> -----Original Message-----
> From: Ido Schimmel <idosch@xxxxxxxxxx>
> Sent: Tuesday, May 9, 2023 10:05 AM
> To: netdev@xxxxxxxxxxxxxxx; bridge@xxxxxxxxxxxxxxxxxxxxxxxxxx
> Cc: davem@xxxxxxxxxxxxx; kuba@xxxxxxxxxx; pabeni@xxxxxxxxxx;
> edumazet@xxxxxxxxxx; razor@xxxxxxxxxxxxx; roopa@xxxxxxxxxx;
> jhs@xxxxxxxxxxxx; xiyou.wangcong@xxxxxxxxx; jiri@xxxxxxxxxxx;
> petrm@xxxxxxxxxx; taspelund@xxxxxxxxxx; Ido Schimmel
> <idosch@xxxxxxxxxx>
> Subject: [EXT] [RFC PATCH net-next 3/5] flow_offload: Reject matching on
> layer 2 miss
>
> External Email
>
> ----------------------------------------------------------------------
> Adjust drivers that support the 'FLOW_DISSECTOR_KEY_META' key to reject
> filters that try to match on the newly added layer 2 miss option. Add an
> extack message to clearly communicate the failure reason to user space.
>
> Example:
>
> # tc filter add dev swp1 egress pref 1 proto all flower skip_sw l2_miss true
> action drop
> Error: mlxsw_spectrum: Can't match on "l2_miss".
> We have an error talking to the kernel
>
> Signed-off-by: Ido Schimmel <idosch@xxxxxxxxxx>
> ---
> .../net/ethernet/marvell/prestera/prestera_flower.c | 6 ++++++
> drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 ++++++
> drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c | 6 ++++++
> drivers/net/ethernet/mscc/ocelot_flower.c | 10 ++++++++++
> 4 files changed, 28 insertions(+)
>
> diff --git a/drivers/net/ethernet/marvell/prestera/prestera_flower.c
> b/drivers/net/ethernet/marvell/prestera/prestera_flower.c
> index 91a478b75cbf..3e20e71b0f81 100644
> --- a/drivers/net/ethernet/marvell/prestera/prestera_flower.c
> +++ b/drivers/net/ethernet/marvell/prestera/prestera_flower.c
> @@ -148,6 +148,12 @@ static int prestera_flower_parse_meta(struct
> prestera_acl_rule *rule,
> __be16 key, mask;
>
> flow_rule_match_meta(f_rule, &match);
> +
> + if (match.mask->l2_miss) {
> + NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on
> \"l2_miss\"");
> + return -EOPNOTSUPP;
> + }
> +
> if (match.mask->ingress_ifindex != 0xFFFFFFFF) {
> NL_SET_ERR_MSG_MOD(f->common.extack,
> "Unsupported ingress ifindex mask"); diff --
> git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> index 728b82ce4031..516653568330 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> @@ -2586,6 +2586,12 @@ static int mlx5e_flower_parse_meta(struct
> net_device *filter_dev,
> return 0;
>
> flow_rule_match_meta(rule, &match);
> +
> + if (match.mask->l2_miss) {
> + NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on
> \"l2_miss\"");
> + return -EOPNOTSUPP;
> + }
> +
> if (!match.mask->ingress_ifindex)
> return 0;
>
> diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
> b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
> index 594cdcb90b3d..6fec9223250b 100644
> --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
> +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
> @@ -294,6 +294,12 @@ static int mlxsw_sp_flower_parse_meta(struct
> mlxsw_sp_acl_rule_info *rulei,
> return 0;
>
> flow_rule_match_meta(rule, &match);
> +
> + if (match.mask->l2_miss) {
> + NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on
> \"l2_miss\"");
> + return -EOPNOTSUPP;
> + }
> +
> if (match.mask->ingress_ifindex != 0xFFFFFFFF) {
> NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported
> ingress ifindex mask");
> return -EINVAL;
> diff --git a/drivers/net/ethernet/mscc/ocelot_flower.c
> b/drivers/net/ethernet/mscc/ocelot_flower.c
> index ee052404eb55..e0916afcddfb 100644
> --- a/drivers/net/ethernet/mscc/ocelot_flower.c
> +++ b/drivers/net/ethernet/mscc/ocelot_flower.c
> @@ -592,6 +592,16 @@ ocelot_flower_parse_key(struct ocelot *ocelot, int
> port, bool ingress,
> return -EOPNOTSUPP;
> }
>
> + if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META)) {
> + struct flow_match_meta match;
> +
> + flow_rule_match_meta(rule, &match);
> + if (match.mask->l2_miss) {
> + NL_SET_ERR_MSG_MOD(extack, "Can't match on
> \"l2_miss\"");
> + return -EOPNOTSUPP;
> + }
> + }
> +
> /* For VCAP ES0 (egress rewriter) we can match on the ingress port
> */
> if (!ingress) {
> ret = ocelot_flower_parse_indev(ocelot, port, f, filter);
> --
> 2.40.1
>
I have reviewed the prestera part. Looks straightforward enough.
Acked-by: Elad Nachman <enachman@xxxxxxxxxxx>
