1// SPDX-License-Identifier: (GPL-2.0 OR MIT)
   2/* Microsemi Ocelot Switch driver
   3 * Copyright (c) 2019 Microsemi Corporation
   4 */
   5
   6#include <net/pkt_cls.h>
   7#include <net/tc_act/tc_gact.h>
   8#include <soc/mscc/ocelot_vcap.h>
   9#include "ocelot_police.h"
  10#include "ocelot_vcap.h"
  11
  12/* Arbitrarily chosen constants for encoding the VCAP block and lookup number
  13 * into the chain number. This is UAPI.
  14 */
  15#define VCAP_BLOCK			10000
  16#define VCAP_LOOKUP			1000
  17#define VCAP_IS1_NUM_LOOKUPS		3
  18#define VCAP_IS2_NUM_LOOKUPS		2
  19#define VCAP_IS2_NUM_PAG		256
  20#define VCAP_IS1_CHAIN(lookup)		\
  21	(1 * VCAP_BLOCK + (lookup) * VCAP_LOOKUP)
  22#define VCAP_IS2_CHAIN(lookup, pag)	\
  23	(2 * VCAP_BLOCK + (lookup) * VCAP_LOOKUP + (pag))
  24/* PSFP chain and block ID */
  25#define PSFP_BLOCK_ID			OCELOT_NUM_VCAP_BLOCKS
  26#define OCELOT_PSFP_CHAIN		(3 * VCAP_BLOCK)
  27
  28static int ocelot_chain_to_block(int chain, bool ingress)
  29{
  30	int lookup, pag;
  31
  32	if (!ingress) {
  33		if (chain == 0)
  34			return VCAP_ES0;
  35		return -EOPNOTSUPP;
  36	}
  37
  38	/* Backwards compatibility with older, single-chain tc-flower
  39	 * offload support in Ocelot
  40	 */
  41	if (chain == 0)
  42		return VCAP_IS2;
  43
  44	for (lookup = 0; lookup < VCAP_IS1_NUM_LOOKUPS; lookup++)
  45		if (chain == VCAP_IS1_CHAIN(lookup))
  46			return VCAP_IS1;
  47
  48	for (lookup = 0; lookup < VCAP_IS2_NUM_LOOKUPS; lookup++)
  49		for (pag = 0; pag < VCAP_IS2_NUM_PAG; pag++)
  50			if (chain == VCAP_IS2_CHAIN(lookup, pag))
  51				return VCAP_IS2;
  52
  53	if (chain == OCELOT_PSFP_CHAIN)
  54		return PSFP_BLOCK_ID;
  55
  56	return -EOPNOTSUPP;
  57}
  58
  59/* Caller must ensure this is a valid IS1 or IS2 chain first,
  60 * by calling ocelot_chain_to_block.
  61 */
  62static int ocelot_chain_to_lookup(int chain)
  63{
  64	/* Backwards compatibility with older, single-chain tc-flower
  65	 * offload support in Ocelot
  66	 */
  67	if (chain == 0)
  68		return 0;
  69
  70	return (chain / VCAP_LOOKUP) % 10;
  71}
  72
  73/* Caller must ensure this is a valid IS2 chain first,
  74 * by calling ocelot_chain_to_block.
  75 */
  76static int ocelot_chain_to_pag(int chain)
  77{
  78	int lookup;
  79
  80	/* Backwards compatibility with older, single-chain tc-flower
  81	 * offload support in Ocelot
  82	 */
  83	if (chain == 0)
  84		return 0;
  85
  86	lookup = ocelot_chain_to_lookup(chain);
  87
  88	/* calculate PAG value as chain index relative to the first PAG */
  89	return chain - VCAP_IS2_CHAIN(lookup, 0);
  90}
  91
  92static bool ocelot_is_goto_target_valid(int goto_target, int chain,
  93					bool ingress)
  94{
  95	int pag;
  96
  97	/* Can't offload GOTO in VCAP ES0 */
  98	if (!ingress)
  99		return (goto_target < 0);
 100
 101	/* Non-optional GOTOs */
 102	if (chain == 0)
 103		/* VCAP IS1 can be skipped, either partially or completely */
 104		return (goto_target == VCAP_IS1_CHAIN(0) ||
 105			goto_target == VCAP_IS1_CHAIN(1) ||
 106			goto_target == VCAP_IS1_CHAIN(2) ||
 107			goto_target == VCAP_IS2_CHAIN(0, 0) ||
 108			goto_target == VCAP_IS2_CHAIN(1, 0) ||
 109			goto_target == OCELOT_PSFP_CHAIN);
 110
 111	if (chain == VCAP_IS1_CHAIN(0))
 112		return (goto_target == VCAP_IS1_CHAIN(1));
 113
 114	if (chain == VCAP_IS1_CHAIN(1))
 115		return (goto_target == VCAP_IS1_CHAIN(2));
 116
 117	/* Lookup 2 of VCAP IS1 can really support non-optional GOTOs,
 118	 * using a Policy Association Group (PAG) value, which is an 8-bit
 119	 * value encoding a VCAP IS2 target chain.
 120	 */
 121	if (chain == VCAP_IS1_CHAIN(2)) {
 122		for (pag = 0; pag < VCAP_IS2_NUM_PAG; pag++)
 123			if (goto_target == VCAP_IS2_CHAIN(0, pag))
 124				return true;
 125
 126		return false;
 127	}
 128
 129	/* Non-optional GOTO from VCAP IS2 lookup 0 to lookup 1.
 130	 * We cannot change the PAG at this point.
 131	 */
 132	for (pag = 0; pag < VCAP_IS2_NUM_PAG; pag++)
 133		if (chain == VCAP_IS2_CHAIN(0, pag))
 134			return (goto_target == VCAP_IS2_CHAIN(1, pag));
 135
 136	/* VCAP IS2 lookup 1 can goto to PSFP block if hardware support */
 137	for (pag = 0; pag < VCAP_IS2_NUM_PAG; pag++)
 138		if (chain == VCAP_IS2_CHAIN(1, pag))
 139			return (goto_target == OCELOT_PSFP_CHAIN);
 140
 141	return false;
 142}
 143
 144static struct ocelot_vcap_filter *
 145ocelot_find_vcap_filter_that_points_at(struct ocelot *ocelot, int chain)
 146{
 147	struct ocelot_vcap_filter *filter;
 148	struct ocelot_vcap_block *block;
 149	int block_id;
 150
 151	block_id = ocelot_chain_to_block(chain, true);
 152	if (block_id < 0)
 153		return NULL;
 154
 155	if (block_id == VCAP_IS2) {
 156		block = &ocelot->block[VCAP_IS1];
 157
 158		list_for_each_entry(filter, &block->rules, list)
 159			if (filter->type == OCELOT_VCAP_FILTER_PAG &&
 160			    filter->goto_target == chain)
 161				return filter;
 162	}
 163
 164	list_for_each_entry(filter, &ocelot->dummy_rules, list)
 165		if (filter->goto_target == chain)
 166			return filter;
 167
 168	return NULL;
 169}
 170
 171static int
 172ocelot_flower_parse_ingress_vlan_modify(struct ocelot *ocelot, int port,
 173					struct ocelot_vcap_filter *filter,
 174					const struct flow_action_entry *a,
 175					struct netlink_ext_ack *extack)
 176{
 177	struct ocelot_port *ocelot_port = ocelot->ports[port];
 178
 179	if (filter->goto_target != -1) {
 180		NL_SET_ERR_MSG_MOD(extack,
 181				   "Last action must be GOTO");
 182		return -EOPNOTSUPP;
 183	}
 184
 185	if (!ocelot_port->vlan_aware) {
 186		NL_SET_ERR_MSG_MOD(extack,
 187				   "Can only modify VLAN under VLAN aware bridge");
 188		return -EOPNOTSUPP;
 189	}
 190
 191	filter->action.vid_replace_ena = true;
 192	filter->action.pcp_dei_ena = true;
 193	filter->action.vid = a->vlan.vid;
 194	filter->action.pcp = a->vlan.prio;
 195	filter->type = OCELOT_VCAP_FILTER_OFFLOAD;
 196
 197	return 0;
 198}
 199
 200static int
 201ocelot_flower_parse_egress_vlan_modify(struct ocelot_vcap_filter *filter,
 202				       const struct flow_action_entry *a,
 203				       struct netlink_ext_ack *extack)
 204{
 205	enum ocelot_tag_tpid_sel tpid;
 206
 207	switch (ntohs(a->vlan.proto)) {
 208	case ETH_P_8021Q:
 209		tpid = OCELOT_TAG_TPID_SEL_8021Q;
 210		break;
 211	case ETH_P_8021AD:
 212		tpid = OCELOT_TAG_TPID_SEL_8021AD;
 213		break;
 214	default:
 215		NL_SET_ERR_MSG_MOD(extack,
 216				   "Cannot modify custom TPID");
 217		return -EOPNOTSUPP;
 218	}
 219
 220	filter->action.tag_a_tpid_sel = tpid;
 221	filter->action.push_outer_tag = OCELOT_ES0_TAG;
 222	filter->action.tag_a_vid_sel = OCELOT_ES0_VID_PLUS_CLASSIFIED_VID;
 223	filter->action.vid_a_val = a->vlan.vid;
 224	filter->action.pcp_a_val = a->vlan.prio;
 225	filter->action.tag_a_pcp_sel = OCELOT_ES0_PCP;
 226	filter->type = OCELOT_VCAP_FILTER_OFFLOAD;
 227
 228	return 0;
 229}
 230
 231static int ocelot_flower_parse_action(struct ocelot *ocelot, int port,
 232				      bool ingress, struct flow_cls_offload *f,
 233				      struct ocelot_vcap_filter *filter)
 234{
 235	const struct flow_action *action = &f->rule->action;
 236	struct netlink_ext_ack *extack = f->common.extack;
 237	bool allow_missing_goto_target = false;
 238	const struct flow_action_entry *a;
 239	enum ocelot_tag_tpid_sel tpid;
 240	int i, chain, egress_port;
 241	u32 pol_ix, pol_max;
 242	u64 rate;
 243	int err;
 244
 245	if (!flow_action_basic_hw_stats_check(&f->rule->action,
 246					      f->common.extack))
 247		return -EOPNOTSUPP;
 248
 249	chain = f->common.chain_index;
 250	filter->block_id = ocelot_chain_to_block(chain, ingress);
 251	if (filter->block_id < 0) {
 252		NL_SET_ERR_MSG_MOD(extack, "Cannot offload to this chain");
 253		return -EOPNOTSUPP;
 254	}
 255	if (filter->block_id == VCAP_IS1 || filter->block_id == VCAP_IS2)
 256		filter->lookup = ocelot_chain_to_lookup(chain);
 257	if (filter->block_id == VCAP_IS2)
 258		filter->pag = ocelot_chain_to_pag(chain);
 259
 260	filter->goto_target = -1;
 261	filter->type = OCELOT_VCAP_FILTER_DUMMY;
 262
 263	flow_action_for_each(i, a, action) {
 264		switch (a->id) {
 265		case FLOW_ACTION_DROP:
 266			if (filter->block_id != VCAP_IS2) {
 267				NL_SET_ERR_MSG_MOD(extack,
 268						   "Drop action can only be offloaded to VCAP IS2");
 269				return -EOPNOTSUPP;
 270			}
 271			if (filter->goto_target != -1) {
 272				NL_SET_ERR_MSG_MOD(extack,
 273						   "Last action must be GOTO");
 274				return -EOPNOTSUPP;
 275			}
 276			filter->action.mask_mode = OCELOT_MASK_MODE_PERMIT_DENY;
 277			filter->action.port_mask = 0;
 278			filter->action.police_ena = true;
 279			filter->action.pol_ix = OCELOT_POLICER_DISCARD;
 280			filter->type = OCELOT_VCAP_FILTER_OFFLOAD;
 281			break;
 282		case FLOW_ACTION_ACCEPT:
 283			if (filter->block_id != VCAP_ES0 &&
 284			    filter->block_id != VCAP_IS1 &&
 285			    filter->block_id != VCAP_IS2) {
 286				NL_SET_ERR_MSG_MOD(extack,
 287						   "Accept action can only be offloaded to VCAP chains");
 288				return -EOPNOTSUPP;
 289			}
 290			if (filter->block_id != VCAP_ES0 &&
 291			    filter->goto_target != -1) {
 292				NL_SET_ERR_MSG_MOD(extack,
 293						   "Last action must be GOTO");
 294				return -EOPNOTSUPP;
 295			}
 296			filter->type = OCELOT_VCAP_FILTER_OFFLOAD;
 297			break;
 298		case FLOW_ACTION_TRAP:
 299			if (filter->block_id != VCAP_IS2 ||
 300			    filter->lookup != 0) {
 301				NL_SET_ERR_MSG_MOD(extack,
 302						   "Trap action can only be offloaded to VCAP IS2 lookup 0");
 303				return -EOPNOTSUPP;
 304			}
 305			if (filter->goto_target != -1) {
 306				NL_SET_ERR_MSG_MOD(extack,
 307						   "Last action must be GOTO");
 308				return -EOPNOTSUPP;
 309			}
 310			filter->action.mask_mode = OCELOT_MASK_MODE_PERMIT_DENY;
 311			filter->action.port_mask = 0;
 312			filter->action.cpu_copy_ena = true;
 313			filter->action.cpu_qu_num = 0;
 314			filter->type = OCELOT_VCAP_FILTER_OFFLOAD;
 315			filter->is_trap = true;
 316			break;
 317		case FLOW_ACTION_POLICE:
 318			if (filter->block_id == PSFP_BLOCK_ID) {
 319				filter->type = OCELOT_PSFP_FILTER_OFFLOAD;
 320				break;
 321			}
 322			if (filter->block_id != VCAP_IS2 ||
 323			    filter->lookup != 0) {
 324				NL_SET_ERR_MSG_MOD(extack,
 325						   "Police action can only be offloaded to VCAP IS2 lookup 0 or PSFP");
 326				return -EOPNOTSUPP;
 327			}
 328			if (filter->goto_target != -1) {
 329				NL_SET_ERR_MSG_MOD(extack,
 330						   "Last action must be GOTO");
 331				return -EOPNOTSUPP;
 332			}
 333
 334			err = ocelot_policer_validate(action, a, extack);
 335			if (err)
 336				return err;
 337
 338			filter->action.police_ena = true;
 339
 340			pol_ix = a->hw_index + ocelot->vcap_pol.base;
 341			pol_max = ocelot->vcap_pol.max;
 342
 343			if (ocelot->vcap_pol.max2 && pol_ix > pol_max) {
 344				pol_ix += ocelot->vcap_pol.base2 - pol_max - 1;
 345				pol_max = ocelot->vcap_pol.max2;
 346			}
 347
 348			if (pol_ix >= pol_max)
 349				return -EINVAL;
 350
 351			filter->action.pol_ix = pol_ix;
 352
 353			rate = a->police.rate_bytes_ps;
 354			filter->action.pol.rate = div_u64(rate, 1000) * 8;
 355			filter->action.pol.burst = a->police.burst;
 356			filter->type = OCELOT_VCAP_FILTER_OFFLOAD;
 357			break;
 358		case FLOW_ACTION_REDIRECT:
 359			if (filter->block_id != VCAP_IS2) {
 360				NL_SET_ERR_MSG_MOD(extack,
 361						   "Redirect action can only be offloaded to VCAP IS2");
 362				return -EOPNOTSUPP;
 363			}
 364			if (filter->goto_target != -1) {
 365				NL_SET_ERR_MSG_MOD(extack,
 366						   "Last action must be GOTO");
 367				return -EOPNOTSUPP;
 368			}
 369			egress_port = ocelot->ops->netdev_to_port(a->dev);
 370			if (egress_port < 0) {
 371				NL_SET_ERR_MSG_MOD(extack,
 372						   "Destination not an ocelot port");
 373				return -EOPNOTSUPP;
 374			}
 375			filter->action.mask_mode = OCELOT_MASK_MODE_REDIRECT;
 376			filter->action.port_mask = BIT(egress_port);
 377			filter->type = OCELOT_VCAP_FILTER_OFFLOAD;
 378			break;
 379		case FLOW_ACTION_MIRRED:
 380			if (filter->block_id != VCAP_IS2) {
 381				NL_SET_ERR_MSG_MOD(extack,
 382						   "Mirror action can only be offloaded to VCAP IS2");
 383				return -EOPNOTSUPP;
 384			}
 385			if (filter->goto_target != -1) {
 386				NL_SET_ERR_MSG_MOD(extack,
 387						   "Last action must be GOTO");
 388				return -EOPNOTSUPP;
 389			}
 390			egress_port = ocelot->ops->netdev_to_port(a->dev);
 391			if (egress_port < 0) {
 392				NL_SET_ERR_MSG_MOD(extack,
 393						   "Destination not an ocelot port");
 394				return -EOPNOTSUPP;
 395			}
 396			filter->egress_port.value = egress_port;
 397			filter->action.mirror_ena = true;
 398			filter->type = OCELOT_VCAP_FILTER_OFFLOAD;
 399			break;
 400		case FLOW_ACTION_VLAN_POP:
 401			if (filter->block_id != VCAP_IS1) {
 402				NL_SET_ERR_MSG_MOD(extack,
 403						   "VLAN pop action can only be offloaded to VCAP IS1");
 404				return -EOPNOTSUPP;
 405			}
 406			if (filter->goto_target != -1) {
 407				NL_SET_ERR_MSG_MOD(extack,
 408						   "Last action must be GOTO");
 409				return -EOPNOTSUPP;
 410			}
 411			filter->action.vlan_pop_cnt_ena = true;
 412			filter->action.vlan_pop_cnt++;
 413			if (filter->action.vlan_pop_cnt > 2) {
 414				NL_SET_ERR_MSG_MOD(extack,
 415						   "Cannot pop more than 2 VLAN headers");
 416				return -EOPNOTSUPP;
 417			}
 418			filter->type = OCELOT_VCAP_FILTER_OFFLOAD;
 419			break;
 420		case FLOW_ACTION_VLAN_MANGLE:
 421			if (filter->block_id == VCAP_IS1) {
 422				err = ocelot_flower_parse_ingress_vlan_modify(ocelot, port,
 423									      filter, a,
 424									      extack);
 425			} else if (filter->block_id == VCAP_ES0) {
 426				err = ocelot_flower_parse_egress_vlan_modify(filter, a,
 427									     extack);
 428			} else {
 429				NL_SET_ERR_MSG_MOD(extack,
 430						   "VLAN modify action can only be offloaded to VCAP IS1 or ES0");
 431				err = -EOPNOTSUPP;
 432			}
 433			if (err)
 434				return err;
 435			break;
 436		case FLOW_ACTION_PRIORITY:
 437			if (filter->block_id != VCAP_IS1) {
 438				NL_SET_ERR_MSG_MOD(extack,
 439						   "Priority action can only be offloaded to VCAP IS1");
 440				return -EOPNOTSUPP;
 441			}
 442			if (filter->goto_target != -1) {
 443				NL_SET_ERR_MSG_MOD(extack,
 444						   "Last action must be GOTO");
 445				return -EOPNOTSUPP;
 446			}
 447			filter->action.qos_ena = true;
 448			filter->action.qos_val = a->priority;
 449			filter->type = OCELOT_VCAP_FILTER_OFFLOAD;
 450			break;
 451		case FLOW_ACTION_GOTO:
 452			filter->goto_target = a->chain_index;
 453
 454			if (filter->block_id == VCAP_IS1 && filter->lookup == 2) {
 455				int pag = ocelot_chain_to_pag(filter->goto_target);
 456
 457				filter->action.pag_override_mask = 0xff;
 458				filter->action.pag_val = pag;
 459				filter->type = OCELOT_VCAP_FILTER_PAG;
 460			}
 461			break;
 462		case FLOW_ACTION_VLAN_PUSH:
 463			if (filter->block_id != VCAP_ES0) {
 464				NL_SET_ERR_MSG_MOD(extack,
 465						   "VLAN push action can only be offloaded to VCAP ES0");
 466				return -EOPNOTSUPP;
 467			}
 468			switch (ntohs(a->vlan.proto)) {
 469			case ETH_P_8021Q:
 470				tpid = OCELOT_TAG_TPID_SEL_8021Q;
 471				break;
 472			case ETH_P_8021AD:
 473				tpid = OCELOT_TAG_TPID_SEL_8021AD;
 474				break;
 475			default:
 476				NL_SET_ERR_MSG_MOD(extack,
 477						   "Cannot push custom TPID");
 478				return -EOPNOTSUPP;
 479			}
 480			filter->action.tag_a_tpid_sel = tpid;
 481			filter->action.push_outer_tag = OCELOT_ES0_TAG;
 482			filter->action.tag_a_vid_sel = OCELOT_ES0_VID;
 483			filter->action.vid_a_val = a->vlan.vid;
 484			filter->action.pcp_a_val = a->vlan.prio;
 485			filter->type = OCELOT_VCAP_FILTER_OFFLOAD;
 486			break;
 487		case FLOW_ACTION_GATE:
 488			if (filter->block_id != PSFP_BLOCK_ID) {
 489				NL_SET_ERR_MSG_MOD(extack,
 490						   "Gate action can only be offloaded to PSFP chain");
 491				return -EOPNOTSUPP;
 492			}
 493			filter->type = OCELOT_PSFP_FILTER_OFFLOAD;
 494			break;
 495		default:
 496			NL_SET_ERR_MSG_MOD(extack, "Cannot offload action");
 497			return -EOPNOTSUPP;
 498		}
 499	}
 500
 501	if (filter->goto_target == -1) {
 502		if ((filter->block_id == VCAP_IS2 && filter->lookup == 1) ||
 503		    chain == 0 || filter->block_id == PSFP_BLOCK_ID) {
 504			allow_missing_goto_target = true;
 505		} else {
 506			NL_SET_ERR_MSG_MOD(extack, "Missing GOTO action");
 507			return -EOPNOTSUPP;
 508		}
 509	}
 510
 511	if (!ocelot_is_goto_target_valid(filter->goto_target, chain, ingress) &&
 512	    !allow_missing_goto_target) {
 513		NL_SET_ERR_MSG_MOD(extack, "Cannot offload this GOTO target");
 514		return -EOPNOTSUPP;
 515	}
 516
 517	return 0;
 518}
 519
 520static int ocelot_flower_parse_indev(struct ocelot *ocelot, int port,
 521				     struct flow_cls_offload *f,
 522				     struct ocelot_vcap_filter *filter)
 523{
 524	struct flow_rule *rule = flow_cls_offload_flow_rule(f);
 525	const struct vcap_props *vcap = &ocelot->vcap[VCAP_ES0];
 526	int key_length = vcap->keys[VCAP_ES0_IGR_PORT].length;
 527	struct netlink_ext_ack *extack = f->common.extack;
 528	struct net_device *dev, *indev;
 529	struct flow_match_meta match;
 530	int ingress_port;
 531
 532	flow_rule_match_meta(rule, &match);
 533
 534	if (!match.mask->ingress_ifindex)
 535		return 0;
 536
 537	if (match.mask->ingress_ifindex != 0xFFFFFFFF) {
 538		NL_SET_ERR_MSG_MOD(extack, "Unsupported ingress ifindex mask");
 539		return -EOPNOTSUPP;
 540	}
 541
 542	dev = ocelot->ops->port_to_netdev(ocelot, port);
 543	if (!dev)
 544		return -EINVAL;
 545
 546	indev = __dev_get_by_index(dev_net(dev), match.key->ingress_ifindex);
 547	if (!indev) {
 548		NL_SET_ERR_MSG_MOD(extack,
 549				   "Can't find the ingress port to match on");
 550		return -ENOENT;
 551	}
 552
 553	ingress_port = ocelot->ops->netdev_to_port(indev);
 554	if (ingress_port < 0) {
 555		NL_SET_ERR_MSG_MOD(extack,
 556				   "Can only offload an ocelot ingress port");
 557		return -EOPNOTSUPP;
 558	}
 559	if (ingress_port == port) {
 560		NL_SET_ERR_MSG_MOD(extack,
 561				   "Ingress port is equal to the egress port");
 562		return -EINVAL;
 563	}
 564
 565	filter->ingress_port.value = ingress_port;
 566	filter->ingress_port.mask = GENMASK(key_length - 1, 0);
 567
 568	return 0;
 569}
 570
 571static int
 572ocelot_flower_parse_key(struct ocelot *ocelot, int port, bool ingress,
 573			struct flow_cls_offload *f,
 574			struct ocelot_vcap_filter *filter)
 575{
 576	struct flow_rule *rule = flow_cls_offload_flow_rule(f);
 577	struct flow_dissector *dissector = rule->match.dissector;
 578	struct netlink_ext_ack *extack = f->common.extack;
 579	u16 proto = ntohs(f->common.protocol);
 580	bool match_protocol = true;
 581	int ret;
 582
 583	if (dissector->used_keys &
 584	    ~(BIT_ULL(FLOW_DISSECTOR_KEY_CONTROL) |
 585	      BIT_ULL(FLOW_DISSECTOR_KEY_BASIC) |
 586	      BIT_ULL(FLOW_DISSECTOR_KEY_META) |
 587	      BIT_ULL(FLOW_DISSECTOR_KEY_PORTS) |
 588	      BIT_ULL(FLOW_DISSECTOR_KEY_VLAN) |
 589	      BIT_ULL(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
 590	      BIT_ULL(FLOW_DISSECTOR_KEY_IPV6_ADDRS) |
 591	      BIT_ULL(FLOW_DISSECTOR_KEY_ETH_ADDRS))) {
 592		return -EOPNOTSUPP;
 593	}
 594
 595	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META)) {
 596		struct flow_match_meta match;
 597
 598		flow_rule_match_meta(rule, &match);
 599		if (match.mask->l2_miss) {
 600			NL_SET_ERR_MSG_MOD(extack, "Can't match on \"l2_miss\"");
 601			return -EOPNOTSUPP;
 602		}
 603	}
 604
 605	/* For VCAP ES0 (egress rewriter) we can match on the ingress port */
 606	if (!ingress) {
 607		ret = ocelot_flower_parse_indev(ocelot, port, f, filter);
 608		if (ret)
 609			return ret;
 610	}
 611
 612	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CONTROL)) {
 613		struct flow_match_control match;
 614
 615		flow_rule_match_control(rule, &match);
 616	}
 617
 618	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) {
 619		struct flow_match_vlan match;
 620
 621		flow_rule_match_vlan(rule, &match);
 622		filter->key_type = OCELOT_VCAP_KEY_ANY;
 623		filter->vlan.vid.value = match.key->vlan_id;
 624		filter->vlan.vid.mask = match.mask->vlan_id;
 625		filter->vlan.pcp.value[0] = match.key->vlan_priority;
 626		filter->vlan.pcp.mask[0] = match.mask->vlan_priority;
 627		match_protocol = false;
 628	}
 629
 630	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
 631		struct flow_match_eth_addrs match;
 632
 633		if (filter->block_id == VCAP_ES0) {
 634			NL_SET_ERR_MSG_MOD(extack,
 635					   "VCAP ES0 cannot match on MAC address");
 636			return -EOPNOTSUPP;
 637		}
 638
 639		/* The hw support mac matches only for MAC_ETYPE key,
 640		 * therefore if other matches(port, tcp flags, etc) are added
 641		 * then just bail out
 642		 */
 643		if ((dissector->used_keys &
 644		    (BIT_ULL(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
 645		     BIT_ULL(FLOW_DISSECTOR_KEY_BASIC) |
 646		     BIT_ULL(FLOW_DISSECTOR_KEY_CONTROL))) !=
 647		    (BIT_ULL(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
 648		     BIT_ULL(FLOW_DISSECTOR_KEY_BASIC) |
 649		     BIT_ULL(FLOW_DISSECTOR_KEY_CONTROL)))
 650			return -EOPNOTSUPP;
 651
 652		flow_rule_match_eth_addrs(rule, &match);
 653
 654		if (filter->block_id == VCAP_IS1 &&
 655		    !is_zero_ether_addr(match.mask->dst)) {
 656			NL_SET_ERR_MSG_MOD(extack,
 657					   "Key type S1_NORMAL cannot match on destination MAC");
 658			return -EOPNOTSUPP;
 659		}
 660
 661		filter->key_type = OCELOT_VCAP_KEY_ETYPE;
 662		ether_addr_copy(filter->key.etype.dmac.value,
 663				match.key->dst);
 664		ether_addr_copy(filter->key.etype.smac.value,
 665				match.key->src);
 666		ether_addr_copy(filter->key.etype.dmac.mask,
 667				match.mask->dst);
 668		ether_addr_copy(filter->key.etype.smac.mask,
 669				match.mask->src);
 670		goto finished_key_parsing;
 671	}
 672
 673	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) {
 674		struct flow_match_basic match;
 675
 676		flow_rule_match_basic(rule, &match);
 677		if (ntohs(match.key->n_proto) == ETH_P_IP) {
 678			if (filter->block_id == VCAP_ES0) {
 679				NL_SET_ERR_MSG_MOD(extack,
 680						   "VCAP ES0 cannot match on IP protocol");
 681				return -EOPNOTSUPP;
 682			}
 683
 684			filter->key_type = OCELOT_VCAP_KEY_IPV4;
 685			filter->key.ipv4.proto.value[0] =
 686				match.key->ip_proto;
 687			filter->key.ipv4.proto.mask[0] =
 688				match.mask->ip_proto;
 689			match_protocol = false;
 690		}
 691		if (ntohs(match.key->n_proto) == ETH_P_IPV6) {
 692			if (filter->block_id == VCAP_ES0) {
 693				NL_SET_ERR_MSG_MOD(extack,
 694						   "VCAP ES0 cannot match on IP protocol");
 695				return -EOPNOTSUPP;
 696			}
 697
 698			filter->key_type = OCELOT_VCAP_KEY_IPV6;
 699			filter->key.ipv6.proto.value[0] =
 700				match.key->ip_proto;
 701			filter->key.ipv6.proto.mask[0] =
 702				match.mask->ip_proto;
 703			match_protocol = false;
 704		}
 705	}
 706
 707	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IPV4_ADDRS) &&
 708	    proto == ETH_P_IP) {
 709		struct flow_match_ipv4_addrs match;
 710		u8 *tmp;
 711
 712		if (filter->block_id == VCAP_ES0) {
 713			NL_SET_ERR_MSG_MOD(extack,
 714					   "VCAP ES0 cannot match on IP address");
 715			return -EOPNOTSUPP;
 716		}
 717
 718		flow_rule_match_ipv4_addrs(rule, &match);
 719
 720		if (filter->block_id == VCAP_IS1 && *(u32 *)&match.mask->dst) {
 721			NL_SET_ERR_MSG_MOD(extack,
 722					   "Key type S1_NORMAL cannot match on destination IP");
 723			return -EOPNOTSUPP;
 724		}
 725
 726		tmp = &filter->key.ipv4.sip.value.addr[0];
 727		memcpy(tmp, &match.key->src, 4);
 728
 729		tmp = &filter->key.ipv4.sip.mask.addr[0];
 730		memcpy(tmp, &match.mask->src, 4);
 731
 732		tmp = &filter->key.ipv4.dip.value.addr[0];
 733		memcpy(tmp, &match.key->dst, 4);
 734
 735		tmp = &filter->key.ipv4.dip.mask.addr[0];
 736		memcpy(tmp, &match.mask->dst, 4);
 737		match_protocol = false;
 738	}
 739
 740	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IPV6_ADDRS) &&
 741	    proto == ETH_P_IPV6) {
 742		return -EOPNOTSUPP;
 743	}
 744
 745	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS)) {
 746		struct flow_match_ports match;
 747
 748		if (filter->block_id == VCAP_ES0) {
 749			NL_SET_ERR_MSG_MOD(extack,
 750					   "VCAP ES0 cannot match on L4 ports");
 751			return -EOPNOTSUPP;
 752		}
 753
 754		flow_rule_match_ports(rule, &match);
 755		filter->key.ipv4.sport.value = ntohs(match.key->src);
 756		filter->key.ipv4.sport.mask = ntohs(match.mask->src);
 757		filter->key.ipv4.dport.value = ntohs(match.key->dst);
 758		filter->key.ipv4.dport.mask = ntohs(match.mask->dst);
 759		match_protocol = false;
 760	}
 761
 762finished_key_parsing:
 763	if (match_protocol && proto != ETH_P_ALL) {
 764		if (filter->block_id == VCAP_ES0) {
 765			NL_SET_ERR_MSG_MOD(extack,
 766					   "VCAP ES0 cannot match on L2 proto");
 767			return -EOPNOTSUPP;
 768		}
 769
 770		/* TODO: support SNAP, LLC etc */
 771		if (proto < ETH_P_802_3_MIN)
 772			return -EOPNOTSUPP;
 773		filter->key_type = OCELOT_VCAP_KEY_ETYPE;
 774		*(__be16 *)filter->key.etype.etype.value = htons(proto);
 775		*(__be16 *)filter->key.etype.etype.mask = htons(0xffff);
 776	}
 777	/* else, a filter of type OCELOT_VCAP_KEY_ANY is implicitly added */
 778
 779	return 0;
 780}
 781
 782static int ocelot_flower_parse(struct ocelot *ocelot, int port, bool ingress,
 783			       struct flow_cls_offload *f,
 784			       struct ocelot_vcap_filter *filter)
 785{
 786	int ret;
 787
 788	filter->prio = f->common.prio;
 789	filter->id.cookie = f->cookie;
 790	filter->id.tc_offload = true;
 791
 792	ret = ocelot_flower_parse_action(ocelot, port, ingress, f, filter);
 793	if (ret)
 794		return ret;
 795
 796	/* PSFP filter need to parse key by stream identification function. */
 797	if (filter->type == OCELOT_PSFP_FILTER_OFFLOAD)
 798		return 0;
 799
 800	return ocelot_flower_parse_key(ocelot, port, ingress, f, filter);
 801}
 802
 803static struct ocelot_vcap_filter
 804*ocelot_vcap_filter_create(struct ocelot *ocelot, int port, bool ingress,
 805			   struct flow_cls_offload *f)
 806{
 807	struct ocelot_vcap_filter *filter;
 808
 809	filter = kzalloc(sizeof(*filter), GFP_KERNEL);
 810	if (!filter)
 811		return NULL;
 812
 813	if (ingress) {
 814		filter->ingress_port_mask = BIT(port);
 815	} else {
 816		const struct vcap_props *vcap = &ocelot->vcap[VCAP_ES0];
 817		int key_length = vcap->keys[VCAP_ES0_EGR_PORT].length;
 818
 819		filter->egress_port.value = port;
 820		filter->egress_port.mask = GENMASK(key_length - 1, 0);
 821	}
 822
 823	return filter;
 824}
 825
 826static int ocelot_vcap_dummy_filter_add(struct ocelot *ocelot,
 827					struct ocelot_vcap_filter *filter)
 828{
 829	list_add(&filter->list, &ocelot->dummy_rules);
 830
 831	return 0;
 832}
 833
 834static int ocelot_vcap_dummy_filter_del(struct ocelot *ocelot,
 835					struct ocelot_vcap_filter *filter)
 836{
 837	list_del(&filter->list);
 838	kfree(filter);
 839
 840	return 0;
 841}
 842
 843/* If we have an egress VLAN modification rule, we need to actually write the
 844 * delta between the input VLAN (from the key) and the output VLAN (from the
 845 * action), but the action was parsed first. So we need to patch the delta into
 846 * the action here.
 847 */
 848static int
 849ocelot_flower_patch_es0_vlan_modify(struct ocelot_vcap_filter *filter,
 850				    struct netlink_ext_ack *extack)
 851{
 852	if (filter->block_id != VCAP_ES0 ||
 853	    filter->action.tag_a_vid_sel != OCELOT_ES0_VID_PLUS_CLASSIFIED_VID)
 854		return 0;
 855
 856	if (filter->vlan.vid.mask != VLAN_VID_MASK) {
 857		NL_SET_ERR_MSG_MOD(extack,
 858				   "VCAP ES0 VLAN rewriting needs a full VLAN in the key");
 859		return -EOPNOTSUPP;
 860	}
 861
 862	filter->action.vid_a_val -= filter->vlan.vid.value;
 863	filter->action.vid_a_val &= VLAN_VID_MASK;
 864
 865	return 0;
 866}
 867
 868int ocelot_cls_flower_replace(struct ocelot *ocelot, int port,
 869			      struct flow_cls_offload *f, bool ingress)
 870{
 871	struct netlink_ext_ack *extack = f->common.extack;
 872	struct ocelot_vcap_filter *filter;
 873	int chain = f->common.chain_index;
 874	int block_id, ret;
 875
 876	if (chain && !ocelot_find_vcap_filter_that_points_at(ocelot, chain)) {
 877		NL_SET_ERR_MSG_MOD(extack, "No default GOTO action points to this chain");
 878		return -EOPNOTSUPP;
 879	}
 880
 881	block_id = ocelot_chain_to_block(chain, ingress);
 882	if (block_id < 0) {
 883		NL_SET_ERR_MSG_MOD(extack, "Cannot offload to this chain");
 884		return -EOPNOTSUPP;
 885	}
 886
 887	filter = ocelot_vcap_block_find_filter_by_id(&ocelot->block[block_id],
 888						     f->cookie, true);
 889	if (filter) {
 890		/* Filter already exists on other ports */
 891		if (!ingress) {
 892			NL_SET_ERR_MSG_MOD(extack, "VCAP ES0 does not support shared filters");
 893			return -EOPNOTSUPP;
 894		}
 895
 896		filter->ingress_port_mask |= BIT(port);
 897
 898		return ocelot_vcap_filter_replace(ocelot, filter);
 899	}
 900
 901	/* Filter didn't exist, create it now */
 902	filter = ocelot_vcap_filter_create(ocelot, port, ingress, f);
 903	if (!filter)
 904		return -ENOMEM;
 905
 906	ret = ocelot_flower_parse(ocelot, port, ingress, f, filter);
 907	if (ret) {
 908		kfree(filter);
 909		return ret;
 910	}
 911
 912	ret = ocelot_flower_patch_es0_vlan_modify(filter, extack);
 913	if (ret) {
 914		kfree(filter);
 915		return ret;
 916	}
 917
 918	/* The non-optional GOTOs for the TCAM skeleton don't need
 919	 * to be actually offloaded.
 920	 */
 921	if (filter->type == OCELOT_VCAP_FILTER_DUMMY)
 922		return ocelot_vcap_dummy_filter_add(ocelot, filter);
 923
 924	if (filter->type == OCELOT_PSFP_FILTER_OFFLOAD) {
 925		kfree(filter);
 926		if (ocelot->ops->psfp_filter_add)
 927			return ocelot->ops->psfp_filter_add(ocelot, port, f);
 928
 929		NL_SET_ERR_MSG_MOD(extack, "PSFP chain is not supported in HW");
 930		return -EOPNOTSUPP;
 931	}
 932
 933	return ocelot_vcap_filter_add(ocelot, filter, f->common.extack);
 934}
 935EXPORT_SYMBOL_GPL(ocelot_cls_flower_replace);
 936
 937int ocelot_cls_flower_destroy(struct ocelot *ocelot, int port,
 938			      struct flow_cls_offload *f, bool ingress)
 939{
 940	struct ocelot_vcap_filter *filter;
 941	struct ocelot_vcap_block *block;
 942	int block_id;
 943
 944	block_id = ocelot_chain_to_block(f->common.chain_index, ingress);
 945	if (block_id < 0)
 946		return 0;
 947
 948	if (block_id == PSFP_BLOCK_ID) {
 949		if (ocelot->ops->psfp_filter_del)
 950			return ocelot->ops->psfp_filter_del(ocelot, f);
 951
 952		return -EOPNOTSUPP;
 953	}
 954
 955	block = &ocelot->block[block_id];
 956
 957	filter = ocelot_vcap_block_find_filter_by_id(block, f->cookie, true);
 958	if (!filter)
 959		return 0;
 960
 961	if (filter->type == OCELOT_VCAP_FILTER_DUMMY)
 962		return ocelot_vcap_dummy_filter_del(ocelot, filter);
 963
 964	if (ingress) {
 965		filter->ingress_port_mask &= ~BIT(port);
 966		if (filter->ingress_port_mask)
 967			return ocelot_vcap_filter_replace(ocelot, filter);
 968	}
 969
 970	return ocelot_vcap_filter_del(ocelot, filter);
 971}
 972EXPORT_SYMBOL_GPL(ocelot_cls_flower_destroy);
 973
 974int ocelot_cls_flower_stats(struct ocelot *ocelot, int port,
 975			    struct flow_cls_offload *f, bool ingress)
 976{
 977	struct ocelot_vcap_filter *filter;
 978	struct ocelot_vcap_block *block;
 979	struct flow_stats stats = {0};
 980	int block_id, ret;
 981
 982	block_id = ocelot_chain_to_block(f->common.chain_index, ingress);
 983	if (block_id < 0)
 984		return 0;
 985
 986	if (block_id == PSFP_BLOCK_ID) {
 987		if (ocelot->ops->psfp_stats_get) {
 988			ret = ocelot->ops->psfp_stats_get(ocelot, f, &stats);
 989			if (ret)
 990				return ret;
 991
 992			goto stats_update;
 993		}
 994
 995		return -EOPNOTSUPP;
 996	}
 997
 998	block = &ocelot->block[block_id];
 999
1000	filter = ocelot_vcap_block_find_filter_by_id(block, f->cookie, true);
1001	if (!filter || filter->type == OCELOT_VCAP_FILTER_DUMMY)
1002		return 0;
1003
1004	ret = ocelot_vcap_filter_stats_update(ocelot, filter);
1005	if (ret)
1006		return ret;
1007
1008	stats.pkts = filter->stats.pkts;
1009
1010stats_update:
1011	flow_stats_update(&f->stats, 0x0, stats.pkts, stats.drops, 0x0,
1012			  FLOW_ACTION_HW_STATS_IMMEDIATE);
1013	return 0;
1014}
1015EXPORT_SYMBOL_GPL(ocelot_cls_flower_stats);