| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID:
<CO1PR18MB46661FF0DD278978575A20C9A11EA@CO1PR18MB4666.namprd18.prod.outlook.com>
Date: Mon, 21 Aug 2023 06:46:02 +0000
From: Subbaraya Sundeep Bhatta <sbhatta@...vell.com>
To: Junfeng Guo <junfeng.guo@...el.com>,
"intel-wired-lan@...ts.osuosl.org"
<intel-wired-lan@...ts.osuosl.org>
CC: "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
"anthony.l.nguyen@...el.com" <anthony.l.nguyen@...el.com>,
"jesse.brandeburg@...el.com" <jesse.brandeburg@...el.com>,
"qi.z.zhang@...el.com" <qi.z.zhang@...el.com>,
"ivecera@...hat.com"
<ivecera@...hat.com>,
"sridhar.samudrala@...el.com"
<sridhar.samudrala@...el.com>
Subject: RE: [EXT] [PATCH iwl-next v5 00/15] Introduce the Parser Library
Hi,
>-----Original Message-----
>From: Junfeng Guo <junfeng.guo@...el.com>
>Sent: Monday, August 21, 2023 8:08 AM
>To: intel-wired-lan@...ts.osuosl.org
>Cc: netdev@...r.kernel.org; anthony.l.nguyen@...el.com;
>jesse.brandeburg@...el.com; qi.z.zhang@...el.com; ivecera@...hat.com;
>sridhar.samudrala@...el.com; Junfeng Guo <junfeng.guo@...el.com>
>Subject: [EXT] [PATCH iwl-next v5 00/15] Introduce the Parser Library
>
>External Email
>
>----------------------------------------------------------------------
>Current software architecture for flow filtering offloading limited
>the capability of Intel Ethernet 800 Series Dynamic Device
>Personalization (DDP) Package. The flow filtering offloading in the
>driver is enabled based on the naming parsers, each flow pattern is
>represented by a protocol header stack. And there are multiple layers
>(e.g., virtchnl) to maintain their own enum/macro/structure
>to represent a protocol header (IP, TCP, UDP ...), thus the extra
>parsers to verify if a pattern is supported by hardware or not as
>well as the extra converters that to translate represents between
>different layers. Every time a new protocol/field is requested to be
>supported, the corresponding logic for the parsers and the converters
>needs to be modified accordingly. Thus, huge & redundant efforts are
>required to support the increasing flow filtering offloading features,
>especially for the tunnel types flow filtering.
>
>This patch set provides a way for applications to send down training
>packets & masks (in binary) to the driver. Then these binary data
>would be used by the driver to generate certain data that are needed
>to create a filter rule in the filtering stage of switch/RSS/FDIR.
>
Which application? Can you provide usage example too. Is it okay to
parse binary data in kernel driver? We do have similar requirements I
am thinking if we can leverage this for all drivers.
Thanks,
Sundeep
>Note that the impact of a malicious rule in the raw packet filter is
>limited to performance rather than functionality. It may affect the
>performance of the workload, similar to other limitations in FDIR/RSS
>on AVF. For example, there is no resource boundary for VF FDIR/RSS
>rules, so one malicious VF could potentially make other VFs
>inefficient in offloading.
>
>The parser library is expected to include boundary checks to prevent
>critical errors such as infinite loops or segmentation faults.
>However, only implementing and validating the parser emulator in a
>sandbox environment (like ebpf) presents a challenge.
>
>The idea is to make the driver be able to learn from the DDP package
>directly to understand how the hardware parser works (i.e., the
>Parser Library), so that it can process on the raw training packet
>(in binary) directly and create the filter rule accordingly.
>
>Based on this Parser Library, the raw flow filtering of
>switch/RSS/FDIR could be enabled to allow new flow filtering
>offloading features to be supported without any driver changes (only
>need to update the DDP package).
>
>
>v5:
>- Update copyrights of new files to be 2023 only.
>- Update patch set series prefix.
>- Fix typo on patch 2 commit message.
>
>v4:
>- Update cover letter series title.
>
>v3:
>- Replace magic hardcoded values with macros.
>- Use size_t to avoid superfluous type cast to uintptr_t in function
> ice_parser_sect_item_get.
>- Prefix for static local function names to avoid namespace pollution.
>- Use strstarts() function instead of self implementation.
>
>v2:
>- Fix build warnings.
>
>
>Junfeng Guo (15):
> ice: add parser create and destroy skeleton
> ice: init imem table for parser
> ice: init metainit table for parser
> ice: init parse graph cam tables for parser
> ice: init boost tcam and label tables for parser
> ice: init ptype marker tcam table for parser
> ice: init marker and protocol group tables for parser
> ice: init flag redirect table for parser
> ice: init XLT key builder for parser
> ice: add parser runtime skeleton
> ice: add internal help functions
> ice: add parser execution main loop
> ice: support double vlan mode configure for parser
> ice: add tunnel port support for parser
> ice: add API for parser profile initialization
>
> drivers/net/ethernet/intel/ice/Makefile | 11 +
> drivers/net/ethernet/intel/ice/ice_bst_tcam.c | 313 +++++++
> drivers/net/ethernet/intel/ice/ice_bst_tcam.h | 52 ++
> drivers/net/ethernet/intel/ice/ice_common.h | 4 +
> drivers/net/ethernet/intel/ice/ice_ddp.c | 10 +-
> drivers/net/ethernet/intel/ice/ice_ddp.h | 14 +
> drivers/net/ethernet/intel/ice/ice_flg_rd.c | 73 ++
> drivers/net/ethernet/intel/ice/ice_flg_rd.h | 24 +
> drivers/net/ethernet/intel/ice/ice_imem.c | 279 ++++++
> drivers/net/ethernet/intel/ice/ice_imem.h | 217 +++++
> drivers/net/ethernet/intel/ice/ice_metainit.c | 181 ++++
> drivers/net/ethernet/intel/ice/ice_metainit.h | 104 +++
> drivers/net/ethernet/intel/ice/ice_mk_grp.c | 51 +
> drivers/net/ethernet/intel/ice/ice_mk_grp.h | 17 +
> drivers/net/ethernet/intel/ice/ice_parser.c | 562 +++++++++++
> drivers/net/ethernet/intel/ice/ice_parser.h | 140 +++
> .../net/ethernet/intel/ice/ice_parser_rt.c | 877 ++++++++++++++++++
> .../net/ethernet/intel/ice/ice_parser_rt.h | 73 ++
> .../net/ethernet/intel/ice/ice_parser_util.h | 37 +
> drivers/net/ethernet/intel/ice/ice_pg_cam.c | 397 ++++++++
> drivers/net/ethernet/intel/ice/ice_pg_cam.h | 142 +++
> .../net/ethernet/intel/ice/ice_proto_grp.c | 90 ++
> .../net/ethernet/intel/ice/ice_proto_grp.h | 31 +
> drivers/net/ethernet/intel/ice/ice_ptype_mk.c | 73 ++
> drivers/net/ethernet/intel/ice/ice_ptype_mk.h | 23 +
> drivers/net/ethernet/intel/ice/ice_tmatch.h | 40 +
> drivers/net/ethernet/intel/ice/ice_type.h | 1 +
> drivers/net/ethernet/intel/ice/ice_xlt_kb.c | 262 ++++++
> drivers/net/ethernet/intel/ice/ice_xlt_kb.h | 80 ++
> 29 files changed, 4173 insertions(+), 5 deletions(-)
> create mode 100644 drivers/net/ethernet/intel/ice/ice_bst_tcam.c
> create mode 100644 drivers/net/ethernet/intel/ice/ice_bst_tcam.h
> create mode 100644 drivers/net/ethernet/intel/ice/ice_flg_rd.c
> create mode 100644 drivers/net/ethernet/intel/ice/ice_flg_rd.h
> create mode 100644 drivers/net/ethernet/intel/ice/ice_imem.c
> create mode 100644 drivers/net/ethernet/intel/ice/ice_imem.h
> create mode 100644 drivers/net/ethernet/intel/ice/ice_metainit.c
> create mode 100644 drivers/net/ethernet/intel/ice/ice_metainit.h
> create mode 100644 drivers/net/ethernet/intel/ice/ice_mk_grp.c
> create mode 100644 drivers/net/ethernet/intel/ice/ice_mk_grp.h
> create mode 100644 drivers/net/ethernet/intel/ice/ice_parser.c
> create mode 100644 drivers/net/ethernet/intel/ice/ice_parser.h
> create mode 100644 drivers/net/ethernet/intel/ice/ice_parser_rt.c
> create mode 100644 drivers/net/ethernet/intel/ice/ice_parser_rt.h
> create mode 100644 drivers/net/ethernet/intel/ice/ice_parser_util.h
> create mode 100644 drivers/net/ethernet/intel/ice/ice_pg_cam.c
> create mode 100644 drivers/net/ethernet/intel/ice/ice_pg_cam.h
> create mode 100644 drivers/net/ethernet/intel/ice/ice_proto_grp.c
> create mode 100644 drivers/net/ethernet/intel/ice/ice_proto_grp.h
> create mode 100644 drivers/net/ethernet/intel/ice/ice_ptype_mk.c
> create mode 100644 drivers/net/ethernet/intel/ice/ice_ptype_mk.h
> create mode 100644 drivers/net/ethernet/intel/ice/ice_tmatch.h
> create mode 100644 drivers/net/ethernet/intel/ice/ice_xlt_kb.c
> create mode 100644 drivers/net/ethernet/intel/ice/ice_xlt_kb.h
>
>--
>2.25.1
>
Powered by blists - more mailing lists