1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0 2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */ 3 4 #include <linux/kernel.h> 5 #include <linux/errno.h> 6 #include <linux/netdevice.h> 7 #include <net/net_namespace.h> 8 #include <net/flow_dissector.h> 9 #include <net/pkt_cls.h> 10 #include <net/tc_act/tc_gact.h> 11 #include <net/tc_act/tc_mirred.h> 12 #include <net/tc_act/tc_vlan.h> 13 14 #include "spectrum.h" 15 #include "core_acl_flex_keys.h" 16 17 static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp, 18 struct mlxsw_sp_acl_block *block, 19 struct mlxsw_sp_acl_rule_info *rulei, 20 struct flow_action *flow_action, 21 struct netlink_ext_ack *extack) 22 { 23 const struct flow_action_entry *act; 24 int err, i; 25 26 if (!flow_action_has_entries(flow_action)) 27 return 0; 28 29 /* Count action is inserted first */ 30 err = mlxsw_sp_acl_rulei_act_count(mlxsw_sp, rulei, extack); 31 if (err) 32 return err; 33 34 flow_action_for_each(i, act, flow_action) { 35 switch (act->id) { 36 case FLOW_ACTION_ACCEPT: 37 err = mlxsw_sp_acl_rulei_act_terminate(rulei); 38 if (err) { 39 NL_SET_ERR_MSG_MOD(extack, "Cannot append terminate action"); 40 return err; 41 } 42 break; 43 case FLOW_ACTION_DROP: 44 err = mlxsw_sp_acl_rulei_act_drop(rulei); 45 if (err) { 46 NL_SET_ERR_MSG_MOD(extack, "Cannot append drop action"); 47 return err; 48 } 49 break; 50 case FLOW_ACTION_TRAP: 51 err = mlxsw_sp_acl_rulei_act_trap(rulei); 52 if (err) { 53 NL_SET_ERR_MSG_MOD(extack, "Cannot append trap action"); 54 return err; 55 } 56 break; 57 case FLOW_ACTION_GOTO: { 58 u32 chain_index = act->chain_index; 59 struct mlxsw_sp_acl_ruleset *ruleset; 60 u16 group_id; 61 62 ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block, 63 chain_index, 64 MLXSW_SP_ACL_PROFILE_FLOWER); 65 if (IS_ERR(ruleset)) 66 return PTR_ERR(ruleset); 67 68 group_id = mlxsw_sp_acl_ruleset_group_id(ruleset); 69 err = mlxsw_sp_acl_rulei_act_jump(rulei, group_id); 70 if (err) { 71 NL_SET_ERR_MSG_MOD(extack, "Cannot append jump action"); 72 return err; 73 } 74 } 75 break; 76 case FLOW_ACTION_REDIRECT: { 77 struct net_device *out_dev; 78 struct mlxsw_sp_fid *fid; 79 u16 fid_index; 80 81 fid = mlxsw_sp_acl_dummy_fid(mlxsw_sp); 82 fid_index = mlxsw_sp_fid_index(fid); 83 err = mlxsw_sp_acl_rulei_act_fid_set(mlxsw_sp, rulei, 84 fid_index, extack); 85 if (err) 86 return err; 87 88 out_dev = act->dev; 89 err = mlxsw_sp_acl_rulei_act_fwd(mlxsw_sp, rulei, 90 out_dev, extack); 91 if (err) 92 return err; 93 } 94 break; 95 case FLOW_ACTION_MIRRED: { 96 struct net_device *out_dev = act->dev; 97 98 err = mlxsw_sp_acl_rulei_act_mirror(mlxsw_sp, rulei, 99 block, out_dev, 100 extack); 101 if (err) 102 return err; 103 } 104 break; 105 case FLOW_ACTION_VLAN_MANGLE: { 106 u16 proto = be16_to_cpu(act->vlan.proto); 107 u8 prio = act->vlan.prio; 108 u16 vid = act->vlan.vid; 109 110 return mlxsw_sp_acl_rulei_act_vlan(mlxsw_sp, rulei, 111 act->id, vid, 112 proto, prio, extack); 113 } 114 default: 115 NL_SET_ERR_MSG_MOD(extack, "Unsupported action"); 116 dev_err(mlxsw_sp->bus_info->dev, "Unsupported action\n"); 117 return -EOPNOTSUPP; 118 } 119 } 120 return 0; 121 } 122 123 static void mlxsw_sp_flower_parse_ipv4(struct mlxsw_sp_acl_rule_info *rulei, 124 struct tc_cls_flower_offload *f) 125 { 126 struct flow_match_ipv4_addrs match; 127 128 flow_rule_match_ipv4_addrs(f->rule, &match); 129 130 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31, 131 (char *) &match.key->src, 132 (char *) &match.mask->src, 4); 133 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31, 134 (char *) &match.key->dst, 135 (char *) &match.mask->dst, 4); 136 } 137 138 static void mlxsw_sp_flower_parse_ipv6(struct mlxsw_sp_acl_rule_info *rulei, 139 struct tc_cls_flower_offload *f) 140 { 141 struct flow_match_ipv6_addrs match; 142 143 flow_rule_match_ipv6_addrs(f->rule, &match); 144 145 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_96_127, 146 &match.key->src.s6_addr[0x0], 147 &match.mask->src.s6_addr[0x0], 4); 148 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_64_95, 149 &match.key->src.s6_addr[0x4], 150 &match.mask->src.s6_addr[0x4], 4); 151 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_32_63, 152 &match.key->src.s6_addr[0x8], 153 &match.mask->src.s6_addr[0x8], 4); 154 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31, 155 &match.key->src.s6_addr[0xC], 156 &match.mask->src.s6_addr[0xC], 4); 157 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_96_127, 158 &match.key->dst.s6_addr[0x0], 159 &match.mask->dst.s6_addr[0x0], 4); 160 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_64_95, 161 &match.key->dst.s6_addr[0x4], 162 &match.mask->dst.s6_addr[0x4], 4); 163 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_32_63, 164 &match.key->dst.s6_addr[0x8], 165 &match.mask->dst.s6_addr[0x8], 4); 166 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31, 167 &match.key->dst.s6_addr[0xC], 168 &match.mask->dst.s6_addr[0xC], 4); 169 } 170 171 static int mlxsw_sp_flower_parse_ports(struct mlxsw_sp *mlxsw_sp, 172 struct mlxsw_sp_acl_rule_info *rulei, 173 struct tc_cls_flower_offload *f, 174 u8 ip_proto) 175 { 176 const struct flow_rule *rule = tc_cls_flower_offload_flow_rule(f); 177 struct flow_match_ports match; 178 179 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS)) 180 return 0; 181 182 if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) { 183 NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported"); 184 dev_err(mlxsw_sp->bus_info->dev, "Only UDP and TCP keys are supported\n"); 185 return -EINVAL; 186 } 187 188 flow_rule_match_ports(rule, &match); 189 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_L4_PORT, 190 ntohs(match.key->dst), 191 ntohs(match.mask->dst)); 192 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_L4_PORT, 193 ntohs(match.key->src), 194 ntohs(match.mask->src)); 195 return 0; 196 } 197 198 static int mlxsw_sp_flower_parse_tcp(struct mlxsw_sp *mlxsw_sp, 199 struct mlxsw_sp_acl_rule_info *rulei, 200 struct tc_cls_flower_offload *f, 201 u8 ip_proto) 202 { 203 const struct flow_rule *rule = tc_cls_flower_offload_flow_rule(f); 204 struct flow_match_tcp match; 205 206 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_TCP)) 207 return 0; 208 209 if (ip_proto != IPPROTO_TCP) { 210 NL_SET_ERR_MSG_MOD(f->common.extack, "TCP keys supported only for TCP"); 211 dev_err(mlxsw_sp->bus_info->dev, "TCP keys supported only for TCP\n"); 212 return -EINVAL; 213 } 214 215 flow_rule_match_tcp(rule, &match); 216 217 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_TCP_FLAGS, 218 ntohs(match.key->flags), 219 ntohs(match.mask->flags)); 220 return 0; 221 } 222 223 static int mlxsw_sp_flower_parse_ip(struct mlxsw_sp *mlxsw_sp, 224 struct mlxsw_sp_acl_rule_info *rulei, 225 struct tc_cls_flower_offload *f, 226 u16 n_proto) 227 { 228 const struct flow_rule *rule = tc_cls_flower_offload_flow_rule(f); 229 struct flow_match_ip match; 230 231 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IP)) 232 return 0; 233 234 if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6) { 235 NL_SET_ERR_MSG_MOD(f->common.extack, "IP keys supported only for IPv4/6"); 236 dev_err(mlxsw_sp->bus_info->dev, "IP keys supported only for IPv4/6\n"); 237 return -EINVAL; 238 } 239 240 flow_rule_match_ip(rule, &match); 241 242 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_TTL_, 243 match.key->ttl, match.mask->ttl); 244 245 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_ECN, 246 match.key->tos & 0x3, 247 match.mask->tos & 0x3); 248 249 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_DSCP, 250 match.key->tos >> 6, 251 match.mask->tos >> 6); 252 253 return 0; 254 } 255 256 static int mlxsw_sp_flower_parse(struct mlxsw_sp *mlxsw_sp, 257 struct mlxsw_sp_acl_block *block, 258 struct mlxsw_sp_acl_rule_info *rulei, 259 struct tc_cls_flower_offload *f) 260 { 261 struct flow_rule *rule = tc_cls_flower_offload_flow_rule(f); 262 struct flow_dissector *dissector = rule->match.dissector; 263 u16 n_proto_mask = 0; 264 u16 n_proto_key = 0; 265 u16 addr_type = 0; 266 u8 ip_proto = 0; 267 int err; 268 269 if (dissector->used_keys & 270 ~(BIT(FLOW_DISSECTOR_KEY_CONTROL) | 271 BIT(FLOW_DISSECTOR_KEY_BASIC) | 272 BIT(FLOW_DISSECTOR_KEY_ETH_ADDRS) | 273 BIT(FLOW_DISSECTOR_KEY_IPV4_ADDRS) | 274 BIT(FLOW_DISSECTOR_KEY_IPV6_ADDRS) | 275 BIT(FLOW_DISSECTOR_KEY_PORTS) | 276 BIT(FLOW_DISSECTOR_KEY_TCP) | 277 BIT(FLOW_DISSECTOR_KEY_IP) | 278 BIT(FLOW_DISSECTOR_KEY_VLAN))) { 279 dev_err(mlxsw_sp->bus_info->dev, "Unsupported key\n"); 280 NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported key"); 281 return -EOPNOTSUPP; 282 } 283 284 mlxsw_sp_acl_rulei_priority(rulei, f->common.prio); 285 286 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CONTROL)) { 287 struct flow_match_control match; 288 289 flow_rule_match_control(rule, &match); 290 addr_type = match.key->addr_type; 291 } 292 293 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) { 294 struct flow_match_basic match; 295 296 flow_rule_match_basic(rule, &match); 297 n_proto_key = ntohs(match.key->n_proto); 298 n_proto_mask = ntohs(match.mask->n_proto); 299 300 if (n_proto_key == ETH_P_ALL) { 301 n_proto_key = 0; 302 n_proto_mask = 0; 303 } 304 mlxsw_sp_acl_rulei_keymask_u32(rulei, 305 MLXSW_AFK_ELEMENT_ETHERTYPE, 306 n_proto_key, n_proto_mask); 307 308 ip_proto = match.key->ip_proto; 309 mlxsw_sp_acl_rulei_keymask_u32(rulei, 310 MLXSW_AFK_ELEMENT_IP_PROTO, 311 match.key->ip_proto, 312 match.mask->ip_proto); 313 } 314 315 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) { 316 struct flow_match_eth_addrs match; 317 318 flow_rule_match_eth_addrs(rule, &match); 319 mlxsw_sp_acl_rulei_keymask_buf(rulei, 320 MLXSW_AFK_ELEMENT_DMAC_32_47, 321 match.key->dst, 322 match.mask->dst, 2); 323 mlxsw_sp_acl_rulei_keymask_buf(rulei, 324 MLXSW_AFK_ELEMENT_DMAC_0_31, 325 match.key->dst + 2, 326 match.mask->dst + 2, 4); 327 mlxsw_sp_acl_rulei_keymask_buf(rulei, 328 MLXSW_AFK_ELEMENT_SMAC_32_47, 329 match.key->src, 330 match.mask->src, 2); 331 mlxsw_sp_acl_rulei_keymask_buf(rulei, 332 MLXSW_AFK_ELEMENT_SMAC_0_31, 333 match.key->src + 2, 334 match.mask->src + 2, 4); 335 } 336 337 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) { 338 struct flow_match_vlan match; 339 340 flow_rule_match_vlan(rule, &match); 341 if (mlxsw_sp_acl_block_is_egress_bound(block)) { 342 NL_SET_ERR_MSG_MOD(f->common.extack, "vlan_id key is not supported on egress"); 343 return -EOPNOTSUPP; 344 } 345 if (match.mask->vlan_id != 0) 346 mlxsw_sp_acl_rulei_keymask_u32(rulei, 347 MLXSW_AFK_ELEMENT_VID, 348 match.key->vlan_id, 349 match.mask->vlan_id); 350 if (match.mask->vlan_priority != 0) 351 mlxsw_sp_acl_rulei_keymask_u32(rulei, 352 MLXSW_AFK_ELEMENT_PCP, 353 match.key->vlan_priority, 354 match.mask->vlan_priority); 355 } 356 357 if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) 358 mlxsw_sp_flower_parse_ipv4(rulei, f); 359 360 if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS) 361 mlxsw_sp_flower_parse_ipv6(rulei, f); 362 363 err = mlxsw_sp_flower_parse_ports(mlxsw_sp, rulei, f, ip_proto); 364 if (err) 365 return err; 366 err = mlxsw_sp_flower_parse_tcp(mlxsw_sp, rulei, f, ip_proto); 367 if (err) 368 return err; 369 370 err = mlxsw_sp_flower_parse_ip(mlxsw_sp, rulei, f, n_proto_key & n_proto_mask); 371 if (err) 372 return err; 373 374 return mlxsw_sp_flower_parse_actions(mlxsw_sp, block, rulei, 375 &f->rule->action, 376 f->common.extack); 377 } 378 379 int mlxsw_sp_flower_replace(struct mlxsw_sp *mlxsw_sp, 380 struct mlxsw_sp_acl_block *block, 381 struct tc_cls_flower_offload *f) 382 { 383 struct mlxsw_sp_acl_rule_info *rulei; 384 struct mlxsw_sp_acl_ruleset *ruleset; 385 struct mlxsw_sp_acl_rule *rule; 386 int err; 387 388 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block, 389 f->common.chain_index, 390 MLXSW_SP_ACL_PROFILE_FLOWER, NULL); 391 if (IS_ERR(ruleset)) 392 return PTR_ERR(ruleset); 393 394 rule = mlxsw_sp_acl_rule_create(mlxsw_sp, ruleset, f->cookie, NULL, 395 f->common.extack); 396 if (IS_ERR(rule)) { 397 err = PTR_ERR(rule); 398 goto err_rule_create; 399 } 400 401 rulei = mlxsw_sp_acl_rule_rulei(rule); 402 err = mlxsw_sp_flower_parse(mlxsw_sp, block, rulei, f); 403 if (err) 404 goto err_flower_parse; 405 406 err = mlxsw_sp_acl_rulei_commit(rulei); 407 if (err) 408 goto err_rulei_commit; 409 410 err = mlxsw_sp_acl_rule_add(mlxsw_sp, rule); 411 if (err) 412 goto err_rule_add; 413 414 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 415 return 0; 416 417 err_rule_add: 418 err_rulei_commit: 419 err_flower_parse: 420 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule); 421 err_rule_create: 422 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 423 return err; 424 } 425 426 void mlxsw_sp_flower_destroy(struct mlxsw_sp *mlxsw_sp, 427 struct mlxsw_sp_acl_block *block, 428 struct tc_cls_flower_offload *f) 429 { 430 struct mlxsw_sp_acl_ruleset *ruleset; 431 struct mlxsw_sp_acl_rule *rule; 432 433 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block, 434 f->common.chain_index, 435 MLXSW_SP_ACL_PROFILE_FLOWER, NULL); 436 if (IS_ERR(ruleset)) 437 return; 438 439 rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie); 440 if (rule) { 441 mlxsw_sp_acl_rule_del(mlxsw_sp, rule); 442 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule); 443 } 444 445 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 446 } 447 448 int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp, 449 struct mlxsw_sp_acl_block *block, 450 struct tc_cls_flower_offload *f) 451 { 452 struct mlxsw_sp_acl_ruleset *ruleset; 453 struct mlxsw_sp_acl_rule *rule; 454 u64 packets; 455 u64 lastuse; 456 u64 bytes; 457 int err; 458 459 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block, 460 f->common.chain_index, 461 MLXSW_SP_ACL_PROFILE_FLOWER, NULL); 462 if (WARN_ON(IS_ERR(ruleset))) 463 return -EINVAL; 464 465 rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie); 466 if (!rule) 467 return -EINVAL; 468 469 err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes, 470 &lastuse); 471 if (err) 472 goto err_rule_get_stats; 473 474 flow_stats_update(&f->stats, bytes, packets, lastuse); 475 476 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 477 return 0; 478 479 err_rule_get_stats: 480 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 481 return err; 482 } 483 484 int mlxsw_sp_flower_tmplt_create(struct mlxsw_sp *mlxsw_sp, 485 struct mlxsw_sp_acl_block *block, 486 struct tc_cls_flower_offload *f) 487 { 488 struct mlxsw_sp_acl_ruleset *ruleset; 489 struct mlxsw_sp_acl_rule_info rulei; 490 int err; 491 492 memset(&rulei, 0, sizeof(rulei)); 493 err = mlxsw_sp_flower_parse(mlxsw_sp, block, &rulei, f); 494 if (err) 495 return err; 496 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block, 497 f->common.chain_index, 498 MLXSW_SP_ACL_PROFILE_FLOWER, 499 &rulei.values.elusage); 500 501 /* keep the reference to the ruleset */ 502 return PTR_ERR_OR_ZERO(ruleset); 503 } 504 505 void mlxsw_sp_flower_tmplt_destroy(struct mlxsw_sp *mlxsw_sp, 506 struct mlxsw_sp_acl_block *block, 507 struct tc_cls_flower_offload *f) 508 { 509 struct mlxsw_sp_acl_ruleset *ruleset; 510 511 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block, 512 f->common.chain_index, 513 MLXSW_SP_ACL_PROFILE_FLOWER, NULL); 514 if (IS_ERR(ruleset)) 515 return; 516 /* put the reference to the ruleset kept in create */ 517 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 518 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 519 } 520