Skip to contentSkip to conversation

nftables offload doesn't seem to work

DISCUSSION Patrick McLean 2 participants 3 messages Mar 1, 2020 – Mar 3, 2020

lore
Share & tools
lore

Patrick McLean

author
#0 lore raw

Hi,

I am trying to test the nftables offload support, as describe in
https://lwn.net/Articles/810663/

When I try to load the rules, or check a rules file, nft errors out, it appears that it does not understand "flags offload;":

# nft --check --file test.nft
test.nft:6:51-55: Error: syntax error, unexpected flags
                type filter hook ingress device if0 priority 0; flags offload;

Here is the contents of the file I am trying to load:

table netdev filter_test {
    chain ingress {
        type filter hook ingress device eth0 priority 0; flags offload;

        192.168.0.10 tcp dport 22 drop
    }
}

I am using the 5.4.22 kernel with nftables 0.9.3, the hardware is mlx5:

# ethtool --driver eth0
driver: mlx5_core
version: 5.0-0
firmware-version: 16.23.1020 (MT_0000000012)
expansion-rom-version:
bus-info: 0000:61:00.0
supports-statistics: yes
supports-test: yes
supports-eeprom-access: no
supports-register-dump: no
supports-priv-flags: yes

lspci reports it as:
61:00.0 Ethernet controller: Mellanox Technologies MT27800 Family [ConnectX-5]

author
#1 lore raw
Quoted 12 lines · On Sun, 1 Mar 2020 15:11:48 -0800 Patrick McLean <[email protected]> wrote:

Hi,

I am trying to test the nftables offload support, as describe in
https://lwn.net/Articles/810663/

When I try to load the rules, or check a rules file, nft errors out, it appears that it does not understand "flags offload;":

# nft --check --file test.nft
test.nft:6:51-55: Error: syntax error, unexpected flags
                type filter hook ingress device if0 priority 0; flags offload;
Quoted 7 lines

Here is the contents of the file I am trying to load:

table netdev filter_test {
    chain ingress {
        type filter hook ingress device eth0 priority 0; flags offload;

        192.168.0.10 tcp dport 22 drop

Oops, copy/paste error, this line is:
ip daddr 192.168.0.10 tcp dport 22 drop

Quoted 19 lines
    }
}

I am using the 5.4.22 kernel with nftables 0.9.3, the hardware is mlx5:

# ethtool --driver eth0
driver: mlx5_core
version: 5.0-0
firmware-version: 16.23.1020 (MT_0000000012)
expansion-rom-version:
bus-info: 0000:61:00.0
supports-statistics: yes
supports-test: yes
supports-eeprom-access: no
supports-register-dump: no
supports-priv-flags: yes

lspci reports it as:
61:00.0 Ethernet controller: Mellanox Technologies MT27800 Family [ConnectX-5]

#2 lore raw
Quoted 17 lines · Patrick McLean
Quoted 14 lines · On Sun, 1 Mar 2020 15:11:48 -0800 Patrick McLean <[email protected]> wrote:

Hi,

I am trying to test the nftables offload support, as describe in
https://lwn.net/Articles/810663/

When I try to load the rules, or check a rules file, nft errors out, it appears that it does not understand "flags offload;":

# nft --check --file test.nft
test.nft:6:51-55: Error: syntax error, unexpected flags
                type filter hook ingress device if0 priority 0; flags offload;

Here is the contents of the file I am trying to load:

Quoted 11 lines
Quoted 5 lines
table netdev filter_test {
    chain ingress {
        type filter hook ingress device eth0 priority 0; flags offload;

        192.168.0.10 tcp dport 22 drop

Oops, copy/paste error, this line is:
ip daddr 192.168.0.10 tcp dport 22 drop

Quoted 4 lines
    }
}

I am using the 5.4.22 kernel with nftables 0.9.3

You have to use a nftables snapshot from git.netfilter.org.

Please, remember to invoke ethtool first:

ethtool -K eth0 hw-tc-offload on

I'm planning to explore a way to make this transparent to the user, so the offload flag implicitly turns on this toggle, so users do not have to invoke ethtool and the 'flags offload' becomes sufficient to turn on hardware offload.

Please, note that basechain priorities are restricted to 1 to USHRT_MAX.

        type filter hook ingress device eth0 priority 1; flags offload;
                                                      ^

Such basechain priority limitation might be removed in the future, however, that will require cooperation from network driver maintainers.