Re: [ovs-dev] [PATCH] compat: Add skb_checksum_simple_complete()

On Fri, Jun 1, 2018 at 1:07 PM, Greg Rose wrote: > A recent patch to gre.c added a call to skb_checksum_simple_complete() > which is not present in kernels before 3.16. Fix up the compatability > layer to allow compile on older kernels that do not have it. > > Signed-off-by: Greg Rose > --- LGT

Re: [ovs-dev] dpcls: Miniflow match of packet and subtable

Thanks Harry for explanation. I got your points :) So I guess your proposal should work with two assumptions: 1) For packet miniflow bitmap, a bit as "0" means the packet header does not have the corresponding field. And 2) For subtable mask miniflow, a bit as "1" means all the rules in the sub

[ovs-dev] [PATCH] compat: Add skb_checksum_simple_complete()

A recent patch to gre.c added a call to skb_checksum_simple_complete() which is not present in kernels before 3.16. Fix up the compatability layer to allow compile on older kernels that do not have it. Signed-off-by: Greg Rose --- acinclude.m4 | 5 + datapat

[ovs-dev] [PATCH] ovn: Allow for automatic dynamic updates of IPAM

OVN offers a method of IP address management that allows for an IPv4 subnet or IPv6 prefix to be specified on a logical switch. Then by specifying a switch port's address as "dynamic" or " dynamic", OVN will automatically assign addresses to the switch port. While this works great for initial assi

[ovs-dev] [PATCH v3 5/6] selinux: introduce domain transitioned kmod helper

This commit uses the previously defined selinux label to transition from the openvswitch_t to openvswitch_load_module_t domain by executing ovs-kmod-ctl that is labelled with openvswitch_load_module_exec_t type. Note that unless the selinux relabel operation is invoked, the script will not be labe

[ovs-dev] [PATCH v3 6/6] rhel: selinux-policy to invoke proper label macros

The rpm doesn't invoke all of the required selinux helpers to enact labeling or relabeling on all versions of Fedora/RHEL. According to: https://fedoraproject.org/wiki/SELinux/IndependentPolicy This commit switches to use the selinux rpm macros which will ensure that all of the labels defined i

[ovs-dev] [PATCH v3 4/6] selinux: tag the custom policy version

Since the policy is an intermediate file, it can inherit the policy module version from release version. Also include an SPDX identifier. Suggested-by: Ansis Atteka Acked-by: Ansis Atteka Signed-off-by: Aaron Conole --- selinux/openvswitch-custom.te.in | 4 +++- 1 file changed, 3 insertions(+

[ovs-dev] [PATCH v3 1/6] ovs-kmod-ctl: introduce a kernel module load script

Currently, Open vSwitch on linux embeds the logic of loading and unloading kernel modules into the ovs-ctl and ovs-lib script files. This works, but it means that there is no way to leverage extended filesystem attributes to grant fine grain permissions relating to module loading. The split out u

[ovs-dev] [PATCH v3 3/6] selinux: allow openvswitch_t net_broadcast and net_raw

The ovs-vswitchd daemon requires both CAP_NET_RAW and CAP_NET_BROADCAST, but these are generally policy prevented by selinux. This allows these capabilities to be retained by the openvswitch_t domain. example: type=AVC msg=audit(1527876508.109:3043): avc: denied { net_broadcast } for pid=5

[ovs-dev] [PATCH v3 2/6] selinux: create a transition type for module loading

Defines a type 'openvswitch_load_module_t' used exclusively for loading modules. This means that the 'openvswitch_t' domain won't require access to the module loading facility - such access can only happen after transitioning through the 'openvswitch_load_module_exec_t' transition context. A futu

[ovs-dev] [PATCH v3 0/6] selinux: introduce a transition domain for loading kmods

On linux systems, the initial start of openvswitch attempts to load the openvswitch.ko kernel module. This module allows openvswitch to utilize the kernel datapath. Some of these linux systems, notably Fedora and RHEL, use selinux to enforce additional restrictions on various processes by way of

Re: [ovs-dev] [PATCH] dpif: Ensure ERSPAN GRE support

On Fri, Jun 1, 2018 at 9:38 AM, Jiri Benc wrote: > On Fri, 1 Jun 2018 09:15:33 -0700, Gregory Rose wrote: >> Since ERSPAN over gre/ip_gre was added to the Linux 4.16 kernel the >> compat interface is needed >> for kernels up to 4.15 so that we can support ERSPAN. If the built-in >> gre/ip_gre ker

Re: [ovs-dev] [PATCH] dpif: Ensure ERSPAN GRE support

On Fri, Jun 1, 2018 at 9:56 AM, Gregory Rose wrote: > On 6/1/2018 9:38 AM, Jiri Benc wrote: >> >> On Fri, 1 Jun 2018 09:15:33 -0700, Gregory Rose wrote: >>> >>> Since ERSPAN over gre/ip_gre was added to the Linux 4.16 kernel the >>> compat interface is needed >>> for kernels up to 4.15 so that we

Re: [ovs-dev] [PATCH v2 2/2] ovn: Test for full logical flow processing in ovn-controller

On Fri, 1 Jun 2018 10:50:07 -0700 Han Zhou wrote: > On Fri, Jun 1, 2018 at 10:03 AM, Jakub Sitnicki wrote: > > > > On Fri, 1 Jun 2018 09:21:28 -0700 > > Han Zhou wrote: > > > > > On Fri, Jun 1, 2018 at 6:49 AM, Jakub Sitnicki wrote: > > > > > > > > On Thu, 31 May 2018 10:14:50 -0700 > > >

Re: [ovs-dev] [PATCH v2 2/2] ovn: Test for full logical flow processing in ovn-controller

On Fri, Jun 1, 2018 at 10:03 AM, Jakub Sitnicki wrote: > > On Fri, 1 Jun 2018 09:21:28 -0700 > Han Zhou wrote: > > > On Fri, Jun 1, 2018 at 6:49 AM, Jakub Sitnicki wrote: > > > > > > On Thu, 31 May 2018 10:14:50 -0700 > > > Han Zhou wrote: > > > > > > > > +# vec_sub VEC_A VEC_B > > > > > +# > >

[ovs-dev] [PATCH v3 16/16] ovn-controller: Incremental processing for port-group changes.

Signed-off-by: Han Zhou --- ovn/controller/lflow.h | 3 ++- ovn/controller/ovn-controller.c | 54 - 2 files changed, 44 insertions(+), 13 deletions(-) diff --git a/ovn/controller/lflow.h b/ovn/controller/lflow.h index a5c42f1..b20838a 100644 ---

[ovs-dev] [PATCH v3 15/16] ovn-controller: Split port_groups from runtime_data.

Signed-off-by: Han Zhou --- ovn/controller/ovn-controller.c | 105 +--- 1 file changed, 87 insertions(+), 18 deletions(-) diff --git a/ovn/controller/ovn-controller.c b/ovn/controller/ovn-controller.c index 953582f..aa32284 100644 --- a/ovn/controller/ovn-cont

[ovs-dev] [PATCH v3 14/16] ovn-controller: Incremental processing for address-set changes.

Signed-off-by: Han Zhou --- ovn/controller/lflow.c | 100 ovn/controller/lflow.h | 16 +++ ovn/controller/ovn-controller.c | 72 - tests/ovn.at| 71 4 fil

[ovs-dev] [PATCH v3 13/16] ovn-controller: Maintain resource references for logical flows.

This patch maintains the cross reference between logical flows and the resources such as address sets and port groups that are used by logical flows. This data will be needed in address set and port group incremental processing. Signed-off-by: Han Zhou --- include/ovn/expr.h | 5 +

[ovs-dev] [PATCH v3 12/16] ovn-controller: Split addr_sets from runtime_data.

Signed-off-by: Han Zhou --- ovn/controller/ovn-controller.c | 94 ++--- 1 file changed, 78 insertions(+), 16 deletions(-) diff --git a/ovn/controller/ovn-controller.c b/ovn/controller/ovn-controller.c index 56902ff..8b0cd46 100644 --- a/ovn/controller/ovn-cont

[ovs-dev] [PATCH v3 11/16] ovsdb-idl: Tracking - preserve data for deleted rows.

OVSDB IDL can track changes, but for deleted rows, the data is destroyed and only uuid is tracked. In some cases we need to check the data of the deleted rows. This patch preserves data for deleted rows until track clear is called. Signed-off-by: Han Zhou --- lib/ovsdb-idl-provider.h | 2 ++ li

[ovs-dev] [PATCH v3 10/16] ovn-controller: incremental processing for multicast group changes

Signed-off-by: Han Zhou --- ovn/controller/ovn-controller.c | 37 - ovn/controller/physical.c | 23 +++ ovn/controller/physical.h | 7 ++- 3 files changed, 65 insertions(+), 2 deletions(-) diff --git a/ovn/controller/ovn-co

[ovs-dev] [PATCH v3 06/16] ovn-controller: Incremental logical flow processing

Persistents flow-table and implements change handler of flow_output for SB lflow changes. Signed-off-by: Han Zhou --- include/ovn/actions.h | 3 + ovn/controller/lflow.c | 178 +++-- ovn/controller/lflow.h | 20 +++- ovn/controller/ofctrl.c

[ovs-dev] [PATCH v3 09/16] ovn-controller: Avoid forced recompute when not needed

Signed-off-by: Han Zhou --- ovn/controller/ovn-controller.c | 13 + ovn/lib/inc-proc-eng.c | 20 ovn/lib/inc-proc-eng.h | 4 3 files changed, 33 insertions(+), 4 deletions(-) diff --git a/ovn/controller/ovn-controller.c b/ovn/controller/ov

[ovs-dev] [PATCH v3 08/16] ovn-controller: port-binding incremental processing for physical flows

This patch implements change handler for port-binding in flow_output for physical flows computing, so that physical flow computing will be incremental. This patch together with previous incremental processing engine related changes supports incremental processing for lflow changes and port-binding

[ovs-dev] [PATCH v3 07/16] ovn-controller: runtime_data change handler for SB port-binding

Evaluates change for SB port-binding in runtime_data node. If the port-binding change has no impact for the runtime_data it will not trigger runtime_data change. Signed-off-by: Han Zhou --- ovn/controller/binding.c| 92 + ovn/controller/binding.h

[ovs-dev] [PATCH v3 05/16] ovn-controller: split ovs_idl inputs in incremental engine

Create nodes for ovs_idl inputs and add ovs_idl inputs and SB inputs as dependencies for runtime_data. With this patch there is no recomputed if there is no change in input. For example, pinctrl input will not trigger flow recompute any more. Signed-off-by: Han Zhou --- ovn/controller/ovn-contro

[ovs-dev] [PATCH v3 03/16] ovn-controller: Initial use of incremental engine in main

Incremental proccessing engine is used to compute flows. In this patch we only create 2 engine nodes with simple dependency: runtime_data -> flow_output In each iteration everything is still recomputed. Signed-off-by: Han Zhou --- ovn/controller/ofctrl.c | 21 +- ovn/controller/ofc

[ovs-dev] [PATCH v3 04/16] ovn-controller: Split SB inputs as separate incremental engine nodes

This patch expands the incremental processing by spliting SB inputs from runtime_data and add them as input for flow_output. Signed-off-by: Han Zhou --- ovn/controller/ovn-controller.c | 44 - 1 file changed, 43 insertions(+), 1 deletion(-) diff --git a/o

[ovs-dev] [PATCH v3 02/16] ovn-controller: Track OVSDB changes

Track OVSDB changes for future patches of incremental processing Signed-off-by: Han Zhou --- ovn/controller/bfd.c| 4 ++-- ovn/controller/binding.c| 16 ovn/controller/encaps.c | 12 ++-- ovn/controller/ovn-controller.c | 22 +

[ovs-dev] [PATCH v3 01/16] ovn-controller: Incremental processing engine

This patch implements the engine which will be used in future patches for ovn-controller incremental processing. Signed-off-by: Han Zhou --- ovn/lib/automake.mk| 4 +- ovn/lib/inc-proc-eng.c | 141 ++ ovn/lib/inc-proc-eng.h | 202

[ovs-dev] [PATCH v3 00/16] ovn-controller incremental processing

ovn-controller currently recomputes everything when there are any changes of input, which leads to high CPU usages and slow in end-to-end flow enforcement in response to changes. It even wastes CPU to recompute flows for unrelated inputs such as pinctrl events. This patch series implements increme

[ovs-dev] [PATCH v3 1/1] netdev-vport: reject concomitant incompatible tunnels

This patch will make sure VXLAN tunnels with and without the group based policy (GBP) option enabled can not coexist on the same destination UDP port. In theory, VXLAN tunnel with and without GBP enables can be multiplexed on the same UDP port as long as different VNI's are used. However currently

Re: [ovs-dev] [PATCH v2 2/2] ovn: Test for full logical flow processing in ovn-controller

On Fri, 1 Jun 2018 09:21:28 -0700 Han Zhou wrote: > On Fri, Jun 1, 2018 at 6:49 AM, Jakub Sitnicki wrote: > > > > On Thu, 31 May 2018 10:14:50 -0700 > > Han Zhou wrote: > > > > > > +# vec_sub VEC_A VEC_B > > > > +# > > > > +# Subtracts two vectors: > > > > +# > > > > +# VEC_A = [a1, a2, .

Re: [ovs-dev] [PATCH] dpif: Ensure ERSPAN GRE support

On 6/1/2018 9:38 AM, Jiri Benc wrote: On Fri, 1 Jun 2018 09:15:33 -0700, Gregory Rose wrote: Since ERSPAN over gre/ip_gre was added to the Linux 4.16 kernel the compat interface is needed for kernels up to 4.15 so that we can support ERSPAN.  If the built-in gre/ip_gre kernel modules don't have

Re: [ovs-dev] [PATCH] dpif: Ensure ERSPAN GRE support

On 6/1/2018 9:38 AM, Jiri Benc wrote: On Fri, 1 Jun 2018 09:15:33 -0700, Gregory Rose wrote: Since ERSPAN over gre/ip_gre was added to the Linux 4.16 kernel the compat interface is needed for kernels up to 4.15 so that we can support ERSPAN.  If the built-in gre/ip_gre kernel modules don't have

Re: [ovs-dev] [PATCH] dpif: Ensure ERSPAN GRE support

On Fri, 1 Jun 2018 09:15:33 -0700, Gregory Rose wrote: > Since ERSPAN over gre/ip_gre was added to the Linux 4.16 kernel the > compat interface is needed > for kernels up to 4.15 so that we can support ERSPAN.  If the built-in > gre/ip_gre kernel modules > don't have the ERSPAN support in them th

Re: [ovs-dev] [PATCH v2 2/2] ovn: Test for full logical flow processing in ovn-controller

On Fri, Jun 1, 2018 at 6:49 AM, Jakub Sitnicki wrote: > > On Thu, 31 May 2018 10:14:50 -0700 > Han Zhou wrote: > > > > +# vec_sub VEC_A VEC_B > > > +# > > > +# Subtracts two vectors: > > > +# > > > +# VEC_A = [a1, a2, ...] > > > +# VEC_B = [b1, b2, ...] > > > +# OUT = [(a1 - b1), (a2

Re: [ovs-dev] [PATCH] dpif: Ensure ERSPAN GRE support

On 6/1/2018 8:30 AM, Eric Garver wrote: On Fri, Jun 01, 2018 at 07:40:49AM -0700, Gregory Rose wrote: On 6/1/2018 6:15 AM, Eric Garver wrote: I'm a bit late, but I have comments below. I'm also a bit out of touch, so I may be missing some context - if so, I apologize. On Thu, May 31, 2018 at

Re: [ovs-dev] [PATCH v3 1/1] ovs-thread: Fix thread id for threads not started with ovs_thread_create()

On 01.06.2018 16:18, Eelco Chaudron wrote: > When ping-pong'in a live VM migration between two machines running > OVS-DPDK every now and then the ping misses would increase > dramatically. For example: > > ===Stream Rate: 3Mpps=== > No Stream_Rate Downtime Totaltime Ping_Loss Moong

Re: [ovs-dev] [PATCH] dpif: Ensure ERSPAN GRE support

On Fri, Jun 01, 2018 at 07:40:49AM -0700, Gregory Rose wrote: > On 6/1/2018 6:15 AM, Eric Garver wrote: > > I'm a bit late, but I have comments below. > > > > I'm also a bit out of touch, so I may be missing some context - if so, I > > apologize. > > > > On Thu, May 31, 2018 at 03:50:31PM -0700,

Re: [ovs-dev] [PATCH] dpif: Ensure ERSPAN GRE support

On 6/1/2018 6:15 AM, Eric Garver wrote: I'm a bit late, but I have comments below. I'm also a bit out of touch, so I may be missing some context - if so, I apologize. On Thu, May 31, 2018 at 03:50:31PM -0700, Greg Rose wrote: When verifying the built-in gre kernel module check for ERSPAN suppo

Re: [ovs-dev] [PATCH v2 2/2] ovn: Test for full logical flow processing in ovn-controller

On Thu, 31 May 2018 10:14:50 -0700 Han Zhou wrote: > > +# vec_sub VEC_A VEC_B > > +# > > +# Subtracts two vectors: > > +# > > +# VEC_A = [a1, a2, ...] > > +# VEC_B = [b1, b2, ...] > > +# OUT = [(a1 - b1), (a2 - b2), ...] > > +# > > +# VEC_A and VEC_B must be lists of values separated

Re: [ovs-dev] [PATCH v2 1/2] coverage: Add command for reading counter value

On Thu, 31 May 2018 09:39:44 -0700 Han Zhou wrote: > On Thu, May 31, 2018 at 3:41 AM, Jakub Sitnicki wrote: > > > > Facilitate checking coverage counters from scripts and tests with a new > > "coverage/read-counter" command that gets the total count for a counter. > > > > Same could be achieved

Re: [ovs-dev] [RFC PATCH] netdev-dpdk: Integrate vHost User PMD

> > > On Mon, May 21, 2018 at 04:44:13PM +0100, Ciara Loftus wrote: > > > The vHost PMD brings vHost User port types ('dpdkvhostuser' and > > > 'dpdkvhostuserclient') under control of DPDK's librte_ether API, like > > > all other DPDK netdev types ('dpdk' and 'dpdkr'). In doing so, direct > > > ca

[ovs-dev] [PATCH v3 1/1] ovs-thread: Fix thread id for threads not started with ovs_thread_create()

When ping-pong'in a live VM migration between two machines running OVS-DPDK every now and then the ping misses would increase dramatically. For example: ===Stream Rate: 3Mpps=== No Stream_Rate Downtime Totaltime Ping_Loss Moongen_Loss 0 3Mpps 128 13974 115

Re: [ovs-dev] [PATCH] dpif: Ensure ERSPAN GRE support

I'm a bit late, but I have comments below. I'm also a bit out of touch, so I may be missing some context - if so, I apologize. On Thu, May 31, 2018 at 03:50:31PM -0700, Greg Rose wrote: > When verifying the built-in gre kernel module check for ERSPAN support. > > Reported-by: Guru Shetty > Sign

Re: [ovs-dev] [PATCH v3] Avoid tunneling for VLAN packets redirected to a gateway chassis

On Fri, Jun 1, 2018 at 12:13 AM, Anil Venkata wrote: > Thanks Russell. > > On Thu, May 31, 2018 at 1:41 AM, Russell Bryant wrote: > >> One more general question: >> >> a major difference when doing the redirect to the gateway via a VLAN >> vs a geneve tunnel is the lack of metadata. You've demo

Re: [ovs-dev] [PATCH v2 1/1] ovs-thread: Fix thread id for threads not started with ovs_thread_create()

On 01/06/18 13:48, Ilya Maximets wrote: On 01.06.2018 14:07, Eelco Chaudron wrote: On 01/06/18 12:51, Ilya Maximets wrote: On 29.05.2018 11:23, Eelco Chaudron wrote: On 05/28/2018 03:42 PM, Ilya Maximets wrote: On 28.05.2018 14:06, Eelco Chaudron wrote: +unsigned int +ovsthread_id_init(voi

Re: [ovs-dev] [PATCH v2 1/1] ovs-thread: Fix thread id for threads not started with ovs_thread_create()

On 01.06.2018 14:07, Eelco Chaudron wrote: > On 01/06/18 12:51, Ilya Maximets wrote: >> On 29.05.2018 11:23, Eelco Chaudron wrote: >>> On 05/28/2018 03:42 PM, Ilya Maximets wrote: On 28.05.2018 14:06, Eelco Chaudron wrote: >>> > +unsigned int > +ovsthread_id_init(void) > +{ >

[ovs-dev] [PATCH 1/1] Utilities: Add the simap and netdev_provider dump commands to gdb

This changes add two additional gdb commands: - ovs_dump_netdev_provider - ovs_dump_ovs_list Here are some examples of their output: ovs_dump_netdev_provider: = (gdb) ovs_dump_netdev_provider (struct netdev_registered_class *) 0x2b2c540: refcnt = {count = 3},

Re: [ovs-dev] [PATCH v2 1/1] ovs-thread: Fix thread id for threads not started with ovs_thread_create()

On 01/06/18 12:51, Ilya Maximets wrote: On 29.05.2018 11:23, Eelco Chaudron wrote: On 05/28/2018 03:42 PM, Ilya Maximets wrote: On 28.05.2018 14:06, Eelco Chaudron wrote: +unsigned int +ovsthread_id_init(void) +{ +    static atomic_count next_id = ATOMIC_COUNT_INIT(0); + +    unsigned int id

[ovs-dev] [PATCH v2] OVN: do not mark ND packets for conntrack in PRE_LB stage

Do not send Neighbor Discovery packets to conntrack module if load balancing rules have been added to NB db since otherwise Neighbor Advertisement frames will be discarded by OVN. In order to reproduce the issue it is enough to add 2 logical ports to a single logical switch, assign an IPv6 address

Re: [ovs-dev] [PATCH v2 1/1] ovs-thread: Fix thread id for threads not started with ovs_thread_create()

On 29.05.2018 11:23, Eelco Chaudron wrote: > On 05/28/2018 03:42 PM, Ilya Maximets wrote: >> On 28.05.2018 14:06, Eelco Chaudron wrote: > > >>> +unsigned int >>> +ovsthread_id_init(void) >>> +{ >>> +    static atomic_count next_id = ATOMIC_COUNT_INIT(0); >>> + >>> +    unsigned int id = *ovsthrea

[ovs-dev] [PATCH] dpcls: cache miniflow blocks during lookup

Lookup consists of 3 main stages: 1) hashing of the packet miniflow based on subtable mf bits 2) lookup of that hash into cmap 3) verification of the rule based on the rule mf bits Before this commit, the iteration of stages 1) and 3) was totally independant, and the work done was duplicate. The r

Re: [ovs-dev] ICT Service Desk

From: Stutzman, Bettina Sent: Friday, June 01, 2018 3:33 AM To: Stutzman, Bettina Subject: ICT Service Desk ICT Service Desk vereist dat u bijwerkt / opnieuw valideert naar de meest recente e-mail Outlook Web Apps 2018, vriendelijk Klik op Service Desk

Re: [ovs-dev] dpcls: Miniflow match of packet and subtable

> From: Wang, Yipeng1 > Sent: Tuesday, May 22, 2018 11:49 PM > To: Van Haaren, Harry ; ovs-dev@openvswitch.org > Cc: Gobriel, Sameh > Subject: RE: dpcls: Miniflow match of packet and subtable > > Hi, Harry, > > Welcome! Thanks! > Please see my reply inlined: My responses also inline, prefixed

[ovs-dev] [PATCH 2/2] Add Drop Stats unit test cases

This patch adds unit test cases for Improved Drop statistics feature request raised by following https://patchwork.ozlabs.org/patch/918934/ Signed-off-by: Rohith Basavaraja --- tests/automake.mk | 3 +- tests/dpif-netdev.at | 6 ++ tests/drop-stats.at| 212