[iwl-next,v2,1/2] ice: tc: check src_vsi in case of traffic from VF

Commit Message

Michal Swiatkowski Feb. 22, 2024, 12:39 p.m. UTC

In case of traffic going from the VF (so ingress for port representor)
source VSI should be consider during packet classification. It is
needed for hardware to not match packets from different ports with
filters added on other port.

It is only for "from VF" traffic, because other traffic direction
doesn't have source VSI.

Set correct ::src_vsi in rule_info to pass it to the hardware filter.

For example this rule should drop only ipv4 packets from eth10, not from
the others VF PRs. It is needed to check source VSI in this case.
$tc filter add dev eth10 ingress protocol ip flower skip_sw action drop

Reviewed-by: Jedrzej Jagielski <[e-mail]>
Reviewed-by: Sridhar Samudrala <[e-mail]>
Signed-off-by: Michal Swiatkowski <[e-mail]>
---
 drivers/net/ethernet/intel/ice/ice_tc_lib.c | 8 ++++++++
 1 file changed, 8 insertions(+)

Comments

Simon Horman Feb. 26, 2024, 1:34 p.m. UTC | #1

On Thu, Feb 22, 2024 at 01:39:55PM +0100, Michal Swiatkowski wrote:
> In case of traffic going from the VF (so ingress for port representor)
> source VSI should be consider during packet classification. It is
> needed for hardware to not match packets from different ports with
> filters added on other port.
> 
> It is only for "from VF" traffic, because other traffic direction
> doesn't have source VSI.
> 
> Set correct ::src_vsi in rule_info to pass it to the hardware filter.
> 
> For example this rule should drop only ipv4 packets from eth10, not from
> the others VF PRs. It is needed to check source VSI in this case.
> $tc filter add dev eth10 ingress protocol ip flower skip_sw action drop
> 
> Reviewed-by: Jedrzej Jagielski <[e-mail]>
> Reviewed-by: Sridhar Samudrala <[e-mail]>
> Signed-off-by: Michal Swiatkowski <[e-mail]>

Hi Michal,

Should this be treated as a fix: have a Fixes tag; be targeted at 'iwl'?

That notwithstanding, this look good to me.

Reviewed-by: Simon Horman <[e-mail]>

...

Buvaneswaran, Sujai March 8, 2024, 7:39 a.m. UTC | #2

> -----Original Message-----
> From: Intel-wired-lan <[e-mail]> On Behalf Of
> Michal Swiatkowski
> Sent: Thursday, February 22, 2024 6:10 PM
> To: [e-mail]
> Cc: [e-mail]; Drewek, Wojciech
> <[e-mail]>; Szycik, Marcin <[e-mail]>;
> [e-mail]; Jagielski, Jedrzej <[e-mail]>;
> Samudrala, Sridhar <[e-mail]>; Michal Swiatkowski
> <[e-mail]>
> Subject: [Intel-wired-lan] [iwl-next v2 1/2] ice: tc: check src_vsi in case of
> traffic from VF
> 
> In case of traffic going from the VF (so ingress for port representor) source
> VSI should be consider during packet classification. It is needed for hardware
> to not match packets from different ports with filters added on other port.
> 
> It is only for "from VF" traffic, because other traffic direction doesn't have
> source VSI.
> 
> Set correct ::src_vsi in rule_info to pass it to the hardware filter.
> 
> For example this rule should drop only ipv4 packets from eth10, not from the
> others VF PRs. It is needed to check source VSI in this case.
> $tc filter add dev eth10 ingress protocol ip flower skip_sw action drop
> 
> Reviewed-by: Jedrzej Jagielski <[e-mail]>
> Reviewed-by: Sridhar Samudrala <[e-mail]>
> Signed-off-by: Michal Swiatkowski <[e-mail]>
> ---
>  drivers/net/ethernet/intel/ice/ice_tc_lib.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
Tested-by: Sujai Buvaneswaran <[e-mail]>

Michal Swiatkowski March 14, 2024, 10:59 a.m. UTC | #3

On Mon, Feb 26, 2024 at 01:34:48PM +0000, Simon Horman wrote:
> On Thu, Feb 22, 2024 at 01:39:55PM +0100, Michal Swiatkowski wrote:
> > In case of traffic going from the VF (so ingress for port representor)
> > source VSI should be consider during packet classification. It is
> > needed for hardware to not match packets from different ports with
> > filters added on other port.
> > 
> > It is only for "from VF" traffic, because other traffic direction
> > doesn't have source VSI.
> > 
> > Set correct ::src_vsi in rule_info to pass it to the hardware filter.
> > 
> > For example this rule should drop only ipv4 packets from eth10, not from
> > the others VF PRs. It is needed to check source VSI in this case.
> > $tc filter add dev eth10 ingress protocol ip flower skip_sw action drop
> > 
> > Reviewed-by: Jedrzej Jagielski <[e-mail]>
> > Reviewed-by: Sridhar Samudrala <[e-mail]>
> > Signed-off-by: Michal Swiatkowski <[e-mail]>
> 
> Hi Michal,
> 
> Should this be treated as a fix: have a Fixes tag; be targeted at 'iwl'?
> 
> That notwithstanding, this look good to me.
> 
> Reviewed-by: Simon Horman <[e-mail]>
> 
> ...

Thanks Simon, you are right, it will go to net with correct fixes tag.

Thanks,
Michal

Patch

diff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.c b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
index b890410a2bc0..49ed5fd7db10 100644
--- a/drivers/net/ethernet/intel/ice/ice_tc_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
@@ -28,6 +28,8 @@  ice_tc_count_lkups(u32 flags, struct ice_tc_flower_lyr_2_4_hdrs *headers,
 	 * - ICE_TC_FLWR_FIELD_VLAN_TPID (present if specified)
 	 * - Tunnel flag (present if tunnel)
 	 */
+	if (fltr->direction == ICE_ESWITCH_FLTR_EGRESS)
+		lkups_cnt++;
 
 	if (flags & ICE_TC_FLWR_FIELD_TENANT_ID)
 		lkups_cnt++;
@@ -363,6 +365,11 @@  ice_tc_fill_rules(struct ice_hw *hw, u32 flags,
 	/* Always add direction metadata */
 	ice_rule_add_direction_metadata(&list[ICE_TC_METADATA_LKUP_IDX]);
 
+	if (tc_fltr->direction == ICE_ESWITCH_FLTR_EGRESS) {
+		ice_rule_add_src_vsi_metadata(&list[i]);
+		i++;
+	}
+
 	rule_info->tun_type = ice_sw_type_from_tunnel(tc_fltr->tunnel_type);
 	if (tc_fltr->tunnel_type != TNL_LAST) {
 		i = ice_tc_fill_tunnel_outer(flags, tc_fltr, list, i);
@@ -820,6 +827,7 @@  ice_eswitch_add_tc_fltr(struct ice_vsi *vsi, struct ice_tc_flower_fltr *fltr)
 
 	/* specify the cookie as filter_rule_id */
 	rule_info.fltr_rule_id = fltr->cookie;
+	rule_info.src_vsi = vsi->idx;
 
 	ret = ice_add_adv_rule(hw, list, lkups_cnt, &rule_info, &rule_added);
 	if (ret == -EEXIST) {