From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.8 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_NEOMUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 80784C282C0 for ; Wed, 23 Jan 2019 12:47:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 46F6E20870 for ; Wed, 23 Jan 2019 12:47:38 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=verge.net.au header.i=@verge.net.au header.b="gpKOyHa7" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726267AbfAWMrh (ORCPT ); Wed, 23 Jan 2019 07:47:37 -0500 Received: from kirsty.vergenet.net ([202.4.237.240]:52812 "EHLO kirsty.vergenet.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726104AbfAWMrh (ORCPT ); Wed, 23 Jan 2019 07:47:37 -0500 Received: from reginn.horms.nl (watermunt.horms.nl [80.127.179.77]) by kirsty.vergenet.net (Postfix) with ESMTPA id AE41525BE34; Wed, 23 Jan 2019 23:47:32 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=verge.net.au; s=mail; t=1548247653; bh=mJbUAJNrsZgiz3DAm5zWDZ/vZzEesH1vcsaq1db9vE0=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=gpKOyHa7NgZCDNEWyceltVK0jZ2AYHfD88hKj09ftzdFwPqdtX7HvQ7XoNsjblSqj rWldA7XFruNnMMcPq3gvMTiFGgKVL+iiPd5FYQQtPr2lEOODBla18NhOU37D6q950+ vamErQnGZBimoTWzYTcJeKsstDE9PhxHd0XTkyII= Received: by reginn.horms.nl (Postfix, from userid 7100) id 1339D940483; Wed, 23 Jan 2019 13:47:31 +0100 (CET) Date: Wed, 23 Jan 2019 13:47:30 +0100 From: Simon Horman To: Julian Anastasov , Pablo Neira Ayuso Cc: Matteo Croce , lvs-devel@vger.kernel.org, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, Wensong Zhang , Paolo Abeni Subject: Re: [PATCH ipvs-next] ipvs: use indirect call wrappers Message-ID: <20190123124730.pbq6l64ejpao6gtn@verge.net.au> References: <20190119142535.29572-1-mcroce@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Organisation: Horms Solutions BV User-Agent: NeoMutt/20170113 (1.7.2) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Sun, Jan 20, 2019 at 02:12:04PM +0200, Julian Anastasov wrote: > > Hello, > > On Sat, 19 Jan 2019, Matteo Croce wrote: > > > Use the new indirect call wrappers in IPVS when calling the TCP or UDP > > protocol specific functions. > > This avoids an indirect calls in IPVS, and reduces the performance > > impact of the Spectre mitigation. > > > > Signed-off-by: Matteo Croce > > Looks good to me, thanks! > > Acked-by: Julian Anastasov Likewise, Pablo could you consider applying this to nf-next? Acked-by: Simon Horman > > > --- > > net/netfilter/ipvs/ip_vs_core.c | 49 +++++++++++++++++++++++----- > > net/netfilter/ipvs/ip_vs_proto_tcp.c | 3 +- > > net/netfilter/ipvs/ip_vs_proto_udp.c | 3 +- > > 3 files changed, 45 insertions(+), 10 deletions(-) > > > > diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c > > index fe9abf3cc10a..e969dad66991 100644 > > --- a/net/netfilter/ipvs/ip_vs_core.c > > +++ b/net/netfilter/ipvs/ip_vs_core.c > > @@ -53,6 +53,7 @@ > > #endif > > > > #include > > +#include > > > > > > EXPORT_SYMBOL(register_ip_vs_scheduler); > > @@ -70,6 +71,29 @@ EXPORT_SYMBOL(ip_vs_get_debug_level); > > #endif > > EXPORT_SYMBOL(ip_vs_new_conn_out); > > > > +#ifdef CONFIG_IP_VS_PROTO_TCP > > +INDIRECT_CALLABLE_DECLARE(int > > + tcp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, > > + struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)); > > +#endif > > + > > +#ifdef CONFIG_IP_VS_PROTO_UDP > > +INDIRECT_CALLABLE_DECLARE(int > > + udp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, > > + struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)); > > +#endif > > + > > +#if defined(CONFIG_IP_VS_PROTO_TCP) && defined(CONFIG_IP_VS_PROTO_UDP) > > +#define SNAT_CALL(f, ...) \ > > + INDIRECT_CALL_2(f, tcp_snat_handler, udp_snat_handler, __VA_ARGS__) > > +#elif defined(CONFIG_IP_VS_PROTO_TCP) > > +#define SNAT_CALL(f, ...) INDIRECT_CALL_1(f, tcp_snat_handler, __VA_ARGS__) > > +#elif defined(CONFIG_IP_VS_PROTO_UDP) > > +#define SNAT_CALL(f, ...) INDIRECT_CALL_1(f, udp_snat_handler, __VA_ARGS__) > > +#else > > +#define SNAT_CALL(f, ...) f(__VA_ARGS__) > > +#endif > > + > > static unsigned int ip_vs_net_id __read_mostly; > > /* netns cnt used for uniqueness */ > > static atomic_t ipvs_netns_cnt = ATOMIC_INIT(0); > > @@ -478,7 +502,9 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb, > > */ > > if ((!skb->dev || skb->dev->flags & IFF_LOOPBACK)) { > > iph->hdr_flags ^= IP_VS_HDR_INVERSE; > > - cp = pp->conn_in_get(svc->ipvs, svc->af, skb, iph); > > + cp = INDIRECT_CALL_1(pp->conn_in_get, > > + ip_vs_conn_in_get_proto, svc->ipvs, > > + svc->af, skb, iph); > > iph->hdr_flags ^= IP_VS_HDR_INVERSE; > > > > if (cp) { > > @@ -972,7 +998,8 @@ static int ip_vs_out_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, > > ip_vs_fill_iph_skb_icmp(AF_INET, skb, offset, true, &ciph); > > > > /* The embedded headers contain source and dest in reverse order */ > > - cp = pp->conn_out_get(ipvs, AF_INET, skb, &ciph); > > + cp = INDIRECT_CALL_1(pp->conn_out_get, ip_vs_conn_out_get_proto, > > + ipvs, AF_INET, skb, &ciph); > > if (!cp) > > return NF_ACCEPT; > > > > @@ -1028,7 +1055,8 @@ static int ip_vs_out_icmp_v6(struct netns_ipvs *ipvs, struct sk_buff *skb, > > return NF_ACCEPT; > > > > /* The embedded headers contain source and dest in reverse order */ > > - cp = pp->conn_out_get(ipvs, AF_INET6, skb, &ciph); > > + cp = INDIRECT_CALL_1(pp->conn_out_get, ip_vs_conn_out_get_proto, > > + ipvs, AF_INET6, skb, &ciph); > > if (!cp) > > return NF_ACCEPT; > > > > @@ -1263,7 +1291,8 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd, > > goto drop; > > > > /* mangle the packet */ > > - if (pp->snat_handler && !pp->snat_handler(skb, pp, cp, iph)) > > + if (pp->snat_handler && > > + !SNAT_CALL(pp->snat_handler, skb, pp, cp, iph)) > > goto drop; > > > > #ifdef CONFIG_IP_VS_IPV6 > > @@ -1389,7 +1418,8 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in > > /* > > * Check if the packet belongs to an existing entry > > */ > > - cp = pp->conn_out_get(ipvs, af, skb, &iph); > > + cp = INDIRECT_CALL_1(pp->conn_out_get, ip_vs_conn_out_get_proto, > > + ipvs, af, skb, &iph); > > > > if (likely(cp)) { > > if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) > > @@ -1644,7 +1674,8 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related, > > /* The embedded headers contain source and dest in reverse order. > > * For IPIP this is error for request, not for reply. > > */ > > - cp = pp->conn_in_get(ipvs, AF_INET, skb, &ciph); > > + cp = INDIRECT_CALL_1(pp->conn_in_get, ip_vs_conn_in_get_proto, > > + ipvs, AF_INET, skb, &ciph); > > > > if (!cp) { > > int v; > > @@ -1796,7 +1827,8 @@ static int ip_vs_in_icmp_v6(struct netns_ipvs *ipvs, struct sk_buff *skb, > > /* The embedded headers contain source and dest in reverse order > > * if not from localhost > > */ > > - cp = pp->conn_in_get(ipvs, AF_INET6, skb, &ciph); > > + cp = INDIRECT_CALL_1(pp->conn_in_get, ip_vs_conn_in_get_proto, > > + ipvs, AF_INET6, skb, &ciph); > > > > if (!cp) { > > int v; > > @@ -1925,7 +1957,8 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int > > /* > > * Check if the packet belongs to an existing connection entry > > */ > > - cp = pp->conn_in_get(ipvs, af, skb, &iph); > > + cp = INDIRECT_CALL_1(pp->conn_in_get, ip_vs_conn_in_get_proto, > > + ipvs, af, skb, &iph); > > > > conn_reuse_mode = sysctl_conn_reuse_mode(ipvs); > > if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) && cp) { > > diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c > > index 6a275f989085..479419759983 100644 > > --- a/net/netfilter/ipvs/ip_vs_proto_tcp.c > > +++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c > > @@ -28,6 +28,7 @@ > > #include > > #include > > #include > > +#include > > > > #include > > > > @@ -146,7 +147,7 @@ tcp_partial_csum_update(int af, struct tcphdr *tcph, > > } > > > > > > -static int > > +INDIRECT_CALLABLE_SCOPE int > > tcp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, > > struct ip_vs_conn *cp, struct ip_vs_iphdr *iph) > > { > > diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c > > index 3285718264d5..646c384910fb 100644 > > --- a/net/netfilter/ipvs/ip_vs_proto_udp.c > > +++ b/net/netfilter/ipvs/ip_vs_proto_udp.c > > @@ -23,6 +23,7 @@ > > #include > > #include > > #include > > +#include > > > > #include > > #include > > @@ -136,7 +137,7 @@ udp_partial_csum_update(int af, struct udphdr *uhdr, > > } > > > > > > -static int > > +INDIRECT_CALLABLE_SCOPE int > > udp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, > > struct ip_vs_conn *cp, struct ip_vs_iphdr *iph) > > { > > -- > > 2.20.1 > > Regards > > -- > Julian Anastasov >