| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20190813120558.6151-10-toshiaki.makita1@gmail.com>
Date: Tue, 13 Aug 2019 21:05:53 +0900
From: Toshiaki Makita <toshiaki.makita1@...il.com>
To: Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Martin KaFai Lau <kafai@...com>,
Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
"David S. Miller" <davem@...emloft.net>,
Jakub Kicinski <jakub.kicinski@...ronome.com>,
Jesper Dangaard Brouer <hawk@...nel.org>,
John Fastabend <john.fastabend@...il.com>,
Jamal Hadi Salim <jhs@...atatu.com>,
Cong Wang <xiyou.wangcong@...il.com>,
Jiri Pirko <jiri@...nulli.us>
Cc: Toshiaki Makita <toshiaki.makita1@...il.com>,
netdev@...r.kernel.org, bpf@...r.kernel.org,
William Tu <u9012063@...il.com>
Subject: [RFC PATCH bpf-next 09/14] xdp_flow: Add netdev feature for enabling TC flower offload to XDP
The usage would be like this:
$ ethtool -K eth0 tc-offload-xdp on
$ tc qdisc add dev eth0 clsact
$ tc filter add dev eth0 ingress protocol ip flower skip_sw ...
Then the filters offloaded to XDP are marked as "in_hw".
If the tc flow block is created when tc-offload-xdp is enabled on the
device, the block is internally marked as xdp and only can be offloaded
to XDP.
The reason not to allow HW-offload and XDP-offload at the same time is
to avoid the situation where offloading to only one of them succeeds.
If we allow offloading to both, users cannot know which offload
succeeded.
NOTE: This makes flows offloaded to XDP look as if they are HW
offloaded, since they will be marked as "in_hw". This could be confusing.
Maybe we can add another status "in_xdp"? Then we can allow both of HW-
and XDP-offload at the same time.
Signed-off-by: Toshiaki Makita <toshiaki.makita1@...il.com>
---
include/linux/netdev_features.h | 2 ++
include/net/pkt_cls.h | 5 +++
include/net/sch_generic.h | 1 +
net/core/dev.c | 2 ++
net/core/ethtool.c | 1 +
net/sched/cls_api.c | 67 +++++++++++++++++++++++++++++++++++++---
net/xdp_flow/xdp_flow_kern_mod.c | 6 ++++
7 files changed, 80 insertions(+), 4 deletions(-)
diff --git a/include/linux/netdev_features.h b/include/linux/netdev_features.h
index 4b19c54..ddd201e 100644
--- a/include/linux/netdev_features.h
+++ b/include/linux/netdev_features.h
@@ -80,6 +80,7 @@ enum {
NETIF_F_GRO_HW_BIT, /* Hardware Generic receive offload */
NETIF_F_HW_TLS_RECORD_BIT, /* Offload TLS record */
+ NETIF_F_XDP_TC_BIT, /* Offload TC to XDP */
/*
* Add your fresh new feature above and remember to update
@@ -150,6 +151,7 @@ enum {
#define NETIF_F_GSO_UDP_L4 __NETIF_F(GSO_UDP_L4)
#define NETIF_F_HW_TLS_TX __NETIF_F(HW_TLS_TX)
#define NETIF_F_HW_TLS_RX __NETIF_F(HW_TLS_RX)
+#define NETIF_F_XDP_TC __NETIF_F(XDP_TC)
/* Finds the next feature with the highest number of the range of start till 0.
*/
diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
index e429809..d190aae 100644
--- a/include/net/pkt_cls.h
+++ b/include/net/pkt_cls.h
@@ -610,6 +610,11 @@ static inline bool tc_can_offload_extack(const struct net_device *dev,
return true;
}
+static inline bool tc_xdp_offload_enabled(const struct net_device *dev)
+{
+ return dev->features & NETIF_F_XDP_TC;
+}
+
static inline bool tc_skip_hw(u32 flags)
{
return (flags & TCA_CLS_FLAGS_SKIP_HW) ? true : false;
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 6b6b012..a4d90b5 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -402,6 +402,7 @@ struct tcf_block {
struct flow_block flow_block;
struct list_head owner_list;
bool keep_dst;
+ bool xdp;
unsigned int offloadcnt; /* Number of oddloaded filters */
unsigned int nooffloaddevcnt; /* Number of devs unable to do offload */
struct {
diff --git a/net/core/dev.c b/net/core/dev.c
index a45d2e4..d1f980d 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -8680,6 +8680,8 @@ int register_netdevice(struct net_device *dev)
* software offloads (GSO and GRO).
*/
dev->hw_features |= NETIF_F_SOFT_FEATURES;
+ if (IS_ENABLED(CONFIG_XDP_FLOW))
+ dev->hw_features |= NETIF_F_XDP_TC;
dev->features |= NETIF_F_SOFT_FEATURES;
if (dev->netdev_ops->ndo_udp_tunnel_add) {
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 6288e69..c7e61cf 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -111,6 +111,7 @@ int ethtool_op_get_ts_info(struct net_device *dev, struct ethtool_ts_info *info)
[NETIF_F_HW_TLS_RECORD_BIT] = "tls-hw-record",
[NETIF_F_HW_TLS_TX_BIT] = "tls-hw-tx-offload",
[NETIF_F_HW_TLS_RX_BIT] = "tls-hw-rx-offload",
+ [NETIF_F_XDP_TC_BIT] = "tc-offload-xdp",
};
static const char
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 3565d9a..4c89bab 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -37,6 +37,7 @@
#include <net/tc_act/tc_skbedit.h>
#include <net/tc_act/tc_ct.h>
#include <net/tc_act/tc_mpls.h>
+#include <net/flow_offload_xdp.h>
extern const struct nla_policy rtm_tca_policy[TCA_MAX + 1];
@@ -806,7 +807,7 @@ static int tcf_block_offload_cmd(struct tcf_block *block,
struct net_device *dev,
struct tcf_block_ext_info *ei,
enum flow_block_command command,
- struct netlink_ext_ack *extack)
+ bool xdp, struct netlink_ext_ack *extack)
{
struct flow_block_offload bo = {};
int err;
@@ -819,13 +820,39 @@ static int tcf_block_offload_cmd(struct tcf_block *block,
bo.extack = extack;
INIT_LIST_HEAD(&bo.cb_list);
- err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_BLOCK, &bo);
+ if (xdp)
+ err = xdp_flow_setup_block(dev, &bo);
+ else
+ err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_BLOCK, &bo);
if (err < 0)
return err;
return tcf_block_setup(block, &bo);
}
+static int tcf_block_offload_bind_xdp(struct tcf_block *block, struct Qdisc *q,
+ struct tcf_block_ext_info *ei,
+ struct netlink_ext_ack *extack)
+{
+ struct net_device *dev = q->dev_queue->dev;
+ int err;
+
+ if (!tc_xdp_offload_enabled(dev) && tcf_block_offload_in_use(block)) {
+ NL_SET_ERR_MSG(extack,
+ "Bind to offloaded block failed as dev has tc-offload-xdp disabled");
+ return -EOPNOTSUPP;
+ }
+
+ err = tcf_block_offload_cmd(block, dev, ei, FLOW_BLOCK_BIND, true,
+ extack);
+ if (err == -EOPNOTSUPP) {
+ block->nooffloaddevcnt++;
+ err = 0;
+ }
+
+ return err;
+}
+
static int tcf_block_offload_bind(struct tcf_block *block, struct Qdisc *q,
struct tcf_block_ext_info *ei,
struct netlink_ext_ack *extack)
@@ -833,6 +860,15 @@ static int tcf_block_offload_bind(struct tcf_block *block, struct Qdisc *q,
struct net_device *dev = q->dev_queue->dev;
int err;
+ if (block->xdp)
+ return tcf_block_offload_bind_xdp(block, q, ei, extack);
+
+ if (tc_xdp_offload_enabled(dev)) {
+ NL_SET_ERR_MSG(extack,
+ "Cannot bind to block created with tc-offload-xdp disabled");
+ return -EOPNOTSUPP;
+ }
+
if (!dev->netdev_ops->ndo_setup_tc)
goto no_offload_dev_inc;
@@ -844,7 +880,8 @@ static int tcf_block_offload_bind(struct tcf_block *block, struct Qdisc *q,
return -EOPNOTSUPP;
}
- err = tcf_block_offload_cmd(block, dev, ei, FLOW_BLOCK_BIND, extack);
+ err = tcf_block_offload_cmd(block, dev, ei, FLOW_BLOCK_BIND, false,
+ extack);
if (err == -EOPNOTSUPP)
goto no_offload_dev_inc;
if (err)
@@ -861,17 +898,35 @@ static int tcf_block_offload_bind(struct tcf_block *block, struct Qdisc *q,
return 0;
}
+static void tcf_block_offload_unbind_xdp(struct tcf_block *block,
+ struct net_device *dev,
+ struct tcf_block_ext_info *ei)
+{
+ int err;
+
+ err = tcf_block_offload_cmd(block, dev, ei, FLOW_BLOCK_UNBIND, true,
+ NULL);
+ if (err == -EOPNOTSUPP)
+ WARN_ON(block->nooffloaddevcnt-- == 0);
+}
+
static void tcf_block_offload_unbind(struct tcf_block *block, struct Qdisc *q,
struct tcf_block_ext_info *ei)
{
struct net_device *dev = q->dev_queue->dev;
int err;
+ if (block->xdp) {
+ tcf_block_offload_unbind_xdp(block, dev, ei);
+ return;
+ }
+
tc_indr_block_call(block, dev, ei, FLOW_BLOCK_UNBIND, NULL);
if (!dev->netdev_ops->ndo_setup_tc)
goto no_offload_dev_dec;
- err = tcf_block_offload_cmd(block, dev, ei, FLOW_BLOCK_UNBIND, NULL);
+ err = tcf_block_offload_cmd(block, dev, ei, FLOW_BLOCK_UNBIND, false,
+ NULL);
if (err == -EOPNOTSUPP)
goto no_offload_dev_dec;
return;
@@ -1004,6 +1059,10 @@ static struct tcf_block *tcf_block_create(struct net *net, struct Qdisc *q,
/* Don't store q pointer for blocks which are shared */
if (!tcf_block_shared(block))
block->q = q;
+
+ if (tc_xdp_offload_enabled(q->dev_queue->dev))
+ block->xdp = true;
+
return block;
}
diff --git a/net/xdp_flow/xdp_flow_kern_mod.c b/net/xdp_flow/xdp_flow_kern_mod.c
index fe925db..891b18c 100644
--- a/net/xdp_flow/xdp_flow_kern_mod.c
+++ b/net/xdp_flow/xdp_flow_kern_mod.c
@@ -410,6 +410,12 @@ static int xdp_flow_setup_block_cb(enum tc_setup_type type, void *type_data,
struct net_device *dev = cb_priv;
int err = 0;
+ if (!tc_xdp_offload_enabled(dev)) {
+ NL_SET_ERR_MSG(common->extack,
+ "tc-offload-xdp is disabled on net device");
+ return -EOPNOTSUPP;
+ }
+
if (common->chain_index) {
NL_SET_ERR_MSG(common->extack,
"xdp_flow supports only offload of chain 0");
--
1.8.3.1
Powered by blists - more mailing lists