[dpdk-dev] [PATCH] doc: Malicious Driver Detection not supported by ixgbe

[dpdk-dev] [PATCH] doc: Malicious Driver Detection not supported by ixgbe

[Wenzhuo Lu]

Signed-off-by: Wenzhuo Lu <wenzhuo.lu@intel.com>
---
 doc/guides/nics/ixgbe.rst              | 21 +++++++++++++++++++++
 doc/guides/rel_notes/release_16_04.rst | 24 ++++++++++++++++++++++++
 2 files changed, 45 insertions(+)

diff --git a/doc/guides/nics/ixgbe.rst b/doc/guides/nics/ixgbe.rst
index 8cae299..aac5586 100644
--- a/doc/guides/nics/ixgbe.rst
+++ b/doc/guides/nics/ixgbe.rst
@@ -147,6 +147,27 @@ The following MACROs are used for these three features:
 
 *   ETH_TXQ_FLAGS_NOXSUMTCP
 
+Malicious Driver Detection not Supported by ixgbe
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+On Intel x550 series NICs, HW supports a feature called MDD (Malcicious
+Driver Detection).
+MDD is used to check the behavior of the VF driver. It means when transmitting
+packets, the VF must use the advanced context descriptor and set it correctly.
+And VF must set the CC (Check Context) bit either.
+DPDK PF doesn't support MDD. We may hit problem in this scenario kernel PF +
+DPDK VF. If user enables MDD in kernel PF, DPDK VF will not work. Because
+kernel PF thinks the VF is malicious. But actually it's not. The only reason
+is the VF doesn't act as MDD required.
+There's significant performance impact to support MDD. DPDK should check if
+the advanced context descriptor should be set and set it. And DPDK has to ask
+the info about the header length from the upper layer, because parsing the
+packet itself is not acceptale. So, it's too expensive to support MDD.
+When using kernel PF + DPDK VF on x550, please make sure using the kernel
+driver that disables MDD or can disable MDD. (Some kernel driver can use
+this CLI 'insmod ixgbe.ko MDD=0,0' to disable MDD. Some kernel driver disable
+it by default.)
+
 
 Sample Application Notes
 ~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/doc/guides/rel_notes/release_16_04.rst b/doc/guides/rel_notes/release_16_04.rst
index 5786f74..df81c54 100644
--- a/doc/guides/rel_notes/release_16_04.rst
+++ b/doc/guides/rel_notes/release_16_04.rst
@@ -90,6 +90,30 @@ This section should contain new known issues in this release. Sample format:
   tense. Add information on any known workarounds.
 
 
+Restriction
+-----------
+
+* **Malicious Driver Detection is not supported by ixgbe**
+
+  On Intel x550 series NICs, HW supports a feature called MDD (Malcicious
+  Driver Detection).
+  MDD is used to check the behavior of the VF driver. It means when transmitting
+  packets, the VF must use the advanced context descriptor and set it correctly.
+  And VF must set the CC (Check Context) bit either.
+  DPDK PF doesn't support MDD. We may hit problem in this scenario kernel PF +
+  DPDK VF. If user enables MDD in kernel PF, DPDK VF will not work. Because
+  kernel PF thinks the VF is malicious. But actually it's not. The only reason
+  is the VF doesn't act as MDD required.
+  There's significant performance impact to support MDD. DPDK should check if
+  the advanced context descriptor should be set and set it. And DPDK has to ask
+  the info about the header length from the upper layer, because parsing the
+  packet itself is not acceptale. So, it's too expensive to support MDD.
+  When using kernel PF + DPDK VF on x550, please make sure using the kernel
+  driver that disables MDD or can disable MDD. (Some kernel driver can use
+  this CLI 'insmod ixgbe.ko MDD=0,0' to disable MDD. Some kernel driver disable
+  it by default.)
+
+
 API Changes
 -----------
 
-- 
1.9.3

Re: [dpdk-dev] [PATCH] doc: Malicious Driver Detection not supported by ixgbe

[Stephen Hemminger]

On Wed, 24 Feb 2016 13:33:04 +0800
Wenzhuo Lu <wenzhuo.lu@intel.com> wrote:

> +  On Intel x550 series NICs, HW supports a feature called MDD (Malcicious
> +  Driver Detection).
> +  MDD is used to check the behavior of the VF driver. It means when transmitting
> +  packets, the VF must use the advanced context descriptor and set it correctly.
> +  And VF must set the CC (Check Context) bit either.

This is hard sentence to read, why not reword as:

The Intel x550 series NIC's support1 a feature called MDD (Malcicious
Driver Detection) which checks the behavior of the VF driver.
If this feature is enabled, the VF must use the advanced context descriptor
correctly and set the CC (Check Context) bit.


> +  DPDK PF doesn't support MDD. We may hit problem in this scenario kernel PF +
> +  DPDK VF. If user enables MDD in kernel PF, DPDK VF will not work. Because
> +  kernel PF thinks the VF is malicious. But actually it's not. The only reason
> +  is the VF doesn't act as MDD required.
> +  There's significant performance impact to support MDD. DPDK should check if
> +  the advanced context descriptor should be set and set it. And DPDK has to ask
> +  the info about the header length from the upper layer, because parsing the
> +  packet itself is not acceptale. So, it's too expensive to support MDD.
> +  When using kernel PF + DPDK VF on x550, please make sure using the kernel
> +  driver that disables MDD or can disable MDD. (Some kernel driver can use
> +  this CLI 'insmod ixgbe.ko MDD=0,0' to disable MDD. Some kernel driver disable
> +  it by default.)
> +

Re: [dpdk-dev] [PATCH] doc: Malicious Driver Detection not supported by ixgbe

[Lu, Wenzhuo]

Hi Stephen,


> -----Original Message-----
> From: Stephen Hemminger [mailto:stephen@networkplumber.org]
> Sent: Thursday, February 25, 2016 1:04 AM
> To: Lu, Wenzhuo
> Cc: dev@dpdk.org
> Subject: Re: [dpdk-dev] [PATCH] doc: Malicious Driver Detection not supported
> by ixgbe
> 
> On Wed, 24 Feb 2016 13:33:04 +0800
> Wenzhuo Lu <wenzhuo.lu@intel.com> wrote:
> 
> > +  On Intel x550 series NICs, HW supports a feature called MDD
> > + (Malcicious  Driver Detection).
> > +  MDD is used to check the behavior of the VF driver. It means when
> > + transmitting  packets, the VF must use the advanced context descriptor and
> set it correctly.
> > +  And VF must set the CC (Check Context) bit either.
> 
> This is hard sentence to read, why not reword as:
> 
> The Intel x550 series NIC's support1 a feature called MDD (Malcicious Driver
> Detection) which checks the behavior of the VF driver.
> If this feature is enabled, the VF must use the advanced context descriptor
> correctly and set the CC (Check Context) bit.
Thanks for the suggestion. I'll try to make it better :)

> 
> 
> > +  DPDK PF doesn't support MDD. We may hit problem in this scenario
> > + kernel PF +  DPDK VF. If user enables MDD in kernel PF, DPDK VF will
> > + not work. Because  kernel PF thinks the VF is malicious. But
> > + actually it's not. The only reason  is the VF doesn't act as MDD required.
> > +  There's significant performance impact to support MDD. DPDK should
> > + check if  the advanced context descriptor should be set and set it.
> > + And DPDK has to ask  the info about the header length from the upper
> > + layer, because parsing the  packet itself is not acceptale. So, it's too
> expensive to support MDD.
> > +  When using kernel PF + DPDK VF on x550, please make sure using the
> > + kernel  driver that disables MDD or can disable MDD. (Some kernel
> > + driver can use  this CLI 'insmod ixgbe.ko MDD=0,0' to disable MDD.
> > + Some kernel driver disable  it by default.)
> > +

[dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not supported by ixgbe

[Wenzhuo Lu]

Announce that Malicious Driver Detection is not supported.

V2:
 *Rework the words.

Signed-off-by: Wenzhuo Lu <wenzhuo.lu@intel.com>
---
 doc/guides/nics/ixgbe.rst              | 20 ++++++++++++++++++++
 doc/guides/rel_notes/release_16_04.rst | 23 +++++++++++++++++++++++
 2 files changed, 43 insertions(+)

diff --git a/doc/guides/nics/ixgbe.rst b/doc/guides/nics/ixgbe.rst
index 8cae299..7218cdd 100644
--- a/doc/guides/nics/ixgbe.rst
+++ b/doc/guides/nics/ixgbe.rst
@@ -147,6 +147,26 @@ The following MACROs are used for these three features:
 
 *   ETH_TXQ_FLAGS_NOXSUMTCP
 
+Malicious Driver Detection not Supported by ixgbe
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The Intel x550 series NICs support a feature called MDD (Malcicious
+Driver Detection) which checks the behavior of the VF driver.
+If this feature is enabled, the VF must use the advanced context descriptor
+correctly and set the CC (Check Context) bit.
+DPDK PF doesn't support MDD, but kernel PF does. We may hit problem in this
+scenario kernel PF + DPDK VF. If user enables MDD in kernel PF, DPDK VF will
+not work. Because kernel PF thinks the VF is malicious. But actually it's not.
+The only reason is the VF doesn't act as MDD required.
+There's significant performance impact to support MDD. DPDK should check if
+the advanced context descriptor should be set and set it. And DPDK has to ask
+the info about the header length from the upper layer, because parsing the
+packet itself is not acceptale. So, it's too expensive to support MDD.
+When using kernel PF + DPDK VF on x550, please make sure using the kernel
+driver that disables MDD or can disable MDD. (Some kernel driver can use
+this CLI 'insmod ixgbe.ko MDD=0,0' to disable MDD. Some kernel driver disables
+it by default.)
+
 
 Sample Application Notes
 ~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/doc/guides/rel_notes/release_16_04.rst b/doc/guides/rel_notes/release_16_04.rst
index 5786f74..0647896 100644
--- a/doc/guides/rel_notes/release_16_04.rst
+++ b/doc/guides/rel_notes/release_16_04.rst
@@ -90,6 +90,29 @@ This section should contain new known issues in this release. Sample format:
   tense. Add information on any known workarounds.
 
 
+Restriction
+-----------
+
+* **Malicious Driver Detection is not supported by ixgbe**
+
+  The Intel x550 series NICs support a feature called MDD (Malcicious
+  Driver Detection) which checks the behavior of the VF driver.
+  If this feature is enabled, the VF must use the advanced context descriptor
+  correctly and set the CC (Check Context) bit.
+  DPDK PF doesn't support MDD, but kernel PF does. We may hit problem in this
+  scenario kernel PF + DPDK VF. If user enables MDD in kernel PF, DPDK VF will
+  not work. Because kernel PF thinks the VF is malicious. But actually it's not.
+  The only reason is the VF doesn't act as MDD required.
+  There's significant performance impact to support MDD. DPDK should check if
+  the advanced context descriptor should be set and set it. And DPDK has to ask
+  the info about the header length from the upper layer, because parsing the
+  packet itself is not acceptale. So, it's too expensive to support MDD.
+  When using kernel PF + DPDK VF on x550, please make sure using the kernel
+  driver that disables MDD or can disable MDD. (Some kernel driver can use
+  this CLI 'insmod ixgbe.ko MDD=0,0' to disable MDD. Some kernel driver disables
+  it by default.)
+
+
 API Changes
 -----------
 
-- 
1.9.3

Re: [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not supported by ixgbe

[Bruce Richardson]

On Fri, Feb 26, 2016 at 12:48:37PM +0800, Wenzhuo Lu wrote:
> Announce that Malicious Driver Detection is not supported.
> 
> V2:
>  *Rework the words.
> 
> Signed-off-by: Wenzhuo Lu <wenzhuo.lu@intel.com>

Hi Wenzhuo,

just for future reference, please put the V2,v3 etc. updates below the cut line
"---" so that they can be auto-stripped when applying the patch.

/Bruce

> ---
>  doc/guides/nics/ixgbe.rst              | 20 ++++++++++++++++++++
>  doc/guides/rel_notes/release_16_04.rst | 23 +++++++++++++++++++++++
>  2 files changed, 43 insertions(+)
> 
<snip>

Re: [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not supported by ixgbe

[Lu, Wenzhuo]

Hi Bruce,

> -----Original Message-----
> From: Richardson, Bruce
> Sent: Friday, February 26, 2016 10:41 PM
> To: Lu, Wenzhuo
> Cc: dev@dpdk.org
> Subject: Re: [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not
> supported by ixgbe
> 
> On Fri, Feb 26, 2016 at 12:48:37PM +0800, Wenzhuo Lu wrote:
> > Announce that Malicious Driver Detection is not supported.
> >
> > V2:
> >  *Rework the words.
> >
> > Signed-off-by: Wenzhuo Lu <wenzhuo.lu@intel.com>
> 
> Hi Wenzhuo,
> 
> just for future reference, please put the V2,v3 etc. updates below the cut line "--
> -" so that they can be auto-stripped when applying the patch.
> 
> /Bruce
Got it. Thanks for the reminder :)

> 
> > ---
> >  doc/guides/nics/ixgbe.rst              | 20 ++++++++++++++++++++
> >  doc/guides/rel_notes/release_16_04.rst | 23 +++++++++++++++++++++++
> >  2 files changed, 43 insertions(+)
> >
> <snip>

Re: [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not supported by ixgbe

[Thomas Monjalon]

2016-02-26 12:48, Wenzhuo Lu:
> --- a/doc/guides/nics/ixgbe.rst
> +++ b/doc/guides/nics/ixgbe.rst
> @@ -147,6 +147,26 @@ The following MACROs are used for these three features:
>  
>  *   ETH_TXQ_FLAGS_NOXSUMTCP
>  
> +Malicious Driver Detection not Supported by ixgbe
> +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Why is it in the vector PMD section?

> +
> +The Intel x550 series NICs support a feature called MDD (Malcicious
> +Driver Detection) which checks the behavior of the VF driver.
> +If this feature is enabled, the VF must use the advanced context descriptor
> +correctly and set the CC (Check Context) bit.
> +DPDK PF doesn't support MDD, but kernel PF does. We may hit problem in this
> +scenario kernel PF + DPDK VF. If user enables MDD in kernel PF, DPDK VF will
> +not work. Because kernel PF thinks the VF is malicious. But actually it's not.
> +The only reason is the VF doesn't act as MDD required.
> +There's significant performance impact to support MDD. DPDK should check if
> +the advanced context descriptor should be set and set it. And DPDK has to ask
> +the info about the header length from the upper layer, because parsing the
> +packet itself is not acceptale. So, it's too expensive to support MDD.
> +When using kernel PF + DPDK VF on x550, please make sure using the kernel
> +driver that disables MDD or can disable MDD. (Some kernel driver can use
> +this CLI 'insmod ixgbe.ko MDD=0,0' to disable MDD. Some kernel driver disables
> +it by default.)
> +
>  
>  Sample Application Notes
>  ~~~~~~~~~~~~~~~~~~~~~~~~
> diff --git a/doc/guides/rel_notes/release_16_04.rst b/doc/guides/rel_notes/release_16_04.rst
> index 5786f74..0647896 100644
> --- a/doc/guides/rel_notes/release_16_04.rst
> +++ b/doc/guides/rel_notes/release_16_04.rst
> @@ -90,6 +90,29 @@ This section should contain new known issues in this release. Sample format:
>    tense. Add information on any known workarounds.
>  
>  
> +Restriction
> +-----------
> +
> +* **Malicious Driver Detection is not supported by ixgbe**
> +
> +  The Intel x550 series NICs support a feature called MDD (Malcicious
> +  Driver Detection) which checks the behavior of the VF driver.
> +  If this feature is enabled, the VF must use the advanced context descriptor
> +  correctly and set the CC (Check Context) bit.
> +  DPDK PF doesn't support MDD, but kernel PF does. We may hit problem in this
> +  scenario kernel PF + DPDK VF. If user enables MDD in kernel PF, DPDK VF will
> +  not work. Because kernel PF thinks the VF is malicious. But actually it's not.
> +  The only reason is the VF doesn't act as MDD required.
> +  There's significant performance impact to support MDD. DPDK should check if
> +  the advanced context descriptor should be set and set it. And DPDK has to ask
> +  the info about the header length from the upper layer, because parsing the
> +  packet itself is not acceptale. So, it's too expensive to support MDD.
> +  When using kernel PF + DPDK VF on x550, please make sure using the kernel
> +  driver that disables MDD or can disable MDD. (Some kernel driver can use
> +  this CLI 'insmod ixgbe.ko MDD=0,0' to disable MDD. Some kernel driver disables
> +  it by default.)

Why repeating the whole explanation in the release notes?
I think the ixgbe doc is enough to say that a kernel option is required.

Re: [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not supported by ixgbe

[Lu, Wenzhuo]

Hi Thomas,

> >  *   ETH_TXQ_FLAGS_NOXSUMTCP
> >
> > +Malicious Driver Detection not Supported by ixgbe
> > +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
> Why is it in the vector PMD section?
Sorry, I put it in the wrong place. Seems a whole new section is needed.

> 
> > + Some kernel driver disables  it by default.)
> 
> Why repeating the whole explanation in the release notes?
> I think the ixgbe doc is enough to say that a kernel option is required.
OK, I'll remove this one :)

[dpdk-dev] [PATCH v3] doc: Malicious Driver Detection not supported by ixgbe

[Wenzhuo Lu]

Announce that Malicious Driver Detection is not supported.

v2:
- Rework the words.

v3:
- Remove the duplicate info in the release note.
- Create a new section for this description.

Signed-off-by: Wenzhuo Lu <wenzhuo.lu@intel.com>
Acked-by: Shaopeng He <shaopeng.he <at> intel.com>
---
 doc/guides/nics/ixgbe.rst | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/doc/guides/nics/ixgbe.rst b/doc/guides/nics/ixgbe.rst
index 8cae299..0ee4ebc 100644
--- a/doc/guides/nics/ixgbe.rst
+++ b/doc/guides/nics/ixgbe.rst
@@ -178,3 +178,24 @@ load_balancer
 
 As in the case of l3fwd, set configure port_conf.rxmode.hw_ip_checksum=0 to enable vPMD.
 In addition, for improved performance, use -bsz "(32,32),(64,64),(32,32)" in load_balancer to avoid using the default burst size of 144.
+
+
+Malicious Driver Detection not Supported
+----------------------------------------
+
+The Intel x550 series NICs support a feature called MDD (Malcicious
+Driver Detection) which checks the behavior of the VF driver.
+If this feature is enabled, the VF must use the advanced context descriptor
+correctly and set the CC (Check Context) bit.
+DPDK PF doesn't support MDD, but kernel PF does. We may hit problem in this
+scenario kernel PF + DPDK VF. If user enables MDD in kernel PF, DPDK VF will
+not work. Because kernel PF thinks the VF is malicious. But actually it's not.
+The only reason is the VF doesn't act as MDD required.
+There's significant performance impact to support MDD. DPDK should check if
+the advanced context descriptor should be set and set it. And DPDK has to ask
+the info about the header length from the upper layer, because parsing the
+packet itself is not acceptale. So, it's too expensive to support MDD.
+When using kernel PF + DPDK VF on x550, please make sure using the kernel
+driver that disables MDD or can disable MDD. (Some kernel driver can use
+this CLI 'insmod ixgbe.ko MDD=0,0' to disable MDD. Some kernel driver disables
+it by default.)
-- 
1.9.3

Re: [dpdk-dev] [PATCH v3] doc: Malicious Driver Detection not supported by ixgbe

[Thomas Monjalon]

2016-03-07 13:28, Wenzhuo Lu:
> Announce that Malicious Driver Detection is not supported.
> 
> v2:
> - Rework the words.
> 
> v3:
> - Remove the duplicate info in the release note.
> - Create a new section for this description.
> 
> Signed-off-by: Wenzhuo Lu <wenzhuo.lu@intel.com>
> Acked-by: Shaopeng He <shaopeng.he <at> intel.com>

Applied, thanks

Re: [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not supported by ixgbe

[He, Shaopeng]

Hi,

> -----Original Message-----
> From: dev [mailto:dev-bounces@dpdk.org] On Behalf Of Wenzhuo Lu
> Sent: Friday, February 26, 2016 12:49 PM
> To: dev@dpdk.org
> Subject: [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not supported by ixgbe
> 
> Announce that Malicious Driver Detection is not supported.
> 
> V2:
>  *Rework the words.
> 
> Signed-off-by: Wenzhuo Lu <wenzhuo.lu@intel.com>
Acked-by: Shaopeng He <shaopeng.he@intel.com>