| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250925171744-mutt-send-email-mst@kernel.org>
Date: Thu, 25 Sep 2025 17:19:12 -0400
From: "Michael S. Tsirkin" <mst@...hat.com>
To: Daniel Jurgens <danielj@...dia.com>
Cc: netdev@...r.kernel.org, jasowang@...hat.com, alex.williamson@...hat.com,
pabeni@...hat.com, virtualization@...ts.linux.dev, parav@...dia.com,
shshitrit@...dia.com, yohadt@...dia.com, xuanzhuo@...ux.alibaba.com,
eperezma@...hat.com, shameerali.kolothum.thodi@...wei.com,
jgg@...pe.ca, kevin.tian@...el.com, kuba@...nel.org,
andrew+netdev@...n.ch, edumazet@...gle.com
Subject: Re: [PATCH net-next v3 00/11] virtio_net: Add ethtool flow rules
support
On Tue, Sep 23, 2025 at 09:19:09AM -0500, Daniel Jurgens wrote:
> This series implements ethtool flow rules support for virtio_net using the
> virtio flow filter (FF) specification. The implementation allows users to
> configure packet filtering rules through ethtool commands, directing
> packets to specific receive queues, or dropping them based on various
> header fields.
>
> The series starts with infrastructure changes to expose virtio PCI admin
> capabilities and object management APIs. It then creates the virtio_net
> directory structure and implements the flow filter functionality with support
> for:
ok i took a quick look as you asked
main things:
1. I am not sure device output is validated sufficiently
and can not cause all kind of overflows
can be an issues esp for coco
2. avoid u8* just to do pointer math. void* is better for this.
> - Layer 2 (Ethernet) flow rules
> - IPv4 and IPv6 flow rules
> - TCP and UDP flow rules (both IPv4 and IPv6)
> - Rule querying and management operations
>
> Setting, deleting and viewing flow filters, -1 action is drop, postive
> integers steer to that RQ:
>
> $ ethtool -u ens9
> 4 RX rings available
> Total 0 rules
>
> $ ethtool -U ens9 flow-type ether src 1c:34:da:4a:33:dd action 0
> Added rule with ID 0
> $ ethtool -U ens9 flow-type udp4 dst-port 5001 action 3
> Added rule with ID 1
> $ ethtool -U ens9 flow-type tcp6 src-ip fc00::2 dst-port 5001 action 2
> Added rule with ID 2
> $ ethtool -U ens9 flow-type ip4 src-ip 192.168.51.101 action 1
> Added rule with ID 3
> $ ethtool -U ens9 flow-type ip6 dst-ip fc00::1 action -1
> Added rule with ID 4
> $ ethtool -U ens9 flow-type ip6 src-ip fc00::2 action -1
> Added rule with ID 5
> $ ethtool -U ens9 delete 4
> $ ethtool -u ens9
> 4 RX rings available
> Total 5 rules
>
> Filter: 0
> Flow Type: Raw Ethernet
> Src MAC addr: 1C:34:DA:4A:33:DD mask: 00:00:00:00:00:00
> Dest MAC addr: 00:00:00:00:00:00 mask: FF:FF:FF:FF:FF:FF
> Ethertype: 0x0 mask: 0xFFFF
> Action: Direct to queue 0
>
> Filter: 1
> Rule Type: UDP over IPv4
> Src IP addr: 0.0.0.0 mask: 255.255.255.255
> Dest IP addr: 0.0.0.0 mask: 255.255.255.255
> TOS: 0x0 mask: 0xff
> Src port: 0 mask: 0xffff
> Dest port: 5001 mask: 0x0
> Action: Direct to queue 3
>
> Filter: 2
> Rule Type: TCP over IPv6
> Src IP addr: fc00::2 mask: ::
> Dest IP addr: :: mask: ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
> Traffic Class: 0x0 mask: 0xff
> Src port: 0 mask: 0xffff
> Dest port: 5001 mask: 0x0
> Action: Direct to queue 2
>
> Filter: 3
> Rule Type: Raw IPv4
> Src IP addr: 192.168.51.101 mask: 0.0.0.0
> Dest IP addr: 0.0.0.0 mask: 255.255.255.255
> TOS: 0x0 mask: 0xff
> Protocol: 0 mask: 0xff
> L4 bytes: 0x0 mask: 0xffffffff
> Action: Direct to queue 1
>
> Filter: 5
> Rule Type: Raw IPv6
> Src IP addr: fc00::2 mask: ::
> Dest IP addr: :: mask: ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
> Traffic Class: 0x0 mask: 0xff
> Protocol: 0 mask: 0xff
> L4 bytes: 0x0 mask: 0xffffffff
> Action: Drop
>
> v2:
> - Fix sparse warnings
> - Fix memory leak on subsequent failure to allocate
> - Fix some Typos
>
> v3:
> - Rebased
> - Added back get|set_rxnfc to virtio_net
> - Added admin_ops to virtio_device kdoc.
>
> Daniel Jurgens (11):
> virtio-pci: Expose generic device capability operations
> virtio-pci: Expose object create and destroy API
> virtio_net: Create virtio_net directory
> virtio_net: Query and set flow filter caps
> virtio_net: Create a FF group for ethtool steering
> virtio_net: Implement layer 2 ethtool flow rules
> virtio_net: Use existing classifier if possible
> virtio_net: Implement IPv4 ethtool flow rules
> virtio_net: Add support for IPv6 ethtool steering
> virtio_net: Add support for TCP and UDP ethtool rules
> virtio_net: Add get ethtool flow rules ops
>
> MAINTAINERS | 2 +-
> drivers/net/Makefile | 2 +-
> drivers/net/virtio_net/Makefile | 8 +
> drivers/net/virtio_net/virtio_net_ff.c | 1029 +++++++++++++++++
> drivers/net/virtio_net/virtio_net_ff.h | 42 +
> .../virtio_net_main.c} | 46 +
> drivers/vfio/pci/virtio/migrate.c | 8 +-
> drivers/virtio/virtio.c | 141 +++
> drivers/virtio/virtio_pci_common.h | 1 -
> drivers/virtio/virtio_pci_modern.c | 320 ++---
> include/linux/virtio.h | 22 +
> include/linux/virtio_admin.h | 101 ++
> include/linux/virtio_pci_admin.h | 7 +-
> include/uapi/linux/virtio_net_ff.h | 82 ++
> include/uapi/linux/virtio_pci.h | 7 +-
> 15 files changed, 1677 insertions(+), 141 deletions(-)
> create mode 100644 drivers/net/virtio_net/Makefile
> create mode 100644 drivers/net/virtio_net/virtio_net_ff.c
> create mode 100644 drivers/net/virtio_net/virtio_net_ff.h
> rename drivers/net/{virtio_net.c => virtio_net/virtio_net_main.c} (99%)
> create mode 100644 include/linux/virtio_admin.h
> create mode 100644 include/uapi/linux/virtio_net_ff.h
>
> --
> 2.45.0
Powered by blists - more mailing lists