From: Jiri Pirko <jiri@resnulli.us>
To: Jakub Kicinski <jakub.kicinski@netronome.com>
Cc: Saeed Mahameed <saeedm@mellanox.com>,
"David S. Miller" <davem@davemloft.net>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
Ariel Levkovich <lariel@mellanox.com>
Subject: Re: [net-next 8/8] net/mlx5: Add vf ACL access via tc flower
Date: Wed, 13 Nov 2019 14:06:51 +0100 [thread overview]
Message-ID: <20191113130651.GA2176@nanopsycho> (raw)
In-Reply-To: <20191112154124.4f0f38f9@cakuba>
Wed, Nov 13, 2019 at 12:41:24AM CET, jakub.kicinski@netronome.com wrote:
>On Tue, 12 Nov 2019 17:13:53 +0000, Saeed Mahameed wrote:
>> From: Ariel Levkovich <lariel@mellanox.com>
>>
>> Implementing vf ACL access via tc flower api to allow
>> admins configure the allowed vlan ids on a vf interface.
>>
>> To add a vlan id to a vf's ingress/egress ACL table while
>> in legacy sriov mode, the implementation intercepts tc flows
>> created on the pf device where the flower matching keys include
>> the vf's mac address as the src_mac (eswitch ingress) or the
>> dst_mac (eswitch egress) while the action is accept.
>>
>> In such cases, the mlx5 driver interpets these flows as adding
>> a vlan id to the vf's ingress/egress ACL table and updates
>> the rules in that table using eswitch ACL configuration api
>> that is introduced in a previous patch.
>
>Nack, the magic interpretation of rules installed on the PF is a no go.
For the record, I don't like this approach either. The solution is
out there, one just have to properly implement bridge offloading.
prev parent reply other threads:[~2019-11-13 13:06 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-12 17:13 [pull request][net-next 0/8] Mellanox, mlx5 updates 2019-11-12 Saeed Mahameed
2019-11-12 17:13 ` [net-next 1/8] net/mlx5: DR, Fix matcher builders select check Saeed Mahameed
2019-11-12 17:13 ` [net-next 2/8] net/mlx5: Read num_vfs before disabling SR-IOV Saeed Mahameed
2019-11-12 17:13 ` [net-next 3/8] net/mlx5: Remove redundant NULL initializations Saeed Mahameed
2019-11-12 17:13 ` [net-next 4/8] net/mlx5e: Fix error flow cleanup in mlx5e_tc_tun_create_header_ipv4/6 Saeed Mahameed
2019-11-12 17:13 ` [net-next 5/8] net/mlx5e: Set netdev name space on creation Saeed Mahameed
2019-11-12 17:13 ` [net-next 6/8] net/mlx5: Add devlink reload Saeed Mahameed
2019-11-12 17:13 ` [net-next 7/8] net/mlx5: Add eswitch ACL vlan trunk api Saeed Mahameed
2019-11-12 17:13 ` [net-next 8/8] net/mlx5: Add vf ACL access via tc flower Saeed Mahameed
2019-11-12 23:41 ` Jakub Kicinski
2019-11-13 0:21 ` Marcelo Ricardo Leitner
2019-11-13 0:31 ` Saeed Mahameed
2019-11-13 20:19 ` Jakub Kicinski
2019-11-13 21:35 ` Saeed Mahameed
2019-11-13 13:06 ` Jiri Pirko [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191113130651.GA2176@nanopsycho \
--to=jiri@resnulli.us \
--cc=davem@davemloft.net \
--cc=jakub.kicinski@netronome.com \
--cc=lariel@mellanox.com \
--cc=netdev@vger.kernel.org \
--cc=saeedm@mellanox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.