From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 93CABC43458 for ; Wed, 8 Jul 2026 12:44:41 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id 55D1A81F38; Wed, 8 Jul 2026 12:44:41 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id pNhhz6Ly85SY; Wed, 8 Jul 2026 12:44:38 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=intel-wired-lan-bounces@osuosl.org; receiver= DKIM-Filter: OpenDKIM Filter v2.11.0 smtp1.osuosl.org B970880D99 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=osuosl.org; s=default; t=1783514678; bh=RLXhKgIz8goXRBXFEhTCWUffU7CDX96wcves2MoLAu4=; h=Date:To:Cc:References:From:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=fe36UfcWU5mkltn2/Ya1rHP3/En/WsajQiQrR0kX5xJo3jTLCqjB4pqcWByNSWLiW PjPrR25cJrwac6ycLQryxbHZcGcHMd9OKeqAiBClwAx2TNyHlf2EnEtoeXv7wkO9DC vGl1W5uEkY+iQPO9MxPSRXciyw7D1fT4LZ2X7GzX36knY78NJiNOUy1DTdn5LXuB3x IDGrl+T8+CXjk2HnvuqMaxzMV1BA6KXhgFCijMqWugGk2TYrkbmHpy6Lq4Riplpiks fBErNg7kl2O/Bd3OA1s7SZLTeS6970Comc1Uzn10EkYPLJJ5ttY/2r7gmUi//ZItXF m3OsxN90TDYMg== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp1.osuosl.org (Postfix) with ESMTP id B970880D99; Wed, 8 Jul 2026 12:44:38 +0000 (UTC) Received: from smtp4.osuosl.org (smtp4.osuosl.org [IPv6:2605:bc80:3010::137]) by lists1.osuosl.org (Postfix) with ESMTP id A7EFC15C for ; Wed, 8 Jul 2026 12:44:37 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id 9966140EB4 for ; Wed, 8 Jul 2026 12:44:37 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id Zt85eJs4dVCO for ; Wed, 8 Jul 2026 12:44:36 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=170.10.133.124; helo=us-smtp-delivery-124.mimecast.com; envelope-from=poros@redhat.com; receiver= DMARC-Filter: OpenDMARC Filter v1.4.2 smtp4.osuosl.org 6CEC140EAA DKIM-Filter: OpenDKIM Filter v2.11.0 smtp4.osuosl.org 6CEC140EAA Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by smtp4.osuosl.org (Postfix) with ESMTPS id 6CEC140EAA for ; Wed, 8 Jul 2026 12:44:36 +0000 (UTC) Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-194-4uNLVMwsOGil2jDZHCHxbQ-1; Wed, 08 Jul 2026 08:44:33 -0400 X-MC-Unique: 4uNLVMwsOGil2jDZHCHxbQ-1 X-Mimecast-MFC-AGG-ID: 4uNLVMwsOGil2jDZHCHxbQ_1783514673 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-47deed1aeb4so196757f8f.3 for ; Wed, 08 Jul 2026 05:44:33 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783514672; x=1784119472; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=RLXhKgIz8goXRBXFEhTCWUffU7CDX96wcves2MoLAu4=; b=CKnBiuJ2hkh30Hnmq28+oDKdfVXIBK7iX8+IKzxOyhcD9EBeePtcycdjSPikxJoixO faVFKw1rx+X06dDgfhSA4yGLFk54OMoN5ckBRtKsSKpuORMUtnimLZf9BfOX96CUDbTp FPUJUv5F52E5UPj5wxwAmFpW5iOEJHsVFqFNxzfZD2TJCTjuzFmsguwCa250iruQpkNP 2q0e5vNtU/0S9xLcjX9jAHXF1cM1pVzYeZNwRoD1eAJJf3Ai59amTIx3tcbcRa11GhnX aVy6jPnEC6LSvITQha/+4FZdp+F9pffvQWElU+tIg0lXs4Uw+xtRXqrXVrxRsvSUCIq+ Z6aw== X-Forwarded-Encrypted: i=1; AHgh+Rqd8Q6EY3ClslGhzGlgf/BwilKtiQ45iztJGXt/8vgkfLxd9M/qHotF8POqNaxZj6h5OJRQ0nR+4jGRXBNe2Os=@lists.osuosl.org X-Gm-Message-State: AOJu0YzTWALG2XZTYVkeMdROgnf4MDTFF4mSfjzFsOKCkzh6j+BCGtrC HDaHdo9njr+o0a9T8Btyw+YH7NpxuuWwSXEljZM2jKEK1WyDZh0XeX8wRWn7WzASTPtbN4V7C+Y W787PYEQh9ckys3wPBxKHeblLiAxCGnzUhD7Ug8iseNHUiaj59TWDaG8Lm0GS7u/ysz4pvOA= X-Gm-Gg: AfdE7clkmzdv4Jqo+nceAJjMXmBpRaPdaOwWldJAQBOBZnEWb6FebKQaeHbMDeC10Xz gnySs1QY/BMDQy+p9bFxQqZCl9xEjM1ZPyZIhaEWEQoe5KtnRjKDl1dKs6keC7oLy7Cc3S6NNqz D/1V4+QnovVR/haVo46DRrD2KnQtjn276d5LT8Xg3HZtYz0npsacEu0uz9Ww3BMvAC1Q+1ZrdAn muAjD8c1BVZEGvU0FRobh9oHln0kdAXK9ToccTMlN1Uw97pRgvYNMrG9O3fVOf1osYmRZ1LjlyA KTNtT4tryKfM98TJsu04i8M/TKLLofBqKWhs3wqlyJple/WscGEKjtqe/wBU0go8BPMMsb18jMd iD4Wh11O0pw== X-Received: by 2002:a5d:5847:0:b0:473:1ccc:15bf with SMTP id ffacd0b85a97d-47df07fc15cmr2503578f8f.42.1783514672456; Wed, 08 Jul 2026 05:44:32 -0700 (PDT) X-Received: by 2002:a5d:5847:0:b0:473:1ccc:15bf with SMTP id ffacd0b85a97d-47df07fc15cmr2503529f8f.42.1783514671909; Wed, 08 Jul 2026 05:44:31 -0700 (PDT) Received: from [192.168.2.83] ([46.175.183.46]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47a9de1d8f1sm43229189f8f.3.2026.07.08.05.44.30 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 08 Jul 2026 05:44:31 -0700 (PDT) Message-ID: <8b49c7dc-34f6-45e5-acb0-708e4e283ecd@redhat.com> Date: Wed, 8 Jul 2026 14:44:28 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: Marcin Szycik , netdev@vger.kernel.org Cc: Ivan Vecera , Alice Michael , Przemek Kitszel , Eric Dumazet , linux-kernel@vger.kernel.org, Martyna Szapar-Mudlaw , Andrew Lunn , Tony Nguyen , Simon Horman , intel-wired-lan@lists.osuosl.org, Jacob Keller , Jakub Kicinski , Paolo Abeni , "David S. Miller" References: <20260701133601.2118382-1-poros@redhat.com> <20260701133601.2118382-2-poros@redhat.com> From: Petr Oros In-Reply-To: X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: IGDR2ArowX98_6WE2I1aAglBQNKMI9XKUe-FhTYvCdA_1783514673 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Mailman-Original-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783514675; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=RLXhKgIz8goXRBXFEhTCWUffU7CDX96wcves2MoLAu4=; b=I5crTAl8CYkHt6Q3eGTozkyRfLH+bSO5y8Sq4p+jL9Bh07ssis01ZEvf0kNg9LzQyN+Dd0 A1oUhCXhhjefqJ7K7Cp92tgabN8nbErkavM+frXyo7+UlODdty+nTyesBgyZT5/FD0jMlI N/8PUl8QIMFkNE8gaPc66Rgbiiqjewk= X-Mailman-Original-Authentication-Results: smtp4.osuosl.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com X-Mailman-Original-Authentication-Results: smtp4.osuosl.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=I5crTAl8 Subject: Re: [Intel-wired-lan] [PATCH iwl-net v3 1/2] ice: skip per-VLAN promisc rules when default VSI Rx rule is set X-BeenThere: intel-wired-lan@osuosl.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Intel Wired Ethernet Linux Kernel Driver Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-wired-lan-bounces@osuosl.org Sender: "Intel-wired-lan" On 7/3/26 18:34, Marcin Szycik wrote: > > On 01.07.2026 15:36, Petr Oros wrote: >> When an ice port in a vlan-filtering bridge goes promiscuous (typical for >> bond slaves), the driver installs a per-VLAN ICE_SW_LKUP_PROMISC_VLAN rule >> for every VID on top of the broad ICE_SW_LKUP_DFLT VSI Rx rule. Each rule >> consumes one of the ~32K Flow Lookup Unit (FLU) entries the device shares >> across PFs, so a wide trunk (vid 2-4094) over several PFs overruns the >> pool: firmware rejects further Add Switch Rules with ENOSPC (AQ 0x10) and >> the DFLT Rx rule itself fails to install: >> >> ice 0000:5c:00.1: Failed to set VSI 14 as the default forwarding >> VSI, error -5 >> ice 0000:5c:00.1 ens1f1: Error -5 setting default VSI 14 Rx rule >> >> Once a switch context is overrun the retries can also come back as ENOENT >> (AQ 0x2), which has misled triage toward a perceived recipe binding defect >> rather than a capacity issue. >> >> The DFLT rule already catches every packet on the port regardless of VLAN >> tag, so the per-VLAN promisc expansion is redundant while it is installed. >> Skip it at the two sites that drive it, ice_set_promisc() and >> ice_vlan_rx_add_vid(), keyed on ice_is_vsi_dflt_vsi() rather than the >> netdev IFF_PROMISC flag so a failed or LAG-suppressed DFLT install still >> falls back to the per-VLAN rules. >> >> IFF_ALLMULTI and IFF_PROMISC can reach ice_vsi_sync_fltr() in separate >> passes (a bridge join sets them through separate calls), so the allmulti >> pass may expand the per-VID rules before the DFLT rule exists. Drop those >> now-redundant rules right after ice_set_dflt_vsi() installs the DFLT rule; >> ice_vsi_exit_dflt_promisc() reinstates them when promisc is cleared. >> >> ice_vsi_sync_fltr() subscribed multicast promiscuity only inside the >> "default VSI not yet in use" branch, so a promiscuous VSI that finds the >> default VSI rule already present (owned by another VSI, or preserved >> across a switchdev session) ended up in unicast promisc with no multicast >> subscription. Issue ice_set_promisc(ICE_MCAST_PROMISC_BITS) whenever the >> netdev is promiscuous; it is idempotent and returns 0 if the rule is >> already present. >> >> Fixes: 1273f89578f2 ("ice: Fix broken IFF_ALLMULTI handling") >> Signed-off-by: Petr Oros >> --- >> v3: >> - Dropped the two vid=0 ICE_SW_LKUP_PROMISC <-> ICE_SW_LKUP_PROMISC_VLAN >> recipe-swap guards in ice_vlan_rx_add_vid() and ice_vlan_rx_kill_vid(); >> each swap is net-zero and guarding the demote stranded the vid=0 rule >> in ICE_SW_LKUP_PROMISC_VLAN when the last VLAN was removed under the >> DFLT rule. Reported by review. >> - Drop the now-redundant per-VID multicast promisc rules right after >> ice_set_dflt_vsi(). A bridge join raises IFF_ALLMULTI and IFF_PROMISC >> in separate sync passes, so the allmulti pass expands the per-VID rules >> before the DFLT rule exists; the cleanup keeps them from lingering and >> exhausting the FLU pool. ice_vsi_exit_dflt_promisc() reinstates them on >> promisc off. Reported by review. >> - Issue ice_set_promisc(ICE_MCAST_PROMISC_BITS) whenever the netdev is >> promiscuous, not only when this VSI installs the default VSI rule, so >> multicast promisc is not lost when the rule is already in use (owned by >> another VSI, or preserved across a switchdev session). Reported by >> review. >> - Hoisted the combined VLAN promisc mask in ice_clear_promisc() into a >> local for alignment. Dropped Aleksandr's Reviewed-by since the code >> changed. >> >> v2: https://lore.kernel.org/all/20260622113428.2565255-2-poros@redhat.com/ >> v1: https://lore.kernel.org/all/89efbea9831175e6f57e9fe8557f7a0e48e050b7.1781786935.git.poros@redhat.com/ >> --- >> drivers/net/ethernet/intel/ice/ice_main.c | 111 ++++++++++++++++++---- >> 1 file changed, 90 insertions(+), 21 deletions(-) >> >> diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c >> index b43d420ece99ca..a84de6cf6eb078 100644 >> --- a/drivers/net/ethernet/intel/ice/ice_main.c >> +++ b/drivers/net/ethernet/intel/ice/ice_main.c >> @@ -274,7 +274,8 @@ static int ice_set_promisc(struct ice_vsi *vsi, u8 promisc_m) >> if (vsi->type != ICE_VSI_PF) >> return 0; >> >> - if (ice_vsi_has_non_zero_vlans(vsi)) { >> + /* skip per-VID expansion; the DFLT Rx rule already covers every VID */ >> + if (ice_vsi_has_non_zero_vlans(vsi) && !ice_is_vsi_dflt_vsi(vsi)) { >> promisc_m |= (ICE_PROMISC_VLAN_RX | ICE_PROMISC_VLAN_TX); >> status = ice_fltr_set_vlan_vsi_promisc(&vsi->back->hw, vsi, >> promisc_m); >> @@ -304,9 +305,20 @@ static int ice_clear_promisc(struct ice_vsi *vsi, u8 promisc_m) >> return 0; >> >> if (ice_vsi_has_non_zero_vlans(vsi)) { >> - promisc_m |= (ICE_PROMISC_VLAN_RX | ICE_PROMISC_VLAN_TX); >> + u8 vlan_promisc_m = promisc_m | ICE_PROMISC_VLAN_RX | >> + ICE_PROMISC_VLAN_TX; >> + int vid0_status; >> + >> + /* set time used either recipe (per-VID PROMISC_VLAN, or vid=0 > I find this sentence hard to understand - did you mean "ice_set_promisc() used > either recipe..."? > >> + * PROMISC via the ice_set_promisc() else branch), so clear >> + * both; clearing an absent rule succeeds > What do you mean by this? Both will return -EEXIST if rule is absent. There can > also be other errors. > >> + */ >> status = ice_fltr_clear_vlan_vsi_promisc(&vsi->back->hw, vsi, >> - promisc_m); >> + vlan_promisc_m); >> + vid0_status = ice_fltr_clear_vsi_promisc(&vsi->back->hw, >> + vsi->idx, promisc_m, 0); >> + if (status == 0) >> + status = vid0_status; >> } else { >> status = ice_fltr_clear_vsi_promisc(&vsi->back->hw, vsi->idx, >> promisc_m, 0); >> @@ -317,6 +329,59 @@ static int ice_clear_promisc(struct ice_vsi *vsi, u8 promisc_m) >> return status; >> } >> >> +/** >> + * ice_vsi_exit_dflt_promisc - drop the default VSI Rx rule on promisc off >> + * @vsi: the VSI leaving promiscuous mode >> + * >> + * For an IFF_ALLMULTI VSI with VLANs the per-VID multicast rules are >> + * reinstated before the default rule is cleared so coverage never lapses; >> + * the then redundant vid=0 rule is dropped best-effort. The callees log >> + * their own failures, so error returns are not re-logged here. >> + * >> + * Return: 0 on success, negative on error with the default rule left in place. >> + */ >> +static int ice_vsi_exit_dflt_promisc(struct ice_vsi *vsi) >> +{ >> + struct ice_vsi_vlan_ops *vlan_ops = ice_get_compat_vsi_vlan_ops(vsi); >> + struct net_device *netdev = vsi->netdev; >> + struct ice_hw *hw = &vsi->back->hw; >> + bool restore_mc; >> + int err; >> + >> + restore_mc = (vsi->current_netdev_flags & IFF_ALLMULTI) && >> + ice_vsi_has_non_zero_vlans(vsi); >> + >> + if (restore_mc) { >> + err = ice_fltr_set_vlan_vsi_promisc(hw, vsi, >> + ICE_MCAST_VLAN_PROMISC_BITS); >> + if (err && err != -EEXIST) >> + return err; >> + } >> + >> + err = ice_clear_dflt_vsi(vsi); >> + if (err) >> + return err; >> + >> + if (netdev->features & NETIF_F_HW_VLAN_CTAG_FILTER) >> + vlan_ops->ena_rx_filtering(vsi); >> + >> + if (restore_mc) >> + ice_fltr_clear_vsi_promisc(hw, vsi->idx, ICE_MCAST_PROMISC_BITS, >> + 0); >> + >> + return 0; >> +} >> + >> +/* Drop the per-VID multicast promisc rules, redundant once the default >> + * VSI Rx rule covers every VID. A no-op when the VSI has no VLANs. >> + */ >> +static void ice_vsi_clear_vlan_mc_promisc(struct ice_vsi *vsi) >> +{ >> + if (ice_vsi_has_non_zero_vlans(vsi)) > Nit: could flip condition to decrease indent level. > >> + ice_fltr_clear_vlan_vsi_promisc(&vsi->back->hw, vsi, >> + ICE_MCAST_VLAN_PROMISC_BITS); > Error code ignored, not sure if intentionally. The ignored error code is intentional: it only drops rules made redundant by the default VSI rule, and a leftover is harmless while that rule is installed. I will address all the comment/style points in v4. Many thanks, Petr > >> +} >> + >> /** >> * ice_vsi_sync_fltr - Update the VSI filter list to the HW >> * @vsi: ptr to the VSI >> @@ -429,30 +494,35 @@ static int ice_vsi_sync_fltr(struct ice_vsi *vsi) >> err = 0; >> vlan_ops->dis_rx_filtering(vsi); >> >> - /* promiscuous mode implies allmulticast so >> - * that VSIs that are in promiscuous mode are >> - * subscribed to multicast packets coming to >> - * the port >> + /* DFLT now covers every VID; drop the per-VID >> + * multicast promisc rules a prior IFF_ALLMULTI >> + * pass may have installed (separate passes on a >> + * bridge join) so they do not linger and exhaust >> + * the FLU pool. exit_dflt_promisc() reinstates > Please use the full function name. > >> + * them on promisc off. >> */ >> - err = ice_set_promisc(vsi, >> - ICE_MCAST_PROMISC_BITS); >> - if (err) >> - goto out_promisc; >> + ice_vsi_clear_vlan_mc_promisc(vsi); >> } >> + >> + /* Promiscuous mode implies allmulticast. Subscribe >> + * the VSI to all multicast even when the default VSI >> + * rule is already in use and the block above is >> + * skipped (it may be owned by another VSI, or >> + * preserved across a switchdev session); the unicast >> + * catch-all does not cover the multicast subscription. >> + */ >> + err = ice_set_promisc(vsi, ICE_MCAST_PROMISC_BITS); >> + if (err) >> + goto out_promisc; >> } else { >> /* Clear Rx filter to remove traffic from wire */ >> if (ice_is_vsi_dflt_vsi(vsi)) { >> - err = ice_clear_dflt_vsi(vsi); >> + err = ice_vsi_exit_dflt_promisc(vsi); >> if (err) { >> - netdev_err(netdev, "Error %d clearing default VSI %i Rx rule\n", >> - err, vsi->vsi_num); >> vsi->current_netdev_flags |= >> IFF_PROMISC; >> goto out_promisc; >> } >> - if (vsi->netdev->features & >> - NETIF_F_HW_VLAN_CTAG_FILTER) >> - vlan_ops->ena_rx_filtering(vsi); >> } >> >> /* disable allmulti here, but only if allmulti is not >> @@ -3676,10 +3746,9 @@ int ice_vlan_rx_add_vid(struct net_device *netdev, __be16 proto, u16 vid) >> while (test_and_set_bit(ICE_CFG_BUSY, vsi->state)) >> usleep_range(1000, 2000); >> >> - /* Add multicast promisc rule for the VLAN ID to be added if >> - * all-multicast is currently enabled. >> - */ >> - if (vsi->current_netdev_flags & IFF_ALLMULTI) { >> + /* skip the per-VID rule when the DFLT Rx rule already covers this VID */ >> + if ((vsi->current_netdev_flags & IFF_ALLMULTI) && >> + !ice_is_vsi_dflt_vsi(vsi)) { >> ret = ice_fltr_set_vsi_promisc(&vsi->back->hw, vsi->idx, >> ICE_MCAST_VLAN_PROMISC_BITS, >> vid); > Thanks, > Marcin >