Fix flow table lookup failure with no originating ifindex

Bug #1967892 reported by Bodong Wang
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux-bluefield (Ubuntu)
Invalid
Undecided
Unassigned
Focal
Fix Released
Undecided
Unassigned

Bug Description

* Explain the bug
After the CT ifindex extension feature, flow table entries are
populated with ifindex information which was intended to only be used
for HW offload. This tuple ifindex is hashed in the flow table key, so
it must be filled for lookup to be successful. But tuple ifindex is only
relevant for the netfilter flowtables (nft), so it's not filled in
act_ct flow table lookup, resulting in lookup failure, and no SW
offload and no offload teardown for TCP connection FIN/RST packets.

To fix this, add new tc ifindex field to tuple, which will
only be used for offloading, not for lookup, as it will not be part of the tuple hash.

* How to test
 Create OVS bridge with 2 devices mlx5 rep devices.
Enable HW offload and configure regular connection tracking OpenFlow rules:

e.g:
    ovs-ofctl del-flows br-ovs
    ovs-ofctl add-flow br-ovs arp,actions=normal
    ovs-ofctl add-flow br-ovs "table=0, ip,ct_state=-trk actions=ct(table=1)"
    ovs-ofctl add-flow br-ovs "table=1, ip,ct_state=+trk+new actions=ct(commit),normal"
    ovs-ofctl add-flow br-ovs "table=1, ip,ct_state=+trk+est, actions=normal"

Generate traffic at high rate (e.g. using IXIA).
The number of offloaded rules exposed in /sys/kernel/debug/mlx5/0000\:$BUS\:00.0/ct/offloaded should be in synch the number of generated connections.

* What it could break.
Perhaps nft offload – it is not part of our tests

Changed in linux-bluefield (Ubuntu):
status: New → Invalid
Changed in linux-bluefield (Ubuntu Focal):
status: New → In Progress
status: In Progress → Fix Committed
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-bluefield/5.4.0-1033.36 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-focal
tags: added: verification-done-focal
removed: verification-needed-focal
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (22.3 KiB)

This bug was fixed in the package linux-bluefield - 5.4.0-1035.38

---------------
linux-bluefield (5.4.0-1035.38) focal; urgency=medium

  * focal/linux-bluefield: 5.4.0-1035.38 -proposed tracker (LP: #1969372)

  * mlxbf-gige: sync up with upstreamed version (LP: #1969233)
    - SAUCE: Revert "UBUNTU: SAUCE: Fix OOB handling RX packets in heavy traffic"
    - SAUCE: Revert "UBUNTU: SAUCE: mlxbf_gige: update driver version to 1.25"
    - SAUCE: Revert "UBUNTU: SAUCE: mlxbf_gige: clear valid_polarity upon open"
    - SAUCE: Revert "UBUNTU: SAUCE: mlxbf_gige: add interrupt counts to "ethtool
      -S""
    - SAUCE: Revert "UBUNTU: SAUCE: mlxbf-gige: add ethtool
      mlxbf_gige_set_ringparam"
    - SAUCE: Revert "UBUNTU: SAUCE: mlxbf-gige: add driver version"
    - mlxbf_gige: clear valid_polarity upon open
    - net: mellanox: mlxbf_gige: Replace non-standard interrupt handling
    - SAUCE: mlxbf-gige: add driver version
    - SAUCE: mlxbf_gige: add interrupt counts to "ethtool -S"
    - SAUCE: mlxbf-gige: add ethtool mlxbf_gige_set_ringparam
    - SAUCE: Fix OOB handling RX packets in heavy traffic

  * linux-bluefield: Fix build failure in mlxbf_gige (LP: #1969374)
    - gpiolib: acpi: Allow to find GpioInt() resource by name and index

linux-bluefield (5.4.0-1034.37) focal; urgency=medium

  * focal/linux-bluefield: 5.4.0-1034.37 -proposed tracker (LP: #1968766)

  * Devlink wasn't enabled from common config (LP: #1968751)
    - [Config] Bluefield: Enable CONFIG_NET_DEVLINK
    - [Config] Bluefield: Enable dummy config options NET_VENDOR_BROADCOM and
      PAGE_POOL

linux-bluefield (5.4.0-1033.36) focal; urgency=medium

  * focal/linux-bluefield: 5.4.0-1033.36 -proposed tracker (LP: #1967369)

  * Fix flow table lookup failure with no originating ifindex (LP: #1967892)
    - net/sched: act_ct: Fix flow table lookup failure with no originating ifindex

  * Fix OOB handling RX packets in heavy traffic (LP: #1964984)
    - SAUCE: Fix OOB handling RX packets in heavy traffic

  * Pass originating device to drivers offloading ct connection so devices will
    filter the tuples and offload them more efficiently (LP: #1960575)
    - net: openvswitch: Be liberal in tcp conntrack.
    - net/sched: act_ct: Fill offloading tuple iifidx
    - net: openvswitch: Fill act ct extension

  * Fix flow table lookup after ct clear or switching zones (LP: #1963948)
    - net/sched: act_ct: Fix flow table lookup after ct clear or switching zones

  * CT: Offload only ASSURED connections (LP: #1961819)
    - net/sched: act_ct: Offload only ASSURED connections

  * Sync up gpio interrupt handling with upstreamed version (LP: #1965017)
    - Revert "UBUNTU: SAUCE: gpio-mlxbf2.c: Fix setting the gpio direction to
      output"
    - Revert "UBUNTU: SAUCE: gpio-mlxbf2.c: remove phy interrupt"
    - Revert "UBUNTU: SAUCE: gpio-mlxbf2: Cleanup and use generic gpio_irq_chip
      struct"
    - Revert "UBUNTU: SAUCE: gpio-mlxbf2.c: Support soft reset gpio interrupt"
    - Revert "UBUNTU: SAUCE: gpio-mlxbf2.c: fix spinlock bug and using
      uninitialized work"
    - Revert "UBUNTU: SAUCE: gpio: Add irq support for gpio-mlxbf2"
    - gpio: mlxbf2: remove unused inclu...

Changed in linux-bluefield (Ubuntu Focal):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.