[PATCH v1 1/2] net/mlx5: disallow duplicated tag index in pattern template

[PATCH v1 1/2] net/mlx5: disallow duplicated tag index in pattern template

[Rongwei Liu]

Duplicated tag index in pattern template will most likely cause
matching failures such as "template tag index is 0 data mask 0xff /
tag index is 0 data mask 0xffff / end"

If the upper layer application needs to match the same tag twice
with different masks, it should be consolidated into one rte_item
with the desired mask.

"template tag index is 0 data mask 0xff / tag index is 0 data mask
0xff00 / end" should be present as "template tag index is 0 data mask
0xffff / end"

Cc: stable@dpdk.org
Signed-off-by: Rongwei Liu <rongweil@nvidia.com>
Acked-by: Viacheslav Ovsiienko <viacheslavo@nvidia.com>
---
 drivers/net/mlx5/mlx5_flow_hw.c | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_flow_hw.c b/drivers/net/mlx5/mlx5_flow_hw.c
index 7e0ee8d883..78011584eb 100644
--- a/drivers/net/mlx5/mlx5_flow_hw.c
+++ b/drivers/net/mlx5/mlx5_flow_hw.c
@@ -4831,8 +4831,9 @@ flow_hw_pattern_validate(struct rte_eth_dev *dev,
 			 struct rte_flow_error *error)
 {
 	struct mlx5_priv *priv = dev->data->dev_private;
-	int i;
+	int i, tag_idx;
 	bool items_end = false;
+	uint32_t tag_bitmap = 0;
 
 	if (!attr->ingress && !attr->egress && !attr->transfer)
 		return rte_flow_error_set(error, EINVAL, RTE_FLOW_ERROR_TYPE_ATTR, NULL,
@@ -4874,16 +4875,26 @@ flow_hw_pattern_validate(struct rte_eth_dev *dev,
 		switch (type) {
 		case RTE_FLOW_ITEM_TYPE_TAG:
 		{
-			int reg;
 			const struct rte_flow_item_tag *tag =
 				(const struct rte_flow_item_tag *)items[i].spec;
 
-			reg = flow_hw_get_reg_id(RTE_FLOW_ITEM_TYPE_TAG, tag->index);
-			if (reg == REG_NON)
+			if (tag == NULL)
+				return rte_flow_error_set(error, EINVAL,
+							  RTE_FLOW_ERROR_TYPE_UNSPECIFIED,
+							  NULL,
+							  "Tag spec is NULL");
+			tag_idx = flow_hw_get_reg_id(RTE_FLOW_ITEM_TYPE_TAG, tag->index);
+			if (tag_idx == REG_NON)
 				return rte_flow_error_set(error, EINVAL,
 							  RTE_FLOW_ERROR_TYPE_UNSPECIFIED,
 							  NULL,
 							  "Unsupported tag index");
+			if (tag_bitmap & (1 << tag_idx))
+				return rte_flow_error_set(error, EINVAL,
+							  RTE_FLOW_ERROR_TYPE_ITEM,
+							  NULL,
+							  "Duplicated tag index");
+			tag_bitmap |= 1 << tag_idx;
 			break;
 		}
 		case MLX5_RTE_FLOW_ITEM_TYPE_TAG:
@@ -4897,6 +4908,12 @@ flow_hw_pattern_validate(struct rte_eth_dev *dev,
 							  RTE_FLOW_ERROR_TYPE_UNSPECIFIED,
 							  NULL,
 							  "Unsupported internal tag index");
+			if (tag_bitmap & (1 << tag->index))
+				return rte_flow_error_set(error, EINVAL,
+							  RTE_FLOW_ERROR_TYPE_ITEM,
+							  NULL,
+							  "Duplicated tag index");
+			tag_bitmap |= 1 << tag->index;
 			break;
 		}
 		case RTE_FLOW_ITEM_TYPE_REPRESENTED_PORT:
-- 
2.27.0

[PATCH v1 2/2] net/mlx5: fix sws duplicated tag index matching

[Rongwei Liu]

Duplicated matching tag index is not allowed in sws
because they are using the same matching field in the
underlayer layout.
For example: "tag index is 0 data spec 0x12 mask 0xff /
tag index is 0 data spec 0x1234 mask 0xffff" is paradoxical
matching condition and "tag index is 0 data spec 0x12 mask 0xff /
tag index is 0 data spec 0x3400 mask 0xff00" should be "tag index
is 0 data spec 0x3412 mask 0xffff"

Add checking logic against it.

Fixes: e554b672aa05 ("net/mlx5: support flow tag")
Cc: viacheslavo@nvidia.com
Cc: stable@dpdk.org
Signed-off-by: Rongwei Liu <rongweil@nvidia.com>
Acked-by: Viacheslav Ovsiienko <viacheslavo@nvidia.com>
---
 drivers/net/mlx5/mlx5_flow_dv.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_flow_dv.c b/drivers/net/mlx5/mlx5_flow_dv.c
index 1abc4acad7..db2bf615db 100644
--- a/drivers/net/mlx5/mlx5_flow_dv.c
+++ b/drivers/net/mlx5/mlx5_flow_dv.c
@@ -2294,6 +2294,8 @@ flow_dv_validate_item_meta(struct rte_eth_dev *dev __rte_unused,
  *   Pointer to the rte_eth_dev structure.
  * @param[in] item
  *   Item specification.
+ * @param[in] tag_bitmap
+ *   Tag index bitmap.
  * @param[in] attr
  *   Attributes of flow that includes this item.
  * @param[out] error
@@ -2305,6 +2307,7 @@ flow_dv_validate_item_meta(struct rte_eth_dev *dev __rte_unused,
 static int
 flow_dv_validate_item_tag(struct rte_eth_dev *dev,
 			  const struct rte_flow_item *item,
+			  uint32_t *tag_bitmap,
 			  const struct rte_flow_attr *attr __rte_unused,
 			  struct rte_flow_error *error)
 {
@@ -2348,6 +2351,12 @@ flow_dv_validate_item_tag(struct rte_eth_dev *dev,
 	if (ret < 0)
 		return ret;
 	MLX5_ASSERT(ret != REG_NON);
+	if (*tag_bitmap & (1 << ret))
+		return rte_flow_error_set(error, EINVAL,
+					  RTE_FLOW_ERROR_TYPE_ITEM_SPEC,
+					  item->spec,
+					  "Duplicated tag index");
+	*tag_bitmap |= 1 << ret;
 	return 0;
 }
 
@@ -7290,9 +7299,10 @@ flow_dv_validate(struct rte_eth_dev *dev, const struct rte_flow_attr *attr,
 	bool def_policy = false;
 	bool shared_count = false;
 	uint16_t udp_dport = 0;
-	uint32_t tag_id = 0;
+	uint32_t tag_id = 0, tag_bitmap = 0;
 	const struct rte_flow_action_age *non_shared_age = NULL;
 	const struct rte_flow_action_count *count = NULL;
+	const struct mlx5_rte_flow_item_tag *mlx5_tag;
 	struct mlx5_priv *act_priv = NULL;
 	int aso_after_sample = 0;
 
@@ -7621,7 +7631,7 @@ flow_dv_validate(struct rte_eth_dev *dev, const struct rte_flow_attr *attr,
 			last_item = MLX5_FLOW_LAYER_ICMP6;
 			break;
 		case RTE_FLOW_ITEM_TYPE_TAG:
-			ret = flow_dv_validate_item_tag(dev, items,
+			ret = flow_dv_validate_item_tag(dev, items, &tag_bitmap,
 							attr, error);
 			if (ret < 0)
 				return ret;
@@ -7631,6 +7641,13 @@ flow_dv_validate(struct rte_eth_dev *dev, const struct rte_flow_attr *attr,
 			last_item = MLX5_FLOW_ITEM_SQ;
 			break;
 		case MLX5_RTE_FLOW_ITEM_TYPE_TAG:
+			mlx5_tag = (const struct mlx5_rte_flow_item_tag *)items->spec;
+			if (tag_bitmap & (1 << mlx5_tag->id))
+				return rte_flow_error_set(error, EINVAL,
+							  RTE_FLOW_ERROR_TYPE_ITEM_SPEC,
+							  items->spec,
+							  "Duplicated tag index");
+			tag_bitmap |= 1 << mlx5_tag->id;
 			break;
 		case RTE_FLOW_ITEM_TYPE_GTP:
 			ret = flow_dv_validate_item_gtp(dev, items, item_flags,
-- 
2.27.0

RE: [PATCH v1 1/2] net/mlx5: disallow duplicated tag index in pattern template

[Ori Kam]

Hi Rongwei,

> -----Original Message-----
> From: Rongwei Liu <rongweil@nvidia.com>
> Sent: Tuesday, May 16, 2023 8:43 AM
> 
> Duplicated tag index in pattern template will most likely cause
> matching failures such as "template tag index is 0 data mask 0xff /
> tag index is 0 data mask 0xffff / end"
> 
> If the upper layer application needs to match the same tag twice
> with different masks, it should be consolidated into one rte_item
> with the desired mask.
> 
> "template tag index is 0 data mask 0xff / tag index is 0 data mask
> 0xff00 / end" should be present as "template tag index is 0 data mask
> 0xffff / end"
> 
> Cc: stable@dpdk.org
> Signed-off-by: Rongwei Liu <rongweil@nvidia.com>
> Acked-by: Viacheslav Ovsiienko <viacheslavo@nvidia.com>
> ---

Acked-by: Ori Kam <orika@nvidia.com>