sFlow Phase 2: ifIndex translation platform/vpp changes

[ritvikiscool9]

Changes to platform/vpp:

• rules/vpp.mk — bumped VPP_VERSION (…-0.3 → …-0.4) so the build pulls the locally-patched VPP instead of the prebuilt upstream deb.
• vppbld/patches/series — registered the new patch in the apply list.
• vppbld/patches/0010-sflow-report-linux-ifindex.patch — the actual feature: adds the report-linux-ifindex mode to the VPP sFlow plugin (helper that maps VPP hw_if_index → Linux netdev ifindex via linux-cp, applied to PSAMPLE flow samples and NET_DM drop alerts) plus the new CLI/API to toggle it.

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command.

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command.

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[ritvikiscool9]

To verify sFlow, I enabled it on Ethernet0 (VPP port bobm0) on the collector switch, set the sampling rate and send traffic from the other switch. I then captured a sampled packet with VPP packet trace (trace add dpdk-input).

Trace of a sample packet:

dpdk-input        → packet arrives on bobm0 (Ethernet0)
sflow             → sampled here  (SFLOW: sw_if_index 1)
ethernet-input    → normal L2 parse
ip4-input ... ip4-icmp-input ... ip4-punt → tap4096-tx  → delivered to Linux

When sFlow is enabled on a port, VPP adds an sFlow node to that port's ingress path. Every incoming packet passes through this node, and 1 in N packets (sampling rate) are copied. The orignal packet continues forwarding untouched, the copy is exported out-of-band via PSAMPLE -> hsflowd -> UDP:6343 to the sFlow collector.

A full trace for a packet:

                                                                                   
Packet 50                                                                          
                                                                                   
00:37:46:618831: dpdk-input                                                        
  bobm0 rx queue 0                                                                 
  buffer 0x2e316: current data 0, length 98, buffer-pool 0, ref-count 1, trace hand
le 0x1000031                                                                       
                  ext-hdr-valid                                                    
  PKT MBUF: port 0, nb_segs 1, pkt_len 98                                          
    buf_len 2176, data_len 98, ol_flags 0x0, data_off 128, phys_addr 0x3478c600    
    packet_type 0x0 l2_len 0 l3_len 0 outer_l2_len 0 outer_l3_len 0                
    rss 0x0 fdir.hi 0x0 fdir.lo 0x0                                                
  IP4: 22:b0:a3:50:fa:3a -> 22:34:47:51:c0:a8                                      
  ICMP: 10.0.0.1 -> 10.0.0.2                                                       
    tos 0x00, ttl 64, length 84, checksum 0x3e6d dscp CS0 ecn NON_ECN              
    fragment id 0xe839, flags DONT_FRAGMENT                                        
  ICMP echo_request checksum 0x6d24 id 2                                           
00:37:46:618832: sflow                                                             
  SFLOW: sw_if_index 1, next index 0                                               
  src 22:b0:a3:50:fa:3a -> dst 22:34:47:51:c0:a8                                   
00:37:46:618836: ethernet-input                                                    
  IP4: 22:b0:a3:50:fa:3a -> 22:34:47:51:c0:a8                                      
00:37:46:618837: ip4-input                                                         
  ICMP: 10.0.0.1 -> 10.0.0.2                                                       
    tos 0x00, ttl 64, length 84, checksum 0x3e6d dscp CS0 ecn NON_ECN              
    fragment id 0xe839, flags DONT_FRAGMENT                                        
  ICMP echo_request checksum 0x6d24 id 2                                           
00:37:46:618837: ip4-validate                                                      
  IP4-VALIDATE: sw_if_index 1 next 1 src 10.0.0.1 dst 10.0.0.2                     
00:37:46:618837: ip4-lookup                                                        
  fib 0 dpo-idx 10 flow hash: 0x00000000                                           
  ICMP: 10.0.0.1 -> 10.0.0.2                                                       
    tos 0x00, ttl 64, length 84, checksum 0x3e6d dscp CS0 ecn NON_ECN              
    fragment id 0xe839, flags DONT_FRAGMENT                                        
  ICMP echo_request checksum 0x6d24 id 2                                           
00:37:46:618837: ip4-receive                                                       
    fib:0 adj:10 flow:0x00000000                                                   
  ICMP: 10.0.0.1 -> 10.0.0.2                                                       
    tos 0x00, ttl 64, length 84, checksum 0x3e6d dscp CS0 ecn NON_ECN              
    fragment id 0xe839, flags DONT_FRAGMENT                                        
  ICMP echo_request checksum 0x6d24 id 2                                           
00:37:46:618837: ip4-icmp-input                                                    
  ICMP: 10.0.0.1 -> 10.0.0.2                                                       
    tos 0x00, ttl 64, length 84, checksum 0x3e6d dscp CS0 ecn NON_ECN              
    fragment id 0xe839, flags DONT_FRAGMENT                                        
  ICMP echo_request checksum 0x6d24 id 2                                           
00:37:46:618838: ip4-punt-redirect
  via redirect:0
00:37:46:618838: ip4-dvr-dpo
     sw_if_index:4
00:37:46:618838: ip4-dvr-reinject
     sw_if_index:4
00:37:46:618838: tap4096-output
  tap4096 flags 0x0319000d
  IP4: 22:b0:a3:50:fa:3a -> 22:34:47:51:c0:a8
  ICMP: 10.0.0.1 -> 10.0.0.2
    tos 0x00, ttl 64, length 84, checksum 0x3e6d dscp CS0 ecn NON_ECN
    fragment id 0xe839, flags DONT_FRAGMENT
  ICMP echo_request checksum 0x6d24 id 2
00:37:46:618838: tap4096-tx
    buffer 0x2e316: current data 0, length 98, buffer-pool 0, ref-count 1, trace ha
ndle 0x1000031
                    ext-hdr-valid 
                    local ip4 dvr l2-hdr-offset 0 l3-hdr-offset 14 
  ipv4 hdr-sz 34 l2-hdr-offset 0 l3-hdr-offset 14 l4-hdr-offset 34 l4-hdr-sz 0
  IP4: 22:b0:a3:50:fa:3a -> 22:34:47:51:c0:a8
  ICMP: 10.0.0.1 -> 10.0.0.2
    tos 0x00, ttl 64, length 84, checksum 0x3e6d dscp CS0 ecn NON_ECN
    fragment id 0xe839, flags DONT_FRAGMENT
  ICMP echo_request checksum 0x6d24 id 2

[mssonicbld]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[sflow]

I would like to understand the need for a VPP patch to report the Linux ifIndex numbers. In the VPP sFlow plugin both the VPP ifIndex numbers and the Linux ifIndex numbers are shared over NetLink where hsflowd mod_vpp takes care of the rest depending on what settings are applied there (then ultimately hsflowd mod_sonic translates to the SONiC ifIndex numbers at the point where the datagrams are sent out to the sFlow collector). It sounds as though the patch is to bring all the NetLink messages into the Linux namespace earlier? Is that right? I'm concerned that hsflowd mod_vpp may be thrown by this when it receives the feed -- but perhaps the idea is not to run mod_vpp at all? I guess that makes sense because hsflowd mod_sonic will read the counters from redis anyway, so the PSAMPLE and DROPMON feeds from VPP just need to conform more directly to the SAI spec (Ultimately hsflowd mod_sonic will translate into the SONiC ifIndex namespace, but that happens later).