| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Crash was seen on recent image with this BT on top of the stack
(gdb) bt full
(mif=0x7fffb6226568) at
/vpp/build-data/../src/plugins/memif/memif.c:297
ring = 0x0 <<<<<<<<<<
i = 0
j = 0
buffer_offset = 65792
r = 0x7fffb5e59f80
alloc = {flags = 1, name = 0x7fffb449f965 "memif region",
size = 4260096, numa_node = 0, addr = 0x7fff41dac000,
fd = 11,
log2_page_size = 12, n_pages = 1041}
err = 0x0
__FUNCTION__ = "memif_init_regions_and_queues"
The crash happened at this line.
ring = memif_get_ring (mif, MEMIF_RING_S2M, i);
ring=>head = ring->tail = 0; <=====
Please note that the crash is caused by dereferencing NULL rinng.
Put breakpoint into the function. I notice that
mif->regions[0].shm is not initialized.
(gdb) p mif->regions[0].shm
$8 = (void *) 0x0
It looks like we forgot to set shm after clib_mem_vm_ext_alloc().
Add the missing cide and the crash is fixed.
Change-Id: Ib722a6c241c77acfa8e33962106b57faa50e1ea7
Signed-off-by: Steven <sluong@cisco.com>
(cherry picked from commit 9fefa9a697daf0e949ea7a2700ecaf2ba4d1d2cb)
|
|
Change-Id: Iff33694fc42cc3bcc73cf1372339053a6365039c
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
This will allow us to use this code in client libraries without vlib.
Change-Id: I8557b752496841ba588aa36b6082cbe2cd1867fe
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
Change-Id: Id79d2c2be7a98e15416a537c890a8f2dd6d4464d
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
1. coverity complains about "buffer not null terminated" for strncpy because we
pass the size of the destination to the call which is equal to the true size
of the destination. We subtract 1 for the size to accommodate the null like all
other places are already doing it.
2. Add a check to tx_queues in memif_interface_tx_inline to avoid "divide by zero".
3. To avoid null pointer dereference in memif_create_if, change the goto done
rather than goto error and spit a more meaningful error rather than silent about it.
4. Shuffle a line to avoid "check after use" in vl_api_memif_delete_t_handler.
Change-Id: Icba7ecd5362c012a48ac35795d31aab356617420
Signed-off-by: Steven <sluong@cisco.com>
|
|
New startup config command:
unix {
runtime-dir /run/vpp
}
Also, adds recursive mkdir funtion for use in deifferent places
like cli-config socket path and dpdk hugepage directory path.
Change-Id: I1446ceab9c220c25804e73a743a3ebb383450124
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
Change-Id: Ief02eb1109a1bc463665d9747e9fa4e0c0e3d7e0
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
If interface is down and queues are not configured then we are not able
to change rx-mode. This change introducess default mode which is stored
per interface and applied if driver wants.
Change-Id: I70149c21c1530eafc148d5e4aa03fbee53dec62f
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
In IP mode memif interface is L3 point-to-point interfaces and
we don't pass l2 header. There is no l2 header rewrite operation and
received packets are sent straight to ip4-input / ip6-input nodes.
Change-Id: I4177f3fce3004da7ecf14d235006ae053fcf3f09
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
Change-Id: Ide6d26d6fcc81be6f26ac0abe2cd0d6a0838cfe6
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
Change-Id: I4d41def83a23f13701f1ddcea722d481e4c85cbc
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
Check -1 for return from read prior to using the data
Change-Id: Ibab7309244de488737ea7938b334fab495bf855d
Signed-off-by: Steven <sluong@cisco.com>
|
|
- Add rx-queues and tx-queues option to the create memif CLI
- Add vlib_worker_thread_barrier_sync () to memif_conn_fd_read_ready () as
the latter function may disconnect the ring and clean up the shared memory.
- On transmit, write the rid (queue number) to the socket.
- On receive, read the rid and trigger the interrupt for the corresponding
thread.
Change-Id: If1c7e26c7124174678f047909cbc33e931eaac8c
Signed-off-by: Steven <sluong@cisco.com>
|
|
When I type in 'quit' on the slave instance, the master instance crashes
on this line.
0: /home/sluong/vpp-master/vpp/build-data/../src/vlib/unix/input.c:200 (linux_epoll_input) assertion `! pool_is_free (um->file_pool, _e)' fails
Aborted (core dumped)
Below is the decode from gdb
line_number=0, fmt=0x7f57af6cc9a0 "%s:%d (%s) assertion `%s' fails")
at /home/sluong/vpp-master/vpp/build-data/../src/vppinfra/error.c:143
vm=0x7f57af8e2400 <vlib_global_main>, node=0x7f576d40ad80, frame=0x0)
at /home/sluong/vpp-master/vpp/build-data/../src/vlib/unix/input.c:200
vm=0x7f57af8e2400 <vlib_global_main>, node=0x7f576d40ad80,
type=VLIB_NODE_TYPE_PRE_INPUT, dispatch_state=VLIB_NODE_STATE_POLLING,
frame=0x0, last_time_stamp=1525665215050617)
at /home/sluong/vpp-master/vpp/build-data/../src/vlib/main.c:1016
vm=0x7f57af8e2400 <vlib_global_main>, is_main=1)
at /home/sluong/vpp-master/vpp/build-data/../src/vlib/main.c:1500
I am able to reproduce the problem consistently with the below procedure.
1. Create 3 memif interfaces between slave and master instances.
2. Type 'quit' on the slave. Neither crashes the first time.
3. Bring back the slave. Type 'quit' on the master. Neither crashes.
4. Bring back the master. Type 'quit' on the slave. The master crashes.
There are two places the interrupt line is disconnected and the unix file is
removed via the call unix_file_del ()
1. memif_int_fd_read_ready ()
2. memif_disconnect () which is called via multiple places in memif.
When the crash happens, the unix file was removed from memif_disconnect ()
via memif_conn_fd_read_ready () with size of the message == 0 in recvmsg ().
It is noted when the unix file was removed from memif_int_fd_read_ready (),
it never crashes. It is a race condition. However, if I follow the
aformentioned procedure, the crash always happens.
The reason the crash happens when memif_disconnect () removes the unix file
is because there may still be pending input in linux_epoll_input (). When
linux_epoll_input () tries to access the unix file via the line 200
unix_file_t *f = pool_elt_at_index (um->file_pool, i);
it crashes.
We could add code in linux_epoll_input () to avoid the crash if the index
for the particular file_pool is already free. Or we could fix memif to not
remove the unix file in memif_conn_fd_read_ready () when recvmsg () got 0
byte and just postpone the unix file deletion in memif_int_fd_read_ready ()
later after linux_epoll_input () got a chance to run to empty the input
stream.
I choose to fix the problem in the latter approach. I split the function
memif_disconnect () into two parts. For the code path which
memif_conn_fd_read_ready () calls memif_disconnect (), it does not remove the
unix file. All other calls to memif_disconnect () will continue to do what
it uses to do to avoid regression.
Please let me know if I should fix the problem other way.
Change-Id: I8efe2a3d24c6581609bc7b6fe82c2b59c22d8e4b
Signed-off-by: Steven <sluong@cisco.com>
|
|
Migrate memif to use vnet device infra APIs. No new function is added.
Change-Id: I70e440d2ae1e673876365041f31fe78997aceecf
Signed-off-by: Steven <sluong@cisco.com>
|
|
Change-Id: I220b0b95449f24cc547206e38ab8e10019115ec0
Signed-off-by: Milan Lenco <milan.lenco@pantheon.tech>
|
|
Change-Id: I935620798d6fe82b99b6bd564749e20a189b4ae3
Signed-off-by: Milan Lenco <milan.lenco@pantheon.tech>
|
|
Change-Id: I844ec53b55ceaa1e00996f5cf8a018537ea8b481
Signed-off-by: Milan Lenco <milan.lenco@pantheon.tech>
|
|
Change-Id: I86089e9bb604adfc260a111685001be1c897ce53
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
Change-Id: I94c06b07a39f07ceba87bf3e7fcfc70e43231e8a
Signed-off-by: Damjan Marion <damarion@cisco.com>
Co-Authored-By: Milan Lenco <Milan.Lenco@pantheon.tech>
|
Steven
Damjan Marion
Milan Lenco