summaryrefslogtreecommitdiff
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* python: Update build system to ensure dirs.py is created.Mark Gray2020-11-261-1/+1
| | | | | | | | | | Update build system to ensure dirs.py is created when it is a dependency for a build target. Also, update setup.py to check for that dependency. Fixes: 943c4a325045 ("python: set ovs.dirs variables with build system values") Signed-off-by: Mark Gray <mark.d.gray@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* ovsdb-idl: Return correct seqno from ovsdb_idl_db_set_condition().Dumitru Ceara2020-11-161-3/+6
| | | | | | | | | | | | | | | | | | | | | If an IDL client sets the same monitor condition twice, the expected seqno when the IDL contents are updated should be the same for both calls. In the following scenario: 1. Client calls ovsdb_idl_db_set_condition(db, table, cond1) 2. ovsdb_idl sends monitor_cond_change(cond1) but the server doesn't yet reply. 3. Client calls ovsdb_idl_db_set_condition(db, table, cond1) At step 3 the returned expected seqno should be the same as at step 1. Similarly, if step 2 is skipped, i.e., the client calls sets the condition twice in the same iteration, then both ovsdb_idl_db_set_condition() calls should return the same value. Fixes: 46437c5232bd ("ovsdb-idl: Enhance conditional monitoring API") Signed-off-by: Dumitru Ceara <dceara@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* ovsdb-idl: Fix *_is_new() IDL functions.Mark Gray2020-11-161-13/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently all functions of the type *_is_new() always return 'false'. This patch resolves this issue by using the 'OVSDB_IDL_CHANGE_INSERT' 'change_seqno' instead of the 'OVSDB_IDL_CHANGE_MODIFY' 'change_seqno' to determine if a row is new and by resetting the 'OVSDB_IDL_CHANGE_INSERT' 'change_seqno' on clear. Further to this, the code is also updated to match the following behaviour: When a row is inserted, the 'OVSDB_IDL_CHANGE_INSERT' 'change_seqno' is updated to match the new database change_seqno. The 'OVSDB_IDL_CHANGE_MODIFY' 'change_seqno' is not set for inserted rows (only for updated rows). At the end of a run, ovsdb_idl_db_track_clear() should be called to clear all tracking information, this includes resetting all row 'change_seqno' to zero. This will ensure that subsequent runs will not see a previously 'new' row. add_tracked_change_for_references() is updated to only track rows that reference the current row. Also, update unit tests in order to test the *_is_new(), *_is_delete() functions. Suggested-by: Dumitru Ceara <dceara@redhat.com> Reported-at: https://bugzilla.redhat.com/1883562 Fixes: ca545a787ac0 ("ovsdb-idl.c: Increase seqno for change-tracking of table references.") Signed-off-by: Mark Gray <mark.d.gray@redhat.com> Acked-by: Han Zhou <hzhou@ovn.org> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* ofp-actions: Fix userspace support for mpls_ttl.Timothy Redaelli2020-11-161-0/+5
| | | | | | | | | | | Currently mpls_ttl is ignored when a flow is added because MFF_MPLS_TTL is not handled in nx_put_raw(). This commit adds the correct handling of MFF_MPLS_TTL in nx_put_raw(). Fixes: bef3f465bcd5 ("openflow: Support matching and modifying MPLS TTL field.") Signed-off-by: Timothy Redaelli <tredaelli@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* netdev-dpdk: Add option to configure VF MAC address.Gaetan Rivet2020-11-161-0/+69
| | | | | | | | | | | | | | | | | | | | In some cloud topologies, using DPDK VF representors in guest requires configuring a VF before it is assigned to the guest. A first basic option for such configuration is setting the VF MAC address. Add a key 'dpdk-vf-mac' to the 'options' column of the Interface table. This option can be used as such: $ ovs-vsctl add-port br0 dpdk-rep0 -- set Interface dpdk-rep0 type=dpdk \ options:dpdk-vf-mac=00:11:22:33:44:55 Suggested-by: Ilya Maximets <i.maximets@ovn.org> Acked-by: Eli Britstein <elibr@nvidia.com> Acked-by: Kevin Traynor <ktraynor@redhat.com> Signed-off-by: Gaetan Rivet <grive@u256.net> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* netdev-dpdk: Add ability to set MAC address.Ilya Maximets2020-11-161-3/+29
| | | | | | | | | | It is possible to set the MAC address of DPDK ports by calling rte_eth_dev_default_mac_addr_set(). OvS does not actually call this function for non-internal ports, but the implementation is exposed to be used in a later commit. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Signed-off-by: Gaetan Rivet <grive@u256.net>
* netdev-offload-dpdk: Pass L4 proto-id to match in the L3 rte_flow_item.Sriharsha Basavapatna2020-11-161-23/+0
| | | | | | | | | | | | | The offload layer clears the L4 protocol mask in the L3 item, when the L4 item is passed for matching, as an optimization. This can be confusing while parsing the headers in the PMD. Also, the datapath flow specifies this field to be matched. This optimization is best left to the PMD. This patch restores the code to pass the L4 protocol type in L3 match. Signed-off-by: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com> Acked-by: Eli Britstein <elibr@mellanox.com> Tested-by: Emma Finn <emma.finn@intel.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* lldp: correctly increase discarded countVincent Bernat2020-11-161-0/+2
| | | | | | | | | | | | | | | | | | | Upstream commit: commit 32f0deeebc9172c3f5f4a4d02aab32e6904947f6 Date: Sat, 18 Feb 2017 20:11:47 +0100 lldpd: correctly increase discarded count When a frame cannot be decoded but has been guessed, increase the discarded count. Fix https://github.com/vincentbernat/lldpd/issues/223 Fixes: be53a5c447c3 ("auto-attach: Initial support for Auto-Attach standard") Co-authored-by: Fabrizio D'Angelo <fdangelo@redhat.com> Signed-off-by: Fabrizio D'Angelo <fdangelo@redhat.com> Acked-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* lldp: increase statsTLVsUnrecognizedTotal on unknown TLVVincent Bernat2020-11-161-0/+1
| | | | | | | | | | | | | | | | Upstream commit: commit 109bcd423cd560545ec7940d73a50c5584aebb0c Author: Vincent Bernat <vincent@bernat.ch> Date: Sat, 6 Apr 2019 21:17:25 +0200 This was done for organization TLVs, but not for other TLVs. Fix https://github.com/vincentbernat/lldpd/issues/323 Fixes: be53a5c447c3 ("auto-attach: Initial support for Auto-Attach standard") Signed-off-by: Fabrizio D'Angelo <fdangelo@redhat.com> Acked-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* lldp: fix a buffer overflow when handling management address TLVVincent Bernat2020-11-161-1/+6
| | | | | | | | | | | | | | | | | | | | | | | Upstream commit: commit a8d8006c06d9ac16ebcf33295cbd625c0847ca9b Author: Vincent Bernat <vincent@bernat.im> Date: Sun, 4 Oct 2015 01:50:38 +0200 lldp: fix a buffer overflow when handling management address TLV When a remote device was advertising a too large management address while still respecting TLV boundaries, lldpd would crash due to a buffer overflow. However, the buffer being a static one, this buffer overflow is not exploitable if hardening was not disabled. This bug exists since version 0.5.6. Fixes: be53a5c447c3 ("auto-attach: Initial support for Auto-Attach standard") Reported-by: Jonas Rudloff <jonas.t.rudloff@gmail.com> Reported-at: https://github.com/openvswitch/ovs/pull/335 Co-authored-by: Fabrizio D'Angelo <fdangelo@redhat.com> Signed-off-by: Fabrizio D'Angelo <fdangelo@redhat.com> Acked-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* lldp: Fix size of PEEK_DISCARD_UINT32()Jonas Johansson2020-11-161-1/+1
| | | | | | | | | | | | | | | | | | Upstream commit: commit a8d8006c06d9ac16ebcf33295cbd625c0847ca9b Author: Jonas Johansson <jonasj76@gmail.com> Date: Thu, 21 Apr 2016 11:50:06 +0200 Fix size of PEEK_DISCARD_UINT32() Signed-off-by: Jonas Johansson <jonasj76@gmail.com> Fixes: be53a5c447c3 ("auto-attach: Initial support for Auto-Attach standard") Reported-by: Jonas Rudloff <jonas.t.rudloff@gmail.com> Reported-at: https://github.com/openvswitch/ovs/pull/336 Signed-off-by: Fabrizio D'Angelo <fdangelo@redhat.com> Acked-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* lldp: validate a bit more received LLDP framesVincent Bernat2020-11-161-2/+51
| | | | | | | | | | | | | | | | | | | | Upstream commit: commit 3aeae72b97716fddac290634fad02b952d981f17 Author: Vincent Bernat <vincent@bernat.ch> Date: Tue, 1 Oct 2019 21:42:42 +0200 lldp: validate a bit more received LLDP frames Notably, we ensure the order and unicity of Chassis ID, Port ID and TTL TLV. For Chassis ID and Port ID, we also ensure the maximum size does not exceed 256. Fix https://github.com/vincentbernat/lldpd/issues/351 Fixes: be53a5c447c3 ("auto-attach: Initial support for Auto-Attach standard") Signed-off-by: Aaron Conole <aconole@redhat.com> Co-authored-by: Aaron Conole <aconole@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* sha1: Fix algorithm for data bigger than 512 megabytes.Renat Nurgaliyev2020-11-162-4/+4
| | | | | | | | | | | | | | | | | | | | | In modern systems, size_t is 64 bits. There is a 32 bit overflow check in sha1_update(), which will not work correctly, because compiler will do an automatic cast to 64 bits, since size_t type variable is in the expression. We do want however to lose data, since this is the whole idea of this overflow check. Because of this, computation of SHA-1 checksum will always be incorrect for any data, that is bigger than 512 megabytes, which in bits is the boundary of 32 bits integer. In practice it means that any OVSDB transaction, bigger or equal to 512 megabytes, is considered corrupt and ovsdb-server will refuse to work with the database file. This is especially critical for OVN southbound database, since it tends to grow rapidly. Fixes: 5eccf359391f ("Replace SHA-1 library with one that is clearly licensed.") Signed-off-by: Renat Nurgaliyev <impleman@gmail.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* odp-util: Fix overflow of nested netlink attributes.Ilya Maximets2020-11-162-7/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Length of nested attributes must be checked before storing to the header. If current length exceeds the maximum value parsing should fail, otherwise the length value will be truncated leading to corrupted netlink message and out-of-bound memory accesses: ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6310002cc838 at pc 0x000000575470 bp 0x7ffc6c322d60 sp 0x7ffc6c322d58 READ of size 1 at 0x6310002cc838 thread T0 SCARINESS: 12 (1-byte-read-heap-buffer-overflow) #0 0x57546f in format_generic_odp_key lib/odp-util.c:2738:39 #1 0x559e70 in check_attr_len lib/odp-util.c:3572:13 #2 0x56581a in format_odp_key_attr lib/odp-util.c:4392:9 #3 0x5563b9 in format_odp_action lib/odp-util.c:1192:9 #4 0x555d75 in format_odp_actions lib/odp-util.c:1279:13 ... Fix that by checking the length of nested netlink attributes before updating 'nla_len' inside the header. Additionally introduced assertion inside nl_msg_end_nested() to catch this kind of issues before actual overflow happened. Credit to OSS-Fuzz. Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20003 Fixes: 65da723b40a5 ("odp-util: Format tunnel attributes directly from netlink.") Acked-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* python: set ovs.dirs variables with build system valuesMark Gray2020-11-161-1/+1
| | | | | | | | | | | | ovs/dirs.py should be auto-generated using the template ovs/dirs.py.template at build time. This will set the ovs.dirs python variables with a value specified by the environment or, if the environment variable is not set, from the build system. Signed-off-by: Mark Gray <mark.d.gray@redhat.com> Acked-By: Timothy Redaelli <tredaelli@redhat.com> Signed-off-by: Ian Stokes <ian.stokes@intel.com>
* netdev-offload-tc: Use single 'once' variable for probing tc featuresRoi Dayan2020-11-111-7/+3
| | | | | | | | There is no need for a 'once' variable per probe. Signed-off-by: Roi Dayan <roid@nvidia.com> Reviewed-by: Paul Blakey <paulb@mellanox.com> Signed-off-by: Simon Horman <simon.horman@netronome.com>
* dpctl: Add the option 'pmd' for dump-flows.Tonghao Zhang2020-11-102-5/+21
| | | | | | | | | | | | "ovs-appctl dpctl/dump-flows" added the option "pmd" which allow user to dump pmd specified. That option is useful to dump rules of pmd when we have a large number of rules in dp. Signed-off-by: Tonghao Zhang <xiangxia.m.yue@gmail.com> Acked-by: Gaetan Rivet <grive@u256.net> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* netdev-offload-dpdk: Preserve HW statistics for modified flows.Eli Britstein2020-11-101-11/+22
| | | | | | | | | | | | In case of a flow modification, preserve the HW statistics of the old HW flow to the new one. Fixes: 3c7330ebf036 ("netdev-offload-dpdk: Support offload of output action.") Signed-off-by: Eli Britstein <elibr@nvidia.com> Reviewed-by: Gaetan Rivet <gaetanr@nvidia.com> Acked-by: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com> Tested-by: Emma Finn <emma.finn@intel.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* raft: Set threshold on backlog for raft connections.Ilya Maximets2020-11-102-1/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RAFT messages could be fairly big. If something abnormal happens to one of the servers in a cluster it may not be able to process all the incoming messages in a timely manner. This results in jsonrpc backlog growth on the sender's side. For example if follower gets many new clients at once that it needs to serve, or it decides to take a snapshot in a period of high number of database changes. If backlog grows large enough it becomes harder and harder for follower to process incoming raft messages, it sends outdated replies and starts receiving snapshots and the whole raft log from the leader. Sometimes backlog grows too high (60GB in this example): jsonrpc|INFO|excessive sending backlog, jsonrpc: ssl:<ip>, num of msgs: 15370, backlog: 61731060773. In this case OS might actually decide to kill the sender to free some memory. Anyway, It could take a lot of time for such a server to catch up with the rest of the cluster if it has so much data to receive and process. Introducing backlog thresholds for jsonrpc connections. If sending backlog will exceed particular values (500 messages or 4GB in size), connection will be dropped and re-created. This will allow to drop all the current backlog and start over increasing chances of cluster recovery. Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1888829 Acked-by: Dumitru Ceara <dceara@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* ovsdb-idl: Add comment with program name to ovsdb_idl_loop transactions.Ben Pfaff2020-11-021-0/+3
| | | | | | | | This can make it easier to see what daemon is committing transactions. Sometimes, in OVN especially, it can be hard to guess. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Dumitru Ceara <dceara@redhat.com>
* packets: Un-inline functions needed by DDlog.Leonid Ryzhyk2020-10-262-86/+108
| | | | | | | | | | | | | | | | DDlog uses these functions from Rust, but Rust can't use inline functions (since it doesn't compile C headers but only links against a C-compatible ABI). Thus, move the implementations of these functions to a .c file. I don't think any of these functions is likely to be an important part of a "fast path" in OVS, but if that's wrong, then we could take another approach. Signed-off-by: Leonid Ryzhyk <lryzhyk@vmware.com> Co-authored-by: Ben Pfaff <blp@ovn.org> Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Numan Siddique <numans@ovn.org>
* netdev-tc-offloads: Don't delete ufid mapping if fail to delete filterJianbo Liu2020-10-231-1/+3
| | | | | | | | | | tc_replace_flower may fail, so the return value must be checked. If not zero, ufid can't be deleted. Otherwise the operations on this filter may fail because its ufid is not found. Signed-off-by: Jianbo Liu <jianbol@nvidia.com> Reviewed-by: Roi Dayan <roid@nvidia.com> Signed-off-by: Simon Horman <simon.horman@netronome.com>
* Eliminate use of term "slave" in bond, LACP, and bundle contexts.Ben Pfaff2020-10-2119-473/+484
| | | | | | | | | | | | | The new term is "member". Most of these changes should not change user-visible behavior. One place where they do is in "ovs-ofctl dump-flows", which will now output "members:..." inside "bundle" actions instead of "slaves:...". I don't expect this to cause real problems in most systems. The old syntax is still supported on input for backward compatibility. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com>
* conntrack: Rename "master" connection to "parent" connection.Ben Pfaff2020-10-216-50/+50
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Alin Gabriel Serdean <aserdean@cloudbasesolutions.com>
* odp-util: Add missing comma after gtpu attributes.Ilya Maximets2020-10-201-1/+1
| | | | | | | | | | | Currently flows are printed like this: 'tunnel(gtpu(flags=0x7f,msgtype=0)flags(0))' With this change: 'tunnel(gtpu(flags=0x7f,msgtype=0),flags(0))' Fixes: 3c6d05a02e0f ("userspace: Add GTP-U support.") Acked-by: Yi Yang <yangyi01@inspur.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* odp-util: Fix using uninitialized gtpu metadata.Ilya Maximets2020-10-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If datapath flow doesn't have one of the fields of gtpu metadata, e.g. 'tunnel(gtpu())', uninitialized stack memory will be used instead. ==3485429==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x853a1b in format_u8x lib/odp-util.c:3474:13 #1 0x86ee9c in format_odp_tun_gtpu_opt lib/odp-util.c:3713:5 #2 0x86a099 in format_odp_tun_attr lib/odp-util.c:3973:13 #3 0x83afe6 in format_odp_key_attr__ lib/odp-util.c:4179:9 #4 0x838afb in odp_flow_format lib/odp-util.c:4563:17 #5 0x738422 in log_flow_message lib/dpif.c:1750:5 #6 0x738e2f in log_flow_put_message lib/dpif.c:1784:9 #7 0x7371a4 in dpif_operate lib/dpif.c:1377:21 #8 0x7363ef in dpif_flow_put lib/dpif.c:1035:5 #9 0xc7aab7 in dpctl_put_flow lib/dpctl.c:1171:13 #10 0xc65a4f in dpctl_unixctl_handler lib/dpctl.c:2701:17 #11 0xaaad04 in process_command lib/unixctl.c:308:13 #12 0xaa87f7 in run_connection lib/unixctl.c:342:17 #13 0xaa842e in unixctl_server_run lib/unixctl.c:393:21 #14 0x51c09c in main vswitchd/ovs-vswitchd.c:128:9 #15 0x7f88344391a2 in __libc_start_main (/lib64/libc.so.6+0x271a2) #16 0x46b92d in _start (vswitchd/ovs-vswitchd+0x46b92d) Uninitialized value was stored to memory at #0 0x87da17 in scan_gtpu_metadata lib/odp-util.c:5221:27 #1 0x874588 in parse_odp_key_mask_attr__ lib/odp-util.c:5862:9 #2 0x83ee14 in parse_odp_key_mask_attr lib/odp-util.c:5808:18 #3 0x83e8b5 in odp_flow_from_string lib/odp-util.c:6065:18 #4 0xc7a4f3 in dpctl_put_flow lib/dpctl.c:1145:13 #5 0xc65a4f in dpctl_unixctl_handler lib/dpctl.c:2701:17 #6 0xaaad04 in process_command lib/unixctl.c:308:13 #7 0xaa87f7 in run_connection lib/unixctl.c:342:17 #8 0xaa842e in unixctl_server_run lib/unixctl.c:393:21 #9 0x51c09c in main vswitchd/ovs-vswitchd.c:128:9 #10 0x7f88344391a2 in __libc_start_main (/lib64/libc.so.6+0x271a2) Uninitialized value was created by an allocation of 'msgtype_ma' in the stack frame of function 'scan_gtpu_metadata' #0 0x87d440 in scan_gtpu_metadata lib/odp-util.c:5187 Fix that by initializing fields to all zeroes by default. Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21426 Fixes: 3c6d05a02e0f ("userspace: Add GTP-U support.") Acked-by: Yi Yang <yangyi01@inspur.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* netdev-offload-dpdk: Support vxlan encap offload with load actions.Lei Wang2020-10-191-0/+4
| | | | | | | | | | | | | | | | | Struct match has the tunnel values/masks in match->flow.tunnel/match->wc.masks.tunnel. Load actions such as load:0xa566c10->NXM_NX_TUN_IPV4_DST[], load:0xbba->NXM_NX_TUN_ID[] are utilizing the tunnel masks fields, but those should not be used for matching. Offloading fails if masks is not clear. Clear it if no tunnel used. Fixes: e8a2b5bf92bb ("netdev-dpdk: implement flow offload with rte flow") Reviewed-by: Eli Britstein <elibr@mellanox.com> Reviewed-by: Gaetan Rivet <gaetanr@mellanox.com> Acked-by: Sriharsha Basavapatna <sriharsha.basavapatna@broadcom.com> Tested-by: Emma Finn <emma.finn@intel.com> Signed-off-by: Lei Wang <leiw@mellanox.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* ofp-ed-props: Fix using uninitialized padding for NSH encap actions.Ilya Maximets2020-10-171-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OVS uses memcmp to compare actions of existing and new flows, but 'struct ofp_ed_prop_nsh_md_type' and corresponding ofpact structure has 3 bytes of padding that never initialized and passed around within OF data structures and messages. Uninitialized bytes in MemcmpInterceptorCommon at offset 21 inside [0x7090000003f8, 136) WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x4a184e in bcmp (vswitchd/ovs-vswitchd+0x4a184e) #1 0x896c8a in ofpacts_equal lib/ofp-actions.c:9121:31 #2 0x564403 in replace_rule_finish ofproto/ofproto.c:5650:37 #3 0x563462 in add_flow_finish ofproto/ofproto.c:5218:13 #4 0x54a1ff in ofproto_flow_mod_finish ofproto/ofproto.c:8091:17 #5 0x5433b2 in handle_flow_mod__ ofproto/ofproto.c:6216:17 #6 0x56a2fc in handle_flow_mod ofproto/ofproto.c:6190:17 #7 0x565bda in handle_single_part_openflow ofproto/ofproto.c:8504:16 #8 0x540b25 in handle_openflow ofproto/ofproto.c:8685:21 #9 0x6697fd in ofconn_run ofproto/connmgr.c:1329:13 #10 0x668e6e in connmgr_run ofproto/connmgr.c:356:9 #11 0x53f1bc in ofproto_run ofproto/ofproto.c:1890:5 #12 0x4ead0c in bridge_run__ vswitchd/bridge.c:3250:9 #13 0x4e9bc8 in bridge_run vswitchd/bridge.c:3309:5 #14 0x51c072 in main vswitchd/ovs-vswitchd.c:127:9 #15 0x7f23a99011a2 in __libc_start_main (/lib64/libc.so.6) #16 0x46b92d in _start (vswitchd/ovs-vswitchd+0x46b92d) Uninitialized value was stored to memory at #0 0x4745aa in __msan_memcpy.part.0 (vswitchd/ovs-vswitchd) #1 0x54529f in rule_actions_create ofproto/ofproto.c:3134:5 #2 0x54915e in ofproto_rule_create ofproto/ofproto.c:5284:11 #3 0x55d419 in add_flow_init ofproto/ofproto.c:5123:17 #4 0x54841f in ofproto_flow_mod_init ofproto/ofproto.c:7987:17 #5 0x543250 in handle_flow_mod__ ofproto/ofproto.c:6206:13 #6 0x56a2fc in handle_flow_mod ofproto/ofproto.c:6190:17 #7 0x565bda in handle_single_part_openflow ofproto/ofproto.c:8504:16 #8 0x540b25 in handle_openflow ofproto/ofproto.c:8685:21 #9 0x6697fd in ofconn_run ofproto/connmgr.c:1329:13 #10 0x668e6e in connmgr_run ofproto/connmgr.c:356:9 #11 0x53f1bc in ofproto_run ofproto/ofproto.c:1890:5 #12 0x4ead0c in bridge_run__ vswitchd/bridge.c:3250:9 #13 0x4e9bc8 in bridge_run vswitchd/bridge.c:3309:5 #14 0x51c072 in main vswitchd/ovs-vswitchd.c:127:9 #15 0x7f23a99011a2 in __libc_start_main (/lib64/libc.so.6) Uninitialized value was created by an allocation of 'ofpacts_stub' in the stack frame of function 'handle_flow_mod' #0 0x569e80 in handle_flow_mod ofproto/ofproto.c:6170 This could cause issues with flow modifications or other operations. To reproduce, some NSH tests could be run under valgrind or clang MemorySantizer. Ex. "nsh - md1 encap over a veth link" test. Fix that by clearing padding bytes while encoding and decoding. OVS will still accept OF messages with non-zero padding from controllers. New tests added to tests/ofp-actions.at. Fixes: 1fc11c5948cf ("Generic encap and decap support for NSH") Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Acked-by: Jan Scheurich <jan.scheurich@ericsson.com>
* Eliminate "whitelist" and "blacklist" terms.Ben Pfaff2020-10-165-12/+12
| | | | | | | | There is one remaining use under datapath. That change should happen upstream in Linux first according to our usual policy. Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org>
* Use primary/secondary, not master/slave, as names for OpenFlow roles.Ben Pfaff2020-10-161-46/+48
| | | | | Signed-off-by: Ben Pfaff <blp@ovn.org> Acked-by: Alin Gabriel Serdean <aserdean@ovn.org>
* dpctl: Fix broken flow deletion via ovs-dpctl due to missing ufid.Ilya Maximets2020-10-092-46/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Current code generates UFID for flows installed by ovs-dpctl. This leads to inability to remove such flows by the same command. Ex: ovs-dpctl add-dp test ovs-dpctl add-if test vport0 ovs-dpctl add-flow test "in_port(0),eth(),eth_type(0x800),ipv4(src=100.1.0.1)" 0 ovs-dpctl del-flow test "in_port(0),eth(),eth_type(0x800),ipv4(src=100.1.0.1)" dpif|WARN|system@test: failed to flow_del (No such file or directory) ufid:e4457189-3990-4a01-bdcf-1e5f8b208711 in_port(0), eth(src=00:00:00:00:00:00,dst=00:00:00:00:00:00),eth_type(0x0800), ipv4(src=100.1.0.1,dst=0.0.0.0,proto=0,tos=0,ttl=0,frag=no) ovs-dpctl: deleting flow (No such file or directory) Perhaps you need to specify a UFID? During del-flow operation UFID is generated too, however resulted value is different from one generated during add-flow. This happens because odp_flow_key_hash() function uses random base value for flow hashes which is different on every invocation. That is not an issue while running 'ovs-appctl dpctl/{add,del}-flow' because execution of these requests happens in context of the OVS main process, i.e. there will be same random seed. Commit e61984e781e6 was intended to allow offloading for flows added by dpctl/add-flow unixctl command, so it's better to generate UFIDs conditionally inside dpctl command handler only for appctl invocations. Offloading is not possible from ovs-dpctl utility anyway. There are still couple of corner case: It will not be possible to remove flow by 'ovs-appctl dpctl/del-flow' without specifying UFID if main OVS process was restarted since flow addition and it will not be possible to remove flow by ovs-dpctl without specifying UUID if it was added by 'ovs-appctl dpctl/add-flow'. But these scenarios seems minor since these commands intended for testing only. Reported-by: Eelco Chaudron <echaudro@redhat.com> Reported-at: https://mail.openvswitch.org/pipermail/ovs-dev/2020-September/374863.html Fixes: e61984e781e6 ("dpif-netlink: Generate ufids for installing TC flowers") Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Acked-by: Eelco Chaudron <echaudro@redhat.com> Tested-by: Eelco Chaudron <echaudro@redhat.com>
* dns-resolve: Allow unbound's config file to be set through an env var.Ted Elhourani2020-10-081-0/+12
| | | | | | | | | | | When an unbound context is created, check whether OVS_UNBOUND_CONF has been set. If a valid config file is supplied then use it to configure the context. The procedure returns if the config file is invalid. If no config file is found then the default unbound config is used. Reviewed-by: Yifeng Sun <pkusunyifeng@gmail.com> Signed-off-by: Ted Elhourani <ted.elhourani@nutanix.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* smap: Add smap_get_uint() helper function.Numan Siddique2020-10-082-0/+18
| | | | | | | | | This helper function is required by OVN. Suggested-by: Dumitru Ceara <dceara@redhat.com> Signed-off-by: Numan Siddique <nusiddiq@redhat.com> Acked-by: Dumitru Ceara <dceara@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* dpif-netdev: Fix typo in copyright header.Ian Stokes2020-10-072-2/+2
| | | | | | | | | | Reported-by: David Marchand <david.marchand@redhat.com> Fixes: 352b6c7116cd ("dpif-lookup: add avx512 gather implementation.") Fixes: f5ace7cd8a85 ("dpif-netdev: Move dpcls lookup structures to .h") Cc: Harry Van Haaren <harry.van.haaren@intel.com> Signed-off-by: Ian Stokes <ian.stokes@intel.com> Acked-by: Harry van Haaren <harry.van.haaren@intel.com> Acked-by: Flavio Leitner <fbl@sysclose.org>
* DPDK: Remove support for vhost-user zero-copy.Ian Stokes2020-10-051-25/+0
| | | | | | | | | | | | | | | | | | | | | Support for vhost-user dequeue zero-copy was deprecated in OVS 2.14 with the aim of removing it for OVS 2.15. OVS only supports zero copy for vhost client mode, as such it will cease to function due to DPDK commit [1] Also DPDK is set to remove zero-copy functionality in DPDK 20.11 as referenced by commit [2] As such remove support from OVS. [1] 715070ea10e6 ("vhost: prevent zero-copy with incompatible client mode") [2] d21003c9dafa ("doc: announce removal of vhost zero-copy dequeue") Signed-off-by: Ian Stokes <ian.stokes@intel.com> Acked-by: Maxime Coquelin <maxime.coquelin@redhat.com> Acked-by: Ilya Maximets <i.maximets@ovn.org> Acked-by: Kevin Traynor <ktraynor@redhat.com>
* netdev-dpdk: Don't set rx mq mode for net_virtio.Jaime Caamaño Ruiz2020-09-151-1/+8
| | | | | | | | | | | Since DPDK 19.11 [1], it is not allowed to set any RX mq mode for virtio driver. [1] https://github.com/DPDK/dpdk/commit/13b3137f3b7c8f866947a9b34e06a8aec0d084f7 Signed-off-by: Jaime Caamaño Ruiz <jcaamano@suse.com> Acked-by: Flavio Leitner <fbl@sysclose.org> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* classifier: Fix use of uninitialized value.William Tu2020-09-151-0/+1
| | | | | | | | | | Coverity reports use of uninitialized value of cursor. This happens in cls_cursor_start(), when rule is false, cursor.subtable is uninitialized. CID 279324. Signed-off-by: William Tu <u9012063@gmail.com> Reviewed-by: Greg Rose <gvrose8192@gmail.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* meta-flow: fix a typo in "MPLS Bottom of Stack Field" paragraph.Timothy Redaelli2020-08-261-4/+4
| | | | | | | | | | | | | | | | | | | | In the ovs-fields.7 manual page, the "MPLS Bottom of Stack Field" paragraph says: * When mpls_bos is 1, there is another MPLS label following this one, so the Ethertype passed to pop_mpls should be an MPLS Ethertype. [...] * When mpls_bos is 0, this MPLS label is the last one, so the Ethertype passed to pop_mpls should be a non-MPLS Ethertype such as IPv4. [...] The values 0 and 1 have been swapped: when BOS is 1, then no more label stack entries follows. Fixes: 96fee5e0a2a0 ("ovs-fields: New manpage to document Open vSwitch and OpenFlow fields.") Reported-at: https://bugzilla.redhat.com/1842032 Reported-by: Guillaume Nault <gnault@redhat.com> Signed-off-by: Timothy Redaelli <tredaelli@redhat.com> Acked-by: Greg Rose <gvrose8192@gmail.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* netdev-offload-dpdk: Fix for broken ethernet matching HWOL for XL710NIC.Emma Finn2020-08-171-3/+16
| | | | | | | | | | | | | This patch introduces a temporary work around to fix partial hardware offload for XL710 devices. Currently the incorrect ethernet pattern is being set. This patch will be removed once this issue is fixed within the i40e PMD. Signed-off-by: Emma Finn <emma.finn@intel.com> Signed-off-by: Eli Britstein <elibr@nvidia.com> Co-authored-by: Eli Britstein <elibr@nvidia.com> Tested-by: Ian Stokes <ian.stokes@intel.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* Revert "ovsdb-idl: Fix NULL deref reported by Coverity."Han Zhou2020-08-121-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 68bc6f88a3a36549fcd3b6248c25c5e2e6deb8f3. The commit causes a regression in OVN scale test. ovn-northd's CPU more than doubled for the test scenario: create and bind 12k ports. Below are some perf data of ovn-northd when running command: ovn-nbctl --wait=sb sync Before reverting this commit: - 92.42% 0.62% ovn-northd ovn-northd [.] main - 91.80% main + 68.93% ovn_db_run (inlined) + 22.45% ovsdb_idl_loop_commit_and_wait After reverting this commit: - 92.84% 0.60% ovn-northd ovn-northd [.] main - 92.24% main + 92.03% ovn_db_run (inlined) Reverting this commit avoided 22.45% of the CPU caused by ovsdb_idl_loop_commit_and_wait(). The commit changed the logic of ovsdb_idl_txn_write__() by adding the check "datum->keys && datum->values" before discarding unchanged data in a transaction. However, it is normal for OVSDB clients ( such as ovn-northd) to try to set columns with same empty data as it is before the transaction. IDL would discard these changes and avoid sending big transactions to server (which would end up as no-op on server side). In the ovn scale test scenario mentioned above, each iteration of ovn-northd would send a transaction to server that includes all rows of the huge Port_Binding table, which caused the significant CPU increase of ovn-northd (and also the OVN SB DB server), resulted in longer end to end latency of OVN configuration changes. For the original problem the commit 68bc6f88 was trying to fix, it doesn't seem to be a real problem. The NULL deref reported by Coverity may be addressed in a future patch using a different approach, if necessary. Signed-off-by: Han Zhou <hzhou@ovn.org> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* dpdk: Deprecate vhost-user dequeue zero-copy.Ian Stokes2020-08-121-0/+2
| | | | | | | | | | | | | | | | | | | Dequeue zero-copy is no longer supported for vhost-user client mode in DPDK due to commit [1]. In addition to this, zero-copy mode has been proposed to be marked deprecated in [2] with removal in the next DPDK LTS release. This commit deprecates support for vhost-user dequeue zero-copy in OVS with its removal expected in the next OVS release. [1] 715070ea10e6 ("vhost: prevent zero-copy with incompatible client mode") [2] http://mails.dpdk.org/archives/dev/2020-August/177236.html Signed-off-by: Ian Stokes <ian.stokes@intel.com> Acked-by: Maxime Coquelin <maxime.coquelin@redhat.com> Acked-by: Ilya Maximets <i.maximets@ovn.org>
* netdev-dpdk: linear buffer check with zero-copySivaprasad Tummala2020-08-121-0/+6
| | | | | | | | | | | | | | | | | | | | As of DPDK 19.11, in order to use dequeue-zero-copy in DPDK Vhost library, the application has to disable the linear buffer option. Hence dequeue-zero-copy is not supported for vhost application that requires linear buffers. An alternative DPDK based approach to disable the linear buffers within the vhost library itself was proposed in [1], however the consensus was that application should be responsible for disabling linear buffers. As such this patch disables linear buffers when zero-copy is enabled. [1] https://patches.dpdk.org/patch/67200/ Fixes: 127b6a6eea02 ("dpdk: Update to use DPDK 19.11.") Signed-off-by: Sivaprasad Tummala <Sivaprasad.Tummala@intel.com> Acked-by: Ilya Maximets <i.maximets@ovn.org> Signed-off-by: Ian Stokes <ian.stokes@intel.com>
* tc: Use skip_hw flag when probing tc featuresRoi Dayan2020-08-063-7/+18
| | | | | | | | | | | There is no need to pass tc rules to hw when just probing for tc features. this will avoid redundant errors from hw drivers that may happen. Signed-off-by: Roi Dayan <roid@mellanox.com> Acked-By: Vlad Buslov <vladbu@mellanox.com> Reviewed-by: Tonghao Zhang <xiangxia.m.yue@gmail.com> Signed-off-by: Simon Horman <simon.horman@netronome.com>
* dpif-netdev/avx512: add -fPIC flag to enable shared buildsHarry van Haaren2020-08-051-0/+1
| | | | | | | | | | In certain scenarios with OVS built with --enable-shared and DPDK enabled as shared build too, Position Independant Code is required to link the avx512.a file into the relocatable .so that it must be linked into. Signed-off-by: Harry van Haaren <harry.van.haaren@intel.com> Signed-off-by: Ian Stokes <ian.stokes@intel.com>
* dpif-netdev/avx512: avoid compiling avx512 code if binutils check failsHarry van Haaren2020-08-051-0/+2
| | | | | | | | | This commit avoids compiling and linking of avx512 code into the vswitch_la library if the binutils check fails. This avoids compiling code into OVS that will not be executed due to binutils issue. Signed-off-by: Harry van Haaren <harry.van.haaren@intel.com> Signed-off-by: Ian Stokes <ian.stokes@intel.com>
* odp-util: Clear padding in the nd_extension.Peng He2020-08-041-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | Silimar to the patch 67eb8110171f ("odp-util: Fix passing uninitialized bytes in OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV*.") when change from flow into the netlink format, the tail padding of nd_extension should be cleared. this fixes the following warning logs: |ofproto_dpif_upcall(pmd-...)|WARN|Conflicting ukey for flows: ufid:763c7d3b-4d0c-4bff-aafc-fdfb6089c2ba <...>,eth(...),eth_type(0x86dd),ipv6(...),icmpv6(type=135,code=0),\ nd(target=fdbd:dc02:ff:1:1::1,sll=fa:16:3e:75:b3:a9,tll=00:00:00:00:00:00),\ nd_ext(nd_reserved=0x0,nd_options_type=1) ufid:763c7d3b-4d0c-4bff-aafc-fdfb6089c2ba <...>,eth(...),eth_type(0x86dd),ipv6(...),icmpv6(type=135,code=0),\ nd(target=fdbd:dc02:ff:1:1::1,sll=fa:16:3e:75:b3:a9,tll=00:00:00:00:00:00),\ nd_ext(nd_reserved=0x0,nd_options_type=1) |ofproto_dpif_upcall(pmd-...)|WARN|upcall_cb failure: ukey installation fails Fixes: 9b2b84973db7 ("Support for match & set ICMPv6 reserved and options type fields") Signed-off-by: Peng He <hepeng.0320@bytedance.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* odp-util: Fix clearing match mask if set action is partially unnecessary.Ilya Maximets2020-07-293-16/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While committing set() actions, commit() could wildcard all the fields that are same in match key and in the set action. This leads to situation where mask after commit could actually contain less bits than it was before. And if set action was partially committed, all the fields that were the same will be cleared out from the matching key resulting in the incorrect (too wide) flow. For example, for the flow that matches on both src and dst mac addresses, if the dst mac is the same and only src should be changed by the set() action, destination address will be wildcarded in the match key and will never be matched, i.e. flows with any destination mac will match, which is not correct. Setting OF rule: in_port=1,dl_src=50:54:00:00:00:09 actions=mod_dl_dst(50:54:00:00:00:0a),output(2) Sending following packets on port 1: 1. eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),eth_type(0x0800) 2. eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0c),eth_type(0x0800) 3. eth(src=50:54:00:00:00:0b,dst=50:54:00:00:00:0c),eth_type(0x0800) Resulted datapath flows: eth(dst=50:54:00:00:00:0c),<...>, actions:set(eth(dst=50:54:00:00:00:0a)),2 eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),<...>, actions:2 The first flow doesn't have any match on source MAC address and the third packet successfully matched on it while it must be dropped. Fix that by updating the match mask with only the new bits set by commit(), but keeping those that were cleared (OR operation). With fix applied, resulted correct flows are: eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0a),<...>, actions:2 eth(src=50:54:00:00:00:09,dst=50:54:00:00:00:0c),<...>, actions:set(eth(dst=50:54:00:00:00:0a)),2 eth(src=50:54:00:00:00:0b),<...>, actions:drop The code before commit dbf4a92800d0 was not able to reduce the mask, it was only possible to expand it to exact match, so it was OK to update original matching mask with the new value in all cases. Fixes: dbf4a92800d0 ("odp-util: Do not rewrite fields with the same values as matched") Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1854376 Acked-by: Eli Britstein <elibr@mellanox.com> Tested-by: Adrián Moreno <amorenoz@redhat.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* bfd: Support overlay BFDYifeng Sun2020-07-271-3/+13
| | | | | | | | | | | | | | | Current OVS intercepts and processes all BFD packets, thus VM-2-VM BFD packets get lost and the recipient VM never sees them. This patch fixes it by only intercepting and processing BFD packets destined to a configured BFD instance, and other BFD packets are made available to the OVS flow table for forwarding. This patch keeps BFD's backward compatibility. VMware-BZ: #2579326 Signed-off-by: Yifeng Sun <pkusunyifeng@gmail.com> Signed-off-by: William Tu <u9012063@gmail.com>
* Revert "dpif-netdev: includes microsecond delta in meter bucket calculation".Tonghao Zhang2020-07-271-5/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 5c41c31ebd64fda821fb733a5784a7a440a794f8. Use the pktgen-dpdk to test the commit 5c41c31ebd64 ("dpif-netdev: includes microsecond delta in meter bucket calculation"), it does't work as expected. And it broken the meter function (e.g. set rate 200Mbps, the rate watched was 400Mbps). To reproduce it: $ ovs-vsctl add-br br-int -- set bridge br-int datapath_type=netdev $ ovs-ofctl -O OpenFlow13 add-meter br-int \ "meter=100 kbps burst stats bands=type=drop rate=200000 burst_size=200000" $ ovs-ofctl -O OpenFlow13 add-flow br-int \ "in_port=dpdk0 action=meter:100,output:dpdk1" $ pktgen -l 1,3,5,7,9,11,13,15,17,19 -n 8 --socket-mem 4096 \ --file-prefix pg1 -w 0000:82:00.0 -w 0000:82:00.1 -- \ -T -P -m "[3/5/7/9/11/13/15].[0-1]" -f meter-test.pkt meter-test.pkt: | set 0 count 0 | set 0 size 1500 | set 0 rate 100 | set 0 burst 64 | set 0 sport 1234 | set 0 dport 5678 | set 0 prime 1 | set 0 type ipv4 | set 0 proto udp | set 0 dst ip 1.1.1.2 | set 0 src ip 1.1.1.1/24 | set 0 dst mac ec:0d:9a:ab:54:0a | set 0 src mac ec:0d:9a:bf:df:bb | set 0 vlanid 0 | start 0 Note that the issue that patch 5c41c31ebd64 was intended to fix was already fixed by commit: 42697ca7757b ("dpif-netdev: fix meter at high packet rate.") Signed-off-by: Tonghao Zhang <xiangxia.m.yue@gmail.com> Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
* dpctl: Fix memory leak in dpctl_dump_flows()Tonghao Zhang2020-07-211-1/+1
| | | | | | | | | | Goto label accurately to avoid memleak. Fixes: a692410af0f7 ("dpctl: Expand the flow dump type filter") Cc: Gavi Teitz <gavi@mellanox.com> Reviewed-by: Roi Dayan <roid@mellanox.com> Signed-off-by: Tonghao Zhang <xiangxia.m.yue@gmail.com> Signed-off-by: William Tu <u9012063@gmail.com>
View Lorry Controller Status