| Message ID | 20230529114835.372140-5-idosch@nvidia.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | f4356947f0297b0962fdd197672db7edf9f58be6 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | Add layer 2 miss indication and filtering | expand |
On 29/05/2023 14:48, Ido Schimmel wrote: > Adjust drivers that support the 'FLOW_DISSECTOR_KEY_META' key to reject > filters that try to match on the newly added layer 2 miss field. Add an > extack message to clearly communicate the failure reason to user space. > > The following users were not patched: > > 1. mtk_flow_offload_replace(): Only checks that the key is present, but > does not do anything with it. > 2. mlx5_tc_ct_set_tuple_match(): Used as part of netfilter offload, > which does not make use of the new field, unlike tc. > 3. get_netdev_from_rule() in nfp: Likewise. > > Example: > > # tc filter add dev swp1 egress pref 1 proto all flower skip_sw l2_miss true action drop > Error: mlxsw_spectrum: Can't match on "l2_miss". > We have an error talking to the kernel > > Acked-by: Elad Nachman <enachman@marvell.com> > Signed-off-by: Ido Schimmel <idosch@nvidia.com> > --- > > Notes: > v2: > * Expand commit message to explain why some users were not patched. > > .../net/ethernet/marvell/prestera/prestera_flower.c | 6 ++++++ > drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 ++++++ > drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c | 6 ++++++ > drivers/net/ethernet/mscc/ocelot_flower.c | 10 ++++++++++ > 4 files changed, 28 insertions(+) > Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
diff --git a/drivers/net/ethernet/marvell/prestera/prestera_flower.c b/drivers/net/ethernet/marvell/prestera/prestera_flower.c index 91a478b75cbf..3e20e71b0f81 100644 --- a/drivers/net/ethernet/marvell/prestera/prestera_flower.c +++ b/drivers/net/ethernet/marvell/prestera/prestera_flower.c @@ -148,6 +148,12 @@ static int prestera_flower_parse_meta(struct prestera_acl_rule *rule, __be16 key, mask; flow_rule_match_meta(f_rule, &match); + + if (match.mask->l2_miss) { + NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on \"l2_miss\""); + return -EOPNOTSUPP; + } + if (match.mask->ingress_ifindex != 0xFFFFFFFF) { NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported ingress ifindex mask"); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c index e95414ef1f04..1b0906cb57ef 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c @@ -2587,6 +2587,12 @@ static int mlx5e_flower_parse_meta(struct net_device *filter_dev, return 0; flow_rule_match_meta(rule, &match); + + if (match.mask->l2_miss) { + NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on \"l2_miss\""); + return -EOPNOTSUPP; + } + if (!match.mask->ingress_ifindex) return 0; diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c index 594cdcb90b3d..6fec9223250b 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c @@ -294,6 +294,12 @@ static int mlxsw_sp_flower_parse_meta(struct mlxsw_sp_acl_rule_info *rulei, return 0; flow_rule_match_meta(rule, &match); + + if (match.mask->l2_miss) { + NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on \"l2_miss\""); + return -EOPNOTSUPP; + } + if (match.mask->ingress_ifindex != 0xFFFFFFFF) { NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported ingress ifindex mask"); return -EINVAL; diff --git a/drivers/net/ethernet/mscc/ocelot_flower.c b/drivers/net/ethernet/mscc/ocelot_flower.c index ee052404eb55..e0916afcddfb 100644 --- a/drivers/net/ethernet/mscc/ocelot_flower.c +++ b/drivers/net/ethernet/mscc/ocelot_flower.c @@ -592,6 +592,16 @@ ocelot_flower_parse_key(struct ocelot *ocelot, int port, bool ingress, return -EOPNOTSUPP; } + if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META)) { + struct flow_match_meta match; + + flow_rule_match_meta(rule, &match); + if (match.mask->l2_miss) { + NL_SET_ERR_MSG_MOD(extack, "Can't match on \"l2_miss\""); + return -EOPNOTSUPP; + } + } + /* For VCAP ES0 (egress rewriter) we can match on the ingress port */ if (!ingress) { ret = ocelot_flower_parse_indev(ocelot, port, f, filter);