DPDK patches and discussions
 help / color / mirror / Atom feed
* [dpdk-dev] [PATCH] doc: Malicious Driver Detection not supported by ixgbe
@ 2016-02-24  5:33 Wenzhuo Lu
  2016-02-24 17:04 ` Stephen Hemminger
                   ` (2 more replies)
  0 siblings, 3 replies; 10+ messages in thread
From: Wenzhuo Lu @ 2016-02-24  5:33 UTC (permalink / raw)
  To: dev

Signed-off-by: Wenzhuo Lu <wenzhuo.lu@intel.com>
---
 doc/guides/nics/ixgbe.rst              | 21 +++++++++++++++++++++
 doc/guides/rel_notes/release_16_04.rst | 24 ++++++++++++++++++++++++
 2 files changed, 45 insertions(+)

diff --git a/doc/guides/nics/ixgbe.rst b/doc/guides/nics/ixgbe.rst
index 8cae299..aac5586 100644
--- a/doc/guides/nics/ixgbe.rst
+++ b/doc/guides/nics/ixgbe.rst
@@ -147,6 +147,27 @@ The following MACROs are used for these three features:
 
 *   ETH_TXQ_FLAGS_NOXSUMTCP
 
+Malicious Driver Detection not Supported by ixgbe
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+On Intel x550 series NICs, HW supports a feature called MDD (Malcicious
+Driver Detection).
+MDD is used to check the behavior of the VF driver. It means when transmitting
+packets, the VF must use the advanced context descriptor and set it correctly.
+And VF must set the CC (Check Context) bit either.
+DPDK PF doesn't support MDD. We may hit problem in this scenario kernel PF +
+DPDK VF. If user enables MDD in kernel PF, DPDK VF will not work. Because
+kernel PF thinks the VF is malicious. But actually it's not. The only reason
+is the VF doesn't act as MDD required.
+There's significant performance impact to support MDD. DPDK should check if
+the advanced context descriptor should be set and set it. And DPDK has to ask
+the info about the header length from the upper layer, because parsing the
+packet itself is not acceptale. So, it's too expensive to support MDD.
+When using kernel PF + DPDK VF on x550, please make sure using the kernel
+driver that disables MDD or can disable MDD. (Some kernel driver can use
+this CLI 'insmod ixgbe.ko MDD=0,0' to disable MDD. Some kernel driver disable
+it by default.)
+
 
 Sample Application Notes
 ~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/doc/guides/rel_notes/release_16_04.rst b/doc/guides/rel_notes/release_16_04.rst
index 5786f74..df81c54 100644
--- a/doc/guides/rel_notes/release_16_04.rst
+++ b/doc/guides/rel_notes/release_16_04.rst
@@ -90,6 +90,30 @@ This section should contain new known issues in this release. Sample format:
   tense. Add information on any known workarounds.
 
 
+Restriction
+-----------
+
+* **Malicious Driver Detection is not supported by ixgbe**
+
+  On Intel x550 series NICs, HW supports a feature called MDD (Malcicious
+  Driver Detection).
+  MDD is used to check the behavior of the VF driver. It means when transmitting
+  packets, the VF must use the advanced context descriptor and set it correctly.
+  And VF must set the CC (Check Context) bit either.
+  DPDK PF doesn't support MDD. We may hit problem in this scenario kernel PF +
+  DPDK VF. If user enables MDD in kernel PF, DPDK VF will not work. Because
+  kernel PF thinks the VF is malicious. But actually it's not. The only reason
+  is the VF doesn't act as MDD required.
+  There's significant performance impact to support MDD. DPDK should check if
+  the advanced context descriptor should be set and set it. And DPDK has to ask
+  the info about the header length from the upper layer, because parsing the
+  packet itself is not acceptale. So, it's too expensive to support MDD.
+  When using kernel PF + DPDK VF on x550, please make sure using the kernel
+  driver that disables MDD or can disable MDD. (Some kernel driver can use
+  this CLI 'insmod ixgbe.ko MDD=0,0' to disable MDD. Some kernel driver disable
+  it by default.)
+
+
 API Changes
 -----------
 
-- 
1.9.3

^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2016-03-07 20:59 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-02-24  5:33 [dpdk-dev] [PATCH] doc: Malicious Driver Detection not supported by ixgbe Wenzhuo Lu
2016-02-24 17:04 ` Stephen Hemminger
2016-02-25  1:13   ` Lu, Wenzhuo
2016-02-26  4:48 ` [dpdk-dev] [PATCH v2] " Wenzhuo Lu
2016-02-26 14:41   ` Bruce Richardson
2016-02-29  1:38     ` Lu, Wenzhuo
2016-03-06 22:24   ` Thomas Monjalon
2016-03-07  0:45     ` Lu, Wenzhuo
2016-03-07  5:28 ` [dpdk-dev] [PATCH v3] " Wenzhuo Lu
2016-03-07 20:57   ` Thomas Monjalon

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).