| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20180628130907.951-1-jiri@resnulli.us>
Date: Thu, 28 Jun 2018 15:08:58 +0200
From: Jiri Pirko <jiri@...nulli.us>
To: netdev@...r.kernel.org
Cc: davem@...emloft.net, jhs@...atatu.com, xiyou.wangcong@...il.com,
jakub.kicinski@...ronome.com, simon.horman@...ronome.com,
john.hurley@...ronome.com, dsahern@...il.com, mlxsw@...lanox.com,
sridhar.samudrala@...el.com
Subject: [patch net-next v2 0/9] net: sched: introduce chain templates support with offloading to mlxsw
From: Jiri Pirko <jiri@...lanox.com>
For the TC clsact offload these days, some of HW drivers need
to hold a magic ball. The reason is, with the first inserted rule inside
HW they need to guess what fields will be used for the matching. If
later on this guess proves to be wrong and user adds a filter with a
different field to match, there's a problem. Mlxsw resolves it now with
couple of patterns. Those try to cover as many match fields as possible.
This aproach is far from optimal, both performance-wise and scale-wise.
Also, there is a combination of filters that in certain order won't
succeed.
Most of the time, when user inserts filters in chain, he knows right away
how the filters are going to look like - what type and option will they
have. For example, he knows that he will only insert filters of type
flower matching destination IP address. He can specify a template that
would cover all the filters in the chain.
This patchset is providing the possibility to user to provide such
template to kernel and propagate it all the way down to device
drivers.
See the examples below.
Create dummy device with clsact first:
# ip link add type dummy
# tc qdisc add dev dummy0 clsact
There is no template assigned by default:
# tc chaintemplate show dev dummy0 ingress
Add a template of type flower allowing to insert rules matching on last
2 bytes of destination mac address:
# tc chaintemplate add dev dummy0 ingress proto ip flower dst_mac 00:00:00:00:00:00/00:00:00:00:FF:FF
The template is now showed in the list:
# tc chaintemplate show dev dummy0 ingress
chaintemplate flower chain 0
dst_mac 00:00:00:00:00:00/00:00:00:00:ff:ff
eth_type ipv4
Add another template, this time for chain number 22:
# tc chaintemplate add dev dummy0 ingress proto ip chain 22 flower dst_ip 0.0.0.0/16
# tc chaintemplate show dev dummy0 ingress
chaintemplate flower chain 0
dst_mac 00:00:00:00:00:00/00:00:00:00:ff:ff
eth_type ipv4
chaintemplate flower chain 22
eth_type ipv4
dst_ip 0.0.0.0/16
Add a filter that fits the template:
# tc filter add dev dummy0 ingress proto ip flower dst_mac aa:bb:cc:dd:ee:ff/00:00:00:00:00:0F action drop
Addition of filters that does not fit the template would fail:
# tc filter add dev dummy0 ingress proto ip flower dst_mac aa:11:22:33:44:55/00:00:00:FF:00:00 action drop
Error: Mask does not fit the template.
We have an error talking to the kernel, -1
# tc filter add dev dummy0 ingress proto ip flower dst_ip 10.0.0.1 action drop
Error: Mask does not fit the template.
We have an error talking to the kernel, -1
Additions of filters to chain 22:
# tc filter add dev dummy0 ingress proto ip chain 22 flower dst_ip 10.0.0.1/8 action drop
# tc filter add dev dummy0 ingress proto ip chain 22 flower dst_ip 10.0.0.1 action drop
Error: Mask does not fit the template.
We have an error talking to the kernel, -1
# tc filter add dev dummy0 ingress proto ip chain 22 flower dst_ip 10.0.0.1/24 action drop
Error: Mask does not fit the template.
We have an error talking to the kernel, -1
Removal of a template from non-empty chain would fail:
# tc chaintemplate del dev dummy0 ingress
Error: The chain is not empty, unable to delete template.
We have an error talking to the kernel, -1
Once the chain is flushed, the template could be removed:
# tc filter del dev dummy0 ingress
# tc chaintemplate del dev dummy0 ingress
---
v1->v2:
- patch 5:
- rebase on top of the reoffload pathset
- patch 6:
- remove leftover extack arg in fl_hw_create_tmplt()
- rebase on top of the reoffload pathset
- patch 9:
- adjust to the userspace cmdline changes
Jiri Pirko (9):
net: sched: push ops lookup bits into tcf_proto_lookup_ops()
net: sched: introduce chain templates
net: sched: cls_flower: move key/mask dumping into a separate function
net: sched: cls_flower: change fl_init_dissector to accept mask and
dissector
net: sched: cls_flower: implement chain templates
net: sched: cls_flower: propagate chain teplate creation and
destruction to drivers
mlxsw: spectrum: Implement chain template hinting
selftests: forwarding: move shblock tc support check to a separate
helper
selftests: forwarding: add tests for TC chain templates
drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 5 +
drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 12 +-
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c | 12 +-
.../ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 25 +-
.../net/ethernet/mellanox/mlxsw/spectrum_flower.c | 44 ++-
include/net/pkt_cls.h | 2 +
include/net/sch_generic.h | 14 +-
include/uapi/linux/rtnetlink.h | 7 +
net/sched/cls_api.c | 424 +++++++++++++++++++--
net/sched/cls_basic.c | 2 +-
net/sched/cls_bpf.c | 3 +-
net/sched/cls_cgroup.c | 2 +-
net/sched/cls_flow.c | 3 +-
net/sched/cls_flower.c | 250 +++++++++---
net/sched/cls_fw.c | 3 +-
net/sched/cls_matchall.c | 3 +-
net/sched/cls_route.c | 2 +-
net/sched/cls_rsvp.h | 3 +-
net/sched/cls_tcindex.c | 2 +-
net/sched/cls_u32.c | 2 +-
security/selinux/nlmsgtab.c | 2 +-
tools/testing/selftests/net/forwarding/lib.sh | 12 +
.../selftests/net/forwarding/tc_chaintemplates.sh | 160 ++++++++
.../selftests/net/forwarding/tc_shblocks.sh | 2 +
24 files changed, 900 insertions(+), 96 deletions(-)
create mode 100755 tools/testing/selftests/net/forwarding/tc_chaintemplates.sh
--
2.14.4
Powered by blists - more mailing lists