| Message ID | 20240819101401.67924-1-michal.swiatkowski@linux.intel.com |
|---|---|
| State | Under Review |
| Delegated to: | Anthony Nguyen |
| Headers | show |
| Series | [iwl-next,v1] ice: set correct dst VSI in only LAN filters | expand |
On 8/19/2024 3:14 AM, Michal Swiatkowski wrote: > The filters set that will reproduce the problem: > $ tc filter add dev $VF0_PR ingress protocol arp prio 0 flower \ > skip_sw dst_mac ff:ff:ff:ff:ff:ff action mirred egress \ > redirect dev $PF0 > $ tc filter add dev $VF0_PR ingress protocol arp prio 0 flower \ > skip_sw dst_mac ff:ff:ff:ff:ff:ff src_mac 52:54:00:00:00:10 \ > action mirred egress mirror dev $VF1_PR > > Expected behaviour is to set all broadcast from VF0 to the LAN. If the > src_mac match the value from filters, send packet to LAN and to VF1. > > In this case both LAN_EN and LB_EN flags in switch is set in case of > packet matching both filters. As dst VSI for the only LAN enable bit is > PF VSI, the packet is being seen on PF. To fix this change dst VSI to > the source VSI. It will block receiving any packet even when LB_EN is > set by switch, because local loopback is clear on VF VSI during normal > operation. > > Side note: if the second filters action is redirect instead of mirror > LAN_EN is clear, because switch is AND-ing LAN_EN from each matched > filters and OR-ing LB_EN. > > Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> > Fixes: 73b483b79029 ("ice: Manage act flags for switchdev offloads") > Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
> -----Original Message----- > From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of > Michal Swiatkowski > Sent: Monday, August 19, 2024 3:44 PM > To: intel-wired-lan@lists.osuosl.org > Cc: netdev@vger.kernel.org; Drewek, Wojciech > <wojciech.drewek@intel.com>; Kitszel, Przemyslaw > <przemyslaw.kitszel@intel.com> > Subject: [Intel-wired-lan] [iwl-next v1] ice: set correct dst VSI in only LAN > filters > > The filters set that will reproduce the problem: > $ tc filter add dev $VF0_PR ingress protocol arp prio 0 flower \ > skip_sw dst_mac ff:ff:ff:ff:ff:ff action mirred egress \ > redirect dev $PF0 > $ tc filter add dev $VF0_PR ingress protocol arp prio 0 flower \ > skip_sw dst_mac ff:ff:ff:ff:ff:ff src_mac 52:54:00:00:00:10 \ > action mirred egress mirror dev $VF1_PR > > Expected behaviour is to set all broadcast from VF0 to the LAN. If the > src_mac match the value from filters, send packet to LAN and to VF1. > > In this case both LAN_EN and LB_EN flags in switch is set in case of packet > matching both filters. As dst VSI for the only LAN enable bit is PF VSI, the > packet is being seen on PF. To fix this change dst VSI to the source VSI. It will > block receiving any packet even when LB_EN is set by switch, because local > loopback is clear on VF VSI during normal operation. > > Side note: if the second filters action is redirect instead of mirror LAN_EN is > clear, because switch is AND-ing LAN_EN from each matched filters and OR- > ing LB_EN. > > Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> > Fixes: 73b483b79029 ("ice: Manage act flags for switchdev offloads") > Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com> > --- > drivers/net/ethernet/intel/ice/ice_tc_lib.c | 11 +++++++++++ > 1 file changed, 11 insertions(+) > Tested-by: Sujai Buvaneswaran <sujai.buvaneswaran@intel.com>
diff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.c b/drivers/net/ethernet/intel/ice/ice_tc_lib.c index e6923f8121a9..ea39b999a0d0 100644 --- a/drivers/net/ethernet/intel/ice/ice_tc_lib.c +++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.c @@ -819,6 +819,17 @@ ice_eswitch_add_tc_fltr(struct ice_vsi *vsi, struct ice_tc_flower_fltr *fltr) rule_info.sw_act.flag |= ICE_FLTR_TX; rule_info.sw_act.src = vsi->idx; rule_info.flags_info.act = ICE_SINGLE_ACT_LAN_ENABLE; + /* This is a specific case. The destination VSI index is + * overwritten by the source VSI index. This type of filter + * should allow the packet to go to the LAN, not to the + * VSI passed here. It should set LAN_EN bit only. However, + * the VSI must be a valid one. Setting source VSI index + * here is safe. Even if the result from switch is set LAN_EN + * and LB_EN (which normally will pass the packet to this VSI) + * packet won't be seen on the VSI, because local loopback is + * turned off. + */ + rule_info.sw_act.vsi_handle = vsi->idx; } else { /* VF to VF */ rule_info.sw_act.flag |= ICE_FLTR_TX;