X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=ofproto%2Fofproto-dpif-xlate.c;h=f103d6a49ead315e8eca08884c3a4fe71f2e9adc;hb=04594cd5a80cff071f029d72e98385c9e69faeb0;hp=84677a137563f708df79651eff280e8d48c86c97;hpb=46c88433b341c4d982c10d9de5bf3330bbcd621d;p=sliver-openvswitch.git diff --git a/ofproto/ofproto-dpif-xlate.c b/ofproto/ofproto-dpif-xlate.c index 84677a137..f103d6a49 100644 --- a/ofproto/ofproto-dpif-xlate.c +++ b/ofproto/ofproto-dpif-xlate.c @@ -16,6 +16,8 @@ #include "ofproto/ofproto-dpif-xlate.h" +#include + #include "bfd.h" #include "bitmap.h" #include "bond.h" @@ -42,6 +44,7 @@ #include "ofproto/ofproto-dpif-mirror.h" #include "ofproto/ofproto-dpif-sflow.h" #include "ofproto/ofproto-dpif.h" +#include "ofproto/ofproto-provider.h" #include "tunnel.h" #include "vlog.h" @@ -53,6 +56,12 @@ VLOG_DEFINE_THIS_MODULE(ofproto_dpif_xlate); * flow translation. */ #define MAX_RESUBMIT_RECURSION 64 +/* Maximum number of resubmit actions in a flow translation, whether they are + * recursive or not. */ +#define MAX_RESUBMITS (MAX_RESUBMIT_RECURSION * MAX_RESUBMIT_RECURSION) + +struct ovs_rwlock xlate_rwlock = OVS_RWLOCK_INITIALIZER; + struct xbridge { struct hmap_node hmap_node; /* Node in global 'xbridges' map. */ struct ofproto_dpif *ofproto; /* Key in global 'xbridges' map. */ @@ -61,13 +70,18 @@ struct xbridge { struct hmap xports; /* Indexed by ofp_port. */ char *name; /* Name used in log messages. */ + struct dpif *dpif; /* Datapath interface. */ struct mac_learning *ml; /* Mac learning handle. */ struct mbridge *mbridge; /* Mirroring. */ struct dpif_sflow *sflow; /* SFlow handle, or null. */ struct dpif_ipfix *ipfix; /* Ipfix handle, or null. */ + struct stp *stp; /* STP or null if disabled. */ + + /* Special rules installed by ofproto-dpif. */ + struct rule_dpif *miss_rule; + struct rule_dpif *no_packet_in_rule; enum ofp_config_flags frag; /* Fragmentation handling. */ - bool has_stp; /* Bridge runs stp? */ bool has_netflow; /* Bridge runs netflow? */ bool has_in_band; /* Bridge has in band control? */ bool forward_bpdu; /* Bridge forwards STP BPDUs? */ @@ -112,7 +126,9 @@ struct xport { struct xport *peer; /* Patch port peer or null. */ enum ofputil_port_config config; /* OpenFlow port configuration. */ - enum stp_state stp_state; /* STP_DISABLED if STP not in use. */ + int stp_port_no; /* STP port number or -1 if not in use. */ + + struct hmap skb_priorities; /* Map of 'skb_priority_to_dscp's. */ bool may_enable; /* May be enabled in bonds. */ bool is_tunnel; /* Is a tunnel port. */ @@ -146,8 +162,17 @@ struct xlate_ctx { /* The rule that we are currently translating, or NULL. */ struct rule_dpif *rule; - int recurse; /* Recursion level, via xlate_table_action. */ - bool max_resubmit_trigger; /* Recursed too deeply during translation. */ + int mpls_depth_delta; /* Delta of the mpls stack depth since + * actions were last committed. + * Must be between -1 and 1 inclusive. */ + ovs_be32 pre_push_mpls_lse; /* Used to record the top-most MPLS LSE + * prior to an mpls_push so that it may be + * used for a subsequent mpls_pop. */ + + /* Resubmit statistics, via xlate_table_action(). */ + int recurse; /* Current resubmit nesting depth. */ + int resubmits; /* Total number of resubmits. */ + uint32_t orig_skb_priority; /* Priority when packet arrived. */ uint8_t table_id; /* OpenFlow table ID where flow was found. */ uint32_t sflow_n_outputs; /* Number of output ports. */ @@ -160,10 +185,18 @@ struct xlate_ctx { * it did not arrive on a "real" port. 'ofpp_none_bundle' exists for * when an input bundle is needed for validation (e.g., mirroring or * OFPP_NORMAL processing). It is not connected to an 'ofproto' or have - * any 'port' structs, so care must be taken when dealing with it. */ -static struct xbundle ofpp_none_bundle = { - .name = "OFPP_NONE", - .vlan_mode = PORT_VLAN_TRUNK + * any 'port' structs, so care must be taken when dealing with it. + * The bundle's name and vlan mode are initialized in lookup_input_bundle() */ +static struct xbundle ofpp_none_bundle; + +/* Node in 'xport''s 'skb_priorities' map. Used to maintain a map from + * 'priority' (the datapath's term for QoS queue) to the dscp bits which all + * traffic egressing the 'ofport' with that priority should be marked with. */ +struct skb_priority_to_dscp { + struct hmap_node hmap_node; /* Node in 'ofport_dpif''s 'skb_priorities'. */ + uint32_t skb_priority; /* Priority of this queue (see struct flow). */ + + uint8_t dscp; /* DSCP bits to mark outgoing traffic with. */ }; static struct hmap xbridges = HMAP_INITIALIZER(&xbridges); @@ -173,6 +206,8 @@ static struct hmap xports = HMAP_INITIALIZER(&xports); static bool may_receive(const struct xport *, struct xlate_ctx *); static void do_xlate_actions(const struct ofpact *, size_t ofpacts_len, struct xlate_ctx *); +static void xlate_actions__(struct xlate_in *, struct xlate_out *) + OVS_REQ_RDLOCK(xlate_rwlock); static void xlate_normal(struct xlate_ctx *); static void xlate_report(struct xlate_ctx *, const char *); static void xlate_table_action(struct xlate_ctx *, ofp_port_t in_port, @@ -183,20 +218,25 @@ static void output_normal(struct xlate_ctx *, const struct xbundle *, uint16_t vlan); static void compose_output_action(struct xlate_ctx *, ofp_port_t ofp_port); -static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 5); - static struct xbridge *xbridge_lookup(const struct ofproto_dpif *); static struct xbundle *xbundle_lookup(const struct ofbundle *); -static struct xport *xport_lookup(struct ofport_dpif *); +static struct xport *xport_lookup(const struct ofport_dpif *); static struct xport *get_ofp_port(const struct xbridge *, ofp_port_t ofp_port); +static struct skb_priority_to_dscp *get_skb_priority(const struct xport *, + uint32_t skb_priority); +static void clear_skb_priorities(struct xport *); +static bool dscp_from_skb_priority(const struct xport *, uint32_t skb_priority, + uint8_t *dscp); void xlate_ofproto_set(struct ofproto_dpif *ofproto, const char *name, - const struct mac_learning *ml, const struct mbridge *mbridge, + struct dpif *dpif, struct rule_dpif *miss_rule, + struct rule_dpif *no_packet_in_rule, + const struct mac_learning *ml, struct stp *stp, + const struct mbridge *mbridge, const struct dpif_sflow *sflow, const struct dpif_ipfix *ipfix, enum ofp_config_flags frag, - bool forward_bpdu, bool has_in_band, bool has_netflow, - bool has_stp) + bool forward_bpdu, bool has_in_band, bool has_netflow) { struct xbridge *xbridge = xbridge_lookup(ofproto); @@ -229,14 +269,21 @@ xlate_ofproto_set(struct ofproto_dpif *ofproto, const char *name, xbridge->ipfix = dpif_ipfix_ref(ipfix); } + if (xbridge->stp != stp) { + stp_unref(xbridge->stp); + xbridge->stp = stp_ref(stp); + } + free(xbridge->name); xbridge->name = xstrdup(name); + xbridge->dpif = dpif; xbridge->forward_bpdu = forward_bpdu; xbridge->has_in_band = has_in_band; xbridge->has_netflow = has_netflow; - xbridge->has_stp = has_stp; xbridge->frag = frag; + xbridge->miss_rule = miss_rule; + xbridge->no_packet_in_rule = no_packet_in_rule; } void @@ -259,6 +306,12 @@ xlate_remove_ofproto(struct ofproto_dpif *ofproto) } hmap_remove(&xbridges, &xbridge->hmap_node); + mac_learning_unref(xbridge->ml); + mbridge_unref(xbridge->mbridge); + dpif_sflow_unref(xbridge->sflow); + dpif_ipfix_unref(xbridge->ipfix); + stp_unref(xbridge->stp); + hmap_destroy(&xbridge->xports); free(xbridge->name); free(xbridge); } @@ -332,10 +385,13 @@ xlate_ofport_set(struct ofproto_dpif *ofproto, struct ofbundle *ofbundle, struct ofport_dpif *ofport, ofp_port_t ofp_port, odp_port_t odp_port, const struct netdev *netdev, const struct cfm *cfm, const struct bfd *bfd, - struct ofport_dpif *peer, enum ofputil_port_config config, - enum stp_state stp_state, bool is_tunnel, bool may_enable) + struct ofport_dpif *peer, int stp_port_no, + const struct ofproto_port_queue *qdscp_list, size_t n_qdscp, + enum ofputil_port_config config, bool is_tunnel, + bool may_enable) { struct xport *xport = xport_lookup(ofport); + size_t i; if (!xport) { xport = xzalloc(sizeof *xport); @@ -343,6 +399,7 @@ xlate_ofport_set(struct ofproto_dpif *ofproto, struct ofbundle *ofbundle, xport->xbridge = xbridge_lookup(ofproto); xport->ofp_port = ofp_port; + hmap_init(&xport->skb_priorities); hmap_insert(&xports, &xport->hmap_node, hash_pointer(ofport, 0)); hmap_insert(&xport->xbridge->xports, &xport->ofp_node, hash_ofp_port(xport->ofp_port)); @@ -351,7 +408,7 @@ xlate_ofport_set(struct ofproto_dpif *ofproto, struct ofbundle *ofbundle, ovs_assert(xport->ofp_port == ofp_port); xport->config = config; - xport->stp_state = stp_state; + xport->stp_port_no = stp_port_no; xport->is_tunnel = is_tunnel; xport->may_enable = may_enable; xport->odp_port = odp_port; @@ -374,7 +431,7 @@ xlate_ofport_set(struct ofproto_dpif *ofproto, struct ofbundle *ofbundle, if (xport->peer) { xport->peer->peer = NULL; } - xport->peer = peer ? xport_lookup(peer) : NULL; + xport->peer = xport_lookup(peer); if (xport->peer) { xport->peer->peer = xport; } @@ -382,10 +439,27 @@ xlate_ofport_set(struct ofproto_dpif *ofproto, struct ofbundle *ofbundle, if (xport->xbundle) { list_remove(&xport->bundle_node); } - xport->xbundle = ofbundle ? xbundle_lookup(ofbundle) : NULL; + xport->xbundle = xbundle_lookup(ofbundle); if (xport->xbundle) { list_insert(&xport->xbundle->xports, &xport->bundle_node); } + + clear_skb_priorities(xport); + for (i = 0; i < n_qdscp; i++) { + struct skb_priority_to_dscp *pdscp; + uint32_t skb_priority; + + if (dpif_queue_to_priority(xport->xbridge->dpif, qdscp_list[i].queue, + &skb_priority)) { + continue; + } + + pdscp = xmalloc(sizeof *pdscp); + pdscp->skb_priority = skb_priority; + pdscp->dscp = (qdscp_list[i].dscp << 2) & IP_DSCP_MASK; + hmap_insert(&xport->skb_priorities, &pdscp->hmap_node, + hash_int(pdscp->skb_priority, 0)); + } } void @@ -402,7 +476,13 @@ xlate_ofport_remove(struct ofport_dpif *ofport) xport->peer = NULL; } - list_remove(&xport->bundle_node); + if (xport->xbundle) { + list_remove(&xport->bundle_node); + } + + clear_skb_priorities(xport); + hmap_destroy(&xport->skb_priorities); + hmap_remove(&xports, &xport->hmap_node); hmap_remove(&xport->xbridge->xports, &xport->ofp_node); @@ -412,11 +492,104 @@ xlate_ofport_remove(struct ofport_dpif *ofport) free(xport); } +/* Given a datpath, packet, and flow metadata ('backer', 'packet', and 'key' + * respectively), populates 'flow' with the result of odp_flow_key_to_flow(). + * Optionally, if nonnull, populates 'fitnessp' with the fitness of 'flow' as + * returned by odp_flow_key_to_flow(). Also, optionally populates 'ofproto' + * with the ofproto_dpif, and 'odp_in_port' with the datapath in_port, that + * 'packet' ingressed. + * + * If 'ofproto' is nonnull, requires 'flow''s in_port to exist. Otherwise sets + * 'flow''s in_port to OFPP_NONE. + * + * This function does post-processing on data returned from + * odp_flow_key_to_flow() to help make VLAN splinters transparent to the rest + * of the upcall processing logic. In particular, if the extracted in_port is + * a VLAN splinter port, it replaces flow->in_port by the "real" port, sets + * flow->vlan_tci correctly for the VLAN of the VLAN splinter port, and pushes + * a VLAN header onto 'packet' (if it is nonnull). + * + * Similarly, this function also includes some logic to help with tunnels. It + * may modify 'flow' as necessary to make the tunneling implementation + * transparent to the upcall processing logic. + * + * Returns 0 if successful, ENODEV if the parsed flow has no associated ofport, + * or some other positive errno if there are other problems. */ +int +xlate_receive(const struct dpif_backer *backer, struct ofpbuf *packet, + const struct nlattr *key, size_t key_len, + struct flow *flow, enum odp_key_fitness *fitnessp, + struct ofproto_dpif **ofproto, odp_port_t *odp_in_port) +{ + enum odp_key_fitness fitness; + const struct xport *xport; + int error = ENODEV; + + ovs_rwlock_rdlock(&xlate_rwlock); + fitness = odp_flow_key_to_flow(key, key_len, flow); + if (fitness == ODP_FIT_ERROR) { + error = EINVAL; + goto exit; + } + + if (odp_in_port) { + *odp_in_port = flow->in_port.odp_port; + } + + xport = xport_lookup(tnl_port_should_receive(flow) + ? tnl_port_receive(flow) + : odp_port_to_ofport(backer, flow->in_port.odp_port)); + + flow->in_port.ofp_port = xport ? xport->ofp_port : OFPP_NONE; + if (!xport) { + goto exit; + } + + if (vsp_adjust_flow(xport->xbridge->ofproto, flow)) { + if (packet) { + /* Make the packet resemble the flow, so that it gets sent to + * an OpenFlow controller properly, so that it looks correct + * for sFlow, and so that flow_extract() will get the correct + * vlan_tci if it is called on 'packet'. + * + * The allocated space inside 'packet' probably also contains + * 'key', that is, both 'packet' and 'key' are probably part of + * a struct dpif_upcall (see the large comment on that + * structure definition), so pushing data on 'packet' is in + * general not a good idea since it could overwrite 'key' or + * free it as a side effect. However, it's OK in this special + * case because we know that 'packet' is inside a Netlink + * attribute: pushing 4 bytes will just overwrite the 4-byte + * "struct nlattr", which is fine since we don't need that + * header anymore. */ + eth_push_vlan(packet, flow->vlan_tci); + } + /* We can't reproduce 'key' from 'flow'. */ + fitness = fitness == ODP_FIT_PERFECT ? ODP_FIT_TOO_MUCH : fitness; + } + error = 0; + + if (ofproto) { + *ofproto = xport->xbridge->ofproto; + } + +exit: + if (fitnessp) { + *fitnessp = fitness; + } + ovs_rwlock_unlock(&xlate_rwlock); + return error; +} + static struct xbridge * xbridge_lookup(const struct ofproto_dpif *ofproto) { struct xbridge *xbridge; + if (!ofproto) { + return NULL; + } + HMAP_FOR_EACH_IN_BUCKET (xbridge, hmap_node, hash_pointer(ofproto, 0), &xbridges) { if (xbridge->ofproto == ofproto) { @@ -431,6 +604,10 @@ xbundle_lookup(const struct ofbundle *ofbundle) { struct xbundle *xbundle; + if (!ofbundle) { + return NULL; + } + HMAP_FOR_EACH_IN_BUCKET (xbundle, hmap_node, hash_pointer(ofbundle, 0), &xbundles) { if (xbundle->ofbundle == ofbundle) { @@ -441,10 +618,14 @@ xbundle_lookup(const struct ofbundle *ofbundle) } static struct xport * -xport_lookup(struct ofport_dpif *ofport) +xport_lookup(const struct ofport_dpif *ofport) { struct xport *xport; + if (!ofport) { + return NULL; + } + HMAP_FOR_EACH_IN_BUCKET (xport, hmap_node, hash_pointer(ofport, 0), &xports) { if (xport->ofport == ofport) { @@ -454,6 +635,60 @@ xport_lookup(struct ofport_dpif *ofport) return NULL; } +static struct stp_port * +xport_get_stp_port(const struct xport *xport) +{ + return xport->xbridge->stp && xport->stp_port_no != -1 + ? stp_get_port(xport->xbridge->stp, xport->stp_port_no) + : NULL; +} + +static enum stp_state +xport_stp_learn_state(const struct xport *xport) +{ + struct stp_port *sp = xport_get_stp_port(xport); + return stp_learn_in_state(sp ? stp_port_get_state(sp) : STP_DISABLED); +} + +static bool +xport_stp_forward_state(const struct xport *xport) +{ + struct stp_port *sp = xport_get_stp_port(xport); + return stp_forward_in_state(sp ? stp_port_get_state(sp) : STP_DISABLED); +} + +/* Returns true if STP should process 'flow'. Sets fields in 'wc' that + * were used to make the determination.*/ +static bool +stp_should_process_flow(const struct flow *flow, struct flow_wildcards *wc) +{ + memset(&wc->masks.dl_dst, 0xff, sizeof wc->masks.dl_dst); + return eth_addr_equals(flow->dl_dst, eth_addr_stp); +} + +static void +stp_process_packet(const struct xport *xport, const struct ofpbuf *packet) +{ + struct stp_port *sp = xport_get_stp_port(xport); + struct ofpbuf payload = *packet; + struct eth_header *eth = payload.data; + + /* Sink packets on ports that have STP disabled when the bridge has + * STP enabled. */ + if (!sp || stp_port_get_state(sp) == STP_DISABLED) { + return; + } + + /* Trim off padding on payload. */ + if (payload.size > ntohs(eth->eth_type) + ETH_HEADER_LEN) { + payload.size = ntohs(eth->eth_type) + ETH_HEADER_LEN; + } + + if (ofpbuf_try_pull(&payload, ETH_HEADER_LEN + LLC_HEADER_LEN)) { + stp_received_bpdu(sp, payload.data, payload.size); + } +} + static struct xport * get_ofp_port(const struct xbridge *xbridge, ofp_port_t ofp_port) { @@ -530,6 +765,8 @@ lookup_input_bundle(const struct xbridge *xbridge, ofp_port_t in_port, /* Special-case OFPP_NONE, which a controller may use as the ingress * port for traffic that it is sourcing. */ if (in_port == OFPP_NONE) { + ofpp_none_bundle.name = "OFPP_NONE"; + ofpp_none_bundle.vlan_mode = PORT_VLAN_TRUNK; return &ofpp_none_bundle; } @@ -770,9 +1007,8 @@ output_normal(struct xlate_ctx *ctx, const struct xbundle *out_xbundle, struct ofport_dpif *ofport; ofport = bond_choose_output_slave(out_xbundle->bond, &ctx->xin->flow, - &ctx->xout->wc, vid, - &ctx->xout->tags); - xport = ofport ? xport_lookup(ofport) : NULL; + &ctx->xout->wc, vid); + xport = xport_lookup(ofport); if (!xport) { /* No slaves enabled, so drop packet. */ @@ -822,18 +1058,65 @@ is_gratuitous_arp(const struct flow *flow, struct flow_wildcards *wc) } } -static void -update_learning_table(const struct xbridge *xbridge, - const struct flow *flow, struct flow_wildcards *wc, - int vlan, struct xbundle *in_xbundle) +/* Checks whether a MAC learning update is necessary for MAC learning table + * 'ml' given that a packet matching 'flow' was received on 'in_xbundle' in + * 'vlan'. + * + * Most packets processed through the MAC learning table do not actually + * change it in any way. This function requires only a read lock on the MAC + * learning table, so it is much cheaper in this common case. + * + * Keep the code here synchronized with that in update_learning_table__() + * below. */ +static bool +is_mac_learning_update_needed(const struct mac_learning *ml, + const struct flow *flow, + struct flow_wildcards *wc, + int vlan, struct xbundle *in_xbundle) + OVS_REQ_RDLOCK(ml->rwlock) { struct mac_entry *mac; - /* Don't learn the OFPP_NONE port. */ - if (in_xbundle == &ofpp_none_bundle) { - return; + if (!mac_learning_may_learn(ml, flow->dl_src, vlan)) { + return false; } + mac = mac_learning_lookup(ml, flow->dl_src, vlan); + if (!mac || mac_entry_age(ml, mac)) { + return true; + } + + if (is_gratuitous_arp(flow, wc)) { + /* We don't want to learn from gratuitous ARP packets that are + * reflected back over bond slaves so we lock the learning table. */ + if (!in_xbundle->bond) { + return true; + } else if (mac_entry_is_grat_arp_locked(mac)) { + return false; + } + } + + return mac->port.p != in_xbundle->ofbundle; +} + + +/* Updates MAC learning table 'ml' given that a packet matching 'flow' was + * received on 'in_xbundle' in 'vlan'. + * + * This code repeats all the checks in is_mac_learning_update_needed() because + * the lock was released between there and here and thus the MAC learning state + * could have changed. + * + * Keep the code here synchronized with that in is_mac_learning_update_needed() + * above. */ +static void +update_learning_table__(const struct xbridge *xbridge, + const struct flow *flow, struct flow_wildcards *wc, + int vlan, struct xbundle *in_xbundle) + OVS_REQ_WRLOCK(xbridge->ml->rwlock) +{ + struct mac_entry *mac; + if (!mac_learning_may_learn(xbridge->ml, flow->dl_src, vlan)) { return; } @@ -849,17 +1132,44 @@ update_learning_table(const struct xbridge *xbridge, } } - if (mac_entry_is_new(mac) || mac->port.p != in_xbundle->ofbundle) { + if (mac->port.p != in_xbundle->ofbundle) { /* The log messages here could actually be useful in debugging, * so keep the rate limit relatively high. */ static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(30, 300); + VLOG_DBG_RL(&rl, "bridge %s: learned that "ETH_ADDR_FMT" is " "on port %s in VLAN %d", xbridge->name, ETH_ADDR_ARGS(flow->dl_src), in_xbundle->name, vlan); mac->port.p = in_xbundle->ofbundle; - mac_learning_changed(xbridge->ml, mac); + mac_learning_changed(xbridge->ml); + } +} + +static void +update_learning_table(const struct xbridge *xbridge, + const struct flow *flow, struct flow_wildcards *wc, + int vlan, struct xbundle *in_xbundle) +{ + bool need_update; + + /* Don't learn the OFPP_NONE port. */ + if (in_xbundle == &ofpp_none_bundle) { + return; + } + + /* First try the common case: no change to MAC learning table. */ + ovs_rwlock_rdlock(&xbridge->ml->rwlock); + need_update = is_mac_learning_update_needed(xbridge->ml, flow, wc, vlan, + in_xbundle); + ovs_rwlock_unlock(&xbridge->ml->rwlock); + + if (need_update) { + /* Slow path: MAC learning table might need an update. */ + ovs_rwlock_wrlock(&xbridge->ml->rwlock); + update_learning_table__(xbridge, flow, wc, vlan, in_xbundle); + ovs_rwlock_unlock(&xbridge->ml->rwlock); } } @@ -896,7 +1206,7 @@ is_admissible(struct xlate_ctx *ctx, struct xport *in_port, struct mac_entry *mac; switch (bond_check_admissibility(in_xbundle->bond, in_port->ofport, - flow->dl_dst, &ctx->xout->tags)) { + flow->dl_dst)) { case BV_ACCEPT: break; @@ -905,14 +1215,17 @@ is_admissible(struct xlate_ctx *ctx, struct xport *in_port, return false; case BV_DROP_IF_MOVED: - mac = mac_learning_lookup(xbridge->ml, flow->dl_src, vlan, NULL); + ovs_rwlock_rdlock(&xbridge->ml->rwlock); + mac = mac_learning_lookup(xbridge->ml, flow->dl_src, vlan); if (mac && mac->port.p != in_xbundle->ofbundle && (!is_gratuitous_arp(flow, &ctx->xout->wc) || mac_entry_is_grat_arp_locked(mac))) { + ovs_rwlock_unlock(&xbridge->ml->rwlock); xlate_report(ctx, "SLB bond thinks this packet looped back, " "dropping"); return false; } + ovs_rwlock_unlock(&xbridge->ml->rwlock); break; } } @@ -928,6 +1241,7 @@ xlate_normal(struct xlate_ctx *ctx) struct xbundle *in_xbundle; struct xport *in_port; struct mac_entry *mac; + void *mac_port; uint16_t vlan; uint16_t vid; @@ -988,10 +1302,13 @@ xlate_normal(struct xlate_ctx *ctx) } /* Determine output bundle. */ - mac = mac_learning_lookup(ctx->xbridge->ml, flow->dl_dst, vlan, - &ctx->xout->tags); - if (mac) { - struct xbundle *mac_xbundle = xbundle_lookup(mac->port.p); + ovs_rwlock_rdlock(&ctx->xbridge->ml->rwlock); + mac = mac_learning_lookup(ctx->xbridge->ml, flow->dl_dst, vlan); + mac_port = mac ? mac->port.p : NULL; + ovs_rwlock_unlock(&ctx->xbridge->ml->rwlock); + + if (mac_port) { + struct xbundle *mac_xbundle = xbundle_lookup(mac_port); if (mac_xbundle && mac_xbundle != in_xbundle) { xlate_report(ctx, "forwarding to learned port"); output_normal(ctx, mac_xbundle, vlan); @@ -1029,15 +1346,19 @@ compose_sample_action(const struct xbridge *xbridge, const size_t cookie_size) { size_t sample_offset, actions_offset; + odp_port_t odp_port; int cookie_offset; + uint32_t pid; sample_offset = nl_msg_start_nested(odp_actions, OVS_ACTION_ATTR_SAMPLE); nl_msg_put_u32(odp_actions, OVS_SAMPLE_ATTR_PROBABILITY, probability); actions_offset = nl_msg_start_nested(odp_actions, OVS_SAMPLE_ATTR_ACTIONS); - cookie_offset = put_userspace_action(xbridge->ofproto, odp_actions, flow, - cookie, cookie_size); + + odp_port = ofp_port_to_odp_port(xbridge, flow->in_port.ofp_port); + pid = dpif_port_get_pid(xbridge->dpif, odp_port); + cookie_offset = odp_put_userspace_action(pid, cookie, cookie_size, odp_actions); nl_msg_end_nested(odp_actions, actions_offset); nl_msg_end_nested(odp_actions, sample_offset); @@ -1193,7 +1514,7 @@ process_special(struct xlate_ctx *ctx, const struct flow *flow, cfm_process_heartbeat(xport->cfm, packet); } return SLOW_CFM; - } else if (xport->bfd && bfd_should_process_flow(flow, wc)) { + } else if (xport->bfd && bfd_should_process_flow(xport->bfd, flow, wc)) { if (packet) { bfd_process_packet(xport->bfd, flow, packet); } @@ -1204,9 +1525,9 @@ process_special(struct xlate_ctx *ctx, const struct flow *flow, lacp_process_packet(xport->xbundle->lacp, xport->ofport, packet); } return SLOW_LACP; - } else if (xbridge->has_stp && stp_should_process_flow(flow, wc)) { + } else if (xbridge->stp && stp_should_process_flow(flow, wc)) { if (packet) { - stp_process_packet(xport->ofport, packet); + stp_process_packet(xport, packet); } return SLOW_STP; } else { @@ -1222,14 +1543,14 @@ compose_output_action__(struct xlate_ctx *ctx, ofp_port_t ofp_port, struct flow_wildcards *wc = &ctx->xout->wc; struct flow *flow = &ctx->xin->flow; ovs_be16 flow_vlan_tci; - uint32_t flow_skb_mark; + uint32_t flow_pkt_mark; uint8_t flow_nw_tos; odp_port_t out_port, odp_port; uint8_t dscp; /* If 'struct flow' gets additional metadata, we'll need to zero it out * before traversing a patch port. */ - BUILD_ASSERT_DECL(FLOW_WC_SEQ == 20); + BUILD_ASSERT_DECL(FLOW_WC_SEQ == 21); if (!xport) { xlate_report(ctx, "Nonexistent output port"); @@ -1237,7 +1558,7 @@ compose_output_action__(struct xlate_ctx *ctx, ofp_port_t ofp_port, } else if (xport->config & OFPUTIL_PC_NO_FWD) { xlate_report(ctx, "OFPPC_NO_FWD set, skipping output"); return; - } else if (check_stp && !stp_forward_in_state(xport->stp_state)) { + } else if (check_stp && !xport_stp_forward_state(xport)) { xlate_report(ctx, "STP not in forwarding state, skipping output"); return; } @@ -1261,9 +1582,9 @@ compose_output_action__(struct xlate_ctx *ctx, ofp_port_t ofp_port, special = process_special(ctx, &ctx->xin->flow, peer, ctx->xin->packet); if (special) { - ctx->xout->slow = special; + ctx->xout->slow |= special; } else if (may_receive(peer, ctx)) { - if (stp_forward_in_state(peer->stp_state)) { + if (xport_stp_forward_state(peer)) { xlate_table_action(ctx, flow->in_port.ofp_port, 0, true); } else { /* Forwarding is disabled by STP. Let OFPP_NORMAL and the @@ -1279,7 +1600,7 @@ compose_output_action__(struct xlate_ctx *ctx, ofp_port_t ofp_port, } ctx->xin->flow = old_flow; - ctx->xbridge = xport->xbundle->xbridge; + ctx->xbridge = xport->xbridge; if (ctx->xin->resubmit_stats) { netdev_vport_inc_tx(xport->netdev, ctx->xin->resubmit_stats); @@ -1290,11 +1611,10 @@ compose_output_action__(struct xlate_ctx *ctx, ofp_port_t ofp_port, } flow_vlan_tci = flow->vlan_tci; - flow_skb_mark = flow->skb_mark; + flow_pkt_mark = flow->pkt_mark; flow_nw_tos = flow->nw_tos; - if (ofproto_dpif_dscp_from_priority(xport->ofport, flow->skb_priority, - &dscp)) { + if (dscp_from_skb_priority(xport, flow->skb_priority, &dscp)) { wc->masks.nw_tos |= IP_ECN_MASK; flow->nw_tos &= ~IP_DSCP_MASK; flow->nw_tos |= dscp; @@ -1337,12 +1657,12 @@ compose_output_action__(struct xlate_ctx *ctx, ofp_port_t ofp_port, out_port = ofp_port_to_odp_port(ctx->xbridge, vlandev_port); flow->vlan_tci = htons(0); } - flow->skb_mark &= ~IPSEC_MARK; } if (out_port != ODPP_NONE) { commit_odp_actions(flow, &ctx->base_flow, - &ctx->xout->odp_actions, &ctx->xout->wc); + &ctx->xout->odp_actions, &ctx->xout->wc, + &ctx->mpls_depth_delta); nl_msg_put_odp_port(&ctx->xout->odp_actions, OVS_ACTION_ATTR_OUTPUT, out_port); @@ -1354,7 +1674,7 @@ compose_output_action__(struct xlate_ctx *ctx, ofp_port_t ofp_port, out: /* Restore flow */ flow->vlan_tci = flow_vlan_tci; - flow->skb_mark = flow_skb_mark; + flow->pkt_mark = flow_pkt_mark; flow->nw_tos = flow_nw_tos; } @@ -1364,75 +1684,85 @@ compose_output_action(struct xlate_ctx *ctx, ofp_port_t ofp_port) compose_output_action__(ctx, ofp_port, true); } -/* Common rule processing in one place to avoid duplicating code. */ -static struct rule_dpif * -ctx_rule_hooks(struct xlate_ctx *ctx, struct rule_dpif *rule, - bool may_packet_in) +static void +xlate_recursively(struct xlate_ctx *ctx, struct rule_dpif *rule) { - if (ctx->xin->resubmit_hook) { - ctx->xin->resubmit_hook(ctx->xin, rule, ctx->recurse); - } - if (rule == NULL && may_packet_in) { - /* XXX - * check if table configuration flags - * OFPTC_TABLE_MISS_CONTROLLER, default. - * OFPTC_TABLE_MISS_CONTINUE, - * OFPTC_TABLE_MISS_DROP - * When OF1.0, OFPTC_TABLE_MISS_CONTINUE is used. What to do? - */ - rule = rule_dpif_miss_rule(ctx->xbridge->ofproto, &ctx->xin->flow); - } - if (rule && ctx->xin->resubmit_stats) { - rule_credit_stats(rule, ctx->xin->resubmit_stats); + struct rule_dpif *old_rule = ctx->rule; + struct rule_actions *actions; + + if (ctx->xin->resubmit_stats) { + rule_dpif_credit_stats(rule, ctx->xin->resubmit_stats); } - return rule; + + ctx->resubmits++; + ctx->recurse++; + ctx->rule = rule; + actions = rule_dpif_get_actions(rule); + do_xlate_actions(actions->ofpacts, actions->ofpacts_len, ctx); + rule_actions_unref(actions); + ctx->rule = old_rule; + ctx->recurse--; } static void xlate_table_action(struct xlate_ctx *ctx, ofp_port_t in_port, uint8_t table_id, bool may_packet_in) { - if (ctx->recurse < MAX_RESUBMIT_RECURSION) { + static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 1); + + if (ctx->recurse >= MAX_RESUBMIT_RECURSION) { + VLOG_ERR_RL(&rl, "resubmit actions recursed over %d times", + MAX_RESUBMIT_RECURSION); + } else if (ctx->resubmits >= MAX_RESUBMITS) { + VLOG_ERR_RL(&rl, "over %d resubmit actions", MAX_RESUBMITS); + } else if (ctx->xout->odp_actions.size > UINT16_MAX) { + VLOG_ERR_RL(&rl, "resubmits yielded over 64 kB of actions"); + } else if (ctx->stack.size >= 65536) { + VLOG_ERR_RL(&rl, "resubmits yielded over 64 kB of stack"); + } else { struct rule_dpif *rule; ofp_port_t old_in_port = ctx->xin->flow.in_port.ofp_port; uint8_t old_table_id = ctx->table_id; ctx->table_id = table_id; - /* Look up a flow with 'in_port' as the input port. */ + /* Look up a flow with 'in_port' as the input port. Then restore the + * original input port (otherwise OFPP_NORMAL and OFPP_IN_PORT will + * have surprising behavior). */ ctx->xin->flow.in_port.ofp_port = in_port; - rule = rule_dpif_lookup_in_table(ctx->xbridge->ofproto, - &ctx->xin->flow, &ctx->xout->wc, - table_id); - - ctx->xout->tags |= calculate_flow_tag(ctx->xbridge->ofproto, - &ctx->xin->flow, ctx->table_id, - rule); - - /* Restore the original input port. Otherwise OFPP_NORMAL and - * OFPP_IN_PORT will have surprising behavior. */ + rule_dpif_lookup_in_table(ctx->xbridge->ofproto, + &ctx->xin->flow, &ctx->xout->wc, + table_id, &rule); ctx->xin->flow.in_port.ofp_port = old_in_port; - rule = ctx_rule_hooks(ctx, rule, may_packet_in); + if (ctx->xin->resubmit_hook) { + ctx->xin->resubmit_hook(ctx->xin, rule, ctx->recurse); + } - if (rule) { - struct rule_dpif *old_rule = ctx->rule; + if (!rule && may_packet_in) { + struct xport *xport; - ctx->recurse++; - ctx->rule = rule; - do_xlate_actions(rule->up.ofpacts, rule->up.ofpacts_len, ctx); - ctx->rule = old_rule; - ctx->recurse--; + /* XXX + * check if table configuration flags + * OFPTC_TABLE_MISS_CONTROLLER, default. + * OFPTC_TABLE_MISS_CONTINUE, + * OFPTC_TABLE_MISS_DROP + * When OF1.0, OFPTC_TABLE_MISS_CONTINUE is used. What to do? */ + xport = get_ofp_port(ctx->xbridge, ctx->xin->flow.in_port.ofp_port); + choose_miss_rule(xport ? xport->config : 0, + ctx->xbridge->miss_rule, + ctx->xbridge->no_packet_in_rule, &rule); + } + if (rule) { + xlate_recursively(ctx, rule); + rule_dpif_unref(rule); } ctx->table_id = old_table_id; - } else { - static struct vlog_rate_limit recurse_rl = VLOG_RATE_LIMIT_INIT(1, 1); - - VLOG_ERR_RL(&recurse_rl, "resubmit actions recursed over %d times", - MAX_RESUBMIT_RECURSION); - ctx->max_resubmit_trigger = true; + return; } + + ctx->exit = true; } static void @@ -1480,12 +1810,11 @@ execute_controller_action(struct xlate_ctx *ctx, int len, enum ofp_packet_in_reason reason, uint16_t controller_id) { - struct ofputil_packet_in pin; + struct ofputil_packet_in *pin; struct ofpbuf *packet; struct flow key; - ovs_assert(!ctx->xout->slow || ctx->xout->slow == SLOW_CONTROLLER); - ctx->xout->slow = SLOW_CONTROLLER; + ctx->xout->slow |= SLOW_CONTROLLER; if (!ctx->xin->packet) { return; } @@ -1493,30 +1822,32 @@ execute_controller_action(struct xlate_ctx *ctx, int len, packet = ofpbuf_clone(ctx->xin->packet); key.skb_priority = 0; - key.skb_mark = 0; + key.pkt_mark = 0; memset(&key.tunnel, 0, sizeof key.tunnel); commit_odp_actions(&ctx->xin->flow, &ctx->base_flow, - &ctx->xout->odp_actions, &ctx->xout->wc); + &ctx->xout->odp_actions, &ctx->xout->wc, + &ctx->mpls_depth_delta); odp_execute_actions(NULL, packet, &key, ctx->xout->odp_actions.data, ctx->xout->odp_actions.size, NULL, NULL); - pin.packet = packet->data; - pin.packet_len = packet->size; - pin.reason = reason; - pin.controller_id = controller_id; - pin.table_id = ctx->table_id; - pin.cookie = ctx->rule ? ctx->rule->up.flow_cookie : 0; + pin = xmalloc(sizeof *pin); + pin->packet_len = packet->size; + pin->packet = ofpbuf_steal_data(packet); + pin->reason = reason; + pin->controller_id = controller_id; + pin->table_id = ctx->table_id; + pin->cookie = ctx->rule ? rule_dpif_get_flow_cookie(ctx->rule) : 0; - pin.send_len = len; - flow_get_metadata(&ctx->xin->flow, &pin.fmd); + pin->send_len = len; + flow_get_metadata(&ctx->xin->flow, &pin->fmd); - ofproto_dpif_send_packet_in(ctx->xbridge->ofproto, &pin); + ofproto_dpif_send_packet_in(ctx->xbridge->ofproto, pin); ofpbuf_delete(packet); } -static void +static bool compose_mpls_push_action(struct xlate_ctx *ctx, ovs_be16 eth_type) { struct flow_wildcards *wc = &ctx->xout->wc; @@ -1524,12 +1855,35 @@ compose_mpls_push_action(struct xlate_ctx *ctx, ovs_be16 eth_type) ovs_assert(eth_type_mpls(eth_type)); + /* If mpls_depth_delta is negative then an MPLS POP action has been + * composed and the resulting MPLS label stack is unknown. This means + * an MPLS PUSH action can't be composed as it needs to know either the + * top-most MPLS LSE to use as a template for the new MPLS LSE, or that + * there is no MPLS label stack present. Thus, stop processing. + * + * If mpls_depth_delta is positive then an MPLS PUSH action has been + * composed and no further MPLS PUSH action may be performed without + * losing MPLS LSE and ether type information held in xtx->xin->flow. + * Thus, stop processing. + * + * If the MPLS LSE of the flow and base_flow differ then the MPLS LSE + * has been updated. Performing a MPLS PUSH action may be would result in + * losing MPLS LSE and ether type information held in xtx->xin->flow. + * Thus, stop processing. + * + * It is planned that in the future this case will be handled + * by recirculation */ + if (ctx->mpls_depth_delta || + ctx->xin->flow.mpls_lse != ctx->base_flow.mpls_lse) { + return true; + } + memset(&wc->masks.mpls_lse, 0xff, sizeof wc->masks.mpls_lse); - memset(&wc->masks.mpls_depth, 0xff, sizeof wc->masks.mpls_depth); - if (flow->mpls_depth) { + ctx->pre_push_mpls_lse = ctx->xin->flow.mpls_lse; + + if (eth_type_mpls(ctx->xin->flow.dl_type)) { flow->mpls_lse &= ~htonl(MPLS_BOS_MASK); - flow->mpls_depth++; } else { ovs_be32 label; uint8_t tc, ttl; @@ -1544,30 +1898,48 @@ compose_mpls_push_action(struct xlate_ctx *ctx, ovs_be16 eth_type) tc = (flow->nw_tos & IP_DSCP_MASK) >> 2; ttl = flow->nw_ttl ? flow->nw_ttl : 0x40; flow->mpls_lse = set_mpls_lse_values(ttl, tc, 1, label); - flow->mpls_depth = 1; } flow->dl_type = eth_type; + ctx->mpls_depth_delta++; + + return false; } -static void +static bool compose_mpls_pop_action(struct xlate_ctx *ctx, ovs_be16 eth_type) { struct flow_wildcards *wc = &ctx->xout->wc; - struct flow *flow = &ctx->xin->flow; - ovs_assert(eth_type_mpls(ctx->xin->flow.dl_type)); - ovs_assert(!eth_type_mpls(eth_type)); + if (!eth_type_mpls(ctx->xin->flow.dl_type)) { + return true; + } + + /* If mpls_depth_delta is negative then an MPLS POP action has been + * composed. Performing another MPLS POP action + * would result in losing ether type that results from + * the already composed MPLS POP. Thus, stop processing. + * + * It is planned that in the future this case will be handled + * by recirculation */ + if (ctx->mpls_depth_delta < 0) { + return true; + } memset(&wc->masks.mpls_lse, 0xff, sizeof wc->masks.mpls_lse); - memset(&wc->masks.mpls_depth, 0xff, sizeof wc->masks.mpls_depth); - if (flow->mpls_depth) { - flow->mpls_depth--; - flow->mpls_lse = htonl(0); - if (!flow->mpls_depth) { - flow->dl_type = eth_type; - } + /* If mpls_depth_delta is positive then an MPLS PUSH action has been + * executed and the previous MPLS LSE saved in ctx->pre_push_mpls_lse. The + * flow's MPLS LSE should be restored to that value to allow any + * subsequent actions that update of the LSE to be executed correctly. + */ + if (ctx->mpls_depth_delta > 0) { + ctx->xin->flow.mpls_lse = ctx->pre_push_mpls_lse; } + + ctx->xin->flow.dl_type = eth_type; + ctx->mpls_depth_delta--; + + return false; } static bool @@ -1603,6 +1975,19 @@ compose_set_mpls_ttl_action(struct xlate_ctx *ctx, uint8_t ttl) return true; } + /* If mpls_depth_delta is negative then an MPLS POP action has been + * executed and the resulting MPLS label stack is unknown. This means + * a SET MPLS TTL push action can't be executed as it needs to manipulate + * the top-most MPLS LSE. Thus, stop processing. + * + * It is planned that in the future this case will be handled + * by recirculation. + */ + if (ctx->mpls_depth_delta < 0) { + return true; + } + + ctx->xout->wc.masks.mpls_lse |= htonl(MPLS_TTL_MASK); set_mpls_lse_ttl(&ctx->xin->flow.mpls_lse, ttl); return false; } @@ -1707,8 +2092,7 @@ xlate_enqueue_action(struct xlate_ctx *ctx, int error; /* Translate queue to priority. */ - error = ofproto_dpif_queue_to_priority(ctx->xbridge->ofproto, queue_id, - &priority); + error = dpif_queue_to_priority(ctx->xbridge->dpif, queue_id, &priority); if (error) { /* Fall back to ordinary output action. */ xlate_output_action(ctx, enqueue->port, 0, false); @@ -1741,8 +2125,7 @@ xlate_set_queue_action(struct xlate_ctx *ctx, uint32_t queue_id) { uint32_t skb_priority; - if (!ofproto_dpif_queue_to_priority(ctx->xbridge->ofproto, queue_id, - &skb_priority)) { + if (!dpif_queue_to_priority(ctx->xbridge->dpif, queue_id, &skb_priority)) { ctx->xin->flow.skb_priority = skb_priority; } else { /* Couldn't translate queue to a priority. Nothing to do. A warning @@ -1782,7 +2165,8 @@ xlate_bundle_action(struct xlate_ctx *ctx, slave_enabled_cb, CONST_CAST(struct xbridge *, ctx->xbridge)); if (bundle->dst.field) { - nxm_reg_load(&bundle->dst, ofp_to_u16(port), &ctx->xin->flow); + nxm_reg_load(&bundle->dst, ofp_to_u16(port), &ctx->xin->flow, + &ctx->xout->wc); } else { xlate_output_action(ctx, port, 0, false); } @@ -1792,11 +2176,9 @@ static void xlate_learn_action(struct xlate_ctx *ctx, const struct ofpact_learn *learn) { - static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(5, 1); - struct ofputil_flow_mod fm; uint64_t ofpacts_stub[1024 / 8]; + struct ofputil_flow_mod fm; struct ofpbuf ofpacts; - int error; ctx->xout->has_learn = true; @@ -1806,37 +2188,19 @@ xlate_learn_action(struct xlate_ctx *ctx, return; } - ofpbuf_use_stack(&ofpacts, ofpacts_stub, sizeof ofpacts_stub); + ofpbuf_use_stub(&ofpacts, ofpacts_stub, sizeof ofpacts_stub); learn_execute(learn, &ctx->xin->flow, &fm, &ofpacts); - - error = ofproto_dpif_flow_mod(ctx->xbridge->ofproto, &fm); - if (error && !VLOG_DROP_WARN(&rl)) { - VLOG_WARN("learning action failed to modify flow table (%s)", - ofperr_get_name(error)); - } - + ofproto_dpif_flow_mod(ctx->xbridge->ofproto, &fm); ofpbuf_uninit(&ofpacts); } -/* Reduces '*timeout' to no more than 'max'. A value of zero in either case - * means "infinite". */ -static void -reduce_timeout(uint16_t max, uint16_t *timeout) -{ - if (max && (!*timeout || *timeout > max)) { - *timeout = max; - } -} - static void xlate_fin_timeout(struct xlate_ctx *ctx, const struct ofpact_fin_timeout *oft) { if (ctx->xin->tcp_flags & (TCP_FIN | TCP_RST) && ctx->rule) { - struct rule_dpif *rule = ctx->rule; - - reduce_timeout(oft->fin_idle_timeout, &rule->up.idle_timeout); - reduce_timeout(oft->fin_hard_timeout, &rule->up.hard_timeout); + rule_dpif_reduce_timeouts(ctx->rule, oft->fin_idle_timeout, + oft->fin_hard_timeout); } } @@ -1850,7 +2214,8 @@ xlate_sample_action(struct xlate_ctx *ctx, uint32_t probability = (os->probability << 16) | os->probability; commit_odp_actions(&ctx->xin->flow, &ctx->base_flow, - &ctx->xout->odp_actions, &ctx->xout->wc); + &ctx->xout->odp_actions, &ctx->xout->wc, + &ctx->mpls_depth_delta); compose_flow_sample_cookie(os->probability, os->collector_set_id, os->obs_domain_id, os->obs_point_id, &cookie); @@ -1871,48 +2236,21 @@ may_receive(const struct xport *xport, struct xlate_ctx *ctx) * disabled. If just learning is enabled, we need to have * OFPP_NORMAL and the learning action have a look at the packet * before we can drop it. */ - if (!stp_forward_in_state(xport->stp_state) - && !stp_learn_in_state(xport->stp_state)) { + if (!xport_stp_forward_state(xport) && !xport_stp_learn_state(xport)) { return false; } return true; } -static bool -tunnel_ecn_ok(struct xlate_ctx *ctx) -{ - if (is_ip_any(&ctx->base_flow) - && (ctx->xin->flow.tunnel.ip_tos & IP_ECN_MASK) == IP_ECN_CE) { - if ((ctx->base_flow.nw_tos & IP_ECN_MASK) == IP_ECN_NOT_ECT) { - VLOG_WARN_RL(&rl, "dropping tunnel packet marked ECN CE" - " but is not ECN capable"); - return false; - } else { - /* Set the ECN CE value in the tunneled packet. */ - ctx->xin->flow.nw_tos |= IP_ECN_CE; - } - } - - return true; -} - static void do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len, struct xlate_ctx *ctx) { struct flow_wildcards *wc = &ctx->xout->wc; struct flow *flow = &ctx->xin->flow; - bool was_evictable = true; const struct ofpact *a; - if (ctx->rule) { - /* Don't let the rule we're working on get evicted underneath us. */ - was_evictable = ctx->rule->up.evictable; - ctx->rule->up.evictable = false; - } - - do_xlate_actions_again: OFPACT_FOR_EACH (a, ofpacts, ofpacts_len) { struct ofpact_controller *controller; const struct ofpact_metadata *metadata; @@ -1927,6 +2265,10 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len, ofpact_get_OUTPUT(a)->max_len, true); break; + case OFPACT_GROUP: + /* XXX not yet implemented */ + break; + case OFPACT_CONTROLLER: controller = ofpact_get_CONTROLLER(a); execute_controller_action(ctx, controller->max_len, @@ -1939,12 +2281,14 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len, break; case OFPACT_SET_VLAN_VID: + wc->masks.vlan_tci |= htons(VLAN_VID_MASK | VLAN_CFI); flow->vlan_tci &= ~htons(VLAN_VID_MASK); flow->vlan_tci |= (htons(ofpact_get_SET_VLAN_VID(a)->vlan_vid) | htons(VLAN_CFI)); break; case OFPACT_SET_VLAN_PCP: + wc->masks.vlan_tci |= htons(VLAN_PCP_MASK | VLAN_CFI); flow->vlan_tci &= ~htons(VLAN_PCP_MASK); flow->vlan_tci |= htons((ofpact_get_SET_VLAN_PCP(a)->vlan_pcp << VLAN_PCP_SHIFT) @@ -1952,35 +2296,42 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len, break; case OFPACT_STRIP_VLAN: + memset(&wc->masks.vlan_tci, 0xff, sizeof wc->masks.vlan_tci); flow->vlan_tci = htons(0); break; case OFPACT_PUSH_VLAN: /* XXX 802.1AD(QinQ) */ + memset(&wc->masks.vlan_tci, 0xff, sizeof wc->masks.vlan_tci); flow->vlan_tci = htons(VLAN_CFI); break; case OFPACT_SET_ETH_SRC: + memset(&wc->masks.dl_src, 0xff, sizeof wc->masks.dl_src); memcpy(flow->dl_src, ofpact_get_SET_ETH_SRC(a)->mac, ETH_ADDR_LEN); break; case OFPACT_SET_ETH_DST: + memset(&wc->masks.dl_dst, 0xff, sizeof wc->masks.dl_dst); memcpy(flow->dl_dst, ofpact_get_SET_ETH_DST(a)->mac, ETH_ADDR_LEN); break; case OFPACT_SET_IPV4_SRC: + memset(&wc->masks.nw_src, 0xff, sizeof wc->masks.nw_src); if (flow->dl_type == htons(ETH_TYPE_IP)) { flow->nw_src = ofpact_get_SET_IPV4_SRC(a)->ipv4; } break; case OFPACT_SET_IPV4_DST: + memset(&wc->masks.nw_dst, 0xff, sizeof wc->masks.nw_dst); if (flow->dl_type == htons(ETH_TYPE_IP)) { flow->nw_dst = ofpact_get_SET_IPV4_DST(a)->ipv4; } break; case OFPACT_SET_IPV4_DSCP: + wc->masks.nw_tos |= IP_DSCP_MASK; /* OpenFlow 1.0 only supports IPv4. */ if (flow->dl_type == htons(ETH_TYPE_IP)) { flow->nw_tos &= ~IP_DSCP_MASK; @@ -1990,6 +2341,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len, case OFPACT_SET_L4_SRC_PORT: memset(&wc->masks.nw_proto, 0xff, sizeof wc->masks.nw_proto); + memset(&wc->masks.tp_src, 0xff, sizeof wc->masks.tp_src); if (is_ip_any(flow)) { flow->tp_src = htons(ofpact_get_SET_L4_SRC_PORT(a)->port); } @@ -1997,6 +2349,7 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len, case OFPACT_SET_L4_DST_PORT: memset(&wc->masks.nw_proto, 0xff, sizeof wc->masks.nw_proto); + memset(&wc->masks.tp_dst, 0xff, sizeof wc->masks.tp_dst); if (is_ip_any(flow)) { flow->tp_dst = htons(ofpact_get_SET_L4_DST_PORT(a)->port); } @@ -2032,33 +2385,41 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len, break; case OFPACT_STACK_POP: - nxm_execute_stack_pop(ofpact_get_STACK_POP(a), flow, &ctx->stack); + nxm_execute_stack_pop(ofpact_get_STACK_POP(a), flow, wc, + &ctx->stack); break; case OFPACT_PUSH_MPLS: - compose_mpls_push_action(ctx, ofpact_get_PUSH_MPLS(a)->ethertype); + if (compose_mpls_push_action(ctx, + ofpact_get_PUSH_MPLS(a)->ethertype)) { + return; + } break; case OFPACT_POP_MPLS: - compose_mpls_pop_action(ctx, ofpact_get_POP_MPLS(a)->ethertype); + if (compose_mpls_pop_action(ctx, + ofpact_get_POP_MPLS(a)->ethertype)) { + return; + } break; case OFPACT_SET_MPLS_TTL: if (compose_set_mpls_ttl_action(ctx, ofpact_get_SET_MPLS_TTL(a)->ttl)) { - goto out; + return; } break; case OFPACT_DEC_MPLS_TTL: if (compose_dec_mpls_ttl_action(ctx)) { - goto out; + return; } break; case OFPACT_DEC_TTL: + wc->masks.nw_ttl = 0xff; if (compose_dec_ttl(ctx, ofpact_get_DEC_TTL(a))) { - goto out; + return; } break; @@ -2113,35 +2474,10 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len, case OFPACT_GOTO_TABLE: { /* It is assumed that goto-table is the last action. */ struct ofpact_goto_table *ogt = ofpact_get_GOTO_TABLE(a); - struct rule_dpif *rule; ovs_assert(ctx->table_id < ogt->table_id); - - ctx->table_id = ogt->table_id; - - /* Look up a flow from the new table. */ - rule = rule_dpif_lookup_in_table(ctx->xbridge->ofproto, flow, wc, - ctx->table_id); - - ctx->xout->tags |= calculate_flow_tag(ctx->xbridge->ofproto, - &ctx->xin->flow, - ctx->table_id, rule); - - rule = ctx_rule_hooks(ctx, rule, true); - - if (rule) { - if (ctx->rule) { - ctx->rule->up.evictable = was_evictable; - } - ctx->rule = rule; - was_evictable = rule->up.evictable; - rule->up.evictable = false; - - /* Tail recursion removal. */ - ofpacts = rule->up.ofpacts; - ofpacts_len = rule->up.ofpacts_len; - goto do_xlate_actions_again; - } + xlate_table_action(ctx, ctx->xin->flow.in_port.ofp_port, + ogt->table_id, true); break; } @@ -2150,11 +2486,6 @@ do_xlate_actions(const struct ofpact *ofpacts, size_t ofpacts_len, break; } } - -out: - if (ctx->rule) { - ctx->rule->up.evictable = was_evictable; - } } void @@ -2206,7 +2537,6 @@ void xlate_out_copy(struct xlate_out *dst, const struct xlate_out *src) { dst->wc = src->wc; - dst->tags = src->tags; dst->slow = src->slow; dst->has_learn = src->has_learn; dst->has_normal = src->has_normal; @@ -2219,7 +2549,80 @@ xlate_out_copy(struct xlate_out *dst, const struct xlate_out *src) ofpbuf_put(&dst->odp_actions, src->odp_actions.data, src->odp_actions.size); } + +/* Returns a reference to the sflow handled associated with ofproto, or NULL if + * there is none. The caller is responsible for decrementing the results ref + * count with dpif_sflow_unref(). */ +struct dpif_sflow * +xlate_get_sflow(const struct ofproto_dpif *ofproto) +{ + struct dpif_sflow *sflow = NULL; + struct xbridge *xbridge; + + ovs_rwlock_rdlock(&xlate_rwlock); + xbridge = xbridge_lookup(ofproto); + if (xbridge) { + sflow = dpif_sflow_ref(xbridge->sflow); + } + ovs_rwlock_unlock(&xlate_rwlock); + + return sflow; +} + +/* Returns a reference to the ipfix handled associated with ofproto, or NULL if + * there is none. The caller is responsible for decrementing the results ref + * count with dpif_ipfix_unref(). */ +struct dpif_ipfix * +xlate_get_ipfix(const struct ofproto_dpif *ofproto) +{ + struct dpif_ipfix *ipfix = NULL; + struct xbridge *xbridge; + + ovs_rwlock_rdlock(&xlate_rwlock); + xbridge = xbridge_lookup(ofproto); + if (xbridge) { + ipfix = dpif_ipfix_ref(xbridge->ipfix); + } + ovs_rwlock_unlock(&xlate_rwlock); + + return ipfix; +} +static struct skb_priority_to_dscp * +get_skb_priority(const struct xport *xport, uint32_t skb_priority) +{ + struct skb_priority_to_dscp *pdscp; + uint32_t hash; + + hash = hash_int(skb_priority, 0); + HMAP_FOR_EACH_IN_BUCKET (pdscp, hmap_node, hash, &xport->skb_priorities) { + if (pdscp->skb_priority == skb_priority) { + return pdscp; + } + } + return NULL; +} + +static bool +dscp_from_skb_priority(const struct xport *xport, uint32_t skb_priority, + uint8_t *dscp) +{ + struct skb_priority_to_dscp *pdscp = get_skb_priority(xport, skb_priority); + *dscp = pdscp ? pdscp->dscp : 0; + return pdscp != NULL; +} + +static void +clear_skb_priorities(struct xport *xport) +{ + struct skb_priority_to_dscp *pdscp, *next; + + HMAP_FOR_EACH_SAFE (pdscp, next, hmap_node, &xport->skb_priorities) { + hmap_remove(&xport->skb_priorities, &pdscp->hmap_node); + free(pdscp); + } +} + static bool actions_output_to_local_port(const struct xlate_ctx *ctx) { @@ -2237,25 +2640,36 @@ actions_output_to_local_port(const struct xlate_ctx *ctx) return false; } -/* Translates the 'ofpacts_len' bytes of "struct ofpacts" starting at 'ofpacts' - * into datapath actions in 'odp_actions', using 'ctx'. */ +/* Thread safe call to xlate_actions__(). */ void xlate_actions(struct xlate_in *xin, struct xlate_out *xout) { - /* Normally false. Set to true if we ever hit MAX_RESUBMIT_RECURSION, so - * that in the future we always keep a copy of the original flow for - * tracing purposes. */ - static bool hit_resubmit_limit; + ovs_rwlock_rdlock(&xlate_rwlock); + xlate_actions__(xin, xout); + ovs_rwlock_unlock(&xlate_rwlock); +} +/* Translates the 'ofpacts_len' bytes of "struct ofpacts" starting at 'ofpacts' + * into datapath actions in 'odp_actions', using 'ctx'. + * + * The caller must take responsibility for eventually freeing 'xout', with + * xlate_out_uninit(). */ +static void +xlate_actions__(struct xlate_in *xin, struct xlate_out *xout) + OVS_REQ_RDLOCK(xlate_rwlock) +{ struct flow_wildcards *wc = &xout->wc; struct flow *flow = &xin->flow; + struct rule_dpif *rule = NULL; + struct rule_actions *actions = NULL; enum slow_path_reason special; const struct ofpact *ofpacts; struct xport *in_port; struct flow orig_flow; struct xlate_ctx ctx; size_t ofpacts_len; + bool tnl_may_send; COVERAGE_INC(xlate_actions); @@ -2282,7 +2696,6 @@ xlate_actions(struct xlate_in *xin, struct xlate_out *xout) ctx.xin = xin; ctx.xout = xout; - ctx.xout->tags = 0; ctx.xout->slow = 0; ctx.xout->has_learn = false; ctx.xout->has_normal = false; @@ -2295,7 +2708,7 @@ xlate_actions(struct xlate_in *xin, struct xlate_out *xout) ctx.xbridge = xbridge_lookup(xin->ofproto); if (!ctx.xbridge) { - return; + goto out; } ctx.rule = xin->rule; @@ -2310,32 +2723,41 @@ xlate_actions(struct xlate_in *xin, struct xlate_out *xout) memset(&wc->masks.dl_type, 0xff, sizeof wc->masks.dl_type); wc->masks.nw_frag |= FLOW_NW_FRAG_MASK; - if (tnl_port_should_receive(&ctx.xin->flow)) { - memset(&wc->masks.tunnel, 0xff, sizeof wc->masks.tunnel); - } + tnl_may_send = tnl_xlate_init(&ctx.base_flow, flow, wc); if (ctx.xbridge->has_netflow) { netflow_mask_wc(flow, wc); } ctx.recurse = 0; - ctx.max_resubmit_trigger = false; + ctx.resubmits = 0; ctx.orig_skb_priority = flow->skb_priority; ctx.table_id = 0; ctx.exit = false; + ctx.mpls_depth_delta = 0; + + if (!xin->ofpacts && !ctx.rule) { + rule_dpif_lookup(ctx.xbridge->ofproto, flow, wc, &rule); + if (ctx.xin->resubmit_stats) { + rule_dpif_credit_stats(rule, ctx.xin->resubmit_stats); + } + ctx.rule = rule; + } + xout->fail_open = ctx.rule && rule_dpif_fail_open(ctx.rule); if (xin->ofpacts) { ofpacts = xin->ofpacts; ofpacts_len = xin->ofpacts_len; - } else if (xin->rule) { - ofpacts = xin->rule->up.ofpacts; - ofpacts_len = xin->rule->up.ofpacts_len; + } else if (ctx.rule) { + actions = rule_dpif_get_actions(ctx.rule); + ofpacts = actions->ofpacts; + ofpacts_len = actions->ofpacts_len; } else { NOT_REACHED(); } ofpbuf_use_stub(&ctx.stack, ctx.init_stack, sizeof ctx.init_stack); - if (mbridge_has_mirrors(ctx.xbridge->mbridge) || hit_resubmit_limit) { + if (mbridge_has_mirrors(ctx.xbridge->mbridge)) { /* Do this conditionally because the copy is expensive enough that it * shows up in profiles. */ orig_flow = *flow; @@ -2350,7 +2772,7 @@ xlate_actions(struct xlate_in *xin, struct xlate_out *xout) break; case OFPC_FRAG_DROP: - return; + goto out; case OFPC_FRAG_REASM: NOT_REACHED(); @@ -2367,9 +2789,8 @@ xlate_actions(struct xlate_in *xin, struct xlate_out *xout) in_port = get_ofp_port(ctx.xbridge, flow->in_port.ofp_port); special = process_special(&ctx, flow, in_port, ctx.xin->packet); if (special) { - ctx.xout->slow = special; + ctx.xout->slow |= special; } else { - static struct vlog_rate_limit trace_rl = VLOG_RATE_LIMIT_INIT(1, 1); size_t sample_actions_len; if (flow->in_port.ofp_port @@ -2383,32 +2804,16 @@ xlate_actions(struct xlate_in *xin, struct xlate_out *xout) add_ipfix_action(&ctx); sample_actions_len = ctx.xout->odp_actions.size; - if (tunnel_ecn_ok(&ctx) && (!in_port || may_receive(in_port, &ctx))) { + if (tnl_may_send && (!in_port || may_receive(in_port, &ctx))) { do_xlate_actions(ofpacts, ofpacts_len, &ctx); /* We've let OFPP_NORMAL and the learning action look at the * packet, so drop it now if forwarding is disabled. */ - if (in_port && !stp_forward_in_state(in_port->stp_state)) { + if (in_port && !xport_stp_forward_state(in_port)) { ctx.xout->odp_actions.size = sample_actions_len; } } - if (ctx.max_resubmit_trigger && !ctx.xin->resubmit_hook) { - if (!hit_resubmit_limit) { - /* We didn't record the original flow. Make sure we do from - * now on. */ - hit_resubmit_limit = true; - } else if (!VLOG_DROP_ERR(&trace_rl)) { - struct ds ds = DS_EMPTY_INITIALIZER; - - ofproto_trace(ctx.xbridge->ofproto, &orig_flow, - ctx.xin->packet, &ds); - VLOG_ERR("Trace triggered by excessive resubmit " - "recursion:\n%s", ds_cstr(&ds)); - ds_destroy(&ds); - } - } - if (ctx.xbridge->has_in_band && in_band_must_output_to_local_port(flow) && !actions_output_to_local_port(&ctx)) { @@ -2422,10 +2827,77 @@ xlate_actions(struct xlate_in *xin, struct xlate_out *xout) } } + if (nl_attr_oversized(ctx.xout->odp_actions.size)) { + /* These datapath actions are too big for a Netlink attribute, so we + * can't execute them. */ + static struct vlog_rate_limit rl = VLOG_RATE_LIMIT_INIT(1, 1); + + VLOG_ERR_RL(&rl, "discarding oversize datapath actions"); + ofpbuf_clear(&ctx.xout->odp_actions); + } + ofpbuf_uninit(&ctx.stack); /* Clear the metadata and register wildcard masks, because we won't * use non-header fields as part of the cache. */ memset(&wc->masks.metadata, 0, sizeof wc->masks.metadata); memset(&wc->masks.regs, 0, sizeof wc->masks.regs); + +out: + rule_actions_unref(actions); + rule_dpif_unref(rule); +} + +/* Sends 'packet' out 'ofport'. + * May modify 'packet'. + * Returns 0 if successful, otherwise a positive errno value. */ +int +xlate_send_packet(const struct ofport_dpif *ofport, struct ofpbuf *packet) +{ + uint64_t odp_actions_stub[1024 / 8]; + struct xport *xport; + struct ofpbuf key, odp_actions; + struct dpif_flow_stats stats; + struct odputil_keybuf keybuf; + struct ofpact_output output; + struct xlate_out xout; + struct xlate_in xin; + struct flow flow; + union flow_in_port in_port_; + int error; + + ofpbuf_use_stub(&odp_actions, odp_actions_stub, sizeof odp_actions_stub); + ofpbuf_use_stack(&key, &keybuf, sizeof keybuf); + ofpact_init(&output.ofpact, OFPACT_OUTPUT, sizeof output); + /* Use OFPP_NONE as the in_port to avoid special packet processing. */ + in_port_.ofp_port = OFPP_NONE; + flow_extract(packet, 0, 0, NULL, &in_port_, &flow); + + ovs_rwlock_rdlock(&xlate_rwlock); + xport = xport_lookup(ofport); + if (!xport) { + error = EINVAL; + ovs_rwlock_unlock(&xlate_rwlock); + goto out; + } + + odp_flow_key_from_flow(&key, &flow, ofp_port_to_odp_port(xport->xbridge, OFPP_LOCAL)); + dpif_flow_stats_extract(&flow, packet, time_msec(), &stats); + output.port = xport->ofp_port; + output.max_len = 0; + xlate_in_init(&xin, xport->xbridge->ofproto, &flow, NULL, 0, packet); + xin.ofpacts_len = sizeof output; + xin.ofpacts = &output.ofpact; + xin.resubmit_stats = &stats; + /* Calls xlate_actions__ directly, since the rdlock is acquired. */ + xlate_actions__(&xin, &xout); + error = dpif_execute(xport->xbridge->dpif, + key.data, key.size, + xout.odp_actions.data, xout.odp_actions.size, + packet); + ovs_rwlock_unlock(&xlate_rwlock); + +out: + xlate_out_uninit(&xout); + return error; }