* Re: [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not supported by ixgbe
@ 2016-03-02 6:06 He, Shaopeng
0 siblings, 0 replies; 6+ messages in thread
From: He, Shaopeng @ 2016-03-02 6:06 UTC (permalink / raw)
To: Lu, Wenzhuo, dev
Hi,
> -----Original Message-----
> From: dev [mailto:dev-bounces@dpdk.org] On Behalf Of Wenzhuo Lu
> Sent: Friday, February 26, 2016 12:49 PM
> To: dev@dpdk.org
> Subject: [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not supported by ixgbe
>
> Announce that Malicious Driver Detection is not supported.
>
> V2:
> *Rework the words.
>
> Signed-off-by: Wenzhuo Lu <wenzhuo.lu@intel.com>
Acked-by: Shaopeng He <shaopeng.he@intel.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not supported by ixgbe
2016-03-06 22:24 ` Thomas Monjalon
@ 2016-03-07 0:45 ` Lu, Wenzhuo
0 siblings, 0 replies; 6+ messages in thread
From: Lu, Wenzhuo @ 2016-03-07 0:45 UTC (permalink / raw)
To: Thomas Monjalon; +Cc: dev
Hi Thomas,
> > * ETH_TXQ_FLAGS_NOXSUMTCP
> >
> > +Malicious Driver Detection not Supported by ixgbe
> > +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> Why is it in the vector PMD section?
Sorry, I put it in the wrong place. Seems a whole new section is needed.
>
> > + Some kernel driver disables it by default.)
>
> Why repeating the whole explanation in the release notes?
> I think the ixgbe doc is enough to say that a kernel option is required.
OK, I'll remove this one :)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not supported by ixgbe
2016-02-26 4:48 ` [dpdk-dev] [PATCH v2] " Wenzhuo Lu
2016-02-26 14:41 ` Bruce Richardson
@ 2016-03-06 22:24 ` Thomas Monjalon
2016-03-07 0:45 ` Lu, Wenzhuo
1 sibling, 1 reply; 6+ messages in thread
From: Thomas Monjalon @ 2016-03-06 22:24 UTC (permalink / raw)
To: Wenzhuo Lu; +Cc: dev
2016-02-26 12:48, Wenzhuo Lu:
> --- a/doc/guides/nics/ixgbe.rst
> +++ b/doc/guides/nics/ixgbe.rst
> @@ -147,6 +147,26 @@ The following MACROs are used for these three features:
>
> * ETH_TXQ_FLAGS_NOXSUMTCP
>
> +Malicious Driver Detection not Supported by ixgbe
> +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Why is it in the vector PMD section?
> +
> +The Intel x550 series NICs support a feature called MDD (Malcicious
> +Driver Detection) which checks the behavior of the VF driver.
> +If this feature is enabled, the VF must use the advanced context descriptor
> +correctly and set the CC (Check Context) bit.
> +DPDK PF doesn't support MDD, but kernel PF does. We may hit problem in this
> +scenario kernel PF + DPDK VF. If user enables MDD in kernel PF, DPDK VF will
> +not work. Because kernel PF thinks the VF is malicious. But actually it's not.
> +The only reason is the VF doesn't act as MDD required.
> +There's significant performance impact to support MDD. DPDK should check if
> +the advanced context descriptor should be set and set it. And DPDK has to ask
> +the info about the header length from the upper layer, because parsing the
> +packet itself is not acceptale. So, it's too expensive to support MDD.
> +When using kernel PF + DPDK VF on x550, please make sure using the kernel
> +driver that disables MDD or can disable MDD. (Some kernel driver can use
> +this CLI 'insmod ixgbe.ko MDD=0,0' to disable MDD. Some kernel driver disables
> +it by default.)
> +
>
> Sample Application Notes
> ~~~~~~~~~~~~~~~~~~~~~~~~
> diff --git a/doc/guides/rel_notes/release_16_04.rst b/doc/guides/rel_notes/release_16_04.rst
> index 5786f74..0647896 100644
> --- a/doc/guides/rel_notes/release_16_04.rst
> +++ b/doc/guides/rel_notes/release_16_04.rst
> @@ -90,6 +90,29 @@ This section should contain new known issues in this release. Sample format:
> tense. Add information on any known workarounds.
>
>
> +Restriction
> +-----------
> +
> +* **Malicious Driver Detection is not supported by ixgbe**
> +
> + The Intel x550 series NICs support a feature called MDD (Malcicious
> + Driver Detection) which checks the behavior of the VF driver.
> + If this feature is enabled, the VF must use the advanced context descriptor
> + correctly and set the CC (Check Context) bit.
> + DPDK PF doesn't support MDD, but kernel PF does. We may hit problem in this
> + scenario kernel PF + DPDK VF. If user enables MDD in kernel PF, DPDK VF will
> + not work. Because kernel PF thinks the VF is malicious. But actually it's not.
> + The only reason is the VF doesn't act as MDD required.
> + There's significant performance impact to support MDD. DPDK should check if
> + the advanced context descriptor should be set and set it. And DPDK has to ask
> + the info about the header length from the upper layer, because parsing the
> + packet itself is not acceptale. So, it's too expensive to support MDD.
> + When using kernel PF + DPDK VF on x550, please make sure using the kernel
> + driver that disables MDD or can disable MDD. (Some kernel driver can use
> + this CLI 'insmod ixgbe.ko MDD=0,0' to disable MDD. Some kernel driver disables
> + it by default.)
Why repeating the whole explanation in the release notes?
I think the ixgbe doc is enough to say that a kernel option is required.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not supported by ixgbe
2016-02-26 14:41 ` Bruce Richardson
@ 2016-02-29 1:38 ` Lu, Wenzhuo
0 siblings, 0 replies; 6+ messages in thread
From: Lu, Wenzhuo @ 2016-02-29 1:38 UTC (permalink / raw)
To: Richardson, Bruce; +Cc: dev
Hi Bruce,
> -----Original Message-----
> From: Richardson, Bruce
> Sent: Friday, February 26, 2016 10:41 PM
> To: Lu, Wenzhuo
> Cc: dev@dpdk.org
> Subject: Re: [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not
> supported by ixgbe
>
> On Fri, Feb 26, 2016 at 12:48:37PM +0800, Wenzhuo Lu wrote:
> > Announce that Malicious Driver Detection is not supported.
> >
> > V2:
> > *Rework the words.
> >
> > Signed-off-by: Wenzhuo Lu <wenzhuo.lu@intel.com>
>
> Hi Wenzhuo,
>
> just for future reference, please put the V2,v3 etc. updates below the cut line "--
> -" so that they can be auto-stripped when applying the patch.
>
> /Bruce
Got it. Thanks for the reminder :)
>
> > ---
> > doc/guides/nics/ixgbe.rst | 20 ++++++++++++++++++++
> > doc/guides/rel_notes/release_16_04.rst | 23 +++++++++++++++++++++++
> > 2 files changed, 43 insertions(+)
> >
> <snip>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not supported by ixgbe
2016-02-26 4:48 ` [dpdk-dev] [PATCH v2] " Wenzhuo Lu
@ 2016-02-26 14:41 ` Bruce Richardson
2016-02-29 1:38 ` Lu, Wenzhuo
2016-03-06 22:24 ` Thomas Monjalon
1 sibling, 1 reply; 6+ messages in thread
From: Bruce Richardson @ 2016-02-26 14:41 UTC (permalink / raw)
To: Wenzhuo Lu; +Cc: dev
On Fri, Feb 26, 2016 at 12:48:37PM +0800, Wenzhuo Lu wrote:
> Announce that Malicious Driver Detection is not supported.
>
> V2:
> *Rework the words.
>
> Signed-off-by: Wenzhuo Lu <wenzhuo.lu@intel.com>
Hi Wenzhuo,
just for future reference, please put the V2,v3 etc. updates below the cut line
"---" so that they can be auto-stripped when applying the patch.
/Bruce
> ---
> doc/guides/nics/ixgbe.rst | 20 ++++++++++++++++++++
> doc/guides/rel_notes/release_16_04.rst | 23 +++++++++++++++++++++++
> 2 files changed, 43 insertions(+)
>
<snip>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not supported by ixgbe
2016-02-24 5:33 [dpdk-dev] [PATCH] " Wenzhuo Lu
@ 2016-02-26 4:48 ` Wenzhuo Lu
2016-02-26 14:41 ` Bruce Richardson
2016-03-06 22:24 ` Thomas Monjalon
0 siblings, 2 replies; 6+ messages in thread
From: Wenzhuo Lu @ 2016-02-26 4:48 UTC (permalink / raw)
To: dev
Announce that Malicious Driver Detection is not supported.
V2:
*Rework the words.
Signed-off-by: Wenzhuo Lu <wenzhuo.lu@intel.com>
---
doc/guides/nics/ixgbe.rst | 20 ++++++++++++++++++++
doc/guides/rel_notes/release_16_04.rst | 23 +++++++++++++++++++++++
2 files changed, 43 insertions(+)
diff --git a/doc/guides/nics/ixgbe.rst b/doc/guides/nics/ixgbe.rst
index 8cae299..7218cdd 100644
--- a/doc/guides/nics/ixgbe.rst
+++ b/doc/guides/nics/ixgbe.rst
@@ -147,6 +147,26 @@ The following MACROs are used for these three features:
* ETH_TXQ_FLAGS_NOXSUMTCP
+Malicious Driver Detection not Supported by ixgbe
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The Intel x550 series NICs support a feature called MDD (Malcicious
+Driver Detection) which checks the behavior of the VF driver.
+If this feature is enabled, the VF must use the advanced context descriptor
+correctly and set the CC (Check Context) bit.
+DPDK PF doesn't support MDD, but kernel PF does. We may hit problem in this
+scenario kernel PF + DPDK VF. If user enables MDD in kernel PF, DPDK VF will
+not work. Because kernel PF thinks the VF is malicious. But actually it's not.
+The only reason is the VF doesn't act as MDD required.
+There's significant performance impact to support MDD. DPDK should check if
+the advanced context descriptor should be set and set it. And DPDK has to ask
+the info about the header length from the upper layer, because parsing the
+packet itself is not acceptale. So, it's too expensive to support MDD.
+When using kernel PF + DPDK VF on x550, please make sure using the kernel
+driver that disables MDD or can disable MDD. (Some kernel driver can use
+this CLI 'insmod ixgbe.ko MDD=0,0' to disable MDD. Some kernel driver disables
+it by default.)
+
Sample Application Notes
~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/doc/guides/rel_notes/release_16_04.rst b/doc/guides/rel_notes/release_16_04.rst
index 5786f74..0647896 100644
--- a/doc/guides/rel_notes/release_16_04.rst
+++ b/doc/guides/rel_notes/release_16_04.rst
@@ -90,6 +90,29 @@ This section should contain new known issues in this release. Sample format:
tense. Add information on any known workarounds.
+Restriction
+-----------
+
+* **Malicious Driver Detection is not supported by ixgbe**
+
+ The Intel x550 series NICs support a feature called MDD (Malcicious
+ Driver Detection) which checks the behavior of the VF driver.
+ If this feature is enabled, the VF must use the advanced context descriptor
+ correctly and set the CC (Check Context) bit.
+ DPDK PF doesn't support MDD, but kernel PF does. We may hit problem in this
+ scenario kernel PF + DPDK VF. If user enables MDD in kernel PF, DPDK VF will
+ not work. Because kernel PF thinks the VF is malicious. But actually it's not.
+ The only reason is the VF doesn't act as MDD required.
+ There's significant performance impact to support MDD. DPDK should check if
+ the advanced context descriptor should be set and set it. And DPDK has to ask
+ the info about the header length from the upper layer, because parsing the
+ packet itself is not acceptale. So, it's too expensive to support MDD.
+ When using kernel PF + DPDK VF on x550, please make sure using the kernel
+ driver that disables MDD or can disable MDD. (Some kernel driver can use
+ this CLI 'insmod ixgbe.ko MDD=0,0' to disable MDD. Some kernel driver disables
+ it by default.)
+
+
API Changes
-----------
--
1.9.3
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-03-07 0:45 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-03-02 6:06 [dpdk-dev] [PATCH v2] doc: Malicious Driver Detection not supported by ixgbe He, Shaopeng
-- strict thread matches above, loose matches on Subject: below --
2016-02-24 5:33 [dpdk-dev] [PATCH] " Wenzhuo Lu
2016-02-26 4:48 ` [dpdk-dev] [PATCH v2] " Wenzhuo Lu
2016-02-26 14:41 ` Bruce Richardson
2016-02-29 1:38 ` Lu, Wenzhuo
2016-03-06 22:24 ` Thomas Monjalon
2016-03-07 0:45 ` Lu, Wenzhuo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).