DPDK Flow Filtering Not Working as Expected

[Medvedkin, Vladimir]

You can also try with the existing X540-AT2 NIC the following :

- Init NIC with 2 queues

- set the FDIR flow for your particular ip/port to route your packet to 
a queue number, say 1

- Instead of using rte_flow to drop all other packets, use RSS. Rewrite 
the RSS ReTa (see rte_eth_dev_rss_reta_update) with queue id you are not 
going to poll, so in this case with queue id = 0. All ReTa entries will 
be 0, so packets not matched with the FDIR will be assigned to this queue.

- ignore rx on the queue 0

I believe this approach would be better for your particular use case, 
than relying on rte_flow to drop all the traffic, which, as we could 
see, depends on the internal HW implementation.

On 04/02/2025 15:50, Sid ali cherrati wrote:
>
> Hello Vladimir,
>
> Thank you for the clarification.
>
> I'll try using the E810 and provide an update on the issue.
>
> Best regards,
> Ali
>
>
> Le mar. 4 févr. 2025 à 16:41, Medvedkin, Vladimir 
> <vladimir.medvedkin at intel.com> a écrit :
>
>     Hi all,
>
>     The goal that Ali is trying to achieve is not possible with the
>     X540-AT2
>     NIC (as with any other ixgbe NIC). The problem is related to:
>
>     1. The first rule is processed by the FDIR engine
>
>     2. FDIR engine is executed in the HW pipeline almost in the end (just
>     before RSS), i.e. after other filters that we could use to match all
>     other packets (5tuple filter engine in this particular case).
>
>     Therefore my recommendations here would be to use a modern NIC
>     such as
>     E810 to implement the required filtering logic.
>
>     On 04/02/2025 09:28, Dariusz Sosnowski wrote:
>     > Hi,
>     >
>     > Anatoly, Vladimir - Would you be able to help with the issue
>     regarding DROP action not being supported on X540-AT2?
>     >
>     > Best regards,
>     > Dariusz Sosnowski
>     >
>     >> From: Sid ali cherrati <scherrati1 at gmail.com>
>     >> Sent: Monday, February 3, 2025 18:12
>     >> To: Dmitry Kozlyuk <dmitry.kozliuk at gmail.com>
>     >> Cc: users at dpdk.org
>     >> Subject: Re: DPDK Flow Filtering Not Working as Expected
>     >>
>     >> External email: Use caution opening links or attachments
>     >>
>     >> Here is a better version of the code :
>     >>
>     <snip>
>     >>
>     >> Le lun. 3 févr. 2025 à 16:00, Dmitry Kozlyuk
>     <mailto:dmitry.kozliuk at gmail.com> a écrit :
>     >> 2025-02-03 14:51 (UTC+0100), Sid ali cherrati:
>     >>> [...]
>     >>> if (!rte_flow_validate(port_id, &attr, pattern, actions, &error)){
>     >>> flow = rte_flow_create(port_id, &attr, pattern, actions, &error);
>     >>> }
>     >>>
>     >>> if(flow != 0){
>     >>> printf("Filed to create drop flow filter \n");
>     >>> return -1;
>     >>> }
>     >>> [...]
>     >>> The issue is that when I implement this, I get an error on the
>     drop filter:
>     >>> "Failed to create rule." Do you have any idea why this might
>     be happening?
>     >> There is no this exact error text in your code or DPDK,
>     >> I assume we're talking about the quoted fragment.
>     >> `flow` is a pointer, the correct error condition is `if (flow
>     == NULL)`,
>     >> so your code probably misinterprets success as error.
>     >> Also `flow` is not assigned if `rte_flow_validate()` returns non-0.
>
>     -- 
>     Regards,
>     Vladimir
>
-- 
Regards,
Vladimir
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mails.dpdk.org/archives/users/attachments/20250204/29409c55/attachment-0001.htm>