Tunnel mapping stores the matched tunnel key. The metadata of a packet
missing in hardware after a goto chain or a sample is restored from it.
A partial enc_key_id mask would restore a wrong tunnel id. Flower is about
to accept such masks.
Tunnel options with a partial class or type are already rejected here.
Rules without tunnel mapping keep working.
Found by an AI code review agent while auditing the users of enc_key_id.
Tested on ConnectX-7 with firmware 28.48.1000 in switchdev mode.
Signed-off-by: Alexandre Cassen <redacted>
---
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 708b7987ea4c..28f09d234835 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -2257,6 +2257,7 @@ static int mlx5e_get_flow_tunnel_id(struct mlx5e_priv *priv,
struct tunnel_match_enc_opts tun_enc_opts;
struct mlx5_rep_uplink_priv *uplink_priv;
struct mlx5_flow_attr *attr = flow->attr;
+ struct flow_match_enc_keyid enc_keyid;
struct mlx5e_rep_priv *uplink_rpriv;
struct tunnel_match_key tunnel_key;
bool enc_opts_is_dont_care = true;
@@ -2265,6 +2266,16 @@ static int mlx5e_get_flow_tunnel_id(struct mlx5e_priv *priv,
u32 value, mask;
int err;
+ /* The mapping restores the tunnel id of a packet missing in hardware */
+ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_KEYID)) {
+ flow_rule_match_enc_keyid(rule, &enc_keyid);
+ if (enc_keyid.mask->keyid != cpu_to_be32(U32_MAX)) {
+ NL_SET_ERR_MSG_MOD(extack,
+ "Partial match of tunnel key in chains isn't supported");
+ return -EOPNOTSUPP;
+ }
+ }
+
esw = priv->mdev->priv.eswitch;
uplink_rpriv = mlx5_eswitch_get_uplink_priv(esw, REP_ETH);
uplink_priv = &uplink_rpriv->uplink_priv;--
2.43.0