
214 @@ -97,20 +128,55 @@ static void flow_offload_queue_work(stru
215 schedule_work(&nf_flow_offload_hw_work);
218 +static struct flow_offload_hw *
219 +flow_offload_hw_prepare(struct net *net, struct flow_offload *flow)
221 + struct flow_offload_hw_path src = {};
222 + struct flow_offload_hw_path dest = {};
223 + struct flow_offload_tuple *tuple;
224 + struct flow_offload_hw *offload = NULL;
226 + rcu_read_lock_bh();
228 + tuple = &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple;
229 + if (flow_offload_check_path(net, tuple, &src))
232 + tuple = &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple;
233 + if (flow_offload_check_path(net, tuple, &dest))
236 + if (!src.dev->netdev_ops->ndo_flow_offload)
239 + offload = kzalloc(sizeof(struct flow_offload_hw), GFP_ATOMIC);
244 + dev_hold(dest.dev);
245 + offload->src = src;
246 + offload->dest = dest;
247 + offload->flow = flow;
250 + rcu_read_unlock_bh();
255 static void flow_offload_hw_add(struct net *net, struct flow_offload *flow,
258 struct flow_offload_hw *offload;
260 - offload = kmalloc(sizeof(struct flow_offload_hw), GFP_ATOMIC);
261 + offload = flow_offload_hw_prepare(net, flow);
265 nf_conntrack_get(&ct->ct_general);
266 offload->type = FLOW_OFFLOAD_ADD;
268 - offload->flow = flow;
269 - write_pnet(&offload->flow_hw_net, net);
271 flow_offload_queue_work(offload);
273 @@ -119,14 +185,11 @@ static void flow_offload_hw_del(struct n
275 struct flow_offload_hw *offload;
277 - offload = kmalloc(sizeof(struct flow_offload_hw), GFP_ATOMIC);
278 + offload = flow_offload_hw_prepare(net, flow);
282 offload->type = FLOW_OFFLOAD_DEL;
283 - offload->ct = NULL;
284 - offload->flow = flow;
285 - write_pnet(&offload->flow_hw_net, net);
287 flow_offload_queue_work(offload);
289 @@ -153,12 +216,8 @@ static void __exit nf_flow_table_hw_modu
290 nf_flow_table_hw_unregister(&flow_offload_hw);
291 cancel_work_sync(&nf_flow_offload_hw_work);
293 - list_for_each_entry_safe(offload, next, &hw_offload_pending, list) {
295 - nf_conntrack_put(&offload->ct->ct_general);
296 - list_del(&offload->list);
299 + list_for_each_entry_safe(offload, next, &hw_offload_pending, list)
300 + flow_offload_hw_free(offload);
303 module_init(nf_flow_table_hw_module_init);