X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=vswitchd%2Fvswitch.xml;h=b9628494298286cdd26dac6f856ba37be077562f;hb=28b114322856db3870fb2825fc5dbfc8d16f3a7f;hp=32d4c595b20c1a412358df72685005d5392aea8d;hpb=59efa47adf3234ec51541405726d033173851285;p=sliver-openvswitch.git diff --git a/vswitchd/vswitch.xml b/vswitchd/vswitch.xml index 32d4c595b..b96284942 100644 --- a/vswitchd/vswitch.xml +++ b/vswitchd/vswitch.xml @@ -71,6 +71,71 @@ The Citrix XenServer universally unique identifier for the physical host as displayed by xe host-list. + + +

+ When ovs-vswitchd starts up, it has an empty flow table + and therefore it handles all arriving packets in its default fashion + according to its configuration, by dropping them or sending them to + an OpenFlow controller or switching them as a standalone switch. + This behavior is ordinarily desirable. However, if + ovs-vswitchd is restarting as part of a ``hot-upgrade,'' + then this leads to a relatively long period during which packets are + mishandled. +

+

+ This option allows for improvement. When ovs-vswitchd + starts with this value set as true, it will neither + flush or expire previously set datapath flows nor will it send and + receive any packets to or from the datapath. When this value is + later set to false, ovs-vswitchd will + start receiving packets from the datapath and re-setup the flows. +

+

+ Thus, with this option, the procedure for a hot-upgrade of + ovs-vswitchd becomes roughly the following: +

+
    +
  1. + Stop ovs-vswitchd. +
    2. +
  2. + Set + to true. +
    3. +
  3. + Start ovs-vswitchd. +
    4. +
  4. + Use ovs-ofctl (or some other program, such as an + OpenFlow controller) to restore the OpenFlow flow table + to the desired state. +
    5. +
  5. + Set + to false (or remove it entirely from the database). +
    6. +
+

+ The ovs-ctl's ``restart'' and ``force-reload-kmod'' + functions use the above config option during hot upgrades. +

+ + + +

+ A number of flows as a nonnegative integer. This sets number of + flows at which eviction from the datapath flow table will be + triggered. If there are a large number of flows then increasing this + value to around the number of flows present can result in reduced CPU + usage and packet loss. +

+

+ The default is 2500. Values below 100 will be rounded up to 100. +

+ @@ -340,7 +405,11 @@ - sFlow configuration. + sFlow(R) configuration. + + + + IPFIX configuration. @@ -439,6 +508,12 @@ value. May not be all-zero. + + Human readable description of datapath. It it a maximum 256 + byte-long free-form string to describe the datapath for + debugging purposes, e.g. switch3 in room 3120. + + If set to true, disable in-band control on the bridge @@ -453,6 +528,12 @@ QoS configured, or if the port does not have a queue with the specified ID, the default queue is used instead. + + + List of OpenFlow protocols that may be used when negotiating a + connection with a controller. A default value of + OpenFlow10 will be used if this column is empty. + @@ -531,20 +612,6 @@ datapath ID. - -

- A number of flows as a nonnegative integer. This sets number of - flows at which eviction from the kernel flow table will be triggered. - If there are a large number of flows then increasing this value to - around the number of flows present can result in reduced CPU usage - and packet loss. -

-

- The default is 1000. Values below 100 will be rounded up to 100. -

- - Option to allow forwarding of BPDU frames when NORMAL action is @@ -569,21 +636,13 @@
01:80:c2:00:00:0x
Other reserved protocols.
-
00:00:5e:00:01:xx
-
VRRP IPv4 virtual router MAC address.
- -
00:00:5e:00:02:xx
-
VRRP IPv6 virtual router MAC address.
+
00:e0:2b:00:00:00
+
Extreme Discovery Protocol (EDP).
-
00:00:0c:07:ac:xx
-
HSRP Version 1.
- -
00:00:0c:9f:fx:xx -
-
HSRP Version 2.
- -
00:07:b4:xx:xx:xx
-
GLBP.
+
+ 00:e0:2b:00:00:04 and 00:e0:2b:00:00:06 +
+
Ethernet Automatic Protection Switching (EAPS).
01:00:0c:cc:cc:cc
@@ -600,6 +659,9 @@
01:00:0c:00:00:00
Cisco Inter Switch Link.
+ +
01:00:0c:cc:cc:cx
+
Cisco CFM.
 @@ -622,6 +684,15 @@ transmit packets.

+ + +

+ The maximum number of MAC addresses to learn. The default is + currently 2048. The value, if specified, is forced into a reasonable + range, currently 10 to 1,000,000. +

+ @@ -807,8 +878,13 @@

A port that has more than one interface is a ``bonded port.'' Bonding - allows for load balancing and fail-over. Some kinds of bonding will - work with any kind of upstream switch:

+ allows for load balancing and fail-over.

+ +

+ The following types of bonding will work with any kind of upstream + switch. On the upstream switch, do not configure the interfaces as a + bond: +

balance-slb
@@ -820,7 +896,8 @@
active-backup
Assigns all flows to one slave, failing over to a backup slave when - the active slave is disabled. + the active slave is disabled. This is the only bonding mode in which + interfaces may be plugged into different upstream switches.
@@ -836,21 +913,6 @@ information such as destination MAC address, IP address, and TCP port. - -
stable
-
-

Attempts to always assign a given flow to the same slave - consistently. In an effort to maintain stability, no load - balancing is done. Uses a similar hashing strategy to - balance-tcp, always taking into account L3 and L4 - fields even if LACP negotiations are unsuccessful.

-

Slave selection decisions are made based on if set. Otherwise, - OpenFlow port number is used. Decisions are consistent across all - ovs-vswitchd instances with equivalent - - values.

-

These columns apply only to bonded ports. Their values are @@ -895,7 +957,7 @@

- The number of milliseconds for which carrier must stay up on an + The number of milliseconds for which the link must stay up on an interface before the interface is considered to be up. Specify 0 to enable the interface immediately.

@@ -908,7 +970,7 @@ - The number of milliseconds for which carrier must stay down on an + The number of milliseconds for which the link must stay down on an interface before the interface is considered to be down. Specify 0 to disable the interface immediately. @@ -961,12 +1023,10 @@ - +

These settings control behavior when a bond is in - balance-slb mode, regardless of whether the bond was - intentionally configured in SLB mode or it fell back to SLB mode - because LACP negotiation failed. + balance-slb or balance-tcp mode.

@@ -1126,6 +1186,10 @@ on a host. + + The MAC address in use by this interface. + +

Ethernet address to set for this interface. If unset then the default MAC address is used:

@@ -1158,6 +1222,20 @@ port number for the OpenFlow ``local port''). If the interface cannot be added then Open vSwitch sets this column to -1.

+

When is not set, Open vSwitch picks + an appropriate value for this column and then tries to keep the value + constant across restarts.

+ + + +

Requested OpenFlow port number for this interface. The port + number must be between 1 and 65279, inclusive. Some datapaths + cannot satisfy all requests for particular port numbers. When + this column is empty or the request cannot be fulfilled, the + system will choose a free port. The + column reports the assigned OpenFlow port number.

+

The port number must be requested in the same transaction + that creates the port.

 @@ -1189,8 +1267,7 @@
gre
An Ethernet over RFC 2890 Generic Routing Encapsulation over IPv4 - tunnel. See for information on - configuring GRE tunnels. + tunnel.
ipsec_gre
@@ -1199,13 +1276,41 @@ IPsec tunnel. -
capwap
+
gre64
+
+ It is same as GRE, but it allows 64 bit key. To store higher 32-bits + of key, it uses GRE protocol sequence number field. This is non + standard use of GRE protocol since OVS does not increment + sequence number for every packet at time of encap as expected by + standard GRE implementation. See + for information on configuring GRE tunnels. +
+ +
ipsec_gre64
+
+ Same as IPSEC_GRE except 64 bit key. +
+ +
vxlan
+
+

+ An Ethernet tunnel over the experimental, UDP-based VXLAN + protocol described at + http://tools.ietf.org/html/draft-mahalingam-dutt-dcops-vxlan-03. + VXLAN is currently supported only with the Linux kernel datapath + with kernel version 2.6.26 or later. +

+

+ Open vSwitch uses UDP destination port 4789. The source port used for + VXLAN traffic varies on a per-flow basis and is in the ephemeral port + range. +

+
+ +
lisp
- An Ethernet tunnel over the UDP transport portion of CAPWAP (RFC - 5415). This allows interoperability with certain switches that do - not support GRE. Only the tunneling component of the protocol is - implemented. UDP ports 58881 and 58882 are used as the source and - destination ports respectively. CAPWAP is currently supported only + A layer 3 tunnel over the experimental, UDP-based Locator/ID + Separation Protocol (RFC 6830). LISP is currently supported only with the Linux kernel datapath with kernel version 2.6.26 or later.
@@ -1215,7 +1320,8 @@
null
-
An ignored interface.
+
An ignored interface. Deprecated and slated for removal in + February 2013.
 @@ -1223,7 +1329,8 @@

These options apply to interfaces with of - gre, ipsec_gre, and capwap. + gre, ipsec_gre, gre64, + ipsec_gre64, vxlan, and lisp.

@@ -1238,22 +1345,67 @@

-

- Required. The tunnel endpoint. Unicast and multicast endpoints are - both supported. -

+

Required. The remote tunnel endpoint, one of:

+ +

- When a multicast endpoint is specified, a routing table lookup occurs - only when the tunnel is created. Following a routing change, delete - and then re-create the tunnel to force a new routing table lookup. + The remote tunnel endpoint for any packet received from a tunnel + is available in the tun_src field for matching in the + flow table.

- Optional. The destination IP that received packets must match. - Default is to match all addresses. Must be omitted when is a multicast address. +

+ Optional. The tunnel destination IP that received packets must + match. Default is to match all addresses. If specified, may be one + of: +

+ +
    +
  • + An IPv4 address (not a DNS name), e.g. 192.168.12.3. +
    • +
  • + The word flow. The tunnel accepts packets sent to any + of the local IP addresses of the system running OVS. To process + only packets sent to a specific IP address, the flow entries may + match on the tun_dst field. When sending packets to a + local_ip=flow tunnel, the flow actions may + explicitly set the tun_src field to the desired IP + address, e.g. with a set_field action. However, while + routing the tunneled packet out, the local system may override the + specified address with the local IP address configured for the + outgoing system interface. + +

    + This option is valid only for tunnels also configured with the + remote_ip=flow option. +

    +
    • +
+ +

+ The tunnel destination IP address for any packet received from a + tunnel is available in the tun_dst field for matching in + the flow table. +

@@ -1266,8 +1418,9 @@ key="in_key"/> at all.
  • - A positive 32-bit (for GRE) or 64-bit (for CAPWAP) number. The - tunnel receives only packets with the specified key. + A positive 24-bit (for VXLAN and LISP), 32-bit (for GRE) or 64-bit + (for GRE64) number. The tunnel receives only packets with the + specified key.
  • The word flow. The tunnel accepts packets with any @@ -1292,8 +1445,9 @@ key="out_key"/> at all.
  • - A positive 32-bit (for GRE) or 64-bit (for CAPWAP) number. Packets - sent through the tunnel will have the specified key. + A positive 24-bit (for VXLAN and LISP), 32-bit (for GRE) or 64-bit + (for GRE64) number. Packets sent through the tunnel will have the + specified key.
  • The word flow. Packets sent through the tunnel will @@ -1326,48 +1480,13 @@ system default, typically 64). Default is the system default TTL. - - Optional. If enabled, the Don't Fragment bit will be copied from the - inner IP headers (those of the encapsulated traffic) to the outer - (tunnel) headers. Default is disabled; set to true to - enable. - - - Optional. If enabled, the Don't Fragment bit will be set by default on - tunnel headers if the df_inherit option is not set, or if - the encapsulated packet is not IP. Default is enabled; set to - false to disable. - - - - Optional. Enable tunnel path MTU discovery. If enabled ``ICMP - Destination Unreachable - Fragmentation Needed'' messages will be - generated for IPv4 packets with the DF bit set and IPv6 packets above - the minimum MTU if the packet size exceeds the path MTU minus the size - of the tunnel headers. Note that this option causes behavior that is - typically reserved for routers and therefore is not entirely in - compliance with the IEEE 802.1D specification for bridges. Default is - enabled; set to false to disable. + Optional. If enabled, the Don't Fragment bit will be set on tunnel + outer headers to allow path MTU discovery. Default is enabled; set + to false to disable. - -

    - Only gre interfaces support these options. -

    - - - Enable caching of tunnel headers and the output path. This can lead - to a significant performance increase without changing behavior. In - general it should not be necessary to adjust this setting. However, - the caching can bypass certain components of the IP stack (such as - iptables) and it may be useful to disable it if these - features are required or as a debugging measure. Default is enabled, - set to false to disable. - -     -

    Only gre and ipsec_gre interfaces support @@ -1527,15 +1646,15 @@ The source IP address used for an IPv4 tunnel end-point, such as - gre or capwap. + gre. - Egress interface for tunnels. Currently only relevant for GRE and - CAPWAP tunnels. On Linux systems, this column will show the name of - the interface which is responsible for routing traffic destined for the - configured . This could be an - internal interface such as a bridge port. + Egress interface for tunnels. Currently only relevant for GRE tunnels + On Linux systems, this column will show the name of the interface + which is responsible for routing traffic destined for the configured + . This could be an internal + interface such as a bridge port. + +

    + BFD, defined in RFC 5880 and RFC 5881, allows point to point + detection of connectivity failures by occasional transmission of + BFD control messages. It is implemented in Open vSwitch to serve + as a more popular and standards compliant alternative to CFM. +

    + +

    + BFD operates by regularly transmitting BFD control messages at a + rate negotiated independently in each direction. Each endpoint + specifies the rate at which it expects to receive control messages, + and the rate at which it's willing to transmit them. Open vSwitch + uses a detection multiplier of three, meaning that an endpoint + which fails to receive BFD control messages for a period of three + times the expected reception rate, will signal a connectivity + fault. In the case of a unidirectional connectivity issue, the + system not receiving BFD control messages will signal the problem + to its peer in the messages is transmists. +

    + +

    + The Open vSwitch implementation of BFD aims to comply faithfully + with the requirements put forth in RFC 5880. Currently, the only + known omission is ``Demand Mode'', which we hope to include in + future. Open vSwitch does not implement the optional + Authentication or ``Echo Mode'' features. +

    + + + When true BFD is enabled on this + , otherwise it's disabled. Defaults to + false. + + + + The fastest rate, in milliseconds, at which this BFD session is + willing to receive BFD control messages. The actual rate may be + slower if the remote endpoint isn't willing to transmit as quickly as + specified. Defaults to 1000. + + + + The fastest rate, in milliseconds, at which this BFD session is + willing to transmit BFD control messages. The actual rate may be + slower if the remote endpoint isn't willing to receive as quickly as + specified. Defaults to 100. + + + + Concatenated path down may be used when the local system should not + have traffic forwarded to it for some reason other than a connectivty + failure on the interface being monitored. When a controller thinks + this may be the case, it may set cpath_down to + true which may cause the remote BFD session not to + forward traffic to this . Defaults to + false. + + + + State of the BFD session. The BFD session is fully healthy and + negotiated if UP. + + + + True if the BFD session believes this may be + used to forward traffic. Typically this means the local session is + signaling UP, and the remote system isn't signaling a + problem such as concatenated path down. + + + + A short message indicating what the BFD session thinks is wrong in + case of a problem. + + + + State of the remote endpoint's BFD session. + + + + A short message indicating what the remote endpoint's BFD session + thinks is wrong in case of a problem. + +     +

    802.1ag Connectivity Fault Management (CFM) allows a group of @@ -1701,6 +1912,12 @@ faulted otherwise.

    +

    + When operating over tunnels which have no in_key, or an + in_key of flow. CFM will only accept CCMs + with a tunnel key of zero. +

    + A Maintenance Point ID (MPID) uniquely identifies each endpoint within a Maintenance Association. The MPID is used to identify this endpoint @@ -1769,9 +1986,11 @@ frame having an invalid interval. - - Indicates a CFM fault was triggered because the CFM module received - a CCM frame with a sequence number that it was not expecting. + +

    When in extended mode, indicates the operational state of the + remote endpoint as either up or down. See + . +

    @@ -1832,6 +2051,43 @@ compatibility with 802.1ag compliant implementations. Defaults to false. + + +

    + When true, and + is true, the CFM + module operates in demand mode. When in demand mode, traffic + received on the is used to indicate + liveness. CCMs are still transmitted and received, but if the + is receiving traffic, their absence does not + cause a connectivity fault. +

    + +

    + Demand mode has a couple of caveats: +

      +
    • + To ensure that ovs-vswitchd has enough time to pull statistics + from the datapath, the minimum + is 500ms. +
      • + +
    • + To avoid ambiguity, demand mode disables itself when there are + multiple remote maintenance points. +
      • + +
    • + If the is heavily congested, CCMs + containing the + status may be dropped causing changes in the operational state to + be delayed. Similarly, if CCMs containing the RDI bit are not + received, unidirectional link failures may not be detected. +
      • +
    +

    +     + When down, the CFM module marks all CCMs it generates as @@ -1854,7 +2110,7 @@ When set, the CFM module will apply a VLAN tag to all CCMs it generates - with the given PCP value. The VLAN ID of the tag is governed by the + with the given PCP value, the VLAN ID of the tag is governed by the value of . If is unset, a VLAN ID of zero is used. @@ -1863,16 +2119,6 @@     - - Used in stable bond mode to make slave - selection decisions. Allocating values consistently across interfaces - participating in a bond will guarantee consistent slave selection - decisions across ovs-vswitchd instances when using - stable bonding mode. - - The LACP port ID of this . Port IDs are @@ -1942,6 +2188,11 @@ two different hypervisors. That is, active means that this is the active instance within a single hypervisor, not in a broader scope. + There is one exception: some hypervisors support ``migration'' from a + given hypervisor to itself (most often for test purposes). During + such a ``migration,'' two instances of a single might both be briefly marked + active on a single hypervisor.

    @@ -2129,7 +2380,7 @@

    The eviction process only considers flows that have an idle timeout or a hard timeout. That is, eviction never deletes permanent flows. - (Permanent flows do count against . + (Permanent flows do count against .)

    @@ -2756,10 +3007,9 @@ Service (QoS) on IP networks. The DSCP value specified here is used when establishing the connection - between the controller and the Open vSwitch. The connection must be - reset for the new DSCP values to take effect. If no value is - specified, a default value of 48 is chosen. Valid DSCP values must be - in the range 0 to 63. + between the controller and the Open vSwitch. If no value is specified, + a default value of 48 is chosen. Valid DSCP values must be in the + range 0 to 63. @@ -2824,9 +3074,11 @@

    Listens for SSL connections on the specified TCP port - (default: 6632). If ip, which must be expressed as an - IP address (not a DNS name), is specified, then connections are - restricted to the specified local IP address. + (default: 6632). Specify 0 for port to have the + kernel automatically choose an available port. If ip, + which must be expressed as an IP address (not a DNS name), is + specified, then connections are restricted to the specified local + IP address.

    The column in the ptcp:[port][:ip]

    Listens for connections on the specified TCP port - (default: 6632). If ip, which must be expressed as an - IP address (not a DNS name), is specified, then connections are - restricted to the specified local IP address. + (default: 6632). Specify 0 for port to have the kernel + automatically choose an available port. If ip, which + must be expressed as an IP address (not a DNS name), is specified, + then connections are restricted to the specified local IP address.

    When multiple managers are configured, the @@ -2987,6 +3240,14 @@ chosen connection.

    + + + When is ptcp: or + pssl:, this is the TCP port on which the OVSDB server is + listening. (This is is particularly useful when specifies a port of 0, allowing the kernel to + choose any available port.) +     @@ -3003,10 +3264,9 @@ Service (QoS) on IP networks. The DSCP value specified here is used when establishing the connection - between the manager and the Open vSwitch. The connection must be - reset for the new DSCP values to take effect. If no value is - specified, a default value of 48 is chosen. Valid DSCP values must be - in the range 0 to 63. + between the manager and the Open vSwitch. If no value is specified, a + default value of 48 is chosen. Valid DSCP values must be in the range + 0 to 63. @@ -3107,8 +3367,8 @@ -

    An sFlow(R) target. sFlow is a protocol for remote monitoring - of switches.

    +

    A set of sFlow(R) targets. sFlow is a protocol for remote + monitoring of switches.

    Name of the network device whose IP address should be reported as the @@ -3149,4 +3409,75 @@
    + +

    A set of IPFIX collectors. IPFIX is a protocol that exports a + number of details about flows.

    + + + IPFIX target collectors in the form + ip:port. + + + + For per-bridge packet sampling, i.e. when this row is referenced + from a , the rate at which packets should + be sampled and sent to each target collector. If not specified, + defaults to 400, which means one out of 400 packets, on average, + will be sent to each target collector. Ignored for per-flow + sampling, i.e. when this row is referenced from a . + + + + For per-bridge packet sampling, i.e. when this row is referenced + from a , the IPFIX Observation Domain ID + sent in each IPFIX packet. If not specified, defaults to 0. + Ignored for per-flow sampling, i.e. when this row is referenced + from a . + + + + For per-bridge packet sampling, i.e. when this row is referenced + from a , the IPFIX Observation Point ID + sent in each IPFIX flow record. If not specified, defaults to + 0. Ignored for per-flow sampling, i.e. when this row is + referenced from a . + + + + The overall purpose of these columns is described under Common + Columns at the beginning of this document. + + + +
    + + +

    A set of IPFIX collectors of packet samples generated by + OpenFlow sample actions.

    + + + The ID of this collector set, unique among the bridge's + collector sets, to be used as the collector_set_id + in OpenFlow sample actions. + + + + The bridge into which OpenFlow sample actions can + be added to send packet samples to this set of IPFIX collectors. + + + + Configuration of the set of IPFIX collectors to send one flow + record per sampled packet to. + + + + The overall purpose of these columns is described under Common + Columns at the beginning of this document. + + + +
    +