1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0 2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */ 3 4 #include <linux/kernel.h> 5 #include <linux/errno.h> 6 #include <linux/netdevice.h> 7 #include <linux/log2.h> 8 #include <net/net_namespace.h> 9 #include <net/flow_dissector.h> 10 #include <net/pkt_cls.h> 11 #include <net/tc_act/tc_gact.h> 12 #include <net/tc_act/tc_mirred.h> 13 #include <net/tc_act/tc_vlan.h> 14 15 #include "spectrum.h" 16 #include "core_acl_flex_keys.h" 17 18 static int mlxsw_sp_policer_validate(const struct flow_action *action, 19 const struct flow_action_entry *act, 20 struct netlink_ext_ack *extack) 21 { 22 if (act->police.exceed.act_id != FLOW_ACTION_DROP) { 23 NL_SET_ERR_MSG_MOD(extack, 24 "Offload not supported when exceed action is not drop"); 25 return -EOPNOTSUPP; 26 } 27 28 if (act->police.notexceed.act_id != FLOW_ACTION_PIPE && 29 act->police.notexceed.act_id != FLOW_ACTION_ACCEPT) { 30 NL_SET_ERR_MSG_MOD(extack, 31 "Offload not supported when conform action is not pipe or ok"); 32 return -EOPNOTSUPP; 33 } 34 35 if (act->police.notexceed.act_id == FLOW_ACTION_ACCEPT && 36 !flow_action_is_last_entry(action, act)) { 37 NL_SET_ERR_MSG_MOD(extack, 38 "Offload not supported when conform action is ok, but action is not last"); 39 return -EOPNOTSUPP; 40 } 41 42 if (act->police.peakrate_bytes_ps || 43 act->police.avrate || act->police.overhead) { 44 NL_SET_ERR_MSG_MOD(extack, 45 "Offload not supported when peakrate/avrate/overhead is configured"); 46 return -EOPNOTSUPP; 47 } 48 49 if (act->police.rate_pkt_ps) { 50 NL_SET_ERR_MSG_MOD(extack, 51 "QoS offload not support packets per second"); 52 return -EOPNOTSUPP; 53 } 54 55 return 0; 56 } 57 58 static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp, 59 struct mlxsw_sp_flow_block *block, 60 struct mlxsw_sp_acl_rule_info *rulei, 61 struct flow_action *flow_action, 62 struct netlink_ext_ack *extack) 63 { 64 const struct flow_action_entry *act; 65 int mirror_act_count = 0; 66 int police_act_count = 0; 67 int sample_act_count = 0; 68 int err, i; 69 70 if (!flow_action_has_entries(flow_action)) 71 return 0; 72 if (!flow_action_mixed_hw_stats_check(flow_action, extack)) 73 return -EOPNOTSUPP; 74 75 act = flow_action_first_entry_get(flow_action); 76 if (act->hw_stats & FLOW_ACTION_HW_STATS_DISABLED) { 77 /* Nothing to do */ 78 } else if (act->hw_stats & FLOW_ACTION_HW_STATS_IMMEDIATE) { 79 /* Count action is inserted first */ 80 err = mlxsw_sp_acl_rulei_act_count(mlxsw_sp, rulei, extack); 81 if (err) 82 return err; 83 } else { 84 NL_SET_ERR_MSG_MOD(extack, "Unsupported action HW stats type"); 85 return -EOPNOTSUPP; 86 } 87 88 flow_action_for_each(i, act, flow_action) { 89 switch (act->id) { 90 case FLOW_ACTION_ACCEPT: 91 err = mlxsw_sp_acl_rulei_act_terminate(rulei); 92 if (err) { 93 NL_SET_ERR_MSG_MOD(extack, "Cannot append terminate action"); 94 return err; 95 } 96 break; 97 case FLOW_ACTION_DROP: { 98 bool ingress; 99 100 if (mlxsw_sp_flow_block_is_mixed_bound(block)) { 101 NL_SET_ERR_MSG_MOD(extack, "Drop action is not supported when block is bound to ingress and egress"); 102 return -EOPNOTSUPP; 103 } 104 ingress = mlxsw_sp_flow_block_is_ingress_bound(block); 105 err = mlxsw_sp_acl_rulei_act_drop(rulei, ingress, 106 act->user_cookie, extack); 107 if (err) { 108 NL_SET_ERR_MSG_MOD(extack, "Cannot append drop action"); 109 return err; 110 } 111 112 /* Forbid block with this rulei to be bound 113 * to ingress/egress in future. Ingress rule is 114 * a blocker for egress and vice versa. 115 */ 116 if (ingress) 117 rulei->egress_bind_blocker = 1; 118 else 119 rulei->ingress_bind_blocker = 1; 120 } 121 break; 122 case FLOW_ACTION_TRAP: 123 err = mlxsw_sp_acl_rulei_act_trap(rulei); 124 if (err) { 125 NL_SET_ERR_MSG_MOD(extack, "Cannot append trap action"); 126 return err; 127 } 128 break; 129 case FLOW_ACTION_GOTO: { 130 u32 chain_index = act->chain_index; 131 struct mlxsw_sp_acl_ruleset *ruleset; 132 u16 group_id; 133 134 ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block, 135 chain_index, 136 MLXSW_SP_ACL_PROFILE_FLOWER); 137 if (IS_ERR(ruleset)) 138 return PTR_ERR(ruleset); 139 140 group_id = mlxsw_sp_acl_ruleset_group_id(ruleset); 141 err = mlxsw_sp_acl_rulei_act_jump(rulei, group_id); 142 if (err) { 143 NL_SET_ERR_MSG_MOD(extack, "Cannot append jump action"); 144 return err; 145 } 146 } 147 break; 148 case FLOW_ACTION_REDIRECT: { 149 struct net_device *out_dev; 150 struct mlxsw_sp_fid *fid; 151 u16 fid_index; 152 153 if (mlxsw_sp_flow_block_is_egress_bound(block)) { 154 NL_SET_ERR_MSG_MOD(extack, "Redirect action is not supported on egress"); 155 return -EOPNOTSUPP; 156 } 157 158 /* Forbid block with this rulei to be bound 159 * to egress in future. 160 */ 161 rulei->egress_bind_blocker = 1; 162 163 /* Ignore learning and security lookup as redirection 164 * using ingress filters happens before the bridge. 165 */ 166 err = mlxsw_sp_acl_rulei_act_ignore(mlxsw_sp, rulei, 167 true, true); 168 if (err) { 169 NL_SET_ERR_MSG_MOD(extack, "Cannot append ignore action"); 170 return err; 171 } 172 173 fid = mlxsw_sp_acl_dummy_fid(mlxsw_sp); 174 fid_index = mlxsw_sp_fid_index(fid); 175 err = mlxsw_sp_acl_rulei_act_fid_set(mlxsw_sp, rulei, 176 fid_index, extack); 177 if (err) 178 return err; 179 180 out_dev = act->dev; 181 err = mlxsw_sp_acl_rulei_act_fwd(mlxsw_sp, rulei, 182 out_dev, extack); 183 if (err) 184 return err; 185 } 186 break; 187 case FLOW_ACTION_MIRRED: { 188 struct net_device *out_dev = act->dev; 189 190 if (mirror_act_count++) { 191 NL_SET_ERR_MSG_MOD(extack, "Multiple mirror actions per rule are not supported"); 192 return -EOPNOTSUPP; 193 } 194 195 if (sample_act_count) { 196 NL_SET_ERR_MSG_MOD(extack, "Mirror action after sample action is not supported"); 197 return -EOPNOTSUPP; 198 } 199 200 err = mlxsw_sp_acl_rulei_act_mirror(mlxsw_sp, rulei, 201 block, out_dev, 202 extack); 203 if (err) 204 return err; 205 } 206 break; 207 case FLOW_ACTION_VLAN_MANGLE: { 208 u16 proto = be16_to_cpu(act->vlan.proto); 209 u8 prio = act->vlan.prio; 210 u16 vid = act->vlan.vid; 211 212 err = mlxsw_sp_acl_rulei_act_vlan(mlxsw_sp, rulei, 213 act->id, vid, 214 proto, prio, extack); 215 if (err) 216 return err; 217 break; 218 } 219 case FLOW_ACTION_PRIORITY: 220 err = mlxsw_sp_acl_rulei_act_priority(mlxsw_sp, rulei, 221 act->priority, 222 extack); 223 if (err) 224 return err; 225 break; 226 case FLOW_ACTION_MANGLE: { 227 enum flow_action_mangle_base htype = act->mangle.htype; 228 __be32 be_mask = (__force __be32) act->mangle.mask; 229 __be32 be_val = (__force __be32) act->mangle.val; 230 u32 offset = act->mangle.offset; 231 u32 mask = be32_to_cpu(be_mask); 232 u32 val = be32_to_cpu(be_val); 233 234 err = mlxsw_sp_acl_rulei_act_mangle(mlxsw_sp, rulei, 235 htype, offset, 236 mask, val, extack); 237 if (err) 238 return err; 239 break; 240 } 241 case FLOW_ACTION_POLICE: { 242 u32 burst; 243 244 if (police_act_count++) { 245 NL_SET_ERR_MSG_MOD(extack, "Multiple police actions per rule are not supported"); 246 return -EOPNOTSUPP; 247 } 248 249 err = mlxsw_sp_policer_validate(flow_action, act, extack); 250 if (err) 251 return err; 252 253 /* The kernel might adjust the requested burst size so 254 * that it is not exactly a power of two. Re-adjust it 255 * here since the hardware only supports burst sizes 256 * that are a power of two. 257 */ 258 burst = roundup_pow_of_two(act->police.burst); 259 err = mlxsw_sp_acl_rulei_act_police(mlxsw_sp, rulei, 260 act->hw_index, 261 act->police.rate_bytes_ps, 262 burst, extack); 263 if (err) 264 return err; 265 break; 266 } 267 case FLOW_ACTION_SAMPLE: { 268 if (sample_act_count++) { 269 NL_SET_ERR_MSG_MOD(extack, "Multiple sample actions per rule are not supported"); 270 return -EOPNOTSUPP; 271 } 272 273 if (mirror_act_count) { 274 NL_SET_ERR_MSG_MOD(extack, "Sample action after mirror action is not supported"); 275 return -EOPNOTSUPP; 276 } 277 278 err = mlxsw_sp_acl_rulei_act_sample(mlxsw_sp, rulei, 279 block, 280 act->sample.psample_group, 281 act->sample.rate, 282 act->sample.trunc_size, 283 act->sample.truncate, 284 extack); 285 if (err) 286 return err; 287 break; 288 } 289 default: 290 NL_SET_ERR_MSG_MOD(extack, "Unsupported action"); 291 dev_err(mlxsw_sp->bus_info->dev, "Unsupported action\n"); 292 return -EOPNOTSUPP; 293 } 294 } 295 296 if (rulei->ipv6_valid) { 297 NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field"); 298 return -EOPNOTSUPP; 299 } 300 301 return 0; 302 } 303 304 static int 305 mlxsw_sp_flower_parse_meta_iif(struct mlxsw_sp_acl_rule_info *rulei, 306 const struct mlxsw_sp_flow_block *block, 307 const struct flow_match_meta *match, 308 struct netlink_ext_ack *extack) 309 { 310 struct mlxsw_sp_port *mlxsw_sp_port; 311 struct net_device *ingress_dev; 312 313 if (!match->mask->ingress_ifindex) 314 return 0; 315 316 if (match->mask->ingress_ifindex != 0xFFFFFFFF) { 317 NL_SET_ERR_MSG_MOD(extack, "Unsupported ingress ifindex mask"); 318 return -EINVAL; 319 } 320 321 ingress_dev = __dev_get_by_index(block->net, 322 match->key->ingress_ifindex); 323 if (!ingress_dev) { 324 NL_SET_ERR_MSG_MOD(extack, "Can't find specified ingress port to match on"); 325 return -EINVAL; 326 } 327 328 if (!mlxsw_sp_port_dev_check(ingress_dev)) { 329 NL_SET_ERR_MSG_MOD(extack, "Can't match on non-mlxsw ingress port"); 330 return -EINVAL; 331 } 332 333 mlxsw_sp_port = netdev_priv(ingress_dev); 334 if (mlxsw_sp_port->mlxsw_sp != block->mlxsw_sp) { 335 NL_SET_ERR_MSG_MOD(extack, "Can't match on a port from different device"); 336 return -EINVAL; 337 } 338 339 mlxsw_sp_acl_rulei_keymask_u32(rulei, 340 MLXSW_AFK_ELEMENT_SRC_SYS_PORT, 341 mlxsw_sp_port->local_port, 342 0xFFFFFFFF); 343 344 return 0; 345 } 346 347 static int mlxsw_sp_flower_parse_meta(struct mlxsw_sp_acl_rule_info *rulei, 348 struct flow_cls_offload *f, 349 struct mlxsw_sp_flow_block *block) 350 { 351 struct flow_rule *rule = flow_cls_offload_flow_rule(f); 352 struct flow_match_meta match; 353 354 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META)) 355 return 0; 356 357 flow_rule_match_meta(rule, &match); 358 359 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_FDB_MISS, 360 match.key->l2_miss, match.mask->l2_miss); 361 362 return mlxsw_sp_flower_parse_meta_iif(rulei, block, &match, 363 f->common.extack); 364 } 365 366 static void mlxsw_sp_flower_parse_ipv4(struct mlxsw_sp_acl_rule_info *rulei, 367 struct flow_cls_offload *f) 368 { 369 struct flow_match_ipv4_addrs match; 370 371 flow_rule_match_ipv4_addrs(f->rule, &match); 372 373 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31, 374 (char *) &match.key->src, 375 (char *) &match.mask->src, 4); 376 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31, 377 (char *) &match.key->dst, 378 (char *) &match.mask->dst, 4); 379 } 380 381 static void mlxsw_sp_flower_parse_ipv6(struct mlxsw_sp_acl_rule_info *rulei, 382 struct flow_cls_offload *f) 383 { 384 struct flow_match_ipv6_addrs match; 385 386 flow_rule_match_ipv6_addrs(f->rule, &match); 387 388 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_96_127, 389 &match.key->src.s6_addr[0x0], 390 &match.mask->src.s6_addr[0x0], 4); 391 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_64_95, 392 &match.key->src.s6_addr[0x4], 393 &match.mask->src.s6_addr[0x4], 4); 394 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_32_63, 395 &match.key->src.s6_addr[0x8], 396 &match.mask->src.s6_addr[0x8], 4); 397 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31, 398 &match.key->src.s6_addr[0xC], 399 &match.mask->src.s6_addr[0xC], 4); 400 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_96_127, 401 &match.key->dst.s6_addr[0x0], 402 &match.mask->dst.s6_addr[0x0], 4); 403 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_64_95, 404 &match.key->dst.s6_addr[0x4], 405 &match.mask->dst.s6_addr[0x4], 4); 406 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_32_63, 407 &match.key->dst.s6_addr[0x8], 408 &match.mask->dst.s6_addr[0x8], 4); 409 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31, 410 &match.key->dst.s6_addr[0xC], 411 &match.mask->dst.s6_addr[0xC], 4); 412 } 413 414 static int mlxsw_sp_flower_parse_ports(struct mlxsw_sp *mlxsw_sp, 415 struct mlxsw_sp_acl_rule_info *rulei, 416 struct flow_cls_offload *f, 417 u8 ip_proto) 418 { 419 const struct flow_rule *rule = flow_cls_offload_flow_rule(f); 420 struct flow_match_ports match; 421 422 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS)) 423 return 0; 424 425 if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) { 426 NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported"); 427 dev_err(mlxsw_sp->bus_info->dev, "Only UDP and TCP keys are supported\n"); 428 return -EINVAL; 429 } 430 431 flow_rule_match_ports(rule, &match); 432 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_L4_PORT, 433 ntohs(match.key->dst), 434 ntohs(match.mask->dst)); 435 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_L4_PORT, 436 ntohs(match.key->src), 437 ntohs(match.mask->src)); 438 return 0; 439 } 440 441 static int 442 mlxsw_sp_flower_parse_ports_range(struct mlxsw_sp *mlxsw_sp, 443 struct mlxsw_sp_acl_rule_info *rulei, 444 struct flow_cls_offload *f, u8 ip_proto) 445 { 446 const struct flow_rule *rule = flow_cls_offload_flow_rule(f); 447 struct flow_match_ports_range match; 448 u32 key_mask_value = 0; 449 450 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS_RANGE)) 451 return 0; 452 453 if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) { 454 NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported"); 455 return -EINVAL; 456 } 457 458 flow_rule_match_ports_range(rule, &match); 459 460 if (match.mask->tp_min.src) { 461 struct mlxsw_sp_port_range range = { 462 .min = ntohs(match.key->tp_min.src), 463 .max = ntohs(match.key->tp_max.src), 464 .source = true, 465 }; 466 u8 prr_index; 467 int err; 468 469 err = mlxsw_sp_port_range_reg_get(mlxsw_sp, &range, 470 f->common.extack, &prr_index); 471 if (err) 472 return err; 473 474 rulei->src_port_range_reg_index = prr_index; 475 rulei->src_port_range_reg_valid = true; 476 key_mask_value |= BIT(prr_index); 477 } 478 479 if (match.mask->tp_min.dst) { 480 struct mlxsw_sp_port_range range = { 481 .min = ntohs(match.key->tp_min.dst), 482 .max = ntohs(match.key->tp_max.dst), 483 }; 484 u8 prr_index; 485 int err; 486 487 err = mlxsw_sp_port_range_reg_get(mlxsw_sp, &range, 488 f->common.extack, &prr_index); 489 if (err) 490 return err; 491 492 rulei->dst_port_range_reg_index = prr_index; 493 rulei->dst_port_range_reg_valid = true; 494 key_mask_value |= BIT(prr_index); 495 } 496 497 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_L4_PORT_RANGE, 498 key_mask_value, key_mask_value); 499 500 return 0; 501 } 502 503 static int mlxsw_sp_flower_parse_tcp(struct mlxsw_sp *mlxsw_sp, 504 struct mlxsw_sp_acl_rule_info *rulei, 505 struct flow_cls_offload *f, 506 u8 ip_proto) 507 { 508 const struct flow_rule *rule = flow_cls_offload_flow_rule(f); 509 struct flow_match_tcp match; 510 511 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_TCP)) 512 return 0; 513 514 if (ip_proto != IPPROTO_TCP) { 515 NL_SET_ERR_MSG_MOD(f->common.extack, "TCP keys supported only for TCP"); 516 dev_err(mlxsw_sp->bus_info->dev, "TCP keys supported only for TCP\n"); 517 return -EINVAL; 518 } 519 520 flow_rule_match_tcp(rule, &match); 521 522 if (match.mask->flags & htons(0x0E00)) { 523 NL_SET_ERR_MSG_MOD(f->common.extack, "TCP flags match not supported on reserved bits"); 524 dev_err(mlxsw_sp->bus_info->dev, "TCP flags match not supported on reserved bits\n"); 525 return -EINVAL; 526 } 527 528 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_TCP_FLAGS, 529 ntohs(match.key->flags), 530 ntohs(match.mask->flags)); 531 return 0; 532 } 533 534 static int mlxsw_sp_flower_parse_ip(struct mlxsw_sp *mlxsw_sp, 535 struct mlxsw_sp_acl_rule_info *rulei, 536 struct flow_cls_offload *f, 537 u16 n_proto) 538 { 539 const struct flow_rule *rule = flow_cls_offload_flow_rule(f); 540 struct flow_match_ip match; 541 542 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IP)) 543 return 0; 544 545 if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6) { 546 NL_SET_ERR_MSG_MOD(f->common.extack, "IP keys supported only for IPv4/6"); 547 dev_err(mlxsw_sp->bus_info->dev, "IP keys supported only for IPv4/6\n"); 548 return -EINVAL; 549 } 550 551 flow_rule_match_ip(rule, &match); 552 553 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_TTL_, 554 match.key->ttl, match.mask->ttl); 555 556 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_ECN, 557 match.key->tos & 0x3, 558 match.mask->tos & 0x3); 559 560 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_DSCP, 561 match.key->tos >> 2, 562 match.mask->tos >> 2); 563 564 return 0; 565 } 566 567 static int mlxsw_sp_flower_parse(struct mlxsw_sp *mlxsw_sp, 568 struct mlxsw_sp_flow_block *block, 569 struct mlxsw_sp_acl_rule_info *rulei, 570 struct flow_cls_offload *f) 571 { 572 struct flow_rule *rule = flow_cls_offload_flow_rule(f); 573 struct flow_dissector *dissector = rule->match.dissector; 574 u16 n_proto_mask = 0; 575 u16 n_proto_key = 0; 576 u16 addr_type = 0; 577 u8 ip_proto = 0; 578 int err; 579 580 if (dissector->used_keys & 581 ~(BIT_ULL(FLOW_DISSECTOR_KEY_META) | 582 BIT_ULL(FLOW_DISSECTOR_KEY_CONTROL) | 583 BIT_ULL(FLOW_DISSECTOR_KEY_BASIC) | 584 BIT_ULL(FLOW_DISSECTOR_KEY_ETH_ADDRS) | 585 BIT_ULL(FLOW_DISSECTOR_KEY_IPV4_ADDRS) | 586 BIT_ULL(FLOW_DISSECTOR_KEY_IPV6_ADDRS) | 587 BIT_ULL(FLOW_DISSECTOR_KEY_PORTS) | 588 BIT_ULL(FLOW_DISSECTOR_KEY_PORTS_RANGE) | 589 BIT_ULL(FLOW_DISSECTOR_KEY_TCP) | 590 BIT_ULL(FLOW_DISSECTOR_KEY_IP) | 591 BIT_ULL(FLOW_DISSECTOR_KEY_VLAN))) { 592 dev_err(mlxsw_sp->bus_info->dev, "Unsupported key\n"); 593 NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported key"); 594 return -EOPNOTSUPP; 595 } 596 597 mlxsw_sp_acl_rulei_priority(rulei, f->common.prio); 598 599 err = mlxsw_sp_flower_parse_meta(rulei, f, block); 600 if (err) 601 return err; 602 603 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CONTROL)) { 604 struct flow_match_control match; 605 606 flow_rule_match_control(rule, &match); 607 addr_type = match.key->addr_type; 608 609 if (flow_rule_has_control_flags(match.mask->flags, 610 f->common.extack)) 611 return -EOPNOTSUPP; 612 } 613 614 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) { 615 struct flow_match_basic match; 616 617 flow_rule_match_basic(rule, &match); 618 n_proto_key = ntohs(match.key->n_proto); 619 n_proto_mask = ntohs(match.mask->n_proto); 620 621 if (n_proto_key == ETH_P_ALL) { 622 n_proto_key = 0; 623 n_proto_mask = 0; 624 } 625 mlxsw_sp_acl_rulei_keymask_u32(rulei, 626 MLXSW_AFK_ELEMENT_ETHERTYPE, 627 n_proto_key, n_proto_mask); 628 629 ip_proto = match.key->ip_proto; 630 mlxsw_sp_acl_rulei_keymask_u32(rulei, 631 MLXSW_AFK_ELEMENT_IP_PROTO, 632 match.key->ip_proto, 633 match.mask->ip_proto); 634 } 635 636 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) { 637 struct flow_match_eth_addrs match; 638 639 flow_rule_match_eth_addrs(rule, &match); 640 mlxsw_sp_acl_rulei_keymask_buf(rulei, 641 MLXSW_AFK_ELEMENT_DMAC_32_47, 642 match.key->dst, 643 match.mask->dst, 2); 644 mlxsw_sp_acl_rulei_keymask_buf(rulei, 645 MLXSW_AFK_ELEMENT_DMAC_0_31, 646 match.key->dst + 2, 647 match.mask->dst + 2, 4); 648 mlxsw_sp_acl_rulei_keymask_buf(rulei, 649 MLXSW_AFK_ELEMENT_SMAC_32_47, 650 match.key->src, 651 match.mask->src, 2); 652 mlxsw_sp_acl_rulei_keymask_buf(rulei, 653 MLXSW_AFK_ELEMENT_SMAC_0_31, 654 match.key->src + 2, 655 match.mask->src + 2, 4); 656 } 657 658 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) { 659 struct flow_match_vlan match; 660 661 flow_rule_match_vlan(rule, &match); 662 if (mlxsw_sp_flow_block_is_egress_bound(block) && 663 match.mask->vlan_id) { 664 NL_SET_ERR_MSG_MOD(f->common.extack, "vlan_id key is not supported on egress"); 665 return -EOPNOTSUPP; 666 } 667 668 /* Forbid block with this rulei to be bound 669 * to egress in future. 670 */ 671 rulei->egress_bind_blocker = 1; 672 673 if (match.mask->vlan_id != 0) 674 mlxsw_sp_acl_rulei_keymask_u32(rulei, 675 MLXSW_AFK_ELEMENT_VID, 676 match.key->vlan_id, 677 match.mask->vlan_id); 678 if (match.mask->vlan_priority != 0) 679 mlxsw_sp_acl_rulei_keymask_u32(rulei, 680 MLXSW_AFK_ELEMENT_PCP, 681 match.key->vlan_priority, 682 match.mask->vlan_priority); 683 } 684 685 if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) 686 mlxsw_sp_flower_parse_ipv4(rulei, f); 687 688 if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS) 689 mlxsw_sp_flower_parse_ipv6(rulei, f); 690 691 err = mlxsw_sp_flower_parse_ports(mlxsw_sp, rulei, f, ip_proto); 692 if (err) 693 return err; 694 695 err = mlxsw_sp_flower_parse_ports_range(mlxsw_sp, rulei, f, ip_proto); 696 if (err) 697 return err; 698 699 err = mlxsw_sp_flower_parse_tcp(mlxsw_sp, rulei, f, ip_proto); 700 if (err) 701 return err; 702 703 err = mlxsw_sp_flower_parse_ip(mlxsw_sp, rulei, f, n_proto_key & n_proto_mask); 704 if (err) 705 return err; 706 707 return mlxsw_sp_flower_parse_actions(mlxsw_sp, block, rulei, 708 &f->rule->action, 709 f->common.extack); 710 } 711 712 static int mlxsw_sp_flower_mall_prio_check(struct mlxsw_sp_flow_block *block, 713 struct flow_cls_offload *f) 714 { 715 bool ingress = mlxsw_sp_flow_block_is_ingress_bound(block); 716 unsigned int mall_min_prio; 717 unsigned int mall_max_prio; 718 int err; 719 720 err = mlxsw_sp_mall_prio_get(block, f->common.chain_index, 721 &mall_min_prio, &mall_max_prio); 722 if (err) { 723 if (err == -ENOENT) 724 /* No matchall filters installed on this chain. */ 725 return 0; 726 NL_SET_ERR_MSG(f->common.extack, "Failed to get matchall priorities"); 727 return err; 728 } 729 if (ingress && f->common.prio <= mall_min_prio) { 730 NL_SET_ERR_MSG(f->common.extack, "Failed to add in front of existing matchall rules"); 731 return -EOPNOTSUPP; 732 } 733 if (!ingress && f->common.prio >= mall_max_prio) { 734 NL_SET_ERR_MSG(f->common.extack, "Failed to add behind of existing matchall rules"); 735 return -EOPNOTSUPP; 736 } 737 return 0; 738 } 739 740 int mlxsw_sp_flower_replace(struct mlxsw_sp *mlxsw_sp, 741 struct mlxsw_sp_flow_block *block, 742 struct flow_cls_offload *f) 743 { 744 struct mlxsw_sp_acl_rule_info *rulei; 745 struct mlxsw_sp_acl_ruleset *ruleset; 746 struct mlxsw_sp_acl_rule *rule; 747 int err; 748 749 err = mlxsw_sp_flower_mall_prio_check(block, f); 750 if (err) 751 return err; 752 753 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block, 754 f->common.chain_index, 755 MLXSW_SP_ACL_PROFILE_FLOWER, NULL); 756 if (IS_ERR(ruleset)) 757 return PTR_ERR(ruleset); 758 759 rule = mlxsw_sp_acl_rule_create(mlxsw_sp, ruleset, f->cookie, NULL, 760 f->common.extack); 761 if (IS_ERR(rule)) { 762 err = PTR_ERR(rule); 763 goto err_rule_create; 764 } 765 766 rulei = mlxsw_sp_acl_rule_rulei(rule); 767 err = mlxsw_sp_flower_parse(mlxsw_sp, block, rulei, f); 768 if (err) 769 goto err_flower_parse; 770 771 err = mlxsw_sp_acl_rulei_commit(rulei); 772 if (err) 773 goto err_rulei_commit; 774 775 err = mlxsw_sp_acl_rule_add(mlxsw_sp, rule); 776 if (err) 777 goto err_rule_add; 778 779 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 780 return 0; 781 782 err_rule_add: 783 err_rulei_commit: 784 err_flower_parse: 785 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule); 786 err_rule_create: 787 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 788 return err; 789 } 790 791 void mlxsw_sp_flower_destroy(struct mlxsw_sp *mlxsw_sp, 792 struct mlxsw_sp_flow_block *block, 793 struct flow_cls_offload *f) 794 { 795 struct mlxsw_sp_acl_ruleset *ruleset; 796 struct mlxsw_sp_acl_rule *rule; 797 798 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block, 799 f->common.chain_index, 800 MLXSW_SP_ACL_PROFILE_FLOWER, NULL); 801 if (IS_ERR(ruleset)) 802 return; 803 804 rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie); 805 if (rule) { 806 mlxsw_sp_acl_rule_del(mlxsw_sp, rule); 807 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule); 808 } 809 810 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 811 } 812 813 int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp, 814 struct mlxsw_sp_flow_block *block, 815 struct flow_cls_offload *f) 816 { 817 enum flow_action_hw_stats used_hw_stats = FLOW_ACTION_HW_STATS_DISABLED; 818 struct mlxsw_sp_acl_ruleset *ruleset; 819 struct mlxsw_sp_acl_rule *rule; 820 u64 packets; 821 u64 lastuse; 822 u64 bytes; 823 u64 drops; 824 int err; 825 826 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block, 827 f->common.chain_index, 828 MLXSW_SP_ACL_PROFILE_FLOWER, NULL); 829 if (WARN_ON(IS_ERR(ruleset))) 830 return -EINVAL; 831 832 rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie); 833 if (!rule) 834 return -EINVAL; 835 836 err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes, 837 &drops, &lastuse, &used_hw_stats); 838 if (err) 839 goto err_rule_get_stats; 840 841 flow_stats_update(&f->stats, bytes, packets, drops, lastuse, 842 used_hw_stats); 843 844 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 845 return 0; 846 847 err_rule_get_stats: 848 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 849 return err; 850 } 851 852 int mlxsw_sp_flower_tmplt_create(struct mlxsw_sp *mlxsw_sp, 853 struct mlxsw_sp_flow_block *block, 854 struct flow_cls_offload *f) 855 { 856 struct mlxsw_sp_acl_ruleset *ruleset; 857 struct mlxsw_sp_acl_rule_info rulei; 858 int err; 859 860 memset(&rulei, 0, sizeof(rulei)); 861 err = mlxsw_sp_flower_parse(mlxsw_sp, block, &rulei, f); 862 if (err) 863 return err; 864 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block, 865 f->common.chain_index, 866 MLXSW_SP_ACL_PROFILE_FLOWER, 867 &rulei.values.elusage); 868 869 /* keep the reference to the ruleset */ 870 return PTR_ERR_OR_ZERO(ruleset); 871 } 872 873 void mlxsw_sp_flower_tmplt_destroy(struct mlxsw_sp *mlxsw_sp, 874 struct mlxsw_sp_flow_block *block, 875 struct flow_cls_offload *f) 876 { 877 struct mlxsw_sp_acl_ruleset *ruleset; 878 879 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block, 880 f->common.chain_index, 881 MLXSW_SP_ACL_PROFILE_FLOWER, NULL); 882 if (IS_ERR(ruleset)) 883 return; 884 /* put the reference to the ruleset kept in create */ 885 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 886 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset); 887 } 888 889 int mlxsw_sp_flower_prio_get(struct mlxsw_sp *mlxsw_sp, 890 struct mlxsw_sp_flow_block *block, 891 u32 chain_index, unsigned int *p_min_prio, 892 unsigned int *p_max_prio) 893 { 894 struct mlxsw_sp_acl_ruleset *ruleset; 895 896 ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block, 897 chain_index, 898 MLXSW_SP_ACL_PROFILE_FLOWER); 899 if (IS_ERR(ruleset)) 900 /* In case there are no flower rules, the caller 901 * receives -ENOENT to indicate there is no need 902 * to check the priorities. 903 */ 904 return PTR_ERR(ruleset); 905 mlxsw_sp_acl_ruleset_prio_get(ruleset, p_min_prio, p_max_prio); 906 return 0; 907 } 908