1 // SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
2 /* Copyright (C) 2017-2018 Netronome Systems, Inc. */
3 
4 #include <linux/bitfield.h>
5 #include <linux/mpls.h>
6 #include <net/pkt_cls.h>
7 #include <net/tc_act/tc_csum.h>
8 #include <net/tc_act/tc_gact.h>
9 #include <net/tc_act/tc_mirred.h>
10 #include <net/tc_act/tc_mpls.h>
11 #include <net/tc_act/tc_pedit.h>
12 #include <net/tc_act/tc_vlan.h>
13 #include <net/tc_act/tc_tunnel_key.h>
14 
15 #include "cmsg.h"
16 #include "main.h"
17 #include "../nfp_net_repr.h"
18 
19 /* The kernel versions of TUNNEL_* are not ABI and therefore vulnerable
20  * to change. Such changes will break our FW ABI.
21  */
22 #define NFP_FL_TUNNEL_CSUM			cpu_to_be16(0x01)
23 #define NFP_FL_TUNNEL_KEY			cpu_to_be16(0x04)
24 #define NFP_FL_TUNNEL_GENEVE_OPT		cpu_to_be16(0x0800)
25 #define NFP_FL_SUPPORTED_TUNNEL_INFO_FLAGS	(IP_TUNNEL_INFO_TX | \
26 						 IP_TUNNEL_INFO_IPV6)
27 #define NFP_FL_SUPPORTED_UDP_TUN_FLAGS		(NFP_FL_TUNNEL_CSUM | \
28 						 NFP_FL_TUNNEL_KEY | \
29 						 NFP_FL_TUNNEL_GENEVE_OPT)
30 
31 static int
32 nfp_fl_push_mpls(struct nfp_fl_push_mpls *push_mpls,
33 		 const struct flow_action_entry *act,
34 		 struct netlink_ext_ack *extack)
35 {
36 	size_t act_size = sizeof(struct nfp_fl_push_mpls);
37 	u32 mpls_lse = 0;
38 
39 	push_mpls->head.jump_id = NFP_FL_ACTION_OPCODE_PUSH_MPLS;
40 	push_mpls->head.len_lw = act_size >> NFP_FL_LW_SIZ;
41 
42 	/* BOS is optional in the TC action but required for offload. */
43 	if (act->mpls_push.bos != ACT_MPLS_BOS_NOT_SET) {
44 		mpls_lse |= act->mpls_push.bos << MPLS_LS_S_SHIFT;
45 	} else {
46 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: BOS field must explicitly be set for MPLS push");
47 		return -EOPNOTSUPP;
48 	}
49 
50 	/* Leave MPLS TC as a default value of 0 if not explicitly set. */
51 	if (act->mpls_push.tc != ACT_MPLS_TC_NOT_SET)
52 		mpls_lse |= act->mpls_push.tc << MPLS_LS_TC_SHIFT;
53 
54 	/* Proto, label and TTL are enforced and verified for MPLS push. */
55 	mpls_lse |= act->mpls_push.label << MPLS_LS_LABEL_SHIFT;
56 	mpls_lse |= act->mpls_push.ttl << MPLS_LS_TTL_SHIFT;
57 	push_mpls->ethtype = act->mpls_push.proto;
58 	push_mpls->lse = cpu_to_be32(mpls_lse);
59 
60 	return 0;
61 }
62 
63 static void
64 nfp_fl_pop_mpls(struct nfp_fl_pop_mpls *pop_mpls,
65 		const struct flow_action_entry *act)
66 {
67 	size_t act_size = sizeof(struct nfp_fl_pop_mpls);
68 
69 	pop_mpls->head.jump_id = NFP_FL_ACTION_OPCODE_POP_MPLS;
70 	pop_mpls->head.len_lw = act_size >> NFP_FL_LW_SIZ;
71 	pop_mpls->ethtype = act->mpls_pop.proto;
72 }
73 
74 static void
75 nfp_fl_set_mpls(struct nfp_fl_set_mpls *set_mpls,
76 		const struct flow_action_entry *act)
77 {
78 	size_t act_size = sizeof(struct nfp_fl_set_mpls);
79 	u32 mpls_lse = 0, mpls_mask = 0;
80 
81 	set_mpls->head.jump_id = NFP_FL_ACTION_OPCODE_SET_MPLS;
82 	set_mpls->head.len_lw = act_size >> NFP_FL_LW_SIZ;
83 
84 	if (act->mpls_mangle.label != ACT_MPLS_LABEL_NOT_SET) {
85 		mpls_lse |= act->mpls_mangle.label << MPLS_LS_LABEL_SHIFT;
86 		mpls_mask |= MPLS_LS_LABEL_MASK;
87 	}
88 	if (act->mpls_mangle.tc != ACT_MPLS_TC_NOT_SET) {
89 		mpls_lse |= act->mpls_mangle.tc << MPLS_LS_TC_SHIFT;
90 		mpls_mask |= MPLS_LS_TC_MASK;
91 	}
92 	if (act->mpls_mangle.bos != ACT_MPLS_BOS_NOT_SET) {
93 		mpls_lse |= act->mpls_mangle.bos << MPLS_LS_S_SHIFT;
94 		mpls_mask |= MPLS_LS_S_MASK;
95 	}
96 	if (act->mpls_mangle.ttl) {
97 		mpls_lse |= act->mpls_mangle.ttl << MPLS_LS_TTL_SHIFT;
98 		mpls_mask |= MPLS_LS_TTL_MASK;
99 	}
100 
101 	set_mpls->lse = cpu_to_be32(mpls_lse);
102 	set_mpls->lse_mask = cpu_to_be32(mpls_mask);
103 }
104 
105 static void nfp_fl_pop_vlan(struct nfp_fl_pop_vlan *pop_vlan)
106 {
107 	size_t act_size = sizeof(struct nfp_fl_pop_vlan);
108 
109 	pop_vlan->head.jump_id = NFP_FL_ACTION_OPCODE_POP_VLAN;
110 	pop_vlan->head.len_lw = act_size >> NFP_FL_LW_SIZ;
111 	pop_vlan->reserved = 0;
112 }
113 
114 static void
115 nfp_fl_push_vlan(struct nfp_fl_push_vlan *push_vlan,
116 		 const struct flow_action_entry *act)
117 {
118 	size_t act_size = sizeof(struct nfp_fl_push_vlan);
119 	u16 tmp_push_vlan_tci;
120 
121 	push_vlan->head.jump_id = NFP_FL_ACTION_OPCODE_PUSH_VLAN;
122 	push_vlan->head.len_lw = act_size >> NFP_FL_LW_SIZ;
123 	push_vlan->reserved = 0;
124 	push_vlan->vlan_tpid = act->vlan.proto;
125 
126 	tmp_push_vlan_tci =
127 		FIELD_PREP(NFP_FL_PUSH_VLAN_PRIO, act->vlan.prio) |
128 		FIELD_PREP(NFP_FL_PUSH_VLAN_VID, act->vlan.vid);
129 	push_vlan->vlan_tci = cpu_to_be16(tmp_push_vlan_tci);
130 }
131 
132 static int
133 nfp_fl_pre_lag(struct nfp_app *app, const struct flow_action_entry *act,
134 	       struct nfp_fl_payload *nfp_flow, int act_len,
135 	       struct netlink_ext_ack *extack)
136 {
137 	size_t act_size = sizeof(struct nfp_fl_pre_lag);
138 	struct nfp_fl_pre_lag *pre_lag;
139 	struct net_device *out_dev;
140 	int err;
141 
142 	out_dev = act->dev;
143 	if (!out_dev || !netif_is_lag_master(out_dev))
144 		return 0;
145 
146 	if (act_len + act_size > NFP_FL_MAX_A_SIZ) {
147 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: maximum allowed action list size exceeded at LAG action");
148 		return -EOPNOTSUPP;
149 	}
150 
151 	/* Pre_lag action must be first on action list.
152 	 * If other actions already exist they need pushed forward.
153 	 */
154 	if (act_len)
155 		memmove(nfp_flow->action_data + act_size,
156 			nfp_flow->action_data, act_len);
157 
158 	pre_lag = (struct nfp_fl_pre_lag *)nfp_flow->action_data;
159 	err = nfp_flower_lag_populate_pre_action(app, out_dev, pre_lag, extack);
160 	if (err)
161 		return err;
162 
163 	pre_lag->head.jump_id = NFP_FL_ACTION_OPCODE_PRE_LAG;
164 	pre_lag->head.len_lw = act_size >> NFP_FL_LW_SIZ;
165 
166 	nfp_flow->meta.shortcut = cpu_to_be32(NFP_FL_SC_ACT_NULL);
167 
168 	return act_size;
169 }
170 
171 static int
172 nfp_fl_output(struct nfp_app *app, struct nfp_fl_output *output,
173 	      const struct flow_action_entry *act,
174 	      struct nfp_fl_payload *nfp_flow,
175 	      bool last, struct net_device *in_dev,
176 	      enum nfp_flower_tun_type tun_type, int *tun_out_cnt,
177 	      bool pkt_host, struct netlink_ext_ack *extack)
178 {
179 	size_t act_size = sizeof(struct nfp_fl_output);
180 	struct nfp_flower_priv *priv = app->priv;
181 	struct net_device *out_dev;
182 	u16 tmp_flags;
183 
184 	output->head.jump_id = NFP_FL_ACTION_OPCODE_OUTPUT;
185 	output->head.len_lw = act_size >> NFP_FL_LW_SIZ;
186 
187 	out_dev = act->dev;
188 	if (!out_dev) {
189 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: invalid egress interface for mirred action");
190 		return -EOPNOTSUPP;
191 	}
192 
193 	tmp_flags = last ? NFP_FL_OUT_FLAGS_LAST : 0;
194 
195 	if (tun_type) {
196 		/* Verify the egress netdev matches the tunnel type. */
197 		if (!nfp_fl_netdev_is_tunnel_type(out_dev, tun_type)) {
198 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: egress interface does not match the required tunnel type");
199 			return -EOPNOTSUPP;
200 		}
201 
202 		if (*tun_out_cnt) {
203 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: cannot offload more than one tunnel mirred output per filter");
204 			return -EOPNOTSUPP;
205 		}
206 		(*tun_out_cnt)++;
207 
208 		output->flags = cpu_to_be16(tmp_flags |
209 					    NFP_FL_OUT_FLAGS_USE_TUN);
210 		output->port = cpu_to_be32(NFP_FL_PORT_TYPE_TUN | tun_type);
211 	} else if (netif_is_lag_master(out_dev) &&
212 		   priv->flower_en_feats & NFP_FL_ENABLE_LAG) {
213 		int gid;
214 
215 		output->flags = cpu_to_be16(tmp_flags);
216 		gid = nfp_flower_lag_get_output_id(app, out_dev);
217 		if (gid < 0) {
218 			NL_SET_ERR_MSG_MOD(extack, "invalid entry: cannot find group id for LAG action");
219 			return gid;
220 		}
221 		output->port = cpu_to_be32(NFP_FL_LAG_OUT | gid);
222 	} else if (nfp_flower_internal_port_can_offload(app, out_dev)) {
223 		if (!(priv->flower_ext_feats & NFP_FL_FEATS_PRE_TUN_RULES)) {
224 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: pre-tunnel rules not supported in loaded firmware");
225 			return -EOPNOTSUPP;
226 		}
227 
228 		if (nfp_flow->pre_tun_rule.dev || !pkt_host) {
229 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: pre-tunnel rules require single egress dev and ptype HOST action");
230 			return -EOPNOTSUPP;
231 		}
232 
233 		nfp_flow->pre_tun_rule.dev = out_dev;
234 
235 		return 0;
236 	} else {
237 		/* Set action output parameters. */
238 		output->flags = cpu_to_be16(tmp_flags);
239 
240 		if (nfp_netdev_is_nfp_repr(in_dev)) {
241 			/* Confirm ingress and egress are on same device. */
242 			if (!netdev_port_same_parent_id(in_dev, out_dev)) {
243 				NL_SET_ERR_MSG_MOD(extack, "unsupported offload: ingress and egress interfaces are on different devices");
244 				return -EOPNOTSUPP;
245 			}
246 		}
247 
248 		if (!nfp_netdev_is_nfp_repr(out_dev)) {
249 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: egress interface is not an nfp port");
250 			return -EOPNOTSUPP;
251 		}
252 
253 		output->port = cpu_to_be32(nfp_repr_get_port_id(out_dev));
254 		if (!output->port) {
255 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: invalid port id for egress interface");
256 			return -EOPNOTSUPP;
257 		}
258 	}
259 	nfp_flow->meta.shortcut = output->port;
260 
261 	return 0;
262 }
263 
264 static bool
265 nfp_flower_tun_is_gre(struct flow_rule *rule, int start_idx)
266 {
267 	struct flow_action_entry *act = rule->action.entries;
268 	int num_act = rule->action.num_entries;
269 	int act_idx;
270 
271 	/* Preparse action list for next mirred or redirect action */
272 	for (act_idx = start_idx + 1; act_idx < num_act; act_idx++)
273 		if (act[act_idx].id == FLOW_ACTION_REDIRECT ||
274 		    act[act_idx].id == FLOW_ACTION_MIRRED)
275 			return netif_is_gretap(act[act_idx].dev) ||
276 			       netif_is_ip6gretap(act[act_idx].dev);
277 
278 	return false;
279 }
280 
281 static enum nfp_flower_tun_type
282 nfp_fl_get_tun_from_act(struct nfp_app *app,
283 			struct flow_rule *rule,
284 			const struct flow_action_entry *act, int act_idx)
285 {
286 	const struct ip_tunnel_info *tun = act->tunnel;
287 	struct nfp_flower_priv *priv = app->priv;
288 
289 	/* Determine the tunnel type based on the egress netdev
290 	 * in the mirred action for tunnels without l4.
291 	 */
292 	if (nfp_flower_tun_is_gre(rule, act_idx))
293 		return NFP_FL_TUNNEL_GRE;
294 
295 	switch (tun->key.tp_dst) {
296 	case htons(IANA_VXLAN_UDP_PORT):
297 		return NFP_FL_TUNNEL_VXLAN;
298 	case htons(GENEVE_UDP_PORT):
299 		if (priv->flower_ext_feats & NFP_FL_FEATS_GENEVE)
300 			return NFP_FL_TUNNEL_GENEVE;
301 		fallthrough;
302 	default:
303 		return NFP_FL_TUNNEL_NONE;
304 	}
305 }
306 
307 static struct nfp_fl_pre_tunnel *nfp_fl_pre_tunnel(char *act_data, int act_len)
308 {
309 	size_t act_size = sizeof(struct nfp_fl_pre_tunnel);
310 	struct nfp_fl_pre_tunnel *pre_tun_act;
311 
312 	/* Pre_tunnel action must be first on action list.
313 	 * If other actions already exist they need to be pushed forward.
314 	 */
315 	if (act_len)
316 		memmove(act_data + act_size, act_data, act_len);
317 
318 	pre_tun_act = (struct nfp_fl_pre_tunnel *)act_data;
319 
320 	memset(pre_tun_act, 0, act_size);
321 
322 	pre_tun_act->head.jump_id = NFP_FL_ACTION_OPCODE_PRE_TUNNEL;
323 	pre_tun_act->head.len_lw = act_size >> NFP_FL_LW_SIZ;
324 
325 	return pre_tun_act;
326 }
327 
328 static int
329 nfp_fl_push_geneve_options(struct nfp_fl_payload *nfp_fl, int *list_len,
330 			   const struct flow_action_entry *act,
331 			   struct netlink_ext_ack *extack)
332 {
333 	struct ip_tunnel_info *ip_tun = (struct ip_tunnel_info *)act->tunnel;
334 	int opt_len, opt_cnt, act_start, tot_push_len;
335 	u8 *src = ip_tunnel_info_opts(ip_tun);
336 
337 	/* We need to populate the options in reverse order for HW.
338 	 * Therefore we go through the options, calculating the
339 	 * number of options and the total size, then we populate
340 	 * them in reverse order in the action list.
341 	 */
342 	opt_cnt = 0;
343 	tot_push_len = 0;
344 	opt_len = ip_tun->options_len;
345 	while (opt_len > 0) {
346 		struct geneve_opt *opt = (struct geneve_opt *)src;
347 
348 		opt_cnt++;
349 		if (opt_cnt > NFP_FL_MAX_GENEVE_OPT_CNT) {
350 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: maximum allowed number of geneve options exceeded");
351 			return -EOPNOTSUPP;
352 		}
353 
354 		tot_push_len += sizeof(struct nfp_fl_push_geneve) +
355 			       opt->length * 4;
356 		if (tot_push_len > NFP_FL_MAX_GENEVE_OPT_ACT) {
357 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: maximum allowed action list size exceeded at push geneve options");
358 			return -EOPNOTSUPP;
359 		}
360 
361 		opt_len -= sizeof(struct geneve_opt) + opt->length * 4;
362 		src += sizeof(struct geneve_opt) + opt->length * 4;
363 	}
364 
365 	if (*list_len + tot_push_len > NFP_FL_MAX_A_SIZ) {
366 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: maximum allowed action list size exceeded at push geneve options");
367 		return -EOPNOTSUPP;
368 	}
369 
370 	act_start = *list_len;
371 	*list_len += tot_push_len;
372 	src = ip_tunnel_info_opts(ip_tun);
373 	while (opt_cnt) {
374 		struct geneve_opt *opt = (struct geneve_opt *)src;
375 		struct nfp_fl_push_geneve *push;
376 		size_t act_size, len;
377 
378 		opt_cnt--;
379 		act_size = sizeof(struct nfp_fl_push_geneve) + opt->length * 4;
380 		tot_push_len -= act_size;
381 		len = act_start + tot_push_len;
382 
383 		push = (struct nfp_fl_push_geneve *)&nfp_fl->action_data[len];
384 		push->head.jump_id = NFP_FL_ACTION_OPCODE_PUSH_GENEVE;
385 		push->head.len_lw = act_size >> NFP_FL_LW_SIZ;
386 		push->reserved = 0;
387 		push->class = opt->opt_class;
388 		push->type = opt->type;
389 		push->length = opt->length;
390 		memcpy(&push->opt_data, opt->opt_data, opt->length * 4);
391 
392 		src += sizeof(struct geneve_opt) + opt->length * 4;
393 	}
394 
395 	return 0;
396 }
397 
398 static int
399 nfp_fl_set_tun(struct nfp_app *app, struct nfp_fl_set_tun *set_tun,
400 	       const struct flow_action_entry *act,
401 	       struct nfp_fl_pre_tunnel *pre_tun,
402 	       enum nfp_flower_tun_type tun_type,
403 	       struct net_device *netdev, struct netlink_ext_ack *extack)
404 {
405 	const struct ip_tunnel_info *ip_tun = act->tunnel;
406 	bool ipv6 = ip_tunnel_info_af(ip_tun) == AF_INET6;
407 	size_t act_size = sizeof(struct nfp_fl_set_tun);
408 	struct nfp_flower_priv *priv = app->priv;
409 	u32 tmp_set_ip_tun_type_index = 0;
410 	/* Currently support one pre-tunnel so index is always 0. */
411 	int pretun_idx = 0;
412 
413 	if (!IS_ENABLED(CONFIG_IPV6) && ipv6)
414 		return -EOPNOTSUPP;
415 
416 	if (ipv6 && !(priv->flower_ext_feats & NFP_FL_FEATS_IPV6_TUN))
417 		return -EOPNOTSUPP;
418 
419 	BUILD_BUG_ON(NFP_FL_TUNNEL_CSUM != TUNNEL_CSUM ||
420 		     NFP_FL_TUNNEL_KEY	!= TUNNEL_KEY ||
421 		     NFP_FL_TUNNEL_GENEVE_OPT != TUNNEL_GENEVE_OPT);
422 	if (ip_tun->options_len &&
423 	    (tun_type != NFP_FL_TUNNEL_GENEVE ||
424 	    !(priv->flower_ext_feats & NFP_FL_FEATS_GENEVE_OPT))) {
425 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: loaded firmware does not support geneve options offload");
426 		return -EOPNOTSUPP;
427 	}
428 
429 	set_tun->head.jump_id = NFP_FL_ACTION_OPCODE_SET_TUNNEL;
430 	set_tun->head.len_lw = act_size >> NFP_FL_LW_SIZ;
431 
432 	/* Set tunnel type and pre-tunnel index. */
433 	tmp_set_ip_tun_type_index |=
434 		FIELD_PREP(NFP_FL_TUNNEL_TYPE, tun_type) |
435 		FIELD_PREP(NFP_FL_PRE_TUN_INDEX, pretun_idx);
436 
437 	set_tun->tun_type_index = cpu_to_be32(tmp_set_ip_tun_type_index);
438 	set_tun->tun_id = ip_tun->key.tun_id;
439 
440 	if (ip_tun->key.ttl) {
441 		set_tun->ttl = ip_tun->key.ttl;
442 #ifdef CONFIG_IPV6
443 	} else if (ipv6) {
444 		struct net *net = dev_net(netdev);
445 		struct flowi6 flow = {};
446 		struct dst_entry *dst;
447 
448 		flow.daddr = ip_tun->key.u.ipv6.dst;
449 		flow.flowi4_proto = IPPROTO_UDP;
450 		dst = ipv6_stub->ipv6_dst_lookup_flow(net, NULL, &flow, NULL);
451 		if (!IS_ERR(dst)) {
452 			set_tun->ttl = ip6_dst_hoplimit(dst);
453 			dst_release(dst);
454 		} else {
455 			set_tun->ttl = net->ipv6.devconf_all->hop_limit;
456 		}
457 #endif
458 	} else {
459 		struct net *net = dev_net(netdev);
460 		struct flowi4 flow = {};
461 		struct rtable *rt;
462 		int err;
463 
464 		/* Do a route lookup to determine ttl - if fails then use
465 		 * default. Note that CONFIG_INET is a requirement of
466 		 * CONFIG_NET_SWITCHDEV so must be defined here.
467 		 */
468 		flow.daddr = ip_tun->key.u.ipv4.dst;
469 		flow.flowi4_proto = IPPROTO_UDP;
470 		rt = ip_route_output_key(net, &flow);
471 		err = PTR_ERR_OR_ZERO(rt);
472 		if (!err) {
473 			set_tun->ttl = ip4_dst_hoplimit(&rt->dst);
474 			ip_rt_put(rt);
475 		} else {
476 			set_tun->ttl = net->ipv4.sysctl_ip_default_ttl;
477 		}
478 	}
479 
480 	set_tun->tos = ip_tun->key.tos;
481 
482 	if (!(ip_tun->key.tun_flags & NFP_FL_TUNNEL_KEY) ||
483 	    ip_tun->key.tun_flags & ~NFP_FL_SUPPORTED_UDP_TUN_FLAGS) {
484 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: loaded firmware does not support tunnel flag offload");
485 		return -EOPNOTSUPP;
486 	}
487 	set_tun->tun_flags = ip_tun->key.tun_flags;
488 
489 	if (tun_type == NFP_FL_TUNNEL_GENEVE) {
490 		set_tun->tun_proto = htons(ETH_P_TEB);
491 		set_tun->tun_len = ip_tun->options_len / 4;
492 	}
493 
494 	/* Complete pre_tunnel action. */
495 	if (ipv6) {
496 		pre_tun->flags |= cpu_to_be16(NFP_FL_PRE_TUN_IPV6);
497 		pre_tun->ipv6_dst = ip_tun->key.u.ipv6.dst;
498 	} else {
499 		pre_tun->ipv4_dst = ip_tun->key.u.ipv4.dst;
500 	}
501 
502 	return 0;
503 }
504 
505 static void nfp_fl_set_helper32(u32 value, u32 mask, u8 *p_exact, u8 *p_mask)
506 {
507 	u32 oldvalue = get_unaligned((u32 *)p_exact);
508 	u32 oldmask = get_unaligned((u32 *)p_mask);
509 
510 	value &= mask;
511 	value |= oldvalue & ~mask;
512 
513 	put_unaligned(oldmask | mask, (u32 *)p_mask);
514 	put_unaligned(value, (u32 *)p_exact);
515 }
516 
517 static int
518 nfp_fl_set_eth(const struct flow_action_entry *act, u32 off,
519 	       struct nfp_fl_set_eth *set_eth, struct netlink_ext_ack *extack)
520 {
521 	u32 exact, mask;
522 
523 	if (off + 4 > ETH_ALEN * 2) {
524 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: invalid pedit ethernet action");
525 		return -EOPNOTSUPP;
526 	}
527 
528 	mask = ~act->mangle.mask;
529 	exact = act->mangle.val;
530 
531 	if (exact & ~mask) {
532 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: invalid pedit ethernet action");
533 		return -EOPNOTSUPP;
534 	}
535 
536 	nfp_fl_set_helper32(exact, mask, &set_eth->eth_addr_val[off],
537 			    &set_eth->eth_addr_mask[off]);
538 
539 	set_eth->reserved = cpu_to_be16(0);
540 	set_eth->head.jump_id = NFP_FL_ACTION_OPCODE_SET_ETHERNET;
541 	set_eth->head.len_lw = sizeof(*set_eth) >> NFP_FL_LW_SIZ;
542 
543 	return 0;
544 }
545 
546 struct ipv4_ttl_word {
547 	__u8	ttl;
548 	__u8	protocol;
549 	__sum16	check;
550 };
551 
552 static int
553 nfp_fl_set_ip4(const struct flow_action_entry *act, u32 off,
554 	       struct nfp_fl_set_ip4_addrs *set_ip_addr,
555 	       struct nfp_fl_set_ip4_ttl_tos *set_ip_ttl_tos,
556 	       struct netlink_ext_ack *extack)
557 {
558 	struct ipv4_ttl_word *ttl_word_mask;
559 	struct ipv4_ttl_word *ttl_word;
560 	struct iphdr *tos_word_mask;
561 	struct iphdr *tos_word;
562 	__be32 exact, mask;
563 
564 	/* We are expecting tcf_pedit to return a big endian value */
565 	mask = (__force __be32)~act->mangle.mask;
566 	exact = (__force __be32)act->mangle.val;
567 
568 	if (exact & ~mask) {
569 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: invalid pedit IPv4 action");
570 		return -EOPNOTSUPP;
571 	}
572 
573 	switch (off) {
574 	case offsetof(struct iphdr, daddr):
575 		set_ip_addr->ipv4_dst_mask |= mask;
576 		set_ip_addr->ipv4_dst &= ~mask;
577 		set_ip_addr->ipv4_dst |= exact & mask;
578 		set_ip_addr->head.jump_id = NFP_FL_ACTION_OPCODE_SET_IPV4_ADDRS;
579 		set_ip_addr->head.len_lw = sizeof(*set_ip_addr) >>
580 					   NFP_FL_LW_SIZ;
581 		break;
582 	case offsetof(struct iphdr, saddr):
583 		set_ip_addr->ipv4_src_mask |= mask;
584 		set_ip_addr->ipv4_src &= ~mask;
585 		set_ip_addr->ipv4_src |= exact & mask;
586 		set_ip_addr->head.jump_id = NFP_FL_ACTION_OPCODE_SET_IPV4_ADDRS;
587 		set_ip_addr->head.len_lw = sizeof(*set_ip_addr) >>
588 					   NFP_FL_LW_SIZ;
589 		break;
590 	case offsetof(struct iphdr, ttl):
591 		ttl_word_mask = (struct ipv4_ttl_word *)&mask;
592 		ttl_word = (struct ipv4_ttl_word *)&exact;
593 
594 		if (ttl_word_mask->protocol || ttl_word_mask->check) {
595 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: invalid pedit IPv4 ttl action");
596 			return -EOPNOTSUPP;
597 		}
598 
599 		set_ip_ttl_tos->ipv4_ttl_mask |= ttl_word_mask->ttl;
600 		set_ip_ttl_tos->ipv4_ttl &= ~ttl_word_mask->ttl;
601 		set_ip_ttl_tos->ipv4_ttl |= ttl_word->ttl & ttl_word_mask->ttl;
602 		set_ip_ttl_tos->head.jump_id =
603 			NFP_FL_ACTION_OPCODE_SET_IPV4_TTL_TOS;
604 		set_ip_ttl_tos->head.len_lw = sizeof(*set_ip_ttl_tos) >>
605 					      NFP_FL_LW_SIZ;
606 		break;
607 	case round_down(offsetof(struct iphdr, tos), 4):
608 		tos_word_mask = (struct iphdr *)&mask;
609 		tos_word = (struct iphdr *)&exact;
610 
611 		if (tos_word_mask->version || tos_word_mask->ihl ||
612 		    tos_word_mask->tot_len) {
613 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: invalid pedit IPv4 tos action");
614 			return -EOPNOTSUPP;
615 		}
616 
617 		set_ip_ttl_tos->ipv4_tos_mask |= tos_word_mask->tos;
618 		set_ip_ttl_tos->ipv4_tos &= ~tos_word_mask->tos;
619 		set_ip_ttl_tos->ipv4_tos |= tos_word->tos & tos_word_mask->tos;
620 		set_ip_ttl_tos->head.jump_id =
621 			NFP_FL_ACTION_OPCODE_SET_IPV4_TTL_TOS;
622 		set_ip_ttl_tos->head.len_lw = sizeof(*set_ip_ttl_tos) >>
623 					      NFP_FL_LW_SIZ;
624 		break;
625 	default:
626 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: pedit on unsupported section of IPv4 header");
627 		return -EOPNOTSUPP;
628 	}
629 
630 	return 0;
631 }
632 
633 static void
634 nfp_fl_set_ip6_helper(int opcode_tag, u8 word, __be32 exact, __be32 mask,
635 		      struct nfp_fl_set_ipv6_addr *ip6)
636 {
637 	ip6->ipv6[word].mask |= mask;
638 	ip6->ipv6[word].exact &= ~mask;
639 	ip6->ipv6[word].exact |= exact & mask;
640 
641 	ip6->reserved = cpu_to_be16(0);
642 	ip6->head.jump_id = opcode_tag;
643 	ip6->head.len_lw = sizeof(*ip6) >> NFP_FL_LW_SIZ;
644 }
645 
646 struct ipv6_hop_limit_word {
647 	__be16 payload_len;
648 	u8 nexthdr;
649 	u8 hop_limit;
650 };
651 
652 static int
653 nfp_fl_set_ip6_hop_limit_flow_label(u32 off, __be32 exact, __be32 mask,
654 				    struct nfp_fl_set_ipv6_tc_hl_fl *ip_hl_fl,
655 				    struct netlink_ext_ack *extack)
656 {
657 	struct ipv6_hop_limit_word *fl_hl_mask;
658 	struct ipv6_hop_limit_word *fl_hl;
659 
660 	switch (off) {
661 	case offsetof(struct ipv6hdr, payload_len):
662 		fl_hl_mask = (struct ipv6_hop_limit_word *)&mask;
663 		fl_hl = (struct ipv6_hop_limit_word *)&exact;
664 
665 		if (fl_hl_mask->nexthdr || fl_hl_mask->payload_len) {
666 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: invalid pedit IPv6 hop limit action");
667 			return -EOPNOTSUPP;
668 		}
669 
670 		ip_hl_fl->ipv6_hop_limit_mask |= fl_hl_mask->hop_limit;
671 		ip_hl_fl->ipv6_hop_limit &= ~fl_hl_mask->hop_limit;
672 		ip_hl_fl->ipv6_hop_limit |= fl_hl->hop_limit &
673 					    fl_hl_mask->hop_limit;
674 		break;
675 	case round_down(offsetof(struct ipv6hdr, flow_lbl), 4):
676 		if (mask & ~IPV6_FLOW_LABEL_MASK ||
677 		    exact & ~IPV6_FLOW_LABEL_MASK) {
678 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: invalid pedit IPv6 flow label action");
679 			return -EOPNOTSUPP;
680 		}
681 
682 		ip_hl_fl->ipv6_label_mask |= mask;
683 		ip_hl_fl->ipv6_label &= ~mask;
684 		ip_hl_fl->ipv6_label |= exact & mask;
685 		break;
686 	}
687 
688 	ip_hl_fl->head.jump_id = NFP_FL_ACTION_OPCODE_SET_IPV6_TC_HL_FL;
689 	ip_hl_fl->head.len_lw = sizeof(*ip_hl_fl) >> NFP_FL_LW_SIZ;
690 
691 	return 0;
692 }
693 
694 static int
695 nfp_fl_set_ip6(const struct flow_action_entry *act, u32 off,
696 	       struct nfp_fl_set_ipv6_addr *ip_dst,
697 	       struct nfp_fl_set_ipv6_addr *ip_src,
698 	       struct nfp_fl_set_ipv6_tc_hl_fl *ip_hl_fl,
699 	       struct netlink_ext_ack *extack)
700 {
701 	__be32 exact, mask;
702 	int err = 0;
703 	u8 word;
704 
705 	/* We are expecting tcf_pedit to return a big endian value */
706 	mask = (__force __be32)~act->mangle.mask;
707 	exact = (__force __be32)act->mangle.val;
708 
709 	if (exact & ~mask) {
710 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: invalid pedit IPv6 action");
711 		return -EOPNOTSUPP;
712 	}
713 
714 	if (off < offsetof(struct ipv6hdr, saddr)) {
715 		err = nfp_fl_set_ip6_hop_limit_flow_label(off, exact, mask,
716 							  ip_hl_fl, extack);
717 	} else if (off < offsetof(struct ipv6hdr, daddr)) {
718 		word = (off - offsetof(struct ipv6hdr, saddr)) / sizeof(exact);
719 		nfp_fl_set_ip6_helper(NFP_FL_ACTION_OPCODE_SET_IPV6_SRC, word,
720 				      exact, mask, ip_src);
721 	} else if (off < offsetof(struct ipv6hdr, daddr) +
722 		       sizeof(struct in6_addr)) {
723 		word = (off - offsetof(struct ipv6hdr, daddr)) / sizeof(exact);
724 		nfp_fl_set_ip6_helper(NFP_FL_ACTION_OPCODE_SET_IPV6_DST, word,
725 				      exact, mask, ip_dst);
726 	} else {
727 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: pedit on unsupported section of IPv6 header");
728 		return -EOPNOTSUPP;
729 	}
730 
731 	return err;
732 }
733 
734 static int
735 nfp_fl_set_tport(const struct flow_action_entry *act, u32 off,
736 		 struct nfp_fl_set_tport *set_tport, int opcode,
737 		 struct netlink_ext_ack *extack)
738 {
739 	u32 exact, mask;
740 
741 	if (off) {
742 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: pedit on unsupported section of L4 header");
743 		return -EOPNOTSUPP;
744 	}
745 
746 	mask = ~act->mangle.mask;
747 	exact = act->mangle.val;
748 
749 	if (exact & ~mask) {
750 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: invalid pedit L4 action");
751 		return -EOPNOTSUPP;
752 	}
753 
754 	nfp_fl_set_helper32(exact, mask, set_tport->tp_port_val,
755 			    set_tport->tp_port_mask);
756 
757 	set_tport->reserved = cpu_to_be16(0);
758 	set_tport->head.jump_id = opcode;
759 	set_tport->head.len_lw = sizeof(*set_tport) >> NFP_FL_LW_SIZ;
760 
761 	return 0;
762 }
763 
764 static u32 nfp_fl_csum_l4_to_flag(u8 ip_proto)
765 {
766 	switch (ip_proto) {
767 	case 0:
768 		/* Filter doesn't force proto match,
769 		 * both TCP and UDP will be updated if encountered
770 		 */
771 		return TCA_CSUM_UPDATE_FLAG_TCP | TCA_CSUM_UPDATE_FLAG_UDP;
772 	case IPPROTO_TCP:
773 		return TCA_CSUM_UPDATE_FLAG_TCP;
774 	case IPPROTO_UDP:
775 		return TCA_CSUM_UPDATE_FLAG_UDP;
776 	default:
777 		/* All other protocols will be ignored by FW */
778 		return 0;
779 	}
780 }
781 
782 struct nfp_flower_pedit_acts {
783 	struct nfp_fl_set_ipv6_addr set_ip6_dst, set_ip6_src;
784 	struct nfp_fl_set_ipv6_tc_hl_fl set_ip6_tc_hl_fl;
785 	struct nfp_fl_set_ip4_ttl_tos set_ip_ttl_tos;
786 	struct nfp_fl_set_ip4_addrs set_ip_addr;
787 	struct nfp_fl_set_tport set_tport;
788 	struct nfp_fl_set_eth set_eth;
789 };
790 
791 static int
792 nfp_fl_commit_mangle(struct flow_rule *rule, char *nfp_action,
793 		     int *a_len, struct nfp_flower_pedit_acts *set_act,
794 		     u32 *csum_updated)
795 {
796 	size_t act_size = 0;
797 	u8 ip_proto = 0;
798 
799 	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) {
800 		struct flow_match_basic match;
801 
802 		flow_rule_match_basic(rule, &match);
803 		ip_proto = match.key->ip_proto;
804 	}
805 
806 	if (set_act->set_eth.head.len_lw) {
807 		act_size = sizeof(set_act->set_eth);
808 		memcpy(nfp_action, &set_act->set_eth, act_size);
809 		*a_len += act_size;
810 	}
811 
812 	if (set_act->set_ip_ttl_tos.head.len_lw) {
813 		nfp_action += act_size;
814 		act_size = sizeof(set_act->set_ip_ttl_tos);
815 		memcpy(nfp_action, &set_act->set_ip_ttl_tos, act_size);
816 		*a_len += act_size;
817 
818 		/* Hardware will automatically fix IPv4 and TCP/UDP checksum. */
819 		*csum_updated |= TCA_CSUM_UPDATE_FLAG_IPV4HDR |
820 				nfp_fl_csum_l4_to_flag(ip_proto);
821 	}
822 
823 	if (set_act->set_ip_addr.head.len_lw) {
824 		nfp_action += act_size;
825 		act_size = sizeof(set_act->set_ip_addr);
826 		memcpy(nfp_action, &set_act->set_ip_addr, act_size);
827 		*a_len += act_size;
828 
829 		/* Hardware will automatically fix IPv4 and TCP/UDP checksum. */
830 		*csum_updated |= TCA_CSUM_UPDATE_FLAG_IPV4HDR |
831 				nfp_fl_csum_l4_to_flag(ip_proto);
832 	}
833 
834 	if (set_act->set_ip6_tc_hl_fl.head.len_lw) {
835 		nfp_action += act_size;
836 		act_size = sizeof(set_act->set_ip6_tc_hl_fl);
837 		memcpy(nfp_action, &set_act->set_ip6_tc_hl_fl, act_size);
838 		*a_len += act_size;
839 
840 		/* Hardware will automatically fix TCP/UDP checksum. */
841 		*csum_updated |= nfp_fl_csum_l4_to_flag(ip_proto);
842 	}
843 
844 	if (set_act->set_ip6_dst.head.len_lw &&
845 	    set_act->set_ip6_src.head.len_lw) {
846 		/* TC compiles set src and dst IPv6 address as a single action,
847 		 * the hardware requires this to be 2 separate actions.
848 		 */
849 		nfp_action += act_size;
850 		act_size = sizeof(set_act->set_ip6_src);
851 		memcpy(nfp_action, &set_act->set_ip6_src, act_size);
852 		*a_len += act_size;
853 
854 		act_size = sizeof(set_act->set_ip6_dst);
855 		memcpy(&nfp_action[sizeof(set_act->set_ip6_src)],
856 		       &set_act->set_ip6_dst, act_size);
857 		*a_len += act_size;
858 
859 		/* Hardware will automatically fix TCP/UDP checksum. */
860 		*csum_updated |= nfp_fl_csum_l4_to_flag(ip_proto);
861 	} else if (set_act->set_ip6_dst.head.len_lw) {
862 		nfp_action += act_size;
863 		act_size = sizeof(set_act->set_ip6_dst);
864 		memcpy(nfp_action, &set_act->set_ip6_dst, act_size);
865 		*a_len += act_size;
866 
867 		/* Hardware will automatically fix TCP/UDP checksum. */
868 		*csum_updated |= nfp_fl_csum_l4_to_flag(ip_proto);
869 	} else if (set_act->set_ip6_src.head.len_lw) {
870 		nfp_action += act_size;
871 		act_size = sizeof(set_act->set_ip6_src);
872 		memcpy(nfp_action, &set_act->set_ip6_src, act_size);
873 		*a_len += act_size;
874 
875 		/* Hardware will automatically fix TCP/UDP checksum. */
876 		*csum_updated |= nfp_fl_csum_l4_to_flag(ip_proto);
877 	}
878 	if (set_act->set_tport.head.len_lw) {
879 		nfp_action += act_size;
880 		act_size = sizeof(set_act->set_tport);
881 		memcpy(nfp_action, &set_act->set_tport, act_size);
882 		*a_len += act_size;
883 
884 		/* Hardware will automatically fix TCP/UDP checksum. */
885 		*csum_updated |= nfp_fl_csum_l4_to_flag(ip_proto);
886 	}
887 
888 	return 0;
889 }
890 
891 static int
892 nfp_fl_pedit(const struct flow_action_entry *act,
893 	     char *nfp_action, int *a_len,
894 	     u32 *csum_updated, struct nfp_flower_pedit_acts *set_act,
895 	     struct netlink_ext_ack *extack)
896 {
897 	enum flow_action_mangle_base htype;
898 	u32 offset;
899 
900 	htype = act->mangle.htype;
901 	offset = act->mangle.offset;
902 
903 	switch (htype) {
904 	case TCA_PEDIT_KEY_EX_HDR_TYPE_ETH:
905 		return nfp_fl_set_eth(act, offset, &set_act->set_eth, extack);
906 	case TCA_PEDIT_KEY_EX_HDR_TYPE_IP4:
907 		return nfp_fl_set_ip4(act, offset, &set_act->set_ip_addr,
908 				      &set_act->set_ip_ttl_tos, extack);
909 	case TCA_PEDIT_KEY_EX_HDR_TYPE_IP6:
910 		return nfp_fl_set_ip6(act, offset, &set_act->set_ip6_dst,
911 				      &set_act->set_ip6_src,
912 				      &set_act->set_ip6_tc_hl_fl, extack);
913 	case TCA_PEDIT_KEY_EX_HDR_TYPE_TCP:
914 		return nfp_fl_set_tport(act, offset, &set_act->set_tport,
915 					NFP_FL_ACTION_OPCODE_SET_TCP, extack);
916 	case TCA_PEDIT_KEY_EX_HDR_TYPE_UDP:
917 		return nfp_fl_set_tport(act, offset, &set_act->set_tport,
918 					NFP_FL_ACTION_OPCODE_SET_UDP, extack);
919 	default:
920 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: pedit on unsupported header");
921 		return -EOPNOTSUPP;
922 	}
923 }
924 
925 static int
926 nfp_flower_output_action(struct nfp_app *app,
927 			 const struct flow_action_entry *act,
928 			 struct nfp_fl_payload *nfp_fl, int *a_len,
929 			 struct net_device *netdev, bool last,
930 			 enum nfp_flower_tun_type *tun_type, int *tun_out_cnt,
931 			 int *out_cnt, u32 *csum_updated, bool pkt_host,
932 			 struct netlink_ext_ack *extack)
933 {
934 	struct nfp_flower_priv *priv = app->priv;
935 	struct nfp_fl_output *output;
936 	int err, prelag_size;
937 
938 	/* If csum_updated has not been reset by now, it means HW will
939 	 * incorrectly update csums when they are not requested.
940 	 */
941 	if (*csum_updated) {
942 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: set actions without updating checksums are not supported");
943 		return -EOPNOTSUPP;
944 	}
945 
946 	if (*a_len + sizeof(struct nfp_fl_output) > NFP_FL_MAX_A_SIZ) {
947 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: mirred output increases action list size beyond the allowed maximum");
948 		return -EOPNOTSUPP;
949 	}
950 
951 	output = (struct nfp_fl_output *)&nfp_fl->action_data[*a_len];
952 	err = nfp_fl_output(app, output, act, nfp_fl, last, netdev, *tun_type,
953 			    tun_out_cnt, pkt_host, extack);
954 	if (err)
955 		return err;
956 
957 	*a_len += sizeof(struct nfp_fl_output);
958 
959 	if (priv->flower_en_feats & NFP_FL_ENABLE_LAG) {
960 		/* nfp_fl_pre_lag returns -err or size of prelag action added.
961 		 * This will be 0 if it is not egressing to a lag dev.
962 		 */
963 		prelag_size = nfp_fl_pre_lag(app, act, nfp_fl, *a_len, extack);
964 		if (prelag_size < 0) {
965 			return prelag_size;
966 		} else if (prelag_size > 0 && (!last || *out_cnt)) {
967 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: LAG action has to be last action in action list");
968 			return -EOPNOTSUPP;
969 		}
970 
971 		*a_len += prelag_size;
972 	}
973 	(*out_cnt)++;
974 
975 	return 0;
976 }
977 
978 static int
979 nfp_flower_loop_action(struct nfp_app *app, const struct flow_action_entry *act,
980 		       struct flow_rule *rule,
981 		       struct nfp_fl_payload *nfp_fl, int *a_len,
982 		       struct net_device *netdev,
983 		       enum nfp_flower_tun_type *tun_type, int *tun_out_cnt,
984 		       int *out_cnt, u32 *csum_updated,
985 		       struct nfp_flower_pedit_acts *set_act, bool *pkt_host,
986 		       struct netlink_ext_ack *extack, int act_idx)
987 {
988 	struct nfp_fl_pre_tunnel *pre_tun;
989 	struct nfp_fl_set_tun *set_tun;
990 	struct nfp_fl_push_vlan *psh_v;
991 	struct nfp_fl_push_mpls *psh_m;
992 	struct nfp_fl_pop_vlan *pop_v;
993 	struct nfp_fl_pop_mpls *pop_m;
994 	struct nfp_fl_set_mpls *set_m;
995 	int err;
996 
997 	switch (act->id) {
998 	case FLOW_ACTION_DROP:
999 		nfp_fl->meta.shortcut = cpu_to_be32(NFP_FL_SC_ACT_DROP);
1000 		break;
1001 	case FLOW_ACTION_REDIRECT_INGRESS:
1002 	case FLOW_ACTION_REDIRECT:
1003 		err = nfp_flower_output_action(app, act, nfp_fl, a_len, netdev,
1004 					       true, tun_type, tun_out_cnt,
1005 					       out_cnt, csum_updated, *pkt_host,
1006 					       extack);
1007 		if (err)
1008 			return err;
1009 		break;
1010 	case FLOW_ACTION_MIRRED_INGRESS:
1011 	case FLOW_ACTION_MIRRED:
1012 		err = nfp_flower_output_action(app, act, nfp_fl, a_len, netdev,
1013 					       false, tun_type, tun_out_cnt,
1014 					       out_cnt, csum_updated, *pkt_host,
1015 					       extack);
1016 		if (err)
1017 			return err;
1018 		break;
1019 	case FLOW_ACTION_VLAN_POP:
1020 		if (*a_len +
1021 		    sizeof(struct nfp_fl_pop_vlan) > NFP_FL_MAX_A_SIZ) {
1022 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: maximum allowed action list size exceeded at pop vlan");
1023 			return -EOPNOTSUPP;
1024 		}
1025 
1026 		pop_v = (struct nfp_fl_pop_vlan *)&nfp_fl->action_data[*a_len];
1027 		nfp_fl->meta.shortcut = cpu_to_be32(NFP_FL_SC_ACT_POPV);
1028 
1029 		nfp_fl_pop_vlan(pop_v);
1030 		*a_len += sizeof(struct nfp_fl_pop_vlan);
1031 		break;
1032 	case FLOW_ACTION_VLAN_PUSH:
1033 		if (*a_len +
1034 		    sizeof(struct nfp_fl_push_vlan) > NFP_FL_MAX_A_SIZ) {
1035 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: maximum allowed action list size exceeded at push vlan");
1036 			return -EOPNOTSUPP;
1037 		}
1038 
1039 		psh_v = (struct nfp_fl_push_vlan *)&nfp_fl->action_data[*a_len];
1040 		nfp_fl->meta.shortcut = cpu_to_be32(NFP_FL_SC_ACT_NULL);
1041 
1042 		nfp_fl_push_vlan(psh_v, act);
1043 		*a_len += sizeof(struct nfp_fl_push_vlan);
1044 		break;
1045 	case FLOW_ACTION_TUNNEL_ENCAP: {
1046 		const struct ip_tunnel_info *ip_tun = act->tunnel;
1047 
1048 		*tun_type = nfp_fl_get_tun_from_act(app, rule, act, act_idx);
1049 		if (*tun_type == NFP_FL_TUNNEL_NONE) {
1050 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: unsupported tunnel type in action list");
1051 			return -EOPNOTSUPP;
1052 		}
1053 
1054 		if (ip_tun->mode & ~NFP_FL_SUPPORTED_TUNNEL_INFO_FLAGS) {
1055 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: unsupported tunnel flags in action list");
1056 			return -EOPNOTSUPP;
1057 		}
1058 
1059 		/* Pre-tunnel action is required for tunnel encap.
1060 		 * This checks for next hop entries on NFP.
1061 		 * If none, the packet falls back before applying other actions.
1062 		 */
1063 		if (*a_len + sizeof(struct nfp_fl_pre_tunnel) +
1064 		    sizeof(struct nfp_fl_set_tun) > NFP_FL_MAX_A_SIZ) {
1065 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: maximum allowed action list size exceeded at tunnel encap");
1066 			return -EOPNOTSUPP;
1067 		}
1068 
1069 		pre_tun = nfp_fl_pre_tunnel(nfp_fl->action_data, *a_len);
1070 		nfp_fl->meta.shortcut = cpu_to_be32(NFP_FL_SC_ACT_NULL);
1071 		*a_len += sizeof(struct nfp_fl_pre_tunnel);
1072 
1073 		err = nfp_fl_push_geneve_options(nfp_fl, a_len, act, extack);
1074 		if (err)
1075 			return err;
1076 
1077 		set_tun = (void *)&nfp_fl->action_data[*a_len];
1078 		err = nfp_fl_set_tun(app, set_tun, act, pre_tun, *tun_type,
1079 				     netdev, extack);
1080 		if (err)
1081 			return err;
1082 		*a_len += sizeof(struct nfp_fl_set_tun);
1083 		}
1084 		break;
1085 	case FLOW_ACTION_TUNNEL_DECAP:
1086 		/* Tunnel decap is handled by default so accept action. */
1087 		return 0;
1088 	case FLOW_ACTION_MANGLE:
1089 		if (nfp_fl_pedit(act, &nfp_fl->action_data[*a_len],
1090 				 a_len, csum_updated, set_act, extack))
1091 			return -EOPNOTSUPP;
1092 		break;
1093 	case FLOW_ACTION_CSUM:
1094 		/* csum action requests recalc of something we have not fixed */
1095 		if (act->csum_flags & ~*csum_updated) {
1096 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: unsupported csum update action in action list");
1097 			return -EOPNOTSUPP;
1098 		}
1099 		/* If we will correctly fix the csum we can remove it from the
1100 		 * csum update list. Which will later be used to check support.
1101 		 */
1102 		*csum_updated &= ~act->csum_flags;
1103 		break;
1104 	case FLOW_ACTION_MPLS_PUSH:
1105 		if (*a_len +
1106 		    sizeof(struct nfp_fl_push_mpls) > NFP_FL_MAX_A_SIZ) {
1107 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: maximum allowed action list size exceeded at push MPLS");
1108 			return -EOPNOTSUPP;
1109 		}
1110 
1111 		psh_m = (struct nfp_fl_push_mpls *)&nfp_fl->action_data[*a_len];
1112 		nfp_fl->meta.shortcut = cpu_to_be32(NFP_FL_SC_ACT_NULL);
1113 
1114 		err = nfp_fl_push_mpls(psh_m, act, extack);
1115 		if (err)
1116 			return err;
1117 		*a_len += sizeof(struct nfp_fl_push_mpls);
1118 		break;
1119 	case FLOW_ACTION_MPLS_POP:
1120 		if (*a_len +
1121 		    sizeof(struct nfp_fl_pop_mpls) > NFP_FL_MAX_A_SIZ) {
1122 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: maximum allowed action list size exceeded at pop MPLS");
1123 			return -EOPNOTSUPP;
1124 		}
1125 
1126 		pop_m = (struct nfp_fl_pop_mpls *)&nfp_fl->action_data[*a_len];
1127 		nfp_fl->meta.shortcut = cpu_to_be32(NFP_FL_SC_ACT_NULL);
1128 
1129 		nfp_fl_pop_mpls(pop_m, act);
1130 		*a_len += sizeof(struct nfp_fl_pop_mpls);
1131 		break;
1132 	case FLOW_ACTION_MPLS_MANGLE:
1133 		if (*a_len +
1134 		    sizeof(struct nfp_fl_set_mpls) > NFP_FL_MAX_A_SIZ) {
1135 			NL_SET_ERR_MSG_MOD(extack, "unsupported offload: maximum allowed action list size exceeded at set MPLS");
1136 			return -EOPNOTSUPP;
1137 		}
1138 
1139 		set_m = (struct nfp_fl_set_mpls *)&nfp_fl->action_data[*a_len];
1140 		nfp_fl->meta.shortcut = cpu_to_be32(NFP_FL_SC_ACT_NULL);
1141 
1142 		nfp_fl_set_mpls(set_m, act);
1143 		*a_len += sizeof(struct nfp_fl_set_mpls);
1144 		break;
1145 	case FLOW_ACTION_PTYPE:
1146 		/* TC ptype skbedit sets PACKET_HOST for ingress redirect. */
1147 		if (act->ptype != PACKET_HOST)
1148 			return -EOPNOTSUPP;
1149 
1150 		*pkt_host = true;
1151 		break;
1152 	default:
1153 		/* Currently we do not handle any other actions. */
1154 		NL_SET_ERR_MSG_MOD(extack, "unsupported offload: unsupported action in action list");
1155 		return -EOPNOTSUPP;
1156 	}
1157 
1158 	return 0;
1159 }
1160 
1161 static bool nfp_fl_check_mangle_start(struct flow_action *flow_act,
1162 				      int current_act_idx)
1163 {
1164 	struct flow_action_entry current_act;
1165 	struct flow_action_entry prev_act;
1166 
1167 	current_act = flow_act->entries[current_act_idx];
1168 	if (current_act.id != FLOW_ACTION_MANGLE)
1169 		return false;
1170 
1171 	if (current_act_idx == 0)
1172 		return true;
1173 
1174 	prev_act = flow_act->entries[current_act_idx - 1];
1175 
1176 	return prev_act.id != FLOW_ACTION_MANGLE;
1177 }
1178 
1179 static bool nfp_fl_check_mangle_end(struct flow_action *flow_act,
1180 				    int current_act_idx)
1181 {
1182 	struct flow_action_entry current_act;
1183 	struct flow_action_entry next_act;
1184 
1185 	current_act = flow_act->entries[current_act_idx];
1186 	if (current_act.id != FLOW_ACTION_MANGLE)
1187 		return false;
1188 
1189 	if (current_act_idx == flow_act->num_entries)
1190 		return true;
1191 
1192 	next_act = flow_act->entries[current_act_idx + 1];
1193 
1194 	return next_act.id != FLOW_ACTION_MANGLE;
1195 }
1196 
1197 int nfp_flower_compile_action(struct nfp_app *app,
1198 			      struct flow_rule *rule,
1199 			      struct net_device *netdev,
1200 			      struct nfp_fl_payload *nfp_flow,
1201 			      struct netlink_ext_ack *extack)
1202 {
1203 	int act_len, act_cnt, err, tun_out_cnt, out_cnt, i;
1204 	struct nfp_flower_pedit_acts set_act;
1205 	enum nfp_flower_tun_type tun_type;
1206 	struct flow_action_entry *act;
1207 	bool pkt_host = false;
1208 	u32 csum_updated = 0;
1209 
1210 	if (!flow_action_hw_stats_check(&rule->action, extack,
1211 					FLOW_ACTION_HW_STATS_DELAYED_BIT))
1212 		return -EOPNOTSUPP;
1213 
1214 	memset(nfp_flow->action_data, 0, NFP_FL_MAX_A_SIZ);
1215 	nfp_flow->meta.act_len = 0;
1216 	tun_type = NFP_FL_TUNNEL_NONE;
1217 	act_len = 0;
1218 	act_cnt = 0;
1219 	tun_out_cnt = 0;
1220 	out_cnt = 0;
1221 
1222 	flow_action_for_each(i, act, &rule->action) {
1223 		if (nfp_fl_check_mangle_start(&rule->action, i))
1224 			memset(&set_act, 0, sizeof(set_act));
1225 		err = nfp_flower_loop_action(app, act, rule, nfp_flow, &act_len,
1226 					     netdev, &tun_type, &tun_out_cnt,
1227 					     &out_cnt, &csum_updated,
1228 					     &set_act, &pkt_host, extack, i);
1229 		if (err)
1230 			return err;
1231 		act_cnt++;
1232 		if (nfp_fl_check_mangle_end(&rule->action, i))
1233 			nfp_fl_commit_mangle(rule,
1234 					     &nfp_flow->action_data[act_len],
1235 					     &act_len, &set_act, &csum_updated);
1236 	}
1237 
1238 	/* We optimise when the action list is small, this can unfortunately
1239 	 * not happen once we have more than one action in the action list.
1240 	 */
1241 	if (act_cnt > 1)
1242 		nfp_flow->meta.shortcut = cpu_to_be32(NFP_FL_SC_ACT_NULL);
1243 
1244 	nfp_flow->meta.act_len = act_len;
1245 
1246 	return 0;
1247 }
1248