target/linux/generic/pending-4.14/641-netfilter-nf_flow_table-support-hw-offload-through-v.patch

   1 From: Felix Fietkau <nbd@nbd.name>
   2 Date: Thu, 15 Mar 2018 20:46:31 +0100
   3 Subject: [PATCH] netfilter: nf_flow_table: support hw offload through
   4  virtual interfaces
   5
   6 There are hardware offload devices that support offloading VLANs and
   7 PPPoE devices. Additionally, it is useful to be able to offload packets
   8 routed through bridge interfaces as well.
   9 Add support for finding the path to the offload device through these
  10 virtual interfaces, while collecting useful parameters for the offload
  11 device, like VLAN ID/protocol, PPPoE session and Ethernet MAC address.
  12
  13 Signed-off-by: Felix Fietkau <nbd@nbd.name>
  14 ---
  15
  16 --- a/include/linux/netdevice.h
  17 +++ b/include/linux/netdevice.h
  18 @@ -827,6 +827,7 @@ struct xfrmdev_ops {
  19  #endif
  20
  21  struct flow_offload;
  22 +struct flow_offload_hw_path;
  23
  24  enum flow_offload_type {
  25         FLOW_OFFLOAD_ADD        = 0,
  26 @@ -1064,8 +1065,15 @@ enum flow_offload_type {
  27   * int (*ndo_bridge_dellink)(struct net_device *dev, struct nlmsghdr *nlh,
  28   *                          u16 flags);
  29   *
  30 + * int (*ndo_flow_offload_check)(struct flow_offload_hw_path *path);
  31 + *     For virtual devices like bridges, vlan, and pppoe, fill in the
  32 + *     underlying network device that can be used for offloading connections.
  33 + *     Return an error if offloading is not supported.
  34 + *
  35   * int (*ndo_flow_offload)(enum flow_offload_type type,
  36 - *                        struct flow_offload *flow);
  37 + *                        struct flow_offload *flow,
  38 + *                        struct flow_offload_hw_path *src,
  39 + *                        struct flow_offload_hw_path *dest);
  40   *     Adds/deletes flow entry to/from net device flowtable.
  41   *
  42   * int (*ndo_change_carrier)(struct net_device *dev, bool new_carrier);
  43 @@ -1292,8 +1300,11 @@ struct net_device_ops {
  44         int                     (*ndo_bridge_dellink)(struct net_device *dev,
  45                                                       struct nlmsghdr *nlh,
  46                                                       u16 flags);
  47 +       int                     (*ndo_flow_offload_check)(struct flow_offload_hw_path *path);
  48         int                     (*ndo_flow_offload)(enum flow_offload_type type,
  49 -                                                   struct flow_offload *flow);
  50 +                                                   struct flow_offload *flow,
  51 +                                                   struct flow_offload_hw_path *src,
  52 +                                                   struct flow_offload_hw_path *dest);
  53         int                     (*ndo_change_carrier)(struct net_device *dev,
  54                                                       bool new_carrier);
  55         int                     (*ndo_get_phys_port_id)(struct net_device *dev,
  56 --- a/include/net/netfilter/nf_flow_table.h
  57 +++ b/include/net/netfilter/nf_flow_table.h
  58 @@ -86,6 +86,21 @@ struct flow_offload {
  59         };
  60  };
  61
  62 +#define FLOW_OFFLOAD_PATH_ETHERNET     BIT(0)
  63 +#define FLOW_OFFLOAD_PATH_VLAN         BIT(1)
  64 +#define FLOW_OFFLOAD_PATH_PPPOE                BIT(2)
  65 +
  66 +struct flow_offload_hw_path {
  67 +       struct net_device *dev;
  68 +       u32 flags;
  69 +
  70 +       u8 eth_src[ETH_ALEN];
  71 +       u8 eth_dest[ETH_ALEN];
  72 +       u16 vlan_proto;
  73 +       u16 vlan_id;
  74 +       u16 pppoe_sid;
  75 +};
  76 +
  77  #define NF_FLOW_TIMEOUT (30 * HZ)
  78
  79  struct nf_flow_route {
  80 --- a/net/netfilter/nf_flow_table_hw.c
  81 +++ b/net/netfilter/nf_flow_table_hw.c
  82 @@ -19,48 +19,75 @@ struct flow_offload_hw {
  83         enum flow_offload_type  type;
  84         struct flow_offload     *flow;
  85         struct nf_conn          *ct;
  86 -       possible_net_t          flow_hw_net;
  87 +
  88 +       struct flow_offload_hw_path src;
  89 +       struct flow_offload_hw_path dest;
  90  };
  91
  92 -static int do_flow_offload_hw(struct net *net, struct flow_offload *flow,
  93 -                             int type)
  94 +static void flow_offload_check_ethernet(struct flow_offload_tuple *tuple,
  95 +                                       struct flow_offload_hw_path *path)
  96  {
  97 -       struct net_device *indev;
  98 -       int ret, ifindex;
  99 +       struct net_device *dev = path->dev;
 100 +       struct neighbour *n;
 101
 102 -       ifindex = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.iifidx;
 103 -       indev = dev_get_by_index(net, ifindex);
 104 -       if (WARN_ON(!indev))
 105 -               return 0;
 106 +       if (dev->type != ARPHRD_ETHER)
 107 +               return;
 108
 109 -       mutex_lock(&nf_flow_offload_hw_mutex);
 110 -       ret = indev->netdev_ops->ndo_flow_offload(type, flow);
 111 -       mutex_unlock(&nf_flow_offload_hw_mutex);
 112 +       memcpy(path->eth_src, path->dev->dev_addr, ETH_ALEN);
 113 +       n = dst_neigh_lookup(tuple->dst_cache, &tuple->src_v4);
 114 +       if (!n)
 115 +               return;
 116
 117 -       dev_put(indev);
 118 +       memcpy(path->eth_dest, n->ha, ETH_ALEN);
 119 +       path->flags |= FLOW_OFFLOAD_PATH_ETHERNET;
 120 +       neigh_release(n);
 121 +}
 122
 123 -       return ret;
 124 +static int flow_offload_check_path(struct net *net,
 125 +                                  struct flow_offload_tuple *tuple,
 126 +                                  struct flow_offload_hw_path *path)
 127 +{
 128 +       struct net_device *dev;
 129 +
 130 +       dev = dev_get_by_index_rcu(net, tuple->iifidx);
 131 +       if (!dev)
 132 +               return -ENOENT;
 133 +
 134 +       path->dev = dev;
 135 +       flow_offload_check_ethernet(tuple, path);
 136 +
 137 +       if (dev->netdev_ops->ndo_flow_offload_check)
 138 +               return dev->netdev_ops->ndo_flow_offload_check(path);
 139 +
 140 +       return 0;
 141  }
 142
 143 -static void flow_offload_hw_work_add(struct flow_offload_hw *offload)
 144 +static int do_flow_offload_hw(struct flow_offload_hw *offload)
 145  {
 146 -       struct net *net;
 147 +       struct net_device *src_dev = offload->src.dev;
 148 +       struct net_device *dest_dev = offload->dest.dev;
 149         int ret;
 150
 151 -       if (nf_ct_is_dying(offload->ct))
 152 -               return;
 153 +       ret = src_dev->netdev_ops->ndo_flow_offload(offload->type,
 154 +                                                   offload->flow,
 155 +                                                   &offload->src,
 156 +                                                   &offload->dest);
 157
 158 -       net = read_pnet(&offload->flow_hw_net);
 159 -       ret = do_flow_offload_hw(net, offload->flow, FLOW_OFFLOAD_ADD);
 160 -       if (ret >= 0)
 161 -               offload->flow->flags |= FLOW_OFFLOAD_HW;
 162 +       /* restore devices in case the driver mangled them */
 163 +       offload->src.dev = src_dev;
 164 +       offload->dest.dev = dest_dev;
 165 +
 166 +       return ret;
 167  }
 168
 169 -static void flow_offload_hw_work_del(struct flow_offload_hw *offload)
 170 +static void flow_offload_hw_free(struct flow_offload_hw *offload)
 171  {
 172 -       struct net *net = read_pnet(&offload->flow_hw_net);
 173 -
 174 -       do_flow_offload_hw(net, offload->flow, FLOW_OFFLOAD_DEL);
 175 +       dev_put(offload->src.dev);
 176 +       dev_put(offload->dest.dev);
 177 +       if (offload->ct)
 178 +               nf_conntrack_put(&offload->ct->ct_general);
 179 +       list_del(&offload->list);
 180 +       kfree(offload);
 181  }
 182
 183  static void flow_offload_hw_work(struct work_struct *work)
 184 @@ -73,18 +100,22 @@ static void flow_offload_hw_work(struct
 185         spin_unlock_bh(&flow_offload_hw_pending_list_lock);
 186
 187         list_for_each_entry_safe(offload, next, &hw_offload_pending, list) {
 188 +               mutex_lock(&nf_flow_offload_hw_mutex);
 189                 switch (offload->type) {
 190                 case FLOW_OFFLOAD_ADD:
 191 -                       flow_offload_hw_work_add(offload);
 192 +                       if (nf_ct_is_dying(offload->ct))
 193 +                               break;
 194 +
 195 +                       if (do_flow_offload_hw(offload) >= 0)
 196 +                               offload->flow->flags |= FLOW_OFFLOAD_HW;
 197                         break;
 198                 case FLOW_OFFLOAD_DEL:
 199 -                       flow_offload_hw_work_del(offload);
 200 +                       do_flow_offload_hw(offload);
 201                         break;
 202                 }
 203 -               if (offload->ct)
 204 -                       nf_conntrack_put(&offload->ct->ct_general);
 205 -               list_del(&offload->list);
 206 -               kfree(offload);
 207 +               mutex_unlock(&nf_flow_offload_hw_mutex);
 208 +
 209 +               flow_offload_hw_free(offload);
 210         }
 211  }
 212
 213 @@ -97,20 +128,55 @@ static void flow_offload_queue_work(stru
 214         schedule_work(&nf_flow_offload_hw_work);
 215  }
 216
 217 +static struct flow_offload_hw *
 218 +flow_offload_hw_prepare(struct net *net, struct flow_offload *flow)
 219 +{
 220 +       struct flow_offload_hw_path src = {};
 221 +       struct flow_offload_hw_path dest = {};
 222 +       struct flow_offload_tuple *tuple;
 223 +       struct flow_offload_hw *offload = NULL;
 224 +
 225 +       rcu_read_lock_bh();
 226 +
 227 +       tuple = &flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple;
 228 +       if (flow_offload_check_path(net, tuple, &src))
 229 +               goto out;
 230 +
 231 +       tuple = &flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple;
 232 +       if (flow_offload_check_path(net, tuple, &dest))
 233 +               goto out;
 234 +
 235 +       if (!src.dev->netdev_ops->ndo_flow_offload)
 236 +               goto out;
 237 +
 238 +       offload = kzalloc(sizeof(struct flow_offload_hw), GFP_ATOMIC);
 239 +       if (!offload)
 240 +               goto out;
 241 +
 242 +       dev_hold(src.dev);
 243 +       dev_hold(dest.dev);
 244 +       offload->src = src;
 245 +       offload->dest = dest;
 246 +       offload->flow = flow;
 247 +
 248 +out:
 249 +       rcu_read_unlock_bh();
 250 +
 251 +       return offload;
 252 +}
 253 +
 254  static void flow_offload_hw_add(struct net *net, struct flow_offload *flow,
 255                                 struct nf_conn *ct)
 256  {
 257         struct flow_offload_hw *offload;
 258
 259 -       offload = kmalloc(sizeof(struct flow_offload_hw), GFP_ATOMIC);
 260 +       offload = flow_offload_hw_prepare(net, flow);
 261         if (!offload)
 262                 return;
 263
 264         nf_conntrack_get(&ct->ct_general);
 265         offload->type = FLOW_OFFLOAD_ADD;
 266         offload->ct = ct;
 267 -       offload->flow = flow;
 268 -       write_pnet(&offload->flow_hw_net, net);
 269
 270         flow_offload_queue_work(offload);
 271  }
 272 @@ -119,14 +185,11 @@ static void flow_offload_hw_del(struct n
 273  {
 274         struct flow_offload_hw *offload;
 275
 276 -       offload = kmalloc(sizeof(struct flow_offload_hw), GFP_ATOMIC);
 277 +       offload = flow_offload_hw_prepare(net, flow);
 278         if (!offload)
 279                 return;
 280
 281         offload->type = FLOW_OFFLOAD_DEL;
 282 -       offload->ct = NULL;
 283 -       offload->flow = flow;
 284 -       write_pnet(&offload->flow_hw_net, net);
 285
 286         flow_offload_queue_work(offload);
 287  }
 288 @@ -153,12 +216,8 @@ static void __exit nf_flow_table_hw_modu
 289         nf_flow_table_hw_unregister(&flow_offload_hw);
 290         cancel_work_sync(&nf_flow_offload_hw_work);
 291
 292 -       list_for_each_entry_safe(offload, next, &hw_offload_pending, list) {
 293 -               if (offload->ct)
 294 -                       nf_conntrack_put(&offload->ct->ct_general);
 295 -               list_del(&offload->list);
 296 -               kfree(offload);
 297 -       }
 298 +       list_for_each_entry_safe(offload, next, &hw_offload_pending, list)
 299 +               flow_offload_hw_free(offload);
 300  }
 301
 302  module_init(nf_flow_table_hw_module_init);