Jesse Gross [Thu, 2 May 2013 17:14:54 +0000 (10:14 -0700)]
datapath: Immediately exit on error in ovs_vport_cmd_set().
It is an error to try to change the type of a vport using the set
command. However, while we check that this is an error, we still
proceed to allocate memory which then gets freed immediately.
This stops processing after noticing the error, which does not
actually fix a bug but is more correct.
Signed-off-by: Jesse Gross <jesse@nicira.com> Acked-by: Pravin B Shelar <pshelar@nicira.com>
Ben Pfaff [Thu, 2 May 2013 00:08:20 +0000 (17:08 -0700)]
dpif-linux: Close channel Netlink sockets when a port number gets recycled.
When ovs-vswitchd deletes a port with dpif_linux_port_del(), that function
uses del_channel() to delete the corresponding channel, including closing
its Netlink socket fd. However, if the vport gets removed by some other
process (e.g. "ip link delete" for veths) then this function never gets
called and thus the channel never gets deleted.
This commit partially fixes the problem. Now, if a port number gets
reused, add_channel() closes the old Netlink socket assigned to that port
before it installs the new one.
Bug #16784. Reported-by: Paul Ingram <paul@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
Ben Pfaff [Wed, 1 May 2013 23:54:18 +0000 (16:54 -0700)]
dpif-linux: Use MAX_PORTS instead of hard-coded 65535.
MAX_PORTS is currently USHRT_MAX (also 65535). I think that's a
coincidence; I don't remember MAX_PORTS being mentioned when the new
dpif_channel code was written.
Ben Pfaff [Tue, 30 Apr 2013 18:24:11 +0000 (11:24 -0700)]
ofproto-dpif: Fix 'size' argument to fix_sflow_action().
The sflow action only uses 8 bytes of the total 16 for user_action_cookie,
but fix_sflow_action() was checking for the presence of all 16, so if the
sflow action wasn't followed by a few other actions then 'cookie' would
end up NULL and the assertion would segfault.
Bug #16659. Reported-by: Dhaval Badiani <dbadiani@vmware.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
worker: Prevent worker from being responsible for pidfile deletion.
Currently we are creating the worker process after creation of the pidfile.
This means that the responsibility of deleting the pidfile after process
termination rests with the worker process.
When we restart openvswitch using the startup scripts, we SIGTERM the main
process and once it is cleaned up, we start ovs-vswitchd again. This results
in a race condition. The new ovs-vswitchd will create a pidfile because it is
unlocked. But, if the old worker process exits after the start of new
ovs-vswitchd, it will simply delete the pidfile underneath the new ovs-vswitchd.
This will eventually result in multiple ovs-vswitchd daemons.
This patch gives the responsibility of deleting the pidfile to the main
process.
vswitchd: Disable system stats collection on a concurrently running daemon.
There are very rare cases (ex: ovs-vswitchd.pid is inadvertantly deleted),
when multiple ovs-vswitchd daemons can end up running at the same time.
In a situation like that one of the daemons can wait on the poll()
with a 0 ms wait time as it would be expecting system stats to be collected.
But system stats are never run for the daemon that does not have the
lock on the database and hence it takes up 100% of the CPU if its state
machine for stats collection previously was S_WAITING.
With this patch, we disable the system stats collection for the daemon that
does not have the database lock. When it eventually gets the lock on the
database, system stats are automatically enabled if other_config:\
enable-statistics=true.
Add FAQ entries around the VXLAN support in Open vSwitch.
Add a section to the FAQ explaining VXLAN with a pointer to the IETF draft.
Add sections detailing how much of the VXLAN protocol is currently supported
in OVS, along with a section explaining the default UDP port and how to change
this when creating VXLAN ports.
bridge: Report PID of yielding process when multiple instances run.
Normally, the daemon code will detect when multiple instances are run
and print the conflicting PID. However, if ovs-vswitchd is not run in
daemon mode or the pidfile is removed, a database lock is checked. The
message it prints wasn't specific enough about which process was backing
off due to not getting the lock.
Thomas Graf [Thu, 25 Apr 2013 12:28:16 +0000 (14:28 +0200)]
datapath: Account for RHEL6.4 backports in compat layer
Explicitly check the availability of several kernel API functions
instead of relying on the kernel version to account for Red Hat
Enterprise Linux backports.
Signed-off-by: Thomas Graf <tgraf@redhat.com> Signed-off-by: Jesse Gross <jesse@nicira.com>
Thomas Graf [Thu, 25 Apr 2013 12:28:15 +0000 (14:28 +0200)]
datapath: Use openvswitch_handle_frame hook in >=RHEL6.4 to live side by side with bridging
Due to the missing register rx_handler API in the kernel RHEL6 is
based on, the datapath currently falls back to using the bridging
hook with the consequence that bridging and OVS cannot be used in
parallel on any RHEL6 release.
For this purpose, >=RHEL6.4 releases provide a special rx frame hook
to be used by OVS. It captures frames at the same location in the
stack as the rx_handler would do in more recent kernel releases. In
order to store the vport pointer, the net_device's ax25_ptr field is
utilized under the assumption that an AX25 device will never be
attached to an OVS bridge.
Signed-off-by: Thomas Graf <tgraf@redhat.com> Signed-off-by: Jesse Gross <jesse@nicira.com>
Simon Horman [Wed, 24 Apr 2013 09:02:35 +0000 (18:02 +0900)]
match: Correct formatting of MPLS
1. mpls or mplsm should be included in the formatted match instead of
dl_type=0xXXXX if the dl_type of the match is ETH_TYPE_MPLS or
ETH_TYPE_MPLS_MCAST respectively. This is consistent with the treatment
of other dl_types in match_format().
2. Add formatting of MPLS TTL to match_format().
The format is mpls_ttl=YY.
3. Set the mpls_lse mask of a match to all 1's if
the dl_type of the flow is ETH_TYPE_MPLS or ETH_TYPE_MPLS_MCAST.
This will cause mpls_label=LLLL,mpls_tc=W,mpls_ttl=YY,mpls_bos=Z to
be included with the match is formatted.
4. mpls(label:LLLL,tc:W,ttl:TT,bos:Z) and
mplsm(label:LLLL,tc:W,ttl:TT,bos:Z) should not be included
in a formatted match as this is not consistent with the
formatting of other match elements.
Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Ben Pfaff <blp@nicira.com>
debian: force-reload-kmod while package upgrading.
Currently, when we upgrade openvswitch packages, we do a restart
of userspace daemons automatically. This does not replace the
kernel module.
But almost everytime, we want to use the new kernel module
that comes with the new version. This means that we need to
manually do a "force-reload-kmod". This step, reloads the
kernel module and also restarts the userspace daemons. This gives
us a total of two restarts of userspace daemons. This is quite
expensive in a hypervisor with hundreds of VMs sending real traffic.
This also hurts the controller as it gets two reconnections in a short
amount of time.
With this patch, during a package upgrade, if the kernel module
on disk is different than the one that is loaded, we will
automatically do a force-reload-kmod while openvswitch-switch
is installed. If not, we will just do a "restart" like before.
One can install the kernel package first and then install the userspace
packages in 2 separate steps to enforce a single 'force-reload-kmod'.
If anyone wants to just restart the userspace package instead of
force-reload-kmod, they can set the value of OVS_FORCE_RELOAD_KMOD=no
while installing the package.
Ex: OVS_FORCE_RELOAD_KMOD=no dpkg -i openvswitch-switch*
INSTALL.Debian: Update instructions related to package ordering.
If we install the userspace packages first, without a kernel module
present in the correct path, we get an error because package install
automatically tries to start the userspace daemons and we look for
a kernel module to load.
Installing a kernel module package first and then following it by
userspace package sounds like the correct way to do it. This change
in ordering helps my next commit.
Define a new NXAST_SAMPLE OpenFlow vendor action and the corresponding
OFPACT_SAMPLE OVS action, to do per-flow packet sampling, translated
into a new SAMPLE "flow_sample" dp action.
Make the userspace action's userdata size vary depending on the union
member used. Add a new "flow_sample" upcall to do per-flow packet
sampling. Add a new "ipfix" upcall to do per-bridge packet sampling
to IPFIX collectors.
Extend the OVSDB schema to support configuring IPFIX collector sets.
Add support for configuring multiple IPFIX collectors for per-flow
packet sampling. Add support for configuring per-bridge IPFIX
sampling.
Automatically generate standard IPFIX entity definitions from the IANA
specs. Send one IPFIX data record message for every packet sampled by
an OpenFlow sample action or received by a bridge configured with
IPFIX sampling, and periodically send IPFIX template set messages.
Signed-off-by: Romain Lenglet <rlenglet@vmware.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
while this is not the only place strcasecmp is used without an
explicit inclusion of the header, it's the only place gcc complains
on my environment. for other places, probably the header is included
indirectly via other headers, i guess.
Signed-off-by: YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp> Signed-off-by: Ben Pfaff <blp@nicira.com>
use ax_check_openssl.m4 instead of a direct use of pkg-config.
on some platforms, including NetBSD-6, openssl is available but
its pkg-config files (*.pc) are not. according to Ed Maste,
this is the case for FreeBSD as well.
Signed-off-by: YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp> Signed-off-by: Ben Pfaff <blp@nicira.com>
this file is obtained from:
http://git.savannah.gnu.org/gitweb/?p=autoconf-archive.git;a=blob_plain;f=m4/ax_check_openssl.m4;hb=5a7260331c7d13263126e35c5743fdc35cbc2894
Signed-off-by: YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp> Signed-off-by: Ben Pfaff <blp@nicira.com>
datapath: Fix inconsistency in upstream and out of tree ovs module.
There is a inconsistent ordering in function ovs_vport_cmd_set()
between upstream and out of tree ovs module. Following patch
fixes it by releasing lock before calling ovs_notify.
Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Jesse Gross <jesse@nicira.com>
Ben Pfaff [Thu, 18 Apr 2013 23:37:05 +0000 (16:37 -0700)]
ovsdb-server: Announce bound listening ports as status:bound_port.
The administrator can request that OVSDB bind any available TCP port, but
in that case there is no easy way to find out what port it has bound. This
commit adds that information as the "bound_port" key in the "status"
column.
Ben Pfaff [Wed, 3 Apr 2013 18:30:18 +0000 (13:30 -0500)]
tests: Avoid race conditions, by letting the kernel choose ports to bind.
An occasionally occurring problem with "make check", especially when
parallel tests are enabled, is that multiple tests try to bind the same
TCP port and, of course, fail. This happens because the code to select
a TCP port to bind just generates random numbers until it finds a port that
is not currently in use and uses the first one, which is of course prone
to races.
This commit changes the tests to let the kernel directly choose an
available port, which should avoid this type of failure.
Also, some of the tests that generated a random free TCP port actually
used the port number to bind a UDP socket, which of course doesn't work
well. This commit fixes that problem too as a side effect.
Ben Pfaff [Wed, 3 Apr 2013 18:24:27 +0000 (13:24 -0500)]
socket-util: Log kernel-chosen bound ports in inet_open_passive().
Usually, for passive sockets, one wishes to bind a particular well-known
port, so that clients can easily connect. But automated tests cannot
necessarily bind a well-known port, because that would cause multiple
concurrent tests to interfere with each other or with a real instance of
the service running on the system. They could bind to a randomly selected
port chosen by the user (the Open vSwitch automated tests currently do this)
but this leads to occasional "false negative" test failures when the port
selected happens to be in use.
The best alternative for automated tests is to let the kernel choose a
port that is not otherwise in use, which can be accomplished by specifying
port 0. But in that case there is no easy way for other software to know
what port the kernel chose. This commit fixes that problem one way by
logging the bound port when it is chosen by the kernel.
Andy Zhou [Fri, 5 Apr 2013 23:56:52 +0000 (16:56 -0700)]
sparse: Support recent distributions
sparse support seems to be broken on some recent Linux distributions.
For example, ubuntu 12.04 with Linux 3.5 kernel, and Debian latest test
distribution, running Linux 3.2 kernel.
On both systems that sparse was broken, It was not able find the header files
in the default system include directories. GCC finds them by default.
This patch adds the required GCC default search path when running sparse.
Tested on:
Ubuntu 12.04 - w/ linux 3.5 kernel
Debian-6 March test distribution - w/ linux 3.2 kernel
Signed-off-by: Andy Zhou <azhou@nicira.com>
[blp@nicira.com also tested on Debian squeeze and wheezy (testing)] Signed-off-by: Ben Pfaff <blp@nicira.com>
Alex Wang [Thu, 18 Apr 2013 00:35:04 +0000 (17:35 -0700)]
python: fix a typo error in python/ovs/socket_util.py.
The commit 89d7ffa9 (python: Workaround UNIX socket path
length limits), fixes most failed tests. But it has a
typo and the typo causes the failure of test <unixctl
server errors - Python> when the path length is very
long (e.g. more than 90 characters).
This patch fixes the above issue.
Signed-off-by: Alex Wang <alexw@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
Ben Pfaff [Thu, 18 Apr 2013 16:40:48 +0000 (09:40 -0700)]
Correctly implement the OpenFlow 1.2+ OXM_OF_IP_DSCP field.
NXM puts the DSCP value in bits 2-7 of NXM_OF_IP_TOS.
OXM puts the DSCP value in bits 0-6 of OXM_OF_IP_DSCP.
Before this commit, Open vSwitch incorrectly implemented OXM_OF_IP_DSCP
with the same format as NXM_OF_IP_TOS. This commit fixes the problem and
adds a test (previously missing but I don't know why).
rhel: Remove the firewall hole that we create for GRE.
Till now, by default, we add firewall holes for
gre traffic. There may be users that do not use GRE tunnels
and they may be surprised with this behavior. So, don't add
the firewall rules by default and update the documentation
to mention the same.
This patch does not remove the default GRE firewall rule for
xenserver because xenserver has a feature called "Cross-Host
Internal Networks" (CHIN) that uses GRE.
For end users that do not plan to use tunnels or use only selected
tunnels, it probably is a bad idea to punch firewall holes by default.
Opening holes like this may surprise the user.
Currently OVS uses combination of genl and rtnl lock to protect
datapath state. This was done due to networking stack locking.
But this has complicated locking and there are few lock ordering
issues with new tunneling protocols.
Following patch simplifies locking by introducing new ovs mutex
and now this lock is used to protect entire ovs state.
Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Jesse Gross <jesse@nicira.com>
The following two commands results in a ovs-vsctl segfault.
ovs-vsctl -vfatal_signal:off --timeout=0 wait-until \
Open_vswitch . external_ids:blah="1"
/etc/init.d/openvswitch-switch restart
This patch fixes the segfault by properly setting the global
varibale, the_idl_txn to NULL when the underlying memory is
freed.
Ben Pfaff [Thu, 11 Apr 2013 22:47:08 +0000 (15:47 -0700)]
bridge: Complete initial configuration even with empty database.
If the database was empty, that is, it did not even contain an Open_vSwitch
top-level configuration record, at ovs-vswitchd startup time, then
OVS failed to detach and used 100% CPU. This commit fixes the problem.
This problem was introduced by commit 63ff04e82623e765 (bridge: Only
complete daemonization after db commits initial config.).
This problem did not manifest if the initscripts supplied with Open vSwitch
were used, because those initscripts always initialize the database before
starting ovs-vswitchd, so this problem affects only users with hand-rolled
local OVS startup scripts.
Ben Pfaff [Thu, 11 Apr 2013 22:05:32 +0000 (15:05 -0700)]
memory: Avoid 100% CPU when there is nothing to report.
Commit b9de4087685 (memory: Avoid an empty log message if there's nothing
to log.) introduced a 100% CPU usage condition when there is nothing to
log. This fixes the problem.
Ben Pfaff [Wed, 10 Apr 2013 17:33:39 +0000 (10:33 -0700)]
bridge: Only complete daemonization after db commits initial config.
An earlier commit changed the Open vSwitch startup scripts so that they
connect to remote managers only after ovs-vswitchd does its initial
configuration, as signaled by ovs-vswitchd detaching from its parent
process. However, a race window remains, because ovs-vswitchd detaching
does not mean that the database server has received and committed the
transaction, only that ovs-vswitchd has sent it. This commit fixes that
race window, by changing ovs-vswitchd to complete detaching only after
the database server acknowledges the transaction.
It is still possible for unusual events to cause ovs-vswitchd to detach
before ephemeral columns are filled in. There is always a slim possibility
that the transaction will fail or that some other client has added new
bridges, ports, etc. while ovs-vswitchd was configuring using an old
configuration. The latter race is inherent to the design of the system
and cannot be avoided without radical changes.
Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Ansis Atteka <aatteka@nicira.com>
Bug #15983.
Ben Pfaff [Wed, 10 Apr 2013 16:53:54 +0000 (09:53 -0700)]
ovs-ctl: Connect to remote OVSDB managers only after ovs-vswitchd starts.
Until now, ovs-ctl has started ovsdb-server with the full set of remote
managers configured. This means that ovsdb-server immediately connects to
these managers, before ovs-vswitchd even starts. Because the Open vSwitch
schema has several ephemeral columns, there will be considerable startup
churn in the database. For example, ovs-vswitchd will initially fill in
the datapath-id and ofport columns as it starts and sets up the initial
configuration. This churn wastes bandwidth to the remote managers and has
potential for confusing them.
This commit reduces the churn by changing ovs-ctl so that ovsdb-server
connects to the remote managers only after ovs-vswitchd has finished its
initial configuration. This means that remote managers will initially
see a filled-in database, not one that has its ephemeral columns empty.
This commit does not mean that managers can ignore the possibility that
some columns have not yet been filled in. For example, some columns will
still be briefly blank after a new bridge or a new port is added at
runtime, because adding a bridge or port occurs in one transaction (made by
the client adding the port, e.g. ovs-vsctl) and filling in those columns
happens in a different transaction (made by ovs-vswitchd). But this commit
does reduce the quantity of empty columns that I would expect a database
client to observe in practice.
Reported-by: Jeff Merrick <jmerrick@vmware.com> CC: Amar Padmanabhan <amar@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Ansis Atteka <aatteka@nicira.com>
Bug #15983.
Ben Pfaff [Wed, 10 Apr 2013 16:34:49 +0000 (09:34 -0700)]
ovsdb-server: Add commands for adding and removing remotes at runtime.
This will make it possible, in later commits, to make ovsdb-server connect
to OVS managers only after ovs-vswitchd has completed its initial
configuration.
Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Ansis Atteka <aatteka@nicira.com>
Ben Pfaff [Wed, 10 Apr 2013 23:22:00 +0000 (16:22 -0700)]
ovsdb-server: Refactor parsing of remote names to avoid ovs_fatal().
The current users of parse_db_column() are content to terminate with a
fatal error if parsing fails. An upcoming commit requires more flexibility,
so this commit refactors parse_db_column() to make this possible.
Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Ansis Atteka <aatteka@nicira.com>
Ethan Jackson [Wed, 10 Apr 2013 20:05:04 +0000 (13:05 -0700)]
dpif-linux: Reset epoll() on channel deletion.
The list of epoll events contains references to channels which may
be stale when one of those channels is deleted. The safest thing
to do is simply refresh epoll() whenever a channel is deleted.
Bug #16057. Signed-off-by: Ethan Jackson <ethan@nicira.com>
Ben Pfaff [Mon, 8 Apr 2013 17:44:40 +0000 (10:44 -0700)]
python.ovs.db.idl: Fix Row.delete() of a row already committed to the db.
Row.delete() handled the case of deleting a row that was added within the
current transaction, but not yet committed, but it did not correctly handle
the case of deleting a row that belonged to the database before the
transaction started. This fixes the problem.
Ethan Jackson [Sat, 6 Apr 2013 22:22:14 +0000 (15:22 -0700)]
ofproto-dpif: Disable miss handling in rule_get_stats().
rule_get_stats() is often called when iterating over every rule in
the flow table. To ensure up-to-date statistics, rule_get_stats()
calls push_all_stats() which can cause flow misses to be handled.
When using the learn action, this can cause rules to be added (and
potentially removed) from the OpenFlow table. This could corrupt
the caller's data structures, leading to a segmentation fault.
This patch fixes the issue by disabling flow miss handling from
within rule_get_stats().
Bug #15999. Signed-off-by: Ethan Jackson <ethan@nicira.com>
The port specific options are currently unused resulting in an
empty OVS_VPORT_ATTR_OPTIONS nested attribute being inserted
into every OVS_VPORT_CMD_GET message.
Don't insert OVS_VPORT_ATTR_OPTIONS if no options are present.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
[jesse: Options are used by tunnels but the concept still applies.] Signed-off-by: Jesse Gross <jesse@nicira.com>
Ethan Jackson [Tue, 2 Apr 2013 19:32:22 +0000 (12:32 -0700)]
ofproto-dpif: Don't rate limit facet_learn() with fin_timeouts.
In the standard case, rate limiting facet_learn() to once ever
500ms, makes sense. The worst that can happen is a learning entry
is expired half a second to early. However, when using
fin_timeouts, we really need react quickly to delete the newly
stale flow.
Bug #15915. Signed-off-by: Ethan Jackson <ethan@nicira.com>