* Re: [PATCH 00/10] Add HA and LAG support to mlx4 RoCE and SRIOV services
From: David Miller @ 2015-02-05 0:14 UTC (permalink / raw)
To: ogerlitz; +Cc: netdev, roland, amirv, talal
In-Reply-To: <1422974919-28084-1-git-send-email-ogerlitz@mellanox.com>
From: Or Gerlitz <ogerlitz@mellanox.com>
Date: Tue, 3 Feb 2015 16:48:28 +0200
> This series takes advanges of bonding mlx4 Ethernet devices to support
> a model of High-Availability and Link Aggregation for more environments.
>
> The mlx4 driver reacts on netdev events generated by bonding when
> slave state changes happen by programming a HW V2P (Virt-to-Phys)
> port table. Bonding was extended to expose these state changes
> through netdev events.
>
> When an mlx4 interface such as the mlx4 IB/RoCE driver is subject to
> this policy, QPs are created over virtual ports which are mapped
> to one of the two physical ports. When a failure happens, the
> re-programming of the V2P table allows traffic to keep flowing.
>
> The mlx4 Ethernet driver interfaces are not subject to this
> policy and act as usual.
>
> A 2nd use-case for this model would be to add HA and Link Aggregation
> support to single ported mlx4 Ethernet VFs. In this case, the PF Ethernet
> intrfaces are bonded, all the VFs see single port devices (which is
> supported already today), and VF QPs are subject to V2P.
Series applied, thanks.
^ permalink raw reply
* [PATCH v2] net: openvswitch: Support masked set actions.
From: Jarno Rajahalme @ 2015-02-05 0:16 UTC (permalink / raw)
To: netdev-u79uwXL29TY76Z2rM5mHXA, dev-yBygre7rU0TnMu66kgdUjQ
OVS userspace already probes the openvswitch kernel module for
OVS_ACTION_ATTR_SET_MASKED support. This patch adds the kernel module
implementation of masked set actions.
The existing set action sets many fields at once. When only a subset
of the IP header fields, for example, should be modified, all the IP
fields need to be exact matched so that the other field values can be
copied to the set action. A masked set action allows modification of
an arbitrary subset of the supported header bits without requiring the
rest to be matched.
Masked set action is now supported for all writeable key types, except
for the tunnel key. The set tunnel action is an exception as any
input tunnel info is cleared before action processing starts, so there
is no tunnel info to mask.
The kernel module converts all (non-tunnel) set actions to masked set
actions. This makes action processing more uniform, and results in
less branching and duplicating the action processing code. When
returning actions to userspace, the set actions that were converted to
masked set actions are converted back to normal set actions. We use a
kernel internal action code to be able to tell the userspace provided
and converted masked set actions apart.
Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
---
v2: Fixed checkpatch warnigns and errors, rebase.
include/uapi/linux/openvswitch.h | 22 ++-
net/openvswitch/actions.c | 373 ++++++++++++++++++++++++--------------
net/openvswitch/flow_netlink.c | 165 ++++++++++++++---
3 files changed, 400 insertions(+), 160 deletions(-)
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index 7a8785a..bbd49a0 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -599,6 +599,12 @@ struct ovs_action_hash {
* @OVS_ACTION_ATTR_SET: Replaces the contents of an existing header. The
* single nested %OVS_KEY_ATTR_* attribute specifies a header to modify and its
* value.
+ * @OVS_ACTION_ATTR_SET_MASKED: Replaces the contents of an existing header. A
+ * nested %OVS_KEY_ATTR_* attribute specifies a header to modify, its value,
+ * and a mask. For every bit set in the mask, the corresponding bit value
+ * is copied from the value to the packet header field, rest of the bits are
+ * left unchanged. The non-masked value bits must be passed in as zeroes.
+ * Masking is not supported for the %OVS_KEY_ATTR_TUNNEL attribute.
* @OVS_ACTION_ATTR_PUSH_VLAN: Push a new outermost 802.1Q header onto the
* packet.
* @OVS_ACTION_ATTR_POP_VLAN: Pop the outermost 802.1Q header off the packet.
@@ -617,6 +623,9 @@ struct ovs_action_hash {
* Only a single header can be set with a single %OVS_ACTION_ATTR_SET. Not all
* fields within a header are modifiable, e.g. the IPv4 protocol and fragment
* type may not be changed.
+ *
+ * @OVS_ACTION_ATTR_SET_TO_MASKED: Kernel internal masked set action translated
+ * from the @OVS_ACTION_ATTR_SET.
*/
enum ovs_action_attr {
@@ -631,8 +640,19 @@ enum ovs_action_attr {
OVS_ACTION_ATTR_HASH, /* struct ovs_action_hash. */
OVS_ACTION_ATTR_PUSH_MPLS, /* struct ovs_action_push_mpls. */
OVS_ACTION_ATTR_POP_MPLS, /* __be16 ethertype. */
+ OVS_ACTION_ATTR_SET_MASKED, /* One nested OVS_KEY_ATTR_* including
+ * data immediately followed by a mask.
+ * The data must be zero for the unmasked
+ * bits. */
+
+ __OVS_ACTION_ATTR_MAX, /* Nothing past this will be accepted
+ * from userspace. */
- __OVS_ACTION_ATTR_MAX
+#ifdef __KERNEL__
+ OVS_ACTION_ATTR_SET_TO_MASKED, /* Kernel module internal masked
+ * set action converted from
+ * OVS_ACTION_ATTR_SET. */
+#endif
};
#define OVS_ACTION_ATTR_MAX (__OVS_ACTION_ATTR_MAX - 1)
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index b4cffe6..b491c1c 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -185,10 +185,15 @@ static int pop_mpls(struct sk_buff *skb, struct sw_flow_key *key,
return 0;
}
-static int set_mpls(struct sk_buff *skb, struct sw_flow_key *key,
- const __be32 *mpls_lse)
+/* 'KEY' must not have any bits set outside of the 'MASK' */
+#define MASKED(OLD, KEY, MASK) ((KEY) | ((OLD) & ~(MASK)))
+#define SET_MASKED(OLD, KEY, MASK) ((OLD) = MASKED(OLD, KEY, MASK))
+
+static int set_mpls(struct sk_buff *skb, struct sw_flow_key *flow_key,
+ const __be32 *mpls_lse, const __be32 *mask)
{
__be32 *stack;
+ __be32 lse;
int err;
err = skb_ensure_writable(skb, skb->mac_len + MPLS_HLEN);
@@ -196,14 +201,16 @@ static int set_mpls(struct sk_buff *skb, struct sw_flow_key *key,
return err;
stack = (__be32 *)skb_mpls_header(skb);
+ lse = MASKED(*stack, *mpls_lse, *mask);
if (skb->ip_summed == CHECKSUM_COMPLETE) {
- __be32 diff[] = { ~(*stack), *mpls_lse };
+ __be32 diff[] = { ~(*stack), lse };
+
skb->csum = ~csum_partial((char *)diff, sizeof(diff),
~skb->csum);
}
- *stack = *mpls_lse;
- key->mpls.top_lse = *mpls_lse;
+ *stack = lse;
+ flow_key->mpls.top_lse = lse;
return 0;
}
@@ -230,23 +237,39 @@ static int push_vlan(struct sk_buff *skb, struct sw_flow_key *key,
ntohs(vlan->vlan_tci) & ~VLAN_TAG_PRESENT);
}
-static int set_eth_addr(struct sk_buff *skb, struct sw_flow_key *key,
- const struct ovs_key_ethernet *eth_key)
+/* 'src' is already properly masked. */
+static void ether_addr_copy_masked(u8 *dst_, const u8 *src_, const u8 *mask_)
+{
+ u16 *dst = (u16 *)dst_;
+ const u16 *src = (const u16 *)src_;
+ const u16 *mask = (const u16 *)mask_;
+
+ SET_MASKED(dst[0], src[0], mask[0]);
+ SET_MASKED(dst[1], src[1], mask[1]);
+ SET_MASKED(dst[2], src[2], mask[2]);
+}
+
+static int set_eth_addr(struct sk_buff *skb, struct sw_flow_key *flow_key,
+ const struct ovs_key_ethernet *key,
+ const struct ovs_key_ethernet *mask)
{
int err;
+
err = skb_ensure_writable(skb, ETH_HLEN);
if (unlikely(err))
return err;
skb_postpull_rcsum(skb, eth_hdr(skb), ETH_ALEN * 2);
- ether_addr_copy(eth_hdr(skb)->h_source, eth_key->eth_src);
- ether_addr_copy(eth_hdr(skb)->h_dest, eth_key->eth_dst);
+ ether_addr_copy_masked(eth_hdr(skb)->h_source, key->eth_src,
+ mask->eth_src);
+ ether_addr_copy_masked(eth_hdr(skb)->h_dest, key->eth_dst,
+ mask->eth_dst);
ovs_skb_postpush_rcsum(skb, eth_hdr(skb), ETH_ALEN * 2);
- ether_addr_copy(key->eth.src, eth_key->eth_src);
- ether_addr_copy(key->eth.dst, eth_key->eth_dst);
+ ether_addr_copy(flow_key->eth.src, eth_hdr(skb)->h_source);
+ ether_addr_copy(flow_key->eth.dst, eth_hdr(skb)->h_dest);
return 0;
}
@@ -304,6 +327,15 @@ static void update_ipv6_checksum(struct sk_buff *skb, u8 l4_proto,
}
}
+static void mask_ipv6_addr(const __be32 old[4], const __be32 addr[4],
+ const __be32 mask[4], __be32 masked[4])
+{
+ masked[0] = MASKED(old[0], addr[0], mask[0]);
+ masked[1] = MASKED(old[1], addr[1], mask[1]);
+ masked[2] = MASKED(old[2], addr[2], mask[2]);
+ masked[3] = MASKED(old[3], addr[3], mask[3]);
+}
+
static void set_ipv6_addr(struct sk_buff *skb, u8 l4_proto,
__be32 addr[4], const __be32 new_addr[4],
bool recalculate_csum)
@@ -315,29 +347,29 @@ static void set_ipv6_addr(struct sk_buff *skb, u8 l4_proto,
memcpy(addr, new_addr, sizeof(__be32[4]));
}
-static void set_ipv6_tc(struct ipv6hdr *nh, u8 tc)
+static void set_ipv6_fl(struct ipv6hdr *nh, u32 fl, u32 mask)
{
- nh->priority = tc >> 4;
- nh->flow_lbl[0] = (nh->flow_lbl[0] & 0x0F) | ((tc & 0x0F) << 4);
+ /* Bits 21-24 are always unmasked, so this retains their values. */
+ SET_MASKED(nh->flow_lbl[0], (u8)(fl >> 16), (u8)(mask >> 16));
+ SET_MASKED(nh->flow_lbl[1], (u8)(fl >> 8), (u8)(mask >> 8));
+ SET_MASKED(nh->flow_lbl[2], (u8)fl, (u8)mask);
}
-static void set_ipv6_fl(struct ipv6hdr *nh, u32 fl)
+static void set_ip_ttl(struct sk_buff *skb, struct iphdr *nh, u8 new_ttl,
+ u8 mask)
{
- nh->flow_lbl[0] = (nh->flow_lbl[0] & 0xF0) | (fl & 0x000F0000) >> 16;
- nh->flow_lbl[1] = (fl & 0x0000FF00) >> 8;
- nh->flow_lbl[2] = fl & 0x000000FF;
-}
+ new_ttl = MASKED(nh->ttl, new_ttl, mask);
-static void set_ip_ttl(struct sk_buff *skb, struct iphdr *nh, u8 new_ttl)
-{
csum_replace2(&nh->check, htons(nh->ttl << 8), htons(new_ttl << 8));
nh->ttl = new_ttl;
}
-static int set_ipv4(struct sk_buff *skb, struct sw_flow_key *key,
- const struct ovs_key_ipv4 *ipv4_key)
+static int set_ipv4(struct sk_buff *skb, struct sw_flow_key *flow_key,
+ const struct ovs_key_ipv4 *key,
+ const struct ovs_key_ipv4 *mask)
{
struct iphdr *nh;
+ __be32 new_addr;
int err;
err = skb_ensure_writable(skb, skb_network_offset(skb) +
@@ -347,36 +379,49 @@ static int set_ipv4(struct sk_buff *skb, struct sw_flow_key *key,
nh = ip_hdr(skb);
- if (ipv4_key->ipv4_src != nh->saddr) {
- set_ip_addr(skb, nh, &nh->saddr, ipv4_key->ipv4_src);
- key->ipv4.addr.src = ipv4_key->ipv4_src;
- }
+ /* Setting an IP addresses is typically only a side effect of
+ * matching on them in the current userspace implementation, so it
+ * makes sense to check if the value actually changed.
+ */
+ if (mask->ipv4_src) {
+ new_addr = MASKED(nh->saddr, key->ipv4_src, mask->ipv4_src);
- if (ipv4_key->ipv4_dst != nh->daddr) {
- set_ip_addr(skb, nh, &nh->daddr, ipv4_key->ipv4_dst);
- key->ipv4.addr.dst = ipv4_key->ipv4_dst;
+ if (unlikely(new_addr != nh->saddr)) {
+ set_ip_addr(skb, nh, &nh->saddr, new_addr);
+ flow_key->ipv4.addr.src = new_addr;
+ }
}
+ if (mask->ipv4_dst) {
+ new_addr = MASKED(nh->daddr, key->ipv4_dst, mask->ipv4_dst);
- if (ipv4_key->ipv4_tos != nh->tos) {
- ipv4_change_dsfield(nh, 0, ipv4_key->ipv4_tos);
- key->ip.tos = nh->tos;
+ if (unlikely(new_addr != nh->daddr)) {
+ set_ip_addr(skb, nh, &nh->daddr, new_addr);
+ flow_key->ipv4.addr.dst = new_addr;
+ }
}
-
- if (ipv4_key->ipv4_ttl != nh->ttl) {
- set_ip_ttl(skb, nh, ipv4_key->ipv4_ttl);
- key->ip.ttl = ipv4_key->ipv4_ttl;
+ if (mask->ipv4_tos) {
+ ipv4_change_dsfield(nh, ~mask->ipv4_tos, key->ipv4_tos);
+ flow_key->ip.tos = nh->tos;
+ }
+ if (mask->ipv4_ttl) {
+ set_ip_ttl(skb, nh, key->ipv4_ttl, mask->ipv4_ttl);
+ flow_key->ip.ttl = nh->ttl;
}
return 0;
}
-static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *key,
- const struct ovs_key_ipv6 *ipv6_key)
+static bool is_ipv6_mask_nonzero(const __be32 addr[4])
+{
+ return !!(addr[0] | addr[1] | addr[2] | addr[3]);
+}
+
+static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key,
+ const struct ovs_key_ipv6 *key,
+ const struct ovs_key_ipv6 *mask)
{
struct ipv6hdr *nh;
int err;
- __be32 *saddr;
- __be32 *daddr;
err = skb_ensure_writable(skb, skb_network_offset(skb) +
sizeof(struct ipv6hdr));
@@ -384,71 +429,77 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *key,
return err;
nh = ipv6_hdr(skb);
- saddr = (__be32 *)&nh->saddr;
- daddr = (__be32 *)&nh->daddr;
-
- if (memcmp(ipv6_key->ipv6_src, saddr, sizeof(ipv6_key->ipv6_src))) {
- set_ipv6_addr(skb, ipv6_key->ipv6_proto, saddr,
- ipv6_key->ipv6_src, true);
- memcpy(&key->ipv6.addr.src, ipv6_key->ipv6_src,
- sizeof(ipv6_key->ipv6_src));
- }
- if (memcmp(ipv6_key->ipv6_dst, daddr, sizeof(ipv6_key->ipv6_dst))) {
+ /* Setting an IP addresses is typically only a side effect of
+ * matching on them in the current userspace implementation, so it
+ * makes sense to check if the value actually changed.
+ */
+ if (is_ipv6_mask_nonzero(mask->ipv6_src)) {
+ __be32 *saddr = (__be32 *)&nh->saddr;
+ __be32 masked[4];
+
+ mask_ipv6_addr(saddr, key->ipv6_src, mask->ipv6_src, masked);
+
+ if (unlikely(memcmp(saddr, masked, sizeof(masked)))) {
+ set_ipv6_addr(skb, key->ipv6_proto, saddr, masked,
+ true);
+ memcpy(&flow_key->ipv6.addr.src, masked,
+ sizeof(flow_key->ipv6.addr.src));
+ }
+ }
+ if (is_ipv6_mask_nonzero(mask->ipv6_dst)) {
unsigned int offset = 0;
int flags = IP6_FH_F_SKIP_RH;
bool recalc_csum = true;
-
- if (ipv6_ext_hdr(nh->nexthdr))
- recalc_csum = ipv6_find_hdr(skb, &offset,
- NEXTHDR_ROUTING, NULL,
- &flags) != NEXTHDR_ROUTING;
-
- set_ipv6_addr(skb, ipv6_key->ipv6_proto, daddr,
- ipv6_key->ipv6_dst, recalc_csum);
- memcpy(&key->ipv6.addr.dst, ipv6_key->ipv6_dst,
- sizeof(ipv6_key->ipv6_dst));
+ __be32 *daddr = (__be32 *)&nh->daddr;
+ __be32 masked[4];
+
+ mask_ipv6_addr(daddr, key->ipv6_dst, mask->ipv6_dst, masked);
+
+ if (unlikely(memcmp(daddr, masked, sizeof(masked)))) {
+ if (ipv6_ext_hdr(nh->nexthdr))
+ recalc_csum = (ipv6_find_hdr(skb, &offset,
+ NEXTHDR_ROUTING,
+ NULL, &flags)
+ != NEXTHDR_ROUTING);
+
+ set_ipv6_addr(skb, key->ipv6_proto, daddr, masked,
+ recalc_csum);
+ memcpy(&flow_key->ipv6.addr.dst, masked,
+ sizeof(flow_key->ipv6.addr.dst));
+ }
+ }
+ if (mask->ipv6_tclass) {
+ ipv6_change_dsfield(nh, ~mask->ipv6_tclass, key->ipv6_tclass);
+ flow_key->ip.tos = ipv6_get_dsfield(nh);
+ }
+ if (mask->ipv6_label) {
+ set_ipv6_fl(nh, ntohl(key->ipv6_label),
+ ntohl(mask->ipv6_label));
+ flow_key->ipv6.label =
+ *(__be32 *)nh & htonl(IPV6_FLOWINFO_FLOWLABEL);
+ }
+ if (mask->ipv6_hlimit) {
+ SET_MASKED(nh->hop_limit, key->ipv6_hlimit, mask->ipv6_hlimit);
+ flow_key->ip.ttl = nh->hop_limit;
}
-
- set_ipv6_tc(nh, ipv6_key->ipv6_tclass);
- key->ip.tos = ipv6_get_dsfield(nh);
-
- set_ipv6_fl(nh, ntohl(ipv6_key->ipv6_label));
- key->ipv6.label = *(__be32 *)nh & htonl(IPV6_FLOWINFO_FLOWLABEL);
-
- nh->hop_limit = ipv6_key->ipv6_hlimit;
- key->ip.ttl = ipv6_key->ipv6_hlimit;
return 0;
}
/* Must follow skb_ensure_writable() since that can move the skb data. */
static void set_tp_port(struct sk_buff *skb, __be16 *port,
- __be16 new_port, __sum16 *check)
+ __be16 new_port, __sum16 *check)
{
inet_proto_csum_replace2(check, skb, *port, new_port, 0);
*port = new_port;
- skb_clear_hash(skb);
-}
-
-static void set_udp_port(struct sk_buff *skb, __be16 *port, __be16 new_port)
-{
- struct udphdr *uh = udp_hdr(skb);
-
- if (uh->check && skb->ip_summed != CHECKSUM_PARTIAL) {
- set_tp_port(skb, port, new_port, &uh->check);
-
- if (!uh->check)
- uh->check = CSUM_MANGLED_0;
- } else {
- *port = new_port;
- skb_clear_hash(skb);
- }
}
-static int set_udp(struct sk_buff *skb, struct sw_flow_key *key,
- const struct ovs_key_udp *udp_port_key)
+static int set_udp(struct sk_buff *skb, struct sw_flow_key *flow_key,
+ const struct ovs_key_udp *key,
+ const struct ovs_key_udp *mask)
{
struct udphdr *uh;
+ __be16 src, dst;
int err;
err = skb_ensure_writable(skb, skb_transport_offset(skb) +
@@ -457,23 +508,40 @@ static int set_udp(struct sk_buff *skb, struct sw_flow_key *key,
return err;
uh = udp_hdr(skb);
- if (udp_port_key->udp_src != uh->source) {
- set_udp_port(skb, &uh->source, udp_port_key->udp_src);
- key->tp.src = udp_port_key->udp_src;
- }
+ /* Either of the masks is non-zero, so do not bother checking them. */
+ src = MASKED(uh->source, key->udp_src, mask->udp_src);
+ dst = MASKED(uh->dest, key->udp_dst, mask->udp_dst);
- if (udp_port_key->udp_dst != uh->dest) {
- set_udp_port(skb, &uh->dest, udp_port_key->udp_dst);
- key->tp.dst = udp_port_key->udp_dst;
+ if (uh->check && skb->ip_summed != CHECKSUM_PARTIAL) {
+ if (likely(src != uh->source)) {
+ set_tp_port(skb, &uh->source, src, &uh->check);
+ flow_key->tp.src = src;
+ }
+ if (likely(dst != uh->dest)) {
+ set_tp_port(skb, &uh->dest, dst, &uh->check);
+ flow_key->tp.dst = dst;
+ }
+
+ if (unlikely(!uh->check))
+ uh->check = CSUM_MANGLED_0;
+ } else {
+ uh->source = src;
+ uh->dest = dst;
+ flow_key->tp.src = src;
+ flow_key->tp.dst = dst;
}
+ skb_clear_hash(skb);
+
return 0;
}
-static int set_tcp(struct sk_buff *skb, struct sw_flow_key *key,
- const struct ovs_key_tcp *tcp_port_key)
+static int set_tcp(struct sk_buff *skb, struct sw_flow_key *flow_key,
+ const struct ovs_key_tcp *key,
+ const struct ovs_key_tcp *mask)
{
struct tcphdr *th;
+ __be16 src, dst;
int err;
err = skb_ensure_writable(skb, skb_transport_offset(skb) +
@@ -482,50 +550,49 @@ static int set_tcp(struct sk_buff *skb, struct sw_flow_key *key,
return err;
th = tcp_hdr(skb);
- if (tcp_port_key->tcp_src != th->source) {
- set_tp_port(skb, &th->source, tcp_port_key->tcp_src, &th->check);
- key->tp.src = tcp_port_key->tcp_src;
+ src = MASKED(th->source, key->tcp_src, mask->tcp_src);
+ if (likely(src != th->source)) {
+ set_tp_port(skb, &th->source, src, &th->check);
+ flow_key->tp.src = src;
}
-
- if (tcp_port_key->tcp_dst != th->dest) {
- set_tp_port(skb, &th->dest, tcp_port_key->tcp_dst, &th->check);
- key->tp.dst = tcp_port_key->tcp_dst;
+ dst = MASKED(th->dest, key->tcp_dst, mask->tcp_dst);
+ if (likely(dst != th->dest)) {
+ set_tp_port(skb, &th->dest, dst, &th->check);
+ flow_key->tp.dst = dst;
}
+ skb_clear_hash(skb);
return 0;
}
-static int set_sctp(struct sk_buff *skb, struct sw_flow_key *key,
- const struct ovs_key_sctp *sctp_port_key)
+static int set_sctp(struct sk_buff *skb, struct sw_flow_key *flow_key,
+ const struct ovs_key_sctp *key,
+ const struct ovs_key_sctp *mask)
{
+ unsigned int sctphoff = skb_transport_offset(skb);
struct sctphdr *sh;
+ __le32 old_correct_csum, new_csum, old_csum;
int err;
- unsigned int sctphoff = skb_transport_offset(skb);
err = skb_ensure_writable(skb, sctphoff + sizeof(struct sctphdr));
if (unlikely(err))
return err;
sh = sctp_hdr(skb);
- if (sctp_port_key->sctp_src != sh->source ||
- sctp_port_key->sctp_dst != sh->dest) {
- __le32 old_correct_csum, new_csum, old_csum;
+ old_csum = sh->checksum;
+ old_correct_csum = sctp_compute_cksum(skb, sctphoff);
- old_csum = sh->checksum;
- old_correct_csum = sctp_compute_cksum(skb, sctphoff);
+ sh->source = MASKED(sh->source, key->sctp_src, mask->sctp_src);
+ sh->dest = MASKED(sh->dest, key->sctp_dst, mask->sctp_dst);
- sh->source = sctp_port_key->sctp_src;
- sh->dest = sctp_port_key->sctp_dst;
+ new_csum = sctp_compute_cksum(skb, sctphoff);
- new_csum = sctp_compute_cksum(skb, sctphoff);
+ /* Carry any checksum errors through. */
+ sh->checksum = old_csum ^ old_correct_csum ^ new_csum;
- /* Carry any checksum errors through. */
- sh->checksum = old_csum ^ old_correct_csum ^ new_csum;
-
- skb_clear_hash(skb);
- key->tp.src = sctp_port_key->sctp_src;
- key->tp.dst = sctp_port_key->sctp_dst;
- }
+ skb_clear_hash(skb);
+ flow_key->tp.src = sh->source;
+ flow_key->tp.dst = sh->dest;
return 0;
}
@@ -653,52 +720,77 @@ static void execute_hash(struct sk_buff *skb, struct sw_flow_key *key,
key->ovs_flow_hash = hash;
}
-static int execute_set_action(struct sk_buff *skb, struct sw_flow_key *key,
- const struct nlattr *nested_attr)
+static int execute_set_action(struct sk_buff *skb,
+ struct sw_flow_key *flow_key,
+ const struct nlattr *a)
+{
+ /* Only tunnel set execution is supported without a mask. */
+ if (nla_type(a) == OVS_KEY_ATTR_TUNNEL_INFO) {
+ OVS_CB(skb)->egress_tun_info = nla_data(a);
+ return 0;
+ }
+
+ return -EINVAL;
+}
+
+/* Mask is at the midpoint of the data. */
+#define get_mask(a, type) ((const type)nla_data(a) + 1)
+
+static int execute_masked_set_action(struct sk_buff *skb,
+ struct sw_flow_key *flow_key,
+ const struct nlattr *a)
{
int err = 0;
- switch (nla_type(nested_attr)) {
+ switch (nla_type(a)) {
case OVS_KEY_ATTR_PRIORITY:
- skb->priority = nla_get_u32(nested_attr);
- key->phy.priority = skb->priority;
+ SET_MASKED(skb->priority, nla_get_u32(a), *get_mask(a, u32 *));
+ flow_key->phy.priority = skb->priority;
break;
case OVS_KEY_ATTR_SKB_MARK:
- skb->mark = nla_get_u32(nested_attr);
- key->phy.skb_mark = skb->mark;
+ SET_MASKED(skb->mark, nla_get_u32(a), *get_mask(a, u32 *));
+ flow_key->phy.skb_mark = skb->mark;
break;
case OVS_KEY_ATTR_TUNNEL_INFO:
- OVS_CB(skb)->egress_tun_info = nla_data(nested_attr);
+ /* Masked data not supported for tunnel. */
+ err = -EINVAL;
break;
case OVS_KEY_ATTR_ETHERNET:
- err = set_eth_addr(skb, key, nla_data(nested_attr));
+ err = set_eth_addr(skb, flow_key, nla_data(a),
+ get_mask(a, struct ovs_key_ethernet *));
break;
case OVS_KEY_ATTR_IPV4:
- err = set_ipv4(skb, key, nla_data(nested_attr));
+ err = set_ipv4(skb, flow_key, nla_data(a),
+ get_mask(a, struct ovs_key_ipv4 *));
break;
case OVS_KEY_ATTR_IPV6:
- err = set_ipv6(skb, key, nla_data(nested_attr));
+ err = set_ipv6(skb, flow_key, nla_data(a),
+ get_mask(a, struct ovs_key_ipv6 *));
break;
case OVS_KEY_ATTR_TCP:
- err = set_tcp(skb, key, nla_data(nested_attr));
+ err = set_tcp(skb, flow_key, nla_data(a),
+ get_mask(a, struct ovs_key_tcp *));
break;
case OVS_KEY_ATTR_UDP:
- err = set_udp(skb, key, nla_data(nested_attr));
+ err = set_udp(skb, flow_key, nla_data(a),
+ get_mask(a, struct ovs_key_udp *));
break;
case OVS_KEY_ATTR_SCTP:
- err = set_sctp(skb, key, nla_data(nested_attr));
+ err = set_sctp(skb, flow_key, nla_data(a),
+ get_mask(a, struct ovs_key_sctp *));
break;
case OVS_KEY_ATTR_MPLS:
- err = set_mpls(skb, key, nla_data(nested_attr));
+ err = set_mpls(skb, flow_key, nla_data(a), get_mask(a,
+ __be32 *));
break;
}
@@ -818,6 +910,11 @@ static int do_execute_actions(struct datapath *dp, struct sk_buff *skb,
err = execute_set_action(skb, key, nla_data(a));
break;
+ case OVS_ACTION_ATTR_SET_MASKED:
+ case OVS_ACTION_ATTR_SET_TO_MASKED:
+ err = execute_masked_set_action(skb, key, nla_data(a));
+ break;
+
case OVS_ACTION_ATTR_SAMPLE:
err = sample(dp, skb, key, a);
break;
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 8b9a612..d4042d3 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -1805,23 +1805,45 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
return err;
}
+/* Return false if there are any non-masked bits set.
+ * Mask follows data immediately, before any netlink padding.
+ */
+static bool validate_masked(u8 *data, int len)
+{
+ u8 *mask = data + len;
+
+ while (len--)
+ if (*data++ & ~*mask++)
+ return false;
+
+ return true;
+}
+
static int validate_set(const struct nlattr *a,
const struct sw_flow_key *flow_key,
struct sw_flow_actions **sfa,
- bool *set_tun, __be16 eth_type, bool log)
+ bool *skip_copy, __be16 eth_type, bool masked, bool log)
{
const struct nlattr *ovs_key = nla_data(a);
int key_type = nla_type(ovs_key);
+ size_t key_len;
/* There can be only one key in a action */
if (nla_total_size(nla_len(ovs_key)) != nla_len(a))
return -EINVAL;
+ key_len = nla_len(ovs_key);
+ if (masked)
+ key_len /= 2;
+
if (key_type > OVS_KEY_ATTR_MAX ||
- (ovs_key_lens[key_type].len != nla_len(ovs_key) &&
+ (ovs_key_lens[key_type].len != key_len &&
ovs_key_lens[key_type].len != OVS_ATTR_NESTED))
return -EINVAL;
+ if (masked && !validate_masked(nla_data(ovs_key), key_len))
+ return -EINVAL;
+
switch (key_type) {
const struct ovs_key_ipv4 *ipv4_key;
const struct ovs_key_ipv6 *ipv6_key;
@@ -1836,7 +1858,10 @@ static int validate_set(const struct nlattr *a,
if (eth_p_mpls(eth_type))
return -EINVAL;
- *set_tun = true;
+ if (masked)
+ return -EINVAL; /* Masked tunnel set not supported. */
+
+ *skip_copy = true;
err = validate_and_copy_set_tun(a, sfa, log);
if (err)
return err;
@@ -1846,32 +1871,46 @@ static int validate_set(const struct nlattr *a,
if (eth_type != htons(ETH_P_IP))
return -EINVAL;
- if (!flow_key->ip.proto)
- return -EINVAL;
-
ipv4_key = nla_data(ovs_key);
- if (ipv4_key->ipv4_proto != flow_key->ip.proto)
- return -EINVAL;
- if (ipv4_key->ipv4_frag != flow_key->ip.frag)
- return -EINVAL;
+ if (masked) {
+ const struct ovs_key_ipv4 *mask = ipv4_key + 1;
+ /* Non-writeable fields. */
+ if (mask->ipv4_proto || mask->ipv4_frag)
+ return -EINVAL;
+ } else {
+ if (ipv4_key->ipv4_proto != flow_key->ip.proto)
+ return -EINVAL;
+
+ if (ipv4_key->ipv4_frag != flow_key->ip.frag)
+ return -EINVAL;
+ }
break;
case OVS_KEY_ATTR_IPV6:
if (eth_type != htons(ETH_P_IPV6))
return -EINVAL;
- if (!flow_key->ip.proto)
- return -EINVAL;
-
ipv6_key = nla_data(ovs_key);
- if (ipv6_key->ipv6_proto != flow_key->ip.proto)
- return -EINVAL;
- if (ipv6_key->ipv6_frag != flow_key->ip.frag)
- return -EINVAL;
+ if (masked) {
+ const struct ovs_key_ipv6 *mask = ipv6_key + 1;
+
+ /* Non-writeable fields. */
+ if (mask->ipv6_proto || mask->ipv6_frag)
+ return -EINVAL;
+
+ /* Invalid bits in the flow label mask? */
+ if (ntohl(mask->ipv6_label) & 0xFFF00000)
+ return -EINVAL;
+ } else {
+ if (ipv6_key->ipv6_proto != flow_key->ip.proto)
+ return -EINVAL;
+ if (ipv6_key->ipv6_frag != flow_key->ip.frag)
+ return -EINVAL;
+ }
if (ntohl(ipv6_key->ipv6_label) & 0xFFF00000)
return -EINVAL;
@@ -1881,13 +1920,19 @@ static int validate_set(const struct nlattr *a,
if (flow_key->ip.proto != IPPROTO_TCP)
return -EINVAL;
- return validate_tp_port(flow_key, eth_type);
+ err = validate_tp_port(flow_key, eth_type);
+ if (err)
+ return err;
+ break;
case OVS_KEY_ATTR_UDP:
if (flow_key->ip.proto != IPPROTO_UDP)
return -EINVAL;
- return validate_tp_port(flow_key, eth_type);
+ err = validate_tp_port(flow_key, eth_type);
+ if (err)
+ return err;
+ break;
case OVS_KEY_ATTR_MPLS:
if (!eth_p_mpls(eth_type))
@@ -1898,12 +1943,43 @@ static int validate_set(const struct nlattr *a,
if (flow_key->ip.proto != IPPROTO_SCTP)
return -EINVAL;
- return validate_tp_port(flow_key, eth_type);
+ err = validate_tp_port(flow_key, eth_type);
+ if (err)
+ return err;
+ break;
default:
return -EINVAL;
}
+ /* Convert non-masked non-tunnel set actions to masked set actions. */
+ if (!masked && key_type != OVS_KEY_ATTR_TUNNEL) {
+ int start, len = key_len * 2;
+ struct nlattr *at;
+
+ *skip_copy = true;
+
+ start = add_nested_action_start(sfa,
+ OVS_ACTION_ATTR_SET_TO_MASKED,
+ log);
+ if (start < 0)
+ return start;
+
+ at = __add_action(sfa, key_type, NULL, len, log);
+ if (IS_ERR(at))
+ return PTR_ERR(at);
+
+ memcpy(nla_data(at), nla_data(ovs_key), key_len); /* Key. */
+ memset(nla_data(at) + key_len, 0xff, key_len); /* Mask. */
+ /* Clear non-writeable bits from otherwise writeable fields. */
+ if (key_type == OVS_KEY_ATTR_IPV6) {
+ struct ovs_key_ipv6 *mask = nla_data(at) + key_len;
+
+ mask->ipv6_label &= htonl(0x000FFFFF);
+ }
+ add_nested_action_end(*sfa, start);
+ }
+
return 0;
}
@@ -1965,6 +2041,7 @@ static int __ovs_nla_copy_actions(const struct nlattr *attr,
[OVS_ACTION_ATTR_PUSH_VLAN] = sizeof(struct ovs_action_push_vlan),
[OVS_ACTION_ATTR_POP_VLAN] = 0,
[OVS_ACTION_ATTR_SET] = (u32)-1,
+ [OVS_ACTION_ATTR_SET_MASKED] = (u32)-1,
[OVS_ACTION_ATTR_SAMPLE] = (u32)-1,
[OVS_ACTION_ATTR_HASH] = sizeof(struct ovs_action_hash)
};
@@ -2060,7 +2137,14 @@ static int __ovs_nla_copy_actions(const struct nlattr *attr,
case OVS_ACTION_ATTR_SET:
err = validate_set(a, key, sfa,
- &skip_copy, eth_type, log);
+ &skip_copy, eth_type, false, log);
+ if (err)
+ return err;
+ break;
+
+ case OVS_ACTION_ATTR_SET_MASKED:
+ err = validate_set(a, key, sfa,
+ &skip_copy, eth_type, true, log);
if (err)
return err;
break;
@@ -2090,6 +2174,7 @@ static int __ovs_nla_copy_actions(const struct nlattr *attr,
return 0;
}
+/* 'key' must be the masked key. */
int ovs_nla_copy_actions(const struct nlattr *attr,
const struct sw_flow_key *key,
struct sw_flow_actions **sfa, bool log)
@@ -2177,6 +2262,32 @@ static int set_action_to_attr(const struct nlattr *a, struct sk_buff *skb)
return 0;
}
+static int masked_set_action_to_attr(const struct nlattr *a,
+ struct sk_buff *skb)
+{
+ const struct nlattr *ovs_key = nla_data(a);
+
+ if (nla_put(skb, OVS_ACTION_ATTR_SET_MASKED, nla_len(a), ovs_key))
+ return -EMSGSIZE;
+
+ return 0;
+}
+
+static int masked_set_action_to_set_action_attr(const struct nlattr *a,
+ struct sk_buff *skb)
+{
+ const struct nlattr *ovs_key = nla_data(a);
+ size_t key_len = nla_len(ovs_key) / 2;
+
+ /* Revert the conversion we did from a non-masked set action to
+ * masked set action.
+ */
+ if (nla_put(skb, OVS_ACTION_ATTR_SET, nla_len(a) - key_len, ovs_key))
+ return -EMSGSIZE;
+
+ return 0;
+}
+
int ovs_nla_put_actions(const struct nlattr *attr, int len, struct sk_buff *skb)
{
const struct nlattr *a;
@@ -2192,6 +2303,18 @@ int ovs_nla_put_actions(const struct nlattr *attr, int len, struct sk_buff *skb)
return err;
break;
+ case OVS_ACTION_ATTR_SET_MASKED:
+ err = masked_set_action_to_attr(a, skb);
+ if (err)
+ return err;
+ break;
+
+ case OVS_ACTION_ATTR_SET_TO_MASKED:
+ err = masked_set_action_to_set_action_attr(a, skb);
+ if (err)
+ return err;
+ break;
+
case OVS_ACTION_ATTR_SAMPLE:
err = sample_action_to_attr(a, skb);
if (err)
--
1.7.10.4
_______________________________________________
dev mailing list
dev@openvswitch.org
http://openvswitch.org/mailman/listinfo/dev
^ permalink raw reply related
* [ANNOUNCE] netdev0.1 netfilter BoF
From: Josh Hunt @ 2015-02-05 0:17 UTC (permalink / raw)
To: netdev, netfilter-devel
Cc: Pablo Neira Ayuso, Bohman, Pete, kaber, Jozsef Kadlecsik
We will be leading a BoF discussing netfilter development and issues in
iptables, ipset, and nftables at netdev0.1 in Ottawa coming up in a few
weeks.
Our timeslot is currently scheduled for Sunday, Feb 15 @ 9am, but please
refer to https://www.netdev01.org/schedule in case there are any
schedule changes.
The topics we intend to cover will be based around Akamai's usage,
deployment, and the issues we've come across.
Some examples of those topics are:
* The need for supported interfaces from netfilter components.
* The handling of large (1 million to 25 million entry) sets, both
with ipsets and nft sets.
* Limitations in existing iptables functionality.
* For ex, issues with hashlimit implementation and proposals to
extend it.
We'll also look at the current standing of nftables and discuss some
basic performance as it pertains to our environment, as well as,
backwards compatibility, and possible new features in nftables.
We hope to bring together interested stakeholders and interested parties
to discuss the above along with any other related netfilter topics you
would like to discuss. The BoF is scheduled for two hours.
If you have items you'd like to add to the agenda and/or present, please
contact me.
Thanks
Josh & Pete
^ permalink raw reply
* Re: [PATCH net-next 0/7] Mellanox drivers updates Feb-03-2015
From: David Miller @ 2015-02-05 0:18 UTC (permalink / raw)
To: amirv; +Cc: netdev, ogerlitz, yevgenyp
In-Reply-To: <1422979041-25208-1-git-send-email-amirv@mellanox.com>
From: Amir Vadai <amirv@mellanox.com>
Date: Tue, 3 Feb 2015 17:57:14 +0200
> This patchset introduces some small bug fixes and code cleanups in mlx4_core,
> mlx4_en and mlx5_core.
> I am sending it in parallel to the patchset sent by Or Gerlitz today [1] because
> this is the end of the time frame for 3.20. I also checked that there are no
> conflicts between those two patchsets (Or's patchset is focused on the bonding
> area while this on Mellanox drivers).
>
> The patchset was applied on top of commit 7d37d0c ('net: sctp: Deletion of an
> unnecessary check before the function call "kfree"')
>
> [1] - [PATCH 00/10] Add HA and LAG support to mlx4 RoCE and SRIOV services
> http://marc.info/?l=linux-netdev&m=142297582610254&w=2
Series applied, thanks.
^ permalink raw reply
* Re: [RFC PATCH net-next 00/11] net: remove disable_irq() from ->ndo_poll_controller
From: Sabrina Dubroca @ 2015-02-05 0:20 UTC (permalink / raw)
To: Thomas Gleixner; +Cc: David Miller, netdev, peterz
In-Reply-To: <20150105143126.GA22122@kria>
Thomas, ping?
thread is over there if you need it:
https://marc.info/?l=linux-netdev&m=141833435000554&w=2
2015-01-05, 15:31:26 +0100, Sabrina Dubroca wrote:
> 2014-12-12, 23:01:28 +0100, Thomas Gleixner wrote:
> > On Thu, 11 Dec 2014, Sabrina Dubroca wrote:
> > > 2014-12-09, 21:44:33 -0500, David Miller wrote:
> > > >
> > > > Adding a new spinlock to every interrupt service routine is
> > > > simply a non-starter.
> > > >
> > > > You will certainly have to find a way to fix this in a way
> > > > that doesn't involve adding any new overhead to the normal
> > > > operational paths of these drivers.
> > >
> > > Okay. Here is another idea.
> > >
> > > Since the issue is with the wait_event() part of synchronize_irq(),
> > > and it only takes care of threaded handlers, maybe we could try not
> > > waiting for threaded handlers.
> > >
> > > Introduce disable_irq_nosleep() that returns true if it successfully
> > > synchronized against all handlers (there was no threaded handler
> > > running), false if it left some threads running. And in
> > > ->ndo_poll_controller, only call the interrupt handler if
> > > synchronization was successful.
> > >
> > > Both users of the poll controllers retry their action (alloc/xmit an
> > > skb) several times, with calls to the device's poll controller between
> > > attempts. And hopefully, if the first attempt fails, we will still
> > > manage to get through?
> >
> > Hopefully is not a good starting point. Is the poll controller
> > definitely retrying? Otherwise you might end up with the following:
> >
> > Interrupt line is shared between your network device and a
> > device which requested a threaded interrupt handler.
> >
> > CPU0 CPU1
> > interrupt()
> > your_device_handler()
> > return NONE;
> > shared_device_handler()
> > return WAKE_THREAD;
> > --> atomic_inc(threads_active);
> > poll()
> > disable_irq_nosleep()
> > sync_hardirq()
> > return atomic_read(threads_active);
> >
> > So if you do not have a reliable retry then you might just go into a
> > stale state. And this can happen if the interrupt type is edge because
> > we do not disable the interrupt when we wakeup the thread for obvious
> > reasons.
>
> We do have loops retrying to run the netpoll controller, and trying to
> do the work even if the controller doesn't help. And by hopefully I
> mean: even if we fail, we tried our best and netpoll isn't 100%
> reliable.
>
>
> static struct sk_buff *find_skb(struct netpoll *np, int len, int reserve)
> {
> ...
> repeat:
>
> skb = alloc_skb(len, GFP_ATOMIC);
> if (!skb)
> skb = skb_dequeue(&skb_pool);
>
> if (!skb) {
> if (++count < 10) {
> netpoll_poll_dev(np->dev);
> goto repeat;
> }
> return NULL;
> }
>
> ...
> }
>
> void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
> struct net_device *dev)
> {
> ...
>
> /* try until next clock tick */
> for (tries = jiffies_to_usecs(1)/USEC_PER_POLL;
> tries > 0; --tries) {
> if (HARD_TX_TRYLOCK(dev, txq)) {
> if (!netif_xmit_stopped(txq))
> status = netpoll_start_xmit(skb, dev, txq);
>
> HARD_TX_UNLOCK(dev, txq);
>
> if (status == NETDEV_TX_OK)
> break;
>
> }
>
> /* tickle device maybe there is some cleanup */
> netpoll_poll_dev(np->dev);
>
> udelay(USEC_PER_POLL);
> }
>
> ...
> }
>
>
>
> > Aside of that I think that something like this is a reasonable
> > approach to the problem.
> >
> > The only other nitpicks I have are:
> >
> > - The name of the function sucks, though my tired braain can't
> > come up with something reasonable right now
>
> I couldn't think of anything better. Maybe 'disable_irq_trysync' or
> 'disable_irq_hardsync'?
>
> Or maybe you prefer something that works like spin_trylock, and
> reenables the irq before returning if we can't sync? Maybe the risk
> of abuse would be a bit lower this way?
>
> I made synchronize_irq_nosleep static, but maybe it should be
> EXPORT_SYMBOL'ed as well. I didn't need that for e1000, but that
> would be more consistent.
>
>
> > - The lack of extensive documentation how this interface is
> > supposed to be used and the pitfals of abusage, both in the
> > function documentation and the changelog.
> >
> > Merlily copying the existing documentation of the other
> > interface is not sufficient.
>
>
> Yes, my email wasn't really a changelog, just a description and RFC.
>
>
> Modified documentation:
>
> -----
> disable_irq_nosleep - disable an irq and wait for completion of hard IRQ handlers
> @irq: Interrupt to disable
>
> Disable the selected interrupt line. Enables and Disables are
> nested.
> This function does not sleep, and is safe to call in atomic context.
>
> This function waits for any pending hard IRQ handlers for this
> interrupt to complete before returning. If you use this
> function while holding a resource the IRQ handler may need you
> will deadlock.
>
> This function does not wait for threaded IRQ handlers.
> Returns true if synchronized, false if there are threaded
> handlers pending.
>
> If false is returned, the caller must assume that synchronization
> didn't occur, and that it is NOT safe to proceed.
> The caller MUST reenable the interrupt by calling enable_irq in all
> cases.
>
> This function may be called - with care - from IRQ context.
> -----
>
>
> Thanks.
>
> --
> Sabrina
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply
* Re: [PATCH 3/4] netlink: Use rhashtable walk iterator
From: Thomas Graf @ 2015-02-05 0:25 UTC (permalink / raw)
To: Herbert Xu; +Cc: David Miller, netdev
In-Reply-To: <E1YIkA0-00063W-Hi@gondolin.me.apana.org.au>
On 02/04/15 at 07:33am, Herbert Xu wrote:
> This patch gets rid of the manual rhashtable walk in netlink
> which touches rhashtable internals that should not be exposed.
> It does so by using the rhashtable iterator primitives.
>
> In fact the existing code was very buggy. Some sockets weren't
> shown at all while others were shown more than once.
>
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
I tested these patches. Only thing I found are these sparse
warnings:
net/netlink/af_netlink.c:2893:12: warning: context imbalance in 'netlink_walk_start' - different lock contexts for basic block
net/netlink/af_netlink.c:2907:13: warning: context imbalance in 'netlink_walk_stop' - unexpected unlock
^ permalink raw reply
* [PATCH 0/6 v2 net-next] rhashtable fixes
From: Thomas Graf @ 2015-02-05 1:03 UTC (permalink / raw)
To: davem; +Cc: netdev, herbert, ying.xue
This series fixes all remaining known issues with rhashtable that
have been reported. In particular the race condition reported by
Ying Xue.
---
Dave/Herbert: I'm posting this now as it fixes real issues. I'm
fine with taking Herbert's rehash patches instead if they resolve
all the reported issues as well.
v2:
- Rebased on top of Herbert Xu's iterator code
- Fixed last remaining race that remained. Special thanks
to Daniel Borkmann for assistance while debugging.
Thomas Graf (6):
rhashtable: key_hashfn() must return full hash value
rhashtable: Use a single bucket lock for sibling buckets
rhashtable: Wait for RCU readers after final unzip work
rhashtable: Dump bucket tables on locking violation under
PROVE_LOCKING
rhashtable: Add more lock verification
rhashtable: Avoid bucket cross reference after removal
lib/rhashtable.c | 305 ++++++++++++++++++++++++++++++-------------------------
1 file changed, 167 insertions(+), 138 deletions(-)
^ permalink raw reply
* [PATCH 1/6] rhashtable: key_hashfn() must return full hash value
From: Thomas Graf @ 2015-02-05 1:03 UTC (permalink / raw)
To: davem; +Cc: netdev, herbert, ying.xue
In-Reply-To: <cover.1423097592.git.tgraf@suug.ch>
The value computed by key_hashfn() is used by rhashtable_lookup_compare()
to traverse both tables during a resize. key_hashfn() must therefore
return the hash value without the buckets mask applied so it can be
masked to the size of each individual table.
Fixes: 97defe1ecf86 ("rhashtable: Per bucket locks & deferred expansion/shrinking")
Signed-off-by: Thomas Graf <tgraf@suug.ch>
---
lib/rhashtable.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 0579191..71fd0dd 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -94,13 +94,7 @@ static u32 obj_raw_hashfn(const struct rhashtable *ht, const void *ptr)
static u32 key_hashfn(struct rhashtable *ht, const void *key, u32 len)
{
- struct bucket_table *tbl = rht_dereference_rcu(ht->tbl, ht);
- u32 hash;
-
- hash = ht->p.hashfn(key, len, ht->p.hash_rnd);
- hash >>= HASH_RESERVED_SPACE;
-
- return rht_bucket_index(tbl, hash);
+ return ht->p.hashfn(key, len, ht->p.hash_rnd) >> HASH_RESERVED_SPACE;
}
static u32 head_hashfn(const struct rhashtable *ht,
--
1.9.3
^ permalink raw reply related
* [PATCH 2/6] rhashtable: Use a single bucket lock for sibling buckets
From: Thomas Graf @ 2015-02-05 1:03 UTC (permalink / raw)
To: davem; +Cc: netdev, herbert, ying.xue
In-Reply-To: <cover.1423097592.git.tgraf@suug.ch>
rhashtable currently allows to use a bucket lock per bucket. This
requires multiple levels of complicated nested locking because when
resizing, a single bucket of the smaller table will map to two
buckets in the larger table. So far rhashtable has explicitly locked
both buckets in the larger table.
By excluding the highest bit of the hash from the bucket lock map and
thus only allowing locks to buckets in a ratio of 1:2, the locking
can be simplified a lot without losing the benefits of multiple locks.
Larger tables which benefit from multiple locks will not have a single
lock per bucket anyway.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
---
lib/rhashtable.c | 170 ++++++++++++++++++++++---------------------------------
1 file changed, 69 insertions(+), 101 deletions(-)
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 71fd0dd..cea4244 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -1,7 +1,7 @@
/*
* Resizable, Scalable, Concurrent Hash Table
*
- * Copyright (c) 2014 Thomas Graf <tgraf@suug.ch>
+ * Copyright (c) 2014-2015 Thomas Graf <tgraf@suug.ch>
* Copyright (c) 2008-2014 Patrick McHardy <kaber@trash.net>
*
* Based on the following paper:
@@ -34,12 +34,17 @@
enum {
RHT_LOCK_NORMAL,
RHT_LOCK_NESTED,
- RHT_LOCK_NESTED2,
};
/* The bucket lock is selected based on the hash and protects mutations
* on a group of hash buckets.
*
+ * A maximum of tbl->size/2 bucket locks is allocated. This ensures that
+ * a single lock always covers both buckets which may both contains
+ * entries which link to the same bucket of the old table during resizing.
+ * This allows to simplify the locking as locking the bucket in both
+ * tables during resize always guarantee protection.
+ *
* IMPORTANT: When holding the bucket lock of both the old and new table
* during expansions and shrinking, the old bucket lock must always be
* acquired first.
@@ -128,8 +133,8 @@ static int alloc_bucket_locks(struct rhashtable *ht, struct bucket_table *tbl)
nr_pcpus = min_t(unsigned int, nr_pcpus, 32UL);
size = roundup_pow_of_two(nr_pcpus * ht->p.locks_mul);
- /* Never allocate more than one lock per bucket */
- size = min_t(unsigned int, size, tbl->size);
+ /* Never allocate more than 0.5 locks per bucket */
+ size = min_t(unsigned int, size, tbl->size >> 1);
if (sizeof(spinlock_t) != 0) {
#ifdef CONFIG_NUMA
@@ -211,13 +216,36 @@ bool rht_shrink_below_30(const struct rhashtable *ht, size_t new_size)
}
EXPORT_SYMBOL_GPL(rht_shrink_below_30);
-static void hashtable_chain_unzip(const struct rhashtable *ht,
+static void lock_buckets(struct bucket_table *new_tbl,
+ struct bucket_table *old_tbl, unsigned int hash)
+ __acquires(old_bucket_lock)
+{
+ spin_lock_bh(bucket_lock(old_tbl, hash));
+ if (new_tbl != old_tbl)
+ spin_lock_bh_nested(bucket_lock(new_tbl, hash),
+ RHT_LOCK_NESTED);
+}
+
+static void unlock_buckets(struct bucket_table *new_tbl,
+ struct bucket_table *old_tbl, unsigned int hash)
+ __releases(old_bucket_lock)
+{
+ if (new_tbl != old_tbl)
+ spin_unlock_bh(bucket_lock(new_tbl, hash));
+ spin_unlock_bh(bucket_lock(old_tbl, hash));
+}
+
+/**
+ * Unlink entries on bucket which hash to different bucket.
+ *
+ * Returns true if no more work needs to be performed on the bucket.
+ */
+static bool hashtable_chain_unzip(const struct rhashtable *ht,
const struct bucket_table *new_tbl,
struct bucket_table *old_tbl,
size_t old_hash)
{
struct rhash_head *he, *p, *next;
- spinlock_t *new_bucket_lock, *new_bucket_lock2 = NULL;
unsigned int new_hash, new_hash2;
ASSERT_BUCKET_LOCK(old_tbl, old_hash);
@@ -226,10 +254,10 @@ static void hashtable_chain_unzip(const struct rhashtable *ht,
p = rht_dereference_bucket(old_tbl->buckets[old_hash], old_tbl,
old_hash);
if (rht_is_a_nulls(p))
- return;
+ return false;
- new_hash = new_hash2 = head_hashfn(ht, new_tbl, p);
- new_bucket_lock = bucket_lock(new_tbl, new_hash);
+ new_hash = head_hashfn(ht, new_tbl, p);
+ ASSERT_BUCKET_LOCK(new_tbl, new_hash);
/* Advance the old bucket pointer one or more times until it
* reaches a node that doesn't hash to the same bucket as the
@@ -237,22 +265,14 @@ static void hashtable_chain_unzip(const struct rhashtable *ht,
*/
rht_for_each_continue(he, p->next, old_tbl, old_hash) {
new_hash2 = head_hashfn(ht, new_tbl, he);
+ ASSERT_BUCKET_LOCK(new_tbl, new_hash2);
+
if (new_hash != new_hash2)
break;
p = he;
}
rcu_assign_pointer(old_tbl->buckets[old_hash], p->next);
- spin_lock_bh_nested(new_bucket_lock, RHT_LOCK_NESTED);
-
- /* If we have encountered an entry that maps to a different bucket in
- * the new table, lock down that bucket as well as we might cut off
- * the end of the chain.
- */
- new_bucket_lock2 = bucket_lock(new_tbl, new_hash);
- if (new_bucket_lock != new_bucket_lock2)
- spin_lock_bh_nested(new_bucket_lock2, RHT_LOCK_NESTED2);
-
/* Find the subsequent node which does hash to the same
* bucket as node P, or NULL if no such node exists.
*/
@@ -271,21 +291,16 @@ static void hashtable_chain_unzip(const struct rhashtable *ht,
*/
rcu_assign_pointer(p->next, next);
- if (new_bucket_lock != new_bucket_lock2)
- spin_unlock_bh(new_bucket_lock2);
- spin_unlock_bh(new_bucket_lock);
+ p = rht_dereference_bucket(old_tbl->buckets[old_hash], old_tbl,
+ old_hash);
+
+ return !rht_is_a_nulls(p);
}
static void link_old_to_new(struct bucket_table *new_tbl,
unsigned int new_hash, struct rhash_head *entry)
{
- spinlock_t *new_bucket_lock;
-
- new_bucket_lock = bucket_lock(new_tbl, new_hash);
-
- spin_lock_bh_nested(new_bucket_lock, RHT_LOCK_NESTED);
rcu_assign_pointer(*bucket_tail(new_tbl, new_hash), entry);
- spin_unlock_bh(new_bucket_lock);
}
/**
@@ -308,7 +323,6 @@ int rhashtable_expand(struct rhashtable *ht)
{
struct bucket_table *new_tbl, *old_tbl = rht_dereference(ht->tbl, ht);
struct rhash_head *he;
- spinlock_t *old_bucket_lock;
unsigned int new_hash, old_hash;
bool complete = false;
@@ -338,16 +352,14 @@ int rhashtable_expand(struct rhashtable *ht)
*/
for (new_hash = 0; new_hash < new_tbl->size; new_hash++) {
old_hash = rht_bucket_index(old_tbl, new_hash);
- old_bucket_lock = bucket_lock(old_tbl, old_hash);
-
- spin_lock_bh(old_bucket_lock);
+ lock_buckets(new_tbl, old_tbl, new_hash);
rht_for_each(he, old_tbl, old_hash) {
if (head_hashfn(ht, new_tbl, he) == new_hash) {
link_old_to_new(new_tbl, new_hash, he);
break;
}
}
- spin_unlock_bh(old_bucket_lock);
+ unlock_buckets(new_tbl, old_tbl, new_hash);
}
/* Publish the new table pointer. Lookups may now traverse
@@ -370,18 +382,13 @@ int rhashtable_expand(struct rhashtable *ht)
*/
complete = true;
for (old_hash = 0; old_hash < old_tbl->size; old_hash++) {
- struct rhash_head *head;
+ lock_buckets(new_tbl, old_tbl, old_hash);
- old_bucket_lock = bucket_lock(old_tbl, old_hash);
- spin_lock_bh(old_bucket_lock);
-
- hashtable_chain_unzip(ht, new_tbl, old_tbl, old_hash);
- head = rht_dereference_bucket(old_tbl->buckets[old_hash],
- old_tbl, old_hash);
- if (!rht_is_a_nulls(head))
+ if (hashtable_chain_unzip(ht, new_tbl, old_tbl,
+ old_hash))
complete = false;
- spin_unlock_bh(old_bucket_lock);
+ unlock_buckets(new_tbl, old_tbl, old_hash);
}
}
@@ -409,7 +416,6 @@ EXPORT_SYMBOL_GPL(rhashtable_expand);
int rhashtable_shrink(struct rhashtable *ht)
{
struct bucket_table *new_tbl, *tbl = rht_dereference(ht->tbl, ht);
- spinlock_t *new_bucket_lock, *old_bucket_lock1, *old_bucket_lock2;
unsigned int new_hash;
ASSERT_RHT_MUTEX(ht);
@@ -427,36 +433,16 @@ int rhashtable_shrink(struct rhashtable *ht)
* always divide the size in half when shrinking, each bucket
* in the new table maps to exactly two buckets in the old
* table.
- *
- * As removals can occur concurrently on the old table, we need
- * to lock down both matching buckets in the old table.
*/
for (new_hash = 0; new_hash < new_tbl->size; new_hash++) {
- old_bucket_lock1 = bucket_lock(tbl, new_hash);
- old_bucket_lock2 = bucket_lock(tbl, new_hash + new_tbl->size);
- new_bucket_lock = bucket_lock(new_tbl, new_hash);
-
- spin_lock_bh(old_bucket_lock1);
-
- /* Depending on the lock per buckets mapping, the bucket in
- * the lower and upper region may map to the same lock.
- */
- if (old_bucket_lock1 != old_bucket_lock2) {
- spin_lock_bh_nested(old_bucket_lock2, RHT_LOCK_NESTED);
- spin_lock_bh_nested(new_bucket_lock, RHT_LOCK_NESTED2);
- } else {
- spin_lock_bh_nested(new_bucket_lock, RHT_LOCK_NESTED);
- }
+ lock_buckets(new_tbl, tbl, new_hash);
rcu_assign_pointer(*bucket_tail(new_tbl, new_hash),
tbl->buckets[new_hash]);
rcu_assign_pointer(*bucket_tail(new_tbl, new_hash),
tbl->buckets[new_hash + new_tbl->size]);
- spin_unlock_bh(new_bucket_lock);
- if (old_bucket_lock1 != old_bucket_lock2)
- spin_unlock_bh(old_bucket_lock2);
- spin_unlock_bh(old_bucket_lock1);
+ unlock_buckets(new_tbl, tbl, new_hash);
}
/* Publish the new, valid hash table */
@@ -547,19 +533,18 @@ static void __rhashtable_insert(struct rhashtable *ht, struct rhash_head *obj,
*/
void rhashtable_insert(struct rhashtable *ht, struct rhash_head *obj)
{
- struct bucket_table *tbl;
- spinlock_t *lock;
+ struct bucket_table *tbl, *old_tbl;
unsigned hash;
rcu_read_lock();
tbl = rht_dereference_rcu(ht->future_tbl, ht);
+ old_tbl = rht_dereference_rcu(ht->tbl, ht);
hash = head_hashfn(ht, tbl, obj);
- lock = bucket_lock(tbl, hash);
- spin_lock_bh(lock);
+ lock_buckets(tbl, old_tbl, hash);
__rhashtable_insert(ht, obj, tbl, hash);
- spin_unlock_bh(lock);
+ unlock_buckets(tbl, old_tbl, hash);
rcu_read_unlock();
}
@@ -582,21 +567,20 @@ EXPORT_SYMBOL_GPL(rhashtable_insert);
*/
bool rhashtable_remove(struct rhashtable *ht, struct rhash_head *obj)
{
- struct bucket_table *tbl;
+ struct bucket_table *tbl, *new_tbl, *old_tbl;
struct rhash_head __rcu **pprev;
struct rhash_head *he;
- spinlock_t *lock;
- unsigned int hash;
+ unsigned int hash, new_hash;
bool ret = false;
rcu_read_lock();
- tbl = rht_dereference_rcu(ht->tbl, ht);
- hash = head_hashfn(ht, tbl, obj);
-
- lock = bucket_lock(tbl, hash);
- spin_lock_bh(lock);
+ tbl = old_tbl = rht_dereference_rcu(ht->tbl, ht);
+ new_tbl = rht_dereference_rcu(ht->future_tbl, ht);
+ new_hash = head_hashfn(ht, new_tbl, obj);
+ lock_buckets(new_tbl, old_tbl, new_hash);
restart:
+ hash = rht_bucket_index(tbl, new_hash);
pprev = &tbl->buckets[hash];
rht_for_each(he, tbl, hash) {
if (he != obj) {
@@ -615,18 +599,12 @@ restart:
* resizing. Thus traversing both is fine and the added cost is
* very rare.
*/
- if (tbl != rht_dereference_rcu(ht->future_tbl, ht)) {
- spin_unlock_bh(lock);
-
- tbl = rht_dereference_rcu(ht->future_tbl, ht);
- hash = head_hashfn(ht, tbl, obj);
-
- lock = bucket_lock(tbl, hash);
- spin_lock_bh(lock);
+ if (tbl != new_tbl) {
+ tbl = new_tbl;
goto restart;
}
- spin_unlock_bh(lock);
+ unlock_buckets(new_tbl, old_tbl, new_hash);
if (ret) {
atomic_dec(&ht->nelems);
@@ -782,24 +760,17 @@ bool rhashtable_lookup_compare_insert(struct rhashtable *ht,
void *arg)
{
struct bucket_table *new_tbl, *old_tbl;
- spinlock_t *new_bucket_lock, *old_bucket_lock;
- u32 new_hash, old_hash;
+ u32 new_hash;
bool success = true;
BUG_ON(!ht->p.key_len);
rcu_read_lock();
-
old_tbl = rht_dereference_rcu(ht->tbl, ht);
- old_hash = head_hashfn(ht, old_tbl, obj);
- old_bucket_lock = bucket_lock(old_tbl, old_hash);
- spin_lock_bh(old_bucket_lock);
-
new_tbl = rht_dereference_rcu(ht->future_tbl, ht);
new_hash = head_hashfn(ht, new_tbl, obj);
- new_bucket_lock = bucket_lock(new_tbl, new_hash);
- if (unlikely(old_tbl != new_tbl))
- spin_lock_bh_nested(new_bucket_lock, RHT_LOCK_NESTED);
+
+ lock_buckets(new_tbl, old_tbl, new_hash);
if (rhashtable_lookup_compare(ht, rht_obj(ht, obj) + ht->p.key_offset,
compare, arg)) {
@@ -810,10 +781,7 @@ bool rhashtable_lookup_compare_insert(struct rhashtable *ht,
__rhashtable_insert(ht, obj, new_tbl, new_hash);
exit:
- if (unlikely(old_tbl != new_tbl))
- spin_unlock_bh(new_bucket_lock);
- spin_unlock_bh(old_bucket_lock);
-
+ unlock_buckets(new_tbl, old_tbl, new_hash);
rcu_read_unlock();
return success;
--
1.9.3
^ permalink raw reply related
* [PATCH 3/6] rhashtable: Wait for RCU readers after final unzip work
From: Thomas Graf @ 2015-02-05 1:03 UTC (permalink / raw)
To: davem; +Cc: netdev, herbert, ying.xue
In-Reply-To: <cover.1423097592.git.tgraf@suug.ch>
We need to wait for all RCU readers to complete after the last bit of
unzipping has been completed. Otherwise the old table is freed up
prematurely.
Fixes: 7e1e77636e36 ("lib: Resizable, Scalable, Concurrent Hash Table")
Signed-off-by: Thomas Graf <tgraf@suug.ch>
---
lib/rhashtable.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index cea4244..fd1033d 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -392,6 +392,8 @@ int rhashtable_expand(struct rhashtable *ht)
}
}
+ synchronize_rcu();
+
bucket_table_free(old_tbl);
return 0;
}
--
1.9.3
^ permalink raw reply related
* [PATCH 4/6] rhashtable: Dump bucket tables on locking violation under PROVE_LOCKING
From: Thomas Graf @ 2015-02-05 1:03 UTC (permalink / raw)
To: davem; +Cc: netdev, herbert, ying.xue
In-Reply-To: <cover.1423097592.git.tgraf@suug.ch>
This simplifies debugging of locking violations if compiled with
CONFIG_PROVE_LOCKING.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
---
lib/rhashtable.c | 99 ++++++++++++++++++++++++++++++++++++++++++--------------
1 file changed, 75 insertions(+), 24 deletions(-)
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index fd1033d..c2c3949 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -54,26 +54,6 @@ static spinlock_t *bucket_lock(const struct bucket_table *tbl, u32 hash)
return &tbl->locks[hash & tbl->locks_mask];
}
-#define ASSERT_RHT_MUTEX(HT) BUG_ON(!lockdep_rht_mutex_is_held(HT))
-#define ASSERT_BUCKET_LOCK(TBL, HASH) \
- BUG_ON(!lockdep_rht_bucket_is_held(TBL, HASH))
-
-#ifdef CONFIG_PROVE_LOCKING
-int lockdep_rht_mutex_is_held(struct rhashtable *ht)
-{
- return (debug_locks) ? lockdep_is_held(&ht->mutex) : 1;
-}
-EXPORT_SYMBOL_GPL(lockdep_rht_mutex_is_held);
-
-int lockdep_rht_bucket_is_held(const struct bucket_table *tbl, u32 hash)
-{
- spinlock_t *lock = bucket_lock(tbl, hash);
-
- return (debug_locks) ? lockdep_is_held(lock) : 1;
-}
-EXPORT_SYMBOL_GPL(lockdep_rht_bucket_is_held);
-#endif
-
static void *rht_obj(const struct rhashtable *ht, const struct rhash_head *he)
{
return (void *) he - ht->p.head_offset;
@@ -109,6 +89,77 @@ static u32 head_hashfn(const struct rhashtable *ht,
return rht_bucket_index(tbl, obj_raw_hashfn(ht, rht_obj(ht, he)));
}
+#ifdef CONFIG_PROVE_LOCKING
+static void debug_dump_buckets(const struct rhashtable *ht,
+ const struct bucket_table *tbl)
+{
+ struct rhash_head *he;
+ unsigned int i, hash;
+
+ for (i = 0; i < tbl->size; i++) {
+ pr_warn(" [Bucket %d] ", i);
+ rht_for_each_rcu(he, tbl, i) {
+ hash = head_hashfn(ht, tbl, he);
+ pr_cont("[hash = %#x, lock = %p] ",
+ hash, bucket_lock(tbl, hash));
+ }
+ pr_cont("\n");
+ }
+
+}
+
+static void debug_dump_table(struct rhashtable *ht,
+ const struct bucket_table *tbl,
+ unsigned int hash)
+{
+ struct bucket_table *old_tbl, *future_tbl;
+
+ pr_emerg("BUG: lock for hash %#x in table %p not held\n",
+ hash, tbl);
+
+ rcu_read_lock();
+ future_tbl = rht_dereference_rcu(ht->future_tbl, ht);
+ old_tbl = rht_dereference_rcu(ht->tbl, ht);
+ if (future_tbl != old_tbl) {
+ pr_warn("Future table %p (size: %zd)\n",
+ future_tbl, future_tbl->size);
+ debug_dump_buckets(ht, future_tbl);
+ }
+
+ pr_warn("Table %p (size: %zd)\n", old_tbl, old_tbl->size);
+ debug_dump_buckets(ht, old_tbl);
+
+ rcu_read_unlock();
+}
+
+#define ASSERT_RHT_MUTEX(HT) BUG_ON(!lockdep_rht_mutex_is_held(HT))
+#define ASSERT_BUCKET_LOCK(HT, TBL, HASH) \
+ do { \
+ if (unlikely(!lockdep_rht_bucket_is_held(TBL, HASH))) { \
+ debug_dump_table(HT, TBL, HASH); \
+ BUG(); \
+ } \
+ } while (0)
+
+int lockdep_rht_mutex_is_held(struct rhashtable *ht)
+{
+ return (debug_locks) ? lockdep_is_held(&ht->mutex) : 1;
+}
+EXPORT_SYMBOL_GPL(lockdep_rht_mutex_is_held);
+
+int lockdep_rht_bucket_is_held(const struct bucket_table *tbl, u32 hash)
+{
+ spinlock_t *lock = bucket_lock(tbl, hash);
+
+ return (debug_locks) ? lockdep_is_held(lock) : 1;
+}
+EXPORT_SYMBOL_GPL(lockdep_rht_bucket_is_held);
+#else
+#define ASSERT_RHT_MUTEX(HT)
+#define ASSERT_BUCKET_LOCK(HT, TBL, HASH)
+#endif
+
+
static struct rhash_head __rcu **bucket_tail(struct bucket_table *tbl, u32 n)
{
struct rhash_head __rcu **pprev;
@@ -240,7 +291,7 @@ static void unlock_buckets(struct bucket_table *new_tbl,
*
* Returns true if no more work needs to be performed on the bucket.
*/
-static bool hashtable_chain_unzip(const struct rhashtable *ht,
+static bool hashtable_chain_unzip(struct rhashtable *ht,
const struct bucket_table *new_tbl,
struct bucket_table *old_tbl,
size_t old_hash)
@@ -248,7 +299,7 @@ static bool hashtable_chain_unzip(const struct rhashtable *ht,
struct rhash_head *he, *p, *next;
unsigned int new_hash, new_hash2;
- ASSERT_BUCKET_LOCK(old_tbl, old_hash);
+ ASSERT_BUCKET_LOCK(ht, old_tbl, old_hash);
/* Old bucket empty, no work needed. */
p = rht_dereference_bucket(old_tbl->buckets[old_hash], old_tbl,
@@ -257,7 +308,7 @@ static bool hashtable_chain_unzip(const struct rhashtable *ht,
return false;
new_hash = head_hashfn(ht, new_tbl, p);
- ASSERT_BUCKET_LOCK(new_tbl, new_hash);
+ ASSERT_BUCKET_LOCK(ht, new_tbl, new_hash);
/* Advance the old bucket pointer one or more times until it
* reaches a node that doesn't hash to the same bucket as the
@@ -265,7 +316,7 @@ static bool hashtable_chain_unzip(const struct rhashtable *ht,
*/
rht_for_each_continue(he, p->next, old_tbl, old_hash) {
new_hash2 = head_hashfn(ht, new_tbl, he);
- ASSERT_BUCKET_LOCK(new_tbl, new_hash2);
+ ASSERT_BUCKET_LOCK(ht, new_tbl, new_hash2);
if (new_hash != new_hash2)
break;
--
1.9.3
^ permalink raw reply related
* [PATCH 5/6] rhashtable: Add more lock verification
From: Thomas Graf @ 2015-02-05 1:03 UTC (permalink / raw)
To: davem; +Cc: netdev, herbert, ying.xue
In-Reply-To: <cover.1423097592.git.tgraf@suug.ch>
Catch hash miscalculations which result in hard to track down race
conditions.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
---
lib/rhashtable.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index c2c3949..ef0816b 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -348,9 +348,11 @@ static bool hashtable_chain_unzip(struct rhashtable *ht,
return !rht_is_a_nulls(p);
}
-static void link_old_to_new(struct bucket_table *new_tbl,
+static void link_old_to_new(struct rhashtable *ht, struct bucket_table *new_tbl,
unsigned int new_hash, struct rhash_head *entry)
{
+ ASSERT_BUCKET_LOCK(ht, new_tbl, new_hash);
+
rcu_assign_pointer(*bucket_tail(new_tbl, new_hash), entry);
}
@@ -406,7 +408,7 @@ int rhashtable_expand(struct rhashtable *ht)
lock_buckets(new_tbl, old_tbl, new_hash);
rht_for_each(he, old_tbl, old_hash) {
if (head_hashfn(ht, new_tbl, he) == new_hash) {
- link_old_to_new(new_tbl, new_hash, he);
+ link_old_to_new(ht, new_tbl, new_hash, he);
break;
}
}
@@ -492,6 +494,7 @@ int rhashtable_shrink(struct rhashtable *ht)
rcu_assign_pointer(*bucket_tail(new_tbl, new_hash),
tbl->buckets[new_hash]);
+ ASSERT_BUCKET_LOCK(ht, tbl, new_hash + new_tbl->size);
rcu_assign_pointer(*bucket_tail(new_tbl, new_hash),
tbl->buckets[new_hash + new_tbl->size]);
@@ -557,6 +560,8 @@ static void __rhashtable_insert(struct rhashtable *ht, struct rhash_head *obj,
struct rhash_head *head = rht_dereference_bucket(tbl->buckets[hash],
tbl, hash);
+ ASSERT_BUCKET_LOCK(ht, tbl, hash);
+
if (rht_is_a_nulls(head))
INIT_RHT_NULLS_HEAD(obj->next, ht, hash);
else
@@ -641,6 +646,7 @@ restart:
continue;
}
+ ASSERT_BUCKET_LOCK(ht, tbl, hash);
rcu_assign_pointer(*pprev, obj->next);
ret = true;
--
1.9.3
^ permalink raw reply related
* [PATCH 6/6] rhashtable: Avoid bucket cross reference after removal
From: Thomas Graf @ 2015-02-05 1:03 UTC (permalink / raw)
To: davem; +Cc: netdev, herbert, ying.xue
In-Reply-To: <cover.1423097592.git.tgraf@suug.ch>
During a resize, when two buckets in the larger table map to
a single bucket in the smaller table and the new table has already
been (partially) linked to the old table. Removal of an element
may result the bucket in the larger table to point to entries
which all hash to a different value than the bucket index. Thus
causing two buckets to point to the same sub chain after unzipping.
This is not illegal *during* the resize phase but after it has
completed.
Keep the old table around until all of the unzipping is done to
allow the removal code to only search for matching hashed entries
during this special period.
Reported-by: Ying Xue <ying.xue@windriver.com>
Fixes: 97defe1ecf86 ("rhashtable: Per bucket locks & deferred expansion/shrinking")
Signed-off-by: Thomas Graf <tgraf@suug.ch>
---
lib/rhashtable.c | 26 +++++++++++++++++---------
1 file changed, 17 insertions(+), 9 deletions(-)
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index ef0816b..5919d63 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -415,12 +415,6 @@ int rhashtable_expand(struct rhashtable *ht)
unlock_buckets(new_tbl, old_tbl, new_hash);
}
- /* Publish the new table pointer. Lookups may now traverse
- * the new table, but they will not benefit from any
- * additional efficiency until later steps unzip the buckets.
- */
- rcu_assign_pointer(ht->tbl, new_tbl);
-
/* Unzip interleaved hash chains */
while (!complete && !ht->being_destroyed) {
/* Wait for readers. All new readers will see the new
@@ -445,6 +439,7 @@ int rhashtable_expand(struct rhashtable *ht)
}
}
+ rcu_assign_pointer(ht->tbl, new_tbl);
synchronize_rcu();
bucket_table_free(old_tbl);
@@ -627,14 +622,14 @@ bool rhashtable_remove(struct rhashtable *ht, struct rhash_head *obj)
{
struct bucket_table *tbl, *new_tbl, *old_tbl;
struct rhash_head __rcu **pprev;
- struct rhash_head *he;
+ struct rhash_head *he, *he2;
unsigned int hash, new_hash;
bool ret = false;
rcu_read_lock();
tbl = old_tbl = rht_dereference_rcu(ht->tbl, ht);
new_tbl = rht_dereference_rcu(ht->future_tbl, ht);
- new_hash = head_hashfn(ht, new_tbl, obj);
+ new_hash = obj_raw_hashfn(ht, rht_obj(ht, obj));
lock_buckets(new_tbl, old_tbl, new_hash);
restart:
@@ -647,8 +642,21 @@ restart:
}
ASSERT_BUCKET_LOCK(ht, tbl, hash);
- rcu_assign_pointer(*pprev, obj->next);
+ if (unlikely(new_tbl != tbl)) {
+ rht_for_each_continue(he2, he->next, tbl, hash) {
+ if (head_hashfn(ht, tbl, he2) == hash) {
+ rcu_assign_pointer(*pprev, he2);
+ goto found;
+ }
+ }
+
+ INIT_RHT_NULLS_HEAD(*pprev, ht, hash);
+ } else {
+ rcu_assign_pointer(*pprev, obj->next);
+ }
+
+found:
ret = true;
break;
}
--
1.9.3
^ permalink raw reply related
* [RFC PATCH 01/29] net: Introduce net_ctx and macro for context comparison
From: David Ahern @ 2015-02-05 1:34 UTC (permalink / raw)
To: netdev; +Cc: ebiederm, David Ahern
In-Reply-To: <1423100070-31848-1-git-send-email-dsahern@gmail.com>
For now the network context is just the namespace. A later patch adds
a vrf context.
Signed-off-by: David Ahern <dsahern@gmail.com>
---
include/net/net_namespace.h | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 36faf4990c4b..b932f2a83865 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -134,11 +134,19 @@ struct net {
atomic_t fnhe_genid;
};
+struct net_ctx {
+#ifdef CONFIG_NET_NS
+ struct net *net;
+#endif
+};
+
#include <linux/seq_file_net.h>
/* Init's network namespace */
extern struct net init_net;
+#define INIT_NET_CTX { .net = &init_net }
+
#ifdef CONFIG_NET_NS
struct net *copy_net_ns(unsigned long flags, struct user_namespace *user_ns,
struct net *old_net);
@@ -202,6 +210,13 @@ int net_eq(const struct net *net1, const struct net *net2)
return net1 == net2;
}
+static inline
+int net_ctx_eq(struct net_ctx *ctx1, struct net_ctx *ctx2)
+{
+ return net_eq(ctx1->net, ctx2->net);
+}
+
+
void net_drop_ns(void *);
#else
@@ -226,6 +241,12 @@ int net_eq(const struct net *net1, const struct net *net2)
return 1;
}
+static inline
+int net_ctx_eq(struct net_ctx *ctx1, struct net_ctx *ctx2)
+{
+ return 1;
+}
+
#define net_drop_ns NULL
#endif
--
1.9.3 (Apple Git-50)
^ permalink raw reply related
* [RFC PATCH 00/29] net: VRF support
From: David Ahern @ 2015-02-05 1:34 UTC (permalink / raw)
To: netdev; +Cc: ebiederm, David Ahern
Kernel patches are also available here:
https://github.com/dsahern/linux.git vrf-3.19
iproute2 patches are also available here:
https://github.com/dsahern/iproute2 vrf-3.19
Background
----------
The concept of VRFs (Virtual Routing and Forwarding) has been around for over
15 years. Support for VRFs in the Linux kernel has been an often requested
feature for almost as long. For a while support was available via an out of
tree patch [1]. Since network namespaces came along, the response to queries
about VRF support for Linux was 'use namespaces'. But as mentioned previously
[2] network namespaces are not a good match for VRFs. Of the list of problems
noted the big one is that namespaces do not scale efficiently to the number
of VRFs supported by networking gear (> 1000 VRFs). Networking vendors that
want to use Linux as the OS have to carry custom solutions to this problem --
be it userspace networking stacks, extensive kernel patches (to add VRF
support or bend the implementation of namespaces), and/or patches to many
open source components. The recent addition of switchdev support in the
kernel suggests that people expect the use of Linux as a switch networking
OS to increase. Hopefully the time is right to re-open the discussion on a
salable VRF implementation for the Linux kernel.
The intent of this RFC is to get feedback on the overall idea - namely VRFs
as integer id and the nesting of VRFs within a namespace. This set includes
changes only to core IPv4 code which shows the concept; changes to the rest
of the network stack are fairly repetitive.
This patch set has a number of similarities to the original VRF patch - most
notably VRF ids as an integer index and plumbing through iproute2 and
netlink. But this set is really a complete re-implementation of the feature,
integrating VRF within a namespace and leveraging existing support for
network namespaces.
Design
------
Namespaces provide excellent separation of the networking stack from the
netdevices and up. The intent of VRFs is to provide an additional,
logical separation at the L3 layer within a namespace.
+----------------------------------------------------------+
| Namespace foo |
| +---------------+ |
| +------+ | L3/L4 service | |
| | lldp | | (VRF any) | |
| +------+ +---------------+ |
| |
| +-------------------------+ |
| | VRF M | |
| +---------------------+ +-------------------------+ | |
| | VRF 1 (default) | | VRF N | | |
| | +---------------+ | | +---------------+ | | |
| | | L3/L4 service | | | | L3/L4 service | | | |
| | | (VRF unaware) | | | | (VRF unaware) | | | |
| | +---------------+ | | +---------------+ | | |
| | | | | | |
| |+-----+ +----------+ | | +-----+ +----------+ | | |
| || FIB | | neighbor | | | | FIB | | neighbor | | | |
| |+-----+ +----------+ | | +-----+ +----------+ | | |
| | | | |-+ |
| | {dev 1} {dev 2} | | {dev 3} {dev 4} {dev 5} | |
| +---------------------+ +-------------------------+ |
+----------------------------------------------------------+
This is accomplished by enhancing the current namespace checks to a
broader network context that is both a namepsace and a VRF id. The VRF
id is a tag applied to relevant structures, an integer between 1 and 4095
which allows for 4095 VRFs (could have 0 be the default VRF and then the
range is 0-4095 = 4096s VRFs). (The limitation is arguably artificial. It
is based on the genid scheme for versioning networking data which is a
32-bit integer. The VRF id is the lower 12 bits of the genid's.)
Netdevices, sk_buffs, sockets, and tasks are all tagged with a VRF id.
Network lookups (devices, sockets, addresses, routes, neighbors) require a
match of both network namespace and VRF id (or the special 'vrf any' tag;
more on that later).
Beyond the 4-byte tag in various data structures, there are no resources
allocated to a VRF so there is no need to create or destroy a VRF which is
in-line with the concept of keeping it lightweight for scalability. The
trade-off is that VRFs use the the same sysctl settings as the namespace
they are part of and, for example, MIB counters.
The VRF id of tasks defaults to 1 and is inherited parent to child. It can
be read via the file '/proc/<pid>/vrf' and can be changed anytime by writing
to this file (if preferred this can be made a prctl to change the VRF id).
This allows services to be launched in a VRF context using ip, similar to
what is done for network namespaces.
e.g., ip vrf exec 99 /usr/sbin/sshd
(or a simpler chvrf alias/command can be used to just write the VRF id
to the proc file.)
The task's VRF id also affects viewing and modifying network configuration.
For example, 'ip addr show', 'ip route ls', 'ifconfig', 'arp -n', etc, only
show network data for the VRF associated with the task's VRF id; devices
are at the L2 layer so a command listing devices is not impacted by VRF id.
When a socket is created the VRF id is taken from the task. Socket-vrf
association for non-connected sockets can be changed using a setsockopt
(e.g., create a socket then change VRF id prior to calling bind or connect).
Network devices belong to a single VRF context which defaults to VRF 1.
They can be assigned to another VRF using IFLA_VRF attribute in link
messages. Similarly the VRF assignment is returned in the IFLA_VRF
attribute. The ip command has been modified to display the VRF id of a
device. L2 applications like lldp are not VRF aware and still work through
through all network devices within the namespace.
On RX skbs get their VRF context from the netdevice the packet is received
on. For TX the VRF context for an skb is taken from the socket. The
intention is for L3/raw sockets to be able to set the VRF context for a
packet TX using cmsg (not coded in this patch set).
VRF aware apps (e.g., L3 VPNs) can have sockets in multiple VRFs for
forwarding packets.
The special 'ANY VRF' context allows a single instance of a daemon to
provide a service across all VRFs.
e.g., ip vrf exec any /usr/sbin/sshd
The 'any' context applies to listen sockets only; connected sockets are in
a VRF context. Child sockets accepted by the daemon acquire the VRF context
of the network device the connection originated on.
The 'ANY VRF' context can also be used to display all addresses, routes
or neighbors in the kernel cache. That is, 'ip addr show', 'ip route ls',
'ifconfig', 'arp -n', etc, show all network data for the namespace.
About this Patch Set
--------------------
This is not a complete conversion of the networking stack, only a small
sampling to test the waters. Only changes are to core IPv4 code [2] which
is sufficient to illustrate the fundamental concept. Changes from
struct net to net_ctx are very repetitive.
I'm sure there are a lot of oversights and bugs, but the intent here is
to solicit feedback on the overall idea.
Examples
--------
To illustrate the VRF patches consider a system with 18 NICs:
- eth0, eth17 are in default namespace (e.g., management namespace)
- eth1 - eth8 are in group1 namespace
- eth1 - eth4 are in VRF 11
- eth5 - eth8 are in VRF 13
- eth9 - eth16 are in group2 namespace
- eth9 - eth12 are in VRF 21
- eth13 - eth16 are in VRF 23
- Addresses assigned to each interface:
- eth1: 1.1.1.1/24
- eth2: 2.2.2.1/24
- eth3: 3.3.3.1/24
- eth4: 4.4.4.1/24
- eth5: 1.1.1.1/24 (not a typo, duplicate address in different vrfs)
- eth6: 6.6.6.1/24
- eth7: 7.7.7.1/24
- eth8: 8.8.8.1/24
- openlldpd is started in each namespace
1. device list is VRF agnostic
- ifconfig -a, ip link show, /proc/net/dev
--> default namespace shows only eth0 and eth17
--> group1 namespace shows only eth1 - eth8
--> group2 namespace shows only eth9 - eth16
- ip shows vrf assignment of each link
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 vrf 11 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether 02:ab:cd:02:00:01 brd ff:ff:ff:ff:ff:ff
2. address, route, neighbor list is VRF aware
- ifconfig, ip addr show, ip route ls, /proc/net/route
--> shows only addresses for VRF id of task unless id is 'any'
in VRF 1:
ifconfig eth1
eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether 02:ab:cd:02:00:01 txqueuelen 1000 (Ethernet)
...
No addresses are shown. But if the command is run in VRF 11 or VRF 'any'
ip vrf exec 11 ip addr show dev eth1
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 vrf 11 qdisc pfifo_fast state UP group default qlen 1000
link/ether 02:ab:cd:02:00:01 brd ff:ff:ff:ff:ff:ff
inet 1.1.1.1/24 brd 1.1.1.255 scope global eth1
valid_lft forever preferred_lft forever
3. start ssh in group1 namespace
ip netns exec group1 ip vrf exec 11 /usr/sbin/sshd -d
ssh to 1.1.1.1 via eth1
ip netns exec group1 ip vrf exec 13 /usr/sbin/sshd -d
ssh to 1.1.1.1 via eth5
--> same namespace but different VRFs
4. One ssh instance handles VRFs in group1 namespace
ip netns exec group1 ip vrf exec any /usr/sbin/sshd
--> ssh to any address in the namespace works
References
----------
[1] http://sourceforge.net/projects/linux-vrf
[2] http://www.spinics.net/lists/netdev/msg298368.html
[3] To build only enable core ipv4 code. Disable IPv6, netfilter, ipsec, etc.
David Ahern (29):
net: Introduce net_ctx and macro for context comparison
net: Flip net_device to use net_ctx
net: Flip sock_common to net_ctx
net: Add net_ctx macros for skbuffs
net: Flip seq_net_private to net_ctx
net: Flip fib_rules and fib_rules_ops to use net_ctx
net: Flip inet_bind_bucket to net_ctx
net: Flip fib_info to net_ctx
net: Flip ip6_flowlabel to net_ctx
net: Flip neigh structs to net_ctx
net: Flip nl_info to net_ctx
net: Add device lookups by net_ctx
net: Convert function arg from struct net to struct net_ctx
net: vrf: Introduce vrf header file
net: vrf: Add vrf to net_ctx struct
net: vrf: Set default vrf
net: vrf: Add vrf context to task struct
net: vrf: Plumbing for vrf context on a socket
net: vrf: Add vrf context to skb
net: vrf: Add vrf context to flow struct
net: vrf: Add vrf context to genid's
net: vrf: Set VRF id in various network structs
net: vrf: Enable vrf checks
net: vrf: Add support to get/set vrf context on a device
net: vrf: Handle VRF any context
net: vrf: Change single_open_net to pass net_ctx
net: vrf: Add vrf checks and context to ipv4 proc files
iproute2: vrf: Add vrf subcommand
iproute2: Add vrf option to ip link command
fs/proc/base.c | 94 +++++++++++++++++++++++++
fs/proc/proc_net.c | 22 +++++-
include/linux/inetdevice.h | 12 ++--
include/linux/init_task.h | 1 +
include/linux/netdevice.h | 44 +++++++++++-
include/linux/sched.h | 2 +
include/linux/seq_file_net.h | 10 +--
include/linux/skbuff.h | 5 ++
include/net/addrconf.h | 22 +++---
include/net/arp.h | 2 +-
include/net/dst.h | 16 ++---
include/net/fib_rules.h | 10 ++-
include/net/flow.h | 10 ++-
include/net/inet6_hashtables.h | 19 +++---
include/net/inet_hashtables.h | 60 ++++++++++------
include/net/inet_sock.h | 1 +
include/net/inet_timewait_sock.h | 1 +
include/net/ip.h | 10 +--
include/net/ip6_fib.h | 4 +-
include/net/ip6_route.h | 24 +++----
include/net/ip_fib.h | 38 +++++++----
include/net/ipv6.h | 14 +++-
include/net/neighbour.h | 93 +++++++++++++++++++++----
include/net/net_namespace.h | 39 +++++++++--
include/net/netlink.h | 5 +-
include/net/route.h | 46 +++++++------
include/net/sock.h | 21 ++++--
include/net/tcp.h | 1 +
include/net/transp_v6.h | 2 +-
include/net/udp.h | 8 +--
include/net/vrf.h | 36 ++++++++++
include/net/xfrm.h | 28 ++++----
include/uapi/linux/if_link.h | 1 +
include/uapi/linux/in.h | 1 +
kernel/fork.c | 2 +
net/core/dev.c | 95 +++++++++++++++++++++++---
net/core/fib_rules.c | 36 ++++++----
net/core/flow.c | 5 +-
net/core/neighbour.c | 106 +++++++++++++++--------------
net/core/rtnetlink.c | 12 ++++
net/core/skbuff.c | 12 ++++
net/core/sock.c | 2 +
net/ipv4/af_inet.c | 20 ++++--
net/ipv4/arp.c | 76 ++++++++++++---------
net/ipv4/datagram.c | 6 +-
net/ipv4/devinet.c | 64 ++++++++++++------
net/ipv4/fib_frontend.c | 83 ++++++++++++++---------
net/ipv4/fib_rules.c | 12 ++--
net/ipv4/fib_semantics.c | 38 +++++++----
net/ipv4/fib_trie.c | 24 +++++--
net/ipv4/icmp.c | 40 ++++++-----
net/ipv4/igmp.c | 53 +++++++++------
net/ipv4/inet_connection_sock.c | 23 ++++---
net/ipv4/inet_diag.c | 13 ++--
net/ipv4/inet_hashtables.c | 42 +++++++-----
net/ipv4/inet_timewait_sock.c | 1 +
net/ipv4/ip_input.c | 6 +-
net/ipv4/ip_options.c | 20 +++---
net/ipv4/ip_output.c | 16 +++--
net/ipv4/ip_sockglue.c | 32 +++++++--
net/ipv4/ipconfig.c | 6 +-
net/ipv4/ipmr.c | 53 +++++++++------
net/ipv4/netfilter.c | 13 ++--
net/ipv4/ping.c | 41 +++++------
net/ipv4/proc.c | 10 +--
net/ipv4/raw.c | 48 ++++++++-----
net/ipv4/route.c | 143 +++++++++++++++++++++++----------------
net/ipv4/syncookies.c | 6 +-
net/ipv4/tcp_ipv4.c | 57 +++++++++-------
net/ipv4/tcp_minisocks.c | 1 +
net/ipv4/udp.c | 122 ++++++++++++++++++---------------
net/ipv4/udp_diag.c | 11 +--
net/ipv4/xfrm4_policy.c | 14 ++--
net/netlink/af_netlink.c | 12 ++++
net/sctp/protocol.c | 10 +--
net/xfrm/xfrm_policy.c | 9 +--
76 files changed, 1415 insertions(+), 682 deletions(-)
create mode 100644 include/net/vrf.h
--
1.9.3 (Apple Git-50)
^ permalink raw reply
* [RFC PATCH 02/29] net: Flip net_device to use net_ctx
From: David Ahern @ 2015-02-05 1:34 UTC (permalink / raw)
To: netdev; +Cc: ebiederm, David Ahern
In-Reply-To: <1423100070-31848-1-git-send-email-dsahern@gmail.com>
Enhances a net_device from the current namespace only assignment to
a network context.
Define nd_net macro to handle existing code references. Add macros
for generating net_ctx struct given a net_device (needed because of
the way net references are done) and for comparing a given net_ctx
struct to the context of a net_device.
Signed-off-by: David Ahern <dsahern@gmail.com>
---
include/linux/netdevice.h | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 16251e96e6aa..55a221fec12b 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1697,9 +1697,8 @@ struct net_device {
struct netpoll_info __rcu *npinfo;
#endif
-#ifdef CONFIG_NET_NS
- struct net *nd_net;
-#endif
+ struct net_ctx net_ctx;
+#define nd_net net_ctx.net
/* mid-layer private */
union {
@@ -1845,6 +1844,18 @@ void dev_net_set(struct net_device *dev, struct net *net)
#endif
}
+/* get net_ctx from device */
+#define DEV_NET_CTX(dev) { .net = dev_net((dev)) }
+
+static inline
+int dev_net_ctx_eq(const struct net_device *dev, struct net_ctx *ctx)
+{
+ if (net_eq(dev_net(dev), ctx->net))
+ return 1;
+
+ return 0;
+}
+
static inline bool netdev_uses_dsa(struct net_device *dev)
{
#if IS_ENABLED(CONFIG_NET_DSA)
--
1.9.3 (Apple Git-50)
^ permalink raw reply related
* [RFC PATCH 03/29] net: Flip sock_common to net_ctx
From: David Ahern @ 2015-02-05 1:34 UTC (permalink / raw)
To: netdev; +Cc: ebiederm, David Ahern
In-Reply-To: <1423100070-31848-1-git-send-email-dsahern@gmail.com>
Enhances sockets from the current namespace only assignment to a
network context.
Define skc_net macro to handle existing code references.
Add macros for retrieving net_ctx struct given a sock struct (needed
because of the way net references are done) and for comparing a
given net_ctx struct to the context of a sock struct.
Signed-off-by: David Ahern <dsahern@gmail.com>
---
include/net/sock.h | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/include/net/sock.h b/include/net/sock.h
index 511ef7c8889b..e67347ed1555 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -146,7 +146,7 @@ typedef __u64 __bitwise __addrpair;
* @skc_bind_node: bind hash linkage for various protocol lookup tables
* @skc_portaddr_node: second hash linkage for UDP/UDP-Lite protocol
* @skc_prot: protocol handlers inside a network family
- * @skc_net: reference to the network namespace of this socket
+ * @skc_net_ctx: reference to network context of this socket
* @skc_node: main hash linkage for various protocol lookup tables
* @skc_nulls_node: main hash linkage for TCP/UDP/UDP-Lite protocol
* @skc_tx_queue_mapping: tx queue number for this connection
@@ -190,9 +190,8 @@ struct sock_common {
struct hlist_nulls_node skc_portaddr_node;
};
struct proto *skc_prot;
-#ifdef CONFIG_NET_NS
- struct net *skc_net;
-#endif
+ struct net_ctx skc_net_ctx;
+#define skc_net skc_net_ctx.net
#if IS_ENABLED(CONFIG_IPV6)
struct in6_addr skc_v6_daddr;
@@ -326,7 +325,7 @@ struct sock {
#define sk_bound_dev_if __sk_common.skc_bound_dev_if
#define sk_bind_node __sk_common.skc_bind_node
#define sk_prot __sk_common.skc_prot
-#define sk_net __sk_common.skc_net
+#define sk_net __sk_common.skc_net_ctx.net
#define sk_v6_daddr __sk_common.skc_v6_daddr
#define sk_v6_rcv_saddr __sk_common.skc_v6_rcv_saddr
@@ -2197,6 +2196,14 @@ void sock_net_set(struct sock *sk, struct net *net)
write_pnet(&sk->sk_net, net);
}
+#define SOCK_NET_CTX(sk) { .net = sock_net((sk)) }
+
+static inline
+int sock_net_ctx_eq(struct sock *sk, struct net_ctx *ctx)
+{
+ return net_eq(sock_net(sk), ctx->net);
+}
+
/*
* Kernel sockets, f.e. rtnl or icmp_socket, are a part of a namespace.
* They should not hold a reference to a namespace in order to allow
--
1.9.3 (Apple Git-50)
^ permalink raw reply related
* [RFC PATCH 04/29] net: Add net_ctx macros for skbuffs
From: David Ahern @ 2015-02-05 1:34 UTC (permalink / raw)
To: netdev; +Cc: ebiederm, David Ahern
In-Reply-To: <1423100070-31848-1-git-send-email-dsahern@gmail.com>
skb macros will be used later for determining a network context
from skbs.
Signed-off-by: David Ahern <dsahern@gmail.com>
---
include/linux/skbuff.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 85ab7d72b54c..a5dfef469d07 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -665,6 +665,10 @@ struct sk_buff {
atomic_t users;
};
+#define SKB_NET_CTX_DEV(skb) { .net = dev_net((skb)->dev) }
+#define SKB_NET_CTX_DST(skb) { .net = dev_net(skb_dst((skb))->dev) }
+#define SKB_NET_CTX_SOCK(skb) { .net = sock_net((skb)->sk) }
+
#ifdef __KERNEL__
/*
* Handling routines are only of interest to the kernel
--
1.9.3 (Apple Git-50)
^ permalink raw reply related
* [RFC PATCH 05/29] net: Flip seq_net_private to net_ctx
From: David Ahern @ 2015-02-05 1:34 UTC (permalink / raw)
To: netdev; +Cc: ebiederm, David Ahern
In-Reply-To: <1423100070-31848-1-git-send-email-dsahern@gmail.com>
Enhances seq files for networking to have a network context from the
current namespace only.
Signed-off-by: David Ahern <dsahern@gmail.com>
---
fs/proc/proc_net.c | 2 +-
include/linux/seq_file_net.h | 10 ++++++----
2 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
index 1bde894bc624..4996f5e91a90 100644
--- a/fs/proc/proc_net.c
+++ b/fs/proc/proc_net.c
@@ -54,7 +54,7 @@ int seq_open_net(struct inode *ino, struct file *f,
return -ENOMEM;
}
#ifdef CONFIG_NET_NS
- p->net = net;
+ p->net_ctx.net = net;
#endif
return 0;
}
diff --git a/include/linux/seq_file_net.h b/include/linux/seq_file_net.h
index 32c89bbe24a2..b860d053a65e 100644
--- a/include/linux/seq_file_net.h
+++ b/include/linux/seq_file_net.h
@@ -7,9 +7,7 @@ struct net;
extern struct net init_net;
struct seq_net_private {
-#ifdef CONFIG_NET_NS
- struct net *net;
-#endif
+ struct net_ctx net_ctx;
};
int seq_open_net(struct inode *, struct file *,
@@ -21,10 +19,14 @@ int single_release_net(struct inode *, struct file *);
static inline struct net *seq_file_net(struct seq_file *seq)
{
#ifdef CONFIG_NET_NS
- return ((struct seq_net_private *)seq->private)->net;
+ return ((struct seq_net_private *)seq->private)->net_ctx.net;
#else
return &init_net;
#endif
}
+static inline struct net_ctx *seq_file_net_ctx(struct seq_file *seq)
+{
+ return &((struct seq_net_private *)seq->private)->net_ctx;
+}
#endif
--
1.9.3 (Apple Git-50)
^ permalink raw reply related
* [RFC PATCH 06/29] net: Flip fib_rules and fib_rules_ops to use net_ctx
From: David Ahern @ 2015-02-05 1:34 UTC (permalink / raw)
To: netdev; +Cc: ebiederm, David Ahern
In-Reply-To: <1423100070-31848-1-git-send-email-dsahern@gmail.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
---
include/net/fib_rules.h | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index e584de16e4c3..b02bd45e3e97 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -20,7 +20,8 @@ struct fib_rule {
/* 3 bytes hole, try to use */
u32 target;
struct fib_rule __rcu *ctarget;
- struct net *fr_net;
+ struct net_ctx fr_net_ctx;
+#define fr_net fr_net_ctx.net
atomic_t refcnt;
u32 pref;
@@ -75,7 +76,8 @@ struct fib_rules_ops {
const struct nla_policy *policy;
struct list_head rules_list;
struct module *owner;
- struct net *fro_net;
+ struct net_ctx fro_net_ctx;
+#define fro_net fro_net_ctx.net
struct rcu_head rcu;
};
--
1.9.3 (Apple Git-50)
^ permalink raw reply related
* [RFC PATCH 07/29] net: Flip inet_bind_bucket to net_ctx
From: David Ahern @ 2015-02-05 1:34 UTC (permalink / raw)
To: netdev; +Cc: ebiederm, David Ahern
In-Reply-To: <1423100070-31848-1-git-send-email-dsahern@gmail.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
---
include/net/inet_hashtables.h | 21 +++++++++++++++++----
net/ipv4/inet_hashtables.c | 2 +-
2 files changed, 18 insertions(+), 5 deletions(-)
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index dd1950a7e273..c9e8b7b7331a 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -76,9 +76,7 @@ struct inet_ehash_bucket {
* ports are created in O(1) time? I thought so. ;-) -DaveM
*/
struct inet_bind_bucket {
-#ifdef CONFIG_NET_NS
- struct net *ib_net;
-#endif
+ struct net_ctx ib_net_ctx;
unsigned short port;
signed char fastreuse;
signed char fastreuseport;
@@ -90,7 +88,22 @@ struct inet_bind_bucket {
static inline struct net *ib_net(struct inet_bind_bucket *ib)
{
- return read_pnet(&ib->ib_net);
+ return read_pnet(&ib->ib_net_ctx.net);
+}
+
+static inline
+void ib_net_ctx_set(struct inet_bind_bucket *ib, struct net_ctx *ctx)
+{
+ write_pnet(&ib->ib_net_ctx.net, hold_net(ctx->net));
+}
+
+static inline
+int ib_net_ctx_eq(struct inet_bind_bucket *ib, struct net_ctx *ctx)
+{
+ if (net_eq(ib_net(ib), ctx->net))
+ return 1;
+
+ return 0;
}
#define inet_bind_bucket_for_each(tb, head) \
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 9111a4e22155..1485dac0ead5 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -61,7 +61,7 @@ struct inet_bind_bucket *inet_bind_bucket_create(struct kmem_cache *cachep,
struct inet_bind_bucket *tb = kmem_cache_alloc(cachep, GFP_ATOMIC);
if (tb != NULL) {
- write_pnet(&tb->ib_net, hold_net(net));
+ write_pnet(&tb->ib_net_ctx.net, hold_net(net));
tb->port = snum;
tb->fastreuse = 0;
tb->fastreuseport = 0;
--
1.9.3 (Apple Git-50)
^ permalink raw reply related
* [RFC PATCH 08/29] net: Flip fib_info to net_ctx
From: David Ahern @ 2015-02-05 1:34 UTC (permalink / raw)
To: netdev; +Cc: ebiederm, David Ahern
In-Reply-To: <1423100070-31848-1-git-send-email-dsahern@gmail.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
---
include/net/ip_fib.h | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 5bd120e4bc0a..dca7f30be57f 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -98,7 +98,8 @@ struct fib_nh {
struct fib_info {
struct hlist_node fib_hash;
struct hlist_node fib_lhash;
- struct net *fib_net;
+ struct net_ctx fib_net_ctx;
+#define fib_net fib_net_ctx.net
int fib_treeref;
atomic_t fib_clntref;
unsigned int fib_flags;
@@ -122,6 +123,14 @@ struct fib_info {
#define fib_dev fib_nh[0].nh_dev
};
+static inline
+int fib_net_ctx_eq(const struct fib_info *fi, const struct net_ctx *ctx)
+{
+ if (net_eq(fi->fib_net_ctx.net, ctx->net))
+ return 1;
+
+ return 0;
+}
#ifdef CONFIG_IP_MULTIPLE_TABLES
struct fib_rule;
--
1.9.3 (Apple Git-50)
^ permalink raw reply related
* [RFC PATCH 09/29] net: Flip ip6_flowlabel to net_ctx
From: David Ahern @ 2015-02-05 1:34 UTC (permalink / raw)
To: netdev; +Cc: ebiederm, David Ahern
In-Reply-To: <1423100070-31848-1-git-send-email-dsahern@gmail.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
---
include/net/ipv6.h | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 8027ca53e31f..2d025ed7a183 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -238,9 +238,20 @@ struct ip6_flowlabel {
} owner;
unsigned long lastuse;
unsigned long expires;
- struct net *fl_net;
+ struct net_ctx fl_net_ctx;
+#define fl_net fl_net_ctx.net
};
+static inline
+int fl_net_ctx_eq(struct ip6_flowlabel *fl, struct net_ctx *ctx)
+{
+#ifdef CONFIG_NET_NS
+ return net_eq(fl->fl_net, ctx->net);
+#else
+ return 1;
+#endif
+}
+
#define IPV6_FLOWINFO_MASK cpu_to_be32(0x0FFFFFFF)
#define IPV6_FLOWLABEL_MASK cpu_to_be32(0x000FFFFF)
#define IPV6_TCLASS_MASK (IPV6_FLOWINFO_MASK & ~IPV6_FLOWLABEL_MASK)
--
1.9.3 (Apple Git-50)
^ permalink raw reply related
* [RFC PATCH 11/29] net: Flip nl_info to net_ctx
From: David Ahern @ 2015-02-05 1:34 UTC (permalink / raw)
To: netdev; +Cc: ebiederm, David Ahern
In-Reply-To: <1423100070-31848-1-git-send-email-dsahern@gmail.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
---
include/net/netlink.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/include/net/netlink.h b/include/net/netlink.h
index e010ee8da41d..587a6ef973e5 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -4,6 +4,7 @@
#include <linux/types.h>
#include <linux/netlink.h>
#include <linux/jiffies.h>
+#include <net/net_namespace.h>
/* ========================================================================
* Netlink Messages and Attributes Interface (As Seen On TV)
@@ -221,7 +222,8 @@ struct nla_policy {
*/
struct nl_info {
struct nlmsghdr *nlh;
- struct net *nl_net;
+ struct net_ctx nl_net_ctx;
+#define nl_net nl_net_ctx.net
u32 portid;
};
--
1.9.3 (Apple Git-50)
^ permalink raw reply related
* [RFC PATCH 10/29] net: Flip neigh structs to net_ctx
From: David Ahern @ 2015-02-05 1:34 UTC (permalink / raw)
To: netdev; +Cc: ebiederm, David Ahern
In-Reply-To: <1423100070-31848-1-git-send-email-dsahern@gmail.com>
Signed-off-by: David Ahern <dsahern@gmail.com>
---
include/net/neighbour.h | 44 ++++++++++++++++++++++++++++++++++++--------
net/core/neighbour.c | 6 +++---
2 files changed, 39 insertions(+), 11 deletions(-)
diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 76f708486aae..6228edd1e483 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -65,9 +65,7 @@ enum {
};
struct neigh_parms {
-#ifdef CONFIG_NET_NS
- struct net *net;
-#endif
+ struct net_ctx net_ctx;
struct net_device *dev;
struct list_head list;
int (*neigh_setup)(struct neighbour *);
@@ -167,9 +165,7 @@ struct neigh_ops {
struct pneigh_entry {
struct pneigh_entry *next;
-#ifdef CONFIG_NET_NS
- struct net *net;
-#endif
+ struct net_ctx net_ctx;
struct net_device *dev;
u8 flags;
u8 key[0];
@@ -281,9 +277,22 @@ void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms);
static inline
struct net *neigh_parms_net(const struct neigh_parms *parms)
{
- return read_pnet(&parms->net);
+ return read_pnet(&parms->net_ctx.net);
}
+static inline
+int neigh_parms_net_ctx_eq(const struct neigh_parms *parms,
+ const struct net_ctx *net_ctx)
+{
+#ifdef CONFIG_NET_NS
+ if (net_eq(neigh_parms_net(parms), net_ctx->net))
+ return 1;
+
+ return 0;
+#else
+ return 1;
+#endif
+}
unsigned long neigh_rand_reach_time(unsigned long base);
void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
@@ -298,7 +307,26 @@ int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *key,
static inline struct net *pneigh_net(const struct pneigh_entry *pneigh)
{
- return read_pnet(&pneigh->net);
+ return read_pnet(&pneigh->net_ctx.net);
+}
+static inline
+void pneigh_net_ctx_set(struct pneigh_entry *pneigh,
+ const struct net_ctx *net_ctx)
+{
+ write_pnet(&pneigh->net_ctx.net, hold_net(net_ctx->net));
+}
+static inline
+int pneigh_net_ctx_eq(const struct pneigh_entry *pneigh,
+ const struct net_ctx *net_ctx)
+{
+#ifdef CONFIG_NET_NS
+ if (net_eq(pneigh_net(pneigh), net_ctx->net))
+ return 1;
+
+ return 0;
+#else
+ return 1;
+#endif
}
void neigh_app_ns(struct neighbour *n);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 70fe9e10ac86..bd77804849cc 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -601,7 +601,7 @@ struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
if (!n)
goto out;
- write_pnet(&n->net, hold_net(net));
+ write_pnet(&n->net_ctx.net, hold_net(net));
memcpy(n->key, pkey, key_len);
n->dev = dev;
if (dev)
@@ -1464,7 +1464,7 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
dev_hold(dev);
p->dev = dev;
- write_pnet(&p->net, hold_net(net));
+ write_pnet(&p->net_ctx.net, hold_net(net));
p->sysctl_table = NULL;
if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
@@ -1523,7 +1523,7 @@ void neigh_table_init(int index, struct neigh_table *tbl)
INIT_LIST_HEAD(&tbl->parms_list);
list_add(&tbl->parms.list, &tbl->parms_list);
- write_pnet(&tbl->parms.net, &init_net);
+ write_pnet(&tbl->parms.net_ctx.net, &init_net);
atomic_set(&tbl->parms.refcnt, 1);
tbl->parms.reachable_time =
neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
--
1.9.3 (Apple Git-50)
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox