openvswitch: Mega flow implementation (03f0d916) · Commits · 戴 / test

Documentation/networking/openvswitch.txt

+40 −0

Original line number	Diff line number	Diff line
		@@ -91,6 +91,46 @@ Often we ellipsize arguments not important to the discussion, e.g.:
		in_port(1), eth(...), eth_type(0x0800), ipv4(...), tcp(...)


		Wildcarded flow key format
		--------------------------

		A wildcarded flow is described with two sequences of Netlink attributes
		passed over the Netlink socket. A flow key, exactly as described above, and an
		optional corresponding flow mask.

		A wildcarded flow can represent a group of exact match flows. Each '1' bit
		in the mask specifies a exact match with the corresponding bit in the flow key.
		A '0' bit specifies a don't care bit, which will match either a '1' or '0' bit
		of a incoming packet. Using wildcarded flow can improve the flow set up rate
		by reduce the number of new flows need to be processed by the user space program.

		Support for the mask Netlink attribute is optional for both the kernel and user
		space program. The kernel can ignore the mask attribute, installing an exact
		match flow, or reduce the number of don't care bits in the kernel to less than
		what was specified by the user space program. In this case, variations in bits
		that the kernel does not implement will simply result in additional flow setups.
		The kernel module will also work with user space programs that neither support
		nor supply flow mask attributes.

		Since the kernel may ignore or modify wildcard bits, it can be difficult for
		the userspace program to know exactly what matches are installed. There are
		two possible approaches: reactively install flows as they miss the kernel
		flow table (and therefore not attempt to determine wildcard changes at all)
		or use the kernel's response messages to determine the installed wildcards.

		When interacting with userspace, the kernel should maintain the match portion
		of the key exactly as originally installed. This will provides a handle to
		identify the flow for all future operations. However, when reporting the
		mask of an installed flow, the mask should include any restrictions imposed
		by the kernel.

		The behavior when using overlapping wildcarded flows is undefined. It is the
		responsibility of the user space program to ensure that any incoming packet
		can match at most one flow, wildcarded or not. The current implementation
		performs best-effort detection of overlapping wildcarded flows and may reject
		some but not all of them. However, this behavior may change in future versions.


		Basic rule for evolving flow keys
		---------------------------------

include/uapi/linux/openvswitch.h

+8 −1

Original line number	Diff line number	Diff line

		/*
		* Copyright (c) 2007-2011 Nicira Networks.
		* Copyright (c) 2007-2013 Nicira, Inc.
		*
		* This program is free software; you can redistribute it and/or
		* modify it under the terms of version 2 of the GNU General Public
		@@ -379,6 +379,12 @@ struct ovs_key_nd {
		* @OVS_FLOW_ATTR_CLEAR: If present in a %OVS_FLOW_CMD_SET request, clears the
		* last-used time, accumulated TCP flags, and statistics for this flow.
		* Otherwise ignored in requests. Never present in notifications.
		* @OVS_FLOW_ATTR_MASK: Nested %OVS_KEY_ATTR_* attributes specifying the
		* mask bits for wildcarded flow match. Mask bit value '1' specifies exact
		* match with corresponding flow key bit, while mask bit value '0' specifies
		* a wildcarded match. Omitting attribute is treated as wildcarding all
		* corresponding fields. Optional for all requests. If not present,
		* all flow key bits are exact match bits.
		*
		* These attributes follow the &struct ovs_header within the Generic Netlink
		* payload for %OVS_FLOW_* commands.
		@@ -391,6 +397,7 @@ enum ovs_flow_attr {
		OVS_FLOW_ATTR_TCP_FLAGS, /* 8-bit OR'd TCP flags. */
		OVS_FLOW_ATTR_USED, /* u64 msecs last used in monotonic time. */
		OVS_FLOW_ATTR_CLEAR, /* Flag to clear stats, tcp_flags, used. */
		OVS_FLOW_ATTR_MASK, /* Sequence of OVS_KEY_ATTR_* attributes. */
		__OVS_FLOW_ATTR_MAX
		};

net/openvswitch/actions.c

+4 −2

Original line number	Diff line number	Diff line
		/*
		* Copyright (c) 2007-2012 Nicira, Inc.
		* Copyright (c) 2007-2013 Nicira, Inc.
		*
		* This program is free software; you can redistribute it and/or
		* modify it under the terms of version 2 of the GNU General Public
		@@ -376,8 +376,10 @@ static int output_userspace(struct datapath dp, struct sk_buff skb,
		const struct nlattr *a;
		int rem;

		BUG_ON(!OVS_CB(skb)->pkt_key);

		upcall.cmd = OVS_PACKET_CMD_ACTION;
		upcall.key = &OVS_CB(skb)->flow->key;
		upcall.key = OVS_CB(skb)->pkt_key;
		upcall.userdata = NULL;
		upcall.portid = 0;

net/openvswitch/datapath.c

+100 −40

Original line number	Diff line number	Diff line
		/*
		* Copyright (c) 2007-2012 Nicira, Inc.
		* Copyright (c) 2007-2013 Nicira, Inc.
		*
		* This program is free software; you can redistribute it and/or
		* modify it under the terms of version 2 of the GNU General Public
		@@ -165,7 +165,7 @@ static void destroy_dp_rcu(struct rcu_head *rcu)
		{
		struct datapath *dp = container_of(rcu, struct datapath, rcu);

		ovs_flow_tbl_destroy((__force struct flow_table *)dp->table);
		ovs_flow_tbl_destroy((__force struct flow_table *)dp->table, false);
		free_percpu(dp->stats_percpu);
		release_net(ovs_dp_get_net(dp));
		kfree(dp->ports);
		@@ -226,19 +226,18 @@ void ovs_dp_process_received_packet(struct vport p, struct sk_buff skb)
		struct sw_flow_key key;
		u64 *stats_counter;
		int error;
		int key_len;

		stats = this_cpu_ptr(dp->stats_percpu);

		/* Extract flow from 'skb' into 'key'. */
		error = ovs_flow_extract(skb, p->port_no, &key, &key_len);
		error = ovs_flow_extract(skb, p->port_no, &key);
		if (unlikely(error)) {
		kfree_skb(skb);
		return;
		}

		/* Look up flow. */
		flow = ovs_flow_tbl_lookup(rcu_dereference(dp->table), &key, key_len);
		flow = ovs_flow_lookup(rcu_dereference(dp->table), &key);
		if (unlikely(!flow)) {
		struct dp_upcall_info upcall;

		@@ -253,6 +252,7 @@ void ovs_dp_process_received_packet(struct vport p, struct sk_buff skb)
		}

		OVS_CB(skb)->flow = flow;
		OVS_CB(skb)->pkt_key = &key;

		stats_counter = &stats->n_hit;
		ovs_flow_used(OVS_CB(skb)->flow, skb);
		@@ -435,7 +435,7 @@ static int queue_userspace_packet(struct net *net, int dp_ifindex,
		upcall->dp_ifindex = dp_ifindex;

		nla = nla_nest_start(user_skb, OVS_PACKET_ATTR_KEY);
		ovs_flow_to_nlattrs(upcall_info->key, user_skb);
		ovs_flow_to_nlattrs(upcall_info->key, upcall_info->key, user_skb);
		nla_nest_end(user_skb, nla);

		if (upcall_info->userdata)
		@@ -468,7 +468,7 @@ static int flush_flows(struct datapath *dp)

		rcu_assign_pointer(dp->table, new_table);

		ovs_flow_tbl_deferred_destroy(old_table);
		ovs_flow_tbl_destroy(old_table, true);
		return 0;
		}

		@@ -611,10 +611,12 @@ static int validate_tp_port(const struct sw_flow_key *flow_key)
		static int validate_and_copy_set_tun(const struct nlattr *attr,
		struct sw_flow_actions **sfa)
		{
		struct ovs_key_ipv4_tunnel tun_key;
		struct sw_flow_match match;
		struct sw_flow_key key;
		int err, start;

		err = ovs_ipv4_tun_from_nlattr(nla_data(attr), &tun_key);
		ovs_match_init(&match, &key, NULL);
		err = ovs_ipv4_tun_from_nlattr(nla_data(attr), &match, false);
		if (err)
		return err;

		@@ -622,7 +624,8 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
		if (start < 0)
		return start;

		err = add_action(sfa, OVS_KEY_ATTR_IPV4_TUNNEL, &tun_key, sizeof(tun_key));
		err = add_action(sfa, OVS_KEY_ATTR_IPV4_TUNNEL, &match.key->tun_key,
		sizeof(match.key->tun_key));
		add_nested_action_end(*sfa, start);

		return err;
		@@ -857,7 +860,6 @@ static int ovs_packet_cmd_execute(struct sk_buff skb, struct genl_info info)
		struct ethhdr *eth;
		int len;
		int err;
		int key_len;

		err = -EINVAL;
		if (!a[OVS_PACKET_ATTR_PACKET] \|\| !a[OVS_PACKET_ATTR_KEY] \|\|
		@@ -890,11 +892,11 @@ static int ovs_packet_cmd_execute(struct sk_buff skb, struct genl_info info)
		if (IS_ERR(flow))
		goto err_kfree_skb;

		err = ovs_flow_extract(packet, -1, &flow->key, &key_len);
		err = ovs_flow_extract(packet, -1, &flow->key);
		if (err)
		goto err_flow_free;

		err = ovs_flow_metadata_from_nlattrs(flow, key_len, a[OVS_PACKET_ATTR_KEY]);
		err = ovs_flow_metadata_from_nlattrs(flow, a[OVS_PACKET_ATTR_KEY]);
		if (err)
		goto err_flow_free;
		acts = ovs_flow_actions_alloc(nla_len(a[OVS_PACKET_ATTR_ACTIONS]));
		@@ -908,6 +910,7 @@ static int ovs_packet_cmd_execute(struct sk_buff skb, struct genl_info info)
		goto err_flow_free;

		OVS_CB(packet)->flow = flow;
		OVS_CB(packet)->pkt_key = &flow->key;
		packet->priority = flow->key.phy.priority;
		packet->mark = flow->key.phy.skb_mark;

		@@ -922,13 +925,13 @@ static int ovs_packet_cmd_execute(struct sk_buff skb, struct genl_info info)
		local_bh_enable();
		rcu_read_unlock();

		ovs_flow_free(flow);
		ovs_flow_free(flow, false);
		return err;

		err_unlock:
		rcu_read_unlock();
		err_flow_free:
		ovs_flow_free(flow);
		ovs_flow_free(flow, false);
		err_kfree_skb:
		kfree_skb(packet);
		err:
		@@ -1045,7 +1048,8 @@ static int set_action_to_attr(const struct nlattr a, struct sk_buff skb)
		if (!start)
		return -EMSGSIZE;

		err = ovs_ipv4_tun_to_nlattr(skb, nla_data(ovs_key));
		err = ovs_ipv4_tun_to_nlattr(skb, nla_data(ovs_key),
		nla_data(ovs_key));
		if (err)
		return err;
		nla_nest_end(skb, start);
		@@ -1093,6 +1097,7 @@ static size_t ovs_flow_cmd_msg_size(const struct sw_flow_actions *acts)
		{
		return NLMSG_ALIGN(sizeof(struct ovs_header))
		+ nla_total_size(key_attr_size()) /* OVS_FLOW_ATTR_KEY */
		+ nla_total_size(key_attr_size()) /* OVS_FLOW_ATTR_MASK */
		+ nla_total_size(sizeof(struct ovs_flow_stats)) /* OVS_FLOW_ATTR_STATS */
		+ nla_total_size(1) /* OVS_FLOW_ATTR_TCP_FLAGS */
		+ nla_total_size(8) /* OVS_FLOW_ATTR_USED */
		@@ -1119,12 +1124,25 @@ static int ovs_flow_cmd_fill_info(struct sw_flow flow, struct datapath dp,

		ovs_header->dp_ifindex = get_dpifindex(dp);

		/* Fill flow key. */
		nla = nla_nest_start(skb, OVS_FLOW_ATTR_KEY);
		if (!nla)
		goto nla_put_failure;
		err = ovs_flow_to_nlattrs(&flow->key, skb);

		err = ovs_flow_to_nlattrs(&flow->unmasked_key,
		&flow->unmasked_key, skb);
		if (err)
		goto error;
		nla_nest_end(skb, nla);

		nla = nla_nest_start(skb, OVS_FLOW_ATTR_MASK);
		if (!nla)
		goto nla_put_failure;

		err = ovs_flow_to_nlattrs(&flow->key, &flow->mask->key, skb);
		if (err)
		goto error;

		nla_nest_end(skb, nla);

		spin_lock_bh(&flow->lock);
		@@ -1214,20 +1232,24 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff skb, struct genl_info info)
		{
		struct nlattr **a = info->attrs;
		struct ovs_header *ovs_header = info->userhdr;
		struct sw_flow_key key;
		struct sw_flow *flow;
		struct sw_flow_key key, masked_key;
		struct sw_flow *flow = NULL;
		struct sw_flow_mask mask;
		struct sk_buff *reply;
		struct datapath *dp;
		struct flow_table *table;
		struct sw_flow_actions *acts = NULL;
		struct sw_flow_match match;
		int error;
		int key_len;

		/* Extract key. */
		error = -EINVAL;
		if (!a[OVS_FLOW_ATTR_KEY])
		goto error;
		error = ovs_flow_from_nlattrs(&key, &key_len, a[OVS_FLOW_ATTR_KEY]);

		ovs_match_init(&match, &key, &mask);
		error = ovs_match_from_nlattrs(&match,
		a[OVS_FLOW_ATTR_KEY], a[OVS_FLOW_ATTR_MASK]);
		if (error)
		goto error;

		@@ -1238,9 +1260,13 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff skb, struct genl_info info)
		if (IS_ERR(acts))
		goto error;

		error = validate_and_copy_actions(a[OVS_FLOW_ATTR_ACTIONS], &key, 0, &acts);
		if (error)
		ovs_flow_key_mask(&masked_key, &key, &mask);
		error = validate_and_copy_actions(a[OVS_FLOW_ATTR_ACTIONS],
		&masked_key, 0, &acts);
		if (error) {
		OVS_NLERR("Flow actions may not be safe on all matching packets.\n");
		goto err_kfree;
		}
		} else if (info->genlhdr->cmd == OVS_FLOW_CMD_NEW) {
		error = -EINVAL;
		goto error;
		@@ -1253,8 +1279,11 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff skb, struct genl_info info)
		goto err_unlock_ovs;

		table = ovsl_dereference(dp->table);
		flow = ovs_flow_tbl_lookup(table, &key, key_len);

		/* Check if this is a duplicate flow */
		flow = ovs_flow_lookup(table, &key);
		if (!flow) {
		struct sw_flow_mask *mask_p;
		/* Bail out if we're not allowed to create a new flow. */
		error = -ENOENT;
		if (info->genlhdr->cmd == OVS_FLOW_CMD_SET)
		@@ -1267,7 +1296,7 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff skb, struct genl_info info)
		new_table = ovs_flow_tbl_expand(table);
		if (!IS_ERR(new_table)) {
		rcu_assign_pointer(dp->table, new_table);
		ovs_flow_tbl_deferred_destroy(table);
		ovs_flow_tbl_destroy(table, true);
		table = ovsl_dereference(dp->table);
		}
		}
		@@ -1280,14 +1309,30 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff skb, struct genl_info info)
		}
		clear_stats(flow);

		flow->key = masked_key;
		flow->unmasked_key = key;

		/* Make sure mask is unique in the system */
		mask_p = ovs_sw_flow_mask_find(table, &mask);
		if (!mask_p) {
		/* Allocate a new mask if none exsits. */
		mask_p = ovs_sw_flow_mask_alloc();
		if (!mask_p)
		goto err_flow_free;
		mask_p->key = mask.key;
		mask_p->range = mask.range;
		ovs_sw_flow_mask_insert(table, mask_p);
		}

		ovs_sw_flow_mask_add_ref(mask_p);
		flow->mask = mask_p;
		rcu_assign_pointer(flow->sf_acts, acts);

		/* Put flow in bucket. */
		ovs_flow_tbl_insert(table, flow, &key, key_len);
		ovs_flow_insert(table, flow);

		reply = ovs_flow_cmd_build_info(flow, dp, info->snd_portid,
		info->snd_seq,
		OVS_FLOW_CMD_NEW);
		info->snd_seq, OVS_FLOW_CMD_NEW);
		} else {
		/* We found a matching flow. */
		struct sw_flow_actions *old_acts;
		@@ -1303,6 +1348,13 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff skb, struct genl_info info)
		info->nlhdr->nlmsg_flags & (NLM_F_CREATE \| NLM_F_EXCL))
		goto err_unlock_ovs;

		/* The unmasked key has to be the same for flow updates. */
		error = -EINVAL;
		if (!ovs_flow_cmp_unmasked_key(flow, &key, match.range.end)) {
		OVS_NLERR("Flow modification message rejected, unmasked key does not match.\n");
		goto err_unlock_ovs;
		}

		/* Update actions. */
		old_acts = ovsl_dereference(flow->sf_acts);
		rcu_assign_pointer(flow->sf_acts, acts);
		@@ -1327,6 +1379,8 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff skb, struct genl_info info)
		ovs_dp_flow_multicast_group.id, PTR_ERR(reply));
		return 0;

		err_flow_free:
		ovs_flow_free(flow, false);
		err_unlock_ovs:
		ovs_unlock();
		err_kfree:
		@@ -1344,12 +1398,16 @@ static int ovs_flow_cmd_get(struct sk_buff skb, struct genl_info info)
		struct sw_flow *flow;
		struct datapath *dp;
		struct flow_table *table;
		struct sw_flow_match match;
		int err;
		int key_len;

		if (!a[OVS_FLOW_ATTR_KEY])
		if (!a[OVS_FLOW_ATTR_KEY]) {
		OVS_NLERR("Flow get message rejected, Key attribute missing.\n");
		return -EINVAL;
		err = ovs_flow_from_nlattrs(&key, &key_len, a[OVS_FLOW_ATTR_KEY]);
		}

		ovs_match_init(&match, &key, NULL);
		err = ovs_match_from_nlattrs(&match, a[OVS_FLOW_ATTR_KEY], NULL);
		if (err)
		return err;

		@@ -1361,7 +1419,7 @@ static int ovs_flow_cmd_get(struct sk_buff skb, struct genl_info info)
		}

		table = ovsl_dereference(dp->table);
		flow = ovs_flow_tbl_lookup(table, &key, key_len);
		flow = ovs_flow_lookup_unmasked_key(table, &match);
		if (!flow) {
		err = -ENOENT;
		goto unlock;
		@@ -1390,8 +1448,8 @@ static int ovs_flow_cmd_del(struct sk_buff skb, struct genl_info info)
		struct sw_flow *flow;
		struct datapath *dp;
		struct flow_table *table;
		struct sw_flow_match match;
		int err;
		int key_len;

		ovs_lock();
		dp = get_dp(sock_net(skb->sk), ovs_header->dp_ifindex);
		@@ -1404,12 +1462,14 @@ static int ovs_flow_cmd_del(struct sk_buff skb, struct genl_info info)
		err = flush_flows(dp);
		goto unlock;
		}
		err = ovs_flow_from_nlattrs(&key, &key_len, a[OVS_FLOW_ATTR_KEY]);

		ovs_match_init(&match, &key, NULL);
		err = ovs_match_from_nlattrs(&match, a[OVS_FLOW_ATTR_KEY], NULL);
		if (err)
		goto unlock;

		table = ovsl_dereference(dp->table);
		flow = ovs_flow_tbl_lookup(table, &key, key_len);
		flow = ovs_flow_lookup_unmasked_key(table, &match);
		if (!flow) {
		err = -ENOENT;
		goto unlock;
		@@ -1421,13 +1481,13 @@ static int ovs_flow_cmd_del(struct sk_buff skb, struct genl_info info)
		goto unlock;
		}

		ovs_flow_tbl_remove(table, flow);
		ovs_flow_remove(table, flow);

		err = ovs_flow_cmd_fill_info(flow, dp, reply, info->snd_portid,
		info->snd_seq, 0, OVS_FLOW_CMD_DEL);
		BUG_ON(err < 0);

		ovs_flow_deferred_free(flow);
		ovs_flow_free(flow, true);
		ovs_unlock();

		ovs_notify(reply, info, &ovs_dp_flow_multicast_group);
		@@ -1457,7 +1517,7 @@ static int ovs_flow_cmd_dump(struct sk_buff skb, struct netlink_callback cb)

		bucket = cb->args[0];
		obj = cb->args[1];
		flow = ovs_flow_tbl_next(table, &bucket, &obj);
		flow = ovs_flow_dump_next(table, &bucket, &obj);
		if (!flow)
		break;

		@@ -1680,7 +1740,7 @@ err_destroy_ports_array:
		err_destroy_percpu:
		free_percpu(dp->stats_percpu);
		err_destroy_table:
		ovs_flow_tbl_destroy(ovsl_dereference(dp->table));
		ovs_flow_tbl_destroy(ovsl_dereference(dp->table), false);
		err_free_dp:
		release_net(ovs_dp_get_net(dp));
		kfree(dp);
		@@ -2287,7 +2347,7 @@ static void rehash_flow_table(struct work_struct *work)
		new_table = ovs_flow_tbl_rehash(old_table);
		if (!IS_ERR(new_table)) {
		rcu_assign_pointer(dp->table, new_table);
		ovs_flow_tbl_deferred_destroy(old_table);
		ovs_flow_tbl_destroy(old_table, true);
		}
		}
		}

net/openvswitch/datapath.h

+6 −0

Original line number	Diff line number	Diff line
		@@ -88,11 +88,13 @@ struct datapath {
		/**
		* struct ovs_skb_cb - OVS data in skb CB
		* @flow: The flow associated with this packet. May be %NULL if no flow.
		* @pkt_key: The flow information extracted from the packet. Must be nonnull.
		* @tun_key: Key for the tunnel that encapsulated this packet. NULL if the
		* packet is not being tunneled.
		*/
		struct ovs_skb_cb {
		struct sw_flow *flow;
		struct sw_flow_key *pkt_key;
		struct ovs_key_ipv4_tunnel *tun_key;
		};
		#define OVS_CB(skb) ((struct ovs_skb_cb *)(skb)->cb)
		@@ -183,4 +185,8 @@ struct sk_buff ovs_vport_cmd_build_info(struct vport , u32 pid, u32 seq,

		int ovs_execute_actions(struct datapath dp, struct sk_buff skb);
		void ovs_dp_notify_wq(struct work_struct *work);

		#define OVS_NLERR(fmt, ...) \
		pr_info_once("netlink: " fmt, ##__VA_ARGS__)

		#endif /* datapath.h */

Admin message