DPDK数据流过滤规则例程解析—— 网卡流处理功能窥探

素颜马尾好姑娘i 2021-12-14 10:29 611阅读 0赞

本文转载自DPDK与SPDK社区

当前的高性能网卡通常都支持对数据流的定向和过滤功能，可通过配置将指定的数据流定向到指定的设备队列中，并且如果监听此队列的核心正是运行处理此数据流的应用所在核心，将获得一定的性能优势。另外网卡的流过滤功能还可设定丢弃指定的流，可实现在硬件层面屏蔽非法的访问等，而不需要处理器的干预。DPDK的示例flow\_filtering演示第一种流定向功能。

[![001.jpg][]][001.jpg]

该示例flow\_filtering用于配置网卡的流过滤规则，完成匹配数据流的设备队列定向功能。主函数是通用的初始化流程：包括EAL初始化，分配存储mbuf的内存池mempool，初始化接口init\_port函数。DPDK的此示例使用一个port接口就可运行。随后调用完成流规则配置的函数generate\_ipv4\_flow。当然网卡的流过滤规则除了本示例的队列定向功能，还有其它的功能，比如丢弃匹配的流等

函数generate\_ipv4\_flow完成流规则配置功能，其实现将设定的数据流定向到指定的设备队列中。由以下的四个宏定义可知，本示例要定向的流为：源IP地址为0.0.0.0，mask为空EMPTY\_MASK（0），即不区分源IP，目的IP地址为192.168.1.1，掩码为FULL\_MASK（0xffffffff）。即所有目的地址为192.168.1.1的数据流，定向到设备的队列1中（selected\_queue）。

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 </td> 
 <td> static uint8_t selected_queue = 1; #define SRC_IP ((0&lt;&lt;24) + (0&lt;&lt;16) + (0&lt;&lt;8) + 0)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /* src ip = 0.0.0.0 */ #define DEST_IP ((192&lt;&lt;24) + (168&lt;&lt;16) + (1&lt;&lt;8) + 1)&nbsp;&nbsp;/* dest ip = 192.168.1.1 */ #define FULL_MASK 0xffffffff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/* full mask */ #define EMPTY_MASK 0x0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/* empty mask */ </td> 
 </tr> 
 </tbody> 
</table>

**首先**，设置流的属性rte\_flow\_attr为ingress，即要操作的数据流为接收方向。

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 </td> 
 <td> struct rte_flow *generate_ipv4_flow(uint16_t port_id, uint16_t rx_q, uint32_t src_ip, uint32_t src_mask, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;uint32_t dest_ip, uint32_t dest_mask, struct rte_flow_error *error) { &nbsp;&nbsp;&nbsp;&nbsp;struct rte_flow_attr attr; &nbsp;&nbsp;&nbsp;&nbsp;struct rte_flow_item pattern[MAX_PATTERN_NUM]; &nbsp;&nbsp;&nbsp;&nbsp;struct rte_flow_action action[MAX_ACTION_NUM]; &nbsp;&nbsp;&nbsp;&nbsp;struct rte_flow *flow = NULL; &nbsp;&nbsp;&nbsp;&nbsp;struct rte_flow_action_queue queue = { .index = rx_q }; &nbsp;&nbsp;&nbsp;&nbsp;struct rte_flow_item_ipv4 ip_spec; &nbsp;&nbsp;&nbsp;&nbsp;struct rte_flow_item_ipv4 ip_mask; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;/* set the rule attribute. in this case only ingress packets will be checked. */ &nbsp;&nbsp;&nbsp;&nbsp;memset(&amp;attr, 0, sizeof(struct rte_flow_attr)); &nbsp;&nbsp;&nbsp;&nbsp;attr.ingress = 1; </td> 
 </tr> 
 </tbody> 
</table>

**第二**，设置流规则匹配之后，接下来定义采取的动作action，此处为RTE\_FLOW\_ACTION\_TYPE\_QUEUE，即匹配后定向到指定的设备队列中。另外，如果要实现丢弃匹配流的功能，动作类型应设定为RTE\_FLOW\_ACTION\_TYPE\_DROP，此示例中不涉及。

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 </td> 
 <td> /* create the action sequence. one action only,&nbsp;&nbsp;move packet to queue */ &nbsp;&nbsp;&nbsp;&nbsp;action[0].type = RTE_FLOW_ACTION_TYPE_QUEUE; &nbsp;&nbsp;&nbsp;&nbsp;action[0].conf = &amp;queue; &nbsp;&nbsp;&nbsp;&nbsp;action[1].type = RTE_FLOW_ACTION_TYPE_END; </td> 
 </tr> 
 </tbody> 
</table>

**第三**，设置流规则匹配的模式序列pattern，由于此处最终匹配的为一个IPv4目的地址192.168.1.1，设置第一级匹配模式为以太网数据类型RTE\_FLOW\_ITEM\_TYPE\_ETH。第二级匹配模式设置为源IP/掩码和目的IP/掩码，类型为IPv4（RTE\_FLOW\_ITEM\_TYPE\_IPV4）。

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 </td> 
 <td> /* set the first level of the pattern (ETH). since in this example we just want to get the ipv4 we set this level to allow all. */ &nbsp;&nbsp;&nbsp;&nbsp;pattern[0].type = RTE_FLOW_ITEM_TYPE_ETH; &nbsp;&nbsp;&nbsp;&nbsp;/* &nbsp;&nbsp;&nbsp;&nbsp; * setting the second level of the pattern (IP). in this example this is the level we care about so we set it according to the parameters. &nbsp;&nbsp;&nbsp;&nbsp; */ &nbsp;&nbsp;&nbsp;&nbsp;memset(&amp;ip_spec, 0, sizeof(struct rte_flow_item_ipv4)); &nbsp;&nbsp;&nbsp;&nbsp;memset(&amp;ip_mask, 0, sizeof(struct rte_flow_item_ipv4)); &nbsp;&nbsp;&nbsp;&nbsp;ip_spec.hdr.dst_addr = htonl(dest_ip); &nbsp;&nbsp;&nbsp;&nbsp;ip_mask.hdr.dst_addr = dest_mask; &nbsp;&nbsp;&nbsp;&nbsp;ip_spec.hdr.src_addr = htonl(src_ip); &nbsp;&nbsp;&nbsp;&nbsp;ip_mask.hdr.src_addr = src_mask; &nbsp;&nbsp;&nbsp;&nbsp;pattern[1].type = RTE_FLOW_ITEM_TYPE_IPV4; &nbsp;&nbsp;&nbsp;&nbsp;pattern[1].spec = &amp;ip_spec; &nbsp;&nbsp;&nbsp;&nbsp;pattern[1].mask = &amp;ip_mask; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;/* the final level must be always type end */ &nbsp;&nbsp;&nbsp;&nbsp;pattern[2].type = RTE_FLOW_ITEM_TYPE_END; </td> 
 </tr> 
 </tbody> 
</table>

**第四**，以上流规则的参数都已设置完成。此处调用rte\_flow\_validate函数验证参数配置的是否正确。该函数实现位于文件lib/librte\_ethdev/rte\_flow.c中，其获取设备的流规则处理函数集rte\_flow\_ops，调用其中的validate函数。例如对于INTEL的IXGBE网卡驱动设备而言，validate函数指针指向ixgbe\_flow\_validate函数，其实现位于文件drivers/net/ixgbe/ixgbe\_flow.c中。此函数也仅是检查定义的流规则参数网卡是否支持，例如IXGBE网卡就不支持MAC流识别，以及检查参数中指定的队列号是否超出设备支持的最大队列值等，但是并不确保通过validate检查的flow流规则参数一定能最终设置成功，因为网卡中存储流规则的内存可能已满。

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 </td> 
 <td> int rte_flow_validate(uint16_t port_id, const struct rte_flow_attr *attr, const struct rte_flow_item pattern[], &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;const struct rte_flow_action actions[], struct rte_flow_error *error) {&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;const struct rte_flow_ops *ops = rte_flow_ops_get(port_id, error); &nbsp;&nbsp;&nbsp;&nbsp;struct rte_eth_dev *dev = &amp;rte_eth_devices[port_id]; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;if (unlikely(!ops)) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return -rte_errno; &nbsp;&nbsp;&nbsp;&nbsp;if (likely(!!ops-&gt;validate)) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return flow_err(port_id, ops-&gt;validate(dev, attr, pattern, actions, error), error); &nbsp;&nbsp;&nbsp;&nbsp;return rte_flow_error_set(error, ENOSYS, RTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL, rte_strerror(ENOSYS)); </td> 
 </tr> 
 </tbody> 
</table>

**第五**，调用函数rte\_flow\_create创建流规则，其实现位于文件lib/librte\_ethdev/rte\_flow.c中，与以上的函数rte\_flow\_validate类似，其也是封装了具体的网络设备的流规则创建函数create。还是以INTEL的IXGBE驱动为例，其流规则创建函数为ixgbe\_flow\_create，位于文件drivers/net/ixgbe/ixgbe\_flow.c。主要工作时将设定的流规则写入网卡硬件中。

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 </td> 
 <td> struct rte_flow *rte_flow_create(uint16_t port_id, const struct rte_flow_attr *attr, const struct rte_flow_item pattern[], &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;const struct rte_flow_action actions[], struct rte_flow_error *error) {&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;struct rte_eth_dev *dev = &amp;rte_eth_devices[port_id]; &nbsp;&nbsp;&nbsp;&nbsp;struct rte_flow *flow; &nbsp;&nbsp;&nbsp;&nbsp;const struct rte_flow_ops *ops = rte_flow_ops_get(port_id, error); &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;if (unlikely(!ops)) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return NULL; &nbsp;&nbsp;&nbsp;&nbsp;if (likely(!!ops-&gt;create)) { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;flow = ops-&gt;create(dev, attr, pattern, actions, error); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (flow == NULL) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;flow_err(port_id, -rte_errno, error); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return flow; &nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;&nbsp;&nbsp;rte_flow_error_set(error, ENOSYS, RTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL, rte_strerror(ENOSYS)); &nbsp;&nbsp;&nbsp;&nbsp;return NULL; </td> 
 </tr> 
 </tbody> 
</table>

示例flow\_filtering使用的主要是网卡的Flow Director功能。对于INTEL的网卡82599的IXGBE驱动而言，函数ixgbe\_parse\_fdir\_filter\_normal用来解析上层设置的流规则参数，首先因为在之前的匹配模型pattern中并未设置类型为RTE\_FLOW\_ITEM\_TYPE\_FUZZY的规则，signature\_match不成立，此处使用RTE\_FDIR\_MODE\_PERFECT类型匹配规则。其次由于匹配模式链中第一个指定的为RTE\_FLOW\_ITEM\_TYPE\_ETH类型，但是并没有指定相应的spec和mask，所以IXGBE驱动不做处理，跳到下一个pattern。最后的pattern类型设置的为RTE\_FLOW\_ITEM\_TYPE\_IPV4，即将之前设置的源和目的IP地址赋予规则的ixgbe\_fdir.formatted结构的成员src\_ip\[0\]和dst\_ip\[0\]，将掩码赋予mask.dst\_ipv4\_mask和mask.src\_ipv4\_mask变量。

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 </td> 
 <td> static int ixgbe_parse_fdir_filter_normal(struct rte_eth_dev *dev, const struct rte_flow_attr *attr, const struct rte_flow_item pattern[], &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; const struct rte_flow_action actions[], struct ixgbe_fdir_rule *rule, struct rte_flow_error *error) { &nbsp;&nbsp;&nbsp;&nbsp;if (signature_match(pattern)) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rule-&gt;mode = RTE_FDIR_MODE_SIGNATURE; &nbsp;&nbsp;&nbsp;&nbsp;else &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rule-&gt;mode = RTE_FDIR_MODE_PERFECT; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;if (item-&gt;type == RTE_FLOW_ITEM_TYPE_ETH) { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/*** If both spec and mask are item, it means don't care about ETH. Do nothing. */ &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/** Check if the next not void item is vlan or ipv4. IPv6 is not supported. */ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;item = next_no_fuzzy_pattern(pattern, item); &nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;&nbsp;&nbsp;if (item-&gt;type == RTE_FLOW_ITEM_TYPE_IPV4) { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/** Set the flow type even if there's no content as we must have a flow type. */ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rule-&gt;ixgbe_fdir.formatted.flow_type = IXGBE_ATR_FLOW_TYPE_IPV4; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rule-&gt;b_mask = TRUE; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ipv4_mask = item-&gt;mask; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rule-&gt;mask.dst_ipv4_mask = ipv4_mask-&gt;hdr.dst_addr; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rule-&gt;mask.src_ipv4_mask = ipv4_mask-&gt;hdr.src_addr; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (item-&gt;spec) { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rule-&gt;b_spec = TRUE; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ipv4_spec = item-&gt;spec; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rule-&gt;ixgbe_fdir.formatted.dst_ip[0] = ipv4_spec-&gt;hdr.dst_addr; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rule-&gt;ixgbe_fdir.formatted.src_ip[0] = ipv4_spec-&gt;hdr.src_addr; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;&nbsp;&nbsp;return ixgbe_parse_fdir_act_attr(attr, actions, rule, error); } </td> 
 </tr> 
 </tbody> 
</table>

最后的函数ixgbe\_parse\_fdir\_act\_attr负责解析配置的动作action，此处为将配置的设备队列号赋值到规则的queue变量中。以上可见驱动函数ixgbe\_parse\_fdir\_filter\_normal正好对应之前的配置函数generate\_ipv4\_flow。解析完成之后得到一个初始化完成的ixgbe\_fdir\_rule结构，由函数ixgbe\_fdir\_set\_input\_mask和ixgbe\_fdir\_filter\_program函数写入网卡的Flow Director相关硬件寄存器中。INTEL的82599网卡最多支持8K-2个RTE\_FDIR\_MODE\_PERFECT类型的流规则过滤器，详情请见82599数据手册：[https://www.intel.cn/content/www/cn/zh/embedded/products/networking/82599-10-gbe-controller-datasheet.html][https_www.intel.cn_content_www_cn_zh_embedded_products_networking_82599-10-gbe-controller-datasheet.html]。

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 </td> 
 <td> static int ixgbe_parse_fdir_act_attr(const struct rte_flow_attr *attr, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;const struct rte_flow_action actions[], struct ixgbe_fdir_rule *rule, struct rte_flow_error *error) { &nbsp;&nbsp;&nbsp;&nbsp;if (act-&gt;type == RTE_FLOW_ACTION_TYPE_QUEUE) { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;act_q = (const struct rte_flow_action_queue *)act-&gt;conf; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rule-&gt;queue = act_q-&gt;index; &nbsp;&nbsp;&nbsp;&nbsp;} } </td> 
 </tr> 
 </tbody> 
</table>

示例程序flow\_filtering的最后，调用main\_loop函数，从设备的所有队列中接收数据，并且打印接收到数据的源和目的IP地址，以及接收的设备队列编号。根据此打印信息可确认之前的流规则是否生效。应观察到目的IP地址为192.168.1.1的数据包都由队列1接收到。

<table> 
 <tbody> 
 <tr> 
 <td> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 </td> 
 <td> static void main_loop(void) { &nbsp;&nbsp;&nbsp;&nbsp;while (!force_quit) { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;for (i = 0; i &lt; nr_queues; i++) { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;nb_rx = rte_eth_rx_burst(port_id, i, mbufs, 32); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (nb_rx) { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;for (j = 0; j &lt; nb_rx; j++) { &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;struct rte_mbuf *m = mbufs[j]; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;eth_hdr = rte_pktmbuf_mtod(m, struct ether_hdr *); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print_ether_addr("src=", &amp;eth_hdr-&gt;s_addr); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;print_ether_addr(" - dst=", &amp;eth_hdr-&gt;d_addr); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;printf(" - queue=0x%x", (unsigned int)i); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;printf("\n"); &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;rte_pktmbuf_free(m); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;&nbsp;&nbsp;} } </td> 
 </tr> 
 </tbody> 
</table>

最后，对于Linux而言，可使用ethtool工具配置以上的流规则。如下的命令依次为开启网卡设备的流规则功能；查看开启状态；配置目的IP地址为192.168.1.1的流定向到队列1中，查看流规则列表；最后为删除流规则的命令。更多ethtool配置可查看其帮助信息。

[001.jpg]: /images/20211214/7c406b5b91204a6eb74e77d2314cb3fc.png
[https_www.intel.cn_content_www_cn_zh_embedded_products_networking_82599-10-gbe-controller-datasheet.html]: https://www.intel.cn/content/www/cn/zh/embedded/products/networking/82599-10-gbe-controller-datasheet.html