Hi Jacub,

On Tue, 2022-11-01 at 08:49 -0700, Jakub Kicinski wrote:

EXTERNAL EMAIL: Do not click links or open attachments unless you know the
content is safe

On Tue, 1 Nov 2022 08:31:16 +0100 Steen Hegelund wrote:

quoted

quoted

Previous series in this context means previous revision or something
that was already merged?

Casper refers to this series (the first of the VCAP related series) that was
merged on Oct 24th:

https://lore.kernel.org/all/20221020130904.1215072-1-steen.hegelund@microchip.com/ (local)

Alright, looks like this is only in net-next so no risk of breaking
existing users.

That said you should reject filters you can't support with an extack
message set. Also see below.

quoted

quoted

quoted

tc filter add dev eth3 ingress chain 8000000 prio 10 handle 10 \

How are you using chains?

The chain ids are referring to the VCAP instances and their lookups.  There
are some more details
about this in the series I referred to above.

The short version is that this allows you to select where in the frame
processing flow your rule
will be inserted (using ingress or egress and the chain id).

quoted

I thought you need to offload FLOW_ACTION_GOTO to get to a chain,
and I get no hits on this driver.

I have not yet added the goto action, but one use of that is to chain a
filter from one VCAP
instance/lookup to another.

The goto action will be added in a soon-to-come series.  I just wanted to
avoid a series getting too
large, but on the other hand each of them should provide functionality that
you can use in practice.

The behavior of the offload must be the same as the SW implementation.
It sounds like in your case it very much isn't, as adding rules to
a magic chain in SW, without the goto will result in the rules being
unused.

I have sent a version 4 of the series, but I realized after sending it, that I
was probably not understanding the implications of what you were saying
entirely.

As far as I understand it now, I need to have a matchall rule that does a goto
from chain 0 (as this is where all traffic processing starts) to my first IS2
VCAP chain and this rule activates the IS2 VCAP lookup.

Each of the rules in this VCAP chain need to point to the next chain etc.

If the matchall rule is deleted the IS2 VCAP lookups should be disabled as there
is no longer any way to reach the VCAP chains.

Does that sound OK?

BR
Steen


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel