Downloaded 20 times
![© 2019 NETRONOME SYSTEMS, INC. 2CONFIDENTIAL
Internal Ports in OVS
● Registered in kernel by OVS and treated as standard netdevs
● Main differences with standard bridge devs:
○ If an OVS rule egresses to an internal port, the packet is passed to the network
stack (ingress) rather than dev_queue_xmit
○ ndo_start_xmit() injects packet into OVS kernel datapath
● Rules applied to internal ports are not hit — TC ingress is bypassed
● Wish to address this to allow hardware offload of these rules
● TC rules outputting to an internal port should use Ingress redirect
● Two approaches to allowing TC to offload rules on internal ports:
○ Add TC ingress hook to OVS internal port modules
■ Required as it bypasses hook in the network stack
○ Offload rules as egress hooks
■ [RFC OVS 0/2] ovs-tc: support OVS internal port offload](https://image.slidesharecdn.com/offloadingtcrulesonovsinternalports-netdev0x13-190327165956/85/Offloading-TC-Rules-on-OVS-Internal-Ports-2-320.jpg)
Uploaded byNetronome
Offloading TC Rules on OVS Internal Ports
This document discusses two approaches to allowing traffic control (TC) rules to offload rules on internal ports in Open vSwitch (OVS). The first approach is to add a TC ingress hook to OVS internal port modules so the rules can be applied. The second approach is to offload rules as egress hooks, which achieves the same outcome as ingress hooks on internal ports by generating an OVS ingress action when egressing an internal port. Currently, TC rules outputting to an internal port are not offloaded, so this bypasses the OVS kernel datapath. The proposed approaches aim to address this by allowing hardware offload of rules on internal ports.
Offloading TC Rules on OVS Internal Ports
- 1. © 2019 NETRONOMESYSTEMS, INC. John Hurley presented by Simon Horman Offloading TC rules on OVS Internal Ports
- 2. © 2019 NETRONOMESYSTEMS, INC. 2CONFIDENTIAL Internal Ports in OVS ● Registered in kernel by OVS and treated as standard netdevs ● Main differences with standard bridge devs: ○ If an OVS rule egresses to an internal port, the packet is passed to the network stack (ingress) rather than dev_queue_xmit ○ ndo_start_xmit() injects packet into OVS kernel datapath ● Rules applied to internal ports are not hit — TC ingress is bypassed ● Wish to address this to allow hardware offload of these rules ● TC rules outputting to an internal port should use Ingress redirect ● Two approaches to allowing TC to offload rules on internal ports: ○ Add TC ingress hook to OVS internal port modules ■ Required as it bypasses hook in the network stack ○ Offload rules as egress hooks ■ [RFC OVS 0/2] ovs-tc: support OVS internal port offload
- 3. © 2019 NETRONOMESYSTEMS, INC. 3CONFIDENTIAL OVS Kernel (Encap with Tunnel IP on Bridge) Network RX stack OVS Kernel datapath eth0 Ingress hooks Rx handler Network TX stack Internal Port (br0) vxlan0 eth1 1. In_port: eth0 -> actions: output vxlan0 2. In_port: br0, src/dst mac -> actions: output eth1 Egress hooks 1 2 3 - xmit 4 5 1. Packet enters OVS datapath and matches rule 1 2. Action is to egress port vxlan0 3. Passes ip_tun stack and finds br0 as next hop (neigh_output) and calls dev_queue_xmit on this 4. ndo_start_xmit on internal port pushes packet into OVS kernel datapath with br0 as ingress port 5. Matches rule 2 and egresses port eth1
- 4. © 2019 NETRONOMESYSTEMS, INC. 4CONFIDENTIAL OVS-TC — Current Network RX stack OVS Kernel datapath eth0 Ingress hooks Rx handler Network TX stack Internal Port (br0) vxlan0 eth1 1. In_port: eth0 -> actions: output vxlan0 2. In_port: br0, src/dst mac -> actions: output eth1 Egress hooks 1 2 3 - xmit 4 5 1. Rule 1 is offloaded as a TC flower ingress filter on eth0 so packet is directed straight to vxlan0 without entering the OVS datapath 2. Rule 2 is not offloaded to TC so path (2-5) through OVS kernel is taken
- 5. © 2019 NETRONOMESYSTEMS, INC. 5CONFIDENTIAL OVS-TC — Modified to Use TC Egress Hook Network RX stack OVS Kernel datapath eth0 Ingress hooks Rx handler Network TX stack Internal Port (br0) vxlan0 eth1 1. In_port: eth0 -> actions: output vxlan0 2. In_port: br0, src/dst mac -> actions: output eth1 Egress hooks 1 2 3 - xmit 1. Packet matches ingress hook on eth0 and is directed to egress vxlan0 2. Next hop is determined as br0 so it is directed to egress that internal port 3. Rule 2 is installed on egress hook and packet is directed to eth1, bypassing OVS kernel datapath — egressing an internal port generates an OVS ingress action, so applying rule that match internal ports as egress hooks, achieves the same outcome as having an ingress hook in the internal port handlers
- 6. © 2019 NETRONOMESYSTEMS, INC. 6CONFIDENTIAL OVS-TC — Modified to Use TC Ingress Hook Network RX stack OVS Kernel datapath eth0 Ingress hooks Rx handler Network TX stack Internal Port (br0) vxlan0 eth1 1. In_port: eth0 -> actions: output vxlan0 2. In_port: br0, src/dst mac -> actions: output eth1 Egress hooks 1 2 3 - xmit 1. Packet matches ingress hook on eth0 and is directed to egress vxlan0 2. Next hop is determined as br0 so it is directed to egress that internal port 3. When received by the internal port packet is passed to TC ingress hooks 4. Rule 2 is installed on ingress hook 5. Packet egresses via eth1 4 5
- 7. © 2019 NETRONOMESYSTEMS, INC. Thank You