# \[PATCH net-next 00/10\] tc flower: tunnel key partitioning for RX queue steering

- From: Alexandre Cassen \<hidden\>
- Date: 2026-11-09 13:10:47 
- List: netdev
- Page: https://ratatoskr.run/netdev/2026/11/17897204
- Thread: https://ratatoskr.run/netdev/2026/11/17897204/t.md

```text
RSS cant spread GTP-U traffic between a few endpoints. The outer headers
barely vary and mlx5 does not hash the TEID. One flower rule per TEID does
not scale.

Add a mask to the flower enc_key_id key and offload it on mlx5e NIC flows
with skbedit queue_mapping. One rule then steers a block of tunnel keys to
an RX queue. This "tunnel key partitioning" supports fine-grained session
placement. In a 5G mobile network, the UPF can place a session on a CPU by
allocating its TEID from the right block [1]. Any scheduling algorithm can
then pick that block.

  tc filter add dev eth0 ingress protocol ip flower skip_sw \
      ip_proto udp dst_port 2152 enc_key_id 0x40000000/0xc0000000 \
      action skbedit queue_mapping 1 skip_sw

This series generalize an earlier GTP-U work [2] to other tunnels that the
ConnectX family can steer: GRE, VXLAN and GENEVE.

Patches 1 to 5 refuse a partial mask or a key wider than the VNI where a
driver cant honor them. Patches 6 and 7 add the flower mask and its test.
Patch 8 adds queue mapping to mlx5e NIC flows. Patch 9 adds the tunnel key
match to mlx5e NIC and eswitch flows without a tunnel device. Patch 10
documents the result.

Without a tunnel device nothing decapsulates. enc_key_id reads the tunnel
header on the wire like on cxgb4 and hns3. On mlx5 the plain ip_proto and
dst_port keys select the match register. A rule on the uplink representor
used to ignore enc_key_id and now matches it or gets refused. I can rework
patch 9 on a dedicated key if that looks cleaner.

Tested on ConnectX-7 with firmware 28.48.1000 in NIC mode. Also tested on
the uplink and VF representors in dmfs, smfs and hmfs. This includes
redirect to a VF. GTP-U needs flex parser profile 3 and GENEVE profile 0.
The bnxt, cxgb4 and nfp patches are build tested only. The selftest passes
under User-Mode Linux and fails on a kernel without the mask.

Multiple AI tools were used to test this feature. They found the problems
fixed by patches 1 to 5.

The iproute2 support is posted separately.

[1] https://gtp-guard.org/articles/5g-upf-pump-up-the-volume/#benefits-of-range-partitioning
[2] https://github.com/acassen/research/tree/main/UPF-flow-steering

Alexandre Cassen (10):
  bnxt_en: require an exact tunnel id in TC flows
  cxgb4: flower: refuse a tunnel key wider than the VNI
  nfp: flower: refuse a tunnel key wider than the VNI
  net/mlx5e: TC, refuse a tunnel key wider than the VNI
  net/mlx5e: TC, reject a partial tunnel key with tunnel mapping
  net/sched: cls_flower: add enc_key_id mask
  selftests: forwarding: tc_flower: test the enc_key_id mask
  net/mlx5e: TC, offload RX queue mapping in NIC flows
  net/mlx5e: TC, match the tunnel key without a tunnel device
  docs: networking: describe tunnel key partitioning in TC queue
    filtering

 Documentation/netlink/specs/tc.yaml           |  4 +
 Documentation/networking/tc-queue-filters.rst | 22 +++++
 drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c  |  7 ++
 .../ethernet/chelsio/cxgb4/cxgb4_tc_flower.c  | 11 +++
 .../net/ethernet/mellanox/mlx5/core/Makefile  |  6 +-
 .../mellanox/mlx5/core/en/tc/act/act.c        |  1 +
 .../mellanox/mlx5/core/en/tc/act/act.h        |  1 +
 .../mellanox/mlx5/core/en/tc/act/rx_queue.c   | 49 +++++++++++
 .../ethernet/mellanox/mlx5/core/en/tc_tun.c   | 88 +++++++++++++++++++
 .../ethernet/mellanox/mlx5/core/en/tc_tun.h   | 14 +++
 .../mellanox/mlx5/core/en/tc_tun_geneve.c     | 46 ++++++++++
 .../mellanox/mlx5/core/en/tc_tun_gre.c        | 31 +++++++
 .../mellanox/mlx5/core/en/tc_tun_gtp.c        | 36 ++++++++
 .../mellanox/mlx5/core/en/tc_tun_vxlan.c      | 45 ++++++++++
 .../net/ethernet/mellanox/mlx5/core/en_tc.c   | 19 ++++
 .../net/ethernet/mellanox/mlx5/core/en_tc.h   |  1 +
 .../ethernet/netronome/nfp/flower/offload.c   | 21 +++++
 include/uapi/linux/pkt_cls.h                  |  2 +
 net/sched/cls_flower.c                        |  5 +-
 .../selftests/net/forwarding/tc_flower.sh     | 57 ++++++++++++
 20 files changed, 462 insertions(+), 4 deletions(-)
 create mode 100644 drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/rx_queue.c
 create mode 100644 drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_gtp.c

-- 
2.43.0

```