On 18-01-09 09:07 AM, Jiri Pirko wrote:
From: Jiri Pirko <j...@mellanox.com>Currently the filters added to qdiscs are independent. So for example if you have 2 netdevices and you create ingress qdisc on both and you want to add identical filter rules both, you need to add them twice. This patchset makes this easier and mainly saves resources allowing to share all filters within a qdisc - I call it a "filter block". Also this helps to save resources when we do offload to hw for example to expensive TCAM. So back to the example. First, we create 2 qdiscs. Both will share block number 22. "22" is just an identification: $ tc qdisc add dev ens7 ingress block 22 ^^^^^^^^ $ tc qdisc add dev ens8 ingress block 22 ^^^^^^^^ If we don't specify "block" command line option, no shared block would be created: $ tc qdisc add dev ens9 ingress Now if we list the qdiscs, we will see the block index in the output: $ tc qdisc qdisc ingress ffff: dev ens7 parent ffff:fff1 block 22 qdisc ingress ffff: dev ens8 parent ffff:fff1 block 22 qdisc ingress ffff: dev ens9 parent ffff:fff1 To make is more visual, the situation looks like this: ens7 ingress qdisc ens7 ingress qdisc | | | | +----------> block 22 <----------+ Unlimited number of qdiscs may share the same block. Now we can add filter using the block index: $ tc filter add block 22 protocol ip pref 25 flower dst_ip 192.168.0.0/16 action drop Note we cannot use the qdisc for filter manipulations of shared blocks: $ tc filter add dev ens8 ingress protocol ip pref 1 flower dst_ip 192.168.100.2 action drop Error: This filter block is shared. Please use the block index to manipulate the filters. We will see the same output if we list filters for ingress qdisc of ens7 and ens8, also for the block 22: $ tc filter show block 22 filter block 22 protocol ip pref 25 flower chain 0 filter block 22 protocol ip pref 25 flower chain 0 handle 0x1 ... $ tc filter show dev ens7 ingress filter block 22 protocol ip pref 25 flower chain 0 filter block 22 protocol ip pref 25 flower chain 0 handle 0x1 ... $ tc filter show dev ens8 ingress filter block 22 protocol ip pref 25 flower chain 0 filter block 22 protocol ip pref 25 flower chain 0 handle 0x1 ...
Somewhere here mention the egress issue we talked about, something like: ---- At the moment on ingress and clsact_xxx are well supported by the block infrastructure. For this to work well with egress qdisc, all the ports/qdiscs sharing the block will have to be symmetric. e.g. if ens8 and ens9 root qdiscs shared a block at their (egress) root qdiscs, then those qdiscs would both need to have the same handle id. An example of a symettric shared block setup would like like: tc qdisc add dev ens8 root block 22 handle 1:0 prio tc qdisc add dev ens9 root block 22 handle 1:0 prio ---- I am confident the above would work. You said you are thinking of getting this to always work (I cant think of a simple way to do it), but for the moment the above is fine. Most people who want this would probably use clsact egress and not care about queues (so it may never be "fixed") cheers, jamal
