Re: [PATCH nf-next v3 0/3] netfilter: flowtable: carry a priority into the offload

[Pablo Neira Ayuso]

On Sun, Oct 04, 2026 at 07:16:33PM +0200, Julius Bairaktaris wrote:
> Packets forwarded by the flowtable skip the ruleset, so a priority set
> with "meta priority set" before "flow add" is lost after the first
> packets. Patch 2 stores skb->priority in the flow, applies it in the
> software fast path and passes it to drivers as FLOW_ACTION_PRIORITY.
> Patch 1 makes mlx5 ignore that action on flowtable flows, so flows it
> offloads today stay offloaded. Patch 3 adds a selftest.
> 
> v2 review asked whether this should be a flowtable attribute instead.
> A per-flow priority covers both one class per flowtable and a class
> chosen per connection, with existing syntax:
> 
>   meta priority set 1:3 flow add @ft
>   udp dport 5060 meta priority set 1:3 flow add @ft
> 
> An attribute needs one flowtable per class. nft rejects a device in
> two flowtables of the same table with -EEXIST, so it also needs one
> table per class. Pablo, is the per-flow approach fine with you?

I don't understand the "one flowtable per class".

> mlx5 maintainers: patch 1 is needed before patch 2 and is meant to go
> through nf-next; an Acked-by would allow that.
> 
> The selftest passes with the series, and its priority checks fail with
> only patch 3 applied (QEMU, three runs). The mlx5, airoha and mtk
> changes are compile-tested only; Lorenzo, a Tested-by on airoha would
> be welcome. struct flow_offload grows by 8 bytes.
> 
> Changes in v3:
> - new patch 1 for mlx5
> - airoha uses the priority for its QoS queue (Lorenzo Bianconi)
> - describe the tc flower effect and the TOS-derived priority
> - rebased onto nf-next
> 
> v2: https://lore.kernel.org/netfilter-devel/20260902155136.4963-1-julius@xxxxxxxxxxxxxx/
> v1: https://lore.kernel.org/netfilter-devel/20260901092632.369248-1-julius@xxxxxxxxxxxxxx/
> 
> Julius Bairaktaris (3):
>   net/mlx5e: Ignore FLOW_ACTION_PRIORITY on flowtable offload
>   netfilter: flowtable: carry a priority into the offload
>   selftests: netfilter: nft_flowtable.sh: check the priority a flow
>     carries
> 
>  Documentation/networking/nf_flowtable.rst     |   4 +-
>  drivers/net/ethernet/airoha/airoha_ppe.c      |   3 +
>  .../net/ethernet/mediatek/mtk_ppe_offload.c   |   1 +
>  .../net/ethernet/mellanox/mlx5/core/Makefile  |   2 +-
>  .../mellanox/mlx5/core/en/tc/act/act.c        |   1 +
>  .../mellanox/mlx5/core/en/tc/act/act.h        |   1 +
>  .../mellanox/mlx5/core/en/tc/act/prio.c       |  22 ++++
>  include/net/netfilter/nf_flow_table.h         |   1 +
>  net/netfilter/nf_flow_table_ip.c              |   6 +
>  net/netfilter/nf_flow_table_offload.c         |  11 ++
>  net/netfilter/nft_flow_offload.c              |   2 +
>  .../selftests/net/netfilter/nft_flowtable.sh  | 110 ++++++++++++++++++
>  12 files changed, 162 insertions(+), 2 deletions(-)
>  create mode 100644 drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/prio.c
> 
> 
> base-commit: 87b80c2f6b05cad9f0ff9136709c62a0f59923e3
> -- 
> 2.53.0
> 
>