On 10/04/2023 16:13, Leon Romanovsky wrote:
> From: Mark Bloch <mbloch@xxxxxxxxxx>
>
> Commit cited in "fixes" tag added bulk support for flow counters but it
> didn't account that's also possible to query a counter using a non-base id
> if the counter was allocated as bulk.
>
> When a user performs a query, validate the flow counter id given in the
> mailbox is inside the valid range taking bulk value into account.
>
> Fixes: 208d70f562e5 ("IB/mlx5: Support flow counters offset for bulk counters")
> Signed-off-by: Mark Bloch <mbloch@xxxxxxxxxx>
> Reviewed-by: Maor Gottlieb <maorg@xxxxxxxxxx>
> Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxx>
> ---
> drivers/infiniband/hw/mlx5/devx.c | 31 ++++++++++++++++++++++++++-----
> include/linux/mlx5/mlx5_ifc.h | 3 ++-
> 2 files changed, 28 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
> index 8b644df46fba..76384555b37e 100644
> --- a/drivers/infiniband/hw/mlx5/devx.c
> +++ b/drivers/infiniband/hw/mlx5/devx.c
> @@ -666,7 +666,21 @@ static bool devx_is_valid_obj_id(struct uverbs_attr_bundle *attrs,
> obj_id;
>
> case MLX5_IB_OBJECT_DEVX_OBJ:
> - return ((struct devx_obj *)uobj->object)->obj_id == obj_id;
> + {
> + u16 opcode = MLX5_GET(general_obj_in_cmd_hdr, in, opcode);
> + struct devx_obj *devx_uobj = uobj->object;
> +
> + if (opcode == MLX5_CMD_OP_QUERY_FLOW_COUNTER &&
> + devx_uobj->flow_counter_bulk_size) {
> + u32 end;
end should be u64 here.
I'll ask Leon to send v2.
Mark
> +
> + end = devx_uobj->obj_id +
> + devx_uobj->flow_counter_bulk_size;
> + return devx_uobj->obj_id <= obj_id && end > obj_id;
> + }
> +
> + return devx_uobj->obj_id == obj_id;
> + }
>
> default:
> return false;
> @@ -1517,10 +1531,17 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_CREATE)(
> goto obj_free;
>
> if (opcode == MLX5_CMD_OP_ALLOC_FLOW_COUNTER) {
> - u8 bulk = MLX5_GET(alloc_flow_counter_in,
> - cmd_in,
> - flow_counter_bulk);
> - obj->flow_counter_bulk_size = 128UL * bulk;
> + u32 bulk = MLX5_GET(alloc_flow_counter_in,
> + cmd_in,
> + flow_counter_bulk_log_size);
> +
> + if (bulk)
> + bulk = 1 << bulk;
> + else
> + bulk = 128UL * MLX5_GET(alloc_flow_counter_in,
> + cmd_in,
> + flow_counter_bulk);
> + obj->flow_counter_bulk_size = bulk;
> }
>
> uobj->object = obj;
> diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
> index b54339a1b1c6..3976e6266bcc 100644
> --- a/include/linux/mlx5/mlx5_ifc.h
> +++ b/include/linux/mlx5/mlx5_ifc.h
> @@ -9283,7 +9283,8 @@ struct mlx5_ifc_alloc_flow_counter_in_bits {
> u8 reserved_at_20[0x10];
> u8 op_mod[0x10];
>
> - u8 reserved_at_40[0x38];
> + u8 reserved_at_40[0x33];
> + u8 flow_counter_bulk_log_size[0x5];
> u8 flow_counter_bulk[0x8];
> };
>
