ice: block LAN in case of VF to VF offload

VF to VF traffic shouldn't go outside. To enforce it, set only the loopback
enable bit in case of all ingress type rules added via the tc tool.

Fixes: 0d08a441fb1a ("ice: ndo_setup_tc implementation for PF")
Reported-by: Sujai Buvaneswaran <Sujai.Buvaneswaran@intel.com>
Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
Tested-by: George Kuruvinakunnel <george.kuruvinakunnel@intel.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/intel/ice/ice_tc_lib.c b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
index 76f29a5bf8d73d6bc25f376370e17087c59f7f1f..d1a31f236d26adcf1cca3e18a81332a926357eec 100644 (file)
--- a/drivers/net/ethernet/intel/ice/ice_tc_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_tc_lib.c
@@ -693,17 +693,18 @@ ice_eswitch_add_tc_fltr(struct ice_vsi *vsi, struct ice_tc_flower_fltr *fltr)
         * results into order of switch rule evaluation.
         */
        rule_info.priority = 7;
+       rule_info.flags_info.act_valid = true;
 
        if (fltr->direction == ICE_ESWITCH_FLTR_INGRESS) {
                rule_info.sw_act.flag |= ICE_FLTR_RX;
                rule_info.sw_act.src = hw->pf_id;
                rule_info.rx = true;
+               rule_info.flags_info.act = ICE_SINGLE_ACT_LB_ENABLE;
        } else {
                rule_info.sw_act.flag |= ICE_FLTR_TX;
                rule_info.sw_act.src = vsi->idx;
                rule_info.rx = false;
                rule_info.flags_info.act = ICE_SINGLE_ACT_LAN_ENABLE;
-               rule_info.flags_info.act_valid = true;
        }
 
        /* specify the cookie as filter_rule_id */