lib/classifier.h

   1 /*
   2  * Copyright (c) 2009, 2010, 2011, 2012, 2013 Nicira, Inc.
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at:
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 #ifndef CLASSIFIER_H
  18 #define CLASSIFIER_H 1
  19
  20 /* Flow classifier.
  21  *
  22  *
  23  * What?
  24  * =====
  25  *
  26  * A flow classifier holds any number of "rules", each of which specifies
  27  * values to match for some fields or subfields and a priority.  Each OpenFlow
  28  * table is implemented as a flow classifier.
  29  *
  30  * The classifier has two primary design goals.  The first is obvious: given a
  31  * set of packet headers, as quickly as possible find the highest-priority rule
  32  * that matches those headers.  The following section describes the second
  33  * goal.
  34  *
  35  *
  36  * "Un-wildcarding"
  37  * ================
  38  *
  39  * A primary goal of the flow classifier is to produce, as a side effect of a
  40  * packet lookup, a wildcard mask that indicates which bits of the packet
  41  * headers were essential to the classification result.  Ideally, a 1-bit in
  42  * any position of this mask means that, if the corresponding bit in the packet
  43  * header were flipped, then the classification result might change.  A 0-bit
  44  * means that changing the packet header bit would have no effect.  Thus, the
  45  * wildcarded bits are the ones that played no role in the classification
  46  * decision.
  47  *
  48  * Such a wildcard mask is useful with datapaths that support installing flows
  49  * that wildcard fields or subfields.  If an OpenFlow lookup for a TCP flow
  50  * does not actually look at the TCP source or destination ports, for example,
  51  * then the switch may install into the datapath a flow that wildcards the port
  52  * numbers, which in turn allows the datapath to handle packets that arrive for
  53  * other TCP source or destination ports without additional help from
  54  * ovs-vswitchd.  This is useful for the Open vSwitch software and,
  55  * potentially, for ASIC-based switches as well.
  56  *
  57  * Some properties of the wildcard mask:
  58  *
  59  *     - "False 1-bits" are acceptable, that is, setting a bit in the wildcard
  60  *       mask to 1 will never cause a packet to be forwarded the wrong way.
  61  *       As a corollary, a wildcard mask composed of all 1-bits will always
  62  *       yield correct (but often needlessly inefficient) behavior.
  63  *
  64  *     - "False 0-bits" can cause problems, so they must be avoided.  In the
  65  *       extreme case, a mask of all 0-bits is only correct if the classifier
  66  *       contains only a single flow that matches all packets.
  67  *
  68  *     - 0-bits are desirable because they allow the datapath to act more
  69  *       autonomously, relying less on ovs-vswitchd to process flow setups,
  70  *       thereby improving performance.
  71  *
  72  *     - We don't know a good way to generate wildcard masks with the maximum
  73  *       (correct) number of 0-bits.  We use various approximations, described
  74  *       in later sections.
  75  *
  76  *     - Wildcard masks for lookups in a given classifier yield a
  77  *       non-overlapping set of rules.  More specifically:
  78  *
  79  *       Consider an classifier C1 filled with an arbitrary collection of rules
  80  *       and an empty classifier C2.  Now take a set of packet headers H and
  81  *       look it up in C1, yielding a highest-priority matching rule R1 and
  82  *       wildcard mask M.  Form a new classifier rule R2 out of packet headers
  83  *       H and mask M, and add R2 to C2 with a fixed priority.  If one were to
  84  *       do this for every possible set of packet headers H, then this
  85  *       process would not attempt to add any overlapping rules to C2, that is,
  86  *       any packet lookup using the rules generated by this process matches at
  87  *       most one rule in C2.
  88  *
  89  * During the lookup process, the classifier starts out with a wildcard mask
  90  * that is all 0-bits, that is, fully wildcarded.  As lookup proceeds, each
  91  * step tends to add constraints to the wildcard mask, that is, change
  92  * wildcarded 0-bits into exact-match 1-bits.  We call this "un-wildcarding".
  93  * A lookup step that examines a particular field must un-wildcard that field.
  94  * In general, un-wildcarding is necessary for correctness but undesirable for
  95  * performance.
  96  *
  97  *
  98  * Basic Classifier Design
  99  * =======================
 100  *
 101  * Suppose that all the rules in a classifier had the same form.  For example,
 102  * suppose that they all matched on the source and destination Ethernet address
 103  * and wildcarded all the other fields.  Then the obvious way to implement a
 104  * classifier would be a hash table on the source and destination Ethernet
 105  * addresses.  If new classification rules came along with a different form,
 106  * you could add a second hash table that hashed on the fields matched in those
 107  * rules.  With two hash tables, you look up a given flow in each hash table.
 108  * If there are no matches, the classifier didn't contain a match; if you find
 109  * a match in one of them, that's the result; if you find a match in both of
 110  * them, then the result is the rule with the higher priority.
 111  *
 112  * This is how the classifier works.  In a "struct classifier", each form of
 113  * "struct cls_rule" present (based on its ->match.mask) goes into a separate
 114  * "struct cls_subtable".  A lookup does a hash lookup in every "struct
 115  * cls_subtable" in the classifier and tracks the highest-priority match that
 116  * it finds.  The subtables are kept in a descending priority order according
 117  * to the highest priority rule in each subtable, which allows lookup to skip
 118  * over subtables that can't possibly have a higher-priority match than already
 119  * found.  Eliminating lookups through priority ordering aids both classifier
 120  * primary design goals: skipping lookups saves time and avoids un-wildcarding
 121  * fields that those lookups would have examined.
 122  *
 123  * One detail: a classifier can contain multiple rules that are identical other
 124  * than their priority.  When this happens, only the highest priority rule out
 125  * of a group of otherwise identical rules is stored directly in the "struct
 126  * cls_subtable", with the other almost-identical rules chained off a linked
 127  * list inside that highest-priority rule.
 128  *
 129  *
 130  * Staged Lookup (Wildcard Optimization)
 131  * =====================================
 132  *
 133  * Subtable lookup is performed in ranges defined for struct flow, starting
 134  * from metadata (registers, in_port, etc.), then L2 header, L3, and finally
 135  * L4 ports.  Whenever it is found that there are no matches in the current
 136  * subtable, the rest of the subtable can be skipped.
 137  *
 138  * Staged lookup does not reduce lookup time, and it may increase it, because
 139  * it changes a single hash table lookup into multiple hash table lookups.
 140  * It reduces un-wildcarding significantly in important use cases.
 141  *
 142  *
 143  * Prefix Tracking (Wildcard Optimization)
 144  * =======================================
 145  *
 146  * Classifier uses prefix trees ("tries") for tracking the used
 147  * address space, enabling skipping classifier tables containing
 148  * longer masks than necessary for the given address.  This reduces
 149  * un-wildcarding for datapath flows in parts of the address space
 150  * without host routes, but consulting extra data structures (the
 151  * tries) may slightly increase lookup time.
 152  *
 153  * Trie lookup is interwoven with staged lookup, so that a trie is
 154  * searched only when the configured trie field becomes relevant for
 155  * the lookup.  The trie lookup results are retained so that each trie
 156  * is checked at most once for each classifier lookup.
 157  *
 158  * This implementation tracks the number of rules at each address
 159  * prefix for the whole classifier.  More aggressive table skipping
 160  * would be possible by maintaining lists of tables that have prefixes
 161  * at the lengths encountered on tree traversal, or by maintaining
 162  * separate tries for subsets of rules separated by metadata fields.
 163  *
 164  * Prefix tracking is configured via OVSDB "Flow_Table" table,
 165  * "fieldspec" column.  "fieldspec" is a string map where a "prefix"
 166  * key tells which fields should be used for prefix tracking.  The
 167  * value of the "prefix" key is a comma separated list of field names.
 168  *
 169  * There is a maximum number of fields that can be enabled for any one
 170  * flow table.  Currently this limit is 3.
 171  *
 172  *
 173  * Partitioning (Lookup Time and Wildcard Optimization)
 174  * ====================================================
 175  *
 176  * Suppose that a given classifier is being used to handle multiple stages in a
 177  * pipeline using "resubmit", with metadata (that is, the OpenFlow 1.1+ field
 178  * named "metadata") distinguishing between the different stages.  For example,
 179  * metadata value 1 might identify ingress rules, metadata value 2 might
 180  * identify ACLs, and metadata value 3 might identify egress rules.  Such a
 181  * classifier is essentially partitioned into multiple sub-classifiers on the
 182  * basis of the metadata value.
 183  *
 184  * The classifier has a special optimization to speed up matching in this
 185  * scenario:
 186  *
 187  *     - Each cls_subtable that matches on metadata gets a tag derived from the
 188  *       subtable's mask, so that it is likely that each subtable has a unique
 189  *       tag.  (Duplicate tags have a performance cost but do not affect
 190  *       correctness.)
 191  *
 192  *     - For each metadata value matched by any cls_rule, the classifier
 193  *       constructs a "struct cls_partition" indexed by the metadata value.
 194  *       The cls_partition has a 'tags' member whose value is the bitwise-OR of
 195  *       the tags of each cls_subtable that contains any rule that matches on
 196  *       the cls_partition's metadata value.  In other words, struct
 197  *       cls_partition associates metadata values with subtables that need to
 198  *       be checked with flows with that specific metadata value.
 199  *
 200  * Thus, a flow lookup can start by looking up the partition associated with
 201  * the flow's metadata, and then skip over any cls_subtable whose 'tag' does
 202  * not intersect the partition's 'tags'.  (The flow must also be looked up in
 203  * any cls_subtable that doesn't match on metadata.  We handle that by giving
 204  * any such cls_subtable TAG_ALL as its 'tags' so that it matches any tag.)
 205  *
 206  * Partitioning saves lookup time by reducing the number of subtable lookups.
 207  * Each eliminated subtable lookup also reduces the amount of un-wildcarding.
 208  *
 209  *
 210  * Thread-safety
 211  * =============
 212  *
 213  * The classifier may safely be accessed by many reader threads concurrently or
 214  * by a single writer. */
 215
 216 #include "flow.h"
 217 #include "hindex.h"
 218 #include "hmap.h"
 219 #include "list.h"
 220 #include "match.h"
 221 #include "meta-flow.h"
 222 #include "tag.h"
 223 #include "openflow/nicira-ext.h"
 224 #include "openflow/openflow.h"
 225 #include "ovs-thread.h"
 226 #include "util.h"
 227
 228 #ifdef __cplusplus
 229 extern "C" {
 230 #endif
 231
 232 /* Needed only for the lock annotation in struct classifier. */
 233 extern struct ovs_mutex ofproto_mutex;
 234 struct trie_node;
 235
 236 /* Prefix trie for a 'field' */
 237 struct cls_trie {
 238     const struct mf_field *field; /* Trie field, or NULL. */
 239     struct trie_node *root;       /* NULL if none. */
 240 };
 241
 242 enum {
 243     CLS_MAX_INDICES = 3, /* Maximum number of lookup indices per subtable. */
 244     CLS_MAX_TRIES = 3    /* Maximum number of prefix trees per classifier. */
 245 };
 246
 247 /* A flow classifier. */
 248 struct classifier {
 249     int n_rules;                /* Total number of rules. */
 250     uint8_t n_flow_segments;
 251     uint8_t flow_segments[CLS_MAX_INDICES]; /* Flow segment boundaries to use
 252                                              * for staged lookup. */
 253     struct hmap subtables;      /* Contains "struct cls_subtable"s.  */
 254     struct list subtables_priority; /* Subtables in descending priority order.
 255                                      */
 256     struct hmap partitions;     /* Contains "struct cls_partition"s. */
 257     struct ovs_rwlock rwlock OVS_ACQ_AFTER(ofproto_mutex);
 258     struct cls_trie tries[CLS_MAX_TRIES]; /* Prefix tries. */
 259     unsigned int n_tries;
 260 };
 261
 262 /* A set of rules that all have the same fields wildcarded. */
 263 struct cls_subtable {
 264     struct hmap_node hmap_node; /* Within struct classifier 'subtables' hmap.
 265                                  */
 266     struct list list_node;      /* Within classifier 'subtables_priority' list.
 267                                  */
 268     struct hmap rules;          /* Contains "struct cls_rule"s. */
 269     struct minimask mask;       /* Wildcards for fields. */
 270     int n_rules;                /* Number of rules, including duplicates. */
 271     unsigned int max_priority;  /* Max priority of any rule in the subtable. */
 272     unsigned int max_count;     /* Count of max_priority rules. */
 273     tag_type tag;               /* Tag generated from mask for partitioning. */
 274     uint8_t n_indices;           /* How many indices to use. */
 275     uint8_t index_ofs[CLS_MAX_INDICES]; /* u32 flow segment boundaries. */
 276     struct hindex indices[CLS_MAX_INDICES]; /* Staged lookup indices. */
 277     unsigned int trie_plen[CLS_MAX_TRIES];  /* Trie prefix length in 'mask'. */
 278 };
 279
 280 /* Returns true if 'table' is a "catch-all" subtable that will match every
 281  * packet (if there is no higher-priority match). */
 282 static inline bool
 283 cls_subtable_is_catchall(const struct cls_subtable *subtable)
 284 {
 285     return minimask_is_catchall(&subtable->mask);
 286 }
 287
 288 /* A rule in a "struct cls_subtable". */
 289 struct cls_rule {
 290     struct hmap_node hmap_node; /* Within struct cls_subtable 'rules'. */
 291     struct list list;           /* List of identical, lower-priority rules. */
 292     struct minimatch match;     /* Matching rule. */
 293     unsigned int priority;      /* Larger numbers are higher priorities. */
 294     struct cls_partition *partition;
 295     struct hindex_node index_nodes[CLS_MAX_INDICES]; /* Within subtable's
 296                                                       * 'indices'. */
 297 };
 298
 299 /* Associates a metadata value (that is, a value of the OpenFlow 1.1+ metadata
 300  * field) with tags for the "cls_subtable"s that contain rules that match that
 301  * metadata value.  */
 302 struct cls_partition {
 303     struct hmap_node hmap_node; /* In struct classifier's 'partitions' hmap. */
 304     ovs_be64 metadata;          /* metadata value for this partition. */
 305     tag_type tags;              /* OR of each flow's cls_subtable tag. */
 306     struct tag_tracker tracker; /* Tracks the bits in 'tags'. */
 307 };
 308
 309 void cls_rule_init(struct cls_rule *, const struct match *,
 310                    unsigned int priority);
 311 void cls_rule_init_from_minimatch(struct cls_rule *, const struct minimatch *,
 312                                   unsigned int priority);
 313 void cls_rule_clone(struct cls_rule *, const struct cls_rule *);
 314 void cls_rule_move(struct cls_rule *dst, struct cls_rule *src);
 315 void cls_rule_destroy(struct cls_rule *);
 316
 317 bool cls_rule_equal(const struct cls_rule *, const struct cls_rule *);
 318 uint32_t cls_rule_hash(const struct cls_rule *, uint32_t basis);
 319
 320 void cls_rule_format(const struct cls_rule *, struct ds *);
 321
 322 bool cls_rule_is_catchall(const struct cls_rule *);
 323
 324 bool cls_rule_is_loose_match(const struct cls_rule *rule,
 325                              const struct minimatch *criteria);
 326
 327 void classifier_init(struct classifier *cls, const uint8_t *flow_segments);
 328 void classifier_destroy(struct classifier *);
 329 void classifier_set_prefix_fields(struct classifier *cls,
 330                                   const enum mf_field_id *trie_fields,
 331                                   unsigned int n_trie_fields)
 332     OVS_REQ_WRLOCK(cls->rwlock);
 333
 334 bool classifier_is_empty(const struct classifier *cls)
 335     OVS_REQ_RDLOCK(cls->rwlock);
 336 int classifier_count(const struct classifier *cls)
 337     OVS_REQ_RDLOCK(cls->rwlock);
 338 void classifier_insert(struct classifier *cls, struct cls_rule *)
 339     OVS_REQ_WRLOCK(cls->rwlock);
 340 struct cls_rule *classifier_replace(struct classifier *cls, struct cls_rule *)
 341     OVS_REQ_WRLOCK(cls->rwlock);
 342 void classifier_remove(struct classifier *cls, struct cls_rule *)
 343     OVS_REQ_WRLOCK(cls->rwlock);
 344 struct cls_rule *classifier_lookup(const struct classifier *cls,
 345                                    const struct flow *,
 346                                    struct flow_wildcards *)
 347     OVS_REQ_RDLOCK(cls->rwlock);
 348 bool classifier_rule_overlaps(const struct classifier *cls,
 349                               const struct cls_rule *)
 350     OVS_REQ_RDLOCK(cls->rwlock);
 351
 352 typedef void cls_cb_func(struct cls_rule *, void *aux);
 353
 354 struct cls_rule *classifier_find_rule_exactly(const struct classifier *cls,
 355                                               const struct cls_rule *)
 356     OVS_REQ_RDLOCK(cls->rwlock);
 357 struct cls_rule *classifier_find_match_exactly(const struct classifier *cls,
 358                                                const struct match *,
 359                                                unsigned int priority)
 360     OVS_REQ_RDLOCK(cls->rwlock);
 361 \f
 362 /* Iteration. */
 363
 364 struct cls_cursor {
 365     const struct classifier *cls;
 366     const struct cls_subtable *subtable;
 367     const struct cls_rule *target;
 368 };
 369
 370 void cls_cursor_init(struct cls_cursor *cursor, const struct classifier *cls,
 371                      const struct cls_rule *match) OVS_REQ_RDLOCK(cls->rwlock);
 372 struct cls_rule *cls_cursor_first(struct cls_cursor *cursor);
 373 struct cls_rule *cls_cursor_next(struct cls_cursor *, const struct cls_rule *);
 374
 375 #define CLS_CURSOR_FOR_EACH(RULE, MEMBER, CURSOR)                       \
 376     for (ASSIGN_CONTAINER(RULE, cls_cursor_first(CURSOR), MEMBER);      \
 377          RULE != OBJECT_CONTAINING(NULL, RULE, MEMBER);                 \
 378          ASSIGN_CONTAINER(RULE, cls_cursor_next(CURSOR, &(RULE)->MEMBER), \
 379                           MEMBER))
 380
 381 #define CLS_CURSOR_FOR_EACH_SAFE(RULE, NEXT, MEMBER, CURSOR)            \
 382     for (ASSIGN_CONTAINER(RULE, cls_cursor_first(CURSOR), MEMBER);      \
 383          (RULE != OBJECT_CONTAINING(NULL, RULE, MEMBER)                 \
 384           ? ASSIGN_CONTAINER(NEXT, cls_cursor_next(CURSOR, &(RULE)->MEMBER), \
 385                              MEMBER), 1                                 \
 386           : 0);                                                         \
 387          (RULE) = (NEXT))
 388
 389 #ifdef __cplusplus
 390 }
 391 #endif
 392
 393 #endif /* classifier.h */