RE: [Intel-wired-lan] [PATCH iwl-next] iavf: flower: validate control flags

[Buvaneswaran, Sujai]

Hi Asbjørn,

HW offload is not directly supported on the iavf VF interface. VF traffic can be offloaded only through VF port representor device which uses ice driver.

[root@cbl-mariner ~]# ethtool -i ens5f0v0
driver: iavf
version: 6.9.0-rc5+
firmware-version: N/A
expansion-rom-version: 
bus-info: 0000:b1:01.0
supports-statistics: yes
supports-test: no
supports-eeprom-access: no
supports-register-dump: no
supports-priv-flags: no
[root@cbl-mariner ~]# tc qdisc add dev ens5f0v0 ingress
[root@cbl-mariner ~]# tc filter add dev ens5f0v0 ingress protocol ip flower skip_sw ip_flags frag/firstfrag action drop
Error: TC offload is disabled on net device.
We have an error talking to the kernel
[root@cbl-mariner ~]# tc filter add dev ens5f0v0 ingress protocol ip flower ip_flags frag/firstfrag action drop
[root@cbl-mariner ~]# tc filter show dev ens5f0v0 ingress
filter protocol ip pref 49152 flower chain 0 
filter protocol ip pref 49152 flower chain 0 handle 0x1 
  eth_type ipv4
  ip_flags frag/firstfrag
  not_in_hw
        action order 1: gact action drop
         random type none pass val 0
         index 1 ref 1 bind 1

Regards,
Sujai B

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@xxxxxxxxxx> On Behalf Of
> Asbjørn Sloth Tønnesen
> Sent: Tuesday, April 16, 2024 8:13 PM
> To: intel-wired-lan@xxxxxxxxxxxxxxxx
> Cc: netdev@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; Eric Dumazet
> <edumazet@xxxxxxxxxx>; Nguyen, Anthony L
> <anthony.l.nguyen@xxxxxxxxx>; Asbjørn Sloth Tønnesen <ast@xxxxxxxxxxx>;
> Jakub Kicinski <kuba@xxxxxxxxxx>; Paolo Abeni <pabeni@xxxxxxxxxx>;
> David S. Miller <davem@xxxxxxxxxxxxx>
> Subject: [Intel-wired-lan] [PATCH iwl-next] iavf: flower: validate control flags
> 
> This driver currently doesn't support any control flags.
> 
> Use flow_rule_has_control_flags() to check for control flags, such as can be
> set through `tc flower ... ip_flags frag`.
> 
> In case any control flags are masked, flow_rule_has_control_flags() sets a NL
> extended error message, and we return -EOPNOTSUPP.
> 
> Only compile-tested.
> 
> Signed-off-by: Asbjørn Sloth Tønnesen <ast@xxxxxxxxxxx>
> ---
>  drivers/net/ethernet/intel/iavf/iavf_main.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c
> b/drivers/net/ethernet/intel/iavf/iavf_main.c
> index 13361a780ece..f14355d52f47 100644
> --- a/drivers/net/ethernet/intel/iavf/iavf_main.c
> +++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
> @@ -3757,6 +3757,10 @@ static int iavf_parse_cls_flower(struct
> iavf_adapter *adapter,
> 
>  		flow_rule_match_control(rule, &match);
>  		addr_type = match.key->addr_type;
> +
> +		if (flow_rule_has_control_flags(match.mask->flags,
> +						f->common.extack))
> +			return -EOPNOTSUPP;
>  	}
> 
>  	if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) {
> --
> 2.43.0