Re: [dpdk-dev] [PATCH] net/mlx5: fix the matching for ICMP fragments

[Raslan Darawsheh <rasland@mellanox.com>]

Hi,

> -----Original Message-----
> From: Bing Zhao <bingz@mellanox.com>
> Sent: Monday, February 17, 2020 4:11 PM
> To: Ori Kam <orika@mellanox.com>; Slava Ovsiienko
> <viacheslavo@mellanox.com>
> Cc: Raslan Darawsheh <rasland@mellanox.com>; Matan Azrad
> <matan@mellanox.com>; dev@dpdk.org; Jack Min
> <jackmin@mellanox.com>; stable@dpdk.org
> Subject: [PATCH] net/mlx5: fix the matching for ICMP fragments
> 
> The hardware can recognize and mark the layer 4 protocol type for TCP,
> UDP and IPSec non-fragmented packets. For all the fragmented packets,
> L4 type will be considered as None. This can be used when creating a
> flow with L4 matching, then hops number will be reduced and a better
> performance could be gained.
> 
> But for ICMP packets, it cannot be recognized correctly because it is
> not a L4 protocol in the stack, even if the packet format is similar.
> 
> All the fragmented and non-fragmented ICMP will have the None L4 type.
> Fragmented packets with incomplete headers could not hit the flow,
> even for the first fragment. Because then it will make it complex to
> defragment for both HW and SW. For other types, the implicit rules
> could be used directly and all the fragments will miss the flow.
> 
> For ICMP packets, this should be done explicitly because all packets
> have None type. The first fragment will still hit the flow if there is
> no explicit rule.
> 
> All ICMP fragments will still hit the rules like ETH, ETH + IP, and
> ETH + IP + "ICMP protocol" only since they are wildcard rules, and
> there is no next layer protocol specified field in such rules.
> 
> Fixes: d53aa89aea91 ("net/mlx5: support matching on ICMP/ICMP6")
> Cc: jackmin@mellanox.com
> Cc: stable@dpdk.org
> 
> Signed-off-by: Bing Zhao <bingz@mellanox.com>
> ---
>  drivers/net/mlx5/mlx5_flow_dv.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/drivers/net/mlx5/mlx5_flow_dv.c
> b/drivers/net/mlx5/mlx5_flow_dv.c
> index a9bb0b4..0e31c69 100644
> --- a/drivers/net/mlx5/mlx5_flow_dv.c
> +++ b/drivers/net/mlx5/mlx5_flow_dv.c
> @@ -6403,6 +6403,12 @@ struct field_modify_info modify_tcp[] = {
>  		return;
>  	if (!icmp6_m)
>  		icmp6_m = &rte_flow_item_icmp6_mask;
> +	/*
> +	 * Force flow only to match the non-fragmented IPv6 ICMPv6
> packets.
> +	 * If only the protocol is specified, no need to match the frag.
> +	 */
> +	MLX5_SET(fte_match_set_lyr_2_4, headers_m, frag, 1);
> +	MLX5_SET(fte_match_set_lyr_2_4, headers_v, frag, 0);
>  	MLX5_SET(fte_match_set_misc3, misc3_m, icmpv6_type, icmp6_m-
> >type);
>  	MLX5_SET(fte_match_set_misc3, misc3_v, icmpv6_type,
>  		 icmp6_v->type & icmp6_m->type);
> @@ -6450,6 +6456,12 @@ struct field_modify_info modify_tcp[] = {
>  		return;
>  	if (!icmp_m)
>  		icmp_m = &rte_flow_item_icmp_mask;
> +	/*
> +	 * Force flow only to match the non-fragmented IPv4 ICMP packets.
> +	 * If only the protocol is specified, no need to match the frag.
> +	 */
> +	MLX5_SET(fte_match_set_lyr_2_4, headers_m, frag, 1);
> +	MLX5_SET(fte_match_set_lyr_2_4, headers_v, frag, 0);
>  	MLX5_SET(fte_match_set_misc3, misc3_m, icmp_type,
>  		 icmp_m->hdr.icmp_type);
>  	MLX5_SET(fte_match_set_misc3, misc3_v, icmp_type,
> --
> 1.8.3.1

Patch applied to next-net-mlx,

Kindest regards,
Raslan Darawsheh