During the parsing of the OVS flow match masks and values to fill in the TC flower offload request, the logic ignores/skips the ct original tuple fields in the OVS original flow. In case there was an actual mask on one of those fields it will not be included in the offloaded flow and the TC flow won't match the original OVS flow. Parser should address all fields in the original flow when preparing for offload and abort the request in case unsupported fields have a mask.
Can you give an example of missing fields, including a datapath flow dump?
There was also the below patch (and some more tc related changes the last couple of months), so maybe the problem has been resolved? commit a039636950c563a40abd042b84541107c225b05d Author: Eelco Chaudron <echaudro> Date: Tue Feb 22 16:23:43 2022 +0100 netdev-offload-tc: Always include conntrack information to tc. Regardless of the traffic type, if requested, the conntrack information should be included to keep the datapath and tc rules in sync. Signed-off-by: Eelco Chaudron <echaudro> Acked-by: Roi Dayan <roid> Signed-off-by: Ilya Maximets <i.maximets> Can you let me know?
I believe he referred to ct_tuple() match, and that when translating the datapath flow to tc flower, it is ignoring the fact that the wanted flow had ct_tuple() match and will install a tc flower without it. But I seem to remember that ovs had a catch-all condition for matches that didn't get translated. I don't remember where that is on the code, so I couldn't find right now, but I believe it is handled.
From the OVS-TC perspective, we have no explicit ct_tuple, whatever is in the flow/mask for the tuple parameters we match on it. I guess for now we will close this BZ until we get a more detailed explanation of the problem.