From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Ahern Subject: Re: [patch net-next v3 00/10] net: sched: allow qdiscs to share filter block instances Date: Wed, 13 Dec 2017 11:28:59 -0700 Message-ID: <3d3f57ae-23b7-6389-7276-3019f57dce01@gmail.com> References: <20171213151038.29665-1-jiri@resnulli.us> <04bcfa37-a74e-9e2f-3ac1-7ed8e63e13df@gmail.com> <20171213170757.GJ2031@nanopsycho> <90bf2450-a21c-9f70-2dc3-b147d0c40740@gmail.com> <20171213173948.GK2031@nanopsycho> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, davem@davemloft.net, jhs@mojatatu.com, xiyou.wangcong@gmail.com, mlxsw@mellanox.com, andrew@lunn.ch, vivien.didelot@savoirfairelinux.com, f.fainelli@gmail.com, michael.chan@broadcom.com, ganeshgr@chelsio.com, saeedm@mellanox.com, matanb@mellanox.com, leonro@mellanox.com, idosch@mellanox.com, jakub.kicinski@netronome.com, simon.horman@netronome.com, pieter.jansenvanvuuren@netronome.com, john.hurley@netronome.com, alexander.h.duyck@intel.com, ogerlitz@mellanox.com, john.fastabend@gmail.com, daniel@iogearbox.net To: Jiri Pirko Return-path: Received: from mail-pg0-f65.google.com ([74.125.83.65]:41778 "EHLO mail-pg0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753011AbdLMS3I (ORCPT ); Wed, 13 Dec 2017 13:29:08 -0500 Received: by mail-pg0-f65.google.com with SMTP id o2so1582715pgc.8 for ; Wed, 13 Dec 2017 10:29:08 -0800 (PST) In-Reply-To: <20171213173948.GK2031@nanopsycho> Content-Language: en-US Sender: netdev-owner@vger.kernel.org List-ID: On 12/13/17 10:39 AM, Jiri Pirko wrote: > Wed, Dec 13, 2017 at 06:18:04PM CET, dsahern@gmail.com wrote: >> On 12/13/17 10:07 AM, Jiri Pirko wrote: >>> Wed, Dec 13, 2017 at 05:54:35PM CET, dsahern@gmail.com wrote: >>>> On 12/13/17 8:10 AM, Jiri Pirko wrote: >>>>> So back to the example. First, we create 2 qdiscs. Both will share >>>>> block number 22. "22" is just an identification. If we don't pass any >>>>> block number, a new one will be generated by kernel: >>>>> >>>>> $ tc qdisc add dev ens7 ingress block 22 >>>>> ^^^^^^^^ >>>>> $ tc qdisc add dev ens8 ingress block 22 >>>>> ^^^^^^^^ >>>>> >>>>> Now if we list the qdiscs, we will see the block index in the output: >>>>> >>>>> $ tc qdisc >>>>> qdisc ingress ffff: dev ens7 parent ffff:fff1 block 22 >>>>> qdisc ingress ffff: dev ens8 parent ffff:fff1 block 22 >>>>> >>>>> To make is more visual, the situation looks like this: >>>>> >>>>> ens7 ingress qdisc ens7 ingress qdisc >>>>> | | >>>>> | | >>>>> +----------> block 22 <----------+ >>>>> >>>>> Unlimited number of qdiscs may share the same block. >>>>> >>>>> Now we can add filter to any of qdiscs sharing the same block: >>>>> >>>>> $ tc filter add dev ens7 ingress protocol ip pref 25 flower dst_ip 192.168.0.0/16 action drop >>>> >>>> I still say this is very odd user semantic - making changes to device M >>>> and the changes magically affect device N. Operating on the shared block >>>> as a separate object makes it is much more direct and clear. >>> >>> I plan to do it as a follow-up patch. But this is how things are done >>> now and have to continue to work. >> >> Why is that? You are introducing the notion of a shared block with this >> patch set. What is the legacy "how things are done now" you are >> referring to? > > Well, the filter add/del should just work no matter if the block behind is > shared or not. My argument is that modifying a shared block instance via a dev should not be allowed. Those changes should only be allowed via the shared block. So if a user puts adds a shared block to the device and then attempts to add a filter via the device it should not be allowed.