2 * Copyright (c) 2009, 2010, 2011, 2012, 2013 Nicira, Inc.
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at:
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
18 #define CLASSIFIER_H 1
26 * A flow classifier holds any number of "rules", each of which specifies
27 * values to match for some fields or subfields and a priority. Each OpenFlow
28 * table is implemented as a flow classifier.
30 * The classifier has two primary design goals. The first is obvious: given a
31 * set of packet headers, as quickly as possible find the highest-priority rule
32 * that matches those headers. The following section describes the second
39 * A primary goal of the flow classifier is to produce, as a side effect of a
40 * packet lookup, a wildcard mask that indicates which bits of the packet
41 * headers were essential to the classification result. Ideally, a 1-bit in
42 * any position of this mask means that, if the corresponding bit in the packet
43 * header were flipped, then the classification result might change. A 0-bit
44 * means that changing the packet header bit would have no effect. Thus, the
45 * wildcarded bits are the ones that played no role in the classification
48 * Such a wildcard mask is useful with datapaths that support installing flows
49 * that wildcard fields or subfields. If an OpenFlow lookup for a TCP flow
50 * does not actually look at the TCP source or destination ports, for example,
51 * then the switch may install into the datapath a flow that wildcards the port
52 * numbers, which in turn allows the datapath to handle packets that arrive for
53 * other TCP source or destination ports without additional help from
54 * ovs-vswitchd. This is useful for the Open vSwitch software and,
55 * potentially, for ASIC-based switches as well.
57 * Some properties of the wildcard mask:
59 * - "False 1-bits" are acceptable, that is, setting a bit in the wildcard
60 * mask to 1 will never cause a packet to be forwarded the wrong way.
61 * As a corollary, a wildcard mask composed of all 1-bits will always
62 * yield correct (but often needlessly inefficient) behavior.
64 * - "False 0-bits" can cause problems, so they must be avoided. In the
65 * extreme case, a mask of all 0-bits is only correct if the classifier
66 * contains only a single flow that matches all packets.
68 * - 0-bits are desirable because they allow the datapath to act more
69 * autonomously, relying less on ovs-vswitchd to process flow setups,
70 * thereby improving performance.
72 * - We don't know a good way to generate wildcard masks with the maximum
73 * (correct) number of 0-bits. We use various approximations, described
76 * - Wildcard masks for lookups in a given classifier yield a
77 * non-overlapping set of rules. More specifically:
79 * Consider an classifier C1 filled with an arbitrary collection of rules
80 * and an empty classifier C2. Now take a set of packet headers H and
81 * look it up in C1, yielding a highest-priority matching rule R1 and
82 * wildcard mask M. Form a new classifier rule R2 out of packet headers
83 * H and mask M, and add R2 to C2 with a fixed priority. If one were to
84 * do this for every possible set of packet headers H, then this
85 * process would not attempt to add any overlapping rules to C2, that is,
86 * any packet lookup using the rules generated by this process matches at
87 * most one rule in C2.
89 * During the lookup process, the classifier starts out with a wildcard mask
90 * that is all 0-bits, that is, fully wildcarded. As lookup proceeds, each
91 * step tends to add constraints to the wildcard mask, that is, change
92 * wildcarded 0-bits into exact-match 1-bits. We call this "un-wildcarding".
93 * A lookup step that examines a particular field must un-wildcard that field.
94 * In general, un-wildcarding is necessary for correctness but undesirable for
98 * Basic Classifier Design
99 * =======================
101 * Suppose that all the rules in a classifier had the same form. For example,
102 * suppose that they all matched on the source and destination Ethernet address
103 * and wildcarded all the other fields. Then the obvious way to implement a
104 * classifier would be a hash table on the source and destination Ethernet
105 * addresses. If new classification rules came along with a different form,
106 * you could add a second hash table that hashed on the fields matched in those
107 * rules. With two hash tables, you look up a given flow in each hash table.
108 * If there are no matches, the classifier didn't contain a match; if you find
109 * a match in one of them, that's the result; if you find a match in both of
110 * them, then the result is the rule with the higher priority.
112 * This is how the classifier works. In a "struct classifier", each form of
113 * "struct cls_rule" present (based on its ->match.mask) goes into a separate
114 * "struct cls_subtable". A lookup does a hash lookup in every "struct
115 * cls_subtable" in the classifier and tracks the highest-priority match that
116 * it finds. The subtables are kept in a descending priority order according
117 * to the highest priority rule in each subtable, which allows lookup to skip
118 * over subtables that can't possibly have a higher-priority match than already
119 * found. Eliminating lookups through priority ordering aids both classifier
120 * primary design goals: skipping lookups saves time and avoids un-wildcarding
121 * fields that those lookups would have examined.
123 * One detail: a classifier can contain multiple rules that are identical other
124 * than their priority. When this happens, only the highest priority rule out
125 * of a group of otherwise identical rules is stored directly in the "struct
126 * cls_subtable", with the other almost-identical rules chained off a linked
127 * list inside that highest-priority rule.
130 * Staged Lookup (Wildcard Optimization)
131 * =====================================
133 * Subtable lookup is performed in ranges defined for struct flow, starting
134 * from metadata (registers, in_port, etc.), then L2 header, L3, and finally
135 * L4 ports. Whenever it is found that there are no matches in the current
136 * subtable, the rest of the subtable can be skipped.
138 * Staged lookup does not reduce lookup time, and it may increase it, because
139 * it changes a single hash table lookup into multiple hash table lookups.
140 * It reduces un-wildcarding significantly in important use cases.
143 * Prefix Tracking (Wildcard Optimization)
144 * =======================================
146 * Classifier uses prefix trees ("tries") for tracking the used
147 * address space, enabling skipping classifier tables containing
148 * longer masks than necessary for the given address. This reduces
149 * un-wildcarding for datapath flows in parts of the address space
150 * without host routes, but consulting extra data structures (the
151 * tries) may slightly increase lookup time.
153 * Trie lookup is interwoven with staged lookup, so that a trie is
154 * searched only when the configured trie field becomes relevant for
155 * the lookup. The trie lookup results are retained so that each trie
156 * is checked at most once for each classifier lookup.
158 * This implementation tracks the number of rules at each address
159 * prefix for the whole classifier. More aggressive table skipping
160 * would be possible by maintaining lists of tables that have prefixes
161 * at the lengths encountered on tree traversal, or by maintaining
162 * separate tries for subsets of rules separated by metadata fields.
164 * Prefix tracking is configured via OVSDB "Flow_Table" table,
165 * "fieldspec" column. "fieldspec" is a string map where a "prefix"
166 * key tells which fields should be used for prefix tracking. The
167 * value of the "prefix" key is a comma separated list of field names.
169 * There is a maximum number of fields that can be enabled for any one
170 * flow table. Currently this limit is 3.
173 * Partitioning (Lookup Time and Wildcard Optimization)
174 * ====================================================
176 * Suppose that a given classifier is being used to handle multiple stages in a
177 * pipeline using "resubmit", with metadata (that is, the OpenFlow 1.1+ field
178 * named "metadata") distinguishing between the different stages. For example,
179 * metadata value 1 might identify ingress rules, metadata value 2 might
180 * identify ACLs, and metadata value 3 might identify egress rules. Such a
181 * classifier is essentially partitioned into multiple sub-classifiers on the
182 * basis of the metadata value.
184 * The classifier has a special optimization to speed up matching in this
187 * - Each cls_subtable that matches on metadata gets a tag derived from the
188 * subtable's mask, so that it is likely that each subtable has a unique
189 * tag. (Duplicate tags have a performance cost but do not affect
192 * - For each metadata value matched by any cls_rule, the classifier
193 * constructs a "struct cls_partition" indexed by the metadata value.
194 * The cls_partition has a 'tags' member whose value is the bitwise-OR of
195 * the tags of each cls_subtable that contains any rule that matches on
196 * the cls_partition's metadata value. In other words, struct
197 * cls_partition associates metadata values with subtables that need to
198 * be checked with flows with that specific metadata value.
200 * Thus, a flow lookup can start by looking up the partition associated with
201 * the flow's metadata, and then skip over any cls_subtable whose 'tag' does
202 * not intersect the partition's 'tags'. (The flow must also be looked up in
203 * any cls_subtable that doesn't match on metadata. We handle that by giving
204 * any such cls_subtable TAG_ALL as its 'tags' so that it matches any tag.)
206 * Partitioning saves lookup time by reducing the number of subtable lookups.
207 * Each eliminated subtable lookup also reduces the amount of un-wildcarding.
213 * The classifier may safely be accessed by many reader threads concurrently or
214 * by a single writer. */
216 #include "fat-rwlock.h"
222 #include "meta-flow.h"
224 #include "openflow/nicira-ext.h"
225 #include "openflow/openflow.h"
226 #include "ovs-thread.h"
233 /* Needed only for the lock annotation in struct classifier. */
234 extern struct ovs_mutex ofproto_mutex;
236 /* Classifier internal data structures. */
237 struct cls_classifier;
239 struct cls_partition;
243 CLS_MAX_TRIES = 3 /* Maximum number of prefix trees per classifier. */
246 /* A flow classifier. */
248 struct fat_rwlock rwlock OVS_ACQ_AFTER(ofproto_mutex);
249 struct cls_classifier *cls;
252 /* A rule to be inserted to the classifier. */
254 struct minimatch match; /* Matching rule. */
255 unsigned int priority; /* Larger numbers are higher priorities. */
256 struct cls_match *cls_match; /* NULL if rule is not in a classifier. */
259 void cls_rule_init(struct cls_rule *, const struct match *,
260 unsigned int priority);
261 void cls_rule_init_from_minimatch(struct cls_rule *, const struct minimatch *,
262 unsigned int priority);
263 void cls_rule_clone(struct cls_rule *, const struct cls_rule *);
264 void cls_rule_move(struct cls_rule *dst, struct cls_rule *src);
265 void cls_rule_destroy(struct cls_rule *);
267 bool cls_rule_equal(const struct cls_rule *, const struct cls_rule *);
268 uint32_t cls_rule_hash(const struct cls_rule *, uint32_t basis);
270 void cls_rule_format(const struct cls_rule *, struct ds *);
272 bool cls_rule_is_catchall(const struct cls_rule *);
274 bool cls_rule_is_loose_match(const struct cls_rule *rule,
275 const struct minimatch *criteria);
277 void classifier_init(struct classifier *cls, const uint8_t *flow_segments);
278 void classifier_destroy(struct classifier *);
279 void classifier_set_prefix_fields(struct classifier *cls,
280 const enum mf_field_id *trie_fields,
281 unsigned int n_trie_fields)
282 OVS_REQ_WRLOCK(cls->rwlock);
284 bool classifier_is_empty(const struct classifier *cls)
285 OVS_REQ_RDLOCK(cls->rwlock);
286 int classifier_count(const struct classifier *cls)
287 OVS_REQ_RDLOCK(cls->rwlock);
288 void classifier_insert(struct classifier *cls, struct cls_rule *)
289 OVS_REQ_WRLOCK(cls->rwlock);
290 struct cls_rule *classifier_replace(struct classifier *cls, struct cls_rule *)
291 OVS_REQ_WRLOCK(cls->rwlock);
292 void classifier_remove(struct classifier *cls, struct cls_rule *)
293 OVS_REQ_WRLOCK(cls->rwlock);
294 struct cls_rule *classifier_lookup(const struct classifier *cls,
296 struct flow_wildcards *)
297 OVS_REQ_RDLOCK(cls->rwlock);
298 struct cls_rule *classifier_lookup_miniflow_first(const struct classifier *cls,
299 const struct miniflow *)
300 OVS_REQ_RDLOCK(cls->rwlock);
301 bool classifier_rule_overlaps(const struct classifier *cls,
302 const struct cls_rule *)
303 OVS_REQ_RDLOCK(cls->rwlock);
305 typedef void cls_cb_func(struct cls_rule *, void *aux);
307 struct cls_rule *classifier_find_rule_exactly(const struct classifier *cls,
308 const struct cls_rule *)
309 OVS_REQ_RDLOCK(cls->rwlock);
310 struct cls_rule *classifier_find_match_exactly(const struct classifier *cls,
311 const struct match *,
312 unsigned int priority)
313 OVS_REQ_RDLOCK(cls->rwlock);
318 const struct cls_classifier *cls;
319 const struct cls_subtable *subtable;
320 const struct cls_rule *target;
323 void cls_cursor_init(struct cls_cursor *cursor, const struct classifier *cls,
324 const struct cls_rule *match) OVS_REQ_RDLOCK(cls->rwlock);
325 struct cls_rule *cls_cursor_first(struct cls_cursor *cursor);
326 struct cls_rule *cls_cursor_next(struct cls_cursor *, const struct cls_rule *);
328 #define CLS_CURSOR_FOR_EACH(RULE, MEMBER, CURSOR) \
329 for (ASSIGN_CONTAINER(RULE, cls_cursor_first(CURSOR), MEMBER); \
330 RULE != OBJECT_CONTAINING(NULL, RULE, MEMBER); \
331 ASSIGN_CONTAINER(RULE, cls_cursor_next(CURSOR, &(RULE)->MEMBER), \
334 #define CLS_CURSOR_FOR_EACH_SAFE(RULE, NEXT, MEMBER, CURSOR) \
335 for (ASSIGN_CONTAINER(RULE, cls_cursor_first(CURSOR), MEMBER); \
336 (RULE != OBJECT_CONTAINING(NULL, RULE, MEMBER) \
337 ? ASSIGN_CONTAINER(NEXT, cls_cursor_next(CURSOR, &(RULE)->MEMBER), \
346 #endif /* classifier.h */