1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */
3
4 #include <linux/kernel.h>
5 #include <linux/errno.h>
6 #include <linux/netdevice.h>
7 #include <linux/log2.h>
8 #include <net/net_namespace.h>
9 #include <net/flow_dissector.h>
10 #include <net/pkt_cls.h>
11 #include <net/tc_act/tc_gact.h>
12 #include <net/tc_act/tc_mirred.h>
13 #include <net/tc_act/tc_vlan.h>
14
15 #include "spectrum.h"
16 #include "core_acl_flex_keys.h"
17
mlxsw_sp_policer_validate(const struct flow_action * action,const struct flow_action_entry * act,struct netlink_ext_ack * extack)18 static int mlxsw_sp_policer_validate(const struct flow_action *action,
19 const struct flow_action_entry *act,
20 struct netlink_ext_ack *extack)
21 {
22 if (act->police.exceed.act_id != FLOW_ACTION_DROP) {
23 NL_SET_ERR_MSG_MOD(extack,
24 "Offload not supported when exceed action is not drop");
25 return -EOPNOTSUPP;
26 }
27
28 if (act->police.notexceed.act_id != FLOW_ACTION_PIPE &&
29 act->police.notexceed.act_id != FLOW_ACTION_ACCEPT) {
30 NL_SET_ERR_MSG_MOD(extack,
31 "Offload not supported when conform action is not pipe or ok");
32 return -EOPNOTSUPP;
33 }
34
35 if (act->police.notexceed.act_id == FLOW_ACTION_ACCEPT &&
36 !flow_action_is_last_entry(action, act)) {
37 NL_SET_ERR_MSG_MOD(extack,
38 "Offload not supported when conform action is ok, but action is not last");
39 return -EOPNOTSUPP;
40 }
41
42 if (act->police.peakrate_bytes_ps ||
43 act->police.avrate || act->police.overhead) {
44 NL_SET_ERR_MSG_MOD(extack,
45 "Offload not supported when peakrate/avrate/overhead is configured");
46 return -EOPNOTSUPP;
47 }
48
49 if (act->police.rate_pkt_ps) {
50 NL_SET_ERR_MSG_MOD(extack,
51 "QoS offload not support packets per second");
52 return -EOPNOTSUPP;
53 }
54
55 return 0;
56 }
57
mlxsw_sp_flower_parse_actions(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_flow_block * block,struct mlxsw_sp_acl_rule_info * rulei,struct flow_action * flow_action,struct netlink_ext_ack * extack)58 static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
59 struct mlxsw_sp_flow_block *block,
60 struct mlxsw_sp_acl_rule_info *rulei,
61 struct flow_action *flow_action,
62 struct netlink_ext_ack *extack)
63 {
64 const struct flow_action_entry *act;
65 int mirror_act_count = 0;
66 int police_act_count = 0;
67 int sample_act_count = 0;
68 int err, i;
69
70 if (!flow_action_has_entries(flow_action))
71 return 0;
72 if (!flow_action_mixed_hw_stats_check(flow_action, extack))
73 return -EOPNOTSUPP;
74
75 act = flow_action_first_entry_get(flow_action);
76 if (act->hw_stats & FLOW_ACTION_HW_STATS_DISABLED) {
77 /* Nothing to do */
78 } else if (act->hw_stats & FLOW_ACTION_HW_STATS_IMMEDIATE) {
79 /* Count action is inserted first */
80 err = mlxsw_sp_acl_rulei_act_count(mlxsw_sp, rulei, extack);
81 if (err)
82 return err;
83 } else {
84 NL_SET_ERR_MSG_MOD(extack, "Unsupported action HW stats type");
85 return -EOPNOTSUPP;
86 }
87
88 flow_action_for_each(i, act, flow_action) {
89 switch (act->id) {
90 case FLOW_ACTION_ACCEPT:
91 err = mlxsw_sp_acl_rulei_act_terminate(rulei);
92 if (err) {
93 NL_SET_ERR_MSG_MOD(extack, "Cannot append terminate action");
94 return err;
95 }
96 break;
97 case FLOW_ACTION_DROP: {
98 bool ingress;
99
100 if (mlxsw_sp_flow_block_is_mixed_bound(block)) {
101 NL_SET_ERR_MSG_MOD(extack, "Drop action is not supported when block is bound to ingress and egress");
102 return -EOPNOTSUPP;
103 }
104 ingress = mlxsw_sp_flow_block_is_ingress_bound(block);
105 err = mlxsw_sp_acl_rulei_act_drop(rulei, ingress,
106 act->user_cookie, extack);
107 if (err) {
108 NL_SET_ERR_MSG_MOD(extack, "Cannot append drop action");
109 return err;
110 }
111
112 /* Forbid block with this rulei to be bound
113 * to ingress/egress in future. Ingress rule is
114 * a blocker for egress and vice versa.
115 */
116 if (ingress)
117 rulei->egress_bind_blocker = 1;
118 else
119 rulei->ingress_bind_blocker = 1;
120 }
121 break;
122 case FLOW_ACTION_TRAP:
123 err = mlxsw_sp_acl_rulei_act_trap(rulei);
124 if (err) {
125 NL_SET_ERR_MSG_MOD(extack, "Cannot append trap action");
126 return err;
127 }
128 break;
129 case FLOW_ACTION_GOTO: {
130 u32 chain_index = act->chain_index;
131 struct mlxsw_sp_acl_ruleset *ruleset;
132 u16 group_id;
133
134 ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
135 chain_index,
136 MLXSW_SP_ACL_PROFILE_FLOWER);
137 if (IS_ERR(ruleset))
138 return PTR_ERR(ruleset);
139
140 group_id = mlxsw_sp_acl_ruleset_group_id(ruleset);
141 err = mlxsw_sp_acl_rulei_act_jump(rulei, group_id);
142 if (err) {
143 NL_SET_ERR_MSG_MOD(extack, "Cannot append jump action");
144 return err;
145 }
146 }
147 break;
148 case FLOW_ACTION_REDIRECT: {
149 struct net_device *out_dev;
150 struct mlxsw_sp_fid *fid;
151 u16 fid_index;
152
153 if (mlxsw_sp_flow_block_is_egress_bound(block)) {
154 NL_SET_ERR_MSG_MOD(extack, "Redirect action is not supported on egress");
155 return -EOPNOTSUPP;
156 }
157
158 /* Forbid block with this rulei to be bound
159 * to egress in future.
160 */
161 rulei->egress_bind_blocker = 1;
162
163 /* Ignore learning and security lookup as redirection
164 * using ingress filters happens before the bridge.
165 */
166 err = mlxsw_sp_acl_rulei_act_ignore(mlxsw_sp, rulei,
167 true, true);
168 if (err) {
169 NL_SET_ERR_MSG_MOD(extack, "Cannot append ignore action");
170 return err;
171 }
172
173 fid = mlxsw_sp_acl_dummy_fid(mlxsw_sp);
174 fid_index = mlxsw_sp_fid_index(fid);
175 err = mlxsw_sp_acl_rulei_act_fid_set(mlxsw_sp, rulei,
176 fid_index, extack);
177 if (err)
178 return err;
179
180 out_dev = act->dev;
181 err = mlxsw_sp_acl_rulei_act_fwd(mlxsw_sp, rulei,
182 out_dev, extack);
183 if (err)
184 return err;
185 }
186 break;
187 case FLOW_ACTION_MIRRED: {
188 struct net_device *out_dev = act->dev;
189
190 if (mirror_act_count++) {
191 NL_SET_ERR_MSG_MOD(extack, "Multiple mirror actions per rule are not supported");
192 return -EOPNOTSUPP;
193 }
194
195 if (sample_act_count) {
196 NL_SET_ERR_MSG_MOD(extack, "Mirror action after sample action is not supported");
197 return -EOPNOTSUPP;
198 }
199
200 err = mlxsw_sp_acl_rulei_act_mirror(mlxsw_sp, rulei,
201 block, out_dev,
202 extack);
203 if (err)
204 return err;
205 }
206 break;
207 case FLOW_ACTION_VLAN_MANGLE: {
208 u16 proto = be16_to_cpu(act->vlan.proto);
209 u8 prio = act->vlan.prio;
210 u16 vid = act->vlan.vid;
211
212 err = mlxsw_sp_acl_rulei_act_vlan(mlxsw_sp, rulei,
213 act->id, vid,
214 proto, prio, extack);
215 if (err)
216 return err;
217 break;
218 }
219 case FLOW_ACTION_PRIORITY:
220 err = mlxsw_sp_acl_rulei_act_priority(mlxsw_sp, rulei,
221 act->priority,
222 extack);
223 if (err)
224 return err;
225 break;
226 case FLOW_ACTION_MANGLE: {
227 enum flow_action_mangle_base htype = act->mangle.htype;
228 __be32 be_mask = (__force __be32) act->mangle.mask;
229 __be32 be_val = (__force __be32) act->mangle.val;
230 u32 offset = act->mangle.offset;
231 u32 mask = be32_to_cpu(be_mask);
232 u32 val = be32_to_cpu(be_val);
233
234 err = mlxsw_sp_acl_rulei_act_mangle(mlxsw_sp, rulei,
235 htype, offset,
236 mask, val, extack);
237 if (err)
238 return err;
239 break;
240 }
241 case FLOW_ACTION_POLICE: {
242 u32 burst;
243
244 if (police_act_count++) {
245 NL_SET_ERR_MSG_MOD(extack, "Multiple police actions per rule are not supported");
246 return -EOPNOTSUPP;
247 }
248
249 err = mlxsw_sp_policer_validate(flow_action, act, extack);
250 if (err)
251 return err;
252
253 /* The kernel might adjust the requested burst size so
254 * that it is not exactly a power of two. Re-adjust it
255 * here since the hardware only supports burst sizes
256 * that are a power of two.
257 */
258 burst = roundup_pow_of_two(act->police.burst);
259 err = mlxsw_sp_acl_rulei_act_police(mlxsw_sp, rulei,
260 act->hw_index,
261 act->police.rate_bytes_ps,
262 burst, extack);
263 if (err)
264 return err;
265 break;
266 }
267 case FLOW_ACTION_SAMPLE: {
268 if (sample_act_count++) {
269 NL_SET_ERR_MSG_MOD(extack, "Multiple sample actions per rule are not supported");
270 return -EOPNOTSUPP;
271 }
272
273 if (mirror_act_count) {
274 NL_SET_ERR_MSG_MOD(extack, "Sample action after mirror action is not supported");
275 return -EOPNOTSUPP;
276 }
277
278 err = mlxsw_sp_acl_rulei_act_sample(mlxsw_sp, rulei,
279 block,
280 act->sample.psample_group,
281 act->sample.rate,
282 act->sample.trunc_size,
283 act->sample.truncate,
284 extack);
285 if (err)
286 return err;
287 break;
288 }
289 default:
290 NL_SET_ERR_MSG_MOD(extack, "Unsupported action");
291 dev_err(mlxsw_sp->bus_info->dev, "Unsupported action\n");
292 return -EOPNOTSUPP;
293 }
294 }
295
296 if (rulei->ipv6_valid) {
297 NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field");
298 return -EOPNOTSUPP;
299 }
300
301 return 0;
302 }
303
304 static int
mlxsw_sp_flower_parse_meta_iif(struct mlxsw_sp_acl_rule_info * rulei,const struct mlxsw_sp_flow_block * block,const struct flow_match_meta * match,struct netlink_ext_ack * extack)305 mlxsw_sp_flower_parse_meta_iif(struct mlxsw_sp_acl_rule_info *rulei,
306 const struct mlxsw_sp_flow_block *block,
307 const struct flow_match_meta *match,
308 struct netlink_ext_ack *extack)
309 {
310 struct mlxsw_sp_port *mlxsw_sp_port;
311 struct net_device *ingress_dev;
312
313 if (!match->mask->ingress_ifindex)
314 return 0;
315
316 if (match->mask->ingress_ifindex != 0xFFFFFFFF) {
317 NL_SET_ERR_MSG_MOD(extack, "Unsupported ingress ifindex mask");
318 return -EINVAL;
319 }
320
321 ingress_dev = __dev_get_by_index(block->net,
322 match->key->ingress_ifindex);
323 if (!ingress_dev) {
324 NL_SET_ERR_MSG_MOD(extack, "Can't find specified ingress port to match on");
325 return -EINVAL;
326 }
327
328 if (!mlxsw_sp_port_dev_check(ingress_dev)) {
329 NL_SET_ERR_MSG_MOD(extack, "Can't match on non-mlxsw ingress port");
330 return -EINVAL;
331 }
332
333 mlxsw_sp_port = netdev_priv(ingress_dev);
334 if (mlxsw_sp_port->mlxsw_sp != block->mlxsw_sp) {
335 NL_SET_ERR_MSG_MOD(extack, "Can't match on a port from different device");
336 return -EINVAL;
337 }
338
339 mlxsw_sp_acl_rulei_keymask_u32(rulei,
340 MLXSW_AFK_ELEMENT_SRC_SYS_PORT,
341 mlxsw_sp_port->local_port,
342 0xFFFFFFFF);
343
344 return 0;
345 }
346
mlxsw_sp_flower_parse_meta(struct mlxsw_sp_acl_rule_info * rulei,struct flow_cls_offload * f,struct mlxsw_sp_flow_block * block)347 static int mlxsw_sp_flower_parse_meta(struct mlxsw_sp_acl_rule_info *rulei,
348 struct flow_cls_offload *f,
349 struct mlxsw_sp_flow_block *block)
350 {
351 struct flow_rule *rule = flow_cls_offload_flow_rule(f);
352 struct flow_match_meta match;
353
354 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META))
355 return 0;
356
357 flow_rule_match_meta(rule, &match);
358
359 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_FDB_MISS,
360 match.key->l2_miss, match.mask->l2_miss);
361
362 return mlxsw_sp_flower_parse_meta_iif(rulei, block, &match,
363 f->common.extack);
364 }
365
mlxsw_sp_flower_parse_ipv4(struct mlxsw_sp_acl_rule_info * rulei,struct flow_cls_offload * f)366 static void mlxsw_sp_flower_parse_ipv4(struct mlxsw_sp_acl_rule_info *rulei,
367 struct flow_cls_offload *f)
368 {
369 struct flow_match_ipv4_addrs match;
370
371 flow_rule_match_ipv4_addrs(f->rule, &match);
372
373 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31,
374 (char *) &match.key->src,
375 (char *) &match.mask->src, 4);
376 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31,
377 (char *) &match.key->dst,
378 (char *) &match.mask->dst, 4);
379 }
380
mlxsw_sp_flower_parse_ipv6(struct mlxsw_sp_acl_rule_info * rulei,struct flow_cls_offload * f)381 static void mlxsw_sp_flower_parse_ipv6(struct mlxsw_sp_acl_rule_info *rulei,
382 struct flow_cls_offload *f)
383 {
384 struct flow_match_ipv6_addrs match;
385
386 flow_rule_match_ipv6_addrs(f->rule, &match);
387
388 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_96_127,
389 &match.key->src.s6_addr[0x0],
390 &match.mask->src.s6_addr[0x0], 4);
391 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_64_95,
392 &match.key->src.s6_addr[0x4],
393 &match.mask->src.s6_addr[0x4], 4);
394 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_32_63,
395 &match.key->src.s6_addr[0x8],
396 &match.mask->src.s6_addr[0x8], 4);
397 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31,
398 &match.key->src.s6_addr[0xC],
399 &match.mask->src.s6_addr[0xC], 4);
400 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_96_127,
401 &match.key->dst.s6_addr[0x0],
402 &match.mask->dst.s6_addr[0x0], 4);
403 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_64_95,
404 &match.key->dst.s6_addr[0x4],
405 &match.mask->dst.s6_addr[0x4], 4);
406 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_32_63,
407 &match.key->dst.s6_addr[0x8],
408 &match.mask->dst.s6_addr[0x8], 4);
409 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31,
410 &match.key->dst.s6_addr[0xC],
411 &match.mask->dst.s6_addr[0xC], 4);
412 }
413
mlxsw_sp_flower_parse_ports(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,struct flow_cls_offload * f,u8 ip_proto)414 static int mlxsw_sp_flower_parse_ports(struct mlxsw_sp *mlxsw_sp,
415 struct mlxsw_sp_acl_rule_info *rulei,
416 struct flow_cls_offload *f,
417 u8 ip_proto)
418 {
419 const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
420 struct flow_match_ports match;
421
422 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS))
423 return 0;
424
425 if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
426 NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported");
427 dev_err(mlxsw_sp->bus_info->dev, "Only UDP and TCP keys are supported\n");
428 return -EINVAL;
429 }
430
431 flow_rule_match_ports(rule, &match);
432 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_L4_PORT,
433 ntohs(match.key->dst),
434 ntohs(match.mask->dst));
435 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_L4_PORT,
436 ntohs(match.key->src),
437 ntohs(match.mask->src));
438 return 0;
439 }
440
441 static int
mlxsw_sp_flower_parse_ports_range(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,struct flow_cls_offload * f,u8 ip_proto)442 mlxsw_sp_flower_parse_ports_range(struct mlxsw_sp *mlxsw_sp,
443 struct mlxsw_sp_acl_rule_info *rulei,
444 struct flow_cls_offload *f, u8 ip_proto)
445 {
446 const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
447 struct flow_match_ports_range match;
448 u32 key_mask_value = 0;
449
450 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS_RANGE))
451 return 0;
452
453 if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
454 NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported");
455 return -EINVAL;
456 }
457
458 flow_rule_match_ports_range(rule, &match);
459
460 if (match.mask->tp_min.src) {
461 struct mlxsw_sp_port_range range = {
462 .min = ntohs(match.key->tp_min.src),
463 .max = ntohs(match.key->tp_max.src),
464 .source = true,
465 };
466 u8 prr_index;
467 int err;
468
469 err = mlxsw_sp_port_range_reg_get(mlxsw_sp, &range,
470 f->common.extack, &prr_index);
471 if (err)
472 return err;
473
474 rulei->src_port_range_reg_index = prr_index;
475 rulei->src_port_range_reg_valid = true;
476 key_mask_value |= BIT(prr_index);
477 }
478
479 if (match.mask->tp_min.dst) {
480 struct mlxsw_sp_port_range range = {
481 .min = ntohs(match.key->tp_min.dst),
482 .max = ntohs(match.key->tp_max.dst),
483 };
484 u8 prr_index;
485 int err;
486
487 err = mlxsw_sp_port_range_reg_get(mlxsw_sp, &range,
488 f->common.extack, &prr_index);
489 if (err)
490 return err;
491
492 rulei->dst_port_range_reg_index = prr_index;
493 rulei->dst_port_range_reg_valid = true;
494 key_mask_value |= BIT(prr_index);
495 }
496
497 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_L4_PORT_RANGE,
498 key_mask_value, key_mask_value);
499
500 return 0;
501 }
502
mlxsw_sp_flower_parse_tcp(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,struct flow_cls_offload * f,u8 ip_proto)503 static int mlxsw_sp_flower_parse_tcp(struct mlxsw_sp *mlxsw_sp,
504 struct mlxsw_sp_acl_rule_info *rulei,
505 struct flow_cls_offload *f,
506 u8 ip_proto)
507 {
508 const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
509 struct flow_match_tcp match;
510
511 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_TCP))
512 return 0;
513
514 if (ip_proto != IPPROTO_TCP) {
515 NL_SET_ERR_MSG_MOD(f->common.extack, "TCP keys supported only for TCP");
516 dev_err(mlxsw_sp->bus_info->dev, "TCP keys supported only for TCP\n");
517 return -EINVAL;
518 }
519
520 flow_rule_match_tcp(rule, &match);
521
522 if (match.mask->flags & htons(0x0E00)) {
523 NL_SET_ERR_MSG_MOD(f->common.extack, "TCP flags match not supported on reserved bits");
524 dev_err(mlxsw_sp->bus_info->dev, "TCP flags match not supported on reserved bits\n");
525 return -EINVAL;
526 }
527
528 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_TCP_FLAGS,
529 ntohs(match.key->flags),
530 ntohs(match.mask->flags));
531 return 0;
532 }
533
mlxsw_sp_flower_parse_ip(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,struct flow_cls_offload * f,u16 n_proto)534 static int mlxsw_sp_flower_parse_ip(struct mlxsw_sp *mlxsw_sp,
535 struct mlxsw_sp_acl_rule_info *rulei,
536 struct flow_cls_offload *f,
537 u16 n_proto)
538 {
539 const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
540 struct flow_match_ip match;
541
542 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IP))
543 return 0;
544
545 if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6) {
546 NL_SET_ERR_MSG_MOD(f->common.extack, "IP keys supported only for IPv4/6");
547 dev_err(mlxsw_sp->bus_info->dev, "IP keys supported only for IPv4/6\n");
548 return -EINVAL;
549 }
550
551 flow_rule_match_ip(rule, &match);
552
553 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_TTL_,
554 match.key->ttl, match.mask->ttl);
555
556 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_ECN,
557 match.key->tos & 0x3,
558 match.mask->tos & 0x3);
559
560 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_DSCP,
561 match.key->tos >> 2,
562 match.mask->tos >> 2);
563
564 return 0;
565 }
566
mlxsw_sp_flower_parse(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_flow_block * block,struct mlxsw_sp_acl_rule_info * rulei,struct flow_cls_offload * f)567 static int mlxsw_sp_flower_parse(struct mlxsw_sp *mlxsw_sp,
568 struct mlxsw_sp_flow_block *block,
569 struct mlxsw_sp_acl_rule_info *rulei,
570 struct flow_cls_offload *f)
571 {
572 struct flow_rule *rule = flow_cls_offload_flow_rule(f);
573 struct flow_dissector *dissector = rule->match.dissector;
574 u16 n_proto_mask = 0;
575 u16 n_proto_key = 0;
576 u16 addr_type = 0;
577 u8 ip_proto = 0;
578 int err;
579
580 if (dissector->used_keys &
581 ~(BIT_ULL(FLOW_DISSECTOR_KEY_META) |
582 BIT_ULL(FLOW_DISSECTOR_KEY_CONTROL) |
583 BIT_ULL(FLOW_DISSECTOR_KEY_BASIC) |
584 BIT_ULL(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
585 BIT_ULL(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
586 BIT_ULL(FLOW_DISSECTOR_KEY_IPV6_ADDRS) |
587 BIT_ULL(FLOW_DISSECTOR_KEY_PORTS) |
588 BIT_ULL(FLOW_DISSECTOR_KEY_PORTS_RANGE) |
589 BIT_ULL(FLOW_DISSECTOR_KEY_TCP) |
590 BIT_ULL(FLOW_DISSECTOR_KEY_IP) |
591 BIT_ULL(FLOW_DISSECTOR_KEY_VLAN))) {
592 dev_err(mlxsw_sp->bus_info->dev, "Unsupported key\n");
593 NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported key");
594 return -EOPNOTSUPP;
595 }
596
597 mlxsw_sp_acl_rulei_priority(rulei, f->common.prio);
598
599 err = mlxsw_sp_flower_parse_meta(rulei, f, block);
600 if (err)
601 return err;
602
603 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CONTROL)) {
604 struct flow_match_control match;
605
606 flow_rule_match_control(rule, &match);
607 addr_type = match.key->addr_type;
608
609 if (flow_rule_has_control_flags(match.mask->flags,
610 f->common.extack))
611 return -EOPNOTSUPP;
612 }
613
614 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) {
615 struct flow_match_basic match;
616
617 flow_rule_match_basic(rule, &match);
618 n_proto_key = ntohs(match.key->n_proto);
619 n_proto_mask = ntohs(match.mask->n_proto);
620
621 if (n_proto_key == ETH_P_ALL) {
622 n_proto_key = 0;
623 n_proto_mask = 0;
624 }
625 mlxsw_sp_acl_rulei_keymask_u32(rulei,
626 MLXSW_AFK_ELEMENT_ETHERTYPE,
627 n_proto_key, n_proto_mask);
628
629 ip_proto = match.key->ip_proto;
630 mlxsw_sp_acl_rulei_keymask_u32(rulei,
631 MLXSW_AFK_ELEMENT_IP_PROTO,
632 match.key->ip_proto,
633 match.mask->ip_proto);
634 }
635
636 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
637 struct flow_match_eth_addrs match;
638
639 flow_rule_match_eth_addrs(rule, &match);
640 mlxsw_sp_acl_rulei_keymask_buf(rulei,
641 MLXSW_AFK_ELEMENT_DMAC_32_47,
642 match.key->dst,
643 match.mask->dst, 2);
644 mlxsw_sp_acl_rulei_keymask_buf(rulei,
645 MLXSW_AFK_ELEMENT_DMAC_0_31,
646 match.key->dst + 2,
647 match.mask->dst + 2, 4);
648 mlxsw_sp_acl_rulei_keymask_buf(rulei,
649 MLXSW_AFK_ELEMENT_SMAC_32_47,
650 match.key->src,
651 match.mask->src, 2);
652 mlxsw_sp_acl_rulei_keymask_buf(rulei,
653 MLXSW_AFK_ELEMENT_SMAC_0_31,
654 match.key->src + 2,
655 match.mask->src + 2, 4);
656 }
657
658 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) {
659 struct flow_match_vlan match;
660
661 flow_rule_match_vlan(rule, &match);
662 if (mlxsw_sp_flow_block_is_egress_bound(block) &&
663 match.mask->vlan_id) {
664 NL_SET_ERR_MSG_MOD(f->common.extack, "vlan_id key is not supported on egress");
665 return -EOPNOTSUPP;
666 }
667
668 /* Forbid block with this rulei to be bound
669 * to egress in future.
670 */
671 rulei->egress_bind_blocker = 1;
672
673 if (match.mask->vlan_id != 0)
674 mlxsw_sp_acl_rulei_keymask_u32(rulei,
675 MLXSW_AFK_ELEMENT_VID,
676 match.key->vlan_id,
677 match.mask->vlan_id);
678 if (match.mask->vlan_priority != 0)
679 mlxsw_sp_acl_rulei_keymask_u32(rulei,
680 MLXSW_AFK_ELEMENT_PCP,
681 match.key->vlan_priority,
682 match.mask->vlan_priority);
683 }
684
685 if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS)
686 mlxsw_sp_flower_parse_ipv4(rulei, f);
687
688 if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS)
689 mlxsw_sp_flower_parse_ipv6(rulei, f);
690
691 err = mlxsw_sp_flower_parse_ports(mlxsw_sp, rulei, f, ip_proto);
692 if (err)
693 return err;
694
695 err = mlxsw_sp_flower_parse_ports_range(mlxsw_sp, rulei, f, ip_proto);
696 if (err)
697 return err;
698
699 err = mlxsw_sp_flower_parse_tcp(mlxsw_sp, rulei, f, ip_proto);
700 if (err)
701 return err;
702
703 err = mlxsw_sp_flower_parse_ip(mlxsw_sp, rulei, f, n_proto_key & n_proto_mask);
704 if (err)
705 return err;
706
707 return mlxsw_sp_flower_parse_actions(mlxsw_sp, block, rulei,
708 &f->rule->action,
709 f->common.extack);
710 }
711
mlxsw_sp_flower_mall_prio_check(struct mlxsw_sp_flow_block * block,struct flow_cls_offload * f)712 static int mlxsw_sp_flower_mall_prio_check(struct mlxsw_sp_flow_block *block,
713 struct flow_cls_offload *f)
714 {
715 bool ingress = mlxsw_sp_flow_block_is_ingress_bound(block);
716 unsigned int mall_min_prio;
717 unsigned int mall_max_prio;
718 int err;
719
720 err = mlxsw_sp_mall_prio_get(block, f->common.chain_index,
721 &mall_min_prio, &mall_max_prio);
722 if (err) {
723 if (err == -ENOENT)
724 /* No matchall filters installed on this chain. */
725 return 0;
726 NL_SET_ERR_MSG(f->common.extack, "Failed to get matchall priorities");
727 return err;
728 }
729 if (ingress && f->common.prio <= mall_min_prio) {
730 NL_SET_ERR_MSG(f->common.extack, "Failed to add in front of existing matchall rules");
731 return -EOPNOTSUPP;
732 }
733 if (!ingress && f->common.prio >= mall_max_prio) {
734 NL_SET_ERR_MSG(f->common.extack, "Failed to add behind of existing matchall rules");
735 return -EOPNOTSUPP;
736 }
737 return 0;
738 }
739
mlxsw_sp_flower_replace(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_flow_block * block,struct flow_cls_offload * f)740 int mlxsw_sp_flower_replace(struct mlxsw_sp *mlxsw_sp,
741 struct mlxsw_sp_flow_block *block,
742 struct flow_cls_offload *f)
743 {
744 struct mlxsw_sp_acl_rule_info *rulei;
745 struct mlxsw_sp_acl_ruleset *ruleset;
746 struct mlxsw_sp_acl_rule *rule;
747 int err;
748
749 err = mlxsw_sp_flower_mall_prio_check(block, f);
750 if (err)
751 return err;
752
753 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
754 f->common.chain_index,
755 MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
756 if (IS_ERR(ruleset))
757 return PTR_ERR(ruleset);
758
759 rule = mlxsw_sp_acl_rule_create(mlxsw_sp, ruleset, f->cookie, NULL,
760 f->common.extack);
761 if (IS_ERR(rule)) {
762 err = PTR_ERR(rule);
763 goto err_rule_create;
764 }
765
766 rulei = mlxsw_sp_acl_rule_rulei(rule);
767 err = mlxsw_sp_flower_parse(mlxsw_sp, block, rulei, f);
768 if (err)
769 goto err_flower_parse;
770
771 err = mlxsw_sp_acl_rulei_commit(rulei);
772 if (err)
773 goto err_rulei_commit;
774
775 err = mlxsw_sp_acl_rule_add(mlxsw_sp, rule);
776 if (err)
777 goto err_rule_add;
778
779 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
780 return 0;
781
782 err_rule_add:
783 err_rulei_commit:
784 err_flower_parse:
785 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
786 err_rule_create:
787 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
788 return err;
789 }
790
mlxsw_sp_flower_destroy(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_flow_block * block,struct flow_cls_offload * f)791 void mlxsw_sp_flower_destroy(struct mlxsw_sp *mlxsw_sp,
792 struct mlxsw_sp_flow_block *block,
793 struct flow_cls_offload *f)
794 {
795 struct mlxsw_sp_acl_ruleset *ruleset;
796 struct mlxsw_sp_acl_rule *rule;
797
798 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
799 f->common.chain_index,
800 MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
801 if (IS_ERR(ruleset))
802 return;
803
804 rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
805 if (rule) {
806 mlxsw_sp_acl_rule_del(mlxsw_sp, rule);
807 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
808 }
809
810 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
811 }
812
mlxsw_sp_flower_stats(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_flow_block * block,struct flow_cls_offload * f)813 int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp,
814 struct mlxsw_sp_flow_block *block,
815 struct flow_cls_offload *f)
816 {
817 enum flow_action_hw_stats used_hw_stats = FLOW_ACTION_HW_STATS_DISABLED;
818 struct mlxsw_sp_acl_ruleset *ruleset;
819 struct mlxsw_sp_acl_rule *rule;
820 u64 packets;
821 u64 lastuse;
822 u64 bytes;
823 u64 drops;
824 int err;
825
826 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
827 f->common.chain_index,
828 MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
829 if (WARN_ON(IS_ERR(ruleset)))
830 return -EINVAL;
831
832 rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
833 if (!rule)
834 return -EINVAL;
835
836 err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes,
837 &drops, &lastuse, &used_hw_stats);
838 if (err)
839 goto err_rule_get_stats;
840
841 flow_stats_update(&f->stats, bytes, packets, drops, lastuse,
842 used_hw_stats);
843
844 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
845 return 0;
846
847 err_rule_get_stats:
848 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
849 return err;
850 }
851
mlxsw_sp_flower_tmplt_create(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_flow_block * block,struct flow_cls_offload * f)852 int mlxsw_sp_flower_tmplt_create(struct mlxsw_sp *mlxsw_sp,
853 struct mlxsw_sp_flow_block *block,
854 struct flow_cls_offload *f)
855 {
856 struct mlxsw_sp_acl_ruleset *ruleset;
857 struct mlxsw_sp_acl_rule_info rulei;
858 int err;
859
860 memset(&rulei, 0, sizeof(rulei));
861 err = mlxsw_sp_flower_parse(mlxsw_sp, block, &rulei, f);
862 if (err)
863 return err;
864 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
865 f->common.chain_index,
866 MLXSW_SP_ACL_PROFILE_FLOWER,
867 &rulei.values.elusage);
868
869 /* keep the reference to the ruleset */
870 return PTR_ERR_OR_ZERO(ruleset);
871 }
872
mlxsw_sp_flower_tmplt_destroy(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_flow_block * block,struct flow_cls_offload * f)873 void mlxsw_sp_flower_tmplt_destroy(struct mlxsw_sp *mlxsw_sp,
874 struct mlxsw_sp_flow_block *block,
875 struct flow_cls_offload *f)
876 {
877 struct mlxsw_sp_acl_ruleset *ruleset;
878
879 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
880 f->common.chain_index,
881 MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
882 if (IS_ERR(ruleset))
883 return;
884 /* put the reference to the ruleset kept in create */
885 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
886 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
887 }
888
mlxsw_sp_flower_prio_get(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_flow_block * block,u32 chain_index,unsigned int * p_min_prio,unsigned int * p_max_prio)889 int mlxsw_sp_flower_prio_get(struct mlxsw_sp *mlxsw_sp,
890 struct mlxsw_sp_flow_block *block,
891 u32 chain_index, unsigned int *p_min_prio,
892 unsigned int *p_max_prio)
893 {
894 struct mlxsw_sp_acl_ruleset *ruleset;
895
896 ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
897 chain_index,
898 MLXSW_SP_ACL_PROFILE_FLOWER);
899 if (IS_ERR(ruleset))
900 /* In case there are no flower rules, the caller
901 * receives -ENOENT to indicate there is no need
902 * to check the priorities.
903 */
904 return PTR_ERR(ruleset);
905 mlxsw_sp_acl_ruleset_prio_get(ruleset, p_min_prio, p_max_prio);
906 return 0;
907 }
908