diff mbox series

[rdma-next] RDMA/mlx5: Fix flow counter query via DEVX

Message ID e164033f175225a5eb966f769694abdee0200fe2.1681132336.git.leon@kernel.org (mailing list archive)
State Superseded
Headers show
Series [rdma-next] RDMA/mlx5: Fix flow counter query via DEVX | expand

Checks

Context Check Description
netdev/tree_selection success Not a local patch

Commit Message

Leon Romanovsky April 10, 2023, 1:13 p.m. UTC
From: Mark Bloch <mbloch@nvidia.com>

Commit cited in "fixes" tag added bulk support for flow counters but it
didn't account that's also possible to query a counter using a non-base id
if the counter was allocated as bulk.

When a user performs a query, validate the flow counter id given in the
mailbox is inside the valid range taking bulk value into account.

Fixes: 208d70f562e5 ("IB/mlx5: Support flow counters offset for bulk counters")
Signed-off-by: Mark Bloch <mbloch@nvidia.com>
Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 drivers/infiniband/hw/mlx5/devx.c | 31 ++++++++++++++++++++++++++-----
 include/linux/mlx5/mlx5_ifc.h     |  3 ++-
 2 files changed, 28 insertions(+), 6 deletions(-)

Comments

Mark Bloch April 11, 2023, 11:46 a.m. UTC | #1
On 10/04/2023 16:13, Leon Romanovsky wrote:
> From: Mark Bloch <mbloch@nvidia.com>
> 
> Commit cited in "fixes" tag added bulk support for flow counters but it
> didn't account that's also possible to query a counter using a non-base id
> if the counter was allocated as bulk.
> 
> When a user performs a query, validate the flow counter id given in the
> mailbox is inside the valid range taking bulk value into account.
> 
> Fixes: 208d70f562e5 ("IB/mlx5: Support flow counters offset for bulk counters")
> Signed-off-by: Mark Bloch <mbloch@nvidia.com>
> Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> ---
>  drivers/infiniband/hw/mlx5/devx.c | 31 ++++++++++++++++++++++++++-----
>  include/linux/mlx5/mlx5_ifc.h     |  3 ++-
>  2 files changed, 28 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
> index 8b644df46fba..76384555b37e 100644
> --- a/drivers/infiniband/hw/mlx5/devx.c
> +++ b/drivers/infiniband/hw/mlx5/devx.c
> @@ -666,7 +666,21 @@ static bool devx_is_valid_obj_id(struct uverbs_attr_bundle *attrs,
>  				      obj_id;
>  
>  	case MLX5_IB_OBJECT_DEVX_OBJ:
> -		return ((struct devx_obj *)uobj->object)->obj_id == obj_id;
> +	{
> +		u16 opcode = MLX5_GET(general_obj_in_cmd_hdr, in, opcode);
> +		struct devx_obj *devx_uobj = uobj->object;
> +
> +		if (opcode == MLX5_CMD_OP_QUERY_FLOW_COUNTER &&
> +		    devx_uobj->flow_counter_bulk_size) {
> +			u32 end;

end should be u64 here.

I'll ask Leon to send v2.

Mark

> +
> +			end = devx_uobj->obj_id +
> +				devx_uobj->flow_counter_bulk_size;
> +			return devx_uobj->obj_id <= obj_id && end > obj_id;
> +		}
> +
> +		return devx_uobj->obj_id == obj_id;
> +	}
>  
>  	default:
>  		return false;
> @@ -1517,10 +1531,17 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
>  		goto obj_free;
>  
>  	if (opcode == MLX5_CMD_OP_ALLOC_FLOW_COUNTER) {
> -		u8 bulk = MLX5_GET(alloc_flow_counter_in,
> -				   cmd_in,
> -				   flow_counter_bulk);
> -		obj->flow_counter_bulk_size = 128UL * bulk;
> +		u32 bulk = MLX5_GET(alloc_flow_counter_in,
> +				    cmd_in,
> +				    flow_counter_bulk_log_size);
> +
> +		if (bulk)
> +			bulk = 1 << bulk;
> +		else
> +			bulk = 128UL * MLX5_GET(alloc_flow_counter_in,
> +						cmd_in,
> +						flow_counter_bulk);
> +		obj->flow_counter_bulk_size = bulk;
>  	}
>  
>  	uobj->object = obj;
> diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
> index b54339a1b1c6..3976e6266bcc 100644
> --- a/include/linux/mlx5/mlx5_ifc.h
> +++ b/include/linux/mlx5/mlx5_ifc.h
> @@ -9283,7 +9283,8 @@ struct mlx5_ifc_alloc_flow_counter_in_bits {
>  	u8         reserved_at_20[0x10];
>  	u8         op_mod[0x10];
>  
> -	u8         reserved_at_40[0x38];
> +	u8         reserved_at_40[0x33];
> +	u8         flow_counter_bulk_log_size[0x5];
>  	u8         flow_counter_bulk[0x8];
>  };
>
diff mbox series

Patch

diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index 8b644df46fba..76384555b37e 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -666,7 +666,21 @@  static bool devx_is_valid_obj_id(struct uverbs_attr_bundle *attrs,
 				      obj_id;
 
 	case MLX5_IB_OBJECT_DEVX_OBJ:
-		return ((struct devx_obj *)uobj->object)->obj_id == obj_id;
+	{
+		u16 opcode = MLX5_GET(general_obj_in_cmd_hdr, in, opcode);
+		struct devx_obj *devx_uobj = uobj->object;
+
+		if (opcode == MLX5_CMD_OP_QUERY_FLOW_COUNTER &&
+		    devx_uobj->flow_counter_bulk_size) {
+			u32 end;
+
+			end = devx_uobj->obj_id +
+				devx_uobj->flow_counter_bulk_size;
+			return devx_uobj->obj_id <= obj_id && end > obj_id;
+		}
+
+		return devx_uobj->obj_id == obj_id;
+	}
 
 	default:
 		return false;
@@ -1517,10 +1531,17 @@  static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
 		goto obj_free;
 
 	if (opcode == MLX5_CMD_OP_ALLOC_FLOW_COUNTER) {
-		u8 bulk = MLX5_GET(alloc_flow_counter_in,
-				   cmd_in,
-				   flow_counter_bulk);
-		obj->flow_counter_bulk_size = 128UL * bulk;
+		u32 bulk = MLX5_GET(alloc_flow_counter_in,
+				    cmd_in,
+				    flow_counter_bulk_log_size);
+
+		if (bulk)
+			bulk = 1 << bulk;
+		else
+			bulk = 128UL * MLX5_GET(alloc_flow_counter_in,
+						cmd_in,
+						flow_counter_bulk);
+		obj->flow_counter_bulk_size = bulk;
 	}
 
 	uobj->object = obj;
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index b54339a1b1c6..3976e6266bcc 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -9283,7 +9283,8 @@  struct mlx5_ifc_alloc_flow_counter_in_bits {
 	u8         reserved_at_20[0x10];
 	u8         op_mod[0x10];
 
-	u8         reserved_at_40[0x38];
+	u8         reserved_at_40[0x33];
+	u8         flow_counter_bulk_log_size[0x5];
 	u8         flow_counter_bulk[0x8];
 };