X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=lib%2Fclassifier.h;h=048aaa148ba1e6d89e94421db5cfcee572aa6869;hb=cabd4c43854275943792a8b1bb4c7b719e210259;hp=8e3bf612fb0a5b8fd49cd431f7c01e773dc6552d;hpb=f4faf4baf7a22316d5a083af57557a97f9c93775;p=sliver-openvswitch.git diff --git a/lib/classifier.h b/lib/classifier.h index 8e3bf612f..048aaa148 100644 --- a/lib/classifier.h +++ b/lib/classifier.h @@ -24,15 +24,79 @@ * ===== * * A flow classifier holds any number of "rules", each of which specifies - * values to match for some fields or subfields and a priority. The primary - * design goal for the classifier is that, given a packet, it can as quickly as - * possible find the highest-priority rule that matches the packet. + * values to match for some fields or subfields and a priority. Each OpenFlow + * table is implemented as a flow classifier. * - * Each OpenFlow table is implemented as a flow classifier. + * The classifier has two primary design goals. The first is obvious: given a + * set of packet headers, as quickly as possible find the highest-priority rule + * that matches those headers. The following section describes the second + * goal. * * - * Basic Design - * ============ + * "Un-wildcarding" + * ================ + * + * A primary goal of the flow classifier is to produce, as a side effect of a + * packet lookup, a wildcard mask that indicates which bits of the packet + * headers were essential to the classification result. Ideally, a 1-bit in + * any position of this mask means that, if the corresponding bit in the packet + * header were flipped, then the classification result might change. A 0-bit + * means that changing the packet header bit would have no effect. Thus, the + * wildcarded bits are the ones that played no role in the classification + * decision. + * + * Such a wildcard mask is useful with datapaths that support installing flows + * that wildcard fields or subfields. If an OpenFlow lookup for a TCP flow + * does not actually look at the TCP source or destination ports, for example, + * then the switch may install into the datapath a flow that wildcards the port + * numbers, which in turn allows the datapath to handle packets that arrive for + * other TCP source or destination ports without additional help from + * ovs-vswitchd. This is useful for the Open vSwitch software and, + * potentially, for ASIC-based switches as well. + * + * Some properties of the wildcard mask: + * + * - "False 1-bits" are acceptable, that is, setting a bit in the wildcard + * mask to 1 will never cause a packet to be forwarded the wrong way. + * As a corollary, a wildcard mask composed of all 1-bits will always + * yield correct (but often needlessly inefficient) behavior. + * + * - "False 0-bits" can cause problems, so they must be avoided. In the + * extreme case, a mask of all 0-bits is only correct if the classifier + * contains only a single flow that matches all packets. + * + * - 0-bits are desirable because they allow the datapath to act more + * autonomously, relying less on ovs-vswitchd to process flow setups, + * thereby improving performance. + * + * - We don't know a good way to generate wildcard masks with the maximum + * (correct) number of 0-bits. We use various approximations, described + * in later sections. + * + * - Wildcard masks for lookups in a given classifier yield a + * non-overlapping set of rules. More specifically: + * + * Consider an classifier C1 filled with an arbitrary collection of rules + * and an empty classifier C2. Now take a set of packet headers H and + * look it up in C1, yielding a highest-priority matching rule R1 and + * wildcard mask M. Form a new classifier rule R2 out of packet headers + * H and mask M, and add R2 to C2 with a fixed priority. If one were to + * do this for every possible set of packet headers H, then this + * process would not attempt to add any overlapping rules to C2, that is, + * any packet lookup using the rules generated by this process matches at + * most one rule in C2. + * + * During the lookup process, the classifier starts out with a wildcard mask + * that is all 0-bits, that is, fully wildcarded. As lookup proceeds, each + * step tends to add constraints to the wildcard mask, that is, change + * wildcarded 0-bits into exact-match 1-bits. We call this "un-wildcarding". + * A lookup step that examines a particular field must un-wildcard that field. + * In general, un-wildcarding is necessary for correctness but undesirable for + * performance. + * + * + * Basic Classifier Design + * ======================= * * Suppose that all the rules in a classifier had the same form. For example, * suppose that they all matched on the source and destination Ethernet address @@ -47,21 +111,67 @@ * * This is how the classifier works. In a "struct classifier", each form of * "struct cls_rule" present (based on its ->match.mask) goes into a separate - * "struct cls_table". A lookup does a hash lookup in every "struct cls_table" - * in the classifier and tracks the highest-priority match that it finds. The - * tables are kept in a descending priority order according to the highest - * priority rule in each table, which allows lookup to skip over tables that - * can't possibly have a higher-priority match than already found. + * "struct cls_subtable". A lookup does a hash lookup in every "struct + * cls_subtable" in the classifier and tracks the highest-priority match that + * it finds. The subtables are kept in a descending priority order according + * to the highest priority rule in each subtable, which allows lookup to skip + * over subtables that can't possibly have a higher-priority match than already + * found. Eliminating lookups through priority ordering aids both classifier + * primary design goals: skipping lookups saves time and avoids un-wildcarding + * fields that those lookups would have examined. * * One detail: a classifier can contain multiple rules that are identical other * than their priority. When this happens, only the highest priority rule out * of a group of otherwise identical rules is stored directly in the "struct - * cls_table", with the other almost-identical rules chained off a linked list - * inside that highest-priority rule. + * cls_subtable", with the other almost-identical rules chained off a linked + * list inside that highest-priority rule. + * + * + * Staged Lookup (Wildcard Optimization) + * ===================================== + * + * Subtable lookup is performed in ranges defined for struct flow, starting + * from metadata (registers, in_port, etc.), then L2 header, L3, and finally + * L4 ports. Whenever it is found that there are no matches in the current + * subtable, the rest of the subtable can be skipped. + * + * Staged lookup does not reduce lookup time, and it may increase it, because + * it changes a single hash table lookup into multiple hash table lookups. + * It reduces un-wildcarding significantly in important use cases. * * - * Partitioning - * ============ + * Prefix Tracking (Wildcard Optimization) + * ======================================= + * + * Classifier uses prefix trees ("tries") for tracking the used + * address space, enabling skipping classifier tables containing + * longer masks than necessary for the given address. This reduces + * un-wildcarding for datapath flows in parts of the address space + * without host routes, but consulting extra data structures (the + * tries) may slightly increase lookup time. + * + * Trie lookup is interwoven with staged lookup, so that a trie is + * searched only when the configured trie field becomes relevant for + * the lookup. The trie lookup results are retained so that each trie + * is checked at most once for each classifier lookup. + * + * This implementation tracks the number of rules at each address + * prefix for the whole classifier. More aggressive table skipping + * would be possible by maintaining lists of tables that have prefixes + * at the lengths encountered on tree traversal, or by maintaining + * separate tries for subsets of rules separated by metadata fields. + * + * Prefix tracking is configured via OVSDB "Flow_Table" table, + * "fieldspec" column. "fieldspec" is a string map where a "prefix" + * key tells which fields should be used for prefix tracking. The + * value of the "prefix" key is a comma separated list of field names. + * + * There is a maximum number of fields that can be enabled for any one + * flow table. Currently this limit is 3. + * + * + * Partitioning (Lookup Time and Wildcard Optimization) + * ==================================================== * * Suppose that a given classifier is being used to handle multiple stages in a * pipeline using "resubmit", with metadata (that is, the OpenFlow 1.1+ field @@ -74,38 +184,42 @@ * The classifier has a special optimization to speed up matching in this * scenario: * - * - Each cls_table that matches on metadata gets a tag derived from the - * table's mask, so that it is likely that each table has a unique tag. - * (Duplicate tags have a performance cost but do not affect + * - Each cls_subtable that matches on metadata gets a tag derived from the + * subtable's mask, so that it is likely that each subtable has a unique + * tag. (Duplicate tags have a performance cost but do not affect * correctness.) * * - For each metadata value matched by any cls_rule, the classifier * constructs a "struct cls_partition" indexed by the metadata value. * The cls_partition has a 'tags' member whose value is the bitwise-OR of - * the tags of each cls_table that contains any rule that matches on the - * cls_partition's metadata value. In other words, struct cls_partition - * associates metadata values with tables that need to be checked with - * flows with that specific metadata value. + * the tags of each cls_subtable that contains any rule that matches on + * the cls_partition's metadata value. In other words, struct + * cls_partition associates metadata values with subtables that need to + * be checked with flows with that specific metadata value. * * Thus, a flow lookup can start by looking up the partition associated with - * the flow's metadata, and then skip over any cls_table whose 'tag' does not - * intersect the partition's 'tags'. (The flow must also be looked up in any - * cls_table that doesn't match on metadata. We handle that by giving any such - * cls_table TAG_ALL as its 'tags' so that it matches any tag.) + * the flow's metadata, and then skip over any cls_subtable whose 'tag' does + * not intersect the partition's 'tags'. (The flow must also be looked up in + * any cls_subtable that doesn't match on metadata. We handle that by giving + * any such cls_subtable TAG_ALL as its 'tags' so that it matches any tag.) + * + * Partitioning saves lookup time by reducing the number of subtable lookups. + * Each eliminated subtable lookup also reduces the amount of un-wildcarding. * * * Thread-safety * ============= * - * When locked properly, the classifier is thread safe as long as the following - * conditions are satisfied. - * - Only the main thread calls functions requiring a write lock. - * - Only the main thread is allowed to iterate over rules. */ + * The classifier may safely be accessed by many reader threads concurrently or + * by a single writer. */ +#include "fat-rwlock.h" #include "flow.h" +#include "hindex.h" #include "hmap.h" #include "list.h" #include "match.h" +#include "meta-flow.h" #include "tag.h" #include "openflow/nicira-ext.h" #include "openflow/openflow.h" @@ -119,52 +233,31 @@ extern "C" { /* Needed only for the lock annotation in struct classifier. */ extern struct ovs_mutex ofproto_mutex; +/* Classifier internal data structures. */ +struct cls_classifier; +struct cls_subtable; +struct cls_partition; + /* A flow classifier. */ struct classifier { - int n_rules; /* Total number of rules. */ - struct hmap tables; /* Contains "struct cls_table"s. */ - struct list tables_priority; /* Tables in descending priority order */ - struct hmap partitions; /* Contains "struct cls_partition"s. */ - struct ovs_rwlock rwlock OVS_ACQ_AFTER(ofproto_mutex); + struct fat_rwlock rwlock OVS_ACQ_AFTER(ofproto_mutex); + struct cls_classifier *cls; }; -/* A set of rules that all have the same fields wildcarded. */ -struct cls_table { - struct hmap_node hmap_node; /* Within struct classifier 'tables' hmap. */ - struct list list_node; /* Within classifier 'tables_priority_list' */ - struct hmap rules; /* Contains "struct cls_rule"s. */ - struct minimask mask; /* Wildcards for fields. */ - int n_table_rules; /* Number of rules, including duplicates. */ - unsigned int max_priority; /* Max priority of any rule in the table. */ - unsigned int max_count; /* Count of max_priority rules. */ - tag_type tag; /* Tag generated from mask for partitioning. */ +enum { + CLS_MAX_INDICES = 3, /* Maximum number of lookup indices per subtable. */ + CLS_MAX_TRIES = 3 /* Maximum number of prefix trees per classifier. */ }; -/* Returns true if 'table' is a "catch-all" table that will match every - * packet (if there is no higher-priority match). */ -static inline bool -cls_table_is_catchall(const struct cls_table *table) -{ - return minimask_is_catchall(&table->mask); -} - -/* A rule in a "struct cls_table". */ +/* A rule in a "struct cls_subtable". */ struct cls_rule { - struct hmap_node hmap_node; /* Within struct cls_table 'rules'. */ + struct hmap_node hmap_node; /* Within struct cls_subtable 'rules'. */ struct list list; /* List of identical, lower-priority rules. */ struct minimatch match; /* Matching rule. */ unsigned int priority; /* Larger numbers are higher priorities. */ struct cls_partition *partition; -}; - -/* Associates a metadata value (that is, a value of the OpenFlow 1.1+ metadata - * field) with tags for the "cls_table"s that contain rules that match that - * metadata value. */ -struct cls_partition { - struct hmap_node hmap_node; /* In struct classifier's 'partitions' hmap. */ - ovs_be64 metadata; /* metadata value for this partition. */ - tag_type tags; /* OR of each included flow's cls_table tag. */ - struct tag_tracker tracker; /* Tracks the bits in 'tags'. */ + struct hindex_node index_nodes[CLS_MAX_INDICES]; /* Within subtable's + * 'indices'. */ }; void cls_rule_init(struct cls_rule *, const struct match *, @@ -185,8 +278,13 @@ bool cls_rule_is_catchall(const struct cls_rule *); bool cls_rule_is_loose_match(const struct cls_rule *rule, const struct minimatch *criteria); -void classifier_init(struct classifier *cls); +void classifier_init(struct classifier *cls, const uint8_t *flow_segments); void classifier_destroy(struct classifier *); +void classifier_set_prefix_fields(struct classifier *cls, + const enum mf_field_id *trie_fields, + unsigned int n_trie_fields) + OVS_REQ_WRLOCK(cls->rwlock); + bool classifier_is_empty(const struct classifier *cls) OVS_REQ_RDLOCK(cls->rwlock); int classifier_count(const struct classifier *cls) @@ -201,6 +299,9 @@ struct cls_rule *classifier_lookup(const struct classifier *cls, const struct flow *, struct flow_wildcards *) OVS_REQ_RDLOCK(cls->rwlock); +struct cls_rule *classifier_lookup_miniflow_first(const struct classifier *cls, + const struct miniflow *) + OVS_REQ_RDLOCK(cls->rwlock); bool classifier_rule_overlaps(const struct classifier *cls, const struct cls_rule *) OVS_REQ_RDLOCK(cls->rwlock); @@ -218,15 +319,15 @@ struct cls_rule *classifier_find_match_exactly(const struct classifier *cls, /* Iteration. */ struct cls_cursor { - const struct classifier *cls; - const struct cls_table *table; + const struct cls_classifier *cls; + const struct cls_subtable *subtable; const struct cls_rule *target; }; void cls_cursor_init(struct cls_cursor *cursor, const struct classifier *cls, const struct cls_rule *match) OVS_REQ_RDLOCK(cls->rwlock); struct cls_rule *cls_cursor_first(struct cls_cursor *cursor); -struct cls_rule *cls_cursor_next(struct cls_cursor *cursor, const struct cls_rule *); +struct cls_rule *cls_cursor_next(struct cls_cursor *, const struct cls_rule *); #define CLS_CURSOR_FOR_EACH(RULE, MEMBER, CURSOR) \ for (ASSIGN_CONTAINER(RULE, cls_cursor_first(CURSOR), MEMBER); \