RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1570842 - NFP can't be used for OVS DPDK due to "A CPP handle can not be obtained" ERR with Selinux=Enforcing.
Summary: NFP can't be used for OVS DPDK due to "A CPP handle can not be obtained" ERR ...
Keywords:
Status: CLOSED DUPLICATE of bug 1568301
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: openvswitch
Version: 7.5
Hardware: x86_64
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Eelco Chaudron
QA Contact: Jean-Tsung Hsiao
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-04-23 14:05 UTC by Jean-Tsung Hsiao
Modified: 2018-05-08 08:07 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-05-08 08:07:03 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Jean-Tsung Hsiao 2018-04-23 14:05:43 UTC 
Description of problem: NFP can't be used for OVS DPDK caused by "A CPP handle can not be obtained" ERR with Selinux=Enforcing.

018-04-23T13:38:48.173Z|00021|dpdk|INFO|EAL: PCI device 0000:81:00.0 on NUMA socket 1
2018-04-23T13:38:48.173Z|00022|dpdk|INFO|EAL:   probe driver: 19ee:4000 net_nfp_pf
2018-04-23T13:38:48.174Z|00023|dpdk|INFO|EAL:   using IOMMU type 1 (Type 1)
2018-04-23T13:38:48.465Z|00024|dpdk|ERR|PMD: A CPP handle can not be obtained
2018-04-23T13:38:48.465Z|00025|dpdk|INFO|EAL: Releasing pci mapped resource for 0000:81:00.0
2018-04-23T13:38:48.465Z|00026|dpdk|INFO|EAL: Calling pci_unmap_resource for 0000:81:00.0 at 0x7ff340000000
2018-04-23T13:38:48.465Z|00027|dpdk|INFO|EAL: Calling pci_unmap_resource for 0000:81:00.0 at 0x7ff348000000
2018-04-23T13:38:48.465Z|00028|dpdk|INFO|EAL: Calling pci_unmap_resource for 0000:81:00.0 at 0x7ff34c000000
2018-04-23T13:38:48.624Z|00029|dpdk|ERR|EAL: Requested device 0000:81:00.0 cannot be used

Also, check the following related bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1566712

Due to this bug OVS-dpdk/NFP cannot be run as: OVS_USER_ID="openvswitch:hugetlbfs"

This might caused the issue here.

Version-Release number of selected component (if applicable):
[root@netqe7 ~]# uname -a
Linux netqe7.knqe.lab.eng.bos.redhat.com 3.10.0-862.el7.x86_64 #1 SMP Wed Mar 21 18:14:51 EDT 2018 x86_64 x86_64 x86_64 GNU/Linux
[root@netqe7 ~]# rpm -q openvswitch
openvswitch-2.9.0-17.el7fdp.x86_64


How reproducible: Reproducible


Steps to Reproduce:
1. Edit /etc/sysconfig/openvswitch to comment out OVS_USER_ID line:
#OVS_USER_ID="openvswitch:hugetlbfs"

2. setenforce 1
3. Use driverctl to bind the NFP
4. systemctl start openvswitch


Actual results: failed --- see description above.


Expected results: Should succeed


Additional info:
Comment 2 Eelco Chaudron 2018-04-26 11:04:01 UTC 
Jean did you install the SELinux profiles needed?

 yum install http://download-ipv4.eng.brq.redhat.com/brewroot/packages/openstack-selinux/0.8.13/2.el7ost/noarch/openstack-selinux-0.8.13-2.el7ost.noarch.rpm \
   http://download-ipv4.eng.brq.redhat.com/brewroot/packages/container-selinux/2.41/1.git126c1c0.el7/noarch/container-selinux-2.41-1.git126c1c0.el7.noarch.rpm

I quickly tried it in my lab and works fine with these profiles installed.
Comment 3 Jean-Tsung Hsiao 2018-04-26 15:53:52 UTC 
Hi Eelco,

Mine are newer:

[root@netqe7 ~]# rpm -qa | grep selinux
libselinux-2.5-12.el7.x86_64
container-selinux-2.51-1.el7.noarch
selinux-policy-targeted-3.13.1-192.el7.noarch
libselinux-utils-2.5-12.el7.x86_64
libselinux-python-2.5-12.el7.x86_64
openstack-selinux-0.8.14-0.20180221131810.4e6703e.el7ost.noarch
selinux-policy-3.13.1-192.el7.noarch

Remember that we need to comment out this line:
#OVS_USER_ID="openvswitch:hugetlbfs"

Thanks!

Jean
Comment 4 Jean-Tsung Hsiao 2018-04-26 18:27:46 UTC 
Please follow this reproducer.

Before staring OVS and configuring anything, setenforce 1; bind NFP first; tail -f the daemon log, and then start OVS. You should see ERR coming out when OVS is up. See the log with ERR here.

{
2018-04-26T18:25:46.289Z|00021|dpdk|INFO|EAL: PCI device 0000:81:00.0 on NUMA socket 1
2018-04-26T18:25:46.289Z|00022|dpdk|INFO|EAL:   probe driver: 19ee:4000 net_nfp_pf
2018-04-26T18:25:46.291Z|00023|dpdk|INFO|EAL:   using IOMMU type 1 (Type 1)
2018-04-26T18:25:46.580Z|00024|dpdk|ERR|PMD: A CPP handle can not be obtained
2018-04-26T18:25:46.580Z|00025|dpdk|INFO|EAL: Releasing pci mapped resource for 0000:81:00.0
2018-04-26T18:25:46.580Z|00026|dpdk|INFO|EAL: Calling pci_unmap_resource for 0000:81:00.0 at 0x7f07c0000000
2018-04-26T18:25:46.580Z|00027|dpdk|INFO|EAL: Calling pci_unmap_resource for 0000:81:00.0 at 0x7f07c8000000
2018-04-26T18:25:46.580Z|00028|dpdk|INFO|EAL: Calling pci_unmap_resource for 0000:81:00.0 at 0x7f07cc000000
2018-04-26T18:25:46.739Z|00029|dpdk|ERR|EAL: Requested device 0000:81:00.0 cannot be used
}

Please let me know your result.

Thanks!

Jean
Comment 7 Eelco Chaudron 2018-05-08 08:07:03 UTC 
Closing this BZ as a duplicate of BZ1568301 after hacking http://dpdk.org/ml/archives/stable/2018-April/006311.html in NFP CPP patch confirmed this is the same issue.

*** This bug has been marked as a duplicate of bug 1568301 ***
Note You need to log in before you can comment on or make changes to this bug.