linux-kernel - Re: [net PATCH] octeontx2-pf: Fix ntuple rule creation to direct packet to VF with higher Rx queue than its PF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <745e6518-6253-4ef0-8f05-1421ee4e1fef@intel.com>
Date:   Mon, 20 Nov 2023 13:02:22 +0100
From:   Wojciech Drewek <wojciech.drewek@...el.com>
To:     Suman Ghosh <sumang@...vell.com>, <sgoutham@...vell.com>,
        <gakula@...vell.com>, <sbhatta@...vell.com>, <hkelam@...vell.com>,
        <lcherian@...vell.com>, <jerinj@...vell.com>,
        <davem@...emloft.net>, <edumazet@...gle.com>, <kuba@...nel.org>,
        <pabeni@...hat.com>, <netdev@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>, <horms@...nel.org>
Subject: Re: [net PATCH] octeontx2-pf: Fix ntuple rule creation to direct
 packet to VF with higher Rx queue than its PF



On 20.11.2023 06:51, Suman Ghosh wrote:
> It is possible to add a ntuple rule which would like to direct packet to
> a VF whose number of queues are greater/less than its PF's queue numbers.
> For example a PF can have 2 Rx queues but a VF created on that PF can have
> 8 Rx queues. As of today, ntuple rule will reject rule because it is
> checking the requested queue number against PF's number of Rx queues.
> As a part of this fix if the action of a ntuple rule is to move a packet
> to a VF's queue then the check is removed. Also, a debug information is
> printed to aware user that it is user's responsibility to cross check if
> the requested queue number on that VF is a valid one.
> 
> Fixes: f0a1913f8a6f ("octeontx2-pf: Add support for ethtool ntuple filters")
> Signed-off-by: Suman Ghosh <sumang@...vell.com>
> ---
>  .../marvell/octeontx2/nic/otx2_flows.c        | 21 +++++++++++++++++++
>  1 file changed, 21 insertions(+)
> 
> diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
> index 4762dbea64a1..4200f2d387f6 100644
> --- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
> +++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
> @@ -1088,6 +1088,7 @@ int otx2_add_flow(struct otx2_nic *pfvf, struct ethtool_rxnfc *nfc)
>  	struct ethhdr *eth_hdr;
>  	bool new = false;
>  	int err = 0;
> +	u64 vf_num;
>  	u32 ring;
>  
>  	if (!flow_cfg->max_flows) {
> @@ -1100,9 +1101,26 @@ int otx2_add_flow(struct otx2_nic *pfvf, struct ethtool_rxnfc *nfc)
>  	if (!(pfvf->flags & OTX2_FLAG_NTUPLE_SUPPORT))
>  		return -ENOMEM;
>  
> +	/* Number of queues on a VF can be greater or less than
> +	 * the PF's queue. Hence no need to check for the
> +	 * queue count. Hence no need to check queue count if PF
> +	 * is installing for its VF. Below is the expected vf_num value
> +	 * based on the ethtool commands.
> +	 *
> +	 * e.g.
> +	 * 1. ethtool -U <netdev> ... action -1  ==> vf_num:255
> +	 * 2. ethtool -U <netdev> ... action <queue_num>  ==> vf_num:0
> +	 * 3. ethtool -U <netdev> ... vf <vf_idx> queue <queue_num>  ==>
> +	 *    vf_num:vf_idx+1
> +	 */
> +	vf_num = ethtool_get_flow_spec_ring_vf(fsp->ring_cookie);
> +	if (!is_otx2_vf(pfvf->pcifunc) && vf_num)
> +		goto bypass_queue_check;

Let's just add this condition to the next if, no need for goto.

> +
>  	if (ring >= pfvf->hw.rx_queues && fsp->ring_cookie != RX_CLS_FLOW_DISC)
>  		return -EINVAL;
>  
> +bypass_queue_check:
>  	if (fsp->location >= otx2_get_maxflows(flow_cfg))
>  		return -EINVAL;
>  
> @@ -1182,6 +1200,9 @@ int otx2_add_flow(struct otx2_nic *pfvf, struct ethtool_rxnfc *nfc)
>  		flow_cfg->nr_flows++;
>  	}
>  
> +	if (flow->is_vf)
> +		netdev_info(pfvf->netdev,
> +			    "Make sure that VF's queue number is within its queue limit\n");
>  	return 0;
>  }
>