netdev - Re: [PATCH net-next v4 2/3] flow_offload: Support get default block from tc immediately

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190729095526.17214c4d@cakuba.netronome.com>
Date:   Mon, 29 Jul 2019 09:55:26 -0700
From:   Jakub Kicinski <jakub.kicinski@...ronome.com>
To:     wenxu <wenxu@...oud.cn>
Cc:     pablo@...filter.org, fw@...len.de, netfilter-devel@...r.kernel.org,
        netdev@...r.kernel.org
Subject: Re: [PATCH net-next v4 2/3] flow_offload: Support get default block
 from tc immediately

On Mon, 29 Jul 2019 15:18:03 +0800, wenxu wrote:
> On 7/29/2019 12:42 PM, Jakub Kicinski wrote:
> > On Mon, 29 Jul 2019 10:43:56 +0800, wenxu wrote:  
> >> On 7/29/2019 4:16 AM, Jakub Kicinski wrote:  
> >>> I don't know the nft code, but it seems unlikely it wouldn't have the
> >>> same problem/need..    
> >> nft don't have the same problem.  The offload rule can only attached
> >> to offload base chain.
> >>
> >> Th  offload base chain is created after the device driver loaded (the
> >> device exist).  
> > For indirect blocks the block is on the tunnel device and the offload
> > target is another device. E.g. you offload rules from a VXLAN device
> > onto the ASIC. The ASICs driver does not have to be loaded when VXLAN
> > device is created.
> >
> > So I feel like either the chain somehow directly references the offload
> > target (in which case the indirect infrastructure with hash lookup etc
> > is not needed for nft), or indirect infra is needed, and we need to take
> > care of replays.  
> 
> I think the nft is different with tc. 
> 
> In tc case we can create vxlan device add a ingress qdisc with a block success
> 
> Then the ASIC driver loaded,  then register the vxlan indr-dev and get the block
> adn replay it to hardware
> 
> But in the nft case,  The base chain flags with offload. Create an offload netdev
> base chain on vxlan device will fail if there is no indr-device to offload.

Can you show us the offload chain spec? Does it specify offload to the
vxlan device or the ASIC device?

Indir-devs can come and go, how do you handle a situation where offload
chain was installed with indir listener present, but then the ASIC
driver got removed?