netdev - Re: [PATCH mlx5-next 05/15] net/mlx5: E-Switch, Tag packet with vport number in VF vports and uplink ingress ACLs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190619125122.GA14681@mellanox.com>
Date:   Wed, 19 Jun 2019 12:52:27 +0000
From:   Jianbo Liu <jianbol@...lanox.com>
To:     Parav Pandit <parav@...lanox.com>
CC:     Saeed Mahameed <saeedm@...lanox.com>,
        Leon Romanovsky <leonro@...lanox.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-rdma@...r.kernel.org" <linux-rdma@...r.kernel.org>,
        Eli Britstein <elibr@...lanox.com>,
        Roi Dayan <roid@...lanox.com>, Mark Bloch <markb@...lanox.com>
Subject: Re: [PATCH mlx5-next 05/15] net/mlx5: E-Switch, Tag packet with vport
 number in VF vports and uplink ingress ACLs

The 06/18/2019 18:31, Parav Pandit wrote:
> 
> 
> > -----Original Message-----
> > From: netdev-owner@...r.kernel.org <netdev-owner@...r.kernel.org> On
> > Behalf Of Saeed Mahameed
> > Sent: Tuesday, June 18, 2019 12:53 AM
> > To: Saeed Mahameed <saeedm@...lanox.com>; Leon Romanovsky
> > <leonro@...lanox.com>
> > Cc: netdev@...r.kernel.org; linux-rdma@...r.kernel.org; Jianbo Liu
> > <jianbol@...lanox.com>; Eli Britstein <elibr@...lanox.com>; Roi Dayan
> > <roid@...lanox.com>; Mark Bloch <markb@...lanox.com>
> > Subject: [PATCH mlx5-next 05/15] net/mlx5: E-Switch, Tag packet with vport
> > number in VF vports and uplink ingress ACLs
> > 
> > From: Jianbo Liu <jianbol@...lanox.com>
> > 
> > When a dual-port VHCA sends a RoCE packet on its non-native port, and the
> > packet arrives to its affiliated vport FDB, a mismatch might occur on the rules
> > that match the packet source vport as it is not represented by single VHCA only
> > in this case. So we change to match on metadata instead of source vport.
> > To do that, a rule is created in all vports and uplink ingress ACLs, to save the
> > source vport number and vhca id in the packet's metadata in order to match on
> > it later.
> > The metadata register used is the first of the 32-bit type C registers. It can be
> > used for matching and header modify operations. The higher 16 bits of this
> > register are for vhca id, and the lower 16 ones is for vport number.
> > This change is not for dual-port RoCE only. If HW and FW allow, the vport
> > metadata matching is enabled by default.
> > 
> > Signed-off-by: Jianbo Liu <jianbol@...lanox.com>
> > Reviewed-by: Eli Britstein <elibr@...lanox.com>
> > Reviewed-by: Roi Dayan <roid@...lanox.com>
> > Reviewed-by: Mark Bloch <markb@...lanox.com>
> > Signed-off-by: Saeed Mahameed <saeedm@...lanox.com>
> > ---
> >  .../net/ethernet/mellanox/mlx5/core/eswitch.c |   2 +
> >  .../net/ethernet/mellanox/mlx5/core/eswitch.h |   9 +
> >  .../mellanox/mlx5/core/eswitch_offloads.c     | 183 ++++++++++++++----
> >  include/linux/mlx5/eswitch.h                  |   3 +
> >  4 files changed, 161 insertions(+), 36 deletions(-)
> > 
> > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
> > b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
> > index a42a23e505df..1235fd84ae3a 100644
> > --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
> > +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c

...

> > +			err = esw_vport_egress_prio_tag_config(esw, vport);
> > +			if (err)
> > +				goto err_egress;
> > +		}
> >  	}
> > 
> > +	if (mlx5_eswitch_vport_match_metadata_enabled(esw))
> > +		esw_info(esw->dev, "Use metadata reg_c as source vport to
> > match\n");
> > +
> >  	return 0;
> > 
> >  err_egress:
> >  	esw_vport_disable_ingress_acl(esw, vport);
> >  err_ingress:
> > -	mlx5_esw_for_each_vf_vport_reverse(esw, j, vport, i - 1) {
> > +	for (j = MLX5_VPORT_PF; j < i; j++) {
> Keep the reverse order as before.

The vports are independent from each other. It doesn't matter disabling
them in or out of order. I don't understand what's the benifit.

> 
> > +		vport = &esw->vports[j];
> >  		esw_vport_disable_egress_acl(esw, vport);
> >  		esw_vport_disable_ingress_acl(esw, vport);
> >  	}
> > @@ -1704,15 +1800,17 @@ static int esw_prio_tag_acls_config(struct
> > mlx5_eswitch *esw, int nvports)
> >  	return err;
> >  }
> > 
> > -static void esw_prio_tag_acls_cleanup(struct mlx5_eswitch *esw)
> > +static void esw_destroy_offloads_acl_tables(struct mlx5_eswitch *esw)
> >  {
> >  	struct mlx5_vport *vport;
> >  	int i;
> > 
> > -	mlx5_esw_for_each_vf_vport(esw, i, vport, esw->nvports) {
> > +	mlx5_esw_for_all_vports(esw, i, vport) {
> If you are changing this, please do in reverse order to keep it exact mirror of create/enable sequence.

Same...

> 
> >  		esw_vport_disable_egress_acl(esw, vport);
> >  		esw_vport_disable_ingress_acl(esw, vport);
> >  	}
> > +
> > +	esw->flags &= ~MLX5_ESWITCH_VPORT_MATCH_METADATA;
> >  }
> > 
> >  static int esw_offloads_steering_init(struct mlx5_eswitch *esw, int nvports)