diff options
| author | Ben Pfaff <blp@ovn.org> | 2018-01-24 11:40:19 -0800 |
|---|---|---|
| committer | Ben Pfaff <blp@ovn.org> | 2018-02-06 10:25:50 -0800 |
| commit | 687bafbb8a798dc0b2f65a14669501c44c01c0ed (patch) | |
| tree | c705a4cba6c0c60fd7b1d74da6a5823ceaa89f16 /lib | |
| parent | 48999827e6b6021c610cc64a43c4835c9a3b2b9d (diff) | |
| download | openvswitch-687bafbb8a798dc0b2f65a14669501c44c01c0ed.tar.gz | |
ofproto-dpif-upcall: Slow path flows that datapath can't fully match.
In the OVS architecture, when a datapath doesn't have a match for a packet,
it sends the packet and the flow that it extracted from it to userspace.
Userspace then examines the packet and the flow and compares them.
Commonly, the flow is the same as what userspace expects, given the packet,
but there are two other possibilities:
- The flow lacks one or more fields that userspace expects to be there,
that is, the datapath doesn't understand or parse them but userspace
does. This is, for example, what would happen if current OVS
userspace, which understands and extracts TCP flags, were to be
paired with an older OVS kernel module, which does not. Internally
OVS uses the name ODP_FIT_TOO_LITTLE for this situation.
- The flow includes fields that userspace does not know about, that is,
the datapath understands and parses them but userspace does not.
This is, for example, what would happen if an old OVS userspace that
does not understand or extract TCP flags, were to be paired with a
recent OVS kernel module that does. Internally, OVS uses the name
ODP_FIT_TOO_MUCH for this situation.
The latter is not a big deal and OVS doesn't have to do much to cope with
it.
The former is more of a problem. When the datapath can't match on all the
fields that OVS supports, it means that OVS can't safely install a flow at
all, other than one that directs packets to the slow path. Otherwise, if
OVS did install a flow, it could match a packet that does not match the
flow that OVS intended to match and could cause the wrong behavior.
Somehow, this nuance was lost a long time. From about 2013 until today,
it seems that OVS has ignored ODP_FIT_TOO_LITTLE. Instead, it happily
installs a flow regardless of whether the datapath can actually fully match
it. I imagine that this is rarely a problem because most of the time
the datapath and userspace are well matched, but it is still an important
problem to fix. This commit fixes it, by forcing flows into the slow path
when the datapath cannot match specifically enough.
CC: Ethan Jackson <ejj@eecs.berkeley.edu>
Fixes: e79a6c833e0d ("ofproto: Handle flow installation and eviction in upcall.")
Reported-by: Huanle Han <hanxueluo@gmail.com>
Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2018-January/343665.html
Signed-off-by: Ben Pfaff <blp@ovn.org>
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/odp-util.h | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/lib/odp-util.h b/lib/odp-util.h index 0fcc593d2..1fad159db 100644 --- a/lib/odp-util.h +++ b/lib/odp-util.h @@ -37,14 +37,15 @@ struct simap; struct pkt_metadata; #define SLOW_PATH_REASONS \ - /* These reasons are mutually exclusive. */ \ SPR(SLOW_CFM, "cfm", "Consists of CFM packets") \ SPR(SLOW_BFD, "bfd", "Consists of BFD packets") \ SPR(SLOW_LACP, "lacp", "Consists of LACP packets") \ SPR(SLOW_STP, "stp", "Consists of STP packets") \ SPR(SLOW_LLDP, "lldp", "Consists of LLDP packets") \ SPR(SLOW_ACTION, "action", \ - "Uses action(s) not supported by datapath") + "Uses action(s) not supported by datapath") \ + SPR(SLOW_MATCH, "match", \ + "Datapath can't match specifically enough") /* Indexes for slow-path reasons. Client code uses "enum slow_path_reason" * values instead of these, these are just a way to construct those. */ |