Re: [PATCH v3 17/19] net/i40e: reimplement tunnel parsers

["Burakov, Anatoly" <anatoly.burakov@intel.com>]

On 9/19/2026 6:14 PM, Medvedkin, Vladimir wrote:
> 
> On 9/16/2026 1:18 PM, Anatoly Burakov wrote:
>> Use the new flow graph API and the common parsing framework to implement
>> flow parser for tunnel filters: QinQ, VXLAN, NVGRE, MPLS, GTP, and L4.
>>
>> As a result of transitioning to more formalized validation, some
>> checks have become more stringent:
>>
>> - VLAN TCI mask is now required to be fully masked (all-ones); previously
>>    the mask was only checked for eth_proto and any non-zero vlan_tci mask
>>    value was silently accepted
>>
>> In addition to using the new graph infrastructure, some of the checks 
>> were
>> made more stringent and/or more correct. In particular:
>>
>> - old code did not check for whether fields other than ports are masked
>>    (they are now rejected)
>> - old code did not check for whether src/ports are fully masked (masks
>>    other than full are now rejected)
>> - old code used spec to decide which port to copy (as a result, it was 
>> not
>>    possible to match port 0 - this is now allowed)
>>
>> Tunnel engine now also share a refcounted global state, and track all
>> flows and do deduplication inside the engine.
>>
>> Signed-off-by: Anatoly Burakov<anatoly.burakov@intel.com>
>> ---
> <snip>
>> +static int
>> +i40e_tunnel_node_vlan_validate(const void *ctx __rte_unused, const 
>> struct rte_flow_item *item,
>> +        struct rte_flow_error *error)
>> +{
>> +    const struct rte_flow_item_vlan *vlan_mask = item->mask;
>> +
>> +    /* matching eth proto not supported */
>> +    if (vlan_mask->hdr.eth_proto) {
>> +        return rte_flow_error_set(error, EINVAL,
>> +                RTE_FLOW_ERROR_TYPE_ITEM, item,
>> +                "Invalid VLAN mask");
>> +    }
>> +
>> +    /* VLAN TCI must be fully masked */
>> +    if (!CI_FIELD_IS_MASKED(&vlan_mask->hdr.vlan_tci)) {
> isn't VLAN TCI optional?
>> +        return rte_flow_error_set(error, EINVAL,
>> +                RTE_FLOW_ERROR_TYPE_ITEM, item,
>> +                "Invalid VLAN mask");
>> +    }
>> +
>> +    return 0;
>> +}
>> +
> <snip>
>> +static int
>> +i40e_tunnel_node_tcp_process(void *ctx, const struct rte_flow_item 
>> *item,
>> +        struct rte_flow_error *error __rte_unused)
>> +{
>> +    struct i40e_tunnel_ctx *tunnel_ctx = ctx;
>> +    struct i40e_tunnel_filter_conf *tunnel_filter = &tunnel_ctx->filter;
>> +    const struct rte_flow_item_tcp *tcp_spec = item->spec;
>> +    const struct rte_flow_item_tcp *tcp_mask = item->mask;
>> +
>> +    if (tcp_mask->hdr.src_port) {
>> +        tunnel_filter->l4_port_type = I40E_L4_PORT_TYPE_SRC;
>> +        tunnel_filter->tenant_id = rte_be_to_cpu_32(tcp_spec- 
>> >hdr.src_port);
> nit: just as a thought for future improvement: here and for some other 
> protocols, use rte_be_to_cpu_16 instead of _32 and fix 
> i40e_tunnel_filter_convert_conf?

Maybe for future improvement, I'm not going to touch this now.

-- 
Thanks,
Anatoly