netdev - Re: [PATCHv10 ovs 00/15] Revalidate flows with unique identifiers.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 25 Nov 2014 11:45:26 -0800
From:	Joe Stringer <joestringer@...ira.com>
To:	"dev@...nvswitch.org" <dev@...nvswitch.org>
Cc:	Linux Netdev List <netdev@...r.kernel.org>
Subject: Re: [PATCHv10 ovs 00/15] Revalidate flows with unique identifiers.

On 13 November 2014 at 11:17, Joe Stringer <joestringer@...ira.com> wrote:
>
> This series modifies the dpif interface for flow commands to use 128-bit unique
> identifiers as an alternative to the netlink-formatted flow key, and caches the
> mask/actions in the udpif_key. This significantly reduces the cost of
> assembling messages between revalidators and the datapath, improving
> revalidation performance by 40% or more. In a test environment of many
> short-lived flows constantly being set up in the datapath, this increases the
> number of flows that can be maintained in the linux datapath from around
> 130-140K up to 190-200K. For the userspace datapath, this decreases the time
> spent revalidating 160K flows from 250ms to 150ms.
>
> The core of the changes sits in the handler and revalidator code. Handlers take
> responsibility for creating udpif_key cache entries which now include a copy of
> the flow mask and actions. Revalidators request datapaths to dump flows using
> only the unique identifier and stats, rather than the full set of
> netlink-formatted flow key, mask and actions.
>
> In cases where full revalidation is required, revalidators will use the
> udpif_key cache of the key/mask/acts to validate the flow. The dpif will
> detect datapath support for the unique identifer "UFID" feature, and omit flow
> keys from netlink transactions if it is supported. For backwards compatibility,
> flow keys will always be serialised if UFID support is not detected in the
> datapath.
>
> Patches 1,2,3,15 are unreviewed. Patch 12 needs further review.
>
> This series is also made available here to assist review:
> https://github.com/joestringer/openvswitch/tree/submit/ufid_v10
>

<snip>

>
> Joe Stringer (15):
>   tests: Add command to purge revalidators of flows.
>   ovs-bugtool: Log more detail for dumped flows.
>   datapath: Add 'is_mask' to ovs_nla_put_flow().
>   revalidator: Use 'cmap' for storing ukeys.
>   revalidator: Protect ukeys with a mutex.
>   udpif: Separate udpif_key maps from revalidators.
>   upcall: Rename dump_op -> ukey_op.
>   upcall: Create ukeys in handler threads.
>   upcall: Revalidate using cache of mask, actions.
>   hash: Add 128-bit murmurhash.
>   dpif: Generate flow_hash for revalidators in dpif.
>   datapath: Add support for unique flow identifiers.
>   dpif: Index flows using unique identifiers.
>   dpif: Minimize memory copy for revalidation.
>   dpctl: Add support for using UFID to add/del flows.


<snip>

I'm currently addressing feedback for the datapath patches, which also
involves minor changes to patch #13.

I've already pushed patch #1 as it provided an unrelated benefit.  As
this series is fairly close, my current plan is to push patches 4-11
to master this afternoon; these are long-running unchanged patches. I
will then resend patches 2,13,14,15 and the openvswitch.h changes for
final review here. I'll rebase the datapath changes against net-next
and go through review there.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html