1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */
3 
4 #include <linux/kernel.h>
5 #include <linux/errno.h>
6 #include <linux/netdevice.h>
7 #include <linux/log2.h>
8 #include <net/net_namespace.h>
9 #include <net/flow_dissector.h>
10 #include <net/pkt_cls.h>
11 #include <net/tc_act/tc_gact.h>
12 #include <net/tc_act/tc_mirred.h>
13 #include <net/tc_act/tc_vlan.h>
14 
15 #include "spectrum.h"
16 #include "core_acl_flex_keys.h"
17 
18 static int mlxsw_sp_policer_validate(const struct flow_action *action,
19 				     const struct flow_action_entry *act,
20 				     struct netlink_ext_ack *extack)
21 {
22 	if (act->police.exceed.act_id != FLOW_ACTION_DROP) {
23 		NL_SET_ERR_MSG_MOD(extack,
24 				   "Offload not supported when exceed action is not drop");
25 		return -EOPNOTSUPP;
26 	}
27 
28 	if (act->police.notexceed.act_id != FLOW_ACTION_PIPE &&
29 	    act->police.notexceed.act_id != FLOW_ACTION_ACCEPT) {
30 		NL_SET_ERR_MSG_MOD(extack,
31 				   "Offload not supported when conform action is not pipe or ok");
32 		return -EOPNOTSUPP;
33 	}
34 
35 	if (act->police.notexceed.act_id == FLOW_ACTION_ACCEPT &&
36 	    !flow_action_is_last_entry(action, act)) {
37 		NL_SET_ERR_MSG_MOD(extack,
38 				   "Offload not supported when conform action is ok, but action is not last");
39 		return -EOPNOTSUPP;
40 	}
41 
42 	if (act->police.peakrate_bytes_ps ||
43 	    act->police.avrate || act->police.overhead) {
44 		NL_SET_ERR_MSG_MOD(extack,
45 				   "Offload not supported when peakrate/avrate/overhead is configured");
46 		return -EOPNOTSUPP;
47 	}
48 
49 	if (act->police.rate_pkt_ps) {
50 		NL_SET_ERR_MSG_MOD(extack,
51 				   "QoS offload not support packets per second");
52 		return -EOPNOTSUPP;
53 	}
54 
55 	return 0;
56 }
57 
58 static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
59 					 struct mlxsw_sp_flow_block *block,
60 					 struct mlxsw_sp_acl_rule_info *rulei,
61 					 struct flow_action *flow_action,
62 					 struct netlink_ext_ack *extack)
63 {
64 	const struct flow_action_entry *act;
65 	int mirror_act_count = 0;
66 	int police_act_count = 0;
67 	int sample_act_count = 0;
68 	int err, i;
69 
70 	if (!flow_action_has_entries(flow_action))
71 		return 0;
72 	if (!flow_action_mixed_hw_stats_check(flow_action, extack))
73 		return -EOPNOTSUPP;
74 
75 	act = flow_action_first_entry_get(flow_action);
76 	if (act->hw_stats & FLOW_ACTION_HW_STATS_DISABLED) {
77 		/* Nothing to do */
78 	} else if (act->hw_stats & FLOW_ACTION_HW_STATS_IMMEDIATE) {
79 		/* Count action is inserted first */
80 		err = mlxsw_sp_acl_rulei_act_count(mlxsw_sp, rulei, extack);
81 		if (err)
82 			return err;
83 	} else {
84 		NL_SET_ERR_MSG_MOD(extack, "Unsupported action HW stats type");
85 		return -EOPNOTSUPP;
86 	}
87 
88 	flow_action_for_each(i, act, flow_action) {
89 		switch (act->id) {
90 		case FLOW_ACTION_ACCEPT:
91 			err = mlxsw_sp_acl_rulei_act_terminate(rulei);
92 			if (err) {
93 				NL_SET_ERR_MSG_MOD(extack, "Cannot append terminate action");
94 				return err;
95 			}
96 			break;
97 		case FLOW_ACTION_DROP: {
98 			bool ingress;
99 
100 			if (mlxsw_sp_flow_block_is_mixed_bound(block)) {
101 				NL_SET_ERR_MSG_MOD(extack, "Drop action is not supported when block is bound to ingress and egress");
102 				return -EOPNOTSUPP;
103 			}
104 			ingress = mlxsw_sp_flow_block_is_ingress_bound(block);
105 			err = mlxsw_sp_acl_rulei_act_drop(rulei, ingress,
106 							  act->user_cookie, extack);
107 			if (err) {
108 				NL_SET_ERR_MSG_MOD(extack, "Cannot append drop action");
109 				return err;
110 			}
111 
112 			/* Forbid block with this rulei to be bound
113 			 * to ingress/egress in future. Ingress rule is
114 			 * a blocker for egress and vice versa.
115 			 */
116 			if (ingress)
117 				rulei->egress_bind_blocker = 1;
118 			else
119 				rulei->ingress_bind_blocker = 1;
120 			}
121 			break;
122 		case FLOW_ACTION_TRAP:
123 			err = mlxsw_sp_acl_rulei_act_trap(rulei);
124 			if (err) {
125 				NL_SET_ERR_MSG_MOD(extack, "Cannot append trap action");
126 				return err;
127 			}
128 			break;
129 		case FLOW_ACTION_GOTO: {
130 			u32 chain_index = act->chain_index;
131 			struct mlxsw_sp_acl_ruleset *ruleset;
132 			u16 group_id;
133 
134 			ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
135 							      chain_index,
136 							      MLXSW_SP_ACL_PROFILE_FLOWER);
137 			if (IS_ERR(ruleset))
138 				return PTR_ERR(ruleset);
139 
140 			group_id = mlxsw_sp_acl_ruleset_group_id(ruleset);
141 			err = mlxsw_sp_acl_rulei_act_jump(rulei, group_id);
142 			if (err) {
143 				NL_SET_ERR_MSG_MOD(extack, "Cannot append jump action");
144 				return err;
145 			}
146 			}
147 			break;
148 		case FLOW_ACTION_REDIRECT: {
149 			struct net_device *out_dev;
150 			struct mlxsw_sp_fid *fid;
151 			u16 fid_index;
152 
153 			if (mlxsw_sp_flow_block_is_egress_bound(block)) {
154 				NL_SET_ERR_MSG_MOD(extack, "Redirect action is not supported on egress");
155 				return -EOPNOTSUPP;
156 			}
157 
158 			/* Forbid block with this rulei to be bound
159 			 * to egress in future.
160 			 */
161 			rulei->egress_bind_blocker = 1;
162 
163 			/* Ignore learning and security lookup as redirection
164 			 * using ingress filters happens before the bridge.
165 			 */
166 			err = mlxsw_sp_acl_rulei_act_ignore(mlxsw_sp, rulei,
167 							    true, true);
168 			if (err) {
169 				NL_SET_ERR_MSG_MOD(extack, "Cannot append ignore action");
170 				return err;
171 			}
172 
173 			fid = mlxsw_sp_acl_dummy_fid(mlxsw_sp);
174 			fid_index = mlxsw_sp_fid_index(fid);
175 			err = mlxsw_sp_acl_rulei_act_fid_set(mlxsw_sp, rulei,
176 							     fid_index, extack);
177 			if (err)
178 				return err;
179 
180 			out_dev = act->dev;
181 			err = mlxsw_sp_acl_rulei_act_fwd(mlxsw_sp, rulei,
182 							 out_dev, extack);
183 			if (err)
184 				return err;
185 			}
186 			break;
187 		case FLOW_ACTION_MIRRED: {
188 			struct net_device *out_dev = act->dev;
189 
190 			if (mirror_act_count++) {
191 				NL_SET_ERR_MSG_MOD(extack, "Multiple mirror actions per rule are not supported");
192 				return -EOPNOTSUPP;
193 			}
194 
195 			err = mlxsw_sp_acl_rulei_act_mirror(mlxsw_sp, rulei,
196 							    block, out_dev,
197 							    extack);
198 			if (err)
199 				return err;
200 			}
201 			break;
202 		case FLOW_ACTION_VLAN_MANGLE: {
203 			u16 proto = be16_to_cpu(act->vlan.proto);
204 			u8 prio = act->vlan.prio;
205 			u16 vid = act->vlan.vid;
206 
207 			err = mlxsw_sp_acl_rulei_act_vlan(mlxsw_sp, rulei,
208 							  act->id, vid,
209 							  proto, prio, extack);
210 			if (err)
211 				return err;
212 			break;
213 			}
214 		case FLOW_ACTION_PRIORITY:
215 			err = mlxsw_sp_acl_rulei_act_priority(mlxsw_sp, rulei,
216 							      act->priority,
217 							      extack);
218 			if (err)
219 				return err;
220 			break;
221 		case FLOW_ACTION_MANGLE: {
222 			enum flow_action_mangle_base htype = act->mangle.htype;
223 			__be32 be_mask = (__force __be32) act->mangle.mask;
224 			__be32 be_val = (__force __be32) act->mangle.val;
225 			u32 offset = act->mangle.offset;
226 			u32 mask = be32_to_cpu(be_mask);
227 			u32 val = be32_to_cpu(be_val);
228 
229 			err = mlxsw_sp_acl_rulei_act_mangle(mlxsw_sp, rulei,
230 							    htype, offset,
231 							    mask, val, extack);
232 			if (err)
233 				return err;
234 			break;
235 			}
236 		case FLOW_ACTION_POLICE: {
237 			u32 burst;
238 
239 			if (police_act_count++) {
240 				NL_SET_ERR_MSG_MOD(extack, "Multiple police actions per rule are not supported");
241 				return -EOPNOTSUPP;
242 			}
243 
244 			err = mlxsw_sp_policer_validate(flow_action, act, extack);
245 			if (err)
246 				return err;
247 
248 			/* The kernel might adjust the requested burst size so
249 			 * that it is not exactly a power of two. Re-adjust it
250 			 * here since the hardware only supports burst sizes
251 			 * that are a power of two.
252 			 */
253 			burst = roundup_pow_of_two(act->police.burst);
254 			err = mlxsw_sp_acl_rulei_act_police(mlxsw_sp, rulei,
255 							    act->hw_index,
256 							    act->police.rate_bytes_ps,
257 							    burst, extack);
258 			if (err)
259 				return err;
260 			break;
261 			}
262 		case FLOW_ACTION_SAMPLE: {
263 			if (sample_act_count++) {
264 				NL_SET_ERR_MSG_MOD(extack, "Multiple sample actions per rule are not supported");
265 				return -EOPNOTSUPP;
266 			}
267 
268 			err = mlxsw_sp_acl_rulei_act_sample(mlxsw_sp, rulei,
269 							    block,
270 							    act->sample.psample_group,
271 							    act->sample.rate,
272 							    act->sample.trunc_size,
273 							    act->sample.truncate,
274 							    extack);
275 			if (err)
276 				return err;
277 			break;
278 			}
279 		default:
280 			NL_SET_ERR_MSG_MOD(extack, "Unsupported action");
281 			dev_err(mlxsw_sp->bus_info->dev, "Unsupported action\n");
282 			return -EOPNOTSUPP;
283 		}
284 	}
285 
286 	if (rulei->ipv6_valid) {
287 		NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field");
288 		return -EOPNOTSUPP;
289 	}
290 
291 	return 0;
292 }
293 
294 static int
295 mlxsw_sp_flower_parse_meta_iif(struct mlxsw_sp_acl_rule_info *rulei,
296 			       const struct mlxsw_sp_flow_block *block,
297 			       const struct flow_match_meta *match,
298 			       struct netlink_ext_ack *extack)
299 {
300 	struct mlxsw_sp_port *mlxsw_sp_port;
301 	struct net_device *ingress_dev;
302 
303 	if (!match->mask->ingress_ifindex)
304 		return 0;
305 
306 	if (match->mask->ingress_ifindex != 0xFFFFFFFF) {
307 		NL_SET_ERR_MSG_MOD(extack, "Unsupported ingress ifindex mask");
308 		return -EINVAL;
309 	}
310 
311 	ingress_dev = __dev_get_by_index(block->net,
312 					 match->key->ingress_ifindex);
313 	if (!ingress_dev) {
314 		NL_SET_ERR_MSG_MOD(extack, "Can't find specified ingress port to match on");
315 		return -EINVAL;
316 	}
317 
318 	if (!mlxsw_sp_port_dev_check(ingress_dev)) {
319 		NL_SET_ERR_MSG_MOD(extack, "Can't match on non-mlxsw ingress port");
320 		return -EINVAL;
321 	}
322 
323 	mlxsw_sp_port = netdev_priv(ingress_dev);
324 	if (mlxsw_sp_port->mlxsw_sp != block->mlxsw_sp) {
325 		NL_SET_ERR_MSG_MOD(extack, "Can't match on a port from different device");
326 		return -EINVAL;
327 	}
328 
329 	mlxsw_sp_acl_rulei_keymask_u32(rulei,
330 				       MLXSW_AFK_ELEMENT_SRC_SYS_PORT,
331 				       mlxsw_sp_port->local_port,
332 				       0xFFFFFFFF);
333 
334 	return 0;
335 }
336 
337 static int mlxsw_sp_flower_parse_meta(struct mlxsw_sp_acl_rule_info *rulei,
338 				      struct flow_cls_offload *f,
339 				      struct mlxsw_sp_flow_block *block)
340 {
341 	struct flow_rule *rule = flow_cls_offload_flow_rule(f);
342 	struct flow_match_meta match;
343 
344 	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META))
345 		return 0;
346 
347 	flow_rule_match_meta(rule, &match);
348 
349 	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_FDB_MISS,
350 				       match.key->l2_miss, match.mask->l2_miss);
351 
352 	return mlxsw_sp_flower_parse_meta_iif(rulei, block, &match,
353 					      f->common.extack);
354 }
355 
356 static void mlxsw_sp_flower_parse_ipv4(struct mlxsw_sp_acl_rule_info *rulei,
357 				       struct flow_cls_offload *f)
358 {
359 	struct flow_match_ipv4_addrs match;
360 
361 	flow_rule_match_ipv4_addrs(f->rule, &match);
362 
363 	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31,
364 				       (char *) &match.key->src,
365 				       (char *) &match.mask->src, 4);
366 	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31,
367 				       (char *) &match.key->dst,
368 				       (char *) &match.mask->dst, 4);
369 }
370 
371 static void mlxsw_sp_flower_parse_ipv6(struct mlxsw_sp_acl_rule_info *rulei,
372 				       struct flow_cls_offload *f)
373 {
374 	struct flow_match_ipv6_addrs match;
375 
376 	flow_rule_match_ipv6_addrs(f->rule, &match);
377 
378 	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_96_127,
379 				       &match.key->src.s6_addr[0x0],
380 				       &match.mask->src.s6_addr[0x0], 4);
381 	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_64_95,
382 				       &match.key->src.s6_addr[0x4],
383 				       &match.mask->src.s6_addr[0x4], 4);
384 	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_32_63,
385 				       &match.key->src.s6_addr[0x8],
386 				       &match.mask->src.s6_addr[0x8], 4);
387 	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31,
388 				       &match.key->src.s6_addr[0xC],
389 				       &match.mask->src.s6_addr[0xC], 4);
390 	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_96_127,
391 				       &match.key->dst.s6_addr[0x0],
392 				       &match.mask->dst.s6_addr[0x0], 4);
393 	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_64_95,
394 				       &match.key->dst.s6_addr[0x4],
395 				       &match.mask->dst.s6_addr[0x4], 4);
396 	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_32_63,
397 				       &match.key->dst.s6_addr[0x8],
398 				       &match.mask->dst.s6_addr[0x8], 4);
399 	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31,
400 				       &match.key->dst.s6_addr[0xC],
401 				       &match.mask->dst.s6_addr[0xC], 4);
402 }
403 
404 static int mlxsw_sp_flower_parse_ports(struct mlxsw_sp *mlxsw_sp,
405 				       struct mlxsw_sp_acl_rule_info *rulei,
406 				       struct flow_cls_offload *f,
407 				       u8 ip_proto)
408 {
409 	const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
410 	struct flow_match_ports match;
411 
412 	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS))
413 		return 0;
414 
415 	if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
416 		NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported");
417 		dev_err(mlxsw_sp->bus_info->dev, "Only UDP and TCP keys are supported\n");
418 		return -EINVAL;
419 	}
420 
421 	flow_rule_match_ports(rule, &match);
422 	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_L4_PORT,
423 				       ntohs(match.key->dst),
424 				       ntohs(match.mask->dst));
425 	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_L4_PORT,
426 				       ntohs(match.key->src),
427 				       ntohs(match.mask->src));
428 	return 0;
429 }
430 
431 static int
432 mlxsw_sp_flower_parse_ports_range(struct mlxsw_sp *mlxsw_sp,
433 				  struct mlxsw_sp_acl_rule_info *rulei,
434 				  struct flow_cls_offload *f, u8 ip_proto)
435 {
436 	const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
437 	struct flow_match_ports_range match;
438 	u32 key_mask_value = 0;
439 
440 	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS_RANGE))
441 		return 0;
442 
443 	if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
444 		NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported");
445 		return -EINVAL;
446 	}
447 
448 	flow_rule_match_ports_range(rule, &match);
449 
450 	if (match.mask->tp_min.src) {
451 		struct mlxsw_sp_port_range range = {
452 			.min = ntohs(match.key->tp_min.src),
453 			.max = ntohs(match.key->tp_max.src),
454 			.source = true,
455 		};
456 		u8 prr_index;
457 		int err;
458 
459 		err = mlxsw_sp_port_range_reg_get(mlxsw_sp, &range,
460 						  f->common.extack, &prr_index);
461 		if (err)
462 			return err;
463 
464 		rulei->src_port_range_reg_index = prr_index;
465 		rulei->src_port_range_reg_valid = true;
466 		key_mask_value |= BIT(prr_index);
467 	}
468 
469 	if (match.mask->tp_min.dst) {
470 		struct mlxsw_sp_port_range range = {
471 			.min = ntohs(match.key->tp_min.dst),
472 			.max = ntohs(match.key->tp_max.dst),
473 		};
474 		u8 prr_index;
475 		int err;
476 
477 		err = mlxsw_sp_port_range_reg_get(mlxsw_sp, &range,
478 						  f->common.extack, &prr_index);
479 		if (err)
480 			return err;
481 
482 		rulei->dst_port_range_reg_index = prr_index;
483 		rulei->dst_port_range_reg_valid = true;
484 		key_mask_value |= BIT(prr_index);
485 	}
486 
487 	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_L4_PORT_RANGE,
488 				       key_mask_value, key_mask_value);
489 
490 	return 0;
491 }
492 
493 static int mlxsw_sp_flower_parse_tcp(struct mlxsw_sp *mlxsw_sp,
494 				     struct mlxsw_sp_acl_rule_info *rulei,
495 				     struct flow_cls_offload *f,
496 				     u8 ip_proto)
497 {
498 	const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
499 	struct flow_match_tcp match;
500 
501 	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_TCP))
502 		return 0;
503 
504 	if (ip_proto != IPPROTO_TCP) {
505 		NL_SET_ERR_MSG_MOD(f->common.extack, "TCP keys supported only for TCP");
506 		dev_err(mlxsw_sp->bus_info->dev, "TCP keys supported only for TCP\n");
507 		return -EINVAL;
508 	}
509 
510 	flow_rule_match_tcp(rule, &match);
511 
512 	if (match.mask->flags & htons(0x0E00)) {
513 		NL_SET_ERR_MSG_MOD(f->common.extack, "TCP flags match not supported on reserved bits");
514 		dev_err(mlxsw_sp->bus_info->dev, "TCP flags match not supported on reserved bits\n");
515 		return -EINVAL;
516 	}
517 
518 	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_TCP_FLAGS,
519 				       ntohs(match.key->flags),
520 				       ntohs(match.mask->flags));
521 	return 0;
522 }
523 
524 static int mlxsw_sp_flower_parse_ip(struct mlxsw_sp *mlxsw_sp,
525 				    struct mlxsw_sp_acl_rule_info *rulei,
526 				    struct flow_cls_offload *f,
527 				    u16 n_proto)
528 {
529 	const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
530 	struct flow_match_ip match;
531 
532 	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IP))
533 		return 0;
534 
535 	if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6) {
536 		NL_SET_ERR_MSG_MOD(f->common.extack, "IP keys supported only for IPv4/6");
537 		dev_err(mlxsw_sp->bus_info->dev, "IP keys supported only for IPv4/6\n");
538 		return -EINVAL;
539 	}
540 
541 	flow_rule_match_ip(rule, &match);
542 
543 	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_TTL_,
544 				       match.key->ttl, match.mask->ttl);
545 
546 	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_ECN,
547 				       match.key->tos & 0x3,
548 				       match.mask->tos & 0x3);
549 
550 	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_DSCP,
551 				       match.key->tos >> 2,
552 				       match.mask->tos >> 2);
553 
554 	return 0;
555 }
556 
557 static int mlxsw_sp_flower_parse(struct mlxsw_sp *mlxsw_sp,
558 				 struct mlxsw_sp_flow_block *block,
559 				 struct mlxsw_sp_acl_rule_info *rulei,
560 				 struct flow_cls_offload *f)
561 {
562 	struct flow_rule *rule = flow_cls_offload_flow_rule(f);
563 	struct flow_dissector *dissector = rule->match.dissector;
564 	u16 n_proto_mask = 0;
565 	u16 n_proto_key = 0;
566 	u16 addr_type = 0;
567 	u8 ip_proto = 0;
568 	int err;
569 
570 	if (dissector->used_keys &
571 	    ~(BIT_ULL(FLOW_DISSECTOR_KEY_META) |
572 	      BIT_ULL(FLOW_DISSECTOR_KEY_CONTROL) |
573 	      BIT_ULL(FLOW_DISSECTOR_KEY_BASIC) |
574 	      BIT_ULL(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
575 	      BIT_ULL(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
576 	      BIT_ULL(FLOW_DISSECTOR_KEY_IPV6_ADDRS) |
577 	      BIT_ULL(FLOW_DISSECTOR_KEY_PORTS) |
578 	      BIT_ULL(FLOW_DISSECTOR_KEY_PORTS_RANGE) |
579 	      BIT_ULL(FLOW_DISSECTOR_KEY_TCP) |
580 	      BIT_ULL(FLOW_DISSECTOR_KEY_IP) |
581 	      BIT_ULL(FLOW_DISSECTOR_KEY_VLAN))) {
582 		dev_err(mlxsw_sp->bus_info->dev, "Unsupported key\n");
583 		NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported key");
584 		return -EOPNOTSUPP;
585 	}
586 
587 	mlxsw_sp_acl_rulei_priority(rulei, f->common.prio);
588 
589 	err = mlxsw_sp_flower_parse_meta(rulei, f, block);
590 	if (err)
591 		return err;
592 
593 	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CONTROL)) {
594 		struct flow_match_control match;
595 
596 		flow_rule_match_control(rule, &match);
597 		addr_type = match.key->addr_type;
598 	}
599 
600 	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) {
601 		struct flow_match_basic match;
602 
603 		flow_rule_match_basic(rule, &match);
604 		n_proto_key = ntohs(match.key->n_proto);
605 		n_proto_mask = ntohs(match.mask->n_proto);
606 
607 		if (n_proto_key == ETH_P_ALL) {
608 			n_proto_key = 0;
609 			n_proto_mask = 0;
610 		}
611 		mlxsw_sp_acl_rulei_keymask_u32(rulei,
612 					       MLXSW_AFK_ELEMENT_ETHERTYPE,
613 					       n_proto_key, n_proto_mask);
614 
615 		ip_proto = match.key->ip_proto;
616 		mlxsw_sp_acl_rulei_keymask_u32(rulei,
617 					       MLXSW_AFK_ELEMENT_IP_PROTO,
618 					       match.key->ip_proto,
619 					       match.mask->ip_proto);
620 	}
621 
622 	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
623 		struct flow_match_eth_addrs match;
624 
625 		flow_rule_match_eth_addrs(rule, &match);
626 		mlxsw_sp_acl_rulei_keymask_buf(rulei,
627 					       MLXSW_AFK_ELEMENT_DMAC_32_47,
628 					       match.key->dst,
629 					       match.mask->dst, 2);
630 		mlxsw_sp_acl_rulei_keymask_buf(rulei,
631 					       MLXSW_AFK_ELEMENT_DMAC_0_31,
632 					       match.key->dst + 2,
633 					       match.mask->dst + 2, 4);
634 		mlxsw_sp_acl_rulei_keymask_buf(rulei,
635 					       MLXSW_AFK_ELEMENT_SMAC_32_47,
636 					       match.key->src,
637 					       match.mask->src, 2);
638 		mlxsw_sp_acl_rulei_keymask_buf(rulei,
639 					       MLXSW_AFK_ELEMENT_SMAC_0_31,
640 					       match.key->src + 2,
641 					       match.mask->src + 2, 4);
642 	}
643 
644 	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) {
645 		struct flow_match_vlan match;
646 
647 		flow_rule_match_vlan(rule, &match);
648 		if (mlxsw_sp_flow_block_is_egress_bound(block) &&
649 		    match.mask->vlan_id) {
650 			NL_SET_ERR_MSG_MOD(f->common.extack, "vlan_id key is not supported on egress");
651 			return -EOPNOTSUPP;
652 		}
653 
654 		/* Forbid block with this rulei to be bound
655 		 * to egress in future.
656 		 */
657 		rulei->egress_bind_blocker = 1;
658 
659 		if (match.mask->vlan_id != 0)
660 			mlxsw_sp_acl_rulei_keymask_u32(rulei,
661 						       MLXSW_AFK_ELEMENT_VID,
662 						       match.key->vlan_id,
663 						       match.mask->vlan_id);
664 		if (match.mask->vlan_priority != 0)
665 			mlxsw_sp_acl_rulei_keymask_u32(rulei,
666 						       MLXSW_AFK_ELEMENT_PCP,
667 						       match.key->vlan_priority,
668 						       match.mask->vlan_priority);
669 	}
670 
671 	if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS)
672 		mlxsw_sp_flower_parse_ipv4(rulei, f);
673 
674 	if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS)
675 		mlxsw_sp_flower_parse_ipv6(rulei, f);
676 
677 	err = mlxsw_sp_flower_parse_ports(mlxsw_sp, rulei, f, ip_proto);
678 	if (err)
679 		return err;
680 
681 	err = mlxsw_sp_flower_parse_ports_range(mlxsw_sp, rulei, f, ip_proto);
682 	if (err)
683 		return err;
684 
685 	err = mlxsw_sp_flower_parse_tcp(mlxsw_sp, rulei, f, ip_proto);
686 	if (err)
687 		return err;
688 
689 	err = mlxsw_sp_flower_parse_ip(mlxsw_sp, rulei, f, n_proto_key & n_proto_mask);
690 	if (err)
691 		return err;
692 
693 	return mlxsw_sp_flower_parse_actions(mlxsw_sp, block, rulei,
694 					     &f->rule->action,
695 					     f->common.extack);
696 }
697 
698 static int mlxsw_sp_flower_mall_prio_check(struct mlxsw_sp_flow_block *block,
699 					   struct flow_cls_offload *f)
700 {
701 	bool ingress = mlxsw_sp_flow_block_is_ingress_bound(block);
702 	unsigned int mall_min_prio;
703 	unsigned int mall_max_prio;
704 	int err;
705 
706 	err = mlxsw_sp_mall_prio_get(block, f->common.chain_index,
707 				     &mall_min_prio, &mall_max_prio);
708 	if (err) {
709 		if (err == -ENOENT)
710 			/* No matchall filters installed on this chain. */
711 			return 0;
712 		NL_SET_ERR_MSG(f->common.extack, "Failed to get matchall priorities");
713 		return err;
714 	}
715 	if (ingress && f->common.prio <= mall_min_prio) {
716 		NL_SET_ERR_MSG(f->common.extack, "Failed to add in front of existing matchall rules");
717 		return -EOPNOTSUPP;
718 	}
719 	if (!ingress && f->common.prio >= mall_max_prio) {
720 		NL_SET_ERR_MSG(f->common.extack, "Failed to add behind of existing matchall rules");
721 		return -EOPNOTSUPP;
722 	}
723 	return 0;
724 }
725 
726 int mlxsw_sp_flower_replace(struct mlxsw_sp *mlxsw_sp,
727 			    struct mlxsw_sp_flow_block *block,
728 			    struct flow_cls_offload *f)
729 {
730 	struct mlxsw_sp_acl_rule_info *rulei;
731 	struct mlxsw_sp_acl_ruleset *ruleset;
732 	struct mlxsw_sp_acl_rule *rule;
733 	int err;
734 
735 	err = mlxsw_sp_flower_mall_prio_check(block, f);
736 	if (err)
737 		return err;
738 
739 	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
740 					   f->common.chain_index,
741 					   MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
742 	if (IS_ERR(ruleset))
743 		return PTR_ERR(ruleset);
744 
745 	rule = mlxsw_sp_acl_rule_create(mlxsw_sp, ruleset, f->cookie, NULL,
746 					f->common.extack);
747 	if (IS_ERR(rule)) {
748 		err = PTR_ERR(rule);
749 		goto err_rule_create;
750 	}
751 
752 	rulei = mlxsw_sp_acl_rule_rulei(rule);
753 	err = mlxsw_sp_flower_parse(mlxsw_sp, block, rulei, f);
754 	if (err)
755 		goto err_flower_parse;
756 
757 	err = mlxsw_sp_acl_rulei_commit(rulei);
758 	if (err)
759 		goto err_rulei_commit;
760 
761 	err = mlxsw_sp_acl_rule_add(mlxsw_sp, rule);
762 	if (err)
763 		goto err_rule_add;
764 
765 	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
766 	return 0;
767 
768 err_rule_add:
769 err_rulei_commit:
770 err_flower_parse:
771 	mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
772 err_rule_create:
773 	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
774 	return err;
775 }
776 
777 void mlxsw_sp_flower_destroy(struct mlxsw_sp *mlxsw_sp,
778 			     struct mlxsw_sp_flow_block *block,
779 			     struct flow_cls_offload *f)
780 {
781 	struct mlxsw_sp_acl_ruleset *ruleset;
782 	struct mlxsw_sp_acl_rule *rule;
783 
784 	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
785 					   f->common.chain_index,
786 					   MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
787 	if (IS_ERR(ruleset))
788 		return;
789 
790 	rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
791 	if (rule) {
792 		mlxsw_sp_acl_rule_del(mlxsw_sp, rule);
793 		mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
794 	}
795 
796 	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
797 }
798 
799 int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp,
800 			  struct mlxsw_sp_flow_block *block,
801 			  struct flow_cls_offload *f)
802 {
803 	enum flow_action_hw_stats used_hw_stats = FLOW_ACTION_HW_STATS_DISABLED;
804 	struct mlxsw_sp_acl_ruleset *ruleset;
805 	struct mlxsw_sp_acl_rule *rule;
806 	u64 packets;
807 	u64 lastuse;
808 	u64 bytes;
809 	u64 drops;
810 	int err;
811 
812 	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
813 					   f->common.chain_index,
814 					   MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
815 	if (WARN_ON(IS_ERR(ruleset)))
816 		return -EINVAL;
817 
818 	rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
819 	if (!rule)
820 		return -EINVAL;
821 
822 	err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes,
823 					  &drops, &lastuse, &used_hw_stats);
824 	if (err)
825 		goto err_rule_get_stats;
826 
827 	flow_stats_update(&f->stats, bytes, packets, drops, lastuse,
828 			  used_hw_stats);
829 
830 	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
831 	return 0;
832 
833 err_rule_get_stats:
834 	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
835 	return err;
836 }
837 
838 int mlxsw_sp_flower_tmplt_create(struct mlxsw_sp *mlxsw_sp,
839 				 struct mlxsw_sp_flow_block *block,
840 				 struct flow_cls_offload *f)
841 {
842 	struct mlxsw_sp_acl_ruleset *ruleset;
843 	struct mlxsw_sp_acl_rule_info rulei;
844 	int err;
845 
846 	memset(&rulei, 0, sizeof(rulei));
847 	err = mlxsw_sp_flower_parse(mlxsw_sp, block, &rulei, f);
848 	if (err)
849 		return err;
850 	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
851 					   f->common.chain_index,
852 					   MLXSW_SP_ACL_PROFILE_FLOWER,
853 					   &rulei.values.elusage);
854 
855 	/* keep the reference to the ruleset */
856 	return PTR_ERR_OR_ZERO(ruleset);
857 }
858 
859 void mlxsw_sp_flower_tmplt_destroy(struct mlxsw_sp *mlxsw_sp,
860 				   struct mlxsw_sp_flow_block *block,
861 				   struct flow_cls_offload *f)
862 {
863 	struct mlxsw_sp_acl_ruleset *ruleset;
864 
865 	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
866 					   f->common.chain_index,
867 					   MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
868 	if (IS_ERR(ruleset))
869 		return;
870 	/* put the reference to the ruleset kept in create */
871 	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
872 	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
873 }
874 
875 int mlxsw_sp_flower_prio_get(struct mlxsw_sp *mlxsw_sp,
876 			     struct mlxsw_sp_flow_block *block,
877 			     u32 chain_index, unsigned int *p_min_prio,
878 			     unsigned int *p_max_prio)
879 {
880 	struct mlxsw_sp_acl_ruleset *ruleset;
881 
882 	ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
883 					      chain_index,
884 					      MLXSW_SP_ACL_PROFILE_FLOWER);
885 	if (IS_ERR(ruleset))
886 		/* In case there are no flower rules, the caller
887 		 * receives -ENOENT to indicate there is no need
888 		 * to check the priorities.
889 		 */
890 		return PTR_ERR(ruleset);
891 	mlxsw_sp_acl_ruleset_prio_get(ruleset, p_min_prio, p_max_prio);
892 	return 0;
893 }
894