From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jiri Pirko Subject: [patch net-next v4 00/12] sched: introduce chain templates support with offloading to mlxsw Date: Mon, 23 Jul 2018 09:23:03 +0200 Message-ID: <20180723072312.4153-1-jiri@resnulli.us> Cc: davem@davemloft.net, jhs@mojatatu.com, xiyou.wangcong@gmail.com, jakub.kicinski@netronome.com, simon.horman@netronome.com, john.hurley@netronome.com, dsahern@gmail.com, mlxsw@mellanox.com, sridhar.samudrala@intel.com To: netdev@vger.kernel.org Return-path: Received: from mail-wr1-f68.google.com ([209.85.221.68]:44854 "EHLO mail-wr1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387923AbeGWIZ1 (ORCPT ); Mon, 23 Jul 2018 04:25:27 -0400 Received: by mail-wr1-f68.google.com with SMTP id r16-v6so16771674wrt.11 for ; Mon, 23 Jul 2018 00:25:36 -0700 (PDT) Sender: netdev-owner@vger.kernel.org List-ID: From: Jiri Pirko For the TC clsact offload these days, some of HW drivers need to hold a magic ball. The reason is, with the first inserted rule inside HW they need to guess what fields will be used for the matching. If later on this guess proves to be wrong and user adds a filter with a different field to match, there's a problem. Mlxsw resolves it now with couple of patterns. Those try to cover as many match fields as possible. This aproach is far from optimal, both performance-wise and scale-wise. Also, there is a combination of filters that in certain order won't succeed. Most of the time, when user inserts filters in chain, he knows right away how the filters are going to look like - what type and option will they have. For example, he knows that he will only insert filters of type flower matching destination IP address. He can specify a template that would cover all the filters in the chain. This patchset is providing the possibility to user to provide such template to kernel and propagate it all the way down to device drivers. See the examples below. Create dummy device with clsact first: # ip link add type dummy # tc qdisc add dev dummy0 clsact There is no chain present by by default: # tc chaintemplate show dev dummy0 ingress Add chain number 11 by explicit command: # tc chain add dev dummy0 ingress chain 11 # tc chain show dev dummy0 ingress chain parent ffff: chain 11 Add filter to chain number 12 which does not exist. That will create implicit chain 12: # tc filter add dev dummy0 ingress protocol ip pref 25 handle 1 chain 12 flower dst_ip 192.168.1.1 action drop # tc chain show dev dummy0 ingress chain parent ffff: chain 11 chain parent ffff: chain 12 Delete both chains: # tc chain del dev dummy0 ingress chain 11 # tc chain del dev dummy0 ingress chain 12 # tc chain show dev dummy0 ingress Add a chain with template of type flower allowing to insert rules matching on last 2 bytes of destination mac address: # tc chain add dev dummy0 ingress proto ip flower dst_mac 00:00:00:00:00:00/00:00:00:00:FF:FF The chain with template is now showed in the list: # tc chain show dev dummy0 ingress chain parent ffff: flower chain 0 dst_mac 00:00:00:00:00:00/00:00:00:00:ff:ff eth_type ipv4 Add another chain (number 22) with template: # tc chain add dev dummy0 ingress proto ip chain 22 flower dst_ip 0.0.0.0/16 # tc chain show dev dummy0 ingress chain parent ffff: flower chain 0 dst_mac 00:00:00:00:00:00/00:00:00:00:ff:ff eth_type ipv4 chain parent ffff: flower chain 22 eth_type ipv4 dst_ip 0.0.0.0/16 Add a filter that fits the template: # tc filter add dev dummy0 ingress proto ip flower dst_mac aa:bb:cc:dd:ee:ff/00:00:00:00:00:0F action drop Addition of filters that does not fit the template would fail: # tc filter add dev dummy0 ingress proto ip flower dst_mac aa:11:22:33:44:55/00:00:00:FF:00:00 action drop Error: cls_flower: Mask does not fit the template. We have an error talking to the kernel, -1 # tc filter add dev dummy0 ingress proto ip flower dst_ip 10.0.0.1 action drop Error: cls_flower: Mask does not fit the template. We have an error talking to the kernel, -1 Additions of filters to chain 22: # tc filter add dev dummy0 ingress proto ip chain 22 flower dst_ip 10.0.0.1/8 action drop # tc filter add dev dummy0 ingress proto ip chain 22 flower dst_ip 10.0.0.1 action drop Error: cls_flower: Mask does not fit the template. We have an error talking to the kernel, -1 # tc filter add dev dummy0 ingress proto ip chain 22 flower dst_ip 10.0.0.1/24 action drop Error: cls_flower: Mask does not fit the template. We have an error talking to the kernel, -1 --- v3->v4: - patch 2: - new patch - patch 3: - new patch, derived from the previous v3 chaintemplate obj patch - patch 4: - only templates part as chains creation/deletion is now a separate patch - don't pass template priv as arg of "change" op - patch 6: - rebased on top of flower cvlan patch and ip tos/ttl patch - patch 7: - templave priv is no longer passed as an arg to "change" op - patch 11: - split from the originally single patch - patch 12: - split from the originally single patch v2->v3: - patch 7: - rebase on top of the reoffload patchset - patch 8: - rebase on top of the reoffload patchset v1->v2: - patch 8: - remove leftover extack arg in fl_hw_create_tmplt() --- Jiri Pirko (12): net: sched: push ops lookup bits into tcf_proto_lookup_ops() net: sched: Avoid implicit chain 0 creation net: sched: introduce chain object to uapi net: sched: introduce chain templates net: sched: cls_flower: move key/mask dumping into a separate function net: sched: cls_flower: change fl_init_dissector to accept mask and dissector net: sched: cls_flower: implement chain templates net: sched: cls_flower: propagate chain teplate creation and destruction to drivers mlxsw: spectrum: Implement chain template hinting selftests: forwarding: move shblock tc support check to a separate helper selftests: forwarding: add tests for TC chains creation adn destruction selftests: forwarding: add tests for TC chain templates drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 5 + drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 9 +- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c | 12 +- .../ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 25 +- .../ethernet/mellanox/mlxsw/spectrum_acl_tcam.h | 3 +- .../net/ethernet/mellanox/mlxsw/spectrum_flower.c | 44 +- include/net/pkt_cls.h | 2 + include/net/sch_generic.h | 18 +- include/uapi/linux/rtnetlink.h | 7 + net/sched/cls_api.c | 512 +++++++++++++++++---- net/sched/cls_flower.c | 250 ++++++++-- security/selinux/nlmsgtab.c | 2 +- tools/testing/selftests/net/forwarding/lib.sh | 12 + .../testing/selftests/net/forwarding/tc_chains.sh | 65 ++- .../selftests/net/forwarding/tc_shblocks.sh | 2 + 15 files changed, 829 insertions(+), 139 deletions(-) -- 2.14.4