Linux Audio

Check our new training course

In-person Linux kernel drivers training

Jun 16-20, 2025
Register
Loading...
v6.9.4
  1// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
  2/* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  3
  4#include <linux/kernel.h>
  5#include <linux/errno.h>
  6#include <linux/netdevice.h>
  7#include <linux/log2.h>
  8#include <net/net_namespace.h>
  9#include <net/flow_dissector.h>
 10#include <net/pkt_cls.h>
 11#include <net/tc_act/tc_gact.h>
 12#include <net/tc_act/tc_mirred.h>
 13#include <net/tc_act/tc_vlan.h>
 14
 15#include "spectrum.h"
 16#include "core_acl_flex_keys.h"
 17
 18static int mlxsw_sp_policer_validate(const struct flow_action *action,
 19				     const struct flow_action_entry *act,
 20				     struct netlink_ext_ack *extack)
 21{
 22	if (act->police.exceed.act_id != FLOW_ACTION_DROP) {
 23		NL_SET_ERR_MSG_MOD(extack,
 24				   "Offload not supported when exceed action is not drop");
 25		return -EOPNOTSUPP;
 26	}
 27
 28	if (act->police.notexceed.act_id != FLOW_ACTION_PIPE &&
 29	    act->police.notexceed.act_id != FLOW_ACTION_ACCEPT) {
 30		NL_SET_ERR_MSG_MOD(extack,
 31				   "Offload not supported when conform action is not pipe or ok");
 32		return -EOPNOTSUPP;
 33	}
 34
 35	if (act->police.notexceed.act_id == FLOW_ACTION_ACCEPT &&
 36	    !flow_action_is_last_entry(action, act)) {
 37		NL_SET_ERR_MSG_MOD(extack,
 38				   "Offload not supported when conform action is ok, but action is not last");
 39		return -EOPNOTSUPP;
 40	}
 41
 42	if (act->police.peakrate_bytes_ps ||
 43	    act->police.avrate || act->police.overhead) {
 44		NL_SET_ERR_MSG_MOD(extack,
 45				   "Offload not supported when peakrate/avrate/overhead is configured");
 46		return -EOPNOTSUPP;
 47	}
 48
 49	if (act->police.rate_pkt_ps) {
 50		NL_SET_ERR_MSG_MOD(extack,
 51				   "QoS offload not support packets per second");
 52		return -EOPNOTSUPP;
 53	}
 54
 55	return 0;
 56}
 57
 58static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
 59					 struct mlxsw_sp_flow_block *block,
 60					 struct mlxsw_sp_acl_rule_info *rulei,
 61					 struct flow_action *flow_action,
 62					 struct netlink_ext_ack *extack)
 63{
 64	const struct flow_action_entry *act;
 65	int mirror_act_count = 0;
 66	int police_act_count = 0;
 67	int sample_act_count = 0;
 68	int err, i;
 69
 70	if (!flow_action_has_entries(flow_action))
 71		return 0;
 72	if (!flow_action_mixed_hw_stats_check(flow_action, extack))
 73		return -EOPNOTSUPP;
 74
 75	act = flow_action_first_entry_get(flow_action);
 76	if (act->hw_stats & FLOW_ACTION_HW_STATS_DISABLED) {
 77		/* Nothing to do */
 78	} else if (act->hw_stats & FLOW_ACTION_HW_STATS_IMMEDIATE) {
 79		/* Count action is inserted first */
 80		err = mlxsw_sp_acl_rulei_act_count(mlxsw_sp, rulei, extack);
 81		if (err)
 82			return err;
 83	} else {
 84		NL_SET_ERR_MSG_MOD(extack, "Unsupported action HW stats type");
 85		return -EOPNOTSUPP;
 86	}
 87
 88	flow_action_for_each(i, act, flow_action) {
 89		switch (act->id) {
 90		case FLOW_ACTION_ACCEPT:
 91			err = mlxsw_sp_acl_rulei_act_terminate(rulei);
 92			if (err) {
 93				NL_SET_ERR_MSG_MOD(extack, "Cannot append terminate action");
 94				return err;
 95			}
 96			break;
 97		case FLOW_ACTION_DROP: {
 98			bool ingress;
 99
100			if (mlxsw_sp_flow_block_is_mixed_bound(block)) {
101				NL_SET_ERR_MSG_MOD(extack, "Drop action is not supported when block is bound to ingress and egress");
102				return -EOPNOTSUPP;
103			}
104			ingress = mlxsw_sp_flow_block_is_ingress_bound(block);
105			err = mlxsw_sp_acl_rulei_act_drop(rulei, ingress,
106							  act->user_cookie, extack);
107			if (err) {
108				NL_SET_ERR_MSG_MOD(extack, "Cannot append drop action");
109				return err;
110			}
111
112			/* Forbid block with this rulei to be bound
113			 * to ingress/egress in future. Ingress rule is
114			 * a blocker for egress and vice versa.
115			 */
116			if (ingress)
117				rulei->egress_bind_blocker = 1;
118			else
119				rulei->ingress_bind_blocker = 1;
120			}
121			break;
122		case FLOW_ACTION_TRAP:
123			err = mlxsw_sp_acl_rulei_act_trap(rulei);
124			if (err) {
125				NL_SET_ERR_MSG_MOD(extack, "Cannot append trap action");
126				return err;
127			}
128			break;
129		case FLOW_ACTION_GOTO: {
130			u32 chain_index = act->chain_index;
131			struct mlxsw_sp_acl_ruleset *ruleset;
132			u16 group_id;
133
134			ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
135							      chain_index,
136							      MLXSW_SP_ACL_PROFILE_FLOWER);
137			if (IS_ERR(ruleset))
138				return PTR_ERR(ruleset);
139
140			group_id = mlxsw_sp_acl_ruleset_group_id(ruleset);
141			err = mlxsw_sp_acl_rulei_act_jump(rulei, group_id);
142			if (err) {
143				NL_SET_ERR_MSG_MOD(extack, "Cannot append jump action");
144				return err;
145			}
146			}
147			break;
148		case FLOW_ACTION_REDIRECT: {
149			struct net_device *out_dev;
150			struct mlxsw_sp_fid *fid;
151			u16 fid_index;
152
153			if (mlxsw_sp_flow_block_is_egress_bound(block)) {
154				NL_SET_ERR_MSG_MOD(extack, "Redirect action is not supported on egress");
155				return -EOPNOTSUPP;
156			}
157
158			/* Forbid block with this rulei to be bound
159			 * to egress in future.
160			 */
161			rulei->egress_bind_blocker = 1;
162
163			/* Ignore learning and security lookup as redirection
164			 * using ingress filters happens before the bridge.
165			 */
166			err = mlxsw_sp_acl_rulei_act_ignore(mlxsw_sp, rulei,
167							    true, true);
168			if (err) {
169				NL_SET_ERR_MSG_MOD(extack, "Cannot append ignore action");
170				return err;
171			}
172
173			fid = mlxsw_sp_acl_dummy_fid(mlxsw_sp);
174			fid_index = mlxsw_sp_fid_index(fid);
175			err = mlxsw_sp_acl_rulei_act_fid_set(mlxsw_sp, rulei,
176							     fid_index, extack);
177			if (err)
178				return err;
179
180			out_dev = act->dev;
181			err = mlxsw_sp_acl_rulei_act_fwd(mlxsw_sp, rulei,
182							 out_dev, extack);
183			if (err)
184				return err;
185			}
186			break;
187		case FLOW_ACTION_MIRRED: {
188			struct net_device *out_dev = act->dev;
189
190			if (mirror_act_count++) {
191				NL_SET_ERR_MSG_MOD(extack, "Multiple mirror actions per rule are not supported");
192				return -EOPNOTSUPP;
193			}
194
195			err = mlxsw_sp_acl_rulei_act_mirror(mlxsw_sp, rulei,
196							    block, out_dev,
197							    extack);
198			if (err)
199				return err;
200			}
201			break;
202		case FLOW_ACTION_VLAN_MANGLE: {
203			u16 proto = be16_to_cpu(act->vlan.proto);
204			u8 prio = act->vlan.prio;
205			u16 vid = act->vlan.vid;
206
207			err = mlxsw_sp_acl_rulei_act_vlan(mlxsw_sp, rulei,
208							  act->id, vid,
209							  proto, prio, extack);
210			if (err)
211				return err;
212			break;
213			}
214		case FLOW_ACTION_PRIORITY:
215			err = mlxsw_sp_acl_rulei_act_priority(mlxsw_sp, rulei,
216							      act->priority,
217							      extack);
218			if (err)
219				return err;
220			break;
221		case FLOW_ACTION_MANGLE: {
222			enum flow_action_mangle_base htype = act->mangle.htype;
223			__be32 be_mask = (__force __be32) act->mangle.mask;
224			__be32 be_val = (__force __be32) act->mangle.val;
225			u32 offset = act->mangle.offset;
226			u32 mask = be32_to_cpu(be_mask);
227			u32 val = be32_to_cpu(be_val);
228
229			err = mlxsw_sp_acl_rulei_act_mangle(mlxsw_sp, rulei,
230							    htype, offset,
231							    mask, val, extack);
232			if (err)
233				return err;
234			break;
235			}
236		case FLOW_ACTION_POLICE: {
237			u32 burst;
238
239			if (police_act_count++) {
240				NL_SET_ERR_MSG_MOD(extack, "Multiple police actions per rule are not supported");
241				return -EOPNOTSUPP;
242			}
243
244			err = mlxsw_sp_policer_validate(flow_action, act, extack);
245			if (err)
246				return err;
247
248			/* The kernel might adjust the requested burst size so
249			 * that it is not exactly a power of two. Re-adjust it
250			 * here since the hardware only supports burst sizes
251			 * that are a power of two.
252			 */
253			burst = roundup_pow_of_two(act->police.burst);
254			err = mlxsw_sp_acl_rulei_act_police(mlxsw_sp, rulei,
255							    act->hw_index,
256							    act->police.rate_bytes_ps,
257							    burst, extack);
258			if (err)
259				return err;
260			break;
261			}
262		case FLOW_ACTION_SAMPLE: {
263			if (sample_act_count++) {
264				NL_SET_ERR_MSG_MOD(extack, "Multiple sample actions per rule are not supported");
265				return -EOPNOTSUPP;
266			}
267
268			err = mlxsw_sp_acl_rulei_act_sample(mlxsw_sp, rulei,
269							    block,
270							    act->sample.psample_group,
271							    act->sample.rate,
272							    act->sample.trunc_size,
273							    act->sample.truncate,
274							    extack);
275			if (err)
276				return err;
277			break;
278			}
279		default:
280			NL_SET_ERR_MSG_MOD(extack, "Unsupported action");
281			dev_err(mlxsw_sp->bus_info->dev, "Unsupported action\n");
282			return -EOPNOTSUPP;
283		}
284	}
285
286	if (rulei->ipv6_valid) {
287		NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field");
288		return -EOPNOTSUPP;
289	}
290
291	return 0;
292}
293
294static int
295mlxsw_sp_flower_parse_meta_iif(struct mlxsw_sp_acl_rule_info *rulei,
296			       const struct mlxsw_sp_flow_block *block,
297			       const struct flow_match_meta *match,
298			       struct netlink_ext_ack *extack)
299{
300	struct mlxsw_sp_port *mlxsw_sp_port;
301	struct net_device *ingress_dev;
302
303	if (!match->mask->ingress_ifindex)
304		return 0;
305
306	if (match->mask->ingress_ifindex != 0xFFFFFFFF) {
307		NL_SET_ERR_MSG_MOD(extack, "Unsupported ingress ifindex mask");
308		return -EINVAL;
309	}
310
311	ingress_dev = __dev_get_by_index(block->net,
312					 match->key->ingress_ifindex);
313	if (!ingress_dev) {
314		NL_SET_ERR_MSG_MOD(extack, "Can't find specified ingress port to match on");
315		return -EINVAL;
316	}
317
318	if (!mlxsw_sp_port_dev_check(ingress_dev)) {
319		NL_SET_ERR_MSG_MOD(extack, "Can't match on non-mlxsw ingress port");
320		return -EINVAL;
321	}
322
323	mlxsw_sp_port = netdev_priv(ingress_dev);
324	if (mlxsw_sp_port->mlxsw_sp != block->mlxsw_sp) {
325		NL_SET_ERR_MSG_MOD(extack, "Can't match on a port from different device");
326		return -EINVAL;
327	}
328
329	mlxsw_sp_acl_rulei_keymask_u32(rulei,
330				       MLXSW_AFK_ELEMENT_SRC_SYS_PORT,
331				       mlxsw_sp_port->local_port,
332				       0xFFFFFFFF);
333
334	return 0;
335}
336
337static int mlxsw_sp_flower_parse_meta(struct mlxsw_sp_acl_rule_info *rulei,
338				      struct flow_cls_offload *f,
339				      struct mlxsw_sp_flow_block *block)
340{
341	struct flow_rule *rule = flow_cls_offload_flow_rule(f);
342	struct flow_match_meta match;
343
344	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META))
345		return 0;
346
347	flow_rule_match_meta(rule, &match);
348
349	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_FDB_MISS,
350				       match.key->l2_miss, match.mask->l2_miss);
351
352	return mlxsw_sp_flower_parse_meta_iif(rulei, block, &match,
353					      f->common.extack);
354}
355
356static void mlxsw_sp_flower_parse_ipv4(struct mlxsw_sp_acl_rule_info *rulei,
357				       struct flow_cls_offload *f)
358{
359	struct flow_match_ipv4_addrs match;
360
361	flow_rule_match_ipv4_addrs(f->rule, &match);
362
363	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31,
364				       (char *) &match.key->src,
365				       (char *) &match.mask->src, 4);
366	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31,
367				       (char *) &match.key->dst,
368				       (char *) &match.mask->dst, 4);
 
 
 
369}
370
371static void mlxsw_sp_flower_parse_ipv6(struct mlxsw_sp_acl_rule_info *rulei,
372				       struct flow_cls_offload *f)
373{
374	struct flow_match_ipv6_addrs match;
375
376	flow_rule_match_ipv6_addrs(f->rule, &match);
377
378	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_96_127,
379				       &match.key->src.s6_addr[0x0],
380				       &match.mask->src.s6_addr[0x0], 4);
381	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_64_95,
382				       &match.key->src.s6_addr[0x4],
383				       &match.mask->src.s6_addr[0x4], 4);
384	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_32_63,
385				       &match.key->src.s6_addr[0x8],
386				       &match.mask->src.s6_addr[0x8], 4);
387	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31,
388				       &match.key->src.s6_addr[0xC],
389				       &match.mask->src.s6_addr[0xC], 4);
390	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_96_127,
391				       &match.key->dst.s6_addr[0x0],
392				       &match.mask->dst.s6_addr[0x0], 4);
393	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_64_95,
394				       &match.key->dst.s6_addr[0x4],
395				       &match.mask->dst.s6_addr[0x4], 4);
396	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_32_63,
397				       &match.key->dst.s6_addr[0x8],
398				       &match.mask->dst.s6_addr[0x8], 4);
399	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31,
400				       &match.key->dst.s6_addr[0xC],
401				       &match.mask->dst.s6_addr[0xC], 4);
402}
403
404static int mlxsw_sp_flower_parse_ports(struct mlxsw_sp *mlxsw_sp,
405				       struct mlxsw_sp_acl_rule_info *rulei,
406				       struct flow_cls_offload *f,
407				       u8 ip_proto)
408{
409	const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
410	struct flow_match_ports match;
411
412	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS))
413		return 0;
414
415	if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
416		NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported");
417		dev_err(mlxsw_sp->bus_info->dev, "Only UDP and TCP keys are supported\n");
418		return -EINVAL;
419	}
420
421	flow_rule_match_ports(rule, &match);
 
 
 
 
 
422	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_L4_PORT,
423				       ntohs(match.key->dst),
424				       ntohs(match.mask->dst));
425	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_L4_PORT,
426				       ntohs(match.key->src),
427				       ntohs(match.mask->src));
428	return 0;
429}
430
431static int
432mlxsw_sp_flower_parse_ports_range(struct mlxsw_sp *mlxsw_sp,
433				  struct mlxsw_sp_acl_rule_info *rulei,
434				  struct flow_cls_offload *f, u8 ip_proto)
435{
436	const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
437	struct flow_match_ports_range match;
438	u32 key_mask_value = 0;
439
440	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS_RANGE))
441		return 0;
442
443	if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
444		NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported");
445		return -EINVAL;
446	}
447
448	flow_rule_match_ports_range(rule, &match);
449
450	if (match.mask->tp_min.src) {
451		struct mlxsw_sp_port_range range = {
452			.min = ntohs(match.key->tp_min.src),
453			.max = ntohs(match.key->tp_max.src),
454			.source = true,
455		};
456		u8 prr_index;
457		int err;
458
459		err = mlxsw_sp_port_range_reg_get(mlxsw_sp, &range,
460						  f->common.extack, &prr_index);
461		if (err)
462			return err;
463
464		rulei->src_port_range_reg_index = prr_index;
465		rulei->src_port_range_reg_valid = true;
466		key_mask_value |= BIT(prr_index);
467	}
468
469	if (match.mask->tp_min.dst) {
470		struct mlxsw_sp_port_range range = {
471			.min = ntohs(match.key->tp_min.dst),
472			.max = ntohs(match.key->tp_max.dst),
473		};
474		u8 prr_index;
475		int err;
476
477		err = mlxsw_sp_port_range_reg_get(mlxsw_sp, &range,
478						  f->common.extack, &prr_index);
479		if (err)
480			return err;
481
482		rulei->dst_port_range_reg_index = prr_index;
483		rulei->dst_port_range_reg_valid = true;
484		key_mask_value |= BIT(prr_index);
485	}
486
487	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_L4_PORT_RANGE,
488				       key_mask_value, key_mask_value);
489
490	return 0;
491}
492
493static int mlxsw_sp_flower_parse_tcp(struct mlxsw_sp *mlxsw_sp,
494				     struct mlxsw_sp_acl_rule_info *rulei,
495				     struct flow_cls_offload *f,
496				     u8 ip_proto)
497{
498	const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
499	struct flow_match_tcp match;
500
501	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_TCP))
502		return 0;
503
504	if (ip_proto != IPPROTO_TCP) {
505		NL_SET_ERR_MSG_MOD(f->common.extack, "TCP keys supported only for TCP");
506		dev_err(mlxsw_sp->bus_info->dev, "TCP keys supported only for TCP\n");
507		return -EINVAL;
508	}
509
510	flow_rule_match_tcp(rule, &match);
511
512	if (match.mask->flags & htons(0x0E00)) {
513		NL_SET_ERR_MSG_MOD(f->common.extack, "TCP flags match not supported on reserved bits");
514		dev_err(mlxsw_sp->bus_info->dev, "TCP flags match not supported on reserved bits\n");
515		return -EINVAL;
516	}
517
518	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_TCP_FLAGS,
519				       ntohs(match.key->flags),
520				       ntohs(match.mask->flags));
521	return 0;
522}
523
524static int mlxsw_sp_flower_parse_ip(struct mlxsw_sp *mlxsw_sp,
525				    struct mlxsw_sp_acl_rule_info *rulei,
526				    struct flow_cls_offload *f,
527				    u16 n_proto)
528{
529	const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
530	struct flow_match_ip match;
531
532	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IP))
533		return 0;
534
535	if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6) {
536		NL_SET_ERR_MSG_MOD(f->common.extack, "IP keys supported only for IPv4/6");
537		dev_err(mlxsw_sp->bus_info->dev, "IP keys supported only for IPv4/6\n");
538		return -EINVAL;
539	}
540
541	flow_rule_match_ip(rule, &match);
542
 
 
 
 
543	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_TTL_,
544				       match.key->ttl, match.mask->ttl);
545
546	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_ECN,
547				       match.key->tos & 0x3,
548				       match.mask->tos & 0x3);
549
550	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_DSCP,
551				       match.key->tos >> 2,
552				       match.mask->tos >> 2);
553
554	return 0;
555}
556
557static int mlxsw_sp_flower_parse(struct mlxsw_sp *mlxsw_sp,
558				 struct mlxsw_sp_flow_block *block,
559				 struct mlxsw_sp_acl_rule_info *rulei,
560				 struct flow_cls_offload *f)
561{
562	struct flow_rule *rule = flow_cls_offload_flow_rule(f);
563	struct flow_dissector *dissector = rule->match.dissector;
564	u16 n_proto_mask = 0;
565	u16 n_proto_key = 0;
566	u16 addr_type = 0;
567	u8 ip_proto = 0;
568	int err;
569
570	if (dissector->used_keys &
571	    ~(BIT_ULL(FLOW_DISSECTOR_KEY_META) |
572	      BIT_ULL(FLOW_DISSECTOR_KEY_CONTROL) |
573	      BIT_ULL(FLOW_DISSECTOR_KEY_BASIC) |
574	      BIT_ULL(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
575	      BIT_ULL(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
576	      BIT_ULL(FLOW_DISSECTOR_KEY_IPV6_ADDRS) |
577	      BIT_ULL(FLOW_DISSECTOR_KEY_PORTS) |
578	      BIT_ULL(FLOW_DISSECTOR_KEY_PORTS_RANGE) |
579	      BIT_ULL(FLOW_DISSECTOR_KEY_TCP) |
580	      BIT_ULL(FLOW_DISSECTOR_KEY_IP) |
581	      BIT_ULL(FLOW_DISSECTOR_KEY_VLAN))) {
582		dev_err(mlxsw_sp->bus_info->dev, "Unsupported key\n");
583		NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported key");
584		return -EOPNOTSUPP;
585	}
586
587	mlxsw_sp_acl_rulei_priority(rulei, f->common.prio);
588
589	err = mlxsw_sp_flower_parse_meta(rulei, f, block);
590	if (err)
591		return err;
592
593	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CONTROL)) {
594		struct flow_match_control match;
595
596		flow_rule_match_control(rule, &match);
597		addr_type = match.key->addr_type;
598	}
599
600	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) {
601		struct flow_match_basic match;
602
603		flow_rule_match_basic(rule, &match);
604		n_proto_key = ntohs(match.key->n_proto);
605		n_proto_mask = ntohs(match.mask->n_proto);
 
 
606
607		if (n_proto_key == ETH_P_ALL) {
608			n_proto_key = 0;
609			n_proto_mask = 0;
610		}
611		mlxsw_sp_acl_rulei_keymask_u32(rulei,
612					       MLXSW_AFK_ELEMENT_ETHERTYPE,
613					       n_proto_key, n_proto_mask);
614
615		ip_proto = match.key->ip_proto;
616		mlxsw_sp_acl_rulei_keymask_u32(rulei,
617					       MLXSW_AFK_ELEMENT_IP_PROTO,
618					       match.key->ip_proto,
619					       match.mask->ip_proto);
620	}
621
622	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
623		struct flow_match_eth_addrs match;
 
 
 
 
 
 
 
624
625		flow_rule_match_eth_addrs(rule, &match);
626		mlxsw_sp_acl_rulei_keymask_buf(rulei,
627					       MLXSW_AFK_ELEMENT_DMAC_32_47,
628					       match.key->dst,
629					       match.mask->dst, 2);
630		mlxsw_sp_acl_rulei_keymask_buf(rulei,
631					       MLXSW_AFK_ELEMENT_DMAC_0_31,
632					       match.key->dst + 2,
633					       match.mask->dst + 2, 4);
634		mlxsw_sp_acl_rulei_keymask_buf(rulei,
635					       MLXSW_AFK_ELEMENT_SMAC_32_47,
636					       match.key->src,
637					       match.mask->src, 2);
638		mlxsw_sp_acl_rulei_keymask_buf(rulei,
639					       MLXSW_AFK_ELEMENT_SMAC_0_31,
640					       match.key->src + 2,
641					       match.mask->src + 2, 4);
642	}
643
644	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) {
645		struct flow_match_vlan match;
646
647		flow_rule_match_vlan(rule, &match);
648		if (mlxsw_sp_flow_block_is_egress_bound(block) &&
649		    match.mask->vlan_id) {
650			NL_SET_ERR_MSG_MOD(f->common.extack, "vlan_id key is not supported on egress");
651			return -EOPNOTSUPP;
652		}
653
654		/* Forbid block with this rulei to be bound
655		 * to egress in future.
656		 */
657		rulei->egress_bind_blocker = 1;
658
659		if (match.mask->vlan_id != 0)
660			mlxsw_sp_acl_rulei_keymask_u32(rulei,
661						       MLXSW_AFK_ELEMENT_VID,
662						       match.key->vlan_id,
663						       match.mask->vlan_id);
664		if (match.mask->vlan_priority != 0)
665			mlxsw_sp_acl_rulei_keymask_u32(rulei,
666						       MLXSW_AFK_ELEMENT_PCP,
667						       match.key->vlan_priority,
668						       match.mask->vlan_priority);
669	}
670
671	if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS)
672		mlxsw_sp_flower_parse_ipv4(rulei, f);
673
674	if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS)
675		mlxsw_sp_flower_parse_ipv6(rulei, f);
676
677	err = mlxsw_sp_flower_parse_ports(mlxsw_sp, rulei, f, ip_proto);
678	if (err)
679		return err;
680
681	err = mlxsw_sp_flower_parse_ports_range(mlxsw_sp, rulei, f, ip_proto);
682	if (err)
683		return err;
684
685	err = mlxsw_sp_flower_parse_tcp(mlxsw_sp, rulei, f, ip_proto);
686	if (err)
687		return err;
688
689	err = mlxsw_sp_flower_parse_ip(mlxsw_sp, rulei, f, n_proto_key & n_proto_mask);
690	if (err)
691		return err;
692
693	return mlxsw_sp_flower_parse_actions(mlxsw_sp, block, rulei,
694					     &f->rule->action,
695					     f->common.extack);
696}
697
698static int mlxsw_sp_flower_mall_prio_check(struct mlxsw_sp_flow_block *block,
699					   struct flow_cls_offload *f)
700{
701	bool ingress = mlxsw_sp_flow_block_is_ingress_bound(block);
702	unsigned int mall_min_prio;
703	unsigned int mall_max_prio;
704	int err;
705
706	err = mlxsw_sp_mall_prio_get(block, f->common.chain_index,
707				     &mall_min_prio, &mall_max_prio);
708	if (err) {
709		if (err == -ENOENT)
710			/* No matchall filters installed on this chain. */
711			return 0;
712		NL_SET_ERR_MSG(f->common.extack, "Failed to get matchall priorities");
713		return err;
714	}
715	if (ingress && f->common.prio <= mall_min_prio) {
716		NL_SET_ERR_MSG(f->common.extack, "Failed to add in front of existing matchall rules");
717		return -EOPNOTSUPP;
718	}
719	if (!ingress && f->common.prio >= mall_max_prio) {
720		NL_SET_ERR_MSG(f->common.extack, "Failed to add behind of existing matchall rules");
721		return -EOPNOTSUPP;
722	}
723	return 0;
724}
725
726int mlxsw_sp_flower_replace(struct mlxsw_sp *mlxsw_sp,
727			    struct mlxsw_sp_flow_block *block,
728			    struct flow_cls_offload *f)
729{
730	struct mlxsw_sp_acl_rule_info *rulei;
731	struct mlxsw_sp_acl_ruleset *ruleset;
732	struct mlxsw_sp_acl_rule *rule;
733	int err;
734
735	err = mlxsw_sp_flower_mall_prio_check(block, f);
736	if (err)
737		return err;
738
739	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
740					   f->common.chain_index,
741					   MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
742	if (IS_ERR(ruleset))
743		return PTR_ERR(ruleset);
744
745	rule = mlxsw_sp_acl_rule_create(mlxsw_sp, ruleset, f->cookie, NULL,
746					f->common.extack);
747	if (IS_ERR(rule)) {
748		err = PTR_ERR(rule);
749		goto err_rule_create;
750	}
751
752	rulei = mlxsw_sp_acl_rule_rulei(rule);
753	err = mlxsw_sp_flower_parse(mlxsw_sp, block, rulei, f);
754	if (err)
755		goto err_flower_parse;
756
757	err = mlxsw_sp_acl_rulei_commit(rulei);
758	if (err)
759		goto err_rulei_commit;
760
761	err = mlxsw_sp_acl_rule_add(mlxsw_sp, rule);
762	if (err)
763		goto err_rule_add;
764
765	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
766	return 0;
767
768err_rule_add:
769err_rulei_commit:
770err_flower_parse:
771	mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
772err_rule_create:
773	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
774	return err;
775}
776
777void mlxsw_sp_flower_destroy(struct mlxsw_sp *mlxsw_sp,
778			     struct mlxsw_sp_flow_block *block,
779			     struct flow_cls_offload *f)
780{
781	struct mlxsw_sp_acl_ruleset *ruleset;
782	struct mlxsw_sp_acl_rule *rule;
783
784	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
785					   f->common.chain_index,
786					   MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
787	if (IS_ERR(ruleset))
788		return;
789
790	rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
791	if (rule) {
792		mlxsw_sp_acl_rule_del(mlxsw_sp, rule);
793		mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
794	}
795
796	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
797}
798
799int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp,
800			  struct mlxsw_sp_flow_block *block,
801			  struct flow_cls_offload *f)
802{
803	enum flow_action_hw_stats used_hw_stats = FLOW_ACTION_HW_STATS_DISABLED;
804	struct mlxsw_sp_acl_ruleset *ruleset;
805	struct mlxsw_sp_acl_rule *rule;
806	u64 packets;
807	u64 lastuse;
808	u64 bytes;
809	u64 drops;
810	int err;
811
812	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
813					   f->common.chain_index,
814					   MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
815	if (WARN_ON(IS_ERR(ruleset)))
816		return -EINVAL;
817
818	rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
819	if (!rule)
820		return -EINVAL;
821
822	err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes,
823					  &drops, &lastuse, &used_hw_stats);
824	if (err)
825		goto err_rule_get_stats;
826
827	flow_stats_update(&f->stats, bytes, packets, drops, lastuse,
828			  used_hw_stats);
829
830	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
831	return 0;
832
833err_rule_get_stats:
834	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
835	return err;
836}
837
838int mlxsw_sp_flower_tmplt_create(struct mlxsw_sp *mlxsw_sp,
839				 struct mlxsw_sp_flow_block *block,
840				 struct flow_cls_offload *f)
841{
842	struct mlxsw_sp_acl_ruleset *ruleset;
843	struct mlxsw_sp_acl_rule_info rulei;
844	int err;
845
846	memset(&rulei, 0, sizeof(rulei));
847	err = mlxsw_sp_flower_parse(mlxsw_sp, block, &rulei, f);
848	if (err)
849		return err;
850	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
851					   f->common.chain_index,
852					   MLXSW_SP_ACL_PROFILE_FLOWER,
853					   &rulei.values.elusage);
854
855	/* keep the reference to the ruleset */
856	return PTR_ERR_OR_ZERO(ruleset);
857}
858
859void mlxsw_sp_flower_tmplt_destroy(struct mlxsw_sp *mlxsw_sp,
860				   struct mlxsw_sp_flow_block *block,
861				   struct flow_cls_offload *f)
862{
863	struct mlxsw_sp_acl_ruleset *ruleset;
864
865	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
866					   f->common.chain_index,
867					   MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
868	if (IS_ERR(ruleset))
869		return;
870	/* put the reference to the ruleset kept in create */
871	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
872	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
873}
874
875int mlxsw_sp_flower_prio_get(struct mlxsw_sp *mlxsw_sp,
876			     struct mlxsw_sp_flow_block *block,
877			     u32 chain_index, unsigned int *p_min_prio,
878			     unsigned int *p_max_prio)
879{
880	struct mlxsw_sp_acl_ruleset *ruleset;
881
882	ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
883					      chain_index,
884					      MLXSW_SP_ACL_PROFILE_FLOWER);
885	if (IS_ERR(ruleset))
886		/* In case there are no flower rules, the caller
887		 * receives -ENOENT to indicate there is no need
888		 * to check the priorities.
889		 */
890		return PTR_ERR(ruleset);
891	mlxsw_sp_acl_ruleset_prio_get(ruleset, p_min_prio, p_max_prio);
892	return 0;
893}
v4.17
  1/*
  2 * drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
  3 * Copyright (c) 2017 Mellanox Technologies. All rights reserved.
  4 * Copyright (c) 2017 Jiri Pirko <jiri@mellanox.com>
  5 *
  6 * Redistribution and use in source and binary forms, with or without
  7 * modification, are permitted provided that the following conditions are met:
  8 *
  9 * 1. Redistributions of source code must retain the above copyright
 10 *    notice, this list of conditions and the following disclaimer.
 11 * 2. Redistributions in binary form must reproduce the above copyright
 12 *    notice, this list of conditions and the following disclaimer in the
 13 *    documentation and/or other materials provided with the distribution.
 14 * 3. Neither the names of the copyright holders nor the names of its
 15 *    contributors may be used to endorse or promote products derived from
 16 *    this software without specific prior written permission.
 17 *
 18 * Alternatively, this software may be distributed under the terms of the
 19 * GNU General Public License ("GPL") version 2 as published by the Free
 20 * Software Foundation.
 21 *
 22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 23 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 26 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 27 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 28 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 29 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 30 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 31 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 32 * POSSIBILITY OF SUCH DAMAGE.
 33 */
 34
 35#include <linux/kernel.h>
 36#include <linux/errno.h>
 37#include <linux/netdevice.h>
 
 38#include <net/net_namespace.h>
 39#include <net/flow_dissector.h>
 40#include <net/pkt_cls.h>
 41#include <net/tc_act/tc_gact.h>
 42#include <net/tc_act/tc_mirred.h>
 43#include <net/tc_act/tc_vlan.h>
 44
 45#include "spectrum.h"
 46#include "core_acl_flex_keys.h"
 47
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 48static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
 49					 struct mlxsw_sp_acl_block *block,
 50					 struct mlxsw_sp_acl_rule_info *rulei,
 51					 struct tcf_exts *exts)
 
 52{
 53	const struct tc_action *a;
 54	LIST_HEAD(actions);
 55	int err;
 
 
 56
 57	if (!tcf_exts_has_actions(exts))
 58		return 0;
 
 
 59
 60	/* Count action is inserted first */
 61	err = mlxsw_sp_acl_rulei_act_count(mlxsw_sp, rulei);
 62	if (err)
 63		return err;
 
 
 
 
 
 
 
 
 64
 65	tcf_exts_to_list(exts, &actions);
 66	list_for_each_entry(a, &actions, list) {
 67		if (is_tcf_gact_ok(a)) {
 68			err = mlxsw_sp_acl_rulei_act_terminate(rulei);
 69			if (err)
 
 70				return err;
 71		} else if (is_tcf_gact_shot(a)) {
 72			err = mlxsw_sp_acl_rulei_act_drop(rulei);
 73			if (err)
 
 
 
 
 
 
 
 
 
 
 
 74				return err;
 75		} else if (is_tcf_gact_trap(a)) {
 
 
 
 
 
 
 
 
 
 
 
 
 76			err = mlxsw_sp_acl_rulei_act_trap(rulei);
 77			if (err)
 
 78				return err;
 79		} else if (is_tcf_gact_goto_chain(a)) {
 80			u32 chain_index = tcf_gact_goto_chain_index(a);
 
 
 81			struct mlxsw_sp_acl_ruleset *ruleset;
 82			u16 group_id;
 83
 84			ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
 85							      chain_index,
 86							      MLXSW_SP_ACL_PROFILE_FLOWER);
 87			if (IS_ERR(ruleset))
 88				return PTR_ERR(ruleset);
 89
 90			group_id = mlxsw_sp_acl_ruleset_group_id(ruleset);
 91			err = mlxsw_sp_acl_rulei_act_jump(rulei, group_id);
 92			if (err)
 
 93				return err;
 94		} else if (is_tcf_mirred_egress_redirect(a)) {
 
 
 
 95			struct net_device *out_dev;
 96			struct mlxsw_sp_fid *fid;
 97			u16 fid_index;
 98
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 99			fid = mlxsw_sp_acl_dummy_fid(mlxsw_sp);
100			fid_index = mlxsw_sp_fid_index(fid);
101			err = mlxsw_sp_acl_rulei_act_fid_set(mlxsw_sp, rulei,
102							     fid_index);
103			if (err)
104				return err;
105
106			out_dev = tcf_mirred_dev(a);
107			err = mlxsw_sp_acl_rulei_act_fwd(mlxsw_sp, rulei,
108							 out_dev);
109			if (err)
110				return err;
111		} else if (is_tcf_mirred_egress_mirror(a)) {
112			struct net_device *out_dev = tcf_mirred_dev(a);
 
 
 
 
 
 
 
113
114			err = mlxsw_sp_acl_rulei_act_mirror(mlxsw_sp, rulei,
115							    block, out_dev);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
116			if (err)
117				return err;
118		} else if (is_tcf_vlan(a)) {
119			u16 proto = be16_to_cpu(tcf_vlan_push_proto(a));
120			u32 action = tcf_vlan_action(a);
121			u8 prio = tcf_vlan_push_prio(a);
122			u16 vid = tcf_vlan_push_vid(a);
123
124			return mlxsw_sp_acl_rulei_act_vlan(mlxsw_sp, rulei,
125							   action, vid,
126							   proto, prio);
127		} else {
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
128			dev_err(mlxsw_sp->bus_info->dev, "Unsupported action\n");
129			return -EOPNOTSUPP;
130		}
131	}
 
 
 
 
 
 
132	return 0;
133}
134
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
135static void mlxsw_sp_flower_parse_ipv4(struct mlxsw_sp_acl_rule_info *rulei,
136				       struct tc_cls_flower_offload *f)
137{
138	struct flow_dissector_key_ipv4_addrs *key =
139		skb_flow_dissector_target(f->dissector,
140					  FLOW_DISSECTOR_KEY_IPV4_ADDRS,
141					  f->key);
142	struct flow_dissector_key_ipv4_addrs *mask =
143		skb_flow_dissector_target(f->dissector,
144					  FLOW_DISSECTOR_KEY_IPV4_ADDRS,
145					  f->mask);
146
147	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_IP4,
148				       ntohl(key->src), ntohl(mask->src));
149	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_IP4,
150				       ntohl(key->dst), ntohl(mask->dst));
151}
152
153static void mlxsw_sp_flower_parse_ipv6(struct mlxsw_sp_acl_rule_info *rulei,
154				       struct tc_cls_flower_offload *f)
155{
156	struct flow_dissector_key_ipv6_addrs *key =
157		skb_flow_dissector_target(f->dissector,
158					  FLOW_DISSECTOR_KEY_IPV6_ADDRS,
159					  f->key);
160	struct flow_dissector_key_ipv6_addrs *mask =
161		skb_flow_dissector_target(f->dissector,
162					  FLOW_DISSECTOR_KEY_IPV6_ADDRS,
163					  f->mask);
164	size_t addr_half_size = sizeof(key->src) / 2;
165
166	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP6_HI,
167				       &key->src.s6_addr[0],
168				       &mask->src.s6_addr[0],
169				       addr_half_size);
170	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP6_LO,
171				       &key->src.s6_addr[addr_half_size],
172				       &mask->src.s6_addr[addr_half_size],
173				       addr_half_size);
174	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP6_HI,
175				       &key->dst.s6_addr[0],
176				       &mask->dst.s6_addr[0],
177				       addr_half_size);
178	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP6_LO,
179				       &key->dst.s6_addr[addr_half_size],
180				       &mask->dst.s6_addr[addr_half_size],
181				       addr_half_size);
 
 
182}
183
184static int mlxsw_sp_flower_parse_ports(struct mlxsw_sp *mlxsw_sp,
185				       struct mlxsw_sp_acl_rule_info *rulei,
186				       struct tc_cls_flower_offload *f,
187				       u8 ip_proto)
188{
189	struct flow_dissector_key_ports *key, *mask;
 
190
191	if (!dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_PORTS))
192		return 0;
193
194	if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
 
195		dev_err(mlxsw_sp->bus_info->dev, "Only UDP and TCP keys are supported\n");
196		return -EINVAL;
197	}
198
199	key = skb_flow_dissector_target(f->dissector,
200					FLOW_DISSECTOR_KEY_PORTS,
201					f->key);
202	mask = skb_flow_dissector_target(f->dissector,
203					 FLOW_DISSECTOR_KEY_PORTS,
204					 f->mask);
205	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_L4_PORT,
206				       ntohs(key->dst), ntohs(mask->dst));
 
207	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_L4_PORT,
208				       ntohs(key->src), ntohs(mask->src));
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
209	return 0;
210}
211
212static int mlxsw_sp_flower_parse_tcp(struct mlxsw_sp *mlxsw_sp,
213				     struct mlxsw_sp_acl_rule_info *rulei,
214				     struct tc_cls_flower_offload *f,
215				     u8 ip_proto)
216{
217	struct flow_dissector_key_tcp *key, *mask;
 
218
219	if (!dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_TCP))
220		return 0;
221
222	if (ip_proto != IPPROTO_TCP) {
 
223		dev_err(mlxsw_sp->bus_info->dev, "TCP keys supported only for TCP\n");
224		return -EINVAL;
225	}
226
227	key = skb_flow_dissector_target(f->dissector,
228					FLOW_DISSECTOR_KEY_TCP,
229					f->key);
230	mask = skb_flow_dissector_target(f->dissector,
231					 FLOW_DISSECTOR_KEY_TCP,
232					 f->mask);
 
 
233	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_TCP_FLAGS,
234				       ntohs(key->flags), ntohs(mask->flags));
 
235	return 0;
236}
237
238static int mlxsw_sp_flower_parse_ip(struct mlxsw_sp *mlxsw_sp,
239				    struct mlxsw_sp_acl_rule_info *rulei,
240				    struct tc_cls_flower_offload *f,
241				    u16 n_proto)
242{
243	struct flow_dissector_key_ip *key, *mask;
 
244
245	if (!dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_IP))
246		return 0;
247
248	if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6) {
 
249		dev_err(mlxsw_sp->bus_info->dev, "IP keys supported only for IPv4/6\n");
250		return -EINVAL;
251	}
252
253	key = skb_flow_dissector_target(f->dissector,
254					FLOW_DISSECTOR_KEY_IP,
255					f->key);
256	mask = skb_flow_dissector_target(f->dissector,
257					 FLOW_DISSECTOR_KEY_IP,
258					 f->mask);
259	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_TTL_,
260				       key->ttl, mask->ttl);
261
262	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_ECN,
263				       key->tos & 0x3, mask->tos & 0x3);
 
264
265	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_DSCP,
266				       key->tos >> 6, mask->tos >> 6);
 
267
268	return 0;
269}
270
271static int mlxsw_sp_flower_parse(struct mlxsw_sp *mlxsw_sp,
272				 struct mlxsw_sp_acl_block *block,
273				 struct mlxsw_sp_acl_rule_info *rulei,
274				 struct tc_cls_flower_offload *f)
275{
 
 
276	u16 n_proto_mask = 0;
277	u16 n_proto_key = 0;
278	u16 addr_type = 0;
279	u8 ip_proto = 0;
280	int err;
281
282	if (f->dissector->used_keys &
283	    ~(BIT(FLOW_DISSECTOR_KEY_CONTROL) |
284	      BIT(FLOW_DISSECTOR_KEY_BASIC) |
285	      BIT(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
286	      BIT(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
287	      BIT(FLOW_DISSECTOR_KEY_IPV6_ADDRS) |
288	      BIT(FLOW_DISSECTOR_KEY_PORTS) |
289	      BIT(FLOW_DISSECTOR_KEY_TCP) |
290	      BIT(FLOW_DISSECTOR_KEY_IP) |
291	      BIT(FLOW_DISSECTOR_KEY_VLAN))) {
 
 
292		dev_err(mlxsw_sp->bus_info->dev, "Unsupported key\n");
 
293		return -EOPNOTSUPP;
294	}
295
296	mlxsw_sp_acl_rulei_priority(rulei, f->common.prio);
297
298	if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CONTROL)) {
299		struct flow_dissector_key_control *key =
300			skb_flow_dissector_target(f->dissector,
301						  FLOW_DISSECTOR_KEY_CONTROL,
302						  f->key);
303		addr_type = key->addr_type;
304	}
305
306	if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
307		struct flow_dissector_key_basic *key =
308			skb_flow_dissector_target(f->dissector,
309						  FLOW_DISSECTOR_KEY_BASIC,
310						  f->key);
311		struct flow_dissector_key_basic *mask =
312			skb_flow_dissector_target(f->dissector,
313						  FLOW_DISSECTOR_KEY_BASIC,
314						  f->mask);
315		n_proto_key = ntohs(key->n_proto);
316		n_proto_mask = ntohs(mask->n_proto);
317
318		if (n_proto_key == ETH_P_ALL) {
319			n_proto_key = 0;
320			n_proto_mask = 0;
321		}
322		mlxsw_sp_acl_rulei_keymask_u32(rulei,
323					       MLXSW_AFK_ELEMENT_ETHERTYPE,
324					       n_proto_key, n_proto_mask);
325
326		ip_proto = key->ip_proto;
327		mlxsw_sp_acl_rulei_keymask_u32(rulei,
328					       MLXSW_AFK_ELEMENT_IP_PROTO,
329					       key->ip_proto, mask->ip_proto);
 
330	}
331
332	if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
333		struct flow_dissector_key_eth_addrs *key =
334			skb_flow_dissector_target(f->dissector,
335						  FLOW_DISSECTOR_KEY_ETH_ADDRS,
336						  f->key);
337		struct flow_dissector_key_eth_addrs *mask =
338			skb_flow_dissector_target(f->dissector,
339						  FLOW_DISSECTOR_KEY_ETH_ADDRS,
340						  f->mask);
341
 
 
 
 
 
 
 
 
 
342		mlxsw_sp_acl_rulei_keymask_buf(rulei,
343					       MLXSW_AFK_ELEMENT_DMAC,
344					       key->dst, mask->dst,
345					       sizeof(key->dst));
346		mlxsw_sp_acl_rulei_keymask_buf(rulei,
347					       MLXSW_AFK_ELEMENT_SMAC,
348					       key->src, mask->src,
349					       sizeof(key->src));
350	}
351
352	if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_VLAN)) {
353		struct flow_dissector_key_vlan *key =
354			skb_flow_dissector_target(f->dissector,
355						  FLOW_DISSECTOR_KEY_VLAN,
356						  f->key);
357		struct flow_dissector_key_vlan *mask =
358			skb_flow_dissector_target(f->dissector,
359						  FLOW_DISSECTOR_KEY_VLAN,
360						  f->mask);
361		if (mask->vlan_id != 0)
 
 
 
 
 
 
362			mlxsw_sp_acl_rulei_keymask_u32(rulei,
363						       MLXSW_AFK_ELEMENT_VID,
364						       key->vlan_id,
365						       mask->vlan_id);
366		if (mask->vlan_priority != 0)
367			mlxsw_sp_acl_rulei_keymask_u32(rulei,
368						       MLXSW_AFK_ELEMENT_PCP,
369						       key->vlan_priority,
370						       mask->vlan_priority);
371	}
372
373	if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS)
374		mlxsw_sp_flower_parse_ipv4(rulei, f);
375
376	if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS)
377		mlxsw_sp_flower_parse_ipv6(rulei, f);
378
379	err = mlxsw_sp_flower_parse_ports(mlxsw_sp, rulei, f, ip_proto);
380	if (err)
381		return err;
 
 
 
 
 
382	err = mlxsw_sp_flower_parse_tcp(mlxsw_sp, rulei, f, ip_proto);
383	if (err)
384		return err;
385
386	err = mlxsw_sp_flower_parse_ip(mlxsw_sp, rulei, f, n_proto_key & n_proto_mask);
387	if (err)
388		return err;
389
390	return mlxsw_sp_flower_parse_actions(mlxsw_sp, block, rulei, f->exts);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
391}
392
393int mlxsw_sp_flower_replace(struct mlxsw_sp *mlxsw_sp,
394			    struct mlxsw_sp_acl_block *block,
395			    struct tc_cls_flower_offload *f)
396{
397	struct mlxsw_sp_acl_rule_info *rulei;
398	struct mlxsw_sp_acl_ruleset *ruleset;
399	struct mlxsw_sp_acl_rule *rule;
400	int err;
401
 
 
 
 
402	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
403					   f->common.chain_index,
404					   MLXSW_SP_ACL_PROFILE_FLOWER);
405	if (IS_ERR(ruleset))
406		return PTR_ERR(ruleset);
407
408	rule = mlxsw_sp_acl_rule_create(mlxsw_sp, ruleset, f->cookie);
 
409	if (IS_ERR(rule)) {
410		err = PTR_ERR(rule);
411		goto err_rule_create;
412	}
413
414	rulei = mlxsw_sp_acl_rule_rulei(rule);
415	err = mlxsw_sp_flower_parse(mlxsw_sp, block, rulei, f);
416	if (err)
417		goto err_flower_parse;
418
419	err = mlxsw_sp_acl_rulei_commit(rulei);
420	if (err)
421		goto err_rulei_commit;
422
423	err = mlxsw_sp_acl_rule_add(mlxsw_sp, rule);
424	if (err)
425		goto err_rule_add;
426
427	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
428	return 0;
429
430err_rule_add:
431err_rulei_commit:
432err_flower_parse:
433	mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
434err_rule_create:
435	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
436	return err;
437}
438
439void mlxsw_sp_flower_destroy(struct mlxsw_sp *mlxsw_sp,
440			     struct mlxsw_sp_acl_block *block,
441			     struct tc_cls_flower_offload *f)
442{
443	struct mlxsw_sp_acl_ruleset *ruleset;
444	struct mlxsw_sp_acl_rule *rule;
445
446	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
447					   f->common.chain_index,
448					   MLXSW_SP_ACL_PROFILE_FLOWER);
449	if (IS_ERR(ruleset))
450		return;
451
452	rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
453	if (rule) {
454		mlxsw_sp_acl_rule_del(mlxsw_sp, rule);
455		mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
456	}
457
458	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
459}
460
461int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp,
462			  struct mlxsw_sp_acl_block *block,
463			  struct tc_cls_flower_offload *f)
464{
 
465	struct mlxsw_sp_acl_ruleset *ruleset;
466	struct mlxsw_sp_acl_rule *rule;
467	u64 packets;
468	u64 lastuse;
469	u64 bytes;
 
470	int err;
471
472	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
473					   f->common.chain_index,
474					   MLXSW_SP_ACL_PROFILE_FLOWER);
475	if (WARN_ON(IS_ERR(ruleset)))
476		return -EINVAL;
477
478	rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
479	if (!rule)
480		return -EINVAL;
481
482	err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes,
483					  &lastuse);
484	if (err)
485		goto err_rule_get_stats;
486
487	tcf_exts_stats_update(f->exts, bytes, packets, lastuse);
 
488
489	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
490	return 0;
491
492err_rule_get_stats:
493	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
494	return err;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
495}