On 3/6/24 12:22 PM, Jamal Hadi Salim wrote:
I think my question was, who can use the act_bpf_kern object when all tc bpf prog is unloaded? If no one can use it, it should as well be cleaned up when the bpf prog is unloaded. or the kernel p4 pipeline can use the act_bpf_kern object even when there is no bpf prog loaded?
[ ... ]
I am looking at the conntrack code and i dont see how they release entries from the cotrack table when the bpf prog goes away.
[ ... ]
I asked earlier about conntrack (where we took the inspiration from): How is what we are doing different from contrack? If you can help me understand that i am more than willing to make the change. Conntrack entries can be added via the kfunc(same for us). Contrack entries can also be added from the control plane and can be found by ebpf lookups(same for us). They can be deleted by the control plane, timers, entry evictions to make space for new entries, etc (same for us). Not sure if they can be deleted by ebpf side (we can). Perusing the conntrack code, I could not find anything that indicated that entries created from ebpf are deleted when the ebpf program goes away. To re-emphasize: Maybe there's something subtle i am missing that we are not doing that conntrack is doing? Conntrack does one small thing we dont: It allocs and returns to ebpf the memory for insertion. I dont see that as particularly useful for our case (and more importantly how that results in the entries being deleted when the ebpf prog goes away)
afaik, the conntrack kfunc inserts "struct nf_conn" that can also be used by other kernel parts, so it is reasonable to go through the kernel existing eviction logic. It is why my earlier question on "is the act_bpf_kern object only useful for the bpf prog alone but not other kernel parts". From reading patch 14, it seems to be only usable by bpf prog. When all bpf program is unloaded, who will still read it and do something useful? If I mis-understood it, this will be useful to capture in the commit message to explain how it could be used by other kernel parts without bpf prog running.
