Ethan Jackson [Fri, 8 Nov 2013 21:47:49 +0000 (13:47 -0800)]
ofproto: Simplify thread creation API.
There's no particular reason for the function controlling the number
of threads to be bound up with dpif_recv_set(). This patch breaks
them up, but as a side effect means threads will run doing nothing
when datapath upcall receiving is disabled. By doing this, the udpif
thread creation API becomes a bit easier to reason about once there
are multiple types of thread introduced in future patches.
Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
Ethan Jackson [Sat, 7 Dec 2013 02:53:12 +0000 (18:53 -0800)]
flow: New function flow_unwildcard_tp_ports().
This patch adds a new function flow_unildcard_tp_ports() which doesn't
unwildcard the upper half of tp_src and tp_dst with ICMP packets.
Unfortunately, this matters in future patches when we compare masks
carefully to determine if flows should be evicted from the datapath.
Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
Helmut Schaa [Fri, 13 Dec 2013 13:05:01 +0000 (14:05 +0100)]
vlog: Use OVS_CONSTRUCTOR for vlog initialization
This allows to get rid of some special segment handling to allow
distributed registering of vlog modules.
Instead use a global list and vlog module constructor functions to
build up the list. That means vlog modules reside within the
compilation unit they are defined in and can be iterated upon
by using the global list vlog_modules.
Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
Helmut Schaa [Fri, 13 Dec 2013 13:17:17 +0000 (14:17 +0100)]
lib/util: Make some functions in util.c inline
str_to_uint, str_to_ulong and str_to_ullong are just wrappers
around the corresponding signed functions. Move these to util.h
and make them inline saving some library exports and letting
the compiler do some more magic.
Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
Helmut Schaa [Fri, 13 Dec 2013 13:17:14 +0000 (14:17 +0100)]
lib/random: Make some functions in random.c inline
random_range, random_uint8 and random_uint16 are basically just wrappers
around random_uint32. Hence, don't export these functions so the compiler
can be smarter when it comes to optimizations.
Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
Ethan Jackson [Sat, 7 Dec 2013 23:04:09 +0000 (15:04 -0800)]
ofproto-dpif: Remove ovs-appctl dpif/del-flows.
It's not entirely clear why someone would want to delete the flows
associated with only one bridge and not be fine with simply using
ovs-dpctl del-flows to get all of them. Additionally, this will be
hard to implement cleanly in the future, so this patch removes it.
Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
Ethan Jackson [Thu, 5 Dec 2013 21:09:27 +0000 (13:09 -0800)]
ofproto-dpif-xlate: Add a mechanism to skip wildcard calculation.
As time goes on and the classifier becomes more complicated, calculate
the wildcard mask will get more and more expensive. This patch adds a
mechanism to xlate_actions() allowing callers to disable wildcard
calculation when it isn't really necessary. Used in future patches.
Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
Ethan Jackson [Wed, 13 Nov 2013 02:18:01 +0000 (18:18 -0800)]
ofproto: Move all statistics accounting into xlate_actions().
This patch moves statistics accounting for netflow, bonding, netdev,
and mirroring inside xlate_actions(). Moving all statistics into one
place makes it very difficult to mess up.
Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
Simon Horman [Wed, 11 Dec 2013 01:23:36 +0000 (10:23 +0900)]
ovs-ofctl: Update push_mpls documentation
* The ethertype of the packet is always set to
the ethertype of the push_mpls action
* Drop references to unicast and multicast MPLS ethertypes,
in RFC5332 0x8847 and 0x8848 do not always have
those meanings.
Signed-off-by: Simon Horman <horms@verge.net.au> Signed-off-by: Ben Pfaff <blp@nicira.com>
Ethan Jackson [Wed, 30 Oct 2013 23:29:58 +0000 (16:29 -0700)]
ofproto: Handle netflow similarly to ipfix and sflow in xlate.
This patch changes how ofproto-dpif-xlate handles netflow so that it's
more similar to how ipfix and sflow are handled. This not only
simplifies the code, but it will allow xlate to call netflow in future
if necessary.
Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
Ethan Jackson [Wed, 23 Oct 2013 06:07:55 +0000 (23:07 -0700)]
ofproto: Modularize netflow.
The netflow code has its tentacles all over the ofproto-dpif module.
This is fine today, but in future facets, which correspond roughly to
netflow_flows, will be retired. In preparation, this patch hides as
much implementation detail as possible inside the netflow module.
Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
Joe Stringer [Fri, 13 Dec 2013 03:33:48 +0000 (03:33 +0000)]
ofproto-dpif: Only run bundles when lacp or bonds are enabled
When dealing with a large number of ports, bundle_run() and
bundle_wait() add significant unnecessary processing to the main run
loop, even when there are no bonds and lacp is not configured. This
patch skips such execution if it is unneeded, reducing average CPU usage
of the main thread from about 25% to about 20% in a test environment of
5000 internal ports and 50 tunnel ports running bfd.
Signed-off-by: Joe Stringer <joestringer@nicira.com> Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Ethan Jackson <ethan@nicira.com>
Ethan Jackson [Fri, 15 Nov 2013 23:55:19 +0000 (15:55 -0800)]
ovs-dev.py: Build with both GCC and Clang.
Many deployments prefer to use gcc in production and it supports
sparse, while clang supports thread safety analysis and has
more/better warnings and error messages. This patch changes
ovs-dev.py to build with both so that developers are unlikely to miss
something that one or the other could catch.
Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Joe Stringer <joestringer@nicira.com>
Joe Stringer [Fri, 13 Dec 2013 03:33:49 +0000 (03:33 +0000)]
bridge: Only store instant_stats on device changes
Previously, we iterated through all interfaces in instant_stats_run(),
grabbing up-to-date information about device and port status. After
assembling all of this information for all interfaces, we would
determine whether anything changed and only send an update to
ovsdb-server if something changed.
This patch uses the new global connectivity_seq to determine whether
there have been any changes before polling all interfaces, which reduces
unnecessary processing in the average case. In a test environment of
5000 internal ports and 50 tunnel ports with bfd, this reduces average
CPU usage of the main thread from about 15% to about 5%. When ports
change status more often than every 100ms, CPU usage is expected to
increase to previous rates.
Signed-off-by: Joe Stringer <joestringer@nicira.com> Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Ethan Jackson <ethan@nicira.com>
Joe Stringer [Fri, 13 Dec 2013 03:33:47 +0000 (03:33 +0000)]
ofproto-dpif: Don't poll ports when nothing changes
Previously, as part of ofproto-dpif run() processing, we would loop
through all ports and poll for changes to carrier, bfd, cfm and lacp
status. This information is used to determine whether bundles may be
enabled, and to perform revalidation when needed.
This patch makes the bfd, cfm, lacp and stp modules aware of the new
global connectivity_seq, notifying on changes in port status. We can
then use connectivity_seq to check if anything has changed before
looping through all ports in ofproto-dpif. In a test environment of 5000
internal ports and 50 tunnel ports with bfd, this reduces average CPU
usage of the main thread from about 35% to about 25%.
Signed-off-by: Joe Stringer <joestringer@nicira.com> Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Ethan Jackson <ethan@nicira.com>
Joe Stringer [Fri, 13 Dec 2013 03:33:46 +0000 (03:33 +0000)]
netdev: Globally track port status changes
Previously, we tracked status changes for ofports on a per-device basis.
Each time in the main thread's loop, we would inspect every ofport
to determine whether the status had changed for corresponding devices.
This patch replaces the per-netdev change_seq with a global 'struct seq'
which tracks status change for all ports. In the average case where
ports are not constantly going up or down, this allows us to check the
sequence once per main loop and not poll any ports. In the worst case,
execution is expected to be similar to how it is currently.
In a test environment of 5000 internal ports and 50 tunnel ports with
bfd, this reduces average CPU usage of the main thread from about 40% to
about 35%.
Signed-off-by: Joe Stringer <joestringer@nicira.com> Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Ethan Jackson <ethan@nicira.com>
Jarno Rajahalme [Thu, 12 Dec 2013 16:27:41 +0000 (08:27 -0800)]
lib/util: More portable use of builtin popcnt.
- Use the GCC predefined macro __POPCNT__ to detect the availability
of fast __builtin_popcnt function.
- Use portable preprocessor macros to detect 64-bit build.
- Only define the 32-bit parts when needed and declare the
count_1bits_8 at file scope to silence a warning.
This time I have tested all code paths to make sure no warnigns are
generated.
Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com> Reviewed-by: Simon Horman <horms@verge.net.au>
Ben Pfaff [Thu, 12 Dec 2013 01:55:26 +0000 (17:55 -0800)]
bridge: Reconfigure in single pass.
This greatly simplifies the reconfiguration code, making it much easier
to understand and modify. The old multi-pass configuration had the
property that it didn't delay block packet processing as much, but that's
not much of a worry anymore now that latency critical activities have
been moved outside the main thread.
Joe Stringer [Thu, 12 Dec 2013 05:46:22 +0000 (05:46 +0000)]
ovs-thread: Reduce logging level for cpuinfo parsing
This was causing test failures on non-Linux platforms.
Reported-by: Ed Maste <emaste@freebsd.org> Signed-off-by: Joe Stringer <joestringer@nicira.com> Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Ethan Jackson <ethan@nicira.com>
Andy Zhou [Wed, 11 Dec 2013 07:32:51 +0000 (23:32 -0800)]
ofproto-dpif: Ignore non-packet field masks during flow revalidation
Commit bcd2633a5be(ofproto-dpif: Store relevant fields for wildcarding
in facet) implements flow revalidation by comparing the newly looked
up flow mask with that of the existing facet.
The non-packet fields, such as register masks, are always cleared
by xlate_actions in the masks stored within facets, but they are not
cleared in the newly looked up flow masks, causing otherwise valid
flows to be declared as invalid flows and be removed from the datapath.
This patch provides a fix. I was able to verify the fix on a system set
up by Ying Chen where the bug can be reproduced.
Ben Pfaff [Wed, 11 Dec 2013 06:42:07 +0000 (22:42 -0800)]
lacp: Make lacp negotiation test hard-code aggregation keys.
The lacp implementation takes the aggregation key from the key or portid
of the first slave to be added to the lacp object. When multiple slaves
are added initially to a lacp object (the most common case), which is the
"first" is arbitrary. Until now, it seems that the "first" was actually
predictable enough for the tests to (unknowingly) rely on it, but an
upcoming commit will break that. This commit fixes the test by forcing
a particular aggregation key for each lacp object.
Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
Ben Pfaff [Mon, 9 Dec 2013 23:38:25 +0000 (15:38 -0800)]
ofproto: Make ofproto_enumerate_types() match its comment.
The comment says that it clears the passed-in sset, but it didn't. The bug
didn't actually affect any of the existing callers, which all passed in an
empty sset.
Signed-off-by: Ben Pfaff <blp@nicira.com> Acked-by: Jarno Rajahalme <jrajahalme@nicira.com>
Jarno Rajahalme [Wed, 11 Dec 2013 19:07:01 +0000 (11:07 -0800)]
Classifier: Track address prefixes.
Add a prefix tree (trie) structure for tracking the used address
space, enabling skipping classifier tables containing longer masks
than necessary for an address field value in a packet header being
classified. This enables less unwildcarding for datapath flows in
parts of the address space without host routes.
Trie lookup is interwoven to the staged lookup, so that a trie is
searched only when the configured trie field becomes relevant
for the lookup. The trie lookup results are retained so that each
trie is checked at most once for each classifier lookup.
This implementation tracks the number of rules at each address prefix
for the whole classifier. More aggressive table skipping would be
possible by maintaining lists of tables that have prefixes at the
lengths encountered on tree traversal, or by maintaining separate
tries for subsets of rules separated by metadata fields.
Prefix tracking is configured via OVSDB. A new column "prefixes" is
added to the database table "Flow_Table". "prefixes" is a set of
string values listing the field names for which prefix lookup should
be used.
As of now, the fields for which prefix lookup can be enabled are:
- tun_id, tun_src, tun_dst
- nw_src, nw_dst (or aliases ip_src and ip_dst)
- ipv6_src, ipv6_dst
There is a maximum number of fields that can be enabled for any one
flow table. Currently this limit is 3.
Jarno Rajahalme [Wed, 11 Dec 2013 19:07:01 +0000 (11:07 -0800)]
dpif-netdev: Properly create exact match masks.
Normally OVS userspace supplies a mask along with a flow key for each
new data path flow that should be created. OVS also provides an
option to disable the kernel wildcarding, in which case the flows are
created without a mask. When kernel wildcarding is disabled, the
datapath should use exact match, i.e. not wildcard any bits in the
flow key. Currently, what happens with the userspace datapath instead
is that a datapath flow with mostly empty mask is created (i.e., most
fields are wildcarded), as the current code does not examine the given
mask key length to find out that the mask key is actually empty. This
results in the same datapath flow matching on packets of multiple
different flows, wrong actions being processed, and stats being
incorrect.
This patch refactors userspace datapath code to explicitly initialize
a suitable exact match mask when a flow put without a mask is
executed.
Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
Joe Stringer [Tue, 26 Nov 2013 05:44:18 +0000 (05:44 +0000)]
bridge: Refresh STP statistics separately from status
Currently, we refresh STP status (id, state, role) alongside
statistics (rx, tx, errors), all within instant_stats_run(). This
patch splits statistics out, and refreshes them with the 5 second
stats instead. This paves the way to reducing execution of
instant_stats_run().
Signed-off-by: Joe Stringer <joestringer@nicira.com> Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Ethan Jackson <ethan@nicira.com>
Joe Stringer [Fri, 6 Dec 2013 07:42:21 +0000 (07:42 +0000)]
lib: Determine cpu core count with /proc/cpuinfo.
On systems that provide /proc/cpuinfo similar to Linux on x86, this
should allow us to choose a better default value for the number of
upcall handler threads -- in particular, it avoids counting
hyper-thread cores. If /proc/cpuinfo cannot be parsed for any reason,
fall back to using sysconf().
Signed-off-by: Joe Stringer <joestringer@nicira.com> Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Ethan Jackson <ethan@nicira.com>
Alex Wang [Tue, 10 Dec 2013 01:34:53 +0000 (17:34 -0800)]
bfd: Change the update of forwarding flag.
Currently, we update the forwarding flag in bfd_set_state() and in
bfd_forwarding_if_rx_update() if bfd_forwarding_if_rx is enabled.
However, these are not the exact places where the forwarding flag
needs to be updated. The exact places are in the bfd_process_packet()
where bfd status are changed based on received control packet, and in
the flow_push_stats() and compose_output_action__() where the
rx_packet counter is updated.
This commit changes the update of forwarding flag to the places
mentioned above.
Signed-off-by: Alex Wang <alexw@nicira.com> Signed-off-by: Ethan Jackson <ethan@nicira.com> Acked-by: Ethan Jackson <ethan@nicira.com>
Jarno Rajahalme [Wed, 27 Nov 2013 20:58:46 +0000 (12:58 -0800)]
util: Better count_1bits().
Inline, use another well-known algorithm for 64-bit builds, and use
builtins when they are known to be fast at compile time. A 32-bit
version of the alternate algorithm is slower than the existing
implementation, so the old one is used for 32-bit builds. Inline
assembler would be a bit faster on 32-bit i7 build, but we use the GCC
builtin for portability.
It should be stressed builds for specific CPUs do not work on others
CPUs, and that OVS build system or runtime does not currently support
CPU detection.
Pravin B Shelar [Fri, 6 Dec 2013 18:43:12 +0000 (10:43 -0800)]
datapath: compat: Fix Compiler error for kernel 3.3 to 3.8
Kernel 3.3 to 3.8 has defined `struct flow_keys` but does not
contains flow_keys.thoff field. Therefore we need to use
compat definition for flow_keys struct.
Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Jesse Gross <jesse@nicira.com>
Pravin B Shelar [Thu, 5 Dec 2013 23:50:27 +0000 (15:50 -0800)]
datapath: Use percpu allocator for flow-stats.
Use percpu allocator for stats due to objection to stats array.
But percpu allocator is not designed for high churn allocation/
deallcation. so we need to avoid allocating percpu flow for
short lived flows. One cheaper way to detect flow is by checking
if 5-tuple used in RSS are masked or not. if any one of them is
masked, flow is likely shared across CPU where percpu stat
should be more scalable. And that flow should be relatively
long lived flow.
Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Acked-by: Jesse Gross <jesse@nicira.com>
Pravin B Shelar [Tue, 3 Dec 2013 16:33:36 +0000 (08:33 -0800)]
datapath: Improve compat rxhash functionality.
Following patch improves rxhash calculation, It is taken from
upstream Linux kernel code.
From kernel 3.8, skb_get_rxhash() can handle hardware generated
l4-rxhash. Therefore compat skb_get_rxhash() is not used on
kernel 3.8 or new.
Signed-off-by: Pravin B Shelar <pshelar@nicira.com> Reviewed-by: Thomas Graf <tgraf@redhat.com> Acked-by: Jesse Gross <jesse@nicira.com>
James Page [Thu, 5 Dec 2013 17:29:05 +0000 (17:29 +0000)]
Add check for -latomic
Later versions of gcc on some architectures push atomic functions
out into a separate atomic library; add a check to see when this
is required and add it to LIBS if need be.
Specifically the problem was observed on GCC 4.8.2 on powerpc
architecture for Ubuntu 14.04:
Flavio Leitner [Tue, 3 Dec 2013 01:13:16 +0000 (23:13 -0200)]
fedora package: include python byte compiled files
Include byte compiled files to speed up the execution,
to avoid spurious SELinux AVC denials and also to make
rpm happy when checking for unpackaged files:
Jesse Gross [Tue, 3 Dec 2013 02:56:32 +0000 (18:56 -0800)]
datapath: Silence RCU lockdep checks from flow lookup.
Flow lookup can happen either in packet processing context or userspace
context but it was annotated as requiring RCU read lock to be held. This
also allows OVS mutex to be held without causing warnings.
Jarno Rajahalme [Mon, 2 Dec 2013 23:14:09 +0000 (15:14 -0800)]
lib: More intuitive syntax for TCP flags matching.
Allow TCP flags match specification with symbolic flag names. TCP
flags are optionally specified as a string of flag names, each
preceded by '+' when the flag must be one, or '-' when the flag must
be zero. Any flags not explicitly included are wildcarded. The
existing hex syntax is still allowed, and is used in flow dumps when
all the flags are matched.
Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
Ben Pfaff [Fri, 22 Nov 2013 23:57:23 +0000 (15:57 -0800)]
ofproto-dpif: keep slow path flow time stamp up-to-date
Noting updating slow path subfacet's time stamp can cause their datapath
flows deleted periodically. For example, CFM datapath flow have usespace
actions that are handled in dpif slow path. They are deleted and
recreated periodically without the fix.
This bug are not obvious during normal operation. Deleted CFM flow
would cause CFM packets to be handled by flow miss handler which will
reinstall the flow in the datapath. The only potentially observable
behavior is that when the user space is overwhelmed with flow miss packets,
the periodic CFM miss packets may get stuck behind other miss packets,
cause tunnel flapping.
Ben refactored the patch to its current form.
Reported-by: Guolin Yang <gyang@nicira.com> Co-authored-by: Ben Pfaff <blp@nicira.com> Signed-off-by: Andy Zhou <azhou@nicira.com>
Alin Serdean [Tue, 26 Nov 2013 07:38:48 +0000 (23:38 -0800)]
Avoid printf type modifiers not supported by MSVC C runtime library.
The MSVC C library printf() implementation does not support the 'z', 't',
'j', or 'hh' format specifiers. This commit changes the Open vSwitch code
to avoid those format specifiers, switching to standard macros from
<inttypes.h> where available and inventing new macros resembling them
where necessary. It also updates CodingStyle to specify the macros' use
and adds a Makefile rule to report violations.
Signed-off-by: Alin Serdean <aserdean@cloudbasesolutions.com> Co-authored-by: Ben Pfaff <blp@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
debian: Don't recreate bridges during manual restart.
Open vSwitch bridges and ports can be configured through
the /etc/network/interfaces script. During system startup,
Open vSwitch startup script reads the interfaces file
and creates the bridges and ports. During system shutdown,
the bridges and ports are removed.
The same behavior also can occur with a manual 'restart' of
Open vswitch (ex: service openvswitch-switch restart).
This behavior has come across as undesirable in some cases.
ex: When some one manually creates interfaces through ovs-vsctl
and then restarts Open vSwitch, that interface is lost.
This commit changes the startup script such that, interfaces
are created and deleted through the startup script only when
RUNLEVEL environment variable is set. This behavior will be
consistent with the OVS RHEL ifcfg-* scripts too.
Signed-off-by: Gurucharan Shetty <gshetty@nicira.com> Acked-by: Ben Pfaff <blp@nicira.com>
Romain Lenglet [Wed, 20 Nov 2013 18:57:53 +0000 (10:57 -0800)]
ipfix: allow empty targets column in table IPFIX
The "targets" column in IPFIX had a min=1 constraints, so OVSDB
implicitly adds an empty string "" into that column if no value is
given. No connection can be opened to a target with address "", so
the whole IPFIX exporter for that row was disabled until that ""
target was removed by users. That behavior is correct but proved to
be unintuitive to users.
This patch removes the min=1 constraint, to avoid the trouble for
users who insert IPFIX rows with no targets: it eliminates the log
messages due to failed connections to target "", and eliminates the
need to manually remove the "" target after row insertion.
This doesn't impact the behavior for any existing row, whether it has
a "" target or not.
Signed-off-by: Romain Lenglet <rlenglet@vmware.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
Alex Wang [Wed, 20 Nov 2013 19:38:29 +0000 (11:38 -0800)]
bfd: Add new key "flap_count" to "bfd_status".
This commit adds a new key "flap_count" to "bfd_status" to count
the number of bfd "forwarding" flag flaps. A flap is considered
as a change of the "forwarding" flag value.
Signed-off-by: Alex Wang <alexw@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>
Alex Wang [Wed, 20 Nov 2013 19:15:54 +0000 (11:15 -0800)]
bfd: Add forwarding flag to struct bfd.
This commit adds a forwarding flag to "struct bfd". This flag
is for indicating the interface's capability of packet I/O.
Also, this flag makes it possible to count the number of interface
state flapping. bfd_forwarding__() will update this flag at
each invocation.
Signed-off-by: Alex Wang <alexw@nicira.com> Signed-off-by: Ben Pfaff <blp@nicira.com>