[Bridge] [PATCH net-next v2 4/8] flow_offload: Reject matching on layer 2 miss

[Ido Schimmel via Bridge]

Adjust drivers that support the 'FLOW_DISSECTOR_KEY_META' key to reject
filters that try to match on the newly added layer 2 miss field. Add an
extack message to clearly communicate the failure reason to user space.

The following users were not patched:

1. mtk_flow_offload_replace(): Only checks that the key is present, but
   does not do anything with it.
2. mlx5_tc_ct_set_tuple_match(): Used as part of netfilter offload,
   which does not make use of the new field, unlike tc.
3. get_netdev_from_rule() in nfp: Likewise.

Example:

 # tc filter add dev swp1 egress pref 1 proto all flower skip_sw l2_miss true 
action drop
 Error: mlxsw_spectrum: Can't match on "l2_miss".
 We have an error talking to the kernel

Acked-by: Elad Nachman <enach...@marvell.com>
Signed-off-by: Ido Schimmel <ido...@nvidia.com>
---

Notes:
    v2:
    * Expand commit message to explain why some users were not patched.

 .../net/ethernet/marvell/prestera/prestera_flower.c    |  6 ++++++
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c        |  6 ++++++
 drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c  |  6 ++++++
 drivers/net/ethernet/mscc/ocelot_flower.c              | 10 ++++++++++
 4 files changed, 28 insertions(+)

diff --git a/drivers/net/ethernet/marvell/prestera/prestera_flower.c 
b/drivers/net/ethernet/marvell/prestera/prestera_flower.c
index 91a478b75cbf..3e20e71b0f81 100644
--- a/drivers/net/ethernet/marvell/prestera/prestera_flower.c
+++ b/drivers/net/ethernet/marvell/prestera/prestera_flower.c
@@ -148,6 +148,12 @@ static int prestera_flower_parse_meta(struct 
prestera_acl_rule *rule,
        __be16 key, mask;
 
        flow_rule_match_meta(f_rule, &match);
+
+       if (match.mask->l2_miss) {
+               NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on 
\"l2_miss\"");
+               return -EOPNOTSUPP;
+       }
+
        if (match.mask->ingress_ifindex != 0xFFFFFFFF) {
                NL_SET_ERR_MSG_MOD(f->common.extack,
                                   "Unsupported ingress ifindex mask");
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c 
b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index e95414ef1f04..1b0906cb57ef 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -2587,6 +2587,12 @@ static int mlx5e_flower_parse_meta(struct net_device 
*filter_dev,
                return 0;
 
        flow_rule_match_meta(rule, &match);
+
+       if (match.mask->l2_miss) {
+               NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on 
\"l2_miss\"");
+               return -EOPNOTSUPP;
+       }
+
        if (!match.mask->ingress_ifindex)
                return 0;
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c 
b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
index 594cdcb90b3d..6fec9223250b 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
@@ -294,6 +294,12 @@ static int mlxsw_sp_flower_parse_meta(struct 
mlxsw_sp_acl_rule_info *rulei,
                return 0;
 
        flow_rule_match_meta(rule, &match);
+
+       if (match.mask->l2_miss) {
+               NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on 
\"l2_miss\"");
+               return -EOPNOTSUPP;
+       }
+
        if (match.mask->ingress_ifindex != 0xFFFFFFFF) {
                NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported ingress 
ifindex mask");
                return -EINVAL;
diff --git a/drivers/net/ethernet/mscc/ocelot_flower.c 
b/drivers/net/ethernet/mscc/ocelot_flower.c
index ee052404eb55..e0916afcddfb 100644
--- a/drivers/net/ethernet/mscc/ocelot_flower.c
+++ b/drivers/net/ethernet/mscc/ocelot_flower.c
@@ -592,6 +592,16 @@ ocelot_flower_parse_key(struct ocelot *ocelot, int port, 
bool ingress,
                return -EOPNOTSUPP;
        }
 
+       if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META)) {
+               struct flow_match_meta match;
+
+               flow_rule_match_meta(rule, &match);
+               if (match.mask->l2_miss) {
+                       NL_SET_ERR_MSG_MOD(extack, "Can't match on 
\"l2_miss\"");
+                       return -EOPNOTSUPP;
+               }
+       }
+
        /* For VCAP ES0 (egress rewriter) we can match on the ingress port */
        if (!ingress) {
                ret = ocelot_flower_parse_indev(ocelot, port, f, filter);
-- 
2.40.1