The current set selection simply choses the first set type that provides the requested features, which always results in the rbtree being chosen by virtue of being the first set in the list. What we actually want to do is choose the implementation that can provide the requested features and is optimal from either a performance or memory perspective depending on the characteristics of the elements and the preferences specified by the user. The elements are not known when creating a set. Even if we would provide them for anonymous (literal) sets, we'd still have standalone sets where the elements are not known in advance. We therefore need an abstract description of the data charcteristics. The kernel already knows the size of the key, this patch starts by introducing a nested set description which so far contains only the maximum amount of elements. Based on this the set implementations are changed to provide an estimate of the required amount of memory and the lookup complexity class. The set ops have a new callback ->estimate() that is invoked during set selection. It receives a structure containing the attributes known to the kernel and is supposed to populate a struct nft_set_estimate with the complexity class and, in case the size is known, the complete amount of memory required, or the amount of memory required per element otherwise. Based on the policy specified by the user (performance/memory, defaulting to performance) the kernel will then select the best suited implementation. Even if the set implementation would allow to add more than the specified maximum amount of elements, they are enforced since new implementations might not be able to add more than maximum based on which they were selected.
Showing the changes to include/uapi/linux (1 of 5 files). Show all
Unified · Split
| @@ -211,6 +211,29 @@ enum nft_set_flags { · 210 unmodified lines | |||
| 211 | NFT_SET_MAP = 0x8, | 211 | NFT_SET_MAP = 0x8, |
| 212 | }; | 212 | }; |
| 213 | 213 | ||
| 214 | /** | ||
| 215 | * enum nft_set_policies - set selection policy | ||
| 216 | * | ||
| 217 | * @NFT_SET_POL_PERFORMANCE: prefer high performance over low memory use | ||
| 218 | * @NFT_SET_POL_MEMORY: prefer low memory use over high performance | ||
| 219 | */ | ||
| 220 | enum nft_set_policies { | ||
| 221 | NFT_SET_POL_PERFORMANCE, | ||
| 222 | NFT_SET_POL_MEMORY, | ||
| 223 | }; | ||
| 224 | |||
| 225 | /** | ||
| 226 | * enum nft_set_desc_attributes - set element description | ||
| 227 | * | ||
| 228 | * @NFTA_SET_DESC_SIZE: number of elements in set (NLA_U32) | ||
| 229 | */ | ||
| 230 | enum nft_set_desc_attributes { | ||
| 231 | NFTA_SET_DESC_UNSPEC, | ||
| 232 | NFTA_SET_DESC_SIZE, | ||
| 233 | __NFTA_SET_DESC_MAX | ||
| 234 | }; | ||
| 235 | #define NFTA_SET_DESC_MAX (__NFTA_SET_DESC_MAX - 1) | ||
| 236 | |||
| 214 | /** | 237 | /** |
| 215 | * enum nft_set_attributes - nf_tables set netlink attributes | 238 | * enum nft_set_attributes - nf_tables set netlink attributes |
| 216 | * | 239 | * |
| @@ -221,6 +244,8 @@ enum nft_set_flags { · 4 unmodified lines | |||
| 221 | * @NFTA_SET_KEY_LEN: key data length (NLA_U32) | 244 | * @NFTA_SET_KEY_LEN: key data length (NLA_U32) |
| 222 | * @NFTA_SET_DATA_TYPE: mapping data type (NLA_U32) | 245 | * @NFTA_SET_DATA_TYPE: mapping data type (NLA_U32) |
| 223 | * @NFTA_SET_DATA_LEN: mapping data length (NLA_U32) | 246 | * @NFTA_SET_DATA_LEN: mapping data length (NLA_U32) |
| 247 | * @NFTA_SET_POLICY: selection policy (NLA_U32) | ||
| 248 | * @NFTA_SET_DESC: set description (NLA_NESTED) | ||
| 224 | */ | 249 | */ |
| 225 | enum nft_set_attributes { | 250 | enum nft_set_attributes { |
| 226 | NFTA_SET_UNSPEC, | 251 | NFTA_SET_UNSPEC, |
| @@ -231,6 +256,8 @@ enum nft_set_attributes { · 4 unmodified lines | |||
| 231 | NFTA_SET_KEY_LEN, | 256 | NFTA_SET_KEY_LEN, |
| 232 | NFTA_SET_DATA_TYPE, | 257 | NFTA_SET_DATA_TYPE, |
| 233 | NFTA_SET_DATA_LEN, | 258 | NFTA_SET_DATA_LEN, |
| 259 | NFTA_SET_POLICY, | ||
| 260 | NFTA_SET_DESC, | ||
| 234 | __NFTA_SET_MAX | 261 | __NFTA_SET_MAX |
| 235 | }; | 262 | }; |
| 236 | #define NFTA_SET_MAX (__NFTA_SET_MAX - 1) | 263 | #define NFTA_SET_MAX (__NFTA_SET_MAX - 1) |