net/bnxt: fix MAC address check in flow validation
[dpdk.git] / drivers / net / bnxt / bnxt_flow.c
index 9e0ce56..cad232a 100644 (file)
@@ -17,7 +17,6 @@
 #include "bnxt_ring.h"
 #include "bnxt_rxq.h"
 #include "bnxt_vnic.h"
-#include "bnxt_util.h"
 #include "hsi_struct_def_dpdk.h"
 
 static int
@@ -137,6 +136,7 @@ bnxt_validate_and_parse_flow_type(struct bnxt *bp,
        const struct rte_flow_item_tcp *tcp_spec, *tcp_mask;
        const struct rte_flow_item_udp *udp_spec, *udp_mask;
        const struct rte_flow_item_eth *eth_spec, *eth_mask;
+       const struct rte_ether_addr *dst, *src;
        const struct rte_flow_item_nvgre *nvgre_spec;
        const struct rte_flow_item_nvgre *nvgre_mask;
        const struct rte_flow_item_gre *gre_spec;
@@ -162,7 +162,7 @@ bnxt_validate_and_parse_flow_type(struct bnxt *bp,
        PMD_DRV_LOG(DEBUG, "Use NTUPLE %d\n", use_ntuple);
 
        filter->filter_type = use_ntuple ?
-               HWRM_CFA_NTUPLE_FILTER : HWRM_CFA_EM_FILTER;
+               HWRM_CFA_NTUPLE_FILTER : HWRM_CFA_L2_FILTER;
        en_ethertype = use_ntuple ?
                NTUPLE_FLTR_ALLOC_INPUT_EN_ETHERTYPE :
                EM_FLOW_ALLOC_INPUT_EN_ETHERTYPE;
@@ -177,6 +177,14 @@ bnxt_validate_and_parse_flow_type(struct bnxt *bp,
                        return -rte_errno;
                }
 
+               if (!item->spec || !item->mask) {
+                       rte_flow_error_set(error, EINVAL,
+                                          RTE_FLOW_ERROR_TYPE_ITEM,
+                                          item,
+                                          "spec/mask is NULL");
+                       return -rte_errno;
+               }
+
                switch (item->type) {
                case RTE_FLOW_ITEM_TYPE_ANY:
                        inner =
@@ -219,6 +227,17 @@ bnxt_validate_and_parse_flow_type(struct bnxt *bp,
                        }
 
                        if (rte_is_broadcast_ether_addr(&eth_mask->dst)) {
+                               dst = &eth_spec->dst;
+                               if (!rte_is_valid_assigned_ether_addr(dst)) {
+                                       rte_flow_error_set(error,
+                                                          EINVAL,
+                                                          RTE_FLOW_ERROR_TYPE_ITEM,
+                                                          item,
+                                                          "DMAC is invalid");
+                                       PMD_DRV_LOG(ERR,
+                                                   "DMAC is invalid!\n");
+                                       return -rte_errno;
+                               }
                                rte_memcpy(filter->dst_macaddr,
                                           &eth_spec->dst, RTE_ETHER_ADDR_LEN);
                                en |= use_ntuple ?
@@ -231,8 +250,18 @@ bnxt_validate_and_parse_flow_type(struct bnxt *bp,
                                PMD_DRV_LOG(DEBUG,
                                            "Creating a priority flow\n");
                        }
-
                        if (rte_is_broadcast_ether_addr(&eth_mask->src)) {
+                               src = &eth_spec->src;
+                               if (!rte_is_valid_assigned_ether_addr(src)) {
+                                       rte_flow_error_set(error,
+                                                          EINVAL,
+                                                          RTE_FLOW_ERROR_TYPE_ITEM,
+                                                          item,
+                                                          "SMAC is invalid");
+                                       PMD_DRV_LOG(ERR,
+                                                   "SMAC is invalid!\n");
+                                       return -rte_errno;
+                               }
                                rte_memcpy(filter->src_macaddr,
                                           &eth_spec->src, RTE_ETHER_ADDR_LEN);
                                en |= use_ntuple ?
@@ -251,6 +280,8 @@ bnxt_validate_and_parse_flow_type(struct bnxt *bp,
                                        rte_be_to_cpu_16(eth_spec->type);
                                en |= en_ethertype;
                        }
+                       if (inner)
+                               valid_flags |= BNXT_FLOW_PARSE_INNER_FLAG;
 
                        break;
                case RTE_FLOW_ITEM_TYPE_VLAN:
@@ -808,9 +839,36 @@ bnxt_create_l2_filter(struct bnxt *bp, struct bnxt_filter_info *nf,
                }
        }
 
-       filter1->enables = HWRM_CFA_L2_FILTER_ALLOC_INPUT_ENABLES_L2_ADDR |
+       if (nf->valid_flags & (BNXT_FLOW_L2_DST_VALID_FLAG |
+                              BNXT_FLOW_L2_SRC_VALID_FLAG |
+                              BNXT_FLOW_L2_INNER_SRC_VALID_FLAG |
+                              BNXT_FLOW_L2_INNER_DST_VALID_FLAG)) {
+               filter1->enables =
+                       HWRM_CFA_L2_FILTER_ALLOC_INPUT_ENABLES_L2_ADDR |
                        L2_FILTER_ALLOC_INPUT_EN_L2_ADDR_MASK;
-       memset(filter1->l2_addr_mask, 0xff, RTE_ETHER_ADDR_LEN);
+               memset(filter1->l2_addr_mask, 0xff, RTE_ETHER_ADDR_LEN);
+       }
+
+       if (nf->valid_flags & BNXT_FLOW_L2_DROP_FLAG) {
+               filter1->flags |=
+                       HWRM_CFA_L2_FILTER_ALLOC_INPUT_FLAGS_DROP;
+               if (nf->ethertype == RTE_ETHER_TYPE_IPV4) {
+                       /* Num VLANs for drop filter will/should be 0.
+                        * If the req is memset to 0, then the count will
+                        * be automatically set to 0.
+                        */
+                       if (nf->valid_flags & BNXT_FLOW_PARSE_INNER_FLAG) {
+                               filter1->enables |=
+                                       L2_FILTER_ALLOC_INPUT_EN_T_NUM_VLANS;
+                       } else {
+                               filter1->enables |=
+                                       L2_FILTER_ALLOC_INPUT_EN_NUM_VLANS;
+                               filter1->flags |=
+                               HWRM_CFA_L2_FILTER_ALLOC_INPUT_FLAGS_OUTERMOST;
+                       }
+               }
+       }
+
        rc = bnxt_hwrm_set_l2_filter(bp, vnic->fw_vnic_id,
                                     filter1);
        if (rc) {
@@ -928,7 +986,9 @@ bnxt_update_filter_flags_en(struct bnxt_filter_info *filter,
              ~(BNXT_FLOW_L2_DST_VALID_FLAG |
                BNXT_FLOW_L2_SRC_VALID_FLAG |
                BNXT_FLOW_L2_INNER_SRC_VALID_FLAG |
-               BNXT_FLOW_L2_INNER_DST_VALID_FLAG))) {
+               BNXT_FLOW_L2_INNER_DST_VALID_FLAG |
+               BNXT_FLOW_L2_DROP_FLAG |
+               BNXT_FLOW_PARSE_INNER_FLAG))) {
                filter->flags = filter1->flags;
                filter->enables = filter1->enables;
                filter->filter_type = HWRM_CFA_L2_FILTER;
@@ -956,11 +1016,11 @@ bnxt_validate_and_parse_flow(struct rte_eth_dev *dev,
                bnxt_flow_non_void_action(actions);
        struct bnxt *bp = dev->data->dev_private;
        struct rte_eth_conf *dev_conf = &bp->eth_dev->data->dev_conf;
+       struct bnxt_vnic_info *vnic = NULL, *vnic0 = NULL;
        const struct rte_flow_action_queue *act_q;
        const struct rte_flow_action_vf *act_vf;
        struct bnxt_filter_info *filter1 = NULL;
        const struct rte_flow_action_rss *rss;
-       struct bnxt_vnic_info *vnic, *vnic0;
        struct bnxt_rx_queue *rxq = NULL;
        int dflt_vnic, vnic_id;
        unsigned int rss_idx;
@@ -1033,10 +1093,6 @@ bnxt_validate_and_parse_flow(struct rte_eth_dev *dev,
                    vnic->fw_vnic_id != INVALID_HW_RING_ID)
                        goto use_vnic;
 
-               //if (!rxq ||
-                   //bp->vnic_info[0].fw_grp_ids[act_q->index] !=
-                   //INVALID_HW_RING_ID ||
-                   //!rxq->rx_deferred_start) {
                if (!rxq ||
                    bp->vnic_info[0].fw_grp_ids[act_q->index] !=
                    INVALID_HW_RING_ID) {
@@ -1061,8 +1117,15 @@ bnxt_validate_and_parse_flow(struct rte_eth_dev *dev,
                PMD_DRV_LOG(DEBUG, "VNIC found\n");
 
                rc = bnxt_vnic_prep(bp, vnic);
-               if (rc)
+               if (rc)  {
+                       rte_flow_error_set(error,
+                                          EINVAL,
+                                          RTE_FLOW_ERROR_TYPE_ACTION,
+                                          act,
+                                          "VNIC prep fail");
+                       rc = -rte_errno;
                        goto ret;
+               }
 
                PMD_DRV_LOG(DEBUG,
                            "vnic[%d] = %p vnic->fw_grp_ids = %p\n",
@@ -1075,7 +1138,12 @@ use_vnic:
                filter->dst_id = vnic->fw_vnic_id;
                filter1 = bnxt_get_l2_filter(bp, filter, vnic);
                if (filter1 == NULL) {
-                       rc = -ENOSPC;
+                       rte_flow_error_set(error,
+                                          ENOSPC,
+                                          RTE_FLOW_ERROR_TYPE_ACTION,
+                                          act,
+                                          "Filter not available");
+                       rc = -rte_errno;
                        goto ret;
                }
 
@@ -1085,25 +1153,38 @@ use_vnic:
                break;
        case RTE_FLOW_ACTION_TYPE_DROP:
                vnic0 = &bp->vnic_info[0];
+               filter->dst_id = vnic0->fw_vnic_id;
+               filter->valid_flags |= BNXT_FLOW_L2_DROP_FLAG;
                filter1 = bnxt_get_l2_filter(bp, filter, vnic0);
                if (filter1 == NULL) {
-                       rc = -ENOSPC;
+                       rte_flow_error_set(error,
+                                          ENOSPC,
+                                          RTE_FLOW_ERROR_TYPE_ACTION,
+                                          act,
+                                          "Filter not available");
+                       rc = -rte_errno;
                        goto ret;
                }
 
-               filter->fw_l2_filter_id = filter1->fw_l2_filter_id;
                if (filter->filter_type == HWRM_CFA_EM_FILTER)
                        filter->flags =
                                HWRM_CFA_EM_FLOW_ALLOC_INPUT_FLAGS_DROP;
-               else
+               else if (filter->filter_type == HWRM_CFA_NTUPLE_FILTER)
                        filter->flags =
                                HWRM_CFA_NTUPLE_FILTER_ALLOC_INPUT_FLAGS_DROP;
+
+               bnxt_update_filter_flags_en(filter, filter1, use_ntuple);
                break;
        case RTE_FLOW_ACTION_TYPE_COUNT:
                vnic0 = &bp->vnic_info[0];
                filter1 = bnxt_get_l2_filter(bp, filter, vnic0);
                if (filter1 == NULL) {
-                       rc = -ENOSPC;
+                       rte_flow_error_set(error,
+                                          ENOSPC,
+                                          RTE_FLOW_ERROR_TYPE_ACTION,
+                                          act,
+                                          "New filter not available");
+                       rc = -rte_errno;
                        goto ret;
                }
 
@@ -1166,7 +1247,12 @@ use_vnic:
                vnic0 = &bp->vnic_info[0];
                filter1 = bnxt_get_l2_filter(bp, filter, vnic0);
                if (filter1 == NULL) {
-                       rc = -ENOSPC;
+                       rte_flow_error_set(error,
+                                          ENOSPC,
+                                          RTE_FLOW_ERROR_TYPE_ACTION,
+                                          act,
+                                          "New filter not available");
+                       rc = -rte_errno;
                        goto ret;
                }
 
@@ -1236,9 +1322,6 @@ use_vnic:
                        }
                        rxq = bp->rx_queues[rss->queue[i]];
 
-                       //if (bp->vnic_info[0].fw_grp_ids[rss->queue[i]] !=
-                           //INVALID_HW_RING_ID ||
-                           //!rxq->rx_deferred_start) {
                        if (bp->vnic_info[0].fw_grp_ids[rss->queue[i]] !=
                            INVALID_HW_RING_ID) {
                                PMD_DRV_LOG(ERR,
@@ -1262,8 +1345,15 @@ use_vnic:
                vnic->func_default = 0; //This is not a default VNIC.
 
                rc = bnxt_vnic_prep(bp, vnic);
-               if (rc)
+               if (rc) {
+                       rte_flow_error_set(error,
+                                          EINVAL,
+                                          RTE_FLOW_ERROR_TYPE_ACTION,
+                                          act,
+                                          "VNIC prep fail");
+                       rc = -rte_errno;
                        goto ret;
+               }
 
                PMD_DRV_LOG(DEBUG,
                            "vnic[%d] = %p vnic->fw_grp_ids = %p\n",
@@ -1318,7 +1408,12 @@ vnic_found:
                filter->dst_id = vnic->fw_vnic_id;
                filter1 = bnxt_get_l2_filter(bp, filter, vnic);
                if (filter1 == NULL) {
-                       rc = -ENOSPC;
+                       rte_flow_error_set(error,
+                                          ENOSPC,
+                                          RTE_FLOW_ERROR_TYPE_ACTION,
+                                          act,
+                                          "New filter not available");
+                       rc = -rte_errno;
                        goto ret;
                }
 
@@ -1351,10 +1446,40 @@ done:
                rc = -rte_errno;
                goto ret;
        }
+
+       return rc;
 ret:
+
+       //TODO: Cleanup according to ACTION TYPE.
+       if (rte_errno)  {
+               if (vnic && STAILQ_EMPTY(&vnic->filter))
+                       vnic->rx_queue_cnt = 0;
+
+               if (rxq && !vnic->rx_queue_cnt)
+                       rxq->vnic = &bp->vnic_info[0];
+       }
        return rc;
 }
 
+static
+struct bnxt_vnic_info *find_matching_vnic(struct bnxt *bp,
+                                         struct bnxt_filter_info *filter)
+{
+       struct bnxt_vnic_info *vnic = NULL;
+       unsigned int i;
+
+       for (i = 0; i < bp->max_vnics; i++) {
+               vnic = &bp->vnic_info[i];
+               if (vnic->fw_vnic_id != INVALID_VNIC_ID &&
+                   filter->dst_id == vnic->fw_vnic_id) {
+                       PMD_DRV_LOG(DEBUG, "Found matching VNIC Id %d\n",
+                                   vnic->ff_pool_idx);
+                       return vnic;
+               }
+       }
+       return NULL;
+}
+
 static int
 bnxt_flow_validate(struct rte_eth_dev *dev,
                   const struct rte_flow_attr *attr,
@@ -1363,24 +1488,52 @@ bnxt_flow_validate(struct rte_eth_dev *dev,
                   struct rte_flow_error *error)
 {
        struct bnxt *bp = dev->data->dev_private;
+       struct bnxt_vnic_info *vnic = NULL;
        struct bnxt_filter_info *filter;
        int ret = 0;
 
+       bnxt_acquire_flow_lock(bp);
        ret = bnxt_flow_args_validate(attr, pattern, actions, error);
-       if (ret != 0)
+       if (ret != 0) {
+               bnxt_release_flow_lock(bp);
                return ret;
+       }
 
        filter = bnxt_get_unused_filter(bp);
        if (filter == NULL) {
                PMD_DRV_LOG(ERR, "Not enough resources for a new flow.\n");
+               bnxt_release_flow_lock(bp);
                return -ENOMEM;
        }
 
        ret = bnxt_validate_and_parse_flow(dev, pattern, actions, attr,
                                           error, filter);
+       if (ret)
+               goto exit;
+
+       vnic = find_matching_vnic(bp, filter);
+       if (vnic) {
+               if (STAILQ_EMPTY(&vnic->filter)) {
+                       rte_free(vnic->fw_grp_ids);
+                       bnxt_hwrm_vnic_ctx_free(bp, vnic);
+                       bnxt_hwrm_vnic_free(bp, vnic);
+                       vnic->rx_queue_cnt = 0;
+                       PMD_DRV_LOG(DEBUG, "Free VNIC\n");
+               }
+       }
+
+       if (filter->filter_type == HWRM_CFA_EM_FILTER)
+               bnxt_hwrm_clear_em_filter(bp, filter);
+       else if (filter->filter_type == HWRM_CFA_NTUPLE_FILTER)
+               bnxt_hwrm_clear_ntuple_filter(bp, filter);
+       else
+               bnxt_hwrm_clear_l2_filter(bp, filter);
+
+exit:
        /* No need to hold on to this filter if we are just validating flow */
        filter->fw_l2_filter_id = UINT64_MAX;
        bnxt_free_filter(bp, filter);
+       bnxt_release_flow_lock(bp);
 
        return ret;
 }
@@ -1414,7 +1567,7 @@ bnxt_match_filter(struct bnxt *bp, struct bnxt_filter_info *nf)
        struct rte_flow *flow;
        int i;
 
-       for (i = bp->max_vnics; i >= 0; i--) {
+       for (i = bp->max_vnics - 1; i >= 0; i--) {
                struct bnxt_vnic_info *vnic = &bp->vnic_info[i];
 
                if (vnic->fw_vnic_id == INVALID_VNIC_ID)
@@ -1484,7 +1637,6 @@ bnxt_flow_create(struct rte_eth_dev *dev,
        struct bnxt_filter_info *filter;
        bool update_flow = false;
        struct rte_flow *flow;
-       unsigned int i;
        int ret = 0;
        uint32_t tun_type;
 
@@ -1495,6 +1647,15 @@ bnxt_flow_create(struct rte_eth_dev *dev,
                return NULL;
        }
 
+       if (!dev->data->dev_started) {
+               rte_flow_error_set(error,
+                                  EINVAL,
+                                  RTE_FLOW_ERROR_TYPE_UNSPECIFIED,
+                                  NULL,
+                                  "Device must be started");
+               return NULL;
+       }
+
        flow = rte_zmalloc("bnxt_flow", sizeof(struct rte_flow), 0);
        if (!flow) {
                rte_flow_error_set(error, ENOMEM,
@@ -1503,6 +1664,7 @@ bnxt_flow_create(struct rte_eth_dev *dev,
                return flow;
        }
 
+       bnxt_acquire_flow_lock(bp);
        ret = bnxt_flow_args_validate(attr, pattern, actions, error);
        if (ret != 0) {
                PMD_DRV_LOG(ERR, "Not a validate flow.\n");
@@ -1585,46 +1747,23 @@ bnxt_flow_create(struct rte_eth_dev *dev,
                ret = bnxt_hwrm_set_ntuple_filter(bp, filter->dst_id, filter);
        }
 
-       for (i = 0; i < bp->max_vnics; i++) {
-               vnic = &bp->vnic_info[i];
-               if (vnic->fw_vnic_id != INVALID_VNIC_ID &&
-                   filter->dst_id == vnic->fw_vnic_id) {
-                       PMD_DRV_LOG(ERR, "Found matching VNIC Id %d\n",
-                                   vnic->ff_pool_idx);
-                       break;
-               }
-       }
+       vnic = find_matching_vnic(bp, filter);
 done:
        if (!ret || update_flow) {
-               flow->filter = filter;
-               flow->vnic = vnic;
-               /* VNIC is set only in case of queue or RSS action */
-               if (vnic) {
-                       /*
-                        * RxQ0 is not used for flow filters.
-                        */
-
-                       if (update_flow) {
-                               ret = -EXDEV;
-                               goto free_flow;
-                       }
-                       STAILQ_INSERT_TAIL(&vnic->filter, filter, next);
-               }
-               PMD_DRV_LOG(ERR, "Successfully created flow.\n");
-               STAILQ_INSERT_TAIL(&vnic->flow_list, flow, next);
-               return flow;
-       }
-       if (!ret) {
                flow->filter = filter;
                flow->vnic = vnic;
                if (update_flow) {
                        ret = -EXDEV;
                        goto free_flow;
                }
+
+               STAILQ_INSERT_TAIL(&vnic->filter, filter, next);
                PMD_DRV_LOG(ERR, "Successfully created flow.\n");
                STAILQ_INSERT_TAIL(&vnic->flow_list, flow, next);
+               bnxt_release_flow_lock(bp);
                return flow;
        }
+
 free_filter:
        bnxt_free_filter(bp, filter);
 free_flow:
@@ -1636,12 +1775,13 @@ free_flow:
                rte_flow_error_set(error, 0,
                                   RTE_FLOW_ERROR_TYPE_NONE, NULL,
                                   "Flow with pattern exists, updating destination queue");
-       else if (!rte_errno)
+       else
                rte_flow_error_set(error, -ret,
                                   RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
                                   "Failed to create flow.");
        rte_free(flow);
        flow = NULL;
+       bnxt_release_flow_lock(bp);
        return flow;
 }
 
@@ -1692,13 +1832,28 @@ bnxt_flow_destroy(struct rte_eth_dev *dev,
                  struct rte_flow_error *error)
 {
        struct bnxt *bp = dev->data->dev_private;
-       struct bnxt_filter_info *filter = flow->filter;
-       struct bnxt_vnic_info *vnic = flow->vnic;
+       struct bnxt_filter_info *filter;
+       struct bnxt_vnic_info *vnic;
        int ret = 0;
 
+       bnxt_acquire_flow_lock(bp);
+       if (!flow) {
+               rte_flow_error_set(error, EINVAL,
+                                  RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
+                                  "Invalid flow: failed to destroy flow.");
+               bnxt_release_flow_lock(bp);
+               return -EINVAL;
+       }
+
+       filter = flow->filter;
+       vnic = flow->vnic;
+
        if (!filter) {
-               ret = -EINVAL;
-               goto done;
+               rte_flow_error_set(error, EINVAL,
+                                  RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
+                                  "Invalid flow: failed to destroy flow.");
+               bnxt_release_flow_lock(bp);
+               return -EINVAL;
        }
 
        if (filter->filter_type == HWRM_CFA_TUNNEL_REDIRECT_FILTER &&
@@ -1706,15 +1861,18 @@ bnxt_flow_destroy(struct rte_eth_dev *dev,
                ret = bnxt_handle_tunnel_redirect_destroy(bp,
                                                          filter,
                                                          error);
-               if (!ret)
+               if (!ret) {
                        goto done;
-               else
+               } else {
+                       bnxt_release_flow_lock(bp);
                        return ret;
+               }
        }
 
        ret = bnxt_match_filter(bp, filter);
        if (ret == 0)
                PMD_DRV_LOG(ERR, "Could not find matching flow\n");
+
        if (filter->filter_type == HWRM_CFA_EM_FILTER)
                ret = bnxt_hwrm_clear_em_filter(bp, filter);
        if (filter->filter_type == HWRM_CFA_NTUPLE_FILTER)
@@ -1723,15 +1881,39 @@ bnxt_flow_destroy(struct rte_eth_dev *dev,
 
 done:
        if (!ret) {
+               /* If it is a L2 drop filter, when the filter is created,
+                * the FW updates the BC/MC records.
+                * Once this filter is removed, issue the set_rx_mask command
+                * to reset the BC/MC records in the HW to the settings
+                * before the drop counter is created.
+                */
+               if (filter->valid_flags & BNXT_FLOW_L2_DROP_FLAG)
+                       bnxt_set_rx_mask_no_vlan(bp, &bp->vnic_info[0]);
+
+               STAILQ_REMOVE(&vnic->filter, filter, bnxt_filter_info, next);
                bnxt_free_filter(bp, filter);
                STAILQ_REMOVE(&vnic->flow_list, flow, rte_flow, next);
                rte_free(flow);
+
+               /* If this was the last flow associated with this vnic,
+                * switch the queue back to RSS pool.
+                */
+               if (vnic && !vnic->func_default &&
+                   STAILQ_EMPTY(&vnic->flow_list)) {
+                       rte_free(vnic->fw_grp_ids);
+                       if (vnic->rx_queue_cnt > 1)
+                               bnxt_hwrm_vnic_ctx_free(bp, vnic);
+
+                       bnxt_hwrm_vnic_free(bp, vnic);
+                       vnic->rx_queue_cnt = 0;
+               }
        } else {
                rte_flow_error_set(error, -ret,
                                   RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
                                   "Failed to destroy flow.");
        }
 
+       bnxt_release_flow_lock(bp);
        return ret;
 }
 
@@ -1739,15 +1921,21 @@ static int
 bnxt_flow_flush(struct rte_eth_dev *dev, struct rte_flow_error *error)
 {
        struct bnxt *bp = dev->data->dev_private;
+       struct bnxt_filter_info *filter = NULL;
        struct bnxt_vnic_info *vnic;
        struct rte_flow *flow;
        unsigned int i;
        int ret = 0;
 
-       for (i = 0; i < bp->nr_vnics; i++) {
+       bnxt_acquire_flow_lock(bp);
+       for (i = 0; i < bp->max_vnics; i++) {
                vnic = &bp->vnic_info[i];
-               STAILQ_FOREACH(flow, &vnic->flow_list, next) {
-                       struct bnxt_filter_info *filter = flow->filter;
+               if (vnic && vnic->fw_vnic_id == INVALID_VNIC_ID)
+                       continue;
+
+               while (!STAILQ_EMPTY(&vnic->flow_list)) {
+                       flow = STAILQ_FIRST(&vnic->flow_list);
+                       filter = flow->filter;
 
                        if (filter->filter_type ==
                            HWRM_CFA_TUNNEL_REDIRECT_FILTER &&
@@ -1756,16 +1944,20 @@ bnxt_flow_flush(struct rte_eth_dev *dev, struct rte_flow_error *error)
                                bnxt_handle_tunnel_redirect_destroy(bp,
                                                                    filter,
                                                                    error);
-                               if (!ret)
+                               if (!ret) {
                                        goto done;
-                               else
+                               } else {
+                                       bnxt_release_flow_lock(bp);
                                        return ret;
+                               }
                        }
 
                        if (filter->filter_type == HWRM_CFA_EM_FILTER)
                                ret = bnxt_hwrm_clear_em_filter(bp, filter);
                        if (filter->filter_type == HWRM_CFA_NTUPLE_FILTER)
                                ret = bnxt_hwrm_clear_ntuple_filter(bp, filter);
+                       else if (i)
+                               ret = bnxt_hwrm_clear_l2_filter(bp, filter);
 
                        if (ret) {
                                rte_flow_error_set
@@ -1774,16 +1966,35 @@ bnxt_flow_flush(struct rte_eth_dev *dev, struct rte_flow_error *error)
                                         RTE_FLOW_ERROR_TYPE_HANDLE,
                                         NULL,
                                         "Failed to flush flow in HW.");
+                               bnxt_release_flow_lock(bp);
                                return -rte_errno;
                        }
 done:
-                       bnxt_free_filter(bp, filter);
                        STAILQ_REMOVE(&vnic->flow_list, flow,
                                      rte_flow, next);
+
+                       STAILQ_REMOVE(&vnic->filter,
+                                     filter,
+                                     bnxt_filter_info,
+                                     next);
+                       bnxt_free_filter(bp, filter);
+
                        rte_free(flow);
+
+                       /* If this was the last flow associated with this vnic,
+                        * switch the queue back to RSS pool.
+                        */
+                       if (STAILQ_EMPTY(&vnic->flow_list)) {
+                               rte_free(vnic->fw_grp_ids);
+                               if (vnic->rx_queue_cnt > 1)
+                                       bnxt_hwrm_vnic_ctx_free(bp, vnic);
+                               bnxt_hwrm_vnic_free(bp, vnic);
+                               vnic->rx_queue_cnt = 0;
+                       }
                }
        }
 
+       bnxt_release_flow_lock(bp);
        return ret;
 }