[dpdk-dev] ACL Issue with single field rule and rest with wild card entry

[dpdk-dev] ACL Issue with single field rule and rest with wild card entry

[Rapelly, Varun]

[-- Attachment #1: Type: text/plain, Size: 986 bytes --]

Hi,

struct ipv6_5tuple {
   uint8_t proto;         /* Protocol, next header. */
   uint32_t src_addr0;  /* IP address of source host. */
   uint32_t src_addr1;  /* IP address of source host. */
   uint32_t src_addr2;  /* IP address of source host. */
   uint32_t src_addr3;  /* IP address of source host. */
};

enum {
   PROTO_FIELD_IPV6,
   SRC_FIELD0_IPV6,
   SRC_FIELD1_IPV6,
   SRC_FIELD2_IPV6,
   SRC_FIELD3_IPV6,
   NUM_FIELDS_IPV6
};


I'm using the above data to insert in to ACL trie.

If I'm inserting rules with only different proto fields, [I'm expecting others fields as wild card entries]  then the rules are not matching.

But if I insert one rule with dummy entries [in the attached file line num 118-125], then the above issue is resolved.

Please let me know:


1.       Can we have rules with only one entry and others as wild card entries?

2.       Is there any other way to match wild card entries in a rule?

Regards,
Varun


[-- Attachment #2: main.c --]
[-- Type: text/plain, Size: 4901 bytes --]

#include <rte_acl.h>
#include <getopt.h>
#include <string.h>

#ifndef RTE_LIBRTE_ACL_STANDALONE

#include <rte_cycles.h>
#include <rte_per_lcore.h>
#include <rte_lcore.h>
#include <rte_ip.h>

#define	PRINT_USAGE_START	"%s [EAL options]\n"

#else 

#define	RTE_LCORE_FOREACH_SLAVE(x)	while (((x) = 0))

#define	rte_eal_remote_launch(a, b, c)	DUMMY_MACRO
#define	rte_eal_mp_wait_lcore()		DUMMY_MACRO

#define	rte_eal_init(c, v)	(0)

#define	PRINT_USAGE_START	"%s\n"

#endif /*RTE_LIBRTE_ACL_STANDALONE */

#include "main.h"

/*
 * Rule and trace formats definitions.
 */

typedef struct ipv6_5tuple ipv6_5tuple;
struct ipv6_5tuple {
   uint8_t proto;         /* Protocol, next header. */
   uint32_t src_addr0;  /* IP address of source host. */
   uint32_t src_addr1;  /* IP address of source host. */
   uint32_t src_addr2;  /* IP address of source host. */
   uint32_t src_addr3;  /* IP address of source host. */
}; 

enum {
   PROTO_FIELD_IPV6,
   SRC_FIELD0_IPV6,
   SRC_FIELD1_IPV6,
   SRC_FIELD2_IPV6,
   SRC_FIELD3_IPV6,
   NUM_FIELDS_IPV6
};

struct rte_acl_field_def ipv6_2tuple_defs[NUM_FIELDS_IPV6] = {
   {
      .type = RTE_ACL_FIELD_TYPE_BITMASK,
      .size = sizeof (uint8_t),
      .field_index = PROTO_FIELD_IPV6,
      .input_index = PROTO_FIELD_IPV6,
      .offset = offsetof (ipv6_5tuple, proto),
   },
   {
      .type = RTE_ACL_FIELD_TYPE_BITMASK,
      .size = sizeof (uint8_t),
      .field_index = SRC_FIELD0_IPV6,
      .input_index = SRC_FIELD0_IPV6,
      .offset = offsetof (ipv6_5tuple, src_addr0),
   },
   {
      .type = RTE_ACL_FIELD_TYPE_BITMASK,
      .size = sizeof (uint8_t),
      .field_index = SRC_FIELD1_IPV6,
      .input_index = SRC_FIELD1_IPV6,
      .offset = offsetof (ipv6_5tuple, src_addr1),
   },
   {
      .type = RTE_ACL_FIELD_TYPE_BITMASK,
      .size = sizeof (uint8_t),
      .field_index = SRC_FIELD2_IPV6,
      .input_index = SRC_FIELD2_IPV6,
      .offset = offsetof (ipv6_5tuple, src_addr2),
   },
   {
      .type = RTE_ACL_FIELD_TYPE_BITMASK,
      .size = sizeof (uint8_t),
      .field_index = SRC_FIELD2_IPV6,
      .input_index = SRC_FIELD2_IPV6,
      .offset = offsetof (ipv6_5tuple, src_addr3),
   },
};

struct rte_acl_ctx *acx;
struct rte_acl_config cfg;
int ret;

/* define a structure for the rule with up to 5 fields. */


RTE_ACL_RULE_DEF(acl_ipv6_rule, RTE_DIM(ipv6_2tuple_defs));

/* AC context creation parameters. */

struct rte_acl_param prm = {
   .name = "ACL_example",
   .socket_id = SOCKET_ID_ANY,
   .rule_size = RTE_ACL_RULE_SZ(RTE_DIM(ipv6_2tuple_defs)),

   /* number of fields per rule. */
   .max_rule_num = 8, /* maximum number of rules in the AC context. */
};

struct acl_ipv6_rule acl6_rules[] = {
   {
      .data = {.userdata = 1, .category_mask = 1, .priority = 1},
      .field[0] = {.value.u8 = 0x33, .mask_range.u8 = 0xFF,},
   },
   {
      .data = {.userdata = 11, .category_mask = 1, .priority = 11},
      .field[0] = {.value.u8 = 0x3a, .mask_range.u8 = 0xFF,},
   },
   {
      .data = {.userdata = 3, .category_mask = 1, .priority = 255},
      .field[0] = {.value.u8 = 0xFF, .mask_range.u8 = 0xFF,},
      //.field[1] = {.value.u32 = 0xFFFFFFFF,. mask_range.u32 = 0xFFFFFFFF,},
      //.field[2] = {.value.u32 = 0xFFFFFFFF,. mask_range.u32 = 0xFFFFFFFF,},
      //.field[3] = {.value.u32 = 0xFFFFFFFF,. mask_range.u32 = 0xFFFFFFFF,},
      //.field[4] = {.value.u32 = 0xFFFFFFFF,. mask_range.u32 = 0xFFFFFFFF,},
   },
   {
      .data = {.userdata = 2, .category_mask = 1, .priority = 2},
      .field[0] = {.value.u8 = 0x35, .mask_range.u8 = 0xFF,},
   },
};

ipv6_5tuple data;

int MAIN(int argc, char **argv)
{
   int ret;
   int32_t rc;
   uint32_t res;
   const uint8_t *dp;

   data.proto = 0x3a;
   data.src_addr0 = 0x12345678;
   data.src_addr1 = 0xaabbccdd;
   data.src_addr2 = 0xaabbccdd;
   data.src_addr3 = 0xaabbccdd;
   dp = (const uint8_t *)&data;

   ret = rte_eal_init(argc, argv);
   if (ret < 0)
      rte_panic("Cannot init EAL\n");

   /* create an empty AC context  */

   if ((acx = rte_acl_create(&prm)) == NULL) {

      /* handle context create failure. */

   }

   /* add rules to the context */

   ret = rte_acl_add_rules(acx, (const struct rte_acl_rule *)acl6_rules, RTE_DIM(acl6_rules));
   if (ret != 0) {
      /* handle error at adding ACL rules. */
   }

   /* prepare AC build config. */

   cfg.num_categories = 1;
   cfg.num_fields = RTE_DIM(ipv6_2tuple_defs);

   memcpy(cfg.defs, ipv6_2tuple_defs, sizeof (ipv6_2tuple_defs));

   /* build the runtime structures for added rules, with 2 categories. */

   ret = rte_acl_build(acx, &cfg);
   if (ret != 0) {
      /* handle error at build runtime structures for ACL context. */
   }
   rc = rte_acl_classify(acx, &dp, &res, 1, 1);
   if(rc != 0)
   {
      printf("rte_acl_classify failed!!\n");
      exit(0);
   }

   printf("rte_acl_classify() returns %d\n, res[0]=%u\n", rc, res);

   return (0);
}

Re: [dpdk-dev] ACL Issue with single field rule and rest with wild card entry

[Ananyev, Konstantin]

Hi Varun,

> -----Original Message-----
> From: dev [mailto:dev-bounces@dpdk.org] On Behalf Of Rapelly, Varun
> Sent: Friday, February 06, 2015 7:25 AM
> To: dev@dpdk.org
> Subject: [dpdk-dev] ACL Issue with single field rule and rest with wild card entry
> 
> Hi,
> 
> struct ipv6_5tuple {
>    uint8_t proto;         /* Protocol, next header. */
>    uint32_t src_addr0;  /* IP address of source host. */
>    uint32_t src_addr1;  /* IP address of source host. */
>    uint32_t src_addr2;  /* IP address of source host. */
>    uint32_t src_addr3;  /* IP address of source host. */
> };
> 
> enum {
>    PROTO_FIELD_IPV6,
>    SRC_FIELD0_IPV6,
>    SRC_FIELD1_IPV6,
>    SRC_FIELD2_IPV6,
>    SRC_FIELD3_IPV6,
>    NUM_FIELDS_IPV6
> };
> 
> 
> I'm using the above data to insert in to ACL trie.
> 
> If I'm inserting rules with only different proto fields, [I'm expecting others fields as wild card entries]  then the rules are not matching.
> 
> But if I insert one rule with dummy entries [in the attached file line num 118-125], then the above issue is resolved.

Hmm, it is strange...
I took your source code compiled it, then commented out lines 118-125 and recompiled it.
Both binaries produce valid result for me:

1. original code:
ACL: Gen phase for ACL "ACL_example":
runtime memory footprint on socket -1:
single nodes/bytes used: 0/0
quad nodes/vectors/bytes used: 0/0/0
DFA nodes/group64/bytes used: 1/4/4104
match nodes/bytes used: 4/512
total: 6816 bytes
max limit: 18446744073709551615 bytes
ACL: Build phase for ACL "ACL_example":
node limit for tree split: 2048
nodes created: 5
memory consumed: 8388615
ACL: trie 0: number of rules: 4, indexes: 1
rte_acl_classify() returns 0
, res[0]=11


2. code with lines 118-125 commented out:
ACL: Gen phase for ACL "ACL_example":
runtime memory footprint on socket -1:
single nodes/bytes used: 0/0
quad nodes/vectors/bytes used: 0/0/0
DFA nodes/group64/bytes used: 1/4/4104
match nodes/bytes used: 3/384
total: 6688 bytes
max limit: 18446744073709551615 bytes
ACL: Build phase for ACL "ACL_example":
node limit for tree split: 2048
nodes created: 4
memory consumed: 8388615
ACL: trie 0: number of rules: 3, indexes: 1
rte_acl_classify() returns 0
, res[0]=11

Wonder what results are you getting for both cases?

Konstantin

> 
> Please let me know:
> 
> 
> 1.       Can we have rules with only one entry and others as wild card entries?
> 
> 2.       Is there any other way to match wild card entries in a rule?
> 
> Regards,
> Varun

Re: [dpdk-dev] ACL Issue with single field rule and rest with wild card entry

[Ananyev, Konstantin]

Hi Varun,

> -----Original Message-----
> From: Rapelly, Varun [mailto:vrapelly@sonusnet.com]
> Sent: Friday, February 06, 2015 4:58 PM
> To: Ananyev, Konstantin
> Subject: FW: [dpdk-dev] ACL Issue with single field rule and rest with wild card entry
> 
> Sorry for too many mails. :)
> 
> I tried with DPDK 1.7 also, but got the same different results as 1.6.0 :(

I just tried with v1.7.0-rc4.
For me results are absolutely the same for both cases:
rte_acl_classify() returns 0 , res[0]=11

That's on HSW, fedora 20, gcc 4.8.3.
Same for IVB, fedora 16 with gcc 4.6
RTE_TARGET=x86_64-native-linuxapp-gcc

Not sure why you are getting different results then me with DPDK 1.7.
I suppose you didn't modify ACL library in any way?

BTW, do you realise that in you test you specify 'size = sizeof (uint8_t)' for all your fields?
It doesn't really matter for that particular test case, as all fields except the very first one are wildcards,
but in real app, it shouldn't be that way.

Konstantin

> 
> Regards,
> Varun
> -----Original Message-----
> From: Rapelly, Varun
> Sent: Friday, February 06, 2015 10:24 PM
> To: 'Ananyev, Konstantin'
> Subject: FW: [dpdk-dev] ACL Issue with single field rule and rest with wild card entry
> 
> Hi Konstantin,
> 
> FYI: I'm using DPDK 1.6.0
> 
> -----Original Message-----
> From: Rapelly, Varun
> Sent: Friday, February 06, 2015 10:08 PM
> To: 'Ananyev, Konstantin'
> Subject: RE: [dpdk-dev] ACL Issue with single field rule and rest with wild card entry
> 
> Hi Konstantin,
> 
> Thanks for your quick response.
> 
> I'm getting different results:
> 
> With 118-125 lines commented:
> 
> ACL: Gen phase for ACL "ACL_example":
> runtime memory footprint on socket -1:
> single nodes/bytes used: 0/0
> quad nodes/bytes used: 0/0
> DFA nodes/bytes used: 1/2048
> match nodes/bytes used: 4/512
> total: 4960 bytes
> ACL: Build phase for ACL "ACL_example":
> memory consumed: 8388615
> ACL: trie 0: number of rules: 4
> rte_acl_classify() returns 0
> , res[0]=0
> 
> With uncommented:
> ACL: Gen phase for ACL "ACL_example":
> runtime memory footprint on socket -1:
> single nodes/bytes used: 12/96
> quad nodes/bytes used: 4/96
> DFA nodes/bytes used: 1/2048
> match nodes/bytes used: 4/512
> total: 5152 bytes
> ACL: Build phase for ACL "ACL_example":
> memory consumed: 8388615
> ACL: trie 0: number of rules: 4
> rte_acl_classify() returns 0
> , res[0]=11
> 
> Please let me know, is it depends on any other environment variables or what?
> 
> Regards,
> Varun
> 
> -----Original Message-----
> From: Ananyev, Konstantin [mailto:konstantin.ananyev@intel.com]
> Sent: Friday, February 06, 2015 5:15 PM
> To: Rapelly, Varun; dev@dpdk.org
> Subject: RE: [dpdk-dev] ACL Issue with single field rule and rest with wild card entry
> 
> Hi Varun,
> 
> > -----Original Message-----
> > From: dev [mailto:dev-bounces@dpdk.org] On Behalf Of Rapelly, Varun
> > Sent: Friday, February 06, 2015 7:25 AM
> > To: dev@dpdk.org
> > Subject: [dpdk-dev] ACL Issue with single field rule and rest with
> > wild card entry
> >
> > Hi,
> >
> > struct ipv6_5tuple {
> >    uint8_t proto;         /* Protocol, next header. */
> >    uint32_t src_addr0;  /* IP address of source host. */
> >    uint32_t src_addr1;  /* IP address of source host. */
> >    uint32_t src_addr2;  /* IP address of source host. */
> >    uint32_t src_addr3;  /* IP address of source host. */ };
> >
> > enum {
> >    PROTO_FIELD_IPV6,
> >    SRC_FIELD0_IPV6,
> >    SRC_FIELD1_IPV6,
> >    SRC_FIELD2_IPV6,
> >    SRC_FIELD3_IPV6,
> >    NUM_FIELDS_IPV6
> > };
> >
> >
> > I'm using the above data to insert in to ACL trie.
> >
> > If I'm inserting rules with only different proto fields, [I'm expecting others fields as wild card entries]  then the rules are not
> matching.
> >
> > But if I insert one rule with dummy entries [in the attached file line num 118-125], then the above issue is resolved.
> 
> Hmm, it is strange...
> I took your source code compiled it, then commented out lines 118-125 and recompiled it.
> Both binaries produce valid result for me:
> 
> 1. original code:
> ACL: Gen phase for ACL "ACL_example":
> runtime memory footprint on socket -1:
> single nodes/bytes used: 0/0
> quad nodes/vectors/bytes used: 0/0/0
> DFA nodes/group64/bytes used: 1/4/4104
> match nodes/bytes used: 4/512
> total: 6816 bytes
> max limit: 18446744073709551615 bytes
> ACL: Build phase for ACL "ACL_example":
> node limit for tree split: 2048
> nodes created: 5
> memory consumed: 8388615
> ACL: trie 0: number of rules: 4, indexes: 1
> rte_acl_classify() returns 0
> , res[0]=11
> 
> 
> 2. code with lines 118-125 commented out:
> ACL: Gen phase for ACL "ACL_example":
> runtime memory footprint on socket -1:
> single nodes/bytes used: 0/0
> quad nodes/vectors/bytes used: 0/0/0
> DFA nodes/group64/bytes used: 1/4/4104
> match nodes/bytes used: 3/384
> total: 6688 bytes
> max limit: 18446744073709551615 bytes
> ACL: Build phase for ACL "ACL_example":
> node limit for tree split: 2048
> nodes created: 4
> memory consumed: 8388615
> ACL: trie 0: number of rules: 3, indexes: 1
> rte_acl_classify() returns 0
> , res[0]=11
> 
> Wonder what results are you getting for both cases?
> 
> Konstantin
> 
> >
> > Please let me know:
> >
> >
> > 1.       Can we have rules with only one entry and others as wild card entries?
> >
> > 2.       Is there any other way to match wild card entries in a rule?
> >
> > Regards,
> > Varun