Loading...
1// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
2/* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */
3
4#include <linux/kernel.h>
5#include <linux/errno.h>
6#include <linux/netdevice.h>
7#include <linux/log2.h>
8#include <net/net_namespace.h>
9#include <net/flow_dissector.h>
10#include <net/pkt_cls.h>
11#include <net/tc_act/tc_gact.h>
12#include <net/tc_act/tc_mirred.h>
13#include <net/tc_act/tc_vlan.h>
14
15#include "spectrum.h"
16#include "core_acl_flex_keys.h"
17
18static int mlxsw_sp_policer_validate(const struct flow_action *action,
19 const struct flow_action_entry *act,
20 struct netlink_ext_ack *extack)
21{
22 if (act->police.exceed.act_id != FLOW_ACTION_DROP) {
23 NL_SET_ERR_MSG_MOD(extack,
24 "Offload not supported when exceed action is not drop");
25 return -EOPNOTSUPP;
26 }
27
28 if (act->police.notexceed.act_id != FLOW_ACTION_PIPE &&
29 act->police.notexceed.act_id != FLOW_ACTION_ACCEPT) {
30 NL_SET_ERR_MSG_MOD(extack,
31 "Offload not supported when conform action is not pipe or ok");
32 return -EOPNOTSUPP;
33 }
34
35 if (act->police.notexceed.act_id == FLOW_ACTION_ACCEPT &&
36 !flow_action_is_last_entry(action, act)) {
37 NL_SET_ERR_MSG_MOD(extack,
38 "Offload not supported when conform action is ok, but action is not last");
39 return -EOPNOTSUPP;
40 }
41
42 if (act->police.peakrate_bytes_ps ||
43 act->police.avrate || act->police.overhead) {
44 NL_SET_ERR_MSG_MOD(extack,
45 "Offload not supported when peakrate/avrate/overhead is configured");
46 return -EOPNOTSUPP;
47 }
48
49 if (act->police.rate_pkt_ps) {
50 NL_SET_ERR_MSG_MOD(extack,
51 "QoS offload not support packets per second");
52 return -EOPNOTSUPP;
53 }
54
55 return 0;
56}
57
58static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
59 struct mlxsw_sp_flow_block *block,
60 struct mlxsw_sp_acl_rule_info *rulei,
61 struct flow_action *flow_action,
62 struct netlink_ext_ack *extack)
63{
64 const struct flow_action_entry *act;
65 int mirror_act_count = 0;
66 int police_act_count = 0;
67 int sample_act_count = 0;
68 int err, i;
69
70 if (!flow_action_has_entries(flow_action))
71 return 0;
72 if (!flow_action_mixed_hw_stats_check(flow_action, extack))
73 return -EOPNOTSUPP;
74
75 act = flow_action_first_entry_get(flow_action);
76 if (act->hw_stats & FLOW_ACTION_HW_STATS_DISABLED) {
77 /* Nothing to do */
78 } else if (act->hw_stats & FLOW_ACTION_HW_STATS_IMMEDIATE) {
79 /* Count action is inserted first */
80 err = mlxsw_sp_acl_rulei_act_count(mlxsw_sp, rulei, extack);
81 if (err)
82 return err;
83 } else {
84 NL_SET_ERR_MSG_MOD(extack, "Unsupported action HW stats type");
85 return -EOPNOTSUPP;
86 }
87
88 flow_action_for_each(i, act, flow_action) {
89 switch (act->id) {
90 case FLOW_ACTION_ACCEPT:
91 err = mlxsw_sp_acl_rulei_act_terminate(rulei);
92 if (err) {
93 NL_SET_ERR_MSG_MOD(extack, "Cannot append terminate action");
94 return err;
95 }
96 break;
97 case FLOW_ACTION_DROP: {
98 bool ingress;
99
100 if (mlxsw_sp_flow_block_is_mixed_bound(block)) {
101 NL_SET_ERR_MSG_MOD(extack, "Drop action is not supported when block is bound to ingress and egress");
102 return -EOPNOTSUPP;
103 }
104 ingress = mlxsw_sp_flow_block_is_ingress_bound(block);
105 err = mlxsw_sp_acl_rulei_act_drop(rulei, ingress,
106 act->user_cookie, extack);
107 if (err) {
108 NL_SET_ERR_MSG_MOD(extack, "Cannot append drop action");
109 return err;
110 }
111
112 /* Forbid block with this rulei to be bound
113 * to ingress/egress in future. Ingress rule is
114 * a blocker for egress and vice versa.
115 */
116 if (ingress)
117 rulei->egress_bind_blocker = 1;
118 else
119 rulei->ingress_bind_blocker = 1;
120 }
121 break;
122 case FLOW_ACTION_TRAP:
123 err = mlxsw_sp_acl_rulei_act_trap(rulei);
124 if (err) {
125 NL_SET_ERR_MSG_MOD(extack, "Cannot append trap action");
126 return err;
127 }
128 break;
129 case FLOW_ACTION_GOTO: {
130 u32 chain_index = act->chain_index;
131 struct mlxsw_sp_acl_ruleset *ruleset;
132 u16 group_id;
133
134 ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
135 chain_index,
136 MLXSW_SP_ACL_PROFILE_FLOWER);
137 if (IS_ERR(ruleset))
138 return PTR_ERR(ruleset);
139
140 group_id = mlxsw_sp_acl_ruleset_group_id(ruleset);
141 err = mlxsw_sp_acl_rulei_act_jump(rulei, group_id);
142 if (err) {
143 NL_SET_ERR_MSG_MOD(extack, "Cannot append jump action");
144 return err;
145 }
146 }
147 break;
148 case FLOW_ACTION_REDIRECT: {
149 struct net_device *out_dev;
150 struct mlxsw_sp_fid *fid;
151 u16 fid_index;
152
153 if (mlxsw_sp_flow_block_is_egress_bound(block)) {
154 NL_SET_ERR_MSG_MOD(extack, "Redirect action is not supported on egress");
155 return -EOPNOTSUPP;
156 }
157
158 /* Forbid block with this rulei to be bound
159 * to egress in future.
160 */
161 rulei->egress_bind_blocker = 1;
162
163 /* Ignore learning and security lookup as redirection
164 * using ingress filters happens before the bridge.
165 */
166 err = mlxsw_sp_acl_rulei_act_ignore(mlxsw_sp, rulei,
167 true, true);
168 if (err) {
169 NL_SET_ERR_MSG_MOD(extack, "Cannot append ignore action");
170 return err;
171 }
172
173 fid = mlxsw_sp_acl_dummy_fid(mlxsw_sp);
174 fid_index = mlxsw_sp_fid_index(fid);
175 err = mlxsw_sp_acl_rulei_act_fid_set(mlxsw_sp, rulei,
176 fid_index, extack);
177 if (err)
178 return err;
179
180 out_dev = act->dev;
181 err = mlxsw_sp_acl_rulei_act_fwd(mlxsw_sp, rulei,
182 out_dev, extack);
183 if (err)
184 return err;
185 }
186 break;
187 case FLOW_ACTION_MIRRED: {
188 struct net_device *out_dev = act->dev;
189
190 if (mirror_act_count++) {
191 NL_SET_ERR_MSG_MOD(extack, "Multiple mirror actions per rule are not supported");
192 return -EOPNOTSUPP;
193 }
194
195 err = mlxsw_sp_acl_rulei_act_mirror(mlxsw_sp, rulei,
196 block, out_dev,
197 extack);
198 if (err)
199 return err;
200 }
201 break;
202 case FLOW_ACTION_VLAN_MANGLE: {
203 u16 proto = be16_to_cpu(act->vlan.proto);
204 u8 prio = act->vlan.prio;
205 u16 vid = act->vlan.vid;
206
207 err = mlxsw_sp_acl_rulei_act_vlan(mlxsw_sp, rulei,
208 act->id, vid,
209 proto, prio, extack);
210 if (err)
211 return err;
212 break;
213 }
214 case FLOW_ACTION_PRIORITY:
215 err = mlxsw_sp_acl_rulei_act_priority(mlxsw_sp, rulei,
216 act->priority,
217 extack);
218 if (err)
219 return err;
220 break;
221 case FLOW_ACTION_MANGLE: {
222 enum flow_action_mangle_base htype = act->mangle.htype;
223 __be32 be_mask = (__force __be32) act->mangle.mask;
224 __be32 be_val = (__force __be32) act->mangle.val;
225 u32 offset = act->mangle.offset;
226 u32 mask = be32_to_cpu(be_mask);
227 u32 val = be32_to_cpu(be_val);
228
229 err = mlxsw_sp_acl_rulei_act_mangle(mlxsw_sp, rulei,
230 htype, offset,
231 mask, val, extack);
232 if (err)
233 return err;
234 break;
235 }
236 case FLOW_ACTION_POLICE: {
237 u32 burst;
238
239 if (police_act_count++) {
240 NL_SET_ERR_MSG_MOD(extack, "Multiple police actions per rule are not supported");
241 return -EOPNOTSUPP;
242 }
243
244 err = mlxsw_sp_policer_validate(flow_action, act, extack);
245 if (err)
246 return err;
247
248 /* The kernel might adjust the requested burst size so
249 * that it is not exactly a power of two. Re-adjust it
250 * here since the hardware only supports burst sizes
251 * that are a power of two.
252 */
253 burst = roundup_pow_of_two(act->police.burst);
254 err = mlxsw_sp_acl_rulei_act_police(mlxsw_sp, rulei,
255 act->hw_index,
256 act->police.rate_bytes_ps,
257 burst, extack);
258 if (err)
259 return err;
260 break;
261 }
262 case FLOW_ACTION_SAMPLE: {
263 if (sample_act_count++) {
264 NL_SET_ERR_MSG_MOD(extack, "Multiple sample actions per rule are not supported");
265 return -EOPNOTSUPP;
266 }
267
268 err = mlxsw_sp_acl_rulei_act_sample(mlxsw_sp, rulei,
269 block,
270 act->sample.psample_group,
271 act->sample.rate,
272 act->sample.trunc_size,
273 act->sample.truncate,
274 extack);
275 if (err)
276 return err;
277 break;
278 }
279 default:
280 NL_SET_ERR_MSG_MOD(extack, "Unsupported action");
281 dev_err(mlxsw_sp->bus_info->dev, "Unsupported action\n");
282 return -EOPNOTSUPP;
283 }
284 }
285
286 if (rulei->ipv6_valid) {
287 NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field");
288 return -EOPNOTSUPP;
289 }
290
291 return 0;
292}
293
294static int
295mlxsw_sp_flower_parse_meta_iif(struct mlxsw_sp_acl_rule_info *rulei,
296 const struct mlxsw_sp_flow_block *block,
297 const struct flow_match_meta *match,
298 struct netlink_ext_ack *extack)
299{
300 struct mlxsw_sp_port *mlxsw_sp_port;
301 struct net_device *ingress_dev;
302
303 if (!match->mask->ingress_ifindex)
304 return 0;
305
306 if (match->mask->ingress_ifindex != 0xFFFFFFFF) {
307 NL_SET_ERR_MSG_MOD(extack, "Unsupported ingress ifindex mask");
308 return -EINVAL;
309 }
310
311 ingress_dev = __dev_get_by_index(block->net,
312 match->key->ingress_ifindex);
313 if (!ingress_dev) {
314 NL_SET_ERR_MSG_MOD(extack, "Can't find specified ingress port to match on");
315 return -EINVAL;
316 }
317
318 if (!mlxsw_sp_port_dev_check(ingress_dev)) {
319 NL_SET_ERR_MSG_MOD(extack, "Can't match on non-mlxsw ingress port");
320 return -EINVAL;
321 }
322
323 mlxsw_sp_port = netdev_priv(ingress_dev);
324 if (mlxsw_sp_port->mlxsw_sp != block->mlxsw_sp) {
325 NL_SET_ERR_MSG_MOD(extack, "Can't match on a port from different device");
326 return -EINVAL;
327 }
328
329 mlxsw_sp_acl_rulei_keymask_u32(rulei,
330 MLXSW_AFK_ELEMENT_SRC_SYS_PORT,
331 mlxsw_sp_port->local_port,
332 0xFFFFFFFF);
333
334 return 0;
335}
336
337static int mlxsw_sp_flower_parse_meta(struct mlxsw_sp_acl_rule_info *rulei,
338 struct flow_cls_offload *f,
339 struct mlxsw_sp_flow_block *block)
340{
341 struct flow_rule *rule = flow_cls_offload_flow_rule(f);
342 struct flow_match_meta match;
343
344 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META))
345 return 0;
346
347 flow_rule_match_meta(rule, &match);
348
349 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_FDB_MISS,
350 match.key->l2_miss, match.mask->l2_miss);
351
352 return mlxsw_sp_flower_parse_meta_iif(rulei, block, &match,
353 f->common.extack);
354}
355
356static void mlxsw_sp_flower_parse_ipv4(struct mlxsw_sp_acl_rule_info *rulei,
357 struct flow_cls_offload *f)
358{
359 struct flow_match_ipv4_addrs match;
360
361 flow_rule_match_ipv4_addrs(f->rule, &match);
362
363 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31,
364 (char *) &match.key->src,
365 (char *) &match.mask->src, 4);
366 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31,
367 (char *) &match.key->dst,
368 (char *) &match.mask->dst, 4);
369}
370
371static void mlxsw_sp_flower_parse_ipv6(struct mlxsw_sp_acl_rule_info *rulei,
372 struct flow_cls_offload *f)
373{
374 struct flow_match_ipv6_addrs match;
375
376 flow_rule_match_ipv6_addrs(f->rule, &match);
377
378 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_96_127,
379 &match.key->src.s6_addr[0x0],
380 &match.mask->src.s6_addr[0x0], 4);
381 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_64_95,
382 &match.key->src.s6_addr[0x4],
383 &match.mask->src.s6_addr[0x4], 4);
384 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_32_63,
385 &match.key->src.s6_addr[0x8],
386 &match.mask->src.s6_addr[0x8], 4);
387 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31,
388 &match.key->src.s6_addr[0xC],
389 &match.mask->src.s6_addr[0xC], 4);
390 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_96_127,
391 &match.key->dst.s6_addr[0x0],
392 &match.mask->dst.s6_addr[0x0], 4);
393 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_64_95,
394 &match.key->dst.s6_addr[0x4],
395 &match.mask->dst.s6_addr[0x4], 4);
396 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_32_63,
397 &match.key->dst.s6_addr[0x8],
398 &match.mask->dst.s6_addr[0x8], 4);
399 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31,
400 &match.key->dst.s6_addr[0xC],
401 &match.mask->dst.s6_addr[0xC], 4);
402}
403
404static int mlxsw_sp_flower_parse_ports(struct mlxsw_sp *mlxsw_sp,
405 struct mlxsw_sp_acl_rule_info *rulei,
406 struct flow_cls_offload *f,
407 u8 ip_proto)
408{
409 const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
410 struct flow_match_ports match;
411
412 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS))
413 return 0;
414
415 if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
416 NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported");
417 dev_err(mlxsw_sp->bus_info->dev, "Only UDP and TCP keys are supported\n");
418 return -EINVAL;
419 }
420
421 flow_rule_match_ports(rule, &match);
422 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_L4_PORT,
423 ntohs(match.key->dst),
424 ntohs(match.mask->dst));
425 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_L4_PORT,
426 ntohs(match.key->src),
427 ntohs(match.mask->src));
428 return 0;
429}
430
431static int
432mlxsw_sp_flower_parse_ports_range(struct mlxsw_sp *mlxsw_sp,
433 struct mlxsw_sp_acl_rule_info *rulei,
434 struct flow_cls_offload *f, u8 ip_proto)
435{
436 const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
437 struct flow_match_ports_range match;
438 u32 key_mask_value = 0;
439
440 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS_RANGE))
441 return 0;
442
443 if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
444 NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported");
445 return -EINVAL;
446 }
447
448 flow_rule_match_ports_range(rule, &match);
449
450 if (match.mask->tp_min.src) {
451 struct mlxsw_sp_port_range range = {
452 .min = ntohs(match.key->tp_min.src),
453 .max = ntohs(match.key->tp_max.src),
454 .source = true,
455 };
456 u8 prr_index;
457 int err;
458
459 err = mlxsw_sp_port_range_reg_get(mlxsw_sp, &range,
460 f->common.extack, &prr_index);
461 if (err)
462 return err;
463
464 rulei->src_port_range_reg_index = prr_index;
465 rulei->src_port_range_reg_valid = true;
466 key_mask_value |= BIT(prr_index);
467 }
468
469 if (match.mask->tp_min.dst) {
470 struct mlxsw_sp_port_range range = {
471 .min = ntohs(match.key->tp_min.dst),
472 .max = ntohs(match.key->tp_max.dst),
473 };
474 u8 prr_index;
475 int err;
476
477 err = mlxsw_sp_port_range_reg_get(mlxsw_sp, &range,
478 f->common.extack, &prr_index);
479 if (err)
480 return err;
481
482 rulei->dst_port_range_reg_index = prr_index;
483 rulei->dst_port_range_reg_valid = true;
484 key_mask_value |= BIT(prr_index);
485 }
486
487 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_L4_PORT_RANGE,
488 key_mask_value, key_mask_value);
489
490 return 0;
491}
492
493static int mlxsw_sp_flower_parse_tcp(struct mlxsw_sp *mlxsw_sp,
494 struct mlxsw_sp_acl_rule_info *rulei,
495 struct flow_cls_offload *f,
496 u8 ip_proto)
497{
498 const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
499 struct flow_match_tcp match;
500
501 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_TCP))
502 return 0;
503
504 if (ip_proto != IPPROTO_TCP) {
505 NL_SET_ERR_MSG_MOD(f->common.extack, "TCP keys supported only for TCP");
506 dev_err(mlxsw_sp->bus_info->dev, "TCP keys supported only for TCP\n");
507 return -EINVAL;
508 }
509
510 flow_rule_match_tcp(rule, &match);
511
512 if (match.mask->flags & htons(0x0E00)) {
513 NL_SET_ERR_MSG_MOD(f->common.extack, "TCP flags match not supported on reserved bits");
514 dev_err(mlxsw_sp->bus_info->dev, "TCP flags match not supported on reserved bits\n");
515 return -EINVAL;
516 }
517
518 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_TCP_FLAGS,
519 ntohs(match.key->flags),
520 ntohs(match.mask->flags));
521 return 0;
522}
523
524static int mlxsw_sp_flower_parse_ip(struct mlxsw_sp *mlxsw_sp,
525 struct mlxsw_sp_acl_rule_info *rulei,
526 struct flow_cls_offload *f,
527 u16 n_proto)
528{
529 const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
530 struct flow_match_ip match;
531
532 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IP))
533 return 0;
534
535 if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6) {
536 NL_SET_ERR_MSG_MOD(f->common.extack, "IP keys supported only for IPv4/6");
537 dev_err(mlxsw_sp->bus_info->dev, "IP keys supported only for IPv4/6\n");
538 return -EINVAL;
539 }
540
541 flow_rule_match_ip(rule, &match);
542
543 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_TTL_,
544 match.key->ttl, match.mask->ttl);
545
546 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_ECN,
547 match.key->tos & 0x3,
548 match.mask->tos & 0x3);
549
550 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_DSCP,
551 match.key->tos >> 2,
552 match.mask->tos >> 2);
553
554 return 0;
555}
556
557static int mlxsw_sp_flower_parse(struct mlxsw_sp *mlxsw_sp,
558 struct mlxsw_sp_flow_block *block,
559 struct mlxsw_sp_acl_rule_info *rulei,
560 struct flow_cls_offload *f)
561{
562 struct flow_rule *rule = flow_cls_offload_flow_rule(f);
563 struct flow_dissector *dissector = rule->match.dissector;
564 u16 n_proto_mask = 0;
565 u16 n_proto_key = 0;
566 u16 addr_type = 0;
567 u8 ip_proto = 0;
568 int err;
569
570 if (dissector->used_keys &
571 ~(BIT_ULL(FLOW_DISSECTOR_KEY_META) |
572 BIT_ULL(FLOW_DISSECTOR_KEY_CONTROL) |
573 BIT_ULL(FLOW_DISSECTOR_KEY_BASIC) |
574 BIT_ULL(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
575 BIT_ULL(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
576 BIT_ULL(FLOW_DISSECTOR_KEY_IPV6_ADDRS) |
577 BIT_ULL(FLOW_DISSECTOR_KEY_PORTS) |
578 BIT_ULL(FLOW_DISSECTOR_KEY_PORTS_RANGE) |
579 BIT_ULL(FLOW_DISSECTOR_KEY_TCP) |
580 BIT_ULL(FLOW_DISSECTOR_KEY_IP) |
581 BIT_ULL(FLOW_DISSECTOR_KEY_VLAN))) {
582 dev_err(mlxsw_sp->bus_info->dev, "Unsupported key\n");
583 NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported key");
584 return -EOPNOTSUPP;
585 }
586
587 mlxsw_sp_acl_rulei_priority(rulei, f->common.prio);
588
589 err = mlxsw_sp_flower_parse_meta(rulei, f, block);
590 if (err)
591 return err;
592
593 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CONTROL)) {
594 struct flow_match_control match;
595
596 flow_rule_match_control(rule, &match);
597 addr_type = match.key->addr_type;
598 }
599
600 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) {
601 struct flow_match_basic match;
602
603 flow_rule_match_basic(rule, &match);
604 n_proto_key = ntohs(match.key->n_proto);
605 n_proto_mask = ntohs(match.mask->n_proto);
606
607 if (n_proto_key == ETH_P_ALL) {
608 n_proto_key = 0;
609 n_proto_mask = 0;
610 }
611 mlxsw_sp_acl_rulei_keymask_u32(rulei,
612 MLXSW_AFK_ELEMENT_ETHERTYPE,
613 n_proto_key, n_proto_mask);
614
615 ip_proto = match.key->ip_proto;
616 mlxsw_sp_acl_rulei_keymask_u32(rulei,
617 MLXSW_AFK_ELEMENT_IP_PROTO,
618 match.key->ip_proto,
619 match.mask->ip_proto);
620 }
621
622 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
623 struct flow_match_eth_addrs match;
624
625 flow_rule_match_eth_addrs(rule, &match);
626 mlxsw_sp_acl_rulei_keymask_buf(rulei,
627 MLXSW_AFK_ELEMENT_DMAC_32_47,
628 match.key->dst,
629 match.mask->dst, 2);
630 mlxsw_sp_acl_rulei_keymask_buf(rulei,
631 MLXSW_AFK_ELEMENT_DMAC_0_31,
632 match.key->dst + 2,
633 match.mask->dst + 2, 4);
634 mlxsw_sp_acl_rulei_keymask_buf(rulei,
635 MLXSW_AFK_ELEMENT_SMAC_32_47,
636 match.key->src,
637 match.mask->src, 2);
638 mlxsw_sp_acl_rulei_keymask_buf(rulei,
639 MLXSW_AFK_ELEMENT_SMAC_0_31,
640 match.key->src + 2,
641 match.mask->src + 2, 4);
642 }
643
644 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) {
645 struct flow_match_vlan match;
646
647 flow_rule_match_vlan(rule, &match);
648 if (mlxsw_sp_flow_block_is_egress_bound(block) &&
649 match.mask->vlan_id) {
650 NL_SET_ERR_MSG_MOD(f->common.extack, "vlan_id key is not supported on egress");
651 return -EOPNOTSUPP;
652 }
653
654 /* Forbid block with this rulei to be bound
655 * to egress in future.
656 */
657 rulei->egress_bind_blocker = 1;
658
659 if (match.mask->vlan_id != 0)
660 mlxsw_sp_acl_rulei_keymask_u32(rulei,
661 MLXSW_AFK_ELEMENT_VID,
662 match.key->vlan_id,
663 match.mask->vlan_id);
664 if (match.mask->vlan_priority != 0)
665 mlxsw_sp_acl_rulei_keymask_u32(rulei,
666 MLXSW_AFK_ELEMENT_PCP,
667 match.key->vlan_priority,
668 match.mask->vlan_priority);
669 }
670
671 if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS)
672 mlxsw_sp_flower_parse_ipv4(rulei, f);
673
674 if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS)
675 mlxsw_sp_flower_parse_ipv6(rulei, f);
676
677 err = mlxsw_sp_flower_parse_ports(mlxsw_sp, rulei, f, ip_proto);
678 if (err)
679 return err;
680
681 err = mlxsw_sp_flower_parse_ports_range(mlxsw_sp, rulei, f, ip_proto);
682 if (err)
683 return err;
684
685 err = mlxsw_sp_flower_parse_tcp(mlxsw_sp, rulei, f, ip_proto);
686 if (err)
687 return err;
688
689 err = mlxsw_sp_flower_parse_ip(mlxsw_sp, rulei, f, n_proto_key & n_proto_mask);
690 if (err)
691 return err;
692
693 return mlxsw_sp_flower_parse_actions(mlxsw_sp, block, rulei,
694 &f->rule->action,
695 f->common.extack);
696}
697
698static int mlxsw_sp_flower_mall_prio_check(struct mlxsw_sp_flow_block *block,
699 struct flow_cls_offload *f)
700{
701 bool ingress = mlxsw_sp_flow_block_is_ingress_bound(block);
702 unsigned int mall_min_prio;
703 unsigned int mall_max_prio;
704 int err;
705
706 err = mlxsw_sp_mall_prio_get(block, f->common.chain_index,
707 &mall_min_prio, &mall_max_prio);
708 if (err) {
709 if (err == -ENOENT)
710 /* No matchall filters installed on this chain. */
711 return 0;
712 NL_SET_ERR_MSG(f->common.extack, "Failed to get matchall priorities");
713 return err;
714 }
715 if (ingress && f->common.prio <= mall_min_prio) {
716 NL_SET_ERR_MSG(f->common.extack, "Failed to add in front of existing matchall rules");
717 return -EOPNOTSUPP;
718 }
719 if (!ingress && f->common.prio >= mall_max_prio) {
720 NL_SET_ERR_MSG(f->common.extack, "Failed to add behind of existing matchall rules");
721 return -EOPNOTSUPP;
722 }
723 return 0;
724}
725
726int mlxsw_sp_flower_replace(struct mlxsw_sp *mlxsw_sp,
727 struct mlxsw_sp_flow_block *block,
728 struct flow_cls_offload *f)
729{
730 struct mlxsw_sp_acl_rule_info *rulei;
731 struct mlxsw_sp_acl_ruleset *ruleset;
732 struct mlxsw_sp_acl_rule *rule;
733 int err;
734
735 err = mlxsw_sp_flower_mall_prio_check(block, f);
736 if (err)
737 return err;
738
739 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
740 f->common.chain_index,
741 MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
742 if (IS_ERR(ruleset))
743 return PTR_ERR(ruleset);
744
745 rule = mlxsw_sp_acl_rule_create(mlxsw_sp, ruleset, f->cookie, NULL,
746 f->common.extack);
747 if (IS_ERR(rule)) {
748 err = PTR_ERR(rule);
749 goto err_rule_create;
750 }
751
752 rulei = mlxsw_sp_acl_rule_rulei(rule);
753 err = mlxsw_sp_flower_parse(mlxsw_sp, block, rulei, f);
754 if (err)
755 goto err_flower_parse;
756
757 err = mlxsw_sp_acl_rulei_commit(rulei);
758 if (err)
759 goto err_rulei_commit;
760
761 err = mlxsw_sp_acl_rule_add(mlxsw_sp, rule);
762 if (err)
763 goto err_rule_add;
764
765 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
766 return 0;
767
768err_rule_add:
769err_rulei_commit:
770err_flower_parse:
771 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
772err_rule_create:
773 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
774 return err;
775}
776
777void mlxsw_sp_flower_destroy(struct mlxsw_sp *mlxsw_sp,
778 struct mlxsw_sp_flow_block *block,
779 struct flow_cls_offload *f)
780{
781 struct mlxsw_sp_acl_ruleset *ruleset;
782 struct mlxsw_sp_acl_rule *rule;
783
784 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
785 f->common.chain_index,
786 MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
787 if (IS_ERR(ruleset))
788 return;
789
790 rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
791 if (rule) {
792 mlxsw_sp_acl_rule_del(mlxsw_sp, rule);
793 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
794 }
795
796 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
797}
798
799int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp,
800 struct mlxsw_sp_flow_block *block,
801 struct flow_cls_offload *f)
802{
803 enum flow_action_hw_stats used_hw_stats = FLOW_ACTION_HW_STATS_DISABLED;
804 struct mlxsw_sp_acl_ruleset *ruleset;
805 struct mlxsw_sp_acl_rule *rule;
806 u64 packets;
807 u64 lastuse;
808 u64 bytes;
809 u64 drops;
810 int err;
811
812 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
813 f->common.chain_index,
814 MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
815 if (WARN_ON(IS_ERR(ruleset)))
816 return -EINVAL;
817
818 rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
819 if (!rule)
820 return -EINVAL;
821
822 err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes,
823 &drops, &lastuse, &used_hw_stats);
824 if (err)
825 goto err_rule_get_stats;
826
827 flow_stats_update(&f->stats, bytes, packets, drops, lastuse,
828 used_hw_stats);
829
830 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
831 return 0;
832
833err_rule_get_stats:
834 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
835 return err;
836}
837
838int mlxsw_sp_flower_tmplt_create(struct mlxsw_sp *mlxsw_sp,
839 struct mlxsw_sp_flow_block *block,
840 struct flow_cls_offload *f)
841{
842 struct mlxsw_sp_acl_ruleset *ruleset;
843 struct mlxsw_sp_acl_rule_info rulei;
844 int err;
845
846 memset(&rulei, 0, sizeof(rulei));
847 err = mlxsw_sp_flower_parse(mlxsw_sp, block, &rulei, f);
848 if (err)
849 return err;
850 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
851 f->common.chain_index,
852 MLXSW_SP_ACL_PROFILE_FLOWER,
853 &rulei.values.elusage);
854
855 /* keep the reference to the ruleset */
856 return PTR_ERR_OR_ZERO(ruleset);
857}
858
859void mlxsw_sp_flower_tmplt_destroy(struct mlxsw_sp *mlxsw_sp,
860 struct mlxsw_sp_flow_block *block,
861 struct flow_cls_offload *f)
862{
863 struct mlxsw_sp_acl_ruleset *ruleset;
864
865 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
866 f->common.chain_index,
867 MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
868 if (IS_ERR(ruleset))
869 return;
870 /* put the reference to the ruleset kept in create */
871 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
872 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
873}
874
875int mlxsw_sp_flower_prio_get(struct mlxsw_sp *mlxsw_sp,
876 struct mlxsw_sp_flow_block *block,
877 u32 chain_index, unsigned int *p_min_prio,
878 unsigned int *p_max_prio)
879{
880 struct mlxsw_sp_acl_ruleset *ruleset;
881
882 ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
883 chain_index,
884 MLXSW_SP_ACL_PROFILE_FLOWER);
885 if (IS_ERR(ruleset))
886 /* In case there are no flower rules, the caller
887 * receives -ENOENT to indicate there is no need
888 * to check the priorities.
889 */
890 return PTR_ERR(ruleset);
891 mlxsw_sp_acl_ruleset_prio_get(ruleset, p_min_prio, p_max_prio);
892 return 0;
893}
1/*
2 * drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
3 * Copyright (c) 2017 Mellanox Technologies. All rights reserved.
4 * Copyright (c) 2017 Jiri Pirko <jiri@mellanox.com>
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the names of the copyright holders nor the names of its
15 * contributors may be used to endorse or promote products derived from
16 * this software without specific prior written permission.
17 *
18 * Alternatively, this software may be distributed under the terms of the
19 * GNU General Public License ("GPL") version 2 as published by the Free
20 * Software Foundation.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
23 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
26 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32 * POSSIBILITY OF SUCH DAMAGE.
33 */
34
35#include <linux/kernel.h>
36#include <linux/errno.h>
37#include <linux/netdevice.h>
38#include <net/net_namespace.h>
39#include <net/flow_dissector.h>
40#include <net/pkt_cls.h>
41#include <net/tc_act/tc_gact.h>
42#include <net/tc_act/tc_mirred.h>
43#include <net/tc_act/tc_vlan.h>
44
45#include "spectrum.h"
46#include "core_acl_flex_keys.h"
47
48static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
49 struct mlxsw_sp_acl_block *block,
50 struct mlxsw_sp_acl_rule_info *rulei,
51 struct tcf_exts *exts)
52{
53 const struct tc_action *a;
54 LIST_HEAD(actions);
55 int err;
56
57 if (!tcf_exts_has_actions(exts))
58 return 0;
59
60 /* Count action is inserted first */
61 err = mlxsw_sp_acl_rulei_act_count(mlxsw_sp, rulei);
62 if (err)
63 return err;
64
65 tcf_exts_to_list(exts, &actions);
66 list_for_each_entry(a, &actions, list) {
67 if (is_tcf_gact_ok(a)) {
68 err = mlxsw_sp_acl_rulei_act_terminate(rulei);
69 if (err)
70 return err;
71 } else if (is_tcf_gact_shot(a)) {
72 err = mlxsw_sp_acl_rulei_act_drop(rulei);
73 if (err)
74 return err;
75 } else if (is_tcf_gact_trap(a)) {
76 err = mlxsw_sp_acl_rulei_act_trap(rulei);
77 if (err)
78 return err;
79 } else if (is_tcf_gact_goto_chain(a)) {
80 u32 chain_index = tcf_gact_goto_chain_index(a);
81 struct mlxsw_sp_acl_ruleset *ruleset;
82 u16 group_id;
83
84 ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
85 chain_index,
86 MLXSW_SP_ACL_PROFILE_FLOWER);
87 if (IS_ERR(ruleset))
88 return PTR_ERR(ruleset);
89
90 group_id = mlxsw_sp_acl_ruleset_group_id(ruleset);
91 err = mlxsw_sp_acl_rulei_act_jump(rulei, group_id);
92 if (err)
93 return err;
94 } else if (is_tcf_mirred_egress_redirect(a)) {
95 struct net_device *out_dev;
96 struct mlxsw_sp_fid *fid;
97 u16 fid_index;
98
99 fid = mlxsw_sp_acl_dummy_fid(mlxsw_sp);
100 fid_index = mlxsw_sp_fid_index(fid);
101 err = mlxsw_sp_acl_rulei_act_fid_set(mlxsw_sp, rulei,
102 fid_index);
103 if (err)
104 return err;
105
106 out_dev = tcf_mirred_dev(a);
107 err = mlxsw_sp_acl_rulei_act_fwd(mlxsw_sp, rulei,
108 out_dev);
109 if (err)
110 return err;
111 } else if (is_tcf_mirred_egress_mirror(a)) {
112 struct net_device *out_dev = tcf_mirred_dev(a);
113
114 err = mlxsw_sp_acl_rulei_act_mirror(mlxsw_sp, rulei,
115 block, out_dev);
116 if (err)
117 return err;
118 } else if (is_tcf_vlan(a)) {
119 u16 proto = be16_to_cpu(tcf_vlan_push_proto(a));
120 u32 action = tcf_vlan_action(a);
121 u8 prio = tcf_vlan_push_prio(a);
122 u16 vid = tcf_vlan_push_vid(a);
123
124 return mlxsw_sp_acl_rulei_act_vlan(mlxsw_sp, rulei,
125 action, vid,
126 proto, prio);
127 } else {
128 dev_err(mlxsw_sp->bus_info->dev, "Unsupported action\n");
129 return -EOPNOTSUPP;
130 }
131 }
132 return 0;
133}
134
135static void mlxsw_sp_flower_parse_ipv4(struct mlxsw_sp_acl_rule_info *rulei,
136 struct tc_cls_flower_offload *f)
137{
138 struct flow_dissector_key_ipv4_addrs *key =
139 skb_flow_dissector_target(f->dissector,
140 FLOW_DISSECTOR_KEY_IPV4_ADDRS,
141 f->key);
142 struct flow_dissector_key_ipv4_addrs *mask =
143 skb_flow_dissector_target(f->dissector,
144 FLOW_DISSECTOR_KEY_IPV4_ADDRS,
145 f->mask);
146
147 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_IP4,
148 ntohl(key->src), ntohl(mask->src));
149 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_IP4,
150 ntohl(key->dst), ntohl(mask->dst));
151}
152
153static void mlxsw_sp_flower_parse_ipv6(struct mlxsw_sp_acl_rule_info *rulei,
154 struct tc_cls_flower_offload *f)
155{
156 struct flow_dissector_key_ipv6_addrs *key =
157 skb_flow_dissector_target(f->dissector,
158 FLOW_DISSECTOR_KEY_IPV6_ADDRS,
159 f->key);
160 struct flow_dissector_key_ipv6_addrs *mask =
161 skb_flow_dissector_target(f->dissector,
162 FLOW_DISSECTOR_KEY_IPV6_ADDRS,
163 f->mask);
164 size_t addr_half_size = sizeof(key->src) / 2;
165
166 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP6_HI,
167 &key->src.s6_addr[0],
168 &mask->src.s6_addr[0],
169 addr_half_size);
170 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP6_LO,
171 &key->src.s6_addr[addr_half_size],
172 &mask->src.s6_addr[addr_half_size],
173 addr_half_size);
174 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP6_HI,
175 &key->dst.s6_addr[0],
176 &mask->dst.s6_addr[0],
177 addr_half_size);
178 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP6_LO,
179 &key->dst.s6_addr[addr_half_size],
180 &mask->dst.s6_addr[addr_half_size],
181 addr_half_size);
182}
183
184static int mlxsw_sp_flower_parse_ports(struct mlxsw_sp *mlxsw_sp,
185 struct mlxsw_sp_acl_rule_info *rulei,
186 struct tc_cls_flower_offload *f,
187 u8 ip_proto)
188{
189 struct flow_dissector_key_ports *key, *mask;
190
191 if (!dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_PORTS))
192 return 0;
193
194 if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
195 dev_err(mlxsw_sp->bus_info->dev, "Only UDP and TCP keys are supported\n");
196 return -EINVAL;
197 }
198
199 key = skb_flow_dissector_target(f->dissector,
200 FLOW_DISSECTOR_KEY_PORTS,
201 f->key);
202 mask = skb_flow_dissector_target(f->dissector,
203 FLOW_DISSECTOR_KEY_PORTS,
204 f->mask);
205 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_L4_PORT,
206 ntohs(key->dst), ntohs(mask->dst));
207 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_L4_PORT,
208 ntohs(key->src), ntohs(mask->src));
209 return 0;
210}
211
212static int mlxsw_sp_flower_parse_tcp(struct mlxsw_sp *mlxsw_sp,
213 struct mlxsw_sp_acl_rule_info *rulei,
214 struct tc_cls_flower_offload *f,
215 u8 ip_proto)
216{
217 struct flow_dissector_key_tcp *key, *mask;
218
219 if (!dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_TCP))
220 return 0;
221
222 if (ip_proto != IPPROTO_TCP) {
223 dev_err(mlxsw_sp->bus_info->dev, "TCP keys supported only for TCP\n");
224 return -EINVAL;
225 }
226
227 key = skb_flow_dissector_target(f->dissector,
228 FLOW_DISSECTOR_KEY_TCP,
229 f->key);
230 mask = skb_flow_dissector_target(f->dissector,
231 FLOW_DISSECTOR_KEY_TCP,
232 f->mask);
233 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_TCP_FLAGS,
234 ntohs(key->flags), ntohs(mask->flags));
235 return 0;
236}
237
238static int mlxsw_sp_flower_parse_ip(struct mlxsw_sp *mlxsw_sp,
239 struct mlxsw_sp_acl_rule_info *rulei,
240 struct tc_cls_flower_offload *f,
241 u16 n_proto)
242{
243 struct flow_dissector_key_ip *key, *mask;
244
245 if (!dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_IP))
246 return 0;
247
248 if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6) {
249 dev_err(mlxsw_sp->bus_info->dev, "IP keys supported only for IPv4/6\n");
250 return -EINVAL;
251 }
252
253 key = skb_flow_dissector_target(f->dissector,
254 FLOW_DISSECTOR_KEY_IP,
255 f->key);
256 mask = skb_flow_dissector_target(f->dissector,
257 FLOW_DISSECTOR_KEY_IP,
258 f->mask);
259 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_TTL_,
260 key->ttl, mask->ttl);
261
262 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_ECN,
263 key->tos & 0x3, mask->tos & 0x3);
264
265 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_DSCP,
266 key->tos >> 6, mask->tos >> 6);
267
268 return 0;
269}
270
271static int mlxsw_sp_flower_parse(struct mlxsw_sp *mlxsw_sp,
272 struct mlxsw_sp_acl_block *block,
273 struct mlxsw_sp_acl_rule_info *rulei,
274 struct tc_cls_flower_offload *f)
275{
276 u16 n_proto_mask = 0;
277 u16 n_proto_key = 0;
278 u16 addr_type = 0;
279 u8 ip_proto = 0;
280 int err;
281
282 if (f->dissector->used_keys &
283 ~(BIT(FLOW_DISSECTOR_KEY_CONTROL) |
284 BIT(FLOW_DISSECTOR_KEY_BASIC) |
285 BIT(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
286 BIT(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
287 BIT(FLOW_DISSECTOR_KEY_IPV6_ADDRS) |
288 BIT(FLOW_DISSECTOR_KEY_PORTS) |
289 BIT(FLOW_DISSECTOR_KEY_TCP) |
290 BIT(FLOW_DISSECTOR_KEY_IP) |
291 BIT(FLOW_DISSECTOR_KEY_VLAN))) {
292 dev_err(mlxsw_sp->bus_info->dev, "Unsupported key\n");
293 return -EOPNOTSUPP;
294 }
295
296 mlxsw_sp_acl_rulei_priority(rulei, f->common.prio);
297
298 if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CONTROL)) {
299 struct flow_dissector_key_control *key =
300 skb_flow_dissector_target(f->dissector,
301 FLOW_DISSECTOR_KEY_CONTROL,
302 f->key);
303 addr_type = key->addr_type;
304 }
305
306 if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
307 struct flow_dissector_key_basic *key =
308 skb_flow_dissector_target(f->dissector,
309 FLOW_DISSECTOR_KEY_BASIC,
310 f->key);
311 struct flow_dissector_key_basic *mask =
312 skb_flow_dissector_target(f->dissector,
313 FLOW_DISSECTOR_KEY_BASIC,
314 f->mask);
315 n_proto_key = ntohs(key->n_proto);
316 n_proto_mask = ntohs(mask->n_proto);
317
318 if (n_proto_key == ETH_P_ALL) {
319 n_proto_key = 0;
320 n_proto_mask = 0;
321 }
322 mlxsw_sp_acl_rulei_keymask_u32(rulei,
323 MLXSW_AFK_ELEMENT_ETHERTYPE,
324 n_proto_key, n_proto_mask);
325
326 ip_proto = key->ip_proto;
327 mlxsw_sp_acl_rulei_keymask_u32(rulei,
328 MLXSW_AFK_ELEMENT_IP_PROTO,
329 key->ip_proto, mask->ip_proto);
330 }
331
332 if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
333 struct flow_dissector_key_eth_addrs *key =
334 skb_flow_dissector_target(f->dissector,
335 FLOW_DISSECTOR_KEY_ETH_ADDRS,
336 f->key);
337 struct flow_dissector_key_eth_addrs *mask =
338 skb_flow_dissector_target(f->dissector,
339 FLOW_DISSECTOR_KEY_ETH_ADDRS,
340 f->mask);
341
342 mlxsw_sp_acl_rulei_keymask_buf(rulei,
343 MLXSW_AFK_ELEMENT_DMAC,
344 key->dst, mask->dst,
345 sizeof(key->dst));
346 mlxsw_sp_acl_rulei_keymask_buf(rulei,
347 MLXSW_AFK_ELEMENT_SMAC,
348 key->src, mask->src,
349 sizeof(key->src));
350 }
351
352 if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_VLAN)) {
353 struct flow_dissector_key_vlan *key =
354 skb_flow_dissector_target(f->dissector,
355 FLOW_DISSECTOR_KEY_VLAN,
356 f->key);
357 struct flow_dissector_key_vlan *mask =
358 skb_flow_dissector_target(f->dissector,
359 FLOW_DISSECTOR_KEY_VLAN,
360 f->mask);
361 if (mask->vlan_id != 0)
362 mlxsw_sp_acl_rulei_keymask_u32(rulei,
363 MLXSW_AFK_ELEMENT_VID,
364 key->vlan_id,
365 mask->vlan_id);
366 if (mask->vlan_priority != 0)
367 mlxsw_sp_acl_rulei_keymask_u32(rulei,
368 MLXSW_AFK_ELEMENT_PCP,
369 key->vlan_priority,
370 mask->vlan_priority);
371 }
372
373 if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS)
374 mlxsw_sp_flower_parse_ipv4(rulei, f);
375
376 if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS)
377 mlxsw_sp_flower_parse_ipv6(rulei, f);
378
379 err = mlxsw_sp_flower_parse_ports(mlxsw_sp, rulei, f, ip_proto);
380 if (err)
381 return err;
382 err = mlxsw_sp_flower_parse_tcp(mlxsw_sp, rulei, f, ip_proto);
383 if (err)
384 return err;
385
386 err = mlxsw_sp_flower_parse_ip(mlxsw_sp, rulei, f, n_proto_key & n_proto_mask);
387 if (err)
388 return err;
389
390 return mlxsw_sp_flower_parse_actions(mlxsw_sp, block, rulei, f->exts);
391}
392
393int mlxsw_sp_flower_replace(struct mlxsw_sp *mlxsw_sp,
394 struct mlxsw_sp_acl_block *block,
395 struct tc_cls_flower_offload *f)
396{
397 struct mlxsw_sp_acl_rule_info *rulei;
398 struct mlxsw_sp_acl_ruleset *ruleset;
399 struct mlxsw_sp_acl_rule *rule;
400 int err;
401
402 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
403 f->common.chain_index,
404 MLXSW_SP_ACL_PROFILE_FLOWER);
405 if (IS_ERR(ruleset))
406 return PTR_ERR(ruleset);
407
408 rule = mlxsw_sp_acl_rule_create(mlxsw_sp, ruleset, f->cookie);
409 if (IS_ERR(rule)) {
410 err = PTR_ERR(rule);
411 goto err_rule_create;
412 }
413
414 rulei = mlxsw_sp_acl_rule_rulei(rule);
415 err = mlxsw_sp_flower_parse(mlxsw_sp, block, rulei, f);
416 if (err)
417 goto err_flower_parse;
418
419 err = mlxsw_sp_acl_rulei_commit(rulei);
420 if (err)
421 goto err_rulei_commit;
422
423 err = mlxsw_sp_acl_rule_add(mlxsw_sp, rule);
424 if (err)
425 goto err_rule_add;
426
427 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
428 return 0;
429
430err_rule_add:
431err_rulei_commit:
432err_flower_parse:
433 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
434err_rule_create:
435 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
436 return err;
437}
438
439void mlxsw_sp_flower_destroy(struct mlxsw_sp *mlxsw_sp,
440 struct mlxsw_sp_acl_block *block,
441 struct tc_cls_flower_offload *f)
442{
443 struct mlxsw_sp_acl_ruleset *ruleset;
444 struct mlxsw_sp_acl_rule *rule;
445
446 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
447 f->common.chain_index,
448 MLXSW_SP_ACL_PROFILE_FLOWER);
449 if (IS_ERR(ruleset))
450 return;
451
452 rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
453 if (rule) {
454 mlxsw_sp_acl_rule_del(mlxsw_sp, rule);
455 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
456 }
457
458 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
459}
460
461int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp,
462 struct mlxsw_sp_acl_block *block,
463 struct tc_cls_flower_offload *f)
464{
465 struct mlxsw_sp_acl_ruleset *ruleset;
466 struct mlxsw_sp_acl_rule *rule;
467 u64 packets;
468 u64 lastuse;
469 u64 bytes;
470 int err;
471
472 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
473 f->common.chain_index,
474 MLXSW_SP_ACL_PROFILE_FLOWER);
475 if (WARN_ON(IS_ERR(ruleset)))
476 return -EINVAL;
477
478 rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
479 if (!rule)
480 return -EINVAL;
481
482 err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes,
483 &lastuse);
484 if (err)
485 goto err_rule_get_stats;
486
487 tcf_exts_stats_update(f->exts, bytes, packets, lastuse);
488
489 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
490 return 0;
491
492err_rule_get_stats:
493 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
494 return err;
495}