1 /* SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB */ 2 /* Copyright (c) 2018 Mellanox Technologies. */ 3 4 #include <net/vxlan.h> 5 #include <net/gre.h> 6 #include <net/geneve.h> 7 #include <net/bareudp.h> 8 #include "en/tc_tun.h" 9 #include "en_tc.h" 10 #include "rep/tc.h" 11 #include "rep/neigh.h" 12 13 struct mlx5e_tc_tunnel *mlx5e_get_tc_tun(struct net_device *tunnel_dev) 14 { 15 if (netif_is_vxlan(tunnel_dev)) 16 return &vxlan_tunnel; 17 else if (netif_is_geneve(tunnel_dev)) 18 return &geneve_tunnel; 19 else if (netif_is_gretap(tunnel_dev) || 20 netif_is_ip6gretap(tunnel_dev)) 21 return &gre_tunnel; 22 else if (netif_is_bareudp(tunnel_dev)) 23 return &mplsoudp_tunnel; 24 else 25 return NULL; 26 } 27 28 static int get_route_and_out_devs(struct mlx5e_priv *priv, 29 struct net_device *dev, 30 struct net_device **route_dev, 31 struct net_device **out_dev) 32 { 33 struct net_device *uplink_dev, *uplink_upper, *real_dev; 34 struct mlx5_eswitch *esw = priv->mdev->priv.eswitch; 35 bool dst_is_lag_dev; 36 37 real_dev = is_vlan_dev(dev) ? vlan_dev_real_dev(dev) : dev; 38 uplink_dev = mlx5_eswitch_uplink_get_proto_dev(esw, REP_ETH); 39 40 rcu_read_lock(); 41 uplink_upper = netdev_master_upper_dev_get_rcu(uplink_dev); 42 /* mlx5_lag_is_sriov() is a blocking function which can't be called 43 * while holding rcu read lock. Take the net_device for correctness 44 * sake. 45 */ 46 if (uplink_upper) 47 dev_hold(uplink_upper); 48 rcu_read_unlock(); 49 50 dst_is_lag_dev = (uplink_upper && 51 netif_is_lag_master(uplink_upper) && 52 real_dev == uplink_upper && 53 mlx5_lag_is_sriov(priv->mdev)); 54 if (uplink_upper) 55 dev_put(uplink_upper); 56 57 /* if the egress device isn't on the same HW e-switch or 58 * it's a LAG device, use the uplink 59 */ 60 *route_dev = dev; 61 if (!netdev_port_same_parent_id(priv->netdev, real_dev) || 62 dst_is_lag_dev || is_vlan_dev(*route_dev)) 63 *out_dev = uplink_dev; 64 else if (mlx5e_eswitch_rep(dev) && 65 mlx5e_is_valid_eswitch_fwd_dev(priv, dev)) 66 *out_dev = *route_dev; 67 else 68 return -EOPNOTSUPP; 69 70 if (!(mlx5e_eswitch_rep(*out_dev) && 71 mlx5e_is_uplink_rep(netdev_priv(*out_dev)))) 72 return -EOPNOTSUPP; 73 74 if (mlx5e_eswitch_uplink_rep(priv->netdev) && *out_dev != priv->netdev) 75 return -EOPNOTSUPP; 76 77 return 0; 78 } 79 80 static int mlx5e_route_lookup_ipv4_get(struct mlx5e_priv *priv, 81 struct net_device *mirred_dev, 82 struct net_device **out_dev, 83 struct net_device **route_dev, 84 struct flowi4 *fl4, 85 struct neighbour **out_n, 86 u8 *out_ttl) 87 { 88 struct neighbour *n; 89 struct rtable *rt; 90 91 #if IS_ENABLED(CONFIG_INET) 92 struct mlx5_core_dev *mdev = priv->mdev; 93 struct net_device *uplink_dev; 94 int ret; 95 96 if (mlx5_lag_is_multipath(mdev)) { 97 struct mlx5_eswitch *esw = mdev->priv.eswitch; 98 99 uplink_dev = mlx5_eswitch_uplink_get_proto_dev(esw, REP_ETH); 100 fl4->flowi4_oif = uplink_dev->ifindex; 101 } 102 103 rt = ip_route_output_key(dev_net(mirred_dev), fl4); 104 if (IS_ERR(rt)) 105 return PTR_ERR(rt); 106 107 if (mlx5_lag_is_multipath(mdev) && rt->rt_gw_family != AF_INET) { 108 ip_rt_put(rt); 109 return -ENETUNREACH; 110 } 111 #else 112 return -EOPNOTSUPP; 113 #endif 114 115 ret = get_route_and_out_devs(priv, rt->dst.dev, route_dev, out_dev); 116 if (ret < 0) { 117 ip_rt_put(rt); 118 return ret; 119 } 120 dev_hold(*route_dev); 121 122 if (!(*out_ttl)) 123 *out_ttl = ip4_dst_hoplimit(&rt->dst); 124 n = dst_neigh_lookup(&rt->dst, &fl4->daddr); 125 ip_rt_put(rt); 126 if (!n) { 127 dev_put(*route_dev); 128 return -ENOMEM; 129 } 130 131 *out_n = n; 132 return 0; 133 } 134 135 static void mlx5e_route_lookup_ipv4_put(struct net_device *route_dev, 136 struct neighbour *n) 137 { 138 neigh_release(n); 139 dev_put(route_dev); 140 } 141 142 static const char *mlx5e_netdev_kind(struct net_device *dev) 143 { 144 if (dev->rtnl_link_ops) 145 return dev->rtnl_link_ops->kind; 146 else 147 return "unknown"; 148 } 149 150 static int mlx5e_gen_ip_tunnel_header(char buf[], __u8 *ip_proto, 151 struct mlx5e_encap_entry *e) 152 { 153 if (!e->tunnel) { 154 pr_warn("mlx5: Cannot generate tunnel header for this tunnel\n"); 155 return -EOPNOTSUPP; 156 } 157 158 return e->tunnel->generate_ip_tun_hdr(buf, ip_proto, e); 159 } 160 161 static char *gen_eth_tnl_hdr(char *buf, struct net_device *dev, 162 struct mlx5e_encap_entry *e, 163 u16 proto) 164 { 165 struct ethhdr *eth = (struct ethhdr *)buf; 166 char *ip; 167 168 ether_addr_copy(eth->h_dest, e->h_dest); 169 ether_addr_copy(eth->h_source, dev->dev_addr); 170 if (is_vlan_dev(dev)) { 171 struct vlan_hdr *vlan = (struct vlan_hdr *) 172 ((char *)eth + ETH_HLEN); 173 ip = (char *)vlan + VLAN_HLEN; 174 eth->h_proto = vlan_dev_vlan_proto(dev); 175 vlan->h_vlan_TCI = htons(vlan_dev_vlan_id(dev)); 176 vlan->h_vlan_encapsulated_proto = htons(proto); 177 } else { 178 eth->h_proto = htons(proto); 179 ip = (char *)eth + ETH_HLEN; 180 } 181 182 return ip; 183 } 184 185 int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv, 186 struct net_device *mirred_dev, 187 struct mlx5e_encap_entry *e) 188 { 189 int max_encap_size = MLX5_CAP_ESW(priv->mdev, max_encap_header_size); 190 const struct ip_tunnel_key *tun_key = &e->tun_info->key; 191 struct net_device *out_dev, *route_dev; 192 struct flowi4 fl4 = {}; 193 struct neighbour *n; 194 int ipv4_encap_size; 195 char *encap_header; 196 u8 nud_state, ttl; 197 struct iphdr *ip; 198 int err; 199 200 /* add the IP fields */ 201 fl4.flowi4_tos = tun_key->tos; 202 fl4.daddr = tun_key->u.ipv4.dst; 203 fl4.saddr = tun_key->u.ipv4.src; 204 ttl = tun_key->ttl; 205 206 err = mlx5e_route_lookup_ipv4_get(priv, mirred_dev, &out_dev, &route_dev, 207 &fl4, &n, &ttl); 208 if (err) 209 return err; 210 211 ipv4_encap_size = 212 (is_vlan_dev(route_dev) ? VLAN_ETH_HLEN : ETH_HLEN) + 213 sizeof(struct iphdr) + 214 e->tunnel->calc_hlen(e); 215 216 if (max_encap_size < ipv4_encap_size) { 217 mlx5_core_warn(priv->mdev, "encap size %d too big, max supported is %d\n", 218 ipv4_encap_size, max_encap_size); 219 err = -EOPNOTSUPP; 220 goto release_neigh; 221 } 222 223 encap_header = kzalloc(ipv4_encap_size, GFP_KERNEL); 224 if (!encap_header) { 225 err = -ENOMEM; 226 goto release_neigh; 227 } 228 229 /* used by mlx5e_detach_encap to lookup a neigh hash table 230 * entry in the neigh hash table when a user deletes a rule 231 */ 232 e->m_neigh.dev = n->dev; 233 e->m_neigh.family = n->ops->family; 234 memcpy(&e->m_neigh.dst_ip, n->primary_key, n->tbl->key_len); 235 e->out_dev = out_dev; 236 e->route_dev_ifindex = route_dev->ifindex; 237 238 /* It's important to add the neigh to the hash table before checking 239 * the neigh validity state. So if we'll get a notification, in case the 240 * neigh changes it's validity state, we would find the relevant neigh 241 * in the hash. 242 */ 243 err = mlx5e_rep_encap_entry_attach(netdev_priv(out_dev), e); 244 if (err) 245 goto free_encap; 246 247 read_lock_bh(&n->lock); 248 nud_state = n->nud_state; 249 ether_addr_copy(e->h_dest, n->ha); 250 read_unlock_bh(&n->lock); 251 252 /* add ethernet header */ 253 ip = (struct iphdr *)gen_eth_tnl_hdr(encap_header, route_dev, e, 254 ETH_P_IP); 255 256 /* add ip header */ 257 ip->tos = tun_key->tos; 258 ip->version = 0x4; 259 ip->ihl = 0x5; 260 ip->ttl = ttl; 261 ip->daddr = fl4.daddr; 262 ip->saddr = fl4.saddr; 263 264 /* add tunneling protocol header */ 265 err = mlx5e_gen_ip_tunnel_header((char *)ip + sizeof(struct iphdr), 266 &ip->protocol, e); 267 if (err) 268 goto destroy_neigh_entry; 269 270 e->encap_size = ipv4_encap_size; 271 e->encap_header = encap_header; 272 273 if (!(nud_state & NUD_VALID)) { 274 neigh_event_send(n, NULL); 275 /* the encap entry will be made valid on neigh update event 276 * and not used before that. 277 */ 278 goto release_neigh; 279 } 280 e->pkt_reformat = mlx5_packet_reformat_alloc(priv->mdev, 281 e->reformat_type, 282 ipv4_encap_size, encap_header, 283 MLX5_FLOW_NAMESPACE_FDB); 284 if (IS_ERR(e->pkt_reformat)) { 285 err = PTR_ERR(e->pkt_reformat); 286 goto destroy_neigh_entry; 287 } 288 289 e->flags |= MLX5_ENCAP_ENTRY_VALID; 290 mlx5e_rep_queue_neigh_stats_work(netdev_priv(out_dev)); 291 mlx5e_route_lookup_ipv4_put(route_dev, n); 292 return err; 293 294 destroy_neigh_entry: 295 mlx5e_rep_encap_entry_detach(netdev_priv(e->out_dev), e); 296 free_encap: 297 kfree(encap_header); 298 release_neigh: 299 mlx5e_route_lookup_ipv4_put(route_dev, n); 300 return err; 301 } 302 303 #if IS_ENABLED(CONFIG_INET) && IS_ENABLED(CONFIG_IPV6) 304 static int mlx5e_route_lookup_ipv6_get(struct mlx5e_priv *priv, 305 struct net_device *mirred_dev, 306 struct net_device **out_dev, 307 struct net_device **route_dev, 308 struct flowi6 *fl6, 309 struct neighbour **out_n, 310 u8 *out_ttl) 311 { 312 struct dst_entry *dst; 313 struct neighbour *n; 314 315 int ret; 316 317 dst = ipv6_stub->ipv6_dst_lookup_flow(dev_net(mirred_dev), NULL, fl6, 318 NULL); 319 if (IS_ERR(dst)) 320 return PTR_ERR(dst); 321 322 if (!(*out_ttl)) 323 *out_ttl = ip6_dst_hoplimit(dst); 324 325 ret = get_route_and_out_devs(priv, dst->dev, route_dev, out_dev); 326 if (ret < 0) { 327 dst_release(dst); 328 return ret; 329 } 330 331 dev_hold(*route_dev); 332 n = dst_neigh_lookup(dst, &fl6->daddr); 333 dst_release(dst); 334 if (!n) { 335 dev_put(*route_dev); 336 return -ENOMEM; 337 } 338 339 *out_n = n; 340 return 0; 341 } 342 343 static void mlx5e_route_lookup_ipv6_put(struct net_device *route_dev, 344 struct neighbour *n) 345 { 346 neigh_release(n); 347 dev_put(route_dev); 348 } 349 350 int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv, 351 struct net_device *mirred_dev, 352 struct mlx5e_encap_entry *e) 353 { 354 int max_encap_size = MLX5_CAP_ESW(priv->mdev, max_encap_header_size); 355 const struct ip_tunnel_key *tun_key = &e->tun_info->key; 356 struct net_device *out_dev, *route_dev; 357 struct flowi6 fl6 = {}; 358 struct ipv6hdr *ip6h; 359 struct neighbour *n = NULL; 360 int ipv6_encap_size; 361 char *encap_header; 362 u8 nud_state, ttl; 363 int err; 364 365 ttl = tun_key->ttl; 366 367 fl6.flowlabel = ip6_make_flowinfo(RT_TOS(tun_key->tos), tun_key->label); 368 fl6.daddr = tun_key->u.ipv6.dst; 369 fl6.saddr = tun_key->u.ipv6.src; 370 371 err = mlx5e_route_lookup_ipv6_get(priv, mirred_dev, &out_dev, &route_dev, 372 &fl6, &n, &ttl); 373 if (err) 374 return err; 375 376 ipv6_encap_size = 377 (is_vlan_dev(route_dev) ? VLAN_ETH_HLEN : ETH_HLEN) + 378 sizeof(struct ipv6hdr) + 379 e->tunnel->calc_hlen(e); 380 381 if (max_encap_size < ipv6_encap_size) { 382 mlx5_core_warn(priv->mdev, "encap size %d too big, max supported is %d\n", 383 ipv6_encap_size, max_encap_size); 384 err = -EOPNOTSUPP; 385 goto release_neigh; 386 } 387 388 encap_header = kzalloc(ipv6_encap_size, GFP_KERNEL); 389 if (!encap_header) { 390 err = -ENOMEM; 391 goto release_neigh; 392 } 393 394 /* used by mlx5e_detach_encap to lookup a neigh hash table 395 * entry in the neigh hash table when a user deletes a rule 396 */ 397 e->m_neigh.dev = n->dev; 398 e->m_neigh.family = n->ops->family; 399 memcpy(&e->m_neigh.dst_ip, n->primary_key, n->tbl->key_len); 400 e->out_dev = out_dev; 401 e->route_dev_ifindex = route_dev->ifindex; 402 403 /* It's importent to add the neigh to the hash table before checking 404 * the neigh validity state. So if we'll get a notification, in case the 405 * neigh changes it's validity state, we would find the relevant neigh 406 * in the hash. 407 */ 408 err = mlx5e_rep_encap_entry_attach(netdev_priv(out_dev), e); 409 if (err) 410 goto free_encap; 411 412 read_lock_bh(&n->lock); 413 nud_state = n->nud_state; 414 ether_addr_copy(e->h_dest, n->ha); 415 read_unlock_bh(&n->lock); 416 417 /* add ethernet header */ 418 ip6h = (struct ipv6hdr *)gen_eth_tnl_hdr(encap_header, route_dev, e, 419 ETH_P_IPV6); 420 421 /* add ip header */ 422 ip6_flow_hdr(ip6h, tun_key->tos, 0); 423 /* the HW fills up ipv6 payload len */ 424 ip6h->hop_limit = ttl; 425 ip6h->daddr = fl6.daddr; 426 ip6h->saddr = fl6.saddr; 427 428 /* add tunneling protocol header */ 429 err = mlx5e_gen_ip_tunnel_header((char *)ip6h + sizeof(struct ipv6hdr), 430 &ip6h->nexthdr, e); 431 if (err) 432 goto destroy_neigh_entry; 433 434 e->encap_size = ipv6_encap_size; 435 e->encap_header = encap_header; 436 437 if (!(nud_state & NUD_VALID)) { 438 neigh_event_send(n, NULL); 439 /* the encap entry will be made valid on neigh update event 440 * and not used before that. 441 */ 442 goto release_neigh; 443 } 444 445 e->pkt_reformat = mlx5_packet_reformat_alloc(priv->mdev, 446 e->reformat_type, 447 ipv6_encap_size, encap_header, 448 MLX5_FLOW_NAMESPACE_FDB); 449 if (IS_ERR(e->pkt_reformat)) { 450 err = PTR_ERR(e->pkt_reformat); 451 goto destroy_neigh_entry; 452 } 453 454 e->flags |= MLX5_ENCAP_ENTRY_VALID; 455 mlx5e_rep_queue_neigh_stats_work(netdev_priv(out_dev)); 456 mlx5e_route_lookup_ipv6_put(route_dev, n); 457 return err; 458 459 destroy_neigh_entry: 460 mlx5e_rep_encap_entry_detach(netdev_priv(e->out_dev), e); 461 free_encap: 462 kfree(encap_header); 463 release_neigh: 464 mlx5e_route_lookup_ipv6_put(route_dev, n); 465 return err; 466 } 467 #endif 468 469 bool mlx5e_tc_tun_device_to_offload(struct mlx5e_priv *priv, 470 struct net_device *netdev) 471 { 472 struct mlx5e_tc_tunnel *tunnel = mlx5e_get_tc_tun(netdev); 473 474 if (tunnel && tunnel->can_offload(priv)) 475 return true; 476 else 477 return false; 478 } 479 480 int mlx5e_tc_tun_init_encap_attr(struct net_device *tunnel_dev, 481 struct mlx5e_priv *priv, 482 struct mlx5e_encap_entry *e, 483 struct netlink_ext_ack *extack) 484 { 485 struct mlx5e_tc_tunnel *tunnel = mlx5e_get_tc_tun(tunnel_dev); 486 487 if (!tunnel) { 488 e->reformat_type = -1; 489 return -EOPNOTSUPP; 490 } 491 492 return tunnel->init_encap_attr(tunnel_dev, priv, e, extack); 493 } 494 495 int mlx5e_tc_tun_parse(struct net_device *filter_dev, 496 struct mlx5e_priv *priv, 497 struct mlx5_flow_spec *spec, 498 struct flow_cls_offload *f, 499 u8 *match_level) 500 { 501 struct mlx5e_tc_tunnel *tunnel = mlx5e_get_tc_tun(filter_dev); 502 struct flow_rule *rule = flow_cls_offload_flow_rule(f); 503 void *headers_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria, 504 outer_headers); 505 void *headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value, 506 outer_headers); 507 struct netlink_ext_ack *extack = f->common.extack; 508 int err = 0; 509 510 if (!tunnel) { 511 netdev_warn(priv->netdev, 512 "decapsulation offload is not supported for %s net device\n", 513 mlx5e_netdev_kind(filter_dev)); 514 err = -EOPNOTSUPP; 515 goto out; 516 } 517 518 *match_level = tunnel->match_level; 519 520 if (tunnel->parse_udp_ports) { 521 err = tunnel->parse_udp_ports(priv, spec, f, 522 headers_c, headers_v); 523 if (err) 524 goto out; 525 } 526 527 if (tunnel->parse_tunnel) { 528 err = tunnel->parse_tunnel(priv, spec, f, 529 headers_c, headers_v); 530 if (err) 531 goto out; 532 } 533 534 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_CONTROL)) { 535 struct flow_dissector_key_basic key_basic = {}; 536 struct flow_dissector_key_basic mask_basic = { 537 .n_proto = htons(0xFFFF), 538 }; 539 struct flow_match_basic match_basic = { 540 .key = &key_basic, .mask = &mask_basic, 541 }; 542 struct flow_match_control match; 543 u16 addr_type; 544 545 flow_rule_match_enc_control(rule, &match); 546 addr_type = match.key->addr_type; 547 548 /* For tunnel addr_type used same key id`s as for non-tunnel */ 549 if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) { 550 struct flow_match_ipv4_addrs match; 551 552 flow_rule_match_enc_ipv4_addrs(rule, &match); 553 MLX5_SET(fte_match_set_lyr_2_4, headers_c, 554 src_ipv4_src_ipv6.ipv4_layout.ipv4, 555 ntohl(match.mask->src)); 556 MLX5_SET(fte_match_set_lyr_2_4, headers_v, 557 src_ipv4_src_ipv6.ipv4_layout.ipv4, 558 ntohl(match.key->src)); 559 560 MLX5_SET(fte_match_set_lyr_2_4, headers_c, 561 dst_ipv4_dst_ipv6.ipv4_layout.ipv4, 562 ntohl(match.mask->dst)); 563 MLX5_SET(fte_match_set_lyr_2_4, headers_v, 564 dst_ipv4_dst_ipv6.ipv4_layout.ipv4, 565 ntohl(match.key->dst)); 566 567 key_basic.n_proto = htons(ETH_P_IP); 568 mlx5e_tc_set_ethertype(priv->mdev, &match_basic, true, 569 headers_c, headers_v); 570 } else if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS) { 571 struct flow_match_ipv6_addrs match; 572 573 flow_rule_match_enc_ipv6_addrs(rule, &match); 574 memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c, 575 src_ipv4_src_ipv6.ipv6_layout.ipv6), 576 &match.mask->src, MLX5_FLD_SZ_BYTES(ipv6_layout, 577 ipv6)); 578 memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v, 579 src_ipv4_src_ipv6.ipv6_layout.ipv6), 580 &match.key->src, MLX5_FLD_SZ_BYTES(ipv6_layout, 581 ipv6)); 582 583 memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c, 584 dst_ipv4_dst_ipv6.ipv6_layout.ipv6), 585 &match.mask->dst, MLX5_FLD_SZ_BYTES(ipv6_layout, 586 ipv6)); 587 memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v, 588 dst_ipv4_dst_ipv6.ipv6_layout.ipv6), 589 &match.key->dst, MLX5_FLD_SZ_BYTES(ipv6_layout, 590 ipv6)); 591 592 key_basic.n_proto = htons(ETH_P_IPV6); 593 mlx5e_tc_set_ethertype(priv->mdev, &match_basic, true, 594 headers_c, headers_v); 595 } 596 } 597 598 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_IP)) { 599 struct flow_match_ip match; 600 601 flow_rule_match_enc_ip(rule, &match); 602 MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_ecn, 603 match.mask->tos & 0x3); 604 MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_ecn, 605 match.key->tos & 0x3); 606 607 MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_dscp, 608 match.mask->tos >> 2); 609 MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_dscp, 610 match.key->tos >> 2); 611 612 MLX5_SET(fte_match_set_lyr_2_4, headers_c, ttl_hoplimit, 613 match.mask->ttl); 614 MLX5_SET(fte_match_set_lyr_2_4, headers_v, ttl_hoplimit, 615 match.key->ttl); 616 617 if (match.mask->ttl && 618 !MLX5_CAP_ESW_FLOWTABLE_FDB 619 (priv->mdev, 620 ft_field_support.outer_ipv4_ttl)) { 621 NL_SET_ERR_MSG_MOD(extack, 622 "Matching on TTL is not supported"); 623 err = -EOPNOTSUPP; 624 goto out; 625 } 626 } 627 628 /* Enforce DMAC when offloading incoming tunneled flows. 629 * Flow counters require a match on the DMAC. 630 */ 631 MLX5_SET_TO_ONES(fte_match_set_lyr_2_4, headers_c, dmac_47_16); 632 MLX5_SET_TO_ONES(fte_match_set_lyr_2_4, headers_c, dmac_15_0); 633 ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v, 634 dmac_47_16), priv->netdev->dev_addr); 635 636 /* let software handle IP fragments */ 637 MLX5_SET(fte_match_set_lyr_2_4, headers_c, frag, 1); 638 MLX5_SET(fte_match_set_lyr_2_4, headers_v, frag, 0); 639 640 return 0; 641 642 out: 643 return err; 644 } 645 646 int mlx5e_tc_tun_parse_udp_ports(struct mlx5e_priv *priv, 647 struct mlx5_flow_spec *spec, 648 struct flow_cls_offload *f, 649 void *headers_c, 650 void *headers_v) 651 { 652 struct flow_rule *rule = flow_cls_offload_flow_rule(f); 653 struct netlink_ext_ack *extack = f->common.extack; 654 struct flow_match_ports enc_ports; 655 656 /* Full udp dst port must be given */ 657 658 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_PORTS)) { 659 NL_SET_ERR_MSG_MOD(extack, 660 "UDP tunnel decap filter must include enc_dst_port condition"); 661 netdev_warn(priv->netdev, 662 "UDP tunnel decap filter must include enc_dst_port condition\n"); 663 return -EOPNOTSUPP; 664 } 665 666 flow_rule_match_enc_ports(rule, &enc_ports); 667 668 if (memchr_inv(&enc_ports.mask->dst, 0xff, 669 sizeof(enc_ports.mask->dst))) { 670 NL_SET_ERR_MSG_MOD(extack, 671 "UDP tunnel decap filter must match enc_dst_port fully"); 672 netdev_warn(priv->netdev, 673 "UDP tunnel decap filter must match enc_dst_port fully\n"); 674 return -EOPNOTSUPP; 675 } 676 677 /* match on UDP protocol and dst port number */ 678 679 MLX5_SET_TO_ONES(fte_match_set_lyr_2_4, headers_c, ip_protocol); 680 MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol, IPPROTO_UDP); 681 682 MLX5_SET(fte_match_set_lyr_2_4, headers_c, udp_dport, 683 ntohs(enc_ports.mask->dst)); 684 MLX5_SET(fte_match_set_lyr_2_4, headers_v, udp_dport, 685 ntohs(enc_ports.key->dst)); 686 687 /* UDP src port on outer header is generated by HW, 688 * so it is probably a bad idea to request matching it. 689 * Nonetheless, it is allowed. 690 */ 691 692 MLX5_SET(fte_match_set_lyr_2_4, headers_c, udp_sport, 693 ntohs(enc_ports.mask->src)); 694 MLX5_SET(fte_match_set_lyr_2_4, headers_v, udp_sport, 695 ntohs(enc_ports.key->src)); 696 697 return 0; 698 } 699