netdev - Re: [PATCH net-next v2] net/mlx5e: Add mlx5e_flower_parse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 15 Jan 2020 11:13:23 +0200
From:   Or Gerlitz <gerlitz.or@...il.com>
To:     wenxu <wenxu@...oud.cn>
Cc:     Paul Blakey <paulb@...lanox.com>,
        Saeed Mahameed <saeedm@...lanox.com>,
        Linux Netdev List <netdev@...r.kernel.org>
Subject: Re: [PATCH net-next v2] net/mlx5e: Add mlx5e_flower_parse_meta support

On Tue, Jan 7, 2020 at 11:17 AM <wenxu@...oud.cn> wrote:
> In the flowtables offload all the devices in the flowtables
> share the same flow_block. An offload rule will be installed on

"In the flowtables offload all the devices in the flowtables share the"

I am not managing to follow on this sentence. What does "devices in
the flowtables" mean?

> all the devices. This scenario is not correct.

so this is a fix and should go to net, or maybe the code you are fixing
was only introduced in net-next?

> It is no problem if there are only two devices in the flowtable,
> The rule with ingress and egress on the same device can be reject

nit: rejected

> by driver.

> But more than two devices in the flowtable will install the wrong
> rules on hardware.
>
> For example:
> Three devices in a offload flowtables: dev_a, dev_b, dev_c
>
> A rule ingress from dev_a and egress to dev_b:
> The rule will install on device dev_a.
> The rule will try to install on dev_b but failed for ingress
> and egress on the same device.
> The rule will install on dev_c. This is not correct.
>
> The flowtables offload avoid this case through restricting the ingress dev
> with FLOW_DISSECTOR_KEY_META as following patch.
> http://patchwork.ozlabs.org/patch/1218109/
>
> So the mlx5e driver also should support the FLOW_DISSECTOR_KEY_META parse.
>
> Signed-off-by: wenxu <wenxu@...oud.cn>
> ---
> v2: remap the patch description
>
>  drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 39 +++++++++++++++++++++++++
>  1 file changed, 39 insertions(+)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> index 9b32a9c..33d1ce5 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> @@ -1805,6 +1805,40 @@ static void *get_match_headers_value(u32 flags,
>                              outer_headers);
>  }
>
> +static int mlx5e_flower_parse_meta(struct net_device *filter_dev,
> +                                  struct flow_cls_offload *f)
> +{
> +       struct flow_rule *rule = flow_cls_offload_flow_rule(f);
> +       struct netlink_ext_ack *extack = f->common.extack;
> +       struct net_device *ingress_dev;
> +       struct flow_match_meta match;
> +
> +       if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META))
> +               return 0;
> +
> +       flow_rule_match_meta(rule, &match);
> +       if (match.mask->ingress_ifindex != 0xFFFFFFFF) {
> +               NL_SET_ERR_MSG_MOD(extack, "Unsupported ingress ifindex mask");
> +               return -EINVAL;
> +       }
> +
> +       ingress_dev = __dev_get_by_index(dev_net(filter_dev),
> +                                        match.key->ingress_ifindex);
> +       if (!ingress_dev) {
> +               NL_SET_ERR_MSG_MOD(extack,
> +                                  "Can't find the ingress port to match on");
> +               return -EINVAL;
> +       }
> +
> +       if (ingress_dev != filter_dev) {
> +               NL_SET_ERR_MSG_MOD(extack,
> +                                  "Can't match on the ingress filter port");
> +               return -EINVAL;
> +       }
> +
> +       return 0;
> +}
> +
>  static int __parse_cls_flower(struct mlx5e_priv *priv,
>                               struct mlx5_flow_spec *spec,
>                               struct flow_cls_offload *f,
> @@ -1825,6 +1859,7 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
>         u16 addr_type = 0;
>         u8 ip_proto = 0;
>         u8 *match_level;
> +       int err;
>
>         match_level = outer_match_level;
>
> @@ -1868,6 +1903,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
>                                                     spec);
>         }
>
> +       err = mlx5e_flower_parse_meta(filter_dev, f);
> +       if (err)
> +               return err;
> +
>         if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) {
>                 struct flow_match_basic match;
>
> --
> 1.8.3.1
>