while this is not the only place strcasecmp is used without an
explicit inclusion of the header, it's the only place gcc complains
on my environment. for other places, probably the header is included
indirectly via other headers, i guess.
Signed-off-by: YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp> Signed-off-by: Ben Pfaff <blp@nicira.com>
use ax_check_openssl.m4 instead of a direct use of pkg-config.
on some platforms, including NetBSD-6, openssl is available but
its pkg-config files (*.pc) are not. according to Ed Maste,
this is the case for FreeBSD as well.
Signed-off-by: YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp> Signed-off-by: Ben Pfaff <blp@nicira.com>
this file is obtained from:
http://git.savannah.gnu.org/gitweb/?p=autoconf-archive.git;a=blob_plain;f=m4/ax_check_openssl.m4;hb=5a7260331c7d13263126e35c5743fdc35cbc2894
Signed-off-by: YAMAMOTO Takashi <yamt@mwd.biglobe.ne.jp> Signed-off-by: Ben Pfaff <blp@nicira.com>
datapath: Fix inconsistency in upstream and out of tree ovs module.
There is a inconsistent ordering in function ovs_vport_cmd_set()
between upstream and out of tree ovs module. Following patch
fixes it by releasing lock before calling ovs_notify.
Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Jesse Gross <jesse@nicira.com>
Ben Pfaff [Thu, 18 Apr 2013 23:37:05 +0000 (16:37 -0700)]
ovsdb-server: Announce bound listening ports as status:bound_port.
The administrator can request that OVSDB bind any available TCP port, but
in that case there is no easy way to find out what port it has bound. This
commit adds that information as the "bound_port" key in the "status"
column.
Ben Pfaff [Wed, 3 Apr 2013 18:30:18 +0000 (13:30 -0500)]
tests: Avoid race conditions, by letting the kernel choose ports to bind.
An occasionally occurring problem with "make check", especially when
parallel tests are enabled, is that multiple tests try to bind the same
TCP port and, of course, fail. This happens because the code to select
a TCP port to bind just generates random numbers until it finds a port that
is not currently in use and uses the first one, which is of course prone
to races.
This commit changes the tests to let the kernel directly choose an
available port, which should avoid this type of failure.
Also, some of the tests that generated a random free TCP port actually
used the port number to bind a UDP socket, which of course doesn't work
well. This commit fixes that problem too as a side effect.
Ben Pfaff [Wed, 3 Apr 2013 18:24:27 +0000 (13:24 -0500)]
socket-util: Log kernel-chosen bound ports in inet_open_passive().
Usually, for passive sockets, one wishes to bind a particular well-known
port, so that clients can easily connect. But automated tests cannot
necessarily bind a well-known port, because that would cause multiple
concurrent tests to interfere with each other or with a real instance of
the service running on the system. They could bind to a randomly selected
port chosen by the user (the Open vSwitch automated tests currently do this)
but this leads to occasional "false negative" test failures when the port
selected happens to be in use.
The best alternative for automated tests is to let the kernel choose a
port that is not otherwise in use, which can be accomplished by specifying
port 0. But in that case there is no easy way for other software to know
what port the kernel chose. This commit fixes that problem one way by
logging the bound port when it is chosen by the kernel.
Andy Zhou [Fri, 5 Apr 2013 23:56:52 +0000 (16:56 -0700)]
sparse: Support recent distributions
sparse support seems to be broken on some recent Linux distributions.
For example, ubuntu 12.04 with Linux 3.5 kernel, and Debian latest test
distribution, running Linux 3.2 kernel.
On both systems that sparse was broken, It was not able find the header files
in the default system include directories. GCC finds them by default.
This patch adds the required GCC default search path when running sparse.
Tested on:
Ubuntu 12.04 - w/ linux 3.5 kernel
Debian-6 March test distribution - w/ linux 3.2 kernel
Signed-off-by: Andy Zhou <azhou@nicira.com>
[blp@nicira.com also tested on Debian squeeze and wheezy (testing)] Signed-off-by: Ben Pfaff <blp@nicira.com>
Alex Wang [Thu, 18 Apr 2013 00:35:04 +0000 (17:35 -0700)]
python: fix a typo error in python/ovs/socket_util.py.
The commit 89d7ffa9 (python: Workaround UNIX socket path
length limits), fixes most failed tests. But it has a
typo and the typo causes the failure of test <unixctl
server errors - Python> when the path length is very
long (e.g. more than 90 characters).
This patch fixes the above issue.
Signed-off-by: Alex Wang <alexw@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
Ben Pfaff [Thu, 18 Apr 2013 16:40:48 +0000 (09:40 -0700)]
Correctly implement the OpenFlow 1.2+ OXM_OF_IP_DSCP field.
NXM puts the DSCP value in bits 2-7 of NXM_OF_IP_TOS.
OXM puts the DSCP value in bits 0-6 of OXM_OF_IP_DSCP.
Before this commit, Open vSwitch incorrectly implemented OXM_OF_IP_DSCP
with the same format as NXM_OF_IP_TOS. This commit fixes the problem and
adds a test (previously missing but I don't know why).
rhel: Remove the firewall hole that we create for GRE.
Till now, by default, we add firewall holes for
gre traffic. There may be users that do not use GRE tunnels
and they may be surprised with this behavior. So, don't add
the firewall rules by default and update the documentation
to mention the same.
This patch does not remove the default GRE firewall rule for
xenserver because xenserver has a feature called "Cross-Host
Internal Networks" (CHIN) that uses GRE.
For end users that do not plan to use tunnels or use only selected
tunnels, it probably is a bad idea to punch firewall holes by default.
Opening holes like this may surprise the user.
Currently OVS uses combination of genl and rtnl lock to protect
datapath state. This was done due to networking stack locking.
But this has complicated locking and there are few lock ordering
issues with new tunneling protocols.
Following patch simplifies locking by introducing new ovs mutex
and now this lock is used to protect entire ovs state.
Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Jesse Gross <jesse@nicira.com>
The following two commands results in a ovs-vsctl segfault.
ovs-vsctl -vfatal_signal:off --timeout=0 wait-until \
Open_vswitch . external_ids:blah="1"
/etc/init.d/openvswitch-switch restart
This patch fixes the segfault by properly setting the global
varibale, the_idl_txn to NULL when the underlying memory is
freed.
Ben Pfaff [Thu, 11 Apr 2013 22:47:08 +0000 (15:47 -0700)]
bridge: Complete initial configuration even with empty database.
If the database was empty, that is, it did not even contain an Open_vSwitch
top-level configuration record, at ovs-vswitchd startup time, then
OVS failed to detach and used 100% CPU. This commit fixes the problem.
This problem was introduced by commit 63ff04e82623e765 (bridge: Only
complete daemonization after db commits initial config.).
This problem did not manifest if the initscripts supplied with Open vSwitch
were used, because those initscripts always initialize the database before
starting ovs-vswitchd, so this problem affects only users with hand-rolled
local OVS startup scripts.
Ben Pfaff [Thu, 11 Apr 2013 22:05:32 +0000 (15:05 -0700)]
memory: Avoid 100% CPU when there is nothing to report.
Commit b9de4087685 (memory: Avoid an empty log message if there's nothing
to log.) introduced a 100% CPU usage condition when there is nothing to
log. This fixes the problem.
Ben Pfaff [Wed, 10 Apr 2013 17:33:39 +0000 (10:33 -0700)]
bridge: Only complete daemonization after db commits initial config.
An earlier commit changed the Open vSwitch startup scripts so that they
connect to remote managers only after ovs-vswitchd does its initial
configuration, as signaled by ovs-vswitchd detaching from its parent
process. However, a race window remains, because ovs-vswitchd detaching
does not mean that the database server has received and committed the
transaction, only that ovs-vswitchd has sent it. This commit fixes that
race window, by changing ovs-vswitchd to complete detaching only after
the database server acknowledges the transaction.
It is still possible for unusual events to cause ovs-vswitchd to detach
before ephemeral columns are filled in. There is always a slim possibility
that the transaction will fail or that some other client has added new
bridges, ports, etc. while ovs-vswitchd was configuring using an old
configuration. The latter race is inherent to the design of the system
and cannot be avoided without radical changes.
Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Ansis Atteka <aatteka@nicira.com>
Bug #15983.
Ben Pfaff [Wed, 10 Apr 2013 16:53:54 +0000 (09:53 -0700)]
ovs-ctl: Connect to remote OVSDB managers only after ovs-vswitchd starts.
Until now, ovs-ctl has started ovsdb-server with the full set of remote
managers configured. This means that ovsdb-server immediately connects to
these managers, before ovs-vswitchd even starts. Because the Open vSwitch
schema has several ephemeral columns, there will be considerable startup
churn in the database. For example, ovs-vswitchd will initially fill in
the datapath-id and ofport columns as it starts and sets up the initial
configuration. This churn wastes bandwidth to the remote managers and has
potential for confusing them.
This commit reduces the churn by changing ovs-ctl so that ovsdb-server
connects to the remote managers only after ovs-vswitchd has finished its
initial configuration. This means that remote managers will initially
see a filled-in database, not one that has its ephemeral columns empty.
This commit does not mean that managers can ignore the possibility that
some columns have not yet been filled in. For example, some columns will
still be briefly blank after a new bridge or a new port is added at
runtime, because adding a bridge or port occurs in one transaction (made by
the client adding the port, e.g. ovs-vsctl) and filling in those columns
happens in a different transaction (made by ovs-vswitchd). But this commit
does reduce the quantity of empty columns that I would expect a database
client to observe in practice.
Reported-by: Jeff Merrick <jmerrick@vmware.com> CC: Amar Padmanabhan <amar@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Ansis Atteka <aatteka@nicira.com>
Bug #15983.
Ben Pfaff [Wed, 10 Apr 2013 16:34:49 +0000 (09:34 -0700)]
ovsdb-server: Add commands for adding and removing remotes at runtime.
This will make it possible, in later commits, to make ovsdb-server connect
to OVS managers only after ovs-vswitchd has completed its initial
configuration.
Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Ansis Atteka <aatteka@nicira.com>
Ben Pfaff [Wed, 10 Apr 2013 23:22:00 +0000 (16:22 -0700)]
ovsdb-server: Refactor parsing of remote names to avoid ovs_fatal().
The current users of parse_db_column() are content to terminate with a
fatal error if parsing fails. An upcoming commit requires more flexibility,
so this commit refactors parse_db_column() to make this possible.
Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Ansis Atteka <aatteka@nicira.com>
Ethan Jackson [Wed, 10 Apr 2013 20:05:04 +0000 (13:05 -0700)]
dpif-linux: Reset epoll() on channel deletion.
The list of epoll events contains references to channels which may
be stale when one of those channels is deleted. The safest thing
to do is simply refresh epoll() whenever a channel is deleted.
Bug #16057. Signed-off-by: Ethan Jackson <ethan@nicira.com>
Ben Pfaff [Mon, 8 Apr 2013 17:44:40 +0000 (10:44 -0700)]
python.ovs.db.idl: Fix Row.delete() of a row already committed to the db.
Row.delete() handled the case of deleting a row that was added within the
current transaction, but not yet committed, but it did not correctly handle
the case of deleting a row that belonged to the database before the
transaction started. This fixes the problem.
Ethan Jackson [Sat, 6 Apr 2013 22:22:14 +0000 (15:22 -0700)]
ofproto-dpif: Disable miss handling in rule_get_stats().
rule_get_stats() is often called when iterating over every rule in
the flow table. To ensure up-to-date statistics, rule_get_stats()
calls push_all_stats() which can cause flow misses to be handled.
When using the learn action, this can cause rules to be added (and
potentially removed) from the OpenFlow table. This could corrupt
the caller's data structures, leading to a segmentation fault.
This patch fixes the issue by disabling flow miss handling from
within rule_get_stats().
Bug #15999. Signed-off-by: Ethan Jackson <ethan@nicira.com>
The port specific options are currently unused resulting in an
empty OVS_VPORT_ATTR_OPTIONS nested attribute being inserted
into every OVS_VPORT_CMD_GET message.
Don't insert OVS_VPORT_ATTR_OPTIONS if no options are present.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
[jesse: Options are used by tunnels but the concept still applies.] Signed-off-by: Jesse Gross <jesse@nicira.com>
Ethan Jackson [Tue, 2 Apr 2013 19:32:22 +0000 (12:32 -0700)]
ofproto-dpif: Don't rate limit facet_learn() with fin_timeouts.
In the standard case, rate limiting facet_learn() to once ever
500ms, makes sense. The worst that can happen is a learning entry
is expired half a second to early. However, when using
fin_timeouts, we really need react quickly to delete the newly
stale flow.
Bug #15915. Signed-off-by: Ethan Jackson <ethan@nicira.com>
The flow-eviction-threshold presents a trade off between the
expense of maintaining large numbers of datapath flows, and the
benefit of avoid unnecessary flow misses. In some large Open
vSwitch deployments, we've seen the previous default flow eviction
threshold negatively impact performance with reasonably typical
traffic patterns. This patch increases the default to a level
which should represent a better trade off: still relatively safe,
but much more amenable to large numbers of long lived flows.
Ethan Jackson [Fri, 22 Mar 2013 02:04:52 +0000 (19:04 -0700)]
ofproto-dpif: Push statistics less frequently.
The most natural place to push facet statistics is in
update_stats() where they're pulled from the datapath. However,
under load, update_stats() can be called as many as 10 times per
second causing us to push statistics so frequently it hurts
performance. By pushing statistics much less frequently, this
patch generates a roughly 8% improvement in TCP_CRR performance.
Ethan Jackson [Wed, 27 Mar 2013 18:33:22 +0000 (11:33 -0700)]
ofproto-dpif: Run fast internally.
ofproto-dpif is responsible for quite a few book keeping tasks in
addition to handling flow misses. Many of these tasks (flow
expiration, flow revalidation, etc) can take many hundreds of
milliseconds, during which no misses can be handled. The ideal
long term solution to this problem, is to isolate flow miss
handling into it's own thread. However, for now this patch
provides a 5% increase in TCP_CRR performance, and smooths out
results during revalidations.
Ethan Jackson [Sat, 30 Mar 2013 22:13:00 +0000 (15:13 -0700)]
ofproto-dpif: Systematically push stats upon request.
Commit bf1e8ff (ofproto-dpif: Push statistics in rule_get_stats()),
started down the road towards pushing stats on demand, but it
didn't go quite far enough. First, it neglected to push stats in
port_get_stats() and mirror_get_stats(). Second, it only pushes
stats for a single ofproto, making it incomplete when patch ports
are used.
rhel: Add depmod.d conf file for rhel6 kmod package.
It looks like for Centos6.4, there is an upstream openvswitch
kernel module already installed. When we try to install kmod-openvswitch
package from this tree's pre-1.10 branches, we get the following warning:
"brcompat.ko needs unknown symbol ovs_dp_ioctl_hook".
Also, after installing the kmod-openvswitch package, if we run
"modprobe openvswitch", the upstream kernel module gets loaded.
We should instead load the kernel module compiled from this tree.
Ben Pfaff [Wed, 27 Mar 2013 21:38:11 +0000 (14:38 -0700)]
jsonrpc-server: Disconnect connections that queue too much data.
Consider this situation:
* OVSDB client A executes transactions very quickly for a long time.
* OVSDB client B monitors the tables that A modifies, but (either
because B is connected over a slow network, or because B is slow to
process updates) cannot keep up.
In this situation, the data that ovsdb-server has queued to send B grows
without bound and eventually ovsdb-server runs out of memory. This commit
avoids the problem by noticing that more data is queued to B than necessary
to express the whole contents of the database and dropping the connection
to B. When B reconnects later, it can then fetch the contents of the
database using less data than was previously queued to it.
(This is not entirely hypothetical. We have seen this behavior in
intentional stress tests.)
Bug #15637. Reported-by: Jeff Merrick <jmerrick@vmware.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
Thomas Graf [Sat, 30 Mar 2013 01:18:58 +0000 (18:18 -0700)]
datapath: Refine Netlink message size calculation and kill FLOW_BUFSIZE
Kills the FLOW_BUFSIZE constant which needs to be calculated manually
and replaces it with key_attr_size() based on nla_total_size().
Calculates the size of datapath messages instead of relying on
NLMSG_DEFAULT_SIZE and moves the existing message size calculations
into own functions for clarity.
Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: Jesse Gross <jesse@nicira.com>
Thomas Graf [Sat, 30 Mar 2013 01:10:31 +0000 (18:10 -0700)]
datapath: Use nla_memcpy() to memcpy() data from attributes
Less error prone as it takes into account the length of both the
destination buffer and the source attribute and documents when
data is copied from an attribute.
Signed-off-by: Thomas Graf <tgraf@suug.ch> Signed-off-by: Jesse Gross <jesse@nicira.com>
Ben Pfaff [Thu, 28 Mar 2013 18:45:47 +0000 (11:45 -0700)]
lacp: Stop time to avoid dependency on real time in negotiation test.
Commit f3103dfa00d (lacp.at: Change timing of lacp - negotiation test)
fixed test failures for the lacp negotiation test on some systems, but
made it crop up on others where it hadn't appeared before.
My guess is that this commit is the real fix. If it isn't, then we
will probably just have to remove the test or disable it, much as I
hate doing that.
Simon Horman [Thu, 28 Mar 2013 19:01:17 +0000 (12:01 -0700)]
datapath: net: add ETH_P_802_3_MIN
Add a new constant ETH_P_802_3_MIN, the minimum ethernet type for
an 802.3 frame. Frames with a lower value in the ethernet type field
are Ethernet II.
Also update all the users of this value that David Miller and
I could find to use the new constant.
Also correct a bug in util.c. The comparison with ETH_P_802_3_MIN
should be >= not >.
As suggested by Jesse Gross.
Compile tested only.
Cc: David Miller <davem@davemloft.net> Cc: Jesse Gross <jesse@nicira.com> Cc: Karsten Keil <isdn@linux-pingi.de> Cc: John W. Linville <linville@tuxdriver.com> Cc: Johannes Berg <johannes@sipsolutions.net> Cc: Bart De Schuymer <bart.de.schuymer@pandora.be> Cc: Stephen Hemminger <stephen@networkplumber.org> Cc: Patrick McHardy <kaber@trash.net> Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Cc: linux-bluetooth@vger.kernel.org Cc: netfilter-devel@vger.kernel.org Cc: bridge@lists.linux-foundation.org Cc: linux-wireless@vger.kernel.org Cc: linux1394-devel@lists.sourceforge.net Cc: linux-media@vger.kernel.org Cc: netdev@vger.kernel.org Cc: dev@openvswitch.org Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com> Acked-by: Stefan Richter <stefanr@s5r6.in-berlin.de> Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Jesse Gross <jesse@nicira.com>
Jarno Rajahalme [Thu, 28 Mar 2013 13:47:46 +0000 (15:47 +0200)]
lacp.at: Change timing of lacp - negotiation test
The "lacp - negotiation" test (# 3) used to always fail when running
multiple tests in parallel (-j2). The reduced simulated wait time
(from 4 seconds to 2.5 seconds) seems to still give the expected result,
and works also when running multiple tests in parallel.
Signed-off-by: Jarno Rajahalme <jarno.rajahalme@nsn.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
Currently, when we stop a daemon, we first send it SIGTERM.
If SIGTERM did not work within ~5 seconds, we send a SIGKILL.
After sending SIGKILL, we wait only for 4 seconds, before giving
up.
If the system is extremely busy, there is a chance that a
process is not killed by the kernel within 4 seconds. In such
a case, when we try to start the daemon immediately, we see that
the pid inside the pid-file is valid and assume that the daemon
is still running. This leaves us in a state, where the daemon is
actually not running.
This patch increases the time waiting for the kernel to kill the
process to 60 seconds.
Andy Zhou [Tue, 26 Mar 2013 02:49:13 +0000 (19:49 -0700)]
ofproto-dpif: Keep track of exact-match flow info
This patch adds more flow related stats to the output of
"ovs-appctl dpif/show". Specifically, the follow information
are added per ofproto:
- Max flow table size
- Average flow table size
- Average flow table add rate
- Average flow table delete rate
- Average flow entry life in milliseconds
Feature #15366
Signed-off-by: Andy Zhou <azhou@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
Ethan Jackson [Fri, 22 Mar 2013 02:40:49 +0000 (19:40 -0700)]
ofproto-dpif: Rate limit calls to facet_learn().
In the TCP_CRR benchmark, ovs-vswitchd spends so much time in
update_stats() that it has a significant impact on flow setup
performance. Further work is needed in this area, but for now,
simply rate limiting facet_learn() has a roughly 10% improvement
with complex flow tables.
With complex flow tables, facet_check_consistency() can be
expensive enough to show up in flow setup performance benchmarks.
In my testing this patch gives us a roughly 10% improvement in
TCP_CRR and ovs-benchmark.
Jarno Rajahalme [Mon, 25 Mar 2013 19:03:38 +0000 (21:03 +0200)]
datapath: Fix IP ID setting.
Eliminate the extra call to ip_select_ident(), and place the
__ip_select_ident() call where the ip_select_ident() call was.
This fixes two problems: Before, the call to ip_select_ident() did
always zero out the value set earlier by __ip_select_ident(). Also,
when __ip_select_ident() was called before setting the iph->daddr,
ident calculation was possibly based on uninitialized data (but as
the result was masked by the later call to ip_select_ident() it was
not visible).
Jesse Gross [Wed, 20 Mar 2013 23:14:58 +0000 (16:14 -0700)]
datapath: Preallocate reply skb in ovs_vport_cmd_set().
Allocation of the Netlink notification skb can potentially fail
after changing vport configuration. In general, we try to avoid
this by undoing any change we made but that is difficult for existing
objects. This avoids the problem by preallocating the buffer (which
is fixed size).
Signed-off-by: Jesse Gross <jesse@nicira.com> Acked-by: Pravin B Shelar <pshelar@nicira.com>
ovs-bugtool: Add ovs-appctl dpif commands to debug bundle.
With single datapath, 'ovs-dpctl dump-flows ' dumps datapath flows for
all the userspace bridges in a system. It can get a little harder
to figure out the datapath flows belonging to a particular userspace
bridge.
This patch adds the 'ovs-appctl dpif/show' and 'ovs-appctl dpif/dump-flows'
output for each userspace bridge. This gives us a summary of configured
datapaths and all datapath flow entries for each bridge separately.
Ethan Jackson [Sat, 23 Mar 2013 22:11:21 +0000 (15:11 -0700)]
ofproto-dpif: Push statistics in rule_get_stats().
As time goes on, and flow tables become more complicated, the
tradeoff between keeping up to date statistics, and the CPU
resources needed to maintain them, will become more important.
Commit 5c0243a (ofproto-dpif: xlate actions once with subfacets.)
delayed the reporting of some statistics in an effort to achieve
higher flow setup performance. Future commits will continue in the
same direction.
This patch helps to alleviate the issue, by pushing statistics
rule_get_stats(), when users actually want them. Presumably, this
happens rarely, and thus will not have a negative impact on
ovs-vswitchd performance.
extract-ofp-errors doesn't work with python 3 for the
following reasons:
- several "SyntaxError: invalid syntax":
print not a keyword anymore. As a function it requires '()'
- AttributeError: 'dict' object has no attribute 'itervalues'
Use values() instead.
Test done:
Generate using ofp-errors.inc as a reference
Patch for python 3, then regenerate ofp-errors.inc
Diff between the two outputs.
Signed-off-by: Damien Millescamps <damien.millescamps@6wind.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
Ethan Jackson [Thu, 21 Mar 2013 18:17:00 +0000 (11:17 -0700)]
ofproto-dpif: xlate actions once with subfacets.
Before this patch, when ofproto-dpif decided that a particular flow
miss needed a facet, it would do action translation multiple times.
Once in subfacet_make_actions(), and once per packet in
subfacet_update_stats(). In the common case (once per miss), this
would double the amount of work required in xlate_actions().
The call to facet_push_stats() in subfacet_update_stats() is
unnecessary. If the packets are simply accounted to the facet,
they will eventually be pushed to the relevant rules in
update_stats() or when the facet is removed. Removing the
unnecessary step gives us a 20% improvement of the netperf TCP_CRR
benchmark with the complex flow tables installed by our controller.
Simon Horman [Wed, 20 Mar 2013 13:18:42 +0000 (22:18 +0900)]
mpls: Allow l3 and l4 actions to prior to a push_mpls action
* Update the order in which actions are committed and thus
appear in the datapath such that MPLS actions appear after
l3 and l4 (nw and port) actions.
In the case where an mpls_push action is present it should ensure
that l3 and l4 actions occur first, which seems logical as
once a mpls_push has occur the frame will be MPLS rather
than IPv4 or IPv6.
In the case where there is an mpls_pop action is present this should
not make any difference as the frame will have been MPLS to start with
and thus not satisfy the pre-requisites for l3 or l4 actions.
* Update commit_set_nw_action() to use the base ethertype when considering
eligibility to commit l3 (nw) actions. This allows l3 actions to be
applied so long as the frame was originally IPv4 or IPv6, even if
an mpls_push action will be applied and thus flow indicates the
frame will be MPLS.
* Make actions that may modify port or network information conditional on
the flow's ethernet type being an IP ethernet type. This is to ensure
that actions that modify network and port information do not occur
on non IP packets, for example if an mpls_push action has changed a
packet from IP to MPLS.
Note that modification of network data is already prevented by
virtue of commit_set_nw_action() only having cases for when the
ethernet type of the flow is IPV4 or IPV6. The conditionality
of network actions on the ethernet type has been added to
do_xlate_actions() to make it explicit.
* Add a check to commit_set_port_action() to ensure that the base
flow is IP. This protects against the case where move_reg is used
to change transport ports after an MPLS header is pushed.
Signed-off-by: Simon Horman <horms@verge.net.au>
[jesse: Add check for an IP protocol when committing L4 actions.] Signed-off-by: Jesse Gross <jesse@nicira.com>