netdev - Re: [PATCH net-next v4] net/mlx5e: Don't allow forwarding between uplink

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <21d44104-5523-f75b-c014-95cf2adb4e45@mellanox.com>
Date:   Mon, 17 Feb 2020 16:18:30 +0200
From:   Roi Dayan <roid@...lanox.com>
To:     xiangxia.m.yue@...il.com, gerlitz.or@...il.com,
        saeedm@....mellanox.co.il
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH net-next v4] net/mlx5e: Don't allow forwarding between
 uplink



On 2020-02-17 4:08 PM, xiangxia.m.yue@...il.com wrote:
> From: Tonghao Zhang <xiangxia.m.yue@...il.com>
> 
> We can install forwarding packets rule between uplink
> in switchdev mode, as show below. But the hardware does
> not do that as expected (mlnx_perf -i $PF1, we can't get
> the counter of the PF1). By the way, if we add the uplink
> PF0, PF1 to Open vSwitch and enable hw-offload, the rules
> can be offloaded but not work fine too. This patch add a
> check and if so return -EOPNOTSUPP.
> 
> $ tc filter add dev $PF0 protocol all parent ffff: prio 1 handle 1 \
>     flower skip_sw action mirred egress redirect dev $PF1
> 
> $ tc -d -s filter show dev $PF0 ingress
>     skip_sw
>     in_hw in_hw_count 1
>     action order 1: mirred (Egress Redirect to device enp130s0f1) stolen
>     ...
>     Sent hardware 408954 bytes 4173 pkt
>     ...
> 
> Signed-off-by: Tonghao Zhang <xiangxia.m.yue@...il.com>
> ---
>  drivers/net/ethernet/mellanox/mlx5/core/en_rep.c |  5 +++++
>  drivers/net/ethernet/mellanox/mlx5/core/en_rep.h |  1 +
>  drivers/net/ethernet/mellanox/mlx5/core/en_tc.c  | 17 +++++++++++++++++
>  3 files changed, 23 insertions(+)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
> index 7b48cca..18d3dcd 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
> @@ -1464,6 +1464,11 @@ static struct devlink_port *mlx5e_get_devlink_port(struct net_device *dev)
>  	.ndo_set_features        = mlx5e_set_features,
>  };
>  
> +bool mlx5e_eswitch_uplink_rep(struct net_device *netdev)
> +{
> +	return netdev->netdev_ops == &mlx5e_netdev_ops_uplink_rep;
> +}
> +
>  bool mlx5e_eswitch_rep(struct net_device *netdev)
>  {
>  	if (netdev->netdev_ops == &mlx5e_netdev_ops_rep ||
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h
> index 3f756d5..8336301 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h
> @@ -200,6 +200,7 @@ void mlx5e_rep_encap_entry_detach(struct mlx5e_priv *priv,
>  void mlx5e_rep_queue_neigh_stats_work(struct mlx5e_priv *priv);
>  
>  bool mlx5e_eswitch_rep(struct net_device *netdev);
> +bool mlx5e_eswitch_uplink_rep(struct net_device *netdev);
>  
>  #else /* CONFIG_MLX5_ESWITCH */
>  static inline bool mlx5e_is_uplink_rep(struct mlx5e_priv *priv) { return false; }
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> index 74091f7..290cdf3 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> @@ -3405,6 +3405,7 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv,
>  				struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
>  				struct net_device *uplink_dev = mlx5_eswitch_uplink_get_proto_dev(esw, REP_ETH);
>  				struct net_device *uplink_upper;
> +				struct mlx5e_rep_priv *rep_priv;
>  
>  				if (is_duplicated_output_device(priv->netdev,
>  								out_dev,
> @@ -3440,6 +3441,22 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv,
>  						return err;
>  				}
>  
> +				/* Don't allow forwarding between uplink.
> +				 *
> +				 * Input vport was stored esw_attr->in_rep.
> +				 * In LAG case, *priv* is the private data of
> +				 * uplink which may be not the input vport.
> +				 */
> +				rep_priv = mlx5e_rep_to_rep_priv(attr->in_rep);
> +				if (mlx5e_eswitch_uplink_rep(rep_priv->netdev) &&
> +				    mlx5e_eswitch_uplink_rep(out_dev)) {
> +					NL_SET_ERR_MSG_MOD(extack,
> +							   "devices are both uplink, can't offload forwarding");
> +					pr_err("devices %s %s are both uplink, can't offload forwarding\n",
> +					       priv->netdev->name, out_dev->name);
> +					return -EOPNOTSUPP;
> +				}
> +
>  				if (!mlx5e_is_valid_eswitch_fwd_dev(priv, out_dev)) {
>  					NL_SET_ERR_MSG_MOD(extack,
>  							   "devices are not on same switch HW, can't offload forwarding");
> 

thanks

Reviewed-by: Roi Dayan <roid@...lanox.com>