net/mlx5: fix integrity matching for inner and outer headers

PATCH In review Gregory Etelson 2 participants 3 messages Oct 26, 2021 – Oct 28, 2021 Network drivers

Share & tools

Gregory Etelson

author

2021-10-26 09:26 UTC #0 lore raw

PATCH 1/2 net/mlx5: fix integrity matching for inner and outer headers

MLX5 PMD can match on integrity bits for inner and outer headers in a single flow.
That means a single flow rule can reference both inner and outer integrity bits. That is implemented by adding 2 flow integrity items to a rule - one item for outer integrity bits and other for inner integrity bits.
Integrity item level parameter specifies what part is being targeted.

Current PMD treated integrity items for outer and inner headers as the same.
The patch separates PMD verifications for inner and outer integrity items.

Fixes 79f8952783d0 ("net/mlx5: support integrity flow item")

Signed-off-by Gregory Etelson <[email protected]>

Acked-by Viacheslav Ovsiienko <[email protected]>

---
 drivers/net/mlx5/mlx5_flow.h    |  7 ++++---
 drivers/net/mlx5/mlx5_flow_dv.c | 29 ++++++++++++++++++++++-------
 2 files changed, 26 insertions(+), 10 deletions(-)

drivers/net/mlx5/mlx5_flow.h +4 -3

index 4a16f30fb7..41e24deec5 100644
@@ -170,11 +170,12 @@ enum mlx5_feature_name {
 #define MLX5_FLOW_LAYER_GENEVE_OPT (UINT64_C(1) << 32)
 #define MLX5_FLOW_LAYER_GTP_PSC (UINT64_C(1) << 33)
 
-/* INTEGRITY item bit */
-#define MLX5_FLOW_ITEM_INTEGRITY (UINT64_C(1) << 34)
+/* INTEGRITY item bits */
+#define MLX5_FLOW_ITEM_OUTER_INTEGRITY (UINT64_C(1) << 34)
+#define MLX5_FLOW_ITEM_INNER_INTEGRITY (UINT64_C(1) << 35)
 
 /* Conntrack item. */
-#define MLX5_FLOW_LAYER_ASO_CT (UINT64_C(1) << 35)
+#define MLX5_FLOW_LAYER_ASO_CT (UINT64_C(1) << 36)
 
 /* Outer Masks. */
 #define MLX5_FLOW_LAYER_OUTER_L3 \

drivers/net/mlx5/mlx5_flow_dv.c +22 -7

index 9cba22ca2d..c27c2df5c4 100644
@@ -6679,6 +6679,7 @@ static int
 flow_dv_validate_item_integrity(struct rte_eth_dev *dev,
 				const struct rte_flow_item *rule_items,
 				const struct rte_flow_item *integrity_item,
+				uint64_t item_flags, uint64_t *last_item,
 				struct rte_flow_error *error)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;

@@ -6694,6 +6695,11 @@ flow_dv_validate_item_integrity(struct rte_eth_dev *dev,
 					  RTE_FLOW_ERROR_TYPE_ITEM,
 					  integrity_item,
 					  "packet integrity integrity_item not supported");
+	if (!spec)
+		return rte_flow_error_set(error, ENOTSUP,
+					  RTE_FLOW_ERROR_TYPE_ITEM,
+					  integrity_item,
+					  "no spec for integrity item");
 	if (!mask)
 		mask = &rte_flow_item_integrity_mask;
 	if (!mlx5_validate_integrity_item(mask))

@@ -6703,6 +6709,11 @@ flow_dv_validate_item_integrity(struct rte_eth_dev *dev,
 					  "unsupported integrity filter");
 	tunnel_item = mlx5_flow_find_tunnel_item(rule_items);
 	if (spec->level > 1) {
+		if (item_flags & MLX5_FLOW_ITEM_INNER_INTEGRITY)
+			return rte_flow_error_set
+				(error, ENOTSUP,
+				 RTE_FLOW_ERROR_TYPE_ITEM,
+				 NULL, "multiple inner integrity items not supported");
 		if (!tunnel_item)
 			return rte_flow_error_set(error, ENOTSUP,
 						  RTE_FLOW_ERROR_TYPE_ITEM,

@@ -6711,6 +6722,11 @@ flow_dv_validate_item_integrity(struct rte_eth_dev *dev,
 		item = tunnel_item;
 		end_item = mlx5_find_end_item(tunnel_item);
 	} else {
+		if (item_flags & MLX5_FLOW_ITEM_OUTER_INTEGRITY)
+			return rte_flow_error_set
+				(error, ENOTSUP,
+				 RTE_FLOW_ERROR_TYPE_ITEM,
+				 NULL, "multiple outer integrity items not supported");
 		end_item = tunnel_item ? tunnel_item :
 			   mlx5_find_end_item(integrity_item);
 	}

@@ -6730,6 +6746,8 @@ flow_dv_validate_item_integrity(struct rte_eth_dev *dev,
 						  integrity_item,
 						  "missing L4 protocol");
 	}
+	*last_item |= spec->level > 1 ? MLX5_FLOW_ITEM_INNER_INTEGRITY :
+					MLX5_FLOW_ITEM_OUTER_INTEGRITY;
 	return 0;
 }

@@ -7152,16 +7170,13 @@ flow_dv_validate(struct rte_eth_dev *dev, const struct rte_flow_attr *attr,
 			last_item = MLX5_FLOW_LAYER_ECPRI;
 			break;
 		case RTE_FLOW_ITEM_TYPE_INTEGRITY:
-			if (item_flags & MLX5_FLOW_ITEM_INTEGRITY)
-				return rte_flow_error_set
-					(error, ENOTSUP,
-					 RTE_FLOW_ERROR_TYPE_ITEM,
-					 NULL, "multiple integrity items not supported");
 			ret = flow_dv_validate_item_integrity(dev, rule_items,
-							      items, error);
+							      items,
+							      item_flags,
+							      &last_item,
+							      error);
 			if (ret < 0)
 				return ret;
-			last_item = MLX5_FLOW_ITEM_INTEGRITY;
 			break;
 		case RTE_FLOW_ITEM_TYPE_CONNTRACK:
 			ret = flow_dv_validate_item_aso_ct(dev, items,

Signature · 1 line

2.33.1

Gregory Etelson

author

2021-10-26 09:26 UTC #1 lore raw

PATCH 2/2 net/mlx5: fix integrity flow item validation and translation

Integrity item validation and translation must verify that integrity item bits match L3 and L4 items in flow rule pattern.
For cases when integrity item was positioned before L3 header, such verification must be split into two stages.
The first stage detects integrity flow item and makes intializations for the second stage.
The second stage is activated after PMD completes processing of all flow items in rule pattern. PMD accumulates information about flow items in flow pattern. When all pattern flow items were processed, PMD can apply that data to complete integrity item validation and translation.

Fixes 79f8952783d0 ("net/mlx5: support integrity flow item")

Signed-off-by Gregory Etelson <[email protected]>

Acked-by Viacheslav Ovsiienko <[email protected]>

---
 drivers/net/mlx5/mlx5_flow.h    |   2 +
 drivers/net/mlx5/mlx5_flow_dv.c | 293 +++++++++++++-------------------
 2 files changed, 119 insertions(+), 176 deletions(-)

drivers/net/mlx5/mlx5_flow.h +2 -0

index 41e24deec5..5a07afa8df 100644
@@ -173,6 +173,8 @@ enum mlx5_feature_name {
 /* INTEGRITY item bits */
 #define MLX5_FLOW_ITEM_OUTER_INTEGRITY (UINT64_C(1) << 34)
 #define MLX5_FLOW_ITEM_INNER_INTEGRITY (UINT64_C(1) << 35)
+#define MLX5_FLOW_ITEM_INTEGRITY \
+	(MLX5_FLOW_ITEM_OUTER_INTEGRITY | MLX5_FLOW_ITEM_INNER_INTEGRITY)
 
 /* Conntrack item. */
 #define MLX5_FLOW_LAYER_ASO_CT (UINT64_C(1) << 36)

drivers/net/mlx5/mlx5_flow_dv.c +117 ~~-176~~

407 lines not on this page · raw message

Signature · 1 line

2.33.1

Raslan Darawsheh

2021-10-28 15:03 UTC #2 lore raw

In reply to Gregory Etelson

Hi,

Quoted 23 lines

-----Original Message-----
From: Gregory Etelson <[email protected]>
Sent: Tuesday, October 26, 2021 12:26 PM
To: [email protected]; Gregory Etelson <[email protected]>
Cc: Matan Azrad <[email protected]>; Raslan Darawsheh <[email protected]>; Slava Ovsiienko <[email protected]>
Subject: [PATCH 1/2] net/mlx5: fix integrity matching for inner and outer headers
MLX5 PMD can match on integrity bits for inner and outer headers in a single flow.
That means a single flow rule can reference both inner and outer integrity bits. That is implemented by adding 2 flow integrity items to a rule - one item for outer integrity bits and other for inner integrity bits.
Integrity item level parameter specifies what part is being targeted.
Current PMD treated integrity items for outer and inner headers as the same.
The patch separates PMD verifications for inner and outer integrity items.

Quoted 4 lines

Fixes 79f8952783d0 ("net/mlx5: support integrity flow item")
Signed-off-by Gregory Etelson <[email protected]>
Acked-by Viacheslav Ovsiienko <[email protected]>

Series applied to next-net-mlx,

Kindest regards,
Raslan Darawsheh