* [PATCH net-next v3 1/2] netlink: specs: add ovs_flow del and set operations
2026-10-15 2:41 [PATCH net-next v3 0/2] netlink: specs: fill in the missing ovs operations Minxi Hou
@ 2026-10-15 2:41 ` Minxi Hou
2026-10-15 2:41 ` [PATCH net-next v3 2/2] netlink: specs: add ovs datapath and vport " Minxi Hou
1 sibling, 0 replies; 3+ messages in thread
From: Minxi Hou @ 2026-10-15 2:41 UTC (permalink / raw)
To: netdev; +Cc: donald.hunter, kuba, davem, edumazet, pabeni, horms
The ovs_flow spec only described get and new, so a YNL client could
not delete or modify a flow. The kernel has had both commands since
the family was added: del flushes the data path when neither a key nor
a ufid is given, and set looks a flow up by key or ufid.
Name the attributes each command reads. new reads ufid-flags and probe
as well as the key, so both are in its request list. new, del and set
all need CAP_NET_ADMIN.
probe was binary in the spec while the kernel policy is NLA_FLAG. It
is a flag now, which changes how a YNL client encodes it: a false flag
is left out, where a binary attribute was sent empty.
The key attribute doc said a key is required for every request except
a dump. The kernel accepts a ufid with no key for get, set and del, and
only a new flow needs a key. A set that replaces the actions needs a
key too. The doc says both now.
Signed-off-by: Minxi Hou <houminxi@gmail.com>
---
Documentation/netlink/specs/ovs_flow.yaml | 41 +++++++++++++++++++++--
1 file changed, 39 insertions(+), 2 deletions(-)
diff --git a/Documentation/netlink/specs/ovs_flow.yaml b/Documentation/netlink/specs/ovs_flow.yaml
index 951837b72e1d..e5e110b6ccc8 100644
--- a/Documentation/netlink/specs/ovs_flow.yaml
+++ b/Documentation/netlink/specs/ovs_flow.yaml
@@ -384,7 +384,9 @@ attribute-sets:
nested-attributes: key-attrs
doc: |
Nested attributes specifying the flow key. Always present in
- notifications. Required for all requests (except dumps).
+ notifications. A request may carry a ufid instead, except for a
+ new flow, which needs a key. A set that replaces the actions
+ needs a key too.
-
name: actions
type: nest
@@ -438,7 +440,7 @@ attribute-sets:
are exact match bits.
-
name: probe
- type: binary
+ type: flag
doc: |
Flow operation is a feature probe, error logging should be suppressed.
-
@@ -988,6 +990,7 @@ operations:
doc: Create OVS flow configuration in a data path
value: 1
attribute-set: flow-attrs
+ flags: [uns-admin-perm]
do:
request:
attributes:
@@ -995,6 +998,40 @@ operations:
- ufid
- mask
- actions
+ - ufid-flags
+ - probe
+ -
+ name: del
+ doc: Delete one flow, or every flow in the data path
+ value: 2
+ attribute-set: flow-attrs
+ flags: [uns-admin-perm]
+ do:
+ request:
+ attributes:
+ - key
+ - ufid
+ - ufid-flags
+ - probe
+ -
+ name: set
+ doc: |
+ Modify an existing flow. The kernel rejects the request with
+ -EINVAL when it carries neither a key nor a ufid. Replacing the
+ actions also needs a key: a ufid on its own is not enough.
+ value: 4
+ attribute-set: flow-attrs
+ flags: [uns-admin-perm]
+ do:
+ request:
+ attributes:
+ - key
+ - ufid
+ - mask
+ - actions
+ - ufid-flags
+ - clear
+ - probe
mcast-groups:
list:
--
2.56.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH net-next v3 2/2] netlink: specs: add ovs datapath and vport set operations
2026-10-15 2:41 [PATCH net-next v3 0/2] netlink: specs: fill in the missing ovs operations Minxi Hou
2026-10-15 2:41 ` [PATCH net-next v3 1/2] netlink: specs: add ovs_flow del and set operations Minxi Hou
@ 2026-10-15 2:41 ` Minxi Hou
1 sibling, 0 replies; 3+ messages in thread
From: Minxi Hou @ 2026-10-15 2:41 UTC (permalink / raw)
To: netdev; +Cc: donald.hunter, kuba, davem, edumazet, pabeni, horms
Both families register a SET command that the spec never described, so
a YNL client could not modify an existing datapath or vport. The kernel
handlers take CAP_NET_ADMIN through GENL_UNS_ADMIN_PERM.
In the kernel, the datapath SET command changes the user features, the
masks cache size and the per-cpu upcall pids. The vport SET command
changes the upcall pid. The kernel rejects a type change and rejects
options.
Signed-off-by: Minxi Hou <houminxi@gmail.com>
---
Documentation/netlink/specs/ovs_datapath.yaml | 18 ++++++++++++++++++
Documentation/netlink/specs/ovs_vport.yaml | 15 +++++++++++++++
2 files changed, 33 insertions(+)
diff --git a/Documentation/netlink/specs/ovs_datapath.yaml b/Documentation/netlink/specs/ovs_datapath.yaml
index f7b3671991e6..9c33d6a2f05d 100644
--- a/Documentation/netlink/specs/ovs_datapath.yaml
+++ b/Documentation/netlink/specs/ovs_datapath.yaml
@@ -138,6 +138,7 @@ operations:
doc: Create new OVS data path
value: 1
attribute-set: datapath
+ flags: [uns-admin-perm]
do:
request:
attributes:
@@ -149,10 +150,27 @@ operations:
doc: Delete existing OVS data path
value: 2
attribute-set: datapath
+ flags: [uns-admin-perm]
do:
request:
attributes:
- name
+ -
+ name: set
+ doc: |
+ Modify an existing OVS data path. The kernel treats a missing
+ user-features attribute as zero and clears the previously set
+ features.
+ value: 4
+ attribute-set: datapath
+ flags: [uns-admin-perm]
+ do:
+ request:
+ attributes:
+ - name
+ - user-features
+ - masks-cache-size
+ - per-cpu-pids
mcast-groups:
list:
diff --git a/Documentation/netlink/specs/ovs_vport.yaml b/Documentation/netlink/specs/ovs_vport.yaml
index fa975f8821b6..63a0a41a1199 100644
--- a/Documentation/netlink/specs/ovs_vport.yaml
+++ b/Documentation/netlink/specs/ovs_vport.yaml
@@ -128,6 +128,7 @@ operations:
name: new
doc: Create a new OVS vport
attribute-set: vport
+ flags: [uns-admin-perm]
do:
request:
attributes:
@@ -140,6 +141,7 @@ operations:
name: del
doc: Delete existing OVS vport from a data path
attribute-set: vport
+ flags: [uns-admin-perm]
do:
request:
attributes:
@@ -165,6 +167,19 @@ operations:
- netnsid
- upcall-stats
dump: *vport-get-op
+ -
+ name: set
+ doc: Modify an existing OVS vport
+ value: 4
+ attribute-set: vport
+ flags: [uns-admin-perm]
+ do:
+ request:
+ attributes:
+ - name
+ - type
+ - options
+ - upcall-pid
mcast-groups:
list:
--
2.56.0
^ permalink raw reply related [flat|nested] 3+ messages in thread