lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 08 Dec 2010 11:26:08 -0800 From: Dimitris Michailidis <dm@...lsio.com> To: Ben Hutchings <bhutchings@...arflare.com> CC: Vladislav Zolotarov <vladz@...adcom.com>, Peter Waskiewicz <peter.p.waskiewicz.jr@...el.com>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>, David Miller <davem@...emloft.net> Subject: Re: (Lack of) specification for RX n-tuple filtering Ben Hutchings wrote: > On Wed, 2010-12-08 at 10:54 -0800, Dimitris Michailidis wrote: >> Ben Hutchings wrote: >>> On Wed, 2010-12-08 at 18:24 +0200, Vladislav Zolotarov wrote: >>>>>> It's a bit worse than that. Currently one can only append filters, not >>>>>> insert at a given position, as ethtool_rx_ntuple doesn't have an index >>>>>> field. For devices that use TCAMs, where position matters, it's quite an >>>>>> obstacle. It also means one cannot modify an existing filter by specifying >>>>>> a new filter for the same index. >>>>> It looks like drivers for devices that use TCAMs should implement the >>>>> RXNFC interface instead. >>>>> >>>> Ben, from ethtool manpage it sounds like RXNFC option defines the way >>>> the RSS hash should be calculated, while SRXNTUPLE is meant to control >>>> the destination Rx queue for a stream specified by a filter/filters. >>> By 'RXNFC interface' I mean ETHTOOL_{G,S}RXCLS* and not >>> ETHTOOL_{G,S}RXFH which wrongly share (part of) the same structure.. >>> >>>> The >>>> semantics for a specification of the steam is also quite different. For >>>> instance, how do u define a rule to drop all packets with source IP >>>> address 192.168.10.200 by means of RXNFC? >>> Something like this, I think: >>> >>> struct ethtool_rxnfc insert_rule = { >>> .cmd = ETHTOOL_SRXCLSRLINS, >>> .flow_type = IP_USER_SPEC, >>> .fs = { >>> .flow_type = IP_USER_SPEC, >>> .h_u.usr_ip4_spec = { >>> .ip4src = inet_aton("192.168.10.200"), >>> .ip_ver = ETH_RX_NFC_IP4 >>> }, >>> .m_u.usr_ip4_spec = { >>> .ip4dst = 0xffffffff, >>> .l4_4_bytes = 0xffffffff, >>> .tos = 0xff, >>> .proto = 0xff >>> }, >>> .ring_cookie = RX_CLS_FLOW_DISC, >>> .location = 0, >>> } >>> }; >> I think the mask would be 0 for don't care fields and 1 for care, so >> >> .m_u.usr_ip4_spec.ip4src = htonl(0xffffffff) >> .m_u.usr_ip4_spec.ip4dst = htonl(0) >> etc > > That is definitely the opposite of what ixgbe and sfc do for > ethtool_ntuple_rx_flow_spec, and I believe it is the opposite of what > niu does for ethtool_rx_flow_spec. These are the values as our HW at least wants them. The care bits are 1 in the mask. It's not a huge deal, the driver can complement the masks. > > [...] >>>> It's also unclear what is the relation between RXNFC and SRXNTUPLE. The >>>> last in general may override the decision made based on the hash result. >>>> So, it sounds like applying rules of SRXNTUPLE should come before >>>> applying the RSS logic and only if there was no match RSS should be >>>> applied to that frame. Do I get it right? >>> That's right. >> It can be more involved than this. Our HW allows a rule to select a >> different part of the RSS table so you get a filter hit and still do RSS >> afterwards if you want. Current ethtool interfaces do not support this, >> basically it would be a different action for either SRXNTUPLE or SRXCLSRLINS. > > So does the rule specify an offset added to the output of the RSS hash > and indirection table, or can it also select a different indirection > table? Our current hardware also has a filter flag for the former > behaviour... There are still plenty of bits to spare in 'action' and > 'ring_cookie' so perhaps we could define a flag for this? You can partition the indirection table and then a rule can specify that matching packets should consult region X of the table. The hash value is not altered, just the part of the overall table it indexes into. > > Ben. > -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists