1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0 2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */ 3 4 #include <linux/kernel.h> 5 #include <linux/errno.h> 6 #include <linux/netdevice.h> 7 #include <linux/log2.h> 8 #include <net/net_namespace.h> 9 #include <net/flow_dissector.h> 10 #include <net/pkt_cls.h> 11 #include <net/tc_act/tc_gact.h> 12 #include <net/tc_act/tc_mirred.h> 13 #include <net/tc_act/tc_vlan.h> 14 15 #include "spectrum.h" 16 #include "core_acl_flex_keys.h" 17 18 static int mlxsw_sp_policer_validate(const struct flow_action *action, 19 const struct flow_action_entry *act, 20 struct netlink_ext_ack *extack) 21 { 22 if (act->police.exceed.act_id != FLOW_ACTION_DROP) { 23 NL_SET_ERR_MSG_MOD(extack, 24 "Offload not supported when exceed action is not drop"); 25 return -EOPNOTSUPP; 26 } 27 28 if (act->police.notexceed.act_id != FLOW_ACTION_PIPE && 29 act->police.notexceed.act_id != FLOW_ACTION_ACCEPT) { 30 NL_SET_ERR_MSG_MOD(extack, 31 "Offload not supported when conform action is not pipe or ok"); 32 return -EOPNOTSUPP; 33 } 34 35 if (act->police.notexceed.act_id == FLOW_ACTION_ACCEPT && 36 !flow_action_is_last_entry(action, act)) { 37 NL_SET_ERR_MSG_MOD(extack, 38 "Offload not supported when conform action is ok, but action is not last"); 39 return -EOPNOTSUPP; 40 } 41 42 if (act->police.peakrate_bytes_ps || 43 act->police.avrate || act->police.overhead) { 44 NL_SET_ERR_MSG_MOD(extack, 45 "Offload not supported when peakrate/avrate/overhead is configured"); 46 return -EOPNOTSUPP; 47 } 48 49 if (act->police.rate_pkt_ps) { 50 NL_SET_ERR_MSG_MOD(extack, 51 "QoS offload not support packets per second"); 52 return -EOPNOTSUPP; 53 } 54 55 return 0; 56 } 57 58 static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp, 59 struct mlxsw_sp_flow_block *block, 60 struct mlxsw_sp_acl_rule_info *rulei, 61 struct flow_action *flow_action, 62 struct netlink_ext_ack *extack) 63 { 64 const struct flow_action_entry *act; 65 int mirror_act_count = 0; 66 int police_act_count = 0; 67 int sample_act_count = 0; 68 int err, i; 69 70 if (!flow_action_has_entries(flow_action)) 71 return 0; 72 if (!flow_action_mixed_hw_stats_check(flow_action, extack)) 73 return -EOPNOTSUPP; 74 75 act = flow_action_first_entry_get(flow_action); 76 if (act->hw_stats & FLOW_ACTION_HW_STATS_DISABLED) { 77 /* Nothing to do */ 78 } else if (act->hw_stats & FLOW_ACTION_HW_STATS_IMMEDIATE) { 79 /* Count action is inserted first */ 80 err = mlxsw_sp_acl_rulei_act_count(mlxsw_sp, rulei, extack); 81 if (err) 82 return err; 83 } else { 84 NL_SET_ERR_MSG_MOD(extack, "Unsupported action HW stats type"); 85 return -EOPNOTSUPP; 86 } 87 88 flow_action_for_each(i, act, flow_action) { 89 switch (act->id) { 90 case FLOW_ACTION_ACCEPT: 91 err = mlxsw_sp_acl_rulei_act_terminate(rulei); 92 if (err) { 93 NL_SET_ERR_MSG_MOD(extack, "Cannot append terminate action"); 94 return err; 95 } 96 break; 97 case FLOW_ACTION_DROP: { 98 bool ingress; 99 100 if (mlxsw_sp_flow_block_is_mixed_bound(block)) { 101 NL_SET_ERR_MSG_MOD(extack, "Drop action is not supported when block is bound to ingress and egress"); 102 return -EOPNOTSUPP; 103 } 104 ingress = mlxsw_sp_flow_block_is_ingress_bound(block); 105 err = mlxsw_sp_acl_rulei_act_drop(rulei, ingress, 106 act->user_cookie, extack); 107 if (err) { 108 NL_SET_ERR_MSG_MOD(extack, "Cannot append drop action"); 109 return err; 110 } 111 112 /* Forbid block with this rulei to be bound 113 * to ingress/egress in future. Ingress rule is 114 * a blocker for egress and vice versa. 115 */ 116 if (ingress) 117 rulei->egress_bind_blocker = 1; 118 else 119 rulei->ingress_bind_blocker = 1; 120 } 121 break; 122 case FLOW_ACTION_TRAP: 123 err = mlxsw_sp_acl_rulei_act_trap(rulei); 124 if (err) { 125 NL_SET_ERR_MSG_MOD(extack, "Cannot append trap action"); 126 return err; 127 } 128 break; 129 case FLOW_ACTION_GOTO: { 130 u32 chain_index = act->chain_index; 131 struct mlxsw_sp_acl_ruleset *ruleset; 132 u16 group_id; 133 134 ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block, 135 chain_index, 136 MLXSW_SP_ACL_PROFILE_FLOWER); 137 if (IS_ERR(ruleset)) 138 return PTR_ERR(ruleset); 139 140 group_id = mlxsw_sp_acl_ruleset_group_id(ruleset); 141 err = mlxsw_sp_acl_rulei_act_jump(rulei, group_id); 142 if (err) { 143 NL_SET_ERR_MSG_MOD(extack, "Cannot append jump action"); 144 return err; 145 } 146 } 147 break; 148 case FLOW_ACTION_REDIRECT: { 149 struct net_device *out_dev; 150 struct mlxsw_sp_fid *fid; 151 u16 fid_index; 152 153 if (mlxsw_sp_flow_block_is_egress_bound(block)) { 154 NL_SET_ERR_MSG_MOD(extack, "Redirect action is not supported on egress"); 155 return -EOPNOTSUPP; 156 } 157 158 /* Forbid block with this rulei to be bound 159 * to egress in future. 160 */ 161 rulei->egress_bind_blocker = 1; 162 163 fid = mlxsw_sp_acl_dummy_fid(mlxsw_sp); 164 fid_index = mlxsw_sp_fid_index(fid); 165 err = mlxsw_sp_acl_rulei_act_fid_set(mlxsw_sp, rulei, 166 fid_index, extack); 167 if (err) 168 return err; 169 170 out_dev = act->dev; 171 err = mlxsw_sp_acl_rulei_act_fwd(mlxsw_sp, rulei, 172 out_dev, extack); 173 if (err) 174 return err; 175 } 176 break; 177 case FLOW_ACTION_MIRRED: { 178 struct net_device *out_dev = act->dev; 179 180 if (mirror_act_count++) { 181 NL_SET_ERR_MSG_MOD(extack, "Multiple mirror actions per rule are not supported"); 182 return -EOPNOTSUPP; 183 } 184 185 err = mlxsw_sp_acl_rulei_act_mirror(mlxsw_sp, rulei, 186 block, out_dev, 187 extack); 188 if (err) 189 return err; 190 } 191 break; 192 case FLOW_ACTION_VLAN_MANGLE: { 193 u16 proto = be16_to_cpu(act->vlan.proto); 194 u8 prio = act->vlan.prio; 195 u16 vid = act->vlan.vid; 196 197 err = mlxsw_sp_acl_rulei_act_vlan(mlxsw_sp, rulei, 198 act->id, vid, 199 proto, prio, extack); 200 if (err) 201 return err; 202 break; 203 } 204 case FLOW_ACTION_PRIORITY: 205 err = mlxsw_sp_acl_rulei_act_priority(mlxsw_sp, rulei, 206 act->priority, 207 extack); 208 if (err) 209 return err; 210 break; 211 case FLOW_ACTION_MANGLE: { 212 enum flow_action_mangle_base htype = act->mangle.htype; 213 __be32 be_mask = (__force __be32) act->mangle.mask; 214 __be32 be_val = (__force __be32) act->mangle.val; 215 u32 offset = act->mangle.offset; 216 u32 mask = be32_to_cpu(be_mask); 217 u32 val = be32_to_cpu(be_val); 218 219 err = mlxsw_sp_acl_rulei_act_mangle(mlxsw_sp, rulei, 220 htype, offset, 221 mask, val, extack); 222 if (err) 223 return err; 224 break; 225 } 226 case FLOW_ACTION_POLICE: { 227 u32 burst; 228 229 if (police_act_count++) { 230 NL_SET_ERR_MSG_MOD(extack, "Multiple police actions per rule are not supported"); 231 return -EOPNOTSUPP; 232 } 233 234 err = mlxsw_sp_policer_validate(flow_action, act, extack); 235 if (err) 236 return err; 237 238 /* The kernel might adjust the requested burst size so 239 * that it is not exactly a power of two. Re-adjust it 240 * here since the hardware only supports burst sizes 241 * that are a power of two. 242 */ 243 burst = roundup_pow_of_two(act->police.burst); 244 err = mlxsw_sp_acl_rulei_act_police(mlxsw_sp, rulei, 245 act->hw_index, 246 act->police.rate_bytes_ps, 247 burst, extack); 248 if (err) 249 return err; 250 break; 251 } 252 case FLOW_ACTION_SAMPLE: { 253 if (sample_act_count++) { 254 NL_SET_ERR_MSG_MOD(extack, "Multiple sample actions per rule are not supported"); 255 return -EOPNOTSUPP; 256 } 257 258 err = mlxsw_sp_acl_rulei_act_sample(mlxsw_sp, rulei, 259 block, 260 act->sample.psample_group, 261 act->sample.rate, 262 act->sample.trunc_size, 263 act->sample.truncate, 264 extack); 265 if (err) 266 return err; 267 break; 268 } 269 default: 270 NL_SET_ERR_MSG_MOD(extack, "Unsupported action"); 271 dev_err(mlxsw_sp->bus_info->dev, "Unsupported action\n"); 272 return -EOPNOTSUPP; 273 } 274 } 275 276 if (rulei->ipv6_valid) { 277 NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field"); 278 return -EOPNOTSUPP; 279 } 280 281 return 0; 282 } 283 284 static int 285 mlxsw_sp_flower_parse_meta_iif(struct mlxsw_sp_acl_rule_info *rulei, 286 const struct mlxsw_sp_flow_block *block, 287 const struct flow_match_meta *match, 288 struct netlink_ext_ack *extack) 289 { 290 struct mlxsw_sp_port *mlxsw_sp_port; 291 struct net_device *ingress_dev; 292 293 if (!match->mask->ingress_ifindex) 294 return 0; 295 296 if (match->mask->ingress_ifindex != 0xFFFFFFFF) { 297 NL_SET_ERR_MSG_MOD(extack, "Unsupported ingress ifindex mask"); 298 return -EINVAL; 299 } 300 301 ingress_dev = __dev_get_by_index(block->net, 302 match->key->ingress_ifindex); 303 if (!ingress_dev) { 304 NL_SET_ERR_MSG_MOD(extack, "Can't find specified ingress port to match on"); 305 return -EINVAL; 306 } 307 308 if (!mlxsw_sp_port_dev_check(ingress_dev)) { 309 NL_SET_ERR_MSG_MOD(extack, "Can't match on non-mlxsw ingress port"); 310 return -EINVAL; 311 } 312 313 mlxsw_sp_port = netdev_priv(ingress_dev); 314 if (mlxsw_sp_port->mlxsw_sp != block->mlxsw_sp) { 315 NL_SET_ERR_MSG_MOD(extack, "Can't match on a port from different device"); 316 return -EINVAL; 317 } 318 319 mlxsw_sp_acl_rulei_keymask_u32(rulei, 320 MLXSW_AFK_ELEMENT_SRC_SYS_PORT, 321 mlxsw_sp_port->local_port, 322 0xFFFFFFFF); 323 324 return 0; 325 } 326 327 static int mlxsw_sp_flower_parse_meta(struct mlxsw_sp_acl_rule_info *rulei, 328 struct flow_cls_offload *f, 329 struct mlxsw_sp_flow_block *block) 330 { 331 struct flow_rule *rule = flow_cls_offload_flow_rule(f); 332 struct flow_match_meta match; 333 334 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META)) 335 return 0; 336 337 flow_rule_match_meta(rule, &match); 338 339 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_FDB_MISS, 340 match.key->l2_miss, match.mask->l2_miss); 341 342 return mlxsw_sp_flower_parse_meta_iif(rulei, block, &match, 343 f->common.extack); 344 } 345 346 static void mlxsw_sp_flower_parse_ipv4(struct mlxsw_sp_acl_rule_info *rulei, 347 struct flow_cls_offload *f) 348 { 349 struct flow_match_ipv4_addrs match; 350 351 flow_rule_match_ipv4_addrs(f->rule, &match); 352 353 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31, 354 (char *) &match.key->src, 355 (char *) &match.mask->src, 4); 356 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31, 357 (char *) &match.key->dst, 358 (char *) &match.mask->dst, 4); 359 } 360 361 static void mlxsw_sp_flower_parse_ipv6(struct mlxsw_sp_acl_rule_info *rulei, 362 struct flow_cls_offload *f) 363 { 364 struct flow_match_ipv6_addrs match; 365 366 flow_rule_match_ipv6_addrs(f->rule, &match); 367 368 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_96_127, 369 &match.key->src.s6_addr[0x0], 370 &match.mask->src.s6_addr[0x0], 4); 371 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_64_95, 372 &match.key->src.s6_addr[0x4], 373 &match.mask->src.s6_addr[0x4], 4); 374 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_32_63, 375 &match.key->src.s6_addr[0x8], 376 &match.mask->src.s6_addr[0x8], 4); 377 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31, 378 &match.key->src.s6_addr[0xC], 379 &match.mask->src.s6_addr[0xC], 4); 380 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_96_127, 381 &match.key->dst.s6_addr[0x0], 382 &match.mask->dst.s6_addr[0x0], 4); 383 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_64_95, 384 &match.key->dst.s6_addr[0x4], 385 &match.mask->dst.s6_addr[0x4], 4); 386 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_32_63, 387 &match.key->dst.s6_addr[0x8], 388 &match.mask->dst.s6_addr[0x8], 4); 389 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31, 390 &match.key->dst.s6_addr[0xC], 391 &match.mask->dst.s6_addr[0xC], 4); 392 } 393 394 static int mlxsw_sp_flower_parse_ports(struct mlxsw_sp *mlxsw_sp, 395 struct mlxsw_sp_acl_rule_info *rulei, 396 struct flow_cls_offload *f, 397 u8 ip_proto) 398 { 399 const struct flow_rule *rule = flow_cls_offload_flow_rule(f); 400 struct flow_match_ports match; 401 402 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS)) 403 return 0; 404 405 if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) { 406 NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported"); 407 dev_err(mlxsw_sp->bus_info->dev, "Only UDP and TCP keys are supported\n"); 408 return -EINVAL; 409 } 410 411 flow_rule_match_ports(rule, &match); 412 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_L4_PORT, 413 ntohs(match.key->dst), 414 ntohs(match.mask->dst)); 415 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_L4_PORT, 416 ntohs(match.key->src), 417 ntohs(match.mask->src)); 418 return 0; 419 } 420 421 static int 422 mlxsw_sp_flower_parse_ports_range(struct mlxsw_sp *mlxsw_sp, 423 struct mlxsw_sp_acl_rule_info *rulei, 424 struct flow_cls_offload *f, u8 ip_proto) 425 { 426 const struct flow_rule *rule = flow_cls_offload_flow_rule(f); 427 struct flow_match_ports_range match; 428 u32 key_mask_value = 0; 429 430 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS_RANGE)) 431 return 0; 432 433 if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) { 434 NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported"); 435 return -EINVAL; 436 } 437 438 flow_rule_match_ports_range(rule, &match); 439 440 if (match.mask->tp_min.src) { 441 struct mlxsw_sp_port_range range = { 442 .min = ntohs(match.key->tp_min.src), 443 .max = ntohs(match.key->tp_max.src), 444 .source = true, 445 }; 446 u8 prr_index; 447 int err; 448 449 err = mlxsw_sp_port_range_reg_get(mlxsw_sp, &range, 450 f->common.extack, &prr_index); 451 if (err) 452 return err; 453 454 rulei->src_port_range_reg_index = prr_index; 455 rulei->src_port_range_reg_valid = true; 456 key_mask_value |= BIT(prr_index); 457 } 458 459 if (match.mask->tp_min.dst) { 460 struct mlxsw_sp_port_range range = { 461 .min = ntohs(match.key->tp_min.dst), 462 .max = ntohs(match.key->tp_max.dst), 463 }; 464 u8 prr_index; 465 int err; 466 467 err = mlxsw_sp_port_range_reg_get(mlxsw_sp, &range, 468 f->common.extack, &prr_index); 469 if (err) 470 return err; 471 472 rulei->dst_port_range_reg_index = prr_index; 473 rulei->dst_port_range_reg_valid = true; 474 key_mask_value |= BIT(prr_index); 475 } 476 477 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_L4_PORT_RANGE, 478 key_mask_value, key_mask_value); 479 480 return 0; 481 } 482 483 static int mlxsw_sp_flower_parse_tcp(struct mlxsw_sp *mlxsw_sp, 484 struct mlxsw_sp_acl_rule_info *rulei, 485 struct flow_cls_offload *f, 486 u8 ip_proto) 487 { 488 const struct flow_rule *rule = flow_cls_offload_flow_rule(f); 489 struct flow_match_tcp match; 490 491 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_TCP)) 492 return 0; 493 494 if (ip_proto != IPPROTO_TCP) { 495 NL_SET_ERR_MSG_MOD(f->common.extack, "TCP keys supported only for TCP"); 496 dev_err(mlxsw_sp->bus_info->dev, "TCP keys supported only for TCP\n"); 497 return -EINVAL; 498 } 499 500 flow_rule_match_tcp(rule, &match); 501 502 if (match.mask->flags & htons(0x0E00)) { 503 NL_SET_ERR_MSG_MOD(f->common.extack, "TCP flags match not supported on reserved bits"); 504 dev_err(mlxsw_sp->bus_info->dev, "TCP flags match not supported on reserved bits\n"); 505 return -EINVAL; 506 } 507 508 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_TCP_FLAGS, 509 ntohs(match.key->flags), 510 ntohs(match.mask->flags)); 511 return 0; 512 } 513 514 static int mlxsw_sp_flower_parse_ip(struct mlxsw_sp *mlxsw_sp, 515 struct mlxsw_sp_acl_rule_info *rulei, 516 struct flow_cls_offload *f, 517 u16 n_proto) 518 { 519 const struct flow_rule *rule = flow_cls_offload_flow_rule(f); 520 struct flow_match_ip match; 521 522 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IP)) 523 return 0; 524 525 if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6) { 526 NL_SET_ERR_MSG_MOD(f->common.extack, "IP keys supported only for IPv4/6"); 527 dev_err(mlxsw_sp->bus_info->dev, "IP keys supported only for IPv4/6\n"); 528 return -EINVAL; 529 } 530 531 flow_rule_match_ip(rule, &match); 532 533 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_TTL_, 534 match.key->ttl, match.mask->ttl); 535 536 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_ECN, 537 match.key->tos & 0x3, 538 match.mask->tos & 0x3); 539 540 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_DSCP, 541 match.key->tos >> 2, 542 match.mask->tos >> 2); 543 544 return 0; 545 } 546 547 static int mlxsw_sp_flower_parse(struct mlxsw_sp *mlxsw_sp, 548 struct mlxsw_sp_flow_block *block, 549 struct mlxsw_sp_acl_rule_info *rulei, 550 struct flow_cls_offload *f) 551 { 552 struct flow_rule *rule = flow_cls_offload_flow_rule(f); 553 struct flow_dissector *dissector = rule->match.dissector; 554 u16 n_proto_mask = 0; 555 u16 n_proto_key = 0; 556 u16 addr_type = 0; 557 u8 ip_proto = 0; 558 int err; 559 560 if (dissector->used_keys & 561 ~(BIT(FLOW_DISSECTOR_KEY_META) | 562 BIT(FLOW_DISSECTOR_KEY_CONTROL) | 563 BIT(FLOW_DISSECTOR_KEY_BASIC) | 564 BIT(FLOW_DISSECTOR_KEY_ETH_ADDRS) | 565 BIT(FLOW_DISSECTOR_KEY_IPV4_ADDRS) | 566 BIT(FLOW_DISSECTOR_KEY_IPV6_ADDRS) | 567 BIT(FLOW_DISSECTOR_KEY_PORTS) | 568 BIT(FLOW_DISSECTOR_KEY_PORTS_RANGE) | 569 BIT(FLOW_DISSECTOR_KEY_TCP) | 570 BIT(FLOW_DISSECTOR_KEY_IP) | 571 BIT(FLOW_DISSECTOR_KEY_VLAN))) { 572 dev_err(mlxsw_sp->bus_info->dev, "Unsupported key\n"); 573 NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported key"); 574 return -EOPNOTSUPP; 575 } 576 577 mlxsw_sp_acl_rulei_priority(rulei, f->common.prio); 578 579 err = mlxsw_sp_flower_parse_meta(rulei, f, block); 580 if (err) 581 return err; 582 583 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CONTROL)) { 584 struct flow_match_control match; 585 586 flow_rule_match_control(rule, &match); 587 addr_type = match.key->addr_type; 588 } 589 590 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) { 591 struct flow_match_basic match; 592 593 flow_rule_match_basic(rule, &match); 594 n_proto_key = ntohs(match.key->n_proto); 595 n_proto_mask = ntohs(match.mask->n_proto); 596 597 if (n_proto_key == ETH_P_ALL) { 598 n_proto_key = 0; 599 n_proto_mask = 0; 600 } 601 mlxsw_sp_acl_rulei_keymask_u32(rulei, 602 MLXSW_AFK_ELEMENT_ETHERTYPE, 603 n_proto_key, n_proto_mask); 604 605 ip_proto = match.key->ip_proto; 606 mlxsw_sp_acl_rulei_keymask_u32(rulei, 607 MLXSW_AFK_ELEMENT_IP_PROTO, 608 match.key->ip_proto, 609 match.mask->ip_proto); 610 } 611 612 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) { 613 struct flow_match_eth_addrs match; 614 615 flow_rule_match_eth_addrs(rule, &match); 616 mlxsw_sp_acl_rulei_keymask_buf(rulei, 617 MLXSW_AFK_ELEMENT_DMAC_32_47, 618 match.key->dst, 619 match.mask->dst, 2); 620 mlxsw_sp_acl_rulei_keymask_buf(rulei, 621 MLXSW_AFK_ELEMENT_DMAC_0_31, 622 match.key->dst + 2, 623 match.mask->dst + 2, 4); 624 mlxsw_sp_acl_rulei_keymask_buf(rulei, 625 MLXSW_AFK_ELEMENT_SMAC_32_47, 626 match.key->src, 627 match.mask->src, 2); 628 mlxsw_sp_acl_rulei_keymask_buf(rulei, 629 MLXSW_AFK_ELEMENT_SMAC_0_31, 630 match.key->src + 2, 631 match.mask->src + 2, 4); 632 } 633 634 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) { 635 struct flow_match_vlan match; 636 637 flow_rule_match_vlan(rule, &match); 638 if (mlxsw_sp_flow_block_is_egress_bound(block) && 639 match.mask->vlan_id) { 640 NL_SET_ERR_MSG_MOD(f->common.extack, "vlan_id key is not supported on egress"); 641 return -EOPNOTSUPP; 642 } 643 644 /* Forbid block with this rulei to be bound 645 * to egress in future. 646 */ 647 rulei->egress_bind_blocker = 1; 648 649 if (match.mask->vlan_id != 0) 650 mlxsw_sp_acl_rulei_keymask_u32(rulei, 651 MLXSW_AFK_ELEMENT_VID, 652 match.key->vlan_id, 653 match.mask->vlan_id); 654 if (match.mask->vlan_priority != 0) 655 mlxsw_sp_acl_rulei_keymask_u32(rulei, 656 MLXSW_AFK_ELEMENT_PCP, 657 match.key->vlan_priority, 658 match.mask->vlan_priority); 659 } 660 661 if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) 662 mlxsw_sp_flower_parse_ipv4(rulei, f); 663 664 if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS) 665 mlxsw_sp_flower_parse_ipv6(rulei, f); 666 667 err = mlxsw_sp_flower_parse_ports(mlxsw_sp, rulei, f, ip_proto); 668 if (err) 669 return err; 670 671 err = mlxsw_sp_flower_parse_ports_range(mlxsw_sp, rulei, f, ip_proto); 672 if (err) 673 return err; 674 675 err = mlxsw_sp_flower_parse_tcp(mlxsw_sp, rulei, f, ip_proto); 676 if (err) 677 return err; 678 679 err = mlxsw_sp_flower_parse_ip(mlxsw_sp, rulei, f, n_proto_key & n_proto_mask); 680 if (err) 681 return err; 682 683 return mlxsw_sp_flower_parse_actions(mlxsw_sp, block, rulei, 684 &f->rule->action, 685 f->common.extack); 686 } 687 688 static int mlxsw_sp_flower_mall_prio_check(struct mlxsw_sp_flow_block *block, 689 struct flow_cls_offload *f) 690 { 691 bool ingress = mlxsw_sp_flow_block_is_ingress_bound(block); 692 unsigned int mall_min_prio; 693 unsigned int mall_max_prio; 694 int err; 695 696 err = mlxsw_sp_mall_prio_get(block, f->common.chain_index, 697 &mall_min_prio, &mall_max_prio); 698 if (err) { 699 if (err == -ENOENT) 700 /* No matchall filters installed on this chain. */ 701 return 0; 702 NL_SET_ERR_MSG(f->common.extack, "Failed to get matchall priorities"); 703 return err; 704 } 705 if (ingress && f->common.prio <= mall_min_prio) { 706 NL_SET_ERR_MSG(f->common.extack, "Failed to add in front of existing matchall rules"); 707 return -EOPNOTSUPP; 708 } 709 if (!ingress && f->common.prio >= mall_max_prio) { 710 NL_SET_ERR_MSG(f->common.extack, "Failed to add behind of existing matchall rules"); 711 return -EOPNOTSUPP; 712 } 713 return 0; 714 } 715 716 int mlxsw_sp_flower_replace(struct mlxsw_sp *mlxsw_sp, 717 struct mlxsw_sp_flow_block *block, 718 struct flow_cls_offload *f) 719 { 720 struct mlxsw_sp_acl_rule_info *rulei; 721 struct mlxsw_sp_acl_ruleset *ruleset; 722 struct mlxsw_sp_acl_rule *rule; 723 int err; 724 725 err = mlxsw_sp_flower_mall_prio_check(block, f); 726 if (err) 727 return err; 728 729 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block, 730 f->common.chain_index, 731 MLXSW_SP_ACL_PROFILE_FLOWER, NULL); 732 if (IS_ERR(ruleset)) 733 return PTR_ERR(ruleset); 734 735 rule = mlxsw_sp_acl_rule_create(mlxsw_sp, ruleset, f->cookie, NULL, 736 f->common.extack); 737 if (IS_ERR(rule)) { 738 err = PTR_ERR(rule); 739 goto err_rule_create; 740 } 741 742 rulei = mlxsw_sp_acl_rule_rulei(rule); 743 err = mlxsw_sp_flower_parse(mlxsw_sp, block, rulei, f); 744 if (err) 745 goto err_flower_parse; 746 747 err = mlxsw_sp_acl_rulei_commit(rulei); 748 if (err) 749 goto err_rulei_commit; 750 751 err = mlxsw_sp_acl_rule_add(mlxsw_sp, rule); 752 if (err) 753 goto err_rule_add; 754 755 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 756 return 0; 757 758 err_rule_add: 759 err_rulei_commit: 760 err_flower_parse: 761 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule); 762 err_rule_create: 763 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 764 return err; 765 } 766 767 void mlxsw_sp_flower_destroy(struct mlxsw_sp *mlxsw_sp, 768 struct mlxsw_sp_flow_block *block, 769 struct flow_cls_offload *f) 770 { 771 struct mlxsw_sp_acl_ruleset *ruleset; 772 struct mlxsw_sp_acl_rule *rule; 773 774 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block, 775 f->common.chain_index, 776 MLXSW_SP_ACL_PROFILE_FLOWER, NULL); 777 if (IS_ERR(ruleset)) 778 return; 779 780 rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie); 781 if (rule) { 782 mlxsw_sp_acl_rule_del(mlxsw_sp, rule); 783 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule); 784 } 785 786 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 787 } 788 789 int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp, 790 struct mlxsw_sp_flow_block *block, 791 struct flow_cls_offload *f) 792 { 793 enum flow_action_hw_stats used_hw_stats = FLOW_ACTION_HW_STATS_DISABLED; 794 struct mlxsw_sp_acl_ruleset *ruleset; 795 struct mlxsw_sp_acl_rule *rule; 796 u64 packets; 797 u64 lastuse; 798 u64 bytes; 799 u64 drops; 800 int err; 801 802 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block, 803 f->common.chain_index, 804 MLXSW_SP_ACL_PROFILE_FLOWER, NULL); 805 if (WARN_ON(IS_ERR(ruleset))) 806 return -EINVAL; 807 808 rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie); 809 if (!rule) 810 return -EINVAL; 811 812 err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes, 813 &drops, &lastuse, &used_hw_stats); 814 if (err) 815 goto err_rule_get_stats; 816 817 flow_stats_update(&f->stats, bytes, packets, drops, lastuse, 818 used_hw_stats); 819 820 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 821 return 0; 822 823 err_rule_get_stats: 824 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 825 return err; 826 } 827 828 int mlxsw_sp_flower_tmplt_create(struct mlxsw_sp *mlxsw_sp, 829 struct mlxsw_sp_flow_block *block, 830 struct flow_cls_offload *f) 831 { 832 struct mlxsw_sp_acl_ruleset *ruleset; 833 struct mlxsw_sp_acl_rule_info rulei; 834 int err; 835 836 memset(&rulei, 0, sizeof(rulei)); 837 err = mlxsw_sp_flower_parse(mlxsw_sp, block, &rulei, f); 838 if (err) 839 return err; 840 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block, 841 f->common.chain_index, 842 MLXSW_SP_ACL_PROFILE_FLOWER, 843 &rulei.values.elusage); 844 845 /* keep the reference to the ruleset */ 846 return PTR_ERR_OR_ZERO(ruleset); 847 } 848 849 void mlxsw_sp_flower_tmplt_destroy(struct mlxsw_sp *mlxsw_sp, 850 struct mlxsw_sp_flow_block *block, 851 struct flow_cls_offload *f) 852 { 853 struct mlxsw_sp_acl_ruleset *ruleset; 854 855 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block, 856 f->common.chain_index, 857 MLXSW_SP_ACL_PROFILE_FLOWER, NULL); 858 if (IS_ERR(ruleset)) 859 return; 860 /* put the reference to the ruleset kept in create */ 861 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 862 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 863 } 864 865 int mlxsw_sp_flower_prio_get(struct mlxsw_sp *mlxsw_sp, 866 struct mlxsw_sp_flow_block *block, 867 u32 chain_index, unsigned int *p_min_prio, 868 unsigned int *p_max_prio) 869 { 870 struct mlxsw_sp_acl_ruleset *ruleset; 871 872 ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block, 873 chain_index, 874 MLXSW_SP_ACL_PROFILE_FLOWER); 875 if (IS_ERR(ruleset)) 876 /* In case there are no flower rules, the caller 877 * receives -ENOENT to indicate there is no need 878 * to check the priorities. 879 */ 880 return PTR_ERR(ruleset); 881 mlxsw_sp_acl_ruleset_prio_get(ruleset, p_min_prio, p_max_prio); 882 return 0; 883 } 884