diff options
author | Mohamad Haj Yahia <mohamad@mellanox.com> | 2016-05-03 17:13:57 +0300 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2016-05-04 14:04:47 -0400 |
commit | 5742df0f7dbe54728145bf1136540c09c7fcb0d1 (patch) | |
tree | e84e59b2021231a73122c58c5f0a4728799d0dcf /drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | |
parent | net/mlx5: E-Switch, Fix error flow memory leak (diff) | |
download | linux-dev-5742df0f7dbe54728145bf1136540c09c7fcb0d1.tar.xz linux-dev-5742df0f7dbe54728145bf1136540c09c7fcb0d1.zip |
net/mlx5: E-Switch, Introduce VST vport ingress/egress ACLs
Create egress/ingress ACLs per VF vport at vport enable.
Ingress ACL:
- one flow group to drop all tagged traffic in VST mode.
Egress ACL:
- one flow group that allows only untagged traffic with
smac that is equals to the original mac (anti-spoofing).
- one flow group that allows only untagged traffic.
- one flow group that allows only smac that is equals
to the original mac (anti-spoofing).
(note: only one of the above group has active rule)
- star rule will be used to drop all other traffic.
By default no rules are generated, unless VST is explicitly requested.
Signed-off-by: Mohamad Haj Yahia <mohamad@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/mellanox/mlx5/core/eswitch.h')
-rw-r--r-- | drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h index ba434513b2c1..e6972074c3f7 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h @@ -88,6 +88,21 @@ struct l2addr_node { kfree(ptr); \ }) +struct vport_ingress { + struct mlx5_flow_table *acl; + struct mlx5_flow_group *allow_untagged_spoofchk_grp; + struct mlx5_flow_group *allow_spoofchk_only_grp; + struct mlx5_flow_group *allow_untagged_only_grp; + struct mlx5_flow_group *drop_grp; + +}; + +struct vport_egress { + struct mlx5_flow_table *acl; + struct mlx5_flow_group *allowed_vlans_grp; + struct mlx5_flow_group *drop_grp; +}; + struct mlx5_vport { struct mlx5_core_dev *dev; int vport; @@ -95,6 +110,9 @@ struct mlx5_vport { struct hlist_head mc_list[MLX5_L2_ADDR_HASH_SIZE]; struct work_struct vport_change_handler; + struct vport_ingress ingress; + struct vport_egress egress; + bool enabled; u16 enabled_events; }; |