This series detaches nf_flowtable from the two existing container structures. Allocation and freeing is moved to the flowtable core. Then, memory release is changed so it passes through another synchronize_rcu() call. Next, a new nftables flowtable flag is introduced to mark a flowtable for explicit XDP-based offload. Such flowtables have more restrictions, in particular, if two flowtables are tagged as 'xdp offloaded', they cannot share any net devices. It would be possible to avoid such new 'xdp flag', but I see no way to do so without breaking backwards compatbility: at this time the same net_device can be part of any number of flowtables, this is very inefficient from an XDP point of view: it would have to perform lookups in all associated flowtables in a loop until a match is found. This is hardly desirable. Last two patches expose the hash table mapping and make utility function available for XDP. The XDP kfunc will be added in a followup patch. Florian Westphal (8): netfilter: flowtable: move nf_flowtable out of container structures netfilter: nf_flowtable: replace init callback with a create one netfilter: nf_flowtable: make free a real free function netfilter: nf_flowtable: delay flowtable release a second time netfilter: nf_tables: reject flowtable hw offload for same device netfilter: nf_tables: add xdp offload flag netfilter: nf_tables: add flowtable map for xdp offload netfilter: nf_tables: permit duplicate flowtable mappings include/net/netfilter/nf_flow_table.h | 15 ++- include/net/netfilter/nf_tables.h | 15 ++- include/uapi/linux/netfilter/nf_tables.h | 5 +- net/netfilter/nf_flow_table_core.c | 39 ++++-- net/netfilter/nf_flow_table_inet.c | 6 +- net/netfilter/nf_flow_table_offload.c | 157 ++++++++++++++++++++++- net/netfilter/nf_tables_api.c | 113 +++++++++++----- net/netfilter/nft_flow_offload.c | 4 +- net/sched/act_ct.c | 37 +++--- 9 files changed, 315 insertions(+), 76 deletions(-) -- 2.41.0
