On 7/8/26 11:48 AM, Pablo Neira Ayuso wrote:
> Hi,
>
> On Tue, Jul 07, 2026 at 11:10:41AM +0200, Eric Woudstra wrote:
>> Add nf_flow_rule_bridge().
>>
>> It only calls the common rule and adds the redirect.
>
> I decided to use the new _unsupp() function, so we don't pretend
> bridge hw offload is already supported. We will need a driver before
> we can add this, this stub does not provide much. I guess your goal
> was just to avoid a crash here.
>
No, I am already using hw_offload between bridged interfaces
on the mt7986 succesfully for almost 2 years.
It works dsa-port to direct interface (lan1 to eth1 on Bananapi R3) and
between direct interfaces (eth0 to eth1 on Bananapi-R3-mini)
It can also be tested with my bridge_fastpath.sh selftest script.
This script uses veth-device pairs to test the software fastpath.
It can also use 2 real interfaces interconnected in a loop of copper,
when chosen with commandline arguments. Then it tests software- and
hardware-fastpath. It also tests many different scenarios.
So this is why I've added it, as it is already functional. If a software
fastpath is setup correctly, the hardware fastpath is also functional.
>> Reviewed-by: Nikolay Aleksandrov <[email protected]>
>> Signed-off-by: Eric Woudstra <[email protected]>
>> ---
>> include/net/netfilter/nf_flow_table.h | 3 +++
>> net/netfilter/nf_flow_table_offload.c | 13 +++++++++++++
>> 2 files changed, 16 insertions(+)
>>
>> diff --git a/include/net/netfilter/nf_flow_table.h
>> b/include/net/netfilter/nf_flow_table.h
>> index 7b23b245a5a86..5c6e3b65ae85b 100644
>> --- a/include/net/netfilter/nf_flow_table.h
>> +++ b/include/net/netfilter/nf_flow_table.h
>> @@ -368,6 +368,9 @@ void nf_flow_table_offload_flush_cleanup(struct
>> nf_flowtable *flowtable);
>> int nf_flow_table_offload_setup(struct nf_flowtable *flowtable,
>> struct net_device *dev,
>> enum flow_block_command cmd);
>> +int nf_flow_rule_bridge(struct net *net, struct flow_offload *flow,
>> + enum flow_offload_tuple_dir dir,
>> + struct nf_flow_rule *flow_rule);
>> int nf_flow_rule_route_ipv4(struct net *net, struct flow_offload *flow,
>> enum flow_offload_tuple_dir dir,
>> struct nf_flow_rule *flow_rule);
>> diff --git a/net/netfilter/nf_flow_table_offload.c
>> b/net/netfilter/nf_flow_table_offload.c
>> index 002ec15d988bd..5566ebda7b7d3 100644
>> --- a/net/netfilter/nf_flow_table_offload.c
>> +++ b/net/netfilter/nf_flow_table_offload.c
>> @@ -740,6 +740,19 @@ nf_flow_rule_route_common(struct net *net, const struct
>> flow_offload *flow,
>> return 0;
>> }
>>
>> +int nf_flow_rule_bridge(struct net *net, struct flow_offload *flow,
>> + enum flow_offload_tuple_dir dir,
>> + struct nf_flow_rule *flow_rule)
>> +{
>> + if (nf_flow_rule_route_common(net, flow, dir, flow_rule) < 0)
>> + return -1;
>> +
>> + flow_offload_redirect(net, flow, dir, flow_rule);
>> +
>> + return 0;
>> +}
>> +EXPORT_SYMBOL_GPL(nf_flow_rule_bridge);
>> +
>> int nf_flow_rule_route_ipv4(struct net *net, struct flow_offload *flow,
>> enum flow_offload_tuple_dir dir,
>> struct nf_flow_rule *flow_rule)
>> --
>> 2.53.0
>>
