1 /* SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB */ 2 /* Copyright (c) 2018 Mellanox Technologies. */ 3 4 #include <net/vxlan.h> 5 #include <net/gre.h> 6 #include <net/geneve.h> 7 #include <net/bareudp.h> 8 #include "en/tc_tun.h" 9 #include "en_tc.h" 10 #include "rep/tc.h" 11 #include "rep/neigh.h" 12 13 struct mlx5e_tc_tunnel *mlx5e_get_tc_tun(struct net_device *tunnel_dev) 14 { 15 if (netif_is_vxlan(tunnel_dev)) 16 return &vxlan_tunnel; 17 else if (netif_is_geneve(tunnel_dev)) 18 return &geneve_tunnel; 19 else if (netif_is_gretap(tunnel_dev) || 20 netif_is_ip6gretap(tunnel_dev)) 21 return &gre_tunnel; 22 else if (netif_is_bareudp(tunnel_dev)) 23 return &mplsoudp_tunnel; 24 else 25 return NULL; 26 } 27 28 static int get_route_and_out_devs(struct mlx5e_priv *priv, 29 struct net_device *dev, 30 struct net_device **route_dev, 31 struct net_device **out_dev) 32 { 33 struct net_device *uplink_dev, *uplink_upper, *real_dev; 34 struct mlx5_eswitch *esw = priv->mdev->priv.eswitch; 35 bool dst_is_lag_dev; 36 37 real_dev = is_vlan_dev(dev) ? vlan_dev_real_dev(dev) : dev; 38 uplink_dev = mlx5_eswitch_uplink_get_proto_dev(esw, REP_ETH); 39 40 rcu_read_lock(); 41 uplink_upper = netdev_master_upper_dev_get_rcu(uplink_dev); 42 /* mlx5_lag_is_sriov() is a blocking function which can't be called 43 * while holding rcu read lock. Take the net_device for correctness 44 * sake. 45 */ 46 if (uplink_upper) 47 dev_hold(uplink_upper); 48 rcu_read_unlock(); 49 50 dst_is_lag_dev = (uplink_upper && 51 netif_is_lag_master(uplink_upper) && 52 real_dev == uplink_upper && 53 mlx5_lag_is_sriov(priv->mdev)); 54 if (uplink_upper) 55 dev_put(uplink_upper); 56 57 /* if the egress device isn't on the same HW e-switch or 58 * it's a LAG device, use the uplink 59 */ 60 *route_dev = dev; 61 if (!netdev_port_same_parent_id(priv->netdev, real_dev) || 62 dst_is_lag_dev || is_vlan_dev(*route_dev)) 63 *out_dev = uplink_dev; 64 else if (mlx5e_eswitch_rep(dev) && 65 mlx5e_is_valid_eswitch_fwd_dev(priv, dev)) 66 *out_dev = *route_dev; 67 else 68 return -EOPNOTSUPP; 69 70 if (!(mlx5e_eswitch_rep(*out_dev) && 71 mlx5e_is_uplink_rep(netdev_priv(*out_dev)))) 72 return -EOPNOTSUPP; 73 74 if (mlx5e_eswitch_uplink_rep(priv->netdev) && *out_dev != priv->netdev) 75 return -EOPNOTSUPP; 76 77 return 0; 78 } 79 80 static int mlx5e_route_lookup_ipv4(struct mlx5e_priv *priv, 81 struct net_device *mirred_dev, 82 struct net_device **out_dev, 83 struct net_device **route_dev, 84 struct flowi4 *fl4, 85 struct neighbour **out_n, 86 u8 *out_ttl) 87 { 88 struct neighbour *n; 89 struct rtable *rt; 90 91 #if IS_ENABLED(CONFIG_INET) 92 struct mlx5_core_dev *mdev = priv->mdev; 93 struct net_device *uplink_dev; 94 int ret; 95 96 if (mlx5_lag_is_multipath(mdev)) { 97 struct mlx5_eswitch *esw = mdev->priv.eswitch; 98 99 uplink_dev = mlx5_eswitch_uplink_get_proto_dev(esw, REP_ETH); 100 fl4->flowi4_oif = uplink_dev->ifindex; 101 } 102 103 rt = ip_route_output_key(dev_net(mirred_dev), fl4); 104 if (IS_ERR(rt)) 105 return PTR_ERR(rt); 106 107 if (mlx5_lag_is_multipath(mdev) && rt->rt_gw_family != AF_INET) { 108 ip_rt_put(rt); 109 return -ENETUNREACH; 110 } 111 #else 112 return -EOPNOTSUPP; 113 #endif 114 115 ret = get_route_and_out_devs(priv, rt->dst.dev, route_dev, out_dev); 116 if (ret < 0) { 117 ip_rt_put(rt); 118 return ret; 119 } 120 121 if (!(*out_ttl)) 122 *out_ttl = ip4_dst_hoplimit(&rt->dst); 123 n = dst_neigh_lookup(&rt->dst, &fl4->daddr); 124 ip_rt_put(rt); 125 if (!n) 126 return -ENOMEM; 127 128 *out_n = n; 129 return 0; 130 } 131 132 static const char *mlx5e_netdev_kind(struct net_device *dev) 133 { 134 if (dev->rtnl_link_ops) 135 return dev->rtnl_link_ops->kind; 136 else 137 return "unknown"; 138 } 139 140 static int mlx5e_gen_ip_tunnel_header(char buf[], __u8 *ip_proto, 141 struct mlx5e_encap_entry *e) 142 { 143 if (!e->tunnel) { 144 pr_warn("mlx5: Cannot generate tunnel header for this tunnel\n"); 145 return -EOPNOTSUPP; 146 } 147 148 return e->tunnel->generate_ip_tun_hdr(buf, ip_proto, e); 149 } 150 151 static char *gen_eth_tnl_hdr(char *buf, struct net_device *dev, 152 struct mlx5e_encap_entry *e, 153 u16 proto) 154 { 155 struct ethhdr *eth = (struct ethhdr *)buf; 156 char *ip; 157 158 ether_addr_copy(eth->h_dest, e->h_dest); 159 ether_addr_copy(eth->h_source, dev->dev_addr); 160 if (is_vlan_dev(dev)) { 161 struct vlan_hdr *vlan = (struct vlan_hdr *) 162 ((char *)eth + ETH_HLEN); 163 ip = (char *)vlan + VLAN_HLEN; 164 eth->h_proto = vlan_dev_vlan_proto(dev); 165 vlan->h_vlan_TCI = htons(vlan_dev_vlan_id(dev)); 166 vlan->h_vlan_encapsulated_proto = htons(proto); 167 } else { 168 eth->h_proto = htons(proto); 169 ip = (char *)eth + ETH_HLEN; 170 } 171 172 return ip; 173 } 174 175 int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv, 176 struct net_device *mirred_dev, 177 struct mlx5e_encap_entry *e) 178 { 179 int max_encap_size = MLX5_CAP_ESW(priv->mdev, max_encap_header_size); 180 const struct ip_tunnel_key *tun_key = &e->tun_info->key; 181 struct net_device *out_dev, *route_dev; 182 struct flowi4 fl4 = {}; 183 struct neighbour *n; 184 int ipv4_encap_size; 185 char *encap_header; 186 u8 nud_state, ttl; 187 struct iphdr *ip; 188 int err; 189 190 /* add the IP fields */ 191 fl4.flowi4_tos = tun_key->tos; 192 fl4.daddr = tun_key->u.ipv4.dst; 193 fl4.saddr = tun_key->u.ipv4.src; 194 ttl = tun_key->ttl; 195 196 err = mlx5e_route_lookup_ipv4(priv, mirred_dev, &out_dev, &route_dev, 197 &fl4, &n, &ttl); 198 if (err) 199 return err; 200 201 ipv4_encap_size = 202 (is_vlan_dev(route_dev) ? VLAN_ETH_HLEN : ETH_HLEN) + 203 sizeof(struct iphdr) + 204 e->tunnel->calc_hlen(e); 205 206 if (max_encap_size < ipv4_encap_size) { 207 mlx5_core_warn(priv->mdev, "encap size %d too big, max supported is %d\n", 208 ipv4_encap_size, max_encap_size); 209 err = -EOPNOTSUPP; 210 goto release_neigh; 211 } 212 213 encap_header = kzalloc(ipv4_encap_size, GFP_KERNEL); 214 if (!encap_header) { 215 err = -ENOMEM; 216 goto release_neigh; 217 } 218 219 /* used by mlx5e_detach_encap to lookup a neigh hash table 220 * entry in the neigh hash table when a user deletes a rule 221 */ 222 e->m_neigh.dev = n->dev; 223 e->m_neigh.family = n->ops->family; 224 memcpy(&e->m_neigh.dst_ip, n->primary_key, n->tbl->key_len); 225 e->out_dev = out_dev; 226 e->route_dev = route_dev; 227 228 /* It's important to add the neigh to the hash table before checking 229 * the neigh validity state. So if we'll get a notification, in case the 230 * neigh changes it's validity state, we would find the relevant neigh 231 * in the hash. 232 */ 233 err = mlx5e_rep_encap_entry_attach(netdev_priv(out_dev), e); 234 if (err) 235 goto free_encap; 236 237 read_lock_bh(&n->lock); 238 nud_state = n->nud_state; 239 ether_addr_copy(e->h_dest, n->ha); 240 read_unlock_bh(&n->lock); 241 242 /* add ethernet header */ 243 ip = (struct iphdr *)gen_eth_tnl_hdr(encap_header, route_dev, e, 244 ETH_P_IP); 245 246 /* add ip header */ 247 ip->tos = tun_key->tos; 248 ip->version = 0x4; 249 ip->ihl = 0x5; 250 ip->ttl = ttl; 251 ip->daddr = fl4.daddr; 252 ip->saddr = fl4.saddr; 253 254 /* add tunneling protocol header */ 255 err = mlx5e_gen_ip_tunnel_header((char *)ip + sizeof(struct iphdr), 256 &ip->protocol, e); 257 if (err) 258 goto destroy_neigh_entry; 259 260 e->encap_size = ipv4_encap_size; 261 e->encap_header = encap_header; 262 263 if (!(nud_state & NUD_VALID)) { 264 neigh_event_send(n, NULL); 265 /* the encap entry will be made valid on neigh update event 266 * and not used before that. 267 */ 268 goto release_neigh; 269 } 270 e->pkt_reformat = mlx5_packet_reformat_alloc(priv->mdev, 271 e->reformat_type, 272 ipv4_encap_size, encap_header, 273 MLX5_FLOW_NAMESPACE_FDB); 274 if (IS_ERR(e->pkt_reformat)) { 275 err = PTR_ERR(e->pkt_reformat); 276 goto destroy_neigh_entry; 277 } 278 279 e->flags |= MLX5_ENCAP_ENTRY_VALID; 280 mlx5e_rep_queue_neigh_stats_work(netdev_priv(out_dev)); 281 neigh_release(n); 282 return err; 283 284 destroy_neigh_entry: 285 mlx5e_rep_encap_entry_detach(netdev_priv(e->out_dev), e); 286 free_encap: 287 kfree(encap_header); 288 release_neigh: 289 neigh_release(n); 290 return err; 291 } 292 293 #if IS_ENABLED(CONFIG_INET) && IS_ENABLED(CONFIG_IPV6) 294 static int mlx5e_route_lookup_ipv6(struct mlx5e_priv *priv, 295 struct net_device *mirred_dev, 296 struct net_device **out_dev, 297 struct net_device **route_dev, 298 struct flowi6 *fl6, 299 struct neighbour **out_n, 300 u8 *out_ttl) 301 { 302 struct dst_entry *dst; 303 struct neighbour *n; 304 305 int ret; 306 307 dst = ipv6_stub->ipv6_dst_lookup_flow(dev_net(mirred_dev), NULL, fl6, 308 NULL); 309 if (IS_ERR(dst)) 310 return PTR_ERR(dst); 311 312 if (!(*out_ttl)) 313 *out_ttl = ip6_dst_hoplimit(dst); 314 315 ret = get_route_and_out_devs(priv, dst->dev, route_dev, out_dev); 316 if (ret < 0) { 317 dst_release(dst); 318 return ret; 319 } 320 321 n = dst_neigh_lookup(dst, &fl6->daddr); 322 dst_release(dst); 323 if (!n) 324 return -ENOMEM; 325 326 *out_n = n; 327 return 0; 328 } 329 330 int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv, 331 struct net_device *mirred_dev, 332 struct mlx5e_encap_entry *e) 333 { 334 int max_encap_size = MLX5_CAP_ESW(priv->mdev, max_encap_header_size); 335 const struct ip_tunnel_key *tun_key = &e->tun_info->key; 336 struct net_device *out_dev, *route_dev; 337 struct flowi6 fl6 = {}; 338 struct ipv6hdr *ip6h; 339 struct neighbour *n = NULL; 340 int ipv6_encap_size; 341 char *encap_header; 342 u8 nud_state, ttl; 343 int err; 344 345 ttl = tun_key->ttl; 346 347 fl6.flowlabel = ip6_make_flowinfo(RT_TOS(tun_key->tos), tun_key->label); 348 fl6.daddr = tun_key->u.ipv6.dst; 349 fl6.saddr = tun_key->u.ipv6.src; 350 351 err = mlx5e_route_lookup_ipv6(priv, mirred_dev, &out_dev, &route_dev, 352 &fl6, &n, &ttl); 353 if (err) 354 return err; 355 356 ipv6_encap_size = 357 (is_vlan_dev(route_dev) ? VLAN_ETH_HLEN : ETH_HLEN) + 358 sizeof(struct ipv6hdr) + 359 e->tunnel->calc_hlen(e); 360 361 if (max_encap_size < ipv6_encap_size) { 362 mlx5_core_warn(priv->mdev, "encap size %d too big, max supported is %d\n", 363 ipv6_encap_size, max_encap_size); 364 err = -EOPNOTSUPP; 365 goto release_neigh; 366 } 367 368 encap_header = kzalloc(ipv6_encap_size, GFP_KERNEL); 369 if (!encap_header) { 370 err = -ENOMEM; 371 goto release_neigh; 372 } 373 374 /* used by mlx5e_detach_encap to lookup a neigh hash table 375 * entry in the neigh hash table when a user deletes a rule 376 */ 377 e->m_neigh.dev = n->dev; 378 e->m_neigh.family = n->ops->family; 379 memcpy(&e->m_neigh.dst_ip, n->primary_key, n->tbl->key_len); 380 e->out_dev = out_dev; 381 e->route_dev = route_dev; 382 383 /* It's importent to add the neigh to the hash table before checking 384 * the neigh validity state. So if we'll get a notification, in case the 385 * neigh changes it's validity state, we would find the relevant neigh 386 * in the hash. 387 */ 388 err = mlx5e_rep_encap_entry_attach(netdev_priv(out_dev), e); 389 if (err) 390 goto free_encap; 391 392 read_lock_bh(&n->lock); 393 nud_state = n->nud_state; 394 ether_addr_copy(e->h_dest, n->ha); 395 read_unlock_bh(&n->lock); 396 397 /* add ethernet header */ 398 ip6h = (struct ipv6hdr *)gen_eth_tnl_hdr(encap_header, route_dev, e, 399 ETH_P_IPV6); 400 401 /* add ip header */ 402 ip6_flow_hdr(ip6h, tun_key->tos, 0); 403 /* the HW fills up ipv6 payload len */ 404 ip6h->hop_limit = ttl; 405 ip6h->daddr = fl6.daddr; 406 ip6h->saddr = fl6.saddr; 407 408 /* add tunneling protocol header */ 409 err = mlx5e_gen_ip_tunnel_header((char *)ip6h + sizeof(struct ipv6hdr), 410 &ip6h->nexthdr, e); 411 if (err) 412 goto destroy_neigh_entry; 413 414 e->encap_size = ipv6_encap_size; 415 e->encap_header = encap_header; 416 417 if (!(nud_state & NUD_VALID)) { 418 neigh_event_send(n, NULL); 419 /* the encap entry will be made valid on neigh update event 420 * and not used before that. 421 */ 422 goto release_neigh; 423 } 424 425 e->pkt_reformat = mlx5_packet_reformat_alloc(priv->mdev, 426 e->reformat_type, 427 ipv6_encap_size, encap_header, 428 MLX5_FLOW_NAMESPACE_FDB); 429 if (IS_ERR(e->pkt_reformat)) { 430 err = PTR_ERR(e->pkt_reformat); 431 goto destroy_neigh_entry; 432 } 433 434 e->flags |= MLX5_ENCAP_ENTRY_VALID; 435 mlx5e_rep_queue_neigh_stats_work(netdev_priv(out_dev)); 436 neigh_release(n); 437 return err; 438 439 destroy_neigh_entry: 440 mlx5e_rep_encap_entry_detach(netdev_priv(e->out_dev), e); 441 free_encap: 442 kfree(encap_header); 443 release_neigh: 444 neigh_release(n); 445 return err; 446 } 447 #endif 448 449 bool mlx5e_tc_tun_device_to_offload(struct mlx5e_priv *priv, 450 struct net_device *netdev) 451 { 452 struct mlx5e_tc_tunnel *tunnel = mlx5e_get_tc_tun(netdev); 453 454 if (tunnel && tunnel->can_offload(priv)) 455 return true; 456 else 457 return false; 458 } 459 460 int mlx5e_tc_tun_init_encap_attr(struct net_device *tunnel_dev, 461 struct mlx5e_priv *priv, 462 struct mlx5e_encap_entry *e, 463 struct netlink_ext_ack *extack) 464 { 465 struct mlx5e_tc_tunnel *tunnel = mlx5e_get_tc_tun(tunnel_dev); 466 467 if (!tunnel) { 468 e->reformat_type = -1; 469 return -EOPNOTSUPP; 470 } 471 472 return tunnel->init_encap_attr(tunnel_dev, priv, e, extack); 473 } 474 475 int mlx5e_tc_tun_parse(struct net_device *filter_dev, 476 struct mlx5e_priv *priv, 477 struct mlx5_flow_spec *spec, 478 struct flow_cls_offload *f, 479 u8 *match_level) 480 { 481 struct mlx5e_tc_tunnel *tunnel = mlx5e_get_tc_tun(filter_dev); 482 struct flow_rule *rule = flow_cls_offload_flow_rule(f); 483 void *headers_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria, 484 outer_headers); 485 void *headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, 486 outer_headers); 487 struct netlink_ext_ack *extack = f->common.extack; 488 int err = 0; 489 490 if (!tunnel) { 491 netdev_warn(priv->netdev, 492 "decapsulation offload is not supported for %s net device\n", 493 mlx5e_netdev_kind(filter_dev)); 494 err = -EOPNOTSUPP; 495 goto out; 496 } 497 498 *match_level = tunnel->match_level; 499 500 if (tunnel->parse_udp_ports) { 501 err = tunnel->parse_udp_ports(priv, spec, f, 502 headers_c, headers_v); 503 if (err) 504 goto out; 505 } 506 507 if (tunnel->parse_tunnel) { 508 err = tunnel->parse_tunnel(priv, spec, f, 509 headers_c, headers_v); 510 if (err) 511 goto out; 512 } 513 514 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_CONTROL)) { 515 struct flow_dissector_key_basic key_basic = {}; 516 struct flow_dissector_key_basic mask_basic = { 517 .n_proto = htons(0xFFFF), 518 }; 519 struct flow_match_basic match_basic = { 520 .key = &key_basic, .mask = &mask_basic, 521 }; 522 struct flow_match_control match; 523 u16 addr_type; 524 525 flow_rule_match_enc_control(rule, &match); 526 addr_type = match.key->addr_type; 527 528 /* For tunnel addr_type used same key id`s as for non-tunnel */ 529 if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) { 530 struct flow_match_ipv4_addrs match; 531 532 flow_rule_match_enc_ipv4_addrs(rule, &match); 533 MLX5_SET(fte_match_set_lyr_2_4, headers_c, 534 src_ipv4_src_ipv6.ipv4_layout.ipv4, 535 ntohl(match.mask->src)); 536 MLX5_SET(fte_match_set_lyr_2_4, headers_v, 537 src_ipv4_src_ipv6.ipv4_layout.ipv4, 538 ntohl(match.key->src)); 539 540 MLX5_SET(fte_match_set_lyr_2_4, headers_c, 541 dst_ipv4_dst_ipv6.ipv4_layout.ipv4, 542 ntohl(match.mask->dst)); 543 MLX5_SET(fte_match_set_lyr_2_4, headers_v, 544 dst_ipv4_dst_ipv6.ipv4_layout.ipv4, 545 ntohl(match.key->dst)); 546 547 key_basic.n_proto = htons(ETH_P_IP); 548 mlx5e_tc_set_ethertype(priv->mdev, &match_basic, true, 549 headers_c, headers_v); 550 } else if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS) { 551 struct flow_match_ipv6_addrs match; 552 553 flow_rule_match_enc_ipv6_addrs(rule, &match); 554 memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c, 555 src_ipv4_src_ipv6.ipv6_layout.ipv6), 556 &match.mask->src, MLX5_FLD_SZ_BYTES(ipv6_layout, 557 ipv6)); 558 memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v, 559 src_ipv4_src_ipv6.ipv6_layout.ipv6), 560 &match.key->src, MLX5_FLD_SZ_BYTES(ipv6_layout, 561 ipv6)); 562 563 memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c, 564 dst_ipv4_dst_ipv6.ipv6_layout.ipv6), 565 &match.mask->dst, MLX5_FLD_SZ_BYTES(ipv6_layout, 566 ipv6)); 567 memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v, 568 dst_ipv4_dst_ipv6.ipv6_layout.ipv6), 569 &match.key->dst, MLX5_FLD_SZ_BYTES(ipv6_layout, 570 ipv6)); 571 572 key_basic.n_proto = htons(ETH_P_IPV6); 573 mlx5e_tc_set_ethertype(priv->mdev, &match_basic, true, 574 headers_c, headers_v); 575 } 576 } 577 578 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_IP)) { 579 struct flow_match_ip match; 580 581 flow_rule_match_enc_ip(rule, &match); 582 MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_ecn, 583 match.mask->tos & 0x3); 584 MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_ecn, 585 match.key->tos & 0x3); 586 587 MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_dscp, 588 match.mask->tos >> 2); 589 MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_dscp, 590 match.key->tos >> 2); 591 592 MLX5_SET(fte_match_set_lyr_2_4, headers_c, ttl_hoplimit, 593 match.mask->ttl); 594 MLX5_SET(fte_match_set_lyr_2_4, headers_v, ttl_hoplimit, 595 match.key->ttl); 596 597 if (match.mask->ttl && 598 !MLX5_CAP_ESW_FLOWTABLE_FDB 599 (priv->mdev, 600 ft_field_support.outer_ipv4_ttl)) { 601 NL_SET_ERR_MSG_MOD(extack, 602 "Matching on TTL is not supported"); 603 err = -EOPNOTSUPP; 604 goto out; 605 } 606 } 607 608 /* Enforce DMAC when offloading incoming tunneled flows. 609 * Flow counters require a match on the DMAC. 610 */ 611 MLX5_SET_TO_ONES(fte_match_set_lyr_2_4, headers_c, dmac_47_16); 612 MLX5_SET_TO_ONES(fte_match_set_lyr_2_4, headers_c, dmac_15_0); 613 ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v, 614 dmac_47_16), priv->netdev->dev_addr); 615 616 /* let software handle IP fragments */ 617 MLX5_SET(fte_match_set_lyr_2_4, headers_c, frag, 1); 618 MLX5_SET(fte_match_set_lyr_2_4, headers_v, frag, 0); 619 620 return 0; 621 622 out: 623 return err; 624 } 625 626 int mlx5e_tc_tun_parse_udp_ports(struct mlx5e_priv *priv, 627 struct mlx5_flow_spec *spec, 628 struct flow_cls_offload *f, 629 void *headers_c, 630 void *headers_v) 631 { 632 struct flow_rule *rule = flow_cls_offload_flow_rule(f); 633 struct netlink_ext_ack *extack = f->common.extack; 634 struct flow_match_ports enc_ports; 635 636 /* Full udp dst port must be given */ 637 638 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_PORTS)) { 639 NL_SET_ERR_MSG_MOD(extack, 640 "UDP tunnel decap filter must include enc_dst_port condition"); 641 netdev_warn(priv->netdev, 642 "UDP tunnel decap filter must include enc_dst_port condition\n"); 643 return -EOPNOTSUPP; 644 } 645 646 flow_rule_match_enc_ports(rule, &enc_ports); 647 648 if (memchr_inv(&enc_ports.mask->dst, 0xff, 649 sizeof(enc_ports.mask->dst))) { 650 NL_SET_ERR_MSG_MOD(extack, 651 "UDP tunnel decap filter must match enc_dst_port fully"); 652 netdev_warn(priv->netdev, 653 "UDP tunnel decap filter must match enc_dst_port fully\n"); 654 return -EOPNOTSUPP; 655 } 656 657 /* match on UDP protocol and dst port number */ 658 659 MLX5_SET_TO_ONES(fte_match_set_lyr_2_4, headers_c, ip_protocol); 660 MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol, IPPROTO_UDP); 661 662 MLX5_SET(fte_match_set_lyr_2_4, headers_c, udp_dport, 663 ntohs(enc_ports.mask->dst)); 664 MLX5_SET(fte_match_set_lyr_2_4, headers_v, udp_dport, 665 ntohs(enc_ports.key->dst)); 666 667 /* UDP src port on outer header is generated by HW, 668 * so it is probably a bad idea to request matching it. 669 * Nonetheless, it is allowed. 670 */ 671 672 MLX5_SET(fte_match_set_lyr_2_4, headers_c, udp_sport, 673 ntohs(enc_ports.mask->src)); 674 MLX5_SET(fte_match_set_lyr_2_4, headers_v, udp_sport, 675 ntohs(enc_ports.key->src)); 676 677 return 0; 678 } 679