Merge branch 'drop_monitor-for-offloaded-paths'

Ido Schimmel says:

====================
Add drop monitor for offloaded data paths

Users have several ways to debug the kernel and understand why a packet
was dropped. For example, using drop monitor and perf. Both utilities
trace kfree_skb(), which is the function called when a packet is freed
as part of a failure. The information provided by these tools is
invaluable when trying to understand the cause of a packet loss.

In recent years, large portions of the kernel data path were offloaded
to capable devices. Today, it is possible to perform L2 and L3
forwarding in hardware, as well as tunneling (IP-in-IP and VXLAN).
Different TC classifiers and actions are also offloaded to capable
devices, at both ingress and egress.

However, when the data path is offloaded it is not possible to achieve
the same level of introspection since packets are dropped by the
underlying device and never reach the kernel.

This patchset aims to solve this by allowing users to monitor packets
that the underlying device decided to drop along with relevant metadata
such as the drop reason and ingress port.

The above is achieved by exposing a fundamental capability of devices
capable of data path offloading - packet trapping. In much the same way
as drop monitor registers its probe function with the kfree_skb()
tracepoint, the device is instructed to pass to the CPU (trap) packets
that it decided to drop in various places in the pipeline.

The configuration of the device to pass such packets to the CPU is
performed using devlink, as it is not specific to a port, but rather to
a device. In the future, we plan to control the policing of such packets
using devlink, in order not to overwhelm the CPU.

While devlink is used as the control path, the dropped packets are
passed along with metadata to drop monitor, which reports them to
userspace as netlink events. This allows users to use the same interface
for the monitoring of both software and hardware drops.

Logically, the solution looks as follows:

                                    Netlink event: Packet w/ metadata
                                                   Or a summary of recent drops
                                  ^
                                  |
         Userspace                |
        +---------------------------------------------------+
         Kernel                   |
                                  |
                          +-------+--------+
                          |                |
                          |  drop_monitor  |
                          |                |
                          +-------^--------+
                                  |
                                  |
                                  |
                             +----+----+
                             |         |      Kernel's Rx path
                             | devlink |      (non-drop traps)
                             |         |
                             +----^----+      ^
                                  |           |
                                  +-----------+
                                  |
                          +-------+-------+
                          |               |
                          | Device driver |
                          |               |
                          +-------^-------+
         Kernel                   |
        +---------------------------------------------------+
         Hardware                 |
                                  | Trapped packet
                                  |
                               +--+---+
                               |      |
                               | ASIC |
                               |      |
                               +------+

In order to reduce the patch count, this patchset only includes
integration with netdevsim. A follow-up patchset will add devlink-trap
support in mlxsw.

Patches #1-#7 extend drop monitor to also monitor hardware originated
drops.

Patches #8-#10 add the devlink-trap infrastructure.

Patches #11-#12 add devlink-trap support in netdevsim.

Patches #13-#16 add tests for the generic infrastructure over netdevsim.

Example
=======

Instantiate netdevsim
---------------------

List supported traps
--------------------

netdevsim/netdevsim10:
  name source_mac_is_multicast type drop generic true action drop group l2_drops
  name vlan_tag_mismatch type drop generic true action drop group l2_drops
  name ingress_vlan_filter type drop generic true action drop group l2_drops
  name ingress_spanning_tree_filter type drop generic true action drop group l2_drops
  name port_list_is_empty type drop generic true action drop group l2_drops
  name port_loopback_filter type drop generic true action drop group l2_drops
  name fid_miss type exception generic false action trap group l2_drops
  name blackhole_route type drop generic true action drop group l3_drops
  name ttl_value_is_too_small type exception generic true action trap group l3_drops
  name tail_drop type drop generic true action drop group buffer_drops

Enable a trap
-------------

Query statistics
----------------

netdevsim/netdevsim10:
  name blackhole_route type drop generic true action trap group l3_drops
    stats:
        rx:
          bytes 7384 packets 52

Monitor dropped packets
-----------------------

dropwatch> set alertmode packet
Setting alert mode
Alert mode successfully set
dropwatch> set sw true
setting software drops monitoring to 1
dropwatch> set hw true
setting hardware drops monitoring to 1
dropwatch> start
Enabling monitoring...
Kernel monitoring activated.
Issue Ctrl-C to stop monitoring
drop at: ttl_value_is_too_small (l3_drops)
origin: hardware
input port ifindex: 55
input port name: eth0
timestamp: Mon Aug 12 10:52:20 2019 445911505 nsec
protocol: 0x800
length: 142
original length: 142

drop at: ip6_mc_input+0x8b8/0xef8 (0xffffffff9e2bb0e8)
origin: software
input port ifindex: 4
timestamp: Mon Aug 12 10:53:37 2019 024444587 nsec
protocol: 0x86dd
length: 110
original length: 110

Future plans
============

* Provide more drop reasons as well as more metadata
* Add dropmon support to libpcap, so that tcpdump/tshark could
  specifically listen on dropmon traffic, instead of capturing all
  netlink packets via nlmon interface

Changes in v3:
* Place test with the rest of the netdevsim tests
* Fix test to load netdevsim module
* Move devlink helpers from the test to devlink_lib.sh. Will be used
  by mlxsw tests
* Re-order netdevsim includes in alphabetical order
* Fix reverse xmas tree in netdevsim
* Remove double include in netdevsim

Changes in v2:
* Use drop monitor to report dropped packets instead of devlink
* Add drop monitor patches
* Add test cases
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 281 insertions, 1 deletions

diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
index a570da406d1d..c217049552f7 100644
--- a/drivers/net/netdevsim/dev.c
+++ b/drivers/net/netdevsim/dev.c
@@ -17,11 +17,20 @@
 
 #include <linux/debugfs.h>
 #include <linux/device.h>
+#include <linux/etherdevice.h>
+#include <linux/inet.h>
+#include <linux/jiffies.h>
+#include <linux/kernel.h>
 #include <linux/list.h>
 #include <linux/mutex.h>
 #include <linux/random.h>
 #include <linux/rtnetlink.h>
+#include <linux/workqueue.h>
 #include <net/devlink.h>
+#include <net/ip.h>
+#include <uapi/linux/devlink.h>
+#include <uapi/linux/ip.h>
+#include <uapi/linux/udp.h>
 
 #include "netdevsim.h"
 
@@ -302,6 +311,218 @@ static void nsim_dev_dummy_region_exit(struct nsim_dev *nsim_dev)
         devlink_region_destroy(nsim_dev->dummy_region);
 }
 
+struct nsim_trap_item {
+        void *trap_ctx;
+        enum devlink_trap_action action;
+};
+
+struct nsim_trap_data {
+        struct delayed_work trap_report_dw;
+        struct nsim_trap_item *trap_items_arr;
+        struct nsim_dev *nsim_dev;
+        spinlock_t trap_lock;   /* Protects trap_items_arr */
+};
+
+/* All driver-specific traps must be documented in
+ * Documentation/networking/devlink-trap-netdevsim.rst
+ */
+enum {
+        NSIM_TRAP_ID_BASE = DEVLINK_TRAP_GENERIC_ID_MAX,
+        NSIM_TRAP_ID_FID_MISS,
+};
+
+#define NSIM_TRAP_NAME_FID_MISS "fid_miss"
+
+#define NSIM_TRAP_METADATA DEVLINK_TRAP_METADATA_TYPE_F_IN_PORT
+
+#define NSIM_TRAP_DROP(_id, _group_id)                                        \
+        DEVLINK_TRAP_GENERIC(DROP, DROP, _id,                                 \
+                             DEVLINK_TRAP_GROUP_GENERIC(_group_id),           \
+                             NSIM_TRAP_METADATA)
+#define NSIM_TRAP_EXCEPTION(_id, _group_id)                                   \
+        DEVLINK_TRAP_GENERIC(EXCEPTION, TRAP, _id,                            \
+                             DEVLINK_TRAP_GROUP_GENERIC(_group_id),           \
+                             NSIM_TRAP_METADATA)
+#define NSIM_TRAP_DRIVER_EXCEPTION(_id, _group_id)                            \
+        DEVLINK_TRAP_DRIVER(EXCEPTION, TRAP, NSIM_TRAP_ID_##_id,              \
+                            NSIM_TRAP_NAME_##_id,                             \
+                            DEVLINK_TRAP_GROUP_GENERIC(_group_id),            \
+                            NSIM_TRAP_METADATA)
+
+static const struct devlink_trap nsim_traps_arr[] = {
+        NSIM_TRAP_DROP(SMAC_MC, L2_DROPS),
+        NSIM_TRAP_DROP(VLAN_TAG_MISMATCH, L2_DROPS),
+        NSIM_TRAP_DROP(INGRESS_VLAN_FILTER, L2_DROPS),
+        NSIM_TRAP_DROP(INGRESS_STP_FILTER, L2_DROPS),
+        NSIM_TRAP_DROP(EMPTY_TX_LIST, L2_DROPS),
+        NSIM_TRAP_DROP(PORT_LOOPBACK_FILTER, L2_DROPS),
+        NSIM_TRAP_DRIVER_EXCEPTION(FID_MISS, L2_DROPS),
+        NSIM_TRAP_DROP(BLACKHOLE_ROUTE, L3_DROPS),
+        NSIM_TRAP_EXCEPTION(TTL_ERROR, L3_DROPS),
+        NSIM_TRAP_DROP(TAIL_DROP, BUFFER_DROPS),
+};
+
+#define NSIM_TRAP_L4_DATA_LEN 100
+
+static struct sk_buff *nsim_dev_trap_skb_build(void)
+{
+        int tot_len, data_len = NSIM_TRAP_L4_DATA_LEN;
+        struct sk_buff *skb;
+        struct udphdr *udph;
+        struct ethhdr *eth;
+        struct iphdr *iph;
+
+        skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
+        if (!skb)
+                return NULL;
+        tot_len = sizeof(struct iphdr) + sizeof(struct udphdr) + data_len;
+
+        eth = skb_put(skb, sizeof(struct ethhdr));
+        eth_random_addr(eth->h_dest);
+        eth_random_addr(eth->h_source);
+        eth->h_proto = htons(ETH_P_IP);
+        skb->protocol = htons(ETH_P_IP);
+
+        iph = skb_put(skb, sizeof(struct iphdr));
+        iph->protocol = IPPROTO_UDP;
+        iph->saddr = in_aton("192.0.2.1");
+        iph->daddr = in_aton("198.51.100.1");
+        iph->version = 0x4;
+        iph->frag_off = 0;
+        iph->ihl = 0x5;
+        iph->tot_len = htons(tot_len);
+        iph->ttl = 100;
+        ip_send_check(iph);
+
+        udph = skb_put_zero(skb, sizeof(struct udphdr) + data_len);
+        get_random_bytes(&udph->source, sizeof(u16));
+        get_random_bytes(&udph->dest, sizeof(u16));
+        udph->len = htons(sizeof(struct udphdr) + data_len);
+
+        return skb;
+}
+
+static void nsim_dev_trap_report(struct nsim_dev_port *nsim_dev_port)
+{
+        struct nsim_dev *nsim_dev = nsim_dev_port->ns->nsim_dev;
+        struct devlink *devlink = priv_to_devlink(nsim_dev);
+        struct nsim_trap_data *nsim_trap_data;
+        int i;
+
+        nsim_trap_data = nsim_dev->trap_data;
+
+        spin_lock(&nsim_trap_data->trap_lock);
+        for (i = 0; i < ARRAY_SIZE(nsim_traps_arr); i++) {
+                struct nsim_trap_item *nsim_trap_item;
+                struct sk_buff *skb;
+
+                nsim_trap_item = &nsim_trap_data->trap_items_arr[i];
+                if (nsim_trap_item->action == DEVLINK_TRAP_ACTION_DROP)
+                        continue;
+
+                skb = nsim_dev_trap_skb_build();
+                if (!skb)
+                        continue;
+                skb->dev = nsim_dev_port->ns->netdev;
+
+                /* Trapped packets are usually passed to devlink in softIRQ,
+                 * but in this case they are generated in a workqueue. Disable
+                 * softIRQs to prevent lockdep from complaining about
+                 * "incosistent lock state".
+                 */
+                local_bh_disable();
+                devlink_trap_report(devlink, skb, nsim_trap_item->trap_ctx,
+                                    &nsim_dev_port->devlink_port);
+                local_bh_enable();
+                consume_skb(skb);
+        }
+        spin_unlock(&nsim_trap_data->trap_lock);
+}
+
+#define NSIM_TRAP_REPORT_INTERVAL_MS    100
+
+static void nsim_dev_trap_report_work(struct work_struct *work)
+{
+        struct nsim_trap_data *nsim_trap_data;
+        struct nsim_dev_port *nsim_dev_port;
+        struct nsim_dev *nsim_dev;
+
+        nsim_trap_data = container_of(work, struct nsim_trap_data,
+                                      trap_report_dw.work);
+        nsim_dev = nsim_trap_data->nsim_dev;
+
+        /* For each running port and enabled packet trap, generate a UDP
+         * packet with a random 5-tuple and report it.
+         */
+        mutex_lock(&nsim_dev->port_list_lock);
+        list_for_each_entry(nsim_dev_port, &nsim_dev->port_list, list) {
+                if (!netif_running(nsim_dev_port->ns->netdev))
+                        continue;
+
+                nsim_dev_trap_report(nsim_dev_port);
+        }
+        mutex_unlock(&nsim_dev->port_list_lock);
+
+        schedule_delayed_work(&nsim_dev->trap_data->trap_report_dw,
+                              msecs_to_jiffies(NSIM_TRAP_REPORT_INTERVAL_MS));
+}
+
+static int nsim_dev_traps_init(struct devlink *devlink)
+{
+        struct nsim_dev *nsim_dev = devlink_priv(devlink);
+        struct nsim_trap_data *nsim_trap_data;
+        int err;
+
+        nsim_trap_data = kzalloc(sizeof(*nsim_trap_data), GFP_KERNEL);
+        if (!nsim_trap_data)
+                return -ENOMEM;
+
+        nsim_trap_data->trap_items_arr = kcalloc(ARRAY_SIZE(nsim_traps_arr),
+                                                 sizeof(struct nsim_trap_item),
+                                                 GFP_KERNEL);
+        if (!nsim_trap_data->trap_items_arr) {
+                err = -ENOMEM;
+                goto err_trap_data_free;
+        }
+
+        /* The lock is used to protect the action state of the registered
+         * traps. The value is written by user and read in delayed work when
+         * iterating over all the traps.
+         */
+        spin_lock_init(&nsim_trap_data->trap_lock);
+        nsim_trap_data->nsim_dev = nsim_dev;
+        nsim_dev->trap_data = nsim_trap_data;
+
+        err = devlink_traps_register(devlink, nsim_traps_arr,
+                                     ARRAY_SIZE(nsim_traps_arr), NULL);
+        if (err)
+                goto err_trap_items_free;
+
+        INIT_DELAYED_WORK(&nsim_dev->trap_data->trap_report_dw,
+                          nsim_dev_trap_report_work);
+        schedule_delayed_work(&nsim_dev->trap_data->trap_report_dw,
+                              msecs_to_jiffies(NSIM_TRAP_REPORT_INTERVAL_MS));
+
+        return 0;
+
+err_trap_items_free:
+        kfree(nsim_trap_data->trap_items_arr);
+err_trap_data_free:
+        kfree(nsim_trap_data);
+        return err;
+}
+
+static void nsim_dev_traps_exit(struct devlink *devlink)
+{
+        struct nsim_dev *nsim_dev = devlink_priv(devlink);
+
+        cancel_delayed_work_sync(&nsim_dev->trap_data->trap_report_dw);
+        devlink_traps_unregister(devlink, nsim_traps_arr,
+                                 ARRAY_SIZE(nsim_traps_arr));
+        kfree(nsim_dev->trap_data->trap_items_arr);
+        kfree(nsim_dev->trap_data);
+}
+
 static int nsim_dev_reload(struct devlink *devlink,
                            struct netlink_ext_ack *extack)
 {
@@ -369,9 +590,61 @@ static int nsim_dev_flash_update(struct devlink *devlink, const char *file_name,
         return 0;
 }
 
+static struct nsim_trap_item *
+nsim_dev_trap_item_lookup(struct nsim_dev *nsim_dev, u16 trap_id)
+{
+        struct nsim_trap_data *nsim_trap_data = nsim_dev->trap_data;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(nsim_traps_arr); i++) {
+                if (nsim_traps_arr[i].id == trap_id)
+                        return &nsim_trap_data->trap_items_arr[i];
+        }
+
+        return NULL;
+}
+
+static int nsim_dev_devlink_trap_init(struct devlink *devlink,
+                                      const struct devlink_trap *trap,
+                                      void *trap_ctx)
+{
+        struct nsim_dev *nsim_dev = devlink_priv(devlink);
+        struct nsim_trap_item *nsim_trap_item;
+
+        nsim_trap_item = nsim_dev_trap_item_lookup(nsim_dev, trap->id);
+        if (WARN_ON(!nsim_trap_item))
+                return -ENOENT;
+
+        nsim_trap_item->trap_ctx = trap_ctx;
+        nsim_trap_item->action = trap->init_action;
+
+        return 0;
+}
+
+static int
+nsim_dev_devlink_trap_action_set(struct devlink *devlink,
+                                 const struct devlink_trap *trap,
+                                 enum devlink_trap_action action)
+{
+        struct nsim_dev *nsim_dev = devlink_priv(devlink);
+        struct nsim_trap_item *nsim_trap_item;
+
+        nsim_trap_item = nsim_dev_trap_item_lookup(nsim_dev, trap->id);
+        if (WARN_ON(!nsim_trap_item))
+                return -ENOENT;
+
+        spin_lock(&nsim_dev->trap_data->trap_lock);
+        nsim_trap_item->action = action;
+        spin_unlock(&nsim_dev->trap_data->trap_lock);
+
+        return 0;
+}
+
 static const struct devlink_ops nsim_dev_devlink_ops = {
         .reload = nsim_dev_reload,
         .flash_update = nsim_dev_flash_update,
+        .trap_init = nsim_dev_devlink_trap_init,
+        .trap_action_set = nsim_dev_devlink_trap_action_set,
 };
 
 #define NSIM_DEV_MAX_MACS_DEFAULT 32
@@ -421,10 +694,14 @@ nsim_dev_create(struct nsim_bus_dev *nsim_bus_dev, unsigned int port_count)
         if (err)
                 goto err_params_unregister;
 
-        err = nsim_dev_debugfs_init(nsim_dev);
+        err = nsim_dev_traps_init(devlink);
         if (err)
                 goto err_dummy_region_exit;
 
+        err = nsim_dev_debugfs_init(nsim_dev);
+        if (err)
+                goto err_traps_exit;
+
         err = nsim_bpf_dev_init(nsim_dev);
         if (err)
                 goto err_debugfs_exit;
@@ -434,6 +711,8 @@ nsim_dev_create(struct nsim_bus_dev *nsim_bus_dev, unsigned int port_count)
 
 err_debugfs_exit:
         nsim_dev_debugfs_exit(nsim_dev);
+err_traps_exit:
+        nsim_dev_traps_exit(devlink);
 err_dummy_region_exit:
         nsim_dev_dummy_region_exit(nsim_dev);
 err_params_unregister:
@@ -456,6 +735,7 @@ static void nsim_dev_destroy(struct nsim_dev *nsim_dev)
 
         nsim_bpf_dev_exit(nsim_dev);
         nsim_dev_debugfs_exit(nsim_dev);
+        nsim_dev_traps_exit(devlink);
         nsim_dev_dummy_region_exit(nsim_dev);
         devlink_params_unregister(devlink, nsim_devlink_params,
                                   ARRAY_SIZE(nsim_devlink_params));