Following the path through a bridge, there are 2 situations where the action is to keep:
1. Packets have the encap, and keep the tag at ingress and keep it at egress. It is typical in the forward path, when a vlan-device and bridge are combined. 2. Packets do not have the encap, are tagged at ingress and untagged at egress. Can be found when only a bridge is in the forward path. It is also possible in the bridged path, that maybe added later. For switchdev userports that support SWITCHDEV_OBJ_ID_PORT_VLAN in sitaution 2, it is necessary to introduce DEV_PATH_BR_VLAN_KEEP_HW. The typical situation 1 is unchanged: DEV_PATH_BR_VLAN_KEEP. DEV_PATH_BR_VLAN_KEEP_HW is similar to DEV_PATH_BR_VLAN_TAG, with the correcponding bit in ingress_vlans set. Signed-off-by: Eric Woudstra <[email protected]> --- Changes in v12: -Split from [PATCH v11 nf-next] netfilter: fastpath fixes Changes in v11: (results of testing with bridge_fastpath.sh) - Dropped "No ingress_vlan forward info for dsa user port" patch. - Added Introduce DEV_PATH_BR_VLAN_KEEP_HW, which changed from applying only in the bridge-fastpath to all fastpaths. Added a better explanation to the description. Changes in v10: - Split from patch-set: bridge-fastpath and related improvements v9 include/linux/netdevice.h | 1 + net/bridge/br_device.c | 1 + net/bridge/br_vlan.c | 18 +++++++++++------- net/netfilter/nf_flow_table_path.c | 10 ++++++++++ 4 files changed, 23 insertions(+), 7 deletions(-) diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index d4e6e00bb90a..8a0dba788703 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -907,6 +907,7 @@ struct net_device_path { DEV_PATH_BR_VLAN_TAG, DEV_PATH_BR_VLAN_UNTAG, DEV_PATH_BR_VLAN_UNTAG_HW, + DEV_PATH_BR_VLAN_KEEP_HW, } vlan_mode; u16 vlan_id; __be16 vlan_proto; diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c index a818fdc22da9..80b75c2e229b 100644 --- a/net/bridge/br_device.c +++ b/net/bridge/br_device.c @@ -423,6 +423,7 @@ static int br_fill_forward_path(struct net_device_path_ctx *ctx, case DEV_PATH_BR_VLAN_UNTAG: ctx->num_vlans--; break; + case DEV_PATH_BR_VLAN_KEEP_HW: case DEV_PATH_BR_VLAN_KEEP: break; } diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c index 636c86fa1183..a42bc75bc883 100644 --- a/net/bridge/br_vlan.c +++ b/net/bridge/br_vlan.c @@ -1494,13 +1494,17 @@ int br_vlan_fill_forward_path_mode(struct net_bridge *br, if (!(v->flags & BRIDGE_VLAN_INFO_UNTAGGED)) return 0; - if (path->bridge.vlan_mode == DEV_PATH_BR_VLAN_TAG) - path->bridge.vlan_mode = DEV_PATH_BR_VLAN_KEEP; - else if (v->priv_flags & BR_VLFLAG_TAGGING_BY_SWITCHDEV) - path->bridge.vlan_mode = DEV_PATH_BR_VLAN_UNTAG_HW; - else - path->bridge.vlan_mode = DEV_PATH_BR_VLAN_UNTAG; - + if (path->bridge.vlan_mode == DEV_PATH_BR_VLAN_TAG) { + if (v->priv_flags & BR_VLFLAG_TAGGING_BY_SWITCHDEV) + path->bridge.vlan_mode = DEV_PATH_BR_VLAN_KEEP_HW; + else + path->bridge.vlan_mode = DEV_PATH_BR_VLAN_KEEP; + } else { + if (v->priv_flags & BR_VLFLAG_TAGGING_BY_SWITCHDEV) + path->bridge.vlan_mode = DEV_PATH_BR_VLAN_UNTAG_HW; + else + path->bridge.vlan_mode = DEV_PATH_BR_VLAN_UNTAG; + } return 0; } diff --git a/net/netfilter/nf_flow_table_path.c b/net/netfilter/nf_flow_table_path.c index f2d7822824bc..e8e4465263e2 100644 --- a/net/netfilter/nf_flow_table_path.c +++ b/net/netfilter/nf_flow_table_path.c @@ -154,6 +154,16 @@ static void nft_dev_path_info(const struct net_device_path_stack *stack, case DEV_PATH_BR_VLAN_UNTAG_HW: info->ingress_vlans |= BIT(info->num_encaps - 1); break; + case DEV_PATH_BR_VLAN_KEEP_HW: + info->ingress_vlans |= BIT(info->num_encaps); + if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) { + info->indev = NULL; + break; + } + info->encap[info->num_encaps].id = path->bridge.vlan_id; + info->encap[info->num_encaps].proto = path->bridge.vlan_proto; + info->num_encaps++; + break; case DEV_PATH_BR_VLAN_TAG: if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) { info->indev = NULL; -- 2.53.0
