Multiple ct_clear datapath actions (openvswitch: ovs-system: deferred action limit reached, drop recirc action)

[Trent Lloyd]

The following log message is commonly encountered 100s of times per day on OVN/OpenStack deployments:
openvswitch: ovs-system: deferred action limit reached, drop recirc action

This message may appear despite seeming to have no impact VM traffic. One known cause of this message is that generated dataplane flow contains many (4-17+) repeated ct_clear actions.

You can verify you have such flows as follows:
ovs-appctl dpctl/dump-flows -m |grep -E "(ct_clear[,]){2,}"

This was fixed upstream in the following commit:
https://github.com/openvswitch/ovs/commit/355fef6f2ccbcf78797b938421cb4cef9b59af13
355fef6f2 ofproto-dpif-xlate: Avoid successive ct_clear datapath actions.

There is an additional Fixes commit:
https://github.com/openvswitch/ovs/commit/88e3ae5d6f7370acbf1d9d60c1a06e4132e4e532
88e3ae5d6 ofproto-dpif-xlate: Fix internal CT state for non-recirc traffic.

While traffic seems unaffected, it's unclear how much a performance loss there is in these cases.

This occurs at least as far back as Focal/Usurri, upstream has backports to many releases. We should look to backport it to at least Focal/Ussuri (openvswitch v2.13)

[nikhil kshirsagar (nkshirsagar)]

A relevant commit is https://github.com/ovn-org/ovn/commit/8c341b9d704cdf002126699527308203319954f0 which has gone into main and v23.06.0, v23.03.0 and backported to 22.12 through 481f25b784896eec07fedc77631992a009bcdada

[Edward Hope-Morley (hopem)]

Both of the patches in the description were backported to 2.13.8 (the version currently in focal-updates).