nf_flow_rule_match() fills the vlan and cvlan keys and sets their dissector offsets, but leaves their bits clear in used_keys. flow_rule_match_key() reads used_keys, so no driver sees the vlan match. mlx5e consumes flowtable rules through mlx5e_rep_setup_ft_cb() and __parse_cls_flower(). With the vlan key undeclared and a filter device that is not a vlan device, the parser sets cvlan_tag in the match criteria with a zero value, an untagged-only match that the tagged frames of the flow never hit. Set the bits where the keys are filled. Fixes: 3e1b0c168f6c ("netfilter: flowtable: add vlan match offload support") Assisted-by: Claude:claude-fable-5-1 Signed-off-by: Julius Bairaktaris --- net/netfilter/nf_flow_table_offload.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c index 19adc6c7725f..c50bbb1411d5 100644 --- a/net/netfilter/nf_flow_table_offload.c +++ b/net/netfilter/nf_flow_table_offload.c @@ -126,6 +126,7 @@ static int nf_flow_rule_match(struct nf_flow_match *match, nf_flow_rule_vlan_match(&key->vlan, &mask->vlan, tuple->encap[0].id, tuple->encap[0].proto); + match->dissector.used_keys |= BIT_ULL(FLOW_DISSECTOR_KEY_VLAN); vlan_encap = true; } @@ -137,12 +138,16 @@ static int nf_flow_rule_match(struct nf_flow_match *match, nf_flow_rule_vlan_match(&key->cvlan, &mask->cvlan, tuple->encap[1].id, tuple->encap[1].proto); + match->dissector.used_keys |= + BIT_ULL(FLOW_DISSECTOR_KEY_CVLAN); } else if (tuple->in_vlan_ingress & BIT(0)) { NF_FLOW_DISSECTOR(match, FLOW_DISSECTOR_KEY_VLAN, vlan); nf_flow_rule_vlan_match(&key->vlan, &mask->vlan, tuple->encap[1].id, tuple->encap[1].proto); + match->dissector.used_keys |= + BIT_ULL(FLOW_DISSECTOR_KEY_VLAN); } } -- 2.53.0