xref: /linux/net/openvswitch/flow_netlink.c (revision c5d3cdad688ed75fb311a3a671eb30ba7106d7d3)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (c) 2007-2017 Nicira, Inc.
4  */
5 
6 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
7 
8 #include "flow.h"
9 #include "datapath.h"
10 #include <linux/uaccess.h>
11 #include <linux/netdevice.h>
12 #include <linux/etherdevice.h>
13 #include <linux/if_ether.h>
14 #include <linux/if_vlan.h>
15 #include <net/llc_pdu.h>
16 #include <linux/kernel.h>
17 #include <linux/jhash.h>
18 #include <linux/jiffies.h>
19 #include <linux/llc.h>
20 #include <linux/module.h>
21 #include <linux/in.h>
22 #include <linux/rcupdate.h>
23 #include <linux/if_arp.h>
24 #include <linux/ip.h>
25 #include <linux/ipv6.h>
26 #include <linux/sctp.h>
27 #include <linux/tcp.h>
28 #include <linux/udp.h>
29 #include <linux/icmp.h>
30 #include <linux/icmpv6.h>
31 #include <linux/rculist.h>
32 #include <net/geneve.h>
33 #include <net/ip.h>
34 #include <net/ipv6.h>
35 #include <net/ndisc.h>
36 #include <net/mpls.h>
37 #include <net/vxlan.h>
38 #include <net/tun_proto.h>
39 #include <net/erspan.h>
40 
41 #include "flow_netlink.h"
42 
43 struct ovs_len_tbl {
44 	int len;
45 	const struct ovs_len_tbl *next;
46 };
47 
48 #define OVS_ATTR_NESTED -1
49 #define OVS_ATTR_VARIABLE -2
50 
51 static bool actions_may_change_flow(const struct nlattr *actions)
52 {
53 	struct nlattr *nla;
54 	int rem;
55 
56 	nla_for_each_nested(nla, actions, rem) {
57 		u16 action = nla_type(nla);
58 
59 		switch (action) {
60 		case OVS_ACTION_ATTR_OUTPUT:
61 		case OVS_ACTION_ATTR_RECIRC:
62 		case OVS_ACTION_ATTR_TRUNC:
63 		case OVS_ACTION_ATTR_USERSPACE:
64 			break;
65 
66 		case OVS_ACTION_ATTR_CT:
67 		case OVS_ACTION_ATTR_CT_CLEAR:
68 		case OVS_ACTION_ATTR_HASH:
69 		case OVS_ACTION_ATTR_POP_ETH:
70 		case OVS_ACTION_ATTR_POP_MPLS:
71 		case OVS_ACTION_ATTR_POP_NSH:
72 		case OVS_ACTION_ATTR_POP_VLAN:
73 		case OVS_ACTION_ATTR_PUSH_ETH:
74 		case OVS_ACTION_ATTR_PUSH_MPLS:
75 		case OVS_ACTION_ATTR_PUSH_NSH:
76 		case OVS_ACTION_ATTR_PUSH_VLAN:
77 		case OVS_ACTION_ATTR_SAMPLE:
78 		case OVS_ACTION_ATTR_SET:
79 		case OVS_ACTION_ATTR_SET_MASKED:
80 		case OVS_ACTION_ATTR_METER:
81 		case OVS_ACTION_ATTR_CHECK_PKT_LEN:
82 		case OVS_ACTION_ATTR_ADD_MPLS:
83 		case OVS_ACTION_ATTR_DEC_TTL:
84 		default:
85 			return true;
86 		}
87 	}
88 	return false;
89 }
90 
91 static void update_range(struct sw_flow_match *match,
92 			 size_t offset, size_t size, bool is_mask)
93 {
94 	struct sw_flow_key_range *range;
95 	size_t start = rounddown(offset, sizeof(long));
96 	size_t end = roundup(offset + size, sizeof(long));
97 
98 	if (!is_mask)
99 		range = &match->range;
100 	else
101 		range = &match->mask->range;
102 
103 	if (range->start == range->end) {
104 		range->start = start;
105 		range->end = end;
106 		return;
107 	}
108 
109 	if (range->start > start)
110 		range->start = start;
111 
112 	if (range->end < end)
113 		range->end = end;
114 }
115 
116 #define SW_FLOW_KEY_PUT(match, field, value, is_mask) \
117 	do { \
118 		update_range(match, offsetof(struct sw_flow_key, field),    \
119 			     sizeof((match)->key->field), is_mask);	    \
120 		if (is_mask)						    \
121 			(match)->mask->key.field = value;		    \
122 		else							    \
123 			(match)->key->field = value;		            \
124 	} while (0)
125 
126 #define SW_FLOW_KEY_MEMCPY_OFFSET(match, offset, value_p, len, is_mask)	    \
127 	do {								    \
128 		update_range(match, offset, len, is_mask);		    \
129 		if (is_mask)						    \
130 			memcpy((u8 *)&(match)->mask->key + offset, value_p, \
131 			       len);					   \
132 		else							    \
133 			memcpy((u8 *)(match)->key + offset, value_p, len);  \
134 	} while (0)
135 
136 #define SW_FLOW_KEY_MEMCPY(match, field, value_p, len, is_mask)		      \
137 	SW_FLOW_KEY_MEMCPY_OFFSET(match, offsetof(struct sw_flow_key, field), \
138 				  value_p, len, is_mask)
139 
140 #define SW_FLOW_KEY_MEMSET_FIELD(match, field, value, is_mask)		    \
141 	do {								    \
142 		update_range(match, offsetof(struct sw_flow_key, field),    \
143 			     sizeof((match)->key->field), is_mask);	    \
144 		if (is_mask)						    \
145 			memset((u8 *)&(match)->mask->key.field, value,      \
146 			       sizeof((match)->mask->key.field));	    \
147 		else							    \
148 			memset((u8 *)&(match)->key->field, value,           \
149 			       sizeof((match)->key->field));                \
150 	} while (0)
151 
152 static bool match_validate(const struct sw_flow_match *match,
153 			   u64 key_attrs, u64 mask_attrs, bool log)
154 {
155 	u64 key_expected = 0;
156 	u64 mask_allowed = key_attrs;  /* At most allow all key attributes */
157 
158 	/* The following mask attributes allowed only if they
159 	 * pass the validation tests. */
160 	mask_allowed &= ~((1 << OVS_KEY_ATTR_IPV4)
161 			| (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4)
162 			| (1 << OVS_KEY_ATTR_IPV6)
163 			| (1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6)
164 			| (1 << OVS_KEY_ATTR_TCP)
165 			| (1 << OVS_KEY_ATTR_TCP_FLAGS)
166 			| (1 << OVS_KEY_ATTR_UDP)
167 			| (1 << OVS_KEY_ATTR_SCTP)
168 			| (1 << OVS_KEY_ATTR_ICMP)
169 			| (1 << OVS_KEY_ATTR_ICMPV6)
170 			| (1 << OVS_KEY_ATTR_ARP)
171 			| (1 << OVS_KEY_ATTR_ND)
172 			| (1 << OVS_KEY_ATTR_MPLS)
173 			| (1 << OVS_KEY_ATTR_NSH));
174 
175 	/* Always allowed mask fields. */
176 	mask_allowed |= ((1 << OVS_KEY_ATTR_TUNNEL)
177 		       | (1 << OVS_KEY_ATTR_IN_PORT)
178 		       | (1 << OVS_KEY_ATTR_ETHERTYPE));
179 
180 	/* Check key attributes. */
181 	if (match->key->eth.type == htons(ETH_P_ARP)
182 			|| match->key->eth.type == htons(ETH_P_RARP)) {
183 		key_expected |= 1 << OVS_KEY_ATTR_ARP;
184 		if (match->mask && (match->mask->key.eth.type == htons(0xffff)))
185 			mask_allowed |= 1 << OVS_KEY_ATTR_ARP;
186 	}
187 
188 	if (eth_p_mpls(match->key->eth.type)) {
189 		key_expected |= 1 << OVS_KEY_ATTR_MPLS;
190 		if (match->mask && (match->mask->key.eth.type == htons(0xffff)))
191 			mask_allowed |= 1 << OVS_KEY_ATTR_MPLS;
192 	}
193 
194 	if (match->key->eth.type == htons(ETH_P_IP)) {
195 		key_expected |= 1 << OVS_KEY_ATTR_IPV4;
196 		if (match->mask && match->mask->key.eth.type == htons(0xffff)) {
197 			mask_allowed |= 1 << OVS_KEY_ATTR_IPV4;
198 			mask_allowed |= 1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4;
199 		}
200 
201 		if (match->key->ip.frag != OVS_FRAG_TYPE_LATER) {
202 			if (match->key->ip.proto == IPPROTO_UDP) {
203 				key_expected |= 1 << OVS_KEY_ATTR_UDP;
204 				if (match->mask && (match->mask->key.ip.proto == 0xff))
205 					mask_allowed |= 1 << OVS_KEY_ATTR_UDP;
206 			}
207 
208 			if (match->key->ip.proto == IPPROTO_SCTP) {
209 				key_expected |= 1 << OVS_KEY_ATTR_SCTP;
210 				if (match->mask && (match->mask->key.ip.proto == 0xff))
211 					mask_allowed |= 1 << OVS_KEY_ATTR_SCTP;
212 			}
213 
214 			if (match->key->ip.proto == IPPROTO_TCP) {
215 				key_expected |= 1 << OVS_KEY_ATTR_TCP;
216 				key_expected |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
217 				if (match->mask && (match->mask->key.ip.proto == 0xff)) {
218 					mask_allowed |= 1 << OVS_KEY_ATTR_TCP;
219 					mask_allowed |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
220 				}
221 			}
222 
223 			if (match->key->ip.proto == IPPROTO_ICMP) {
224 				key_expected |= 1 << OVS_KEY_ATTR_ICMP;
225 				if (match->mask && (match->mask->key.ip.proto == 0xff))
226 					mask_allowed |= 1 << OVS_KEY_ATTR_ICMP;
227 			}
228 		}
229 	}
230 
231 	if (match->key->eth.type == htons(ETH_P_IPV6)) {
232 		key_expected |= 1 << OVS_KEY_ATTR_IPV6;
233 		if (match->mask && match->mask->key.eth.type == htons(0xffff)) {
234 			mask_allowed |= 1 << OVS_KEY_ATTR_IPV6;
235 			mask_allowed |= 1 << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6;
236 		}
237 
238 		if (match->key->ip.frag != OVS_FRAG_TYPE_LATER) {
239 			if (match->key->ip.proto == IPPROTO_UDP) {
240 				key_expected |= 1 << OVS_KEY_ATTR_UDP;
241 				if (match->mask && (match->mask->key.ip.proto == 0xff))
242 					mask_allowed |= 1 << OVS_KEY_ATTR_UDP;
243 			}
244 
245 			if (match->key->ip.proto == IPPROTO_SCTP) {
246 				key_expected |= 1 << OVS_KEY_ATTR_SCTP;
247 				if (match->mask && (match->mask->key.ip.proto == 0xff))
248 					mask_allowed |= 1 << OVS_KEY_ATTR_SCTP;
249 			}
250 
251 			if (match->key->ip.proto == IPPROTO_TCP) {
252 				key_expected |= 1 << OVS_KEY_ATTR_TCP;
253 				key_expected |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
254 				if (match->mask && (match->mask->key.ip.proto == 0xff)) {
255 					mask_allowed |= 1 << OVS_KEY_ATTR_TCP;
256 					mask_allowed |= 1 << OVS_KEY_ATTR_TCP_FLAGS;
257 				}
258 			}
259 
260 			if (match->key->ip.proto == IPPROTO_ICMPV6) {
261 				key_expected |= 1 << OVS_KEY_ATTR_ICMPV6;
262 				if (match->mask && (match->mask->key.ip.proto == 0xff))
263 					mask_allowed |= 1 << OVS_KEY_ATTR_ICMPV6;
264 
265 				if (match->key->tp.src ==
266 						htons(NDISC_NEIGHBOUR_SOLICITATION) ||
267 				    match->key->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) {
268 					key_expected |= 1 << OVS_KEY_ATTR_ND;
269 					/* Original direction conntrack tuple
270 					 * uses the same space as the ND fields
271 					 * in the key, so both are not allowed
272 					 * at the same time.
273 					 */
274 					mask_allowed &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6);
275 					if (match->mask && (match->mask->key.tp.src == htons(0xff)))
276 						mask_allowed |= 1 << OVS_KEY_ATTR_ND;
277 				}
278 			}
279 		}
280 	}
281 
282 	if (match->key->eth.type == htons(ETH_P_NSH)) {
283 		key_expected |= 1 << OVS_KEY_ATTR_NSH;
284 		if (match->mask &&
285 		    match->mask->key.eth.type == htons(0xffff)) {
286 			mask_allowed |= 1 << OVS_KEY_ATTR_NSH;
287 		}
288 	}
289 
290 	if ((key_attrs & key_expected) != key_expected) {
291 		/* Key attributes check failed. */
292 		OVS_NLERR(log, "Missing key (keys=%llx, expected=%llx)",
293 			  (unsigned long long)key_attrs,
294 			  (unsigned long long)key_expected);
295 		return false;
296 	}
297 
298 	if ((mask_attrs & mask_allowed) != mask_attrs) {
299 		/* Mask attributes check failed. */
300 		OVS_NLERR(log, "Unexpected mask (mask=%llx, allowed=%llx)",
301 			  (unsigned long long)mask_attrs,
302 			  (unsigned long long)mask_allowed);
303 		return false;
304 	}
305 
306 	return true;
307 }
308 
309 size_t ovs_tun_key_attr_size(void)
310 {
311 	/* Whenever adding new OVS_TUNNEL_KEY_ FIELDS, we should consider
312 	 * updating this function.
313 	 */
314 	return    nla_total_size_64bit(8) /* OVS_TUNNEL_KEY_ATTR_ID */
315 		+ nla_total_size(16)   /* OVS_TUNNEL_KEY_ATTR_IPV[46]_SRC */
316 		+ nla_total_size(16)   /* OVS_TUNNEL_KEY_ATTR_IPV[46]_DST */
317 		+ nla_total_size(1)    /* OVS_TUNNEL_KEY_ATTR_TOS */
318 		+ nla_total_size(1)    /* OVS_TUNNEL_KEY_ATTR_TTL */
319 		+ nla_total_size(0)    /* OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT */
320 		+ nla_total_size(0)    /* OVS_TUNNEL_KEY_ATTR_CSUM */
321 		+ nla_total_size(0)    /* OVS_TUNNEL_KEY_ATTR_OAM */
322 		+ nla_total_size(256)  /* OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS */
323 		/* OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS and
324 		 * OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS is mutually exclusive with
325 		 * OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS and covered by it.
326 		 */
327 		+ nla_total_size(2)    /* OVS_TUNNEL_KEY_ATTR_TP_SRC */
328 		+ nla_total_size(2);   /* OVS_TUNNEL_KEY_ATTR_TP_DST */
329 }
330 
331 static size_t ovs_nsh_key_attr_size(void)
332 {
333 	/* Whenever adding new OVS_NSH_KEY_ FIELDS, we should consider
334 	 * updating this function.
335 	 */
336 	return  nla_total_size(NSH_BASE_HDR_LEN) /* OVS_NSH_KEY_ATTR_BASE */
337 		/* OVS_NSH_KEY_ATTR_MD1 and OVS_NSH_KEY_ATTR_MD2 are
338 		 * mutually exclusive, so the bigger one can cover
339 		 * the small one.
340 		 */
341 		+ nla_total_size(NSH_CTX_HDRS_MAX_LEN);
342 }
343 
344 size_t ovs_key_attr_size(void)
345 {
346 	/* Whenever adding new OVS_KEY_ FIELDS, we should consider
347 	 * updating this function.
348 	 */
349 	BUILD_BUG_ON(OVS_KEY_ATTR_TUNNEL_INFO != 29);
350 
351 	return    nla_total_size(4)   /* OVS_KEY_ATTR_PRIORITY */
352 		+ nla_total_size(0)   /* OVS_KEY_ATTR_TUNNEL */
353 		  + ovs_tun_key_attr_size()
354 		+ nla_total_size(4)   /* OVS_KEY_ATTR_IN_PORT */
355 		+ nla_total_size(4)   /* OVS_KEY_ATTR_SKB_MARK */
356 		+ nla_total_size(4)   /* OVS_KEY_ATTR_DP_HASH */
357 		+ nla_total_size(4)   /* OVS_KEY_ATTR_RECIRC_ID */
358 		+ nla_total_size(4)   /* OVS_KEY_ATTR_CT_STATE */
359 		+ nla_total_size(2)   /* OVS_KEY_ATTR_CT_ZONE */
360 		+ nla_total_size(4)   /* OVS_KEY_ATTR_CT_MARK */
361 		+ nla_total_size(16)  /* OVS_KEY_ATTR_CT_LABELS */
362 		+ nla_total_size(40)  /* OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6 */
363 		+ nla_total_size(0)   /* OVS_KEY_ATTR_NSH */
364 		  + ovs_nsh_key_attr_size()
365 		+ nla_total_size(12)  /* OVS_KEY_ATTR_ETHERNET */
366 		+ nla_total_size(2)   /* OVS_KEY_ATTR_ETHERTYPE */
367 		+ nla_total_size(4)   /* OVS_KEY_ATTR_VLAN */
368 		+ nla_total_size(0)   /* OVS_KEY_ATTR_ENCAP */
369 		+ nla_total_size(2)   /* OVS_KEY_ATTR_ETHERTYPE */
370 		+ nla_total_size(40)  /* OVS_KEY_ATTR_IPV6 */
371 		+ nla_total_size(2)   /* OVS_KEY_ATTR_ICMPV6 */
372 		+ nla_total_size(28); /* OVS_KEY_ATTR_ND */
373 }
374 
375 static const struct ovs_len_tbl ovs_vxlan_ext_key_lens[OVS_VXLAN_EXT_MAX + 1] = {
376 	[OVS_VXLAN_EXT_GBP]	    = { .len = sizeof(u32) },
377 };
378 
379 static const struct ovs_len_tbl ovs_tunnel_key_lens[OVS_TUNNEL_KEY_ATTR_MAX + 1] = {
380 	[OVS_TUNNEL_KEY_ATTR_ID]	    = { .len = sizeof(u64) },
381 	[OVS_TUNNEL_KEY_ATTR_IPV4_SRC]	    = { .len = sizeof(u32) },
382 	[OVS_TUNNEL_KEY_ATTR_IPV4_DST]	    = { .len = sizeof(u32) },
383 	[OVS_TUNNEL_KEY_ATTR_TOS]	    = { .len = 1 },
384 	[OVS_TUNNEL_KEY_ATTR_TTL]	    = { .len = 1 },
385 	[OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT] = { .len = 0 },
386 	[OVS_TUNNEL_KEY_ATTR_CSUM]	    = { .len = 0 },
387 	[OVS_TUNNEL_KEY_ATTR_TP_SRC]	    = { .len = sizeof(u16) },
388 	[OVS_TUNNEL_KEY_ATTR_TP_DST]	    = { .len = sizeof(u16) },
389 	[OVS_TUNNEL_KEY_ATTR_OAM]	    = { .len = 0 },
390 	[OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS]   = { .len = OVS_ATTR_VARIABLE },
391 	[OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS]    = { .len = OVS_ATTR_NESTED,
392 						.next = ovs_vxlan_ext_key_lens },
393 	[OVS_TUNNEL_KEY_ATTR_IPV6_SRC]      = { .len = sizeof(struct in6_addr) },
394 	[OVS_TUNNEL_KEY_ATTR_IPV6_DST]      = { .len = sizeof(struct in6_addr) },
395 	[OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS]   = { .len = OVS_ATTR_VARIABLE },
396 	[OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE]   = { .len = 0 },
397 };
398 
399 static const struct ovs_len_tbl
400 ovs_nsh_key_attr_lens[OVS_NSH_KEY_ATTR_MAX + 1] = {
401 	[OVS_NSH_KEY_ATTR_BASE] = { .len = sizeof(struct ovs_nsh_key_base) },
402 	[OVS_NSH_KEY_ATTR_MD1]  = { .len = sizeof(struct ovs_nsh_key_md1) },
403 	[OVS_NSH_KEY_ATTR_MD2]  = { .len = OVS_ATTR_VARIABLE },
404 };
405 
406 /* The size of the argument for each %OVS_KEY_ATTR_* Netlink attribute.  */
407 static const struct ovs_len_tbl ovs_key_lens[OVS_KEY_ATTR_MAX + 1] = {
408 	[OVS_KEY_ATTR_ENCAP]	 = { .len = OVS_ATTR_NESTED },
409 	[OVS_KEY_ATTR_PRIORITY]	 = { .len = sizeof(u32) },
410 	[OVS_KEY_ATTR_IN_PORT]	 = { .len = sizeof(u32) },
411 	[OVS_KEY_ATTR_SKB_MARK]	 = { .len = sizeof(u32) },
412 	[OVS_KEY_ATTR_ETHERNET]	 = { .len = sizeof(struct ovs_key_ethernet) },
413 	[OVS_KEY_ATTR_VLAN]	 = { .len = sizeof(__be16) },
414 	[OVS_KEY_ATTR_ETHERTYPE] = { .len = sizeof(__be16) },
415 	[OVS_KEY_ATTR_IPV4]	 = { .len = sizeof(struct ovs_key_ipv4) },
416 	[OVS_KEY_ATTR_IPV6]	 = { .len = sizeof(struct ovs_key_ipv6) },
417 	[OVS_KEY_ATTR_TCP]	 = { .len = sizeof(struct ovs_key_tcp) },
418 	[OVS_KEY_ATTR_TCP_FLAGS] = { .len = sizeof(__be16) },
419 	[OVS_KEY_ATTR_UDP]	 = { .len = sizeof(struct ovs_key_udp) },
420 	[OVS_KEY_ATTR_SCTP]	 = { .len = sizeof(struct ovs_key_sctp) },
421 	[OVS_KEY_ATTR_ICMP]	 = { .len = sizeof(struct ovs_key_icmp) },
422 	[OVS_KEY_ATTR_ICMPV6]	 = { .len = sizeof(struct ovs_key_icmpv6) },
423 	[OVS_KEY_ATTR_ARP]	 = { .len = sizeof(struct ovs_key_arp) },
424 	[OVS_KEY_ATTR_ND]	 = { .len = sizeof(struct ovs_key_nd) },
425 	[OVS_KEY_ATTR_RECIRC_ID] = { .len = sizeof(u32) },
426 	[OVS_KEY_ATTR_DP_HASH]	 = { .len = sizeof(u32) },
427 	[OVS_KEY_ATTR_TUNNEL]	 = { .len = OVS_ATTR_NESTED,
428 				     .next = ovs_tunnel_key_lens, },
429 	[OVS_KEY_ATTR_MPLS]	 = { .len = OVS_ATTR_VARIABLE },
430 	[OVS_KEY_ATTR_CT_STATE]	 = { .len = sizeof(u32) },
431 	[OVS_KEY_ATTR_CT_ZONE]	 = { .len = sizeof(u16) },
432 	[OVS_KEY_ATTR_CT_MARK]	 = { .len = sizeof(u32) },
433 	[OVS_KEY_ATTR_CT_LABELS] = { .len = sizeof(struct ovs_key_ct_labels) },
434 	[OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4] = {
435 		.len = sizeof(struct ovs_key_ct_tuple_ipv4) },
436 	[OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6] = {
437 		.len = sizeof(struct ovs_key_ct_tuple_ipv6) },
438 	[OVS_KEY_ATTR_NSH]       = { .len = OVS_ATTR_NESTED,
439 				     .next = ovs_nsh_key_attr_lens, },
440 };
441 
442 static bool check_attr_len(unsigned int attr_len, unsigned int expected_len)
443 {
444 	return expected_len == attr_len ||
445 	       expected_len == OVS_ATTR_NESTED ||
446 	       expected_len == OVS_ATTR_VARIABLE;
447 }
448 
449 static bool is_all_zero(const u8 *fp, size_t size)
450 {
451 	int i;
452 
453 	if (!fp)
454 		return false;
455 
456 	for (i = 0; i < size; i++)
457 		if (fp[i])
458 			return false;
459 
460 	return true;
461 }
462 
463 static int __parse_flow_nlattrs(const struct nlattr *attr,
464 				const struct nlattr *a[],
465 				u64 *attrsp, bool log, bool nz)
466 {
467 	const struct nlattr *nla;
468 	u64 attrs;
469 	int rem;
470 
471 	attrs = *attrsp;
472 	nla_for_each_nested(nla, attr, rem) {
473 		u16 type = nla_type(nla);
474 		int expected_len;
475 
476 		if (type > OVS_KEY_ATTR_MAX) {
477 			OVS_NLERR(log, "Key type %d is out of range max %d",
478 				  type, OVS_KEY_ATTR_MAX);
479 			return -EINVAL;
480 		}
481 
482 		if (attrs & (1 << type)) {
483 			OVS_NLERR(log, "Duplicate key (type %d).", type);
484 			return -EINVAL;
485 		}
486 
487 		expected_len = ovs_key_lens[type].len;
488 		if (!check_attr_len(nla_len(nla), expected_len)) {
489 			OVS_NLERR(log, "Key %d has unexpected len %d expected %d",
490 				  type, nla_len(nla), expected_len);
491 			return -EINVAL;
492 		}
493 
494 		if (!nz || !is_all_zero(nla_data(nla), nla_len(nla))) {
495 			attrs |= 1 << type;
496 			a[type] = nla;
497 		}
498 	}
499 	if (rem) {
500 		OVS_NLERR(log, "Message has %d unknown bytes.", rem);
501 		return -EINVAL;
502 	}
503 
504 	*attrsp = attrs;
505 	return 0;
506 }
507 
508 static int parse_flow_mask_nlattrs(const struct nlattr *attr,
509 				   const struct nlattr *a[], u64 *attrsp,
510 				   bool log)
511 {
512 	return __parse_flow_nlattrs(attr, a, attrsp, log, true);
513 }
514 
515 int parse_flow_nlattrs(const struct nlattr *attr, const struct nlattr *a[],
516 		       u64 *attrsp, bool log)
517 {
518 	return __parse_flow_nlattrs(attr, a, attrsp, log, false);
519 }
520 
521 static int genev_tun_opt_from_nlattr(const struct nlattr *a,
522 				     struct sw_flow_match *match, bool is_mask,
523 				     bool log)
524 {
525 	unsigned long opt_key_offset;
526 
527 	if (nla_len(a) > sizeof(match->key->tun_opts)) {
528 		OVS_NLERR(log, "Geneve option length err (len %d, max %zu).",
529 			  nla_len(a), sizeof(match->key->tun_opts));
530 		return -EINVAL;
531 	}
532 
533 	if (nla_len(a) % 4 != 0) {
534 		OVS_NLERR(log, "Geneve opt len %d is not a multiple of 4.",
535 			  nla_len(a));
536 		return -EINVAL;
537 	}
538 
539 	/* We need to record the length of the options passed
540 	 * down, otherwise packets with the same format but
541 	 * additional options will be silently matched.
542 	 */
543 	if (!is_mask) {
544 		SW_FLOW_KEY_PUT(match, tun_opts_len, nla_len(a),
545 				false);
546 	} else {
547 		/* This is somewhat unusual because it looks at
548 		 * both the key and mask while parsing the
549 		 * attributes (and by extension assumes the key
550 		 * is parsed first). Normally, we would verify
551 		 * that each is the correct length and that the
552 		 * attributes line up in the validate function.
553 		 * However, that is difficult because this is
554 		 * variable length and we won't have the
555 		 * information later.
556 		 */
557 		if (match->key->tun_opts_len != nla_len(a)) {
558 			OVS_NLERR(log, "Geneve option len %d != mask len %d",
559 				  match->key->tun_opts_len, nla_len(a));
560 			return -EINVAL;
561 		}
562 
563 		SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true);
564 	}
565 
566 	opt_key_offset = TUN_METADATA_OFFSET(nla_len(a));
567 	SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, nla_data(a),
568 				  nla_len(a), is_mask);
569 	return 0;
570 }
571 
572 static int vxlan_tun_opt_from_nlattr(const struct nlattr *attr,
573 				     struct sw_flow_match *match, bool is_mask,
574 				     bool log)
575 {
576 	struct nlattr *a;
577 	int rem;
578 	unsigned long opt_key_offset;
579 	struct vxlan_metadata opts;
580 
581 	BUILD_BUG_ON(sizeof(opts) > sizeof(match->key->tun_opts));
582 
583 	memset(&opts, 0, sizeof(opts));
584 	nla_for_each_nested(a, attr, rem) {
585 		int type = nla_type(a);
586 
587 		if (type > OVS_VXLAN_EXT_MAX) {
588 			OVS_NLERR(log, "VXLAN extension %d out of range max %d",
589 				  type, OVS_VXLAN_EXT_MAX);
590 			return -EINVAL;
591 		}
592 
593 		if (!check_attr_len(nla_len(a),
594 				    ovs_vxlan_ext_key_lens[type].len)) {
595 			OVS_NLERR(log, "VXLAN extension %d has unexpected len %d expected %d",
596 				  type, nla_len(a),
597 				  ovs_vxlan_ext_key_lens[type].len);
598 			return -EINVAL;
599 		}
600 
601 		switch (type) {
602 		case OVS_VXLAN_EXT_GBP:
603 			opts.gbp = nla_get_u32(a);
604 			break;
605 		default:
606 			OVS_NLERR(log, "Unknown VXLAN extension attribute %d",
607 				  type);
608 			return -EINVAL;
609 		}
610 	}
611 	if (rem) {
612 		OVS_NLERR(log, "VXLAN extension message has %d unknown bytes.",
613 			  rem);
614 		return -EINVAL;
615 	}
616 
617 	if (!is_mask)
618 		SW_FLOW_KEY_PUT(match, tun_opts_len, sizeof(opts), false);
619 	else
620 		SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true);
621 
622 	opt_key_offset = TUN_METADATA_OFFSET(sizeof(opts));
623 	SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, &opts, sizeof(opts),
624 				  is_mask);
625 	return 0;
626 }
627 
628 static int erspan_tun_opt_from_nlattr(const struct nlattr *a,
629 				      struct sw_flow_match *match, bool is_mask,
630 				      bool log)
631 {
632 	unsigned long opt_key_offset;
633 
634 	BUILD_BUG_ON(sizeof(struct erspan_metadata) >
635 		     sizeof(match->key->tun_opts));
636 
637 	if (nla_len(a) > sizeof(match->key->tun_opts)) {
638 		OVS_NLERR(log, "ERSPAN option length err (len %d, max %zu).",
639 			  nla_len(a), sizeof(match->key->tun_opts));
640 		return -EINVAL;
641 	}
642 
643 	if (!is_mask)
644 		SW_FLOW_KEY_PUT(match, tun_opts_len,
645 				sizeof(struct erspan_metadata), false);
646 	else
647 		SW_FLOW_KEY_PUT(match, tun_opts_len, 0xff, true);
648 
649 	opt_key_offset = TUN_METADATA_OFFSET(nla_len(a));
650 	SW_FLOW_KEY_MEMCPY_OFFSET(match, opt_key_offset, nla_data(a),
651 				  nla_len(a), is_mask);
652 	return 0;
653 }
654 
655 static int ip_tun_from_nlattr(const struct nlattr *attr,
656 			      struct sw_flow_match *match, bool is_mask,
657 			      bool log)
658 {
659 	bool ttl = false, ipv4 = false, ipv6 = false;
660 	bool info_bridge_mode = false;
661 	__be16 tun_flags = 0;
662 	int opts_type = 0;
663 	struct nlattr *a;
664 	int rem;
665 
666 	nla_for_each_nested(a, attr, rem) {
667 		int type = nla_type(a);
668 		int err;
669 
670 		if (type > OVS_TUNNEL_KEY_ATTR_MAX) {
671 			OVS_NLERR(log, "Tunnel attr %d out of range max %d",
672 				  type, OVS_TUNNEL_KEY_ATTR_MAX);
673 			return -EINVAL;
674 		}
675 
676 		if (!check_attr_len(nla_len(a),
677 				    ovs_tunnel_key_lens[type].len)) {
678 			OVS_NLERR(log, "Tunnel attr %d has unexpected len %d expected %d",
679 				  type, nla_len(a), ovs_tunnel_key_lens[type].len);
680 			return -EINVAL;
681 		}
682 
683 		switch (type) {
684 		case OVS_TUNNEL_KEY_ATTR_ID:
685 			SW_FLOW_KEY_PUT(match, tun_key.tun_id,
686 					nla_get_be64(a), is_mask);
687 			tun_flags |= TUNNEL_KEY;
688 			break;
689 		case OVS_TUNNEL_KEY_ATTR_IPV4_SRC:
690 			SW_FLOW_KEY_PUT(match, tun_key.u.ipv4.src,
691 					nla_get_in_addr(a), is_mask);
692 			ipv4 = true;
693 			break;
694 		case OVS_TUNNEL_KEY_ATTR_IPV4_DST:
695 			SW_FLOW_KEY_PUT(match, tun_key.u.ipv4.dst,
696 					nla_get_in_addr(a), is_mask);
697 			ipv4 = true;
698 			break;
699 		case OVS_TUNNEL_KEY_ATTR_IPV6_SRC:
700 			SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.src,
701 					nla_get_in6_addr(a), is_mask);
702 			ipv6 = true;
703 			break;
704 		case OVS_TUNNEL_KEY_ATTR_IPV6_DST:
705 			SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.dst,
706 					nla_get_in6_addr(a), is_mask);
707 			ipv6 = true;
708 			break;
709 		case OVS_TUNNEL_KEY_ATTR_TOS:
710 			SW_FLOW_KEY_PUT(match, tun_key.tos,
711 					nla_get_u8(a), is_mask);
712 			break;
713 		case OVS_TUNNEL_KEY_ATTR_TTL:
714 			SW_FLOW_KEY_PUT(match, tun_key.ttl,
715 					nla_get_u8(a), is_mask);
716 			ttl = true;
717 			break;
718 		case OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT:
719 			tun_flags |= TUNNEL_DONT_FRAGMENT;
720 			break;
721 		case OVS_TUNNEL_KEY_ATTR_CSUM:
722 			tun_flags |= TUNNEL_CSUM;
723 			break;
724 		case OVS_TUNNEL_KEY_ATTR_TP_SRC:
725 			SW_FLOW_KEY_PUT(match, tun_key.tp_src,
726 					nla_get_be16(a), is_mask);
727 			break;
728 		case OVS_TUNNEL_KEY_ATTR_TP_DST:
729 			SW_FLOW_KEY_PUT(match, tun_key.tp_dst,
730 					nla_get_be16(a), is_mask);
731 			break;
732 		case OVS_TUNNEL_KEY_ATTR_OAM:
733 			tun_flags |= TUNNEL_OAM;
734 			break;
735 		case OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS:
736 			if (opts_type) {
737 				OVS_NLERR(log, "Multiple metadata blocks provided");
738 				return -EINVAL;
739 			}
740 
741 			err = genev_tun_opt_from_nlattr(a, match, is_mask, log);
742 			if (err)
743 				return err;
744 
745 			tun_flags |= TUNNEL_GENEVE_OPT;
746 			opts_type = type;
747 			break;
748 		case OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS:
749 			if (opts_type) {
750 				OVS_NLERR(log, "Multiple metadata blocks provided");
751 				return -EINVAL;
752 			}
753 
754 			err = vxlan_tun_opt_from_nlattr(a, match, is_mask, log);
755 			if (err)
756 				return err;
757 
758 			tun_flags |= TUNNEL_VXLAN_OPT;
759 			opts_type = type;
760 			break;
761 		case OVS_TUNNEL_KEY_ATTR_PAD:
762 			break;
763 		case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS:
764 			if (opts_type) {
765 				OVS_NLERR(log, "Multiple metadata blocks provided");
766 				return -EINVAL;
767 			}
768 
769 			err = erspan_tun_opt_from_nlattr(a, match, is_mask,
770 							 log);
771 			if (err)
772 				return err;
773 
774 			tun_flags |= TUNNEL_ERSPAN_OPT;
775 			opts_type = type;
776 			break;
777 		case OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE:
778 			info_bridge_mode = true;
779 			ipv4 = true;
780 			break;
781 		default:
782 			OVS_NLERR(log, "Unknown IP tunnel attribute %d",
783 				  type);
784 			return -EINVAL;
785 		}
786 	}
787 
788 	SW_FLOW_KEY_PUT(match, tun_key.tun_flags, tun_flags, is_mask);
789 	if (is_mask)
790 		SW_FLOW_KEY_MEMSET_FIELD(match, tun_proto, 0xff, true);
791 	else
792 		SW_FLOW_KEY_PUT(match, tun_proto, ipv6 ? AF_INET6 : AF_INET,
793 				false);
794 
795 	if (rem > 0) {
796 		OVS_NLERR(log, "IP tunnel attribute has %d unknown bytes.",
797 			  rem);
798 		return -EINVAL;
799 	}
800 
801 	if (ipv4 && ipv6) {
802 		OVS_NLERR(log, "Mixed IPv4 and IPv6 tunnel attributes");
803 		return -EINVAL;
804 	}
805 
806 	if (!is_mask) {
807 		if (!ipv4 && !ipv6) {
808 			OVS_NLERR(log, "IP tunnel dst address not specified");
809 			return -EINVAL;
810 		}
811 		if (ipv4) {
812 			if (info_bridge_mode) {
813 				if (match->key->tun_key.u.ipv4.src ||
814 				    match->key->tun_key.u.ipv4.dst ||
815 				    match->key->tun_key.tp_src ||
816 				    match->key->tun_key.tp_dst ||
817 				    match->key->tun_key.ttl ||
818 				    match->key->tun_key.tos ||
819 				    tun_flags & ~TUNNEL_KEY) {
820 					OVS_NLERR(log, "IPv4 tun info is not correct");
821 					return -EINVAL;
822 				}
823 			} else if (!match->key->tun_key.u.ipv4.dst) {
824 				OVS_NLERR(log, "IPv4 tunnel dst address is zero");
825 				return -EINVAL;
826 			}
827 		}
828 		if (ipv6 && ipv6_addr_any(&match->key->tun_key.u.ipv6.dst)) {
829 			OVS_NLERR(log, "IPv6 tunnel dst address is zero");
830 			return -EINVAL;
831 		}
832 
833 		if (!ttl && !info_bridge_mode) {
834 			OVS_NLERR(log, "IP tunnel TTL not specified.");
835 			return -EINVAL;
836 		}
837 	}
838 
839 	return opts_type;
840 }
841 
842 static int vxlan_opt_to_nlattr(struct sk_buff *skb,
843 			       const void *tun_opts, int swkey_tun_opts_len)
844 {
845 	const struct vxlan_metadata *opts = tun_opts;
846 	struct nlattr *nla;
847 
848 	nla = nla_nest_start_noflag(skb, OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS);
849 	if (!nla)
850 		return -EMSGSIZE;
851 
852 	if (nla_put_u32(skb, OVS_VXLAN_EXT_GBP, opts->gbp) < 0)
853 		return -EMSGSIZE;
854 
855 	nla_nest_end(skb, nla);
856 	return 0;
857 }
858 
859 static int __ip_tun_to_nlattr(struct sk_buff *skb,
860 			      const struct ip_tunnel_key *output,
861 			      const void *tun_opts, int swkey_tun_opts_len,
862 			      unsigned short tun_proto, u8 mode)
863 {
864 	if (output->tun_flags & TUNNEL_KEY &&
865 	    nla_put_be64(skb, OVS_TUNNEL_KEY_ATTR_ID, output->tun_id,
866 			 OVS_TUNNEL_KEY_ATTR_PAD))
867 		return -EMSGSIZE;
868 
869 	if (mode & IP_TUNNEL_INFO_BRIDGE)
870 		return nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_IPV4_INFO_BRIDGE)
871 		       ? -EMSGSIZE : 0;
872 
873 	switch (tun_proto) {
874 	case AF_INET:
875 		if (output->u.ipv4.src &&
876 		    nla_put_in_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV4_SRC,
877 				    output->u.ipv4.src))
878 			return -EMSGSIZE;
879 		if (output->u.ipv4.dst &&
880 		    nla_put_in_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV4_DST,
881 				    output->u.ipv4.dst))
882 			return -EMSGSIZE;
883 		break;
884 	case AF_INET6:
885 		if (!ipv6_addr_any(&output->u.ipv6.src) &&
886 		    nla_put_in6_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV6_SRC,
887 				     &output->u.ipv6.src))
888 			return -EMSGSIZE;
889 		if (!ipv6_addr_any(&output->u.ipv6.dst) &&
890 		    nla_put_in6_addr(skb, OVS_TUNNEL_KEY_ATTR_IPV6_DST,
891 				     &output->u.ipv6.dst))
892 			return -EMSGSIZE;
893 		break;
894 	}
895 	if (output->tos &&
896 	    nla_put_u8(skb, OVS_TUNNEL_KEY_ATTR_TOS, output->tos))
897 		return -EMSGSIZE;
898 	if (nla_put_u8(skb, OVS_TUNNEL_KEY_ATTR_TTL, output->ttl))
899 		return -EMSGSIZE;
900 	if ((output->tun_flags & TUNNEL_DONT_FRAGMENT) &&
901 	    nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT))
902 		return -EMSGSIZE;
903 	if ((output->tun_flags & TUNNEL_CSUM) &&
904 	    nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_CSUM))
905 		return -EMSGSIZE;
906 	if (output->tp_src &&
907 	    nla_put_be16(skb, OVS_TUNNEL_KEY_ATTR_TP_SRC, output->tp_src))
908 		return -EMSGSIZE;
909 	if (output->tp_dst &&
910 	    nla_put_be16(skb, OVS_TUNNEL_KEY_ATTR_TP_DST, output->tp_dst))
911 		return -EMSGSIZE;
912 	if ((output->tun_flags & TUNNEL_OAM) &&
913 	    nla_put_flag(skb, OVS_TUNNEL_KEY_ATTR_OAM))
914 		return -EMSGSIZE;
915 	if (swkey_tun_opts_len) {
916 		if (output->tun_flags & TUNNEL_GENEVE_OPT &&
917 		    nla_put(skb, OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS,
918 			    swkey_tun_opts_len, tun_opts))
919 			return -EMSGSIZE;
920 		else if (output->tun_flags & TUNNEL_VXLAN_OPT &&
921 			 vxlan_opt_to_nlattr(skb, tun_opts, swkey_tun_opts_len))
922 			return -EMSGSIZE;
923 		else if (output->tun_flags & TUNNEL_ERSPAN_OPT &&
924 			 nla_put(skb, OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS,
925 				 swkey_tun_opts_len, tun_opts))
926 			return -EMSGSIZE;
927 	}
928 
929 	return 0;
930 }
931 
932 static int ip_tun_to_nlattr(struct sk_buff *skb,
933 			    const struct ip_tunnel_key *output,
934 			    const void *tun_opts, int swkey_tun_opts_len,
935 			    unsigned short tun_proto, u8 mode)
936 {
937 	struct nlattr *nla;
938 	int err;
939 
940 	nla = nla_nest_start_noflag(skb, OVS_KEY_ATTR_TUNNEL);
941 	if (!nla)
942 		return -EMSGSIZE;
943 
944 	err = __ip_tun_to_nlattr(skb, output, tun_opts, swkey_tun_opts_len,
945 				 tun_proto, mode);
946 	if (err)
947 		return err;
948 
949 	nla_nest_end(skb, nla);
950 	return 0;
951 }
952 
953 int ovs_nla_put_tunnel_info(struct sk_buff *skb,
954 			    struct ip_tunnel_info *tun_info)
955 {
956 	return __ip_tun_to_nlattr(skb, &tun_info->key,
957 				  ip_tunnel_info_opts(tun_info),
958 				  tun_info->options_len,
959 				  ip_tunnel_info_af(tun_info), tun_info->mode);
960 }
961 
962 static int encode_vlan_from_nlattrs(struct sw_flow_match *match,
963 				    const struct nlattr *a[],
964 				    bool is_mask, bool inner)
965 {
966 	__be16 tci = 0;
967 	__be16 tpid = 0;
968 
969 	if (a[OVS_KEY_ATTR_VLAN])
970 		tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
971 
972 	if (a[OVS_KEY_ATTR_ETHERTYPE])
973 		tpid = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]);
974 
975 	if (likely(!inner)) {
976 		SW_FLOW_KEY_PUT(match, eth.vlan.tpid, tpid, is_mask);
977 		SW_FLOW_KEY_PUT(match, eth.vlan.tci, tci, is_mask);
978 	} else {
979 		SW_FLOW_KEY_PUT(match, eth.cvlan.tpid, tpid, is_mask);
980 		SW_FLOW_KEY_PUT(match, eth.cvlan.tci, tci, is_mask);
981 	}
982 	return 0;
983 }
984 
985 static int validate_vlan_from_nlattrs(const struct sw_flow_match *match,
986 				      u64 key_attrs, bool inner,
987 				      const struct nlattr **a, bool log)
988 {
989 	__be16 tci = 0;
990 
991 	if (!((key_attrs & (1 << OVS_KEY_ATTR_ETHERNET)) &&
992 	      (key_attrs & (1 << OVS_KEY_ATTR_ETHERTYPE)) &&
993 	       eth_type_vlan(nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE])))) {
994 		/* Not a VLAN. */
995 		return 0;
996 	}
997 
998 	if (!((key_attrs & (1 << OVS_KEY_ATTR_VLAN)) &&
999 	      (key_attrs & (1 << OVS_KEY_ATTR_ENCAP)))) {
1000 		OVS_NLERR(log, "Invalid %s frame", (inner) ? "C-VLAN" : "VLAN");
1001 		return -EINVAL;
1002 	}
1003 
1004 	if (a[OVS_KEY_ATTR_VLAN])
1005 		tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
1006 
1007 	if (!(tci & htons(VLAN_CFI_MASK))) {
1008 		if (tci) {
1009 			OVS_NLERR(log, "%s TCI does not have VLAN_CFI_MASK bit set.",
1010 				  (inner) ? "C-VLAN" : "VLAN");
1011 			return -EINVAL;
1012 		} else if (nla_len(a[OVS_KEY_ATTR_ENCAP])) {
1013 			/* Corner case for truncated VLAN header. */
1014 			OVS_NLERR(log, "Truncated %s header has non-zero encap attribute.",
1015 				  (inner) ? "C-VLAN" : "VLAN");
1016 			return -EINVAL;
1017 		}
1018 	}
1019 
1020 	return 1;
1021 }
1022 
1023 static int validate_vlan_mask_from_nlattrs(const struct sw_flow_match *match,
1024 					   u64 key_attrs, bool inner,
1025 					   const struct nlattr **a, bool log)
1026 {
1027 	__be16 tci = 0;
1028 	__be16 tpid = 0;
1029 	bool encap_valid = !!(match->key->eth.vlan.tci &
1030 			      htons(VLAN_CFI_MASK));
1031 	bool i_encap_valid = !!(match->key->eth.cvlan.tci &
1032 				htons(VLAN_CFI_MASK));
1033 
1034 	if (!(key_attrs & (1 << OVS_KEY_ATTR_ENCAP))) {
1035 		/* Not a VLAN. */
1036 		return 0;
1037 	}
1038 
1039 	if ((!inner && !encap_valid) || (inner && !i_encap_valid)) {
1040 		OVS_NLERR(log, "Encap mask attribute is set for non-%s frame.",
1041 			  (inner) ? "C-VLAN" : "VLAN");
1042 		return -EINVAL;
1043 	}
1044 
1045 	if (a[OVS_KEY_ATTR_VLAN])
1046 		tci = nla_get_be16(a[OVS_KEY_ATTR_VLAN]);
1047 
1048 	if (a[OVS_KEY_ATTR_ETHERTYPE])
1049 		tpid = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]);
1050 
1051 	if (tpid != htons(0xffff)) {
1052 		OVS_NLERR(log, "Must have an exact match on %s TPID (mask=%x).",
1053 			  (inner) ? "C-VLAN" : "VLAN", ntohs(tpid));
1054 		return -EINVAL;
1055 	}
1056 	if (!(tci & htons(VLAN_CFI_MASK))) {
1057 		OVS_NLERR(log, "%s TCI mask does not have exact match for VLAN_CFI_MASK bit.",
1058 			  (inner) ? "C-VLAN" : "VLAN");
1059 		return -EINVAL;
1060 	}
1061 
1062 	return 1;
1063 }
1064 
1065 static int __parse_vlan_from_nlattrs(struct sw_flow_match *match,
1066 				     u64 *key_attrs, bool inner,
1067 				     const struct nlattr **a, bool is_mask,
1068 				     bool log)
1069 {
1070 	int err;
1071 	const struct nlattr *encap;
1072 
1073 	if (!is_mask)
1074 		err = validate_vlan_from_nlattrs(match, *key_attrs, inner,
1075 						 a, log);
1076 	else
1077 		err = validate_vlan_mask_from_nlattrs(match, *key_attrs, inner,
1078 						      a, log);
1079 	if (err <= 0)
1080 		return err;
1081 
1082 	err = encode_vlan_from_nlattrs(match, a, is_mask, inner);
1083 	if (err)
1084 		return err;
1085 
1086 	*key_attrs &= ~(1 << OVS_KEY_ATTR_ENCAP);
1087 	*key_attrs &= ~(1 << OVS_KEY_ATTR_VLAN);
1088 	*key_attrs &= ~(1 << OVS_KEY_ATTR_ETHERTYPE);
1089 
1090 	encap = a[OVS_KEY_ATTR_ENCAP];
1091 
1092 	if (!is_mask)
1093 		err = parse_flow_nlattrs(encap, a, key_attrs, log);
1094 	else
1095 		err = parse_flow_mask_nlattrs(encap, a, key_attrs, log);
1096 
1097 	return err;
1098 }
1099 
1100 static int parse_vlan_from_nlattrs(struct sw_flow_match *match,
1101 				   u64 *key_attrs, const struct nlattr **a,
1102 				   bool is_mask, bool log)
1103 {
1104 	int err;
1105 	bool encap_valid = false;
1106 
1107 	err = __parse_vlan_from_nlattrs(match, key_attrs, false, a,
1108 					is_mask, log);
1109 	if (err)
1110 		return err;
1111 
1112 	encap_valid = !!(match->key->eth.vlan.tci & htons(VLAN_CFI_MASK));
1113 	if (encap_valid) {
1114 		err = __parse_vlan_from_nlattrs(match, key_attrs, true, a,
1115 						is_mask, log);
1116 		if (err)
1117 			return err;
1118 	}
1119 
1120 	return 0;
1121 }
1122 
1123 static int parse_eth_type_from_nlattrs(struct sw_flow_match *match,
1124 				       u64 *attrs, const struct nlattr **a,
1125 				       bool is_mask, bool log)
1126 {
1127 	__be16 eth_type;
1128 
1129 	eth_type = nla_get_be16(a[OVS_KEY_ATTR_ETHERTYPE]);
1130 	if (is_mask) {
1131 		/* Always exact match EtherType. */
1132 		eth_type = htons(0xffff);
1133 	} else if (!eth_proto_is_802_3(eth_type)) {
1134 		OVS_NLERR(log, "EtherType %x is less than min %x",
1135 				ntohs(eth_type), ETH_P_802_3_MIN);
1136 		return -EINVAL;
1137 	}
1138 
1139 	SW_FLOW_KEY_PUT(match, eth.type, eth_type, is_mask);
1140 	*attrs &= ~(1 << OVS_KEY_ATTR_ETHERTYPE);
1141 	return 0;
1142 }
1143 
1144 static int metadata_from_nlattrs(struct net *net, struct sw_flow_match *match,
1145 				 u64 *attrs, const struct nlattr **a,
1146 				 bool is_mask, bool log)
1147 {
1148 	u8 mac_proto = MAC_PROTO_ETHERNET;
1149 
1150 	if (*attrs & (1 << OVS_KEY_ATTR_DP_HASH)) {
1151 		u32 hash_val = nla_get_u32(a[OVS_KEY_ATTR_DP_HASH]);
1152 
1153 		SW_FLOW_KEY_PUT(match, ovs_flow_hash, hash_val, is_mask);
1154 		*attrs &= ~(1 << OVS_KEY_ATTR_DP_HASH);
1155 	}
1156 
1157 	if (*attrs & (1 << OVS_KEY_ATTR_RECIRC_ID)) {
1158 		u32 recirc_id = nla_get_u32(a[OVS_KEY_ATTR_RECIRC_ID]);
1159 
1160 		SW_FLOW_KEY_PUT(match, recirc_id, recirc_id, is_mask);
1161 		*attrs &= ~(1 << OVS_KEY_ATTR_RECIRC_ID);
1162 	}
1163 
1164 	if (*attrs & (1 << OVS_KEY_ATTR_PRIORITY)) {
1165 		SW_FLOW_KEY_PUT(match, phy.priority,
1166 			  nla_get_u32(a[OVS_KEY_ATTR_PRIORITY]), is_mask);
1167 		*attrs &= ~(1 << OVS_KEY_ATTR_PRIORITY);
1168 	}
1169 
1170 	if (*attrs & (1 << OVS_KEY_ATTR_IN_PORT)) {
1171 		u32 in_port = nla_get_u32(a[OVS_KEY_ATTR_IN_PORT]);
1172 
1173 		if (is_mask) {
1174 			in_port = 0xffffffff; /* Always exact match in_port. */
1175 		} else if (in_port >= DP_MAX_PORTS) {
1176 			OVS_NLERR(log, "Port %d exceeds max allowable %d",
1177 				  in_port, DP_MAX_PORTS);
1178 			return -EINVAL;
1179 		}
1180 
1181 		SW_FLOW_KEY_PUT(match, phy.in_port, in_port, is_mask);
1182 		*attrs &= ~(1 << OVS_KEY_ATTR_IN_PORT);
1183 	} else if (!is_mask) {
1184 		SW_FLOW_KEY_PUT(match, phy.in_port, DP_MAX_PORTS, is_mask);
1185 	}
1186 
1187 	if (*attrs & (1 << OVS_KEY_ATTR_SKB_MARK)) {
1188 		uint32_t mark = nla_get_u32(a[OVS_KEY_ATTR_SKB_MARK]);
1189 
1190 		SW_FLOW_KEY_PUT(match, phy.skb_mark, mark, is_mask);
1191 		*attrs &= ~(1 << OVS_KEY_ATTR_SKB_MARK);
1192 	}
1193 	if (*attrs & (1 << OVS_KEY_ATTR_TUNNEL)) {
1194 		if (ip_tun_from_nlattr(a[OVS_KEY_ATTR_TUNNEL], match,
1195 				       is_mask, log) < 0)
1196 			return -EINVAL;
1197 		*attrs &= ~(1 << OVS_KEY_ATTR_TUNNEL);
1198 	}
1199 
1200 	if (*attrs & (1 << OVS_KEY_ATTR_CT_STATE) &&
1201 	    ovs_ct_verify(net, OVS_KEY_ATTR_CT_STATE)) {
1202 		u32 ct_state = nla_get_u32(a[OVS_KEY_ATTR_CT_STATE]);
1203 
1204 		if (ct_state & ~CT_SUPPORTED_MASK) {
1205 			OVS_NLERR(log, "ct_state flags %08x unsupported",
1206 				  ct_state);
1207 			return -EINVAL;
1208 		}
1209 
1210 		SW_FLOW_KEY_PUT(match, ct_state, ct_state, is_mask);
1211 		*attrs &= ~(1ULL << OVS_KEY_ATTR_CT_STATE);
1212 	}
1213 	if (*attrs & (1 << OVS_KEY_ATTR_CT_ZONE) &&
1214 	    ovs_ct_verify(net, OVS_KEY_ATTR_CT_ZONE)) {
1215 		u16 ct_zone = nla_get_u16(a[OVS_KEY_ATTR_CT_ZONE]);
1216 
1217 		SW_FLOW_KEY_PUT(match, ct_zone, ct_zone, is_mask);
1218 		*attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ZONE);
1219 	}
1220 	if (*attrs & (1 << OVS_KEY_ATTR_CT_MARK) &&
1221 	    ovs_ct_verify(net, OVS_KEY_ATTR_CT_MARK)) {
1222 		u32 mark = nla_get_u32(a[OVS_KEY_ATTR_CT_MARK]);
1223 
1224 		SW_FLOW_KEY_PUT(match, ct.mark, mark, is_mask);
1225 		*attrs &= ~(1ULL << OVS_KEY_ATTR_CT_MARK);
1226 	}
1227 	if (*attrs & (1 << OVS_KEY_ATTR_CT_LABELS) &&
1228 	    ovs_ct_verify(net, OVS_KEY_ATTR_CT_LABELS)) {
1229 		const struct ovs_key_ct_labels *cl;
1230 
1231 		cl = nla_data(a[OVS_KEY_ATTR_CT_LABELS]);
1232 		SW_FLOW_KEY_MEMCPY(match, ct.labels, cl->ct_labels,
1233 				   sizeof(*cl), is_mask);
1234 		*attrs &= ~(1ULL << OVS_KEY_ATTR_CT_LABELS);
1235 	}
1236 	if (*attrs & (1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4)) {
1237 		const struct ovs_key_ct_tuple_ipv4 *ct;
1238 
1239 		ct = nla_data(a[OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4]);
1240 
1241 		SW_FLOW_KEY_PUT(match, ipv4.ct_orig.src, ct->ipv4_src, is_mask);
1242 		SW_FLOW_KEY_PUT(match, ipv4.ct_orig.dst, ct->ipv4_dst, is_mask);
1243 		SW_FLOW_KEY_PUT(match, ct.orig_tp.src, ct->src_port, is_mask);
1244 		SW_FLOW_KEY_PUT(match, ct.orig_tp.dst, ct->dst_port, is_mask);
1245 		SW_FLOW_KEY_PUT(match, ct_orig_proto, ct->ipv4_proto, is_mask);
1246 		*attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4);
1247 	}
1248 	if (*attrs & (1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6)) {
1249 		const struct ovs_key_ct_tuple_ipv6 *ct;
1250 
1251 		ct = nla_data(a[OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6]);
1252 
1253 		SW_FLOW_KEY_MEMCPY(match, ipv6.ct_orig.src, &ct->ipv6_src,
1254 				   sizeof(match->key->ipv6.ct_orig.src),
1255 				   is_mask);
1256 		SW_FLOW_KEY_MEMCPY(match, ipv6.ct_orig.dst, &ct->ipv6_dst,
1257 				   sizeof(match->key->ipv6.ct_orig.dst),
1258 				   is_mask);
1259 		SW_FLOW_KEY_PUT(match, ct.orig_tp.src, ct->src_port, is_mask);
1260 		SW_FLOW_KEY_PUT(match, ct.orig_tp.dst, ct->dst_port, is_mask);
1261 		SW_FLOW_KEY_PUT(match, ct_orig_proto, ct->ipv6_proto, is_mask);
1262 		*attrs &= ~(1ULL << OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6);
1263 	}
1264 
1265 	/* For layer 3 packets the Ethernet type is provided
1266 	 * and treated as metadata but no MAC addresses are provided.
1267 	 */
1268 	if (!(*attrs & (1ULL << OVS_KEY_ATTR_ETHERNET)) &&
1269 	    (*attrs & (1ULL << OVS_KEY_ATTR_ETHERTYPE)))
1270 		mac_proto = MAC_PROTO_NONE;
1271 
1272 	/* Always exact match mac_proto */
1273 	SW_FLOW_KEY_PUT(match, mac_proto, is_mask ? 0xff : mac_proto, is_mask);
1274 
1275 	if (mac_proto == MAC_PROTO_NONE)
1276 		return parse_eth_type_from_nlattrs(match, attrs, a, is_mask,
1277 						   log);
1278 
1279 	return 0;
1280 }
1281 
1282 int nsh_hdr_from_nlattr(const struct nlattr *attr,
1283 			struct nshhdr *nh, size_t size)
1284 {
1285 	struct nlattr *a;
1286 	int rem;
1287 	u8 flags = 0;
1288 	u8 ttl = 0;
1289 	int mdlen = 0;
1290 
1291 	/* validate_nsh has check this, so we needn't do duplicate check here
1292 	 */
1293 	if (size < NSH_BASE_HDR_LEN)
1294 		return -ENOBUFS;
1295 
1296 	nla_for_each_nested(a, attr, rem) {
1297 		int type = nla_type(a);
1298 
1299 		switch (type) {
1300 		case OVS_NSH_KEY_ATTR_BASE: {
1301 			const struct ovs_nsh_key_base *base = nla_data(a);
1302 
1303 			flags = base->flags;
1304 			ttl = base->ttl;
1305 			nh->np = base->np;
1306 			nh->mdtype = base->mdtype;
1307 			nh->path_hdr = base->path_hdr;
1308 			break;
1309 		}
1310 		case OVS_NSH_KEY_ATTR_MD1:
1311 			mdlen = nla_len(a);
1312 			if (mdlen > size - NSH_BASE_HDR_LEN)
1313 				return -ENOBUFS;
1314 			memcpy(&nh->md1, nla_data(a), mdlen);
1315 			break;
1316 
1317 		case OVS_NSH_KEY_ATTR_MD2:
1318 			mdlen = nla_len(a);
1319 			if (mdlen > size - NSH_BASE_HDR_LEN)
1320 				return -ENOBUFS;
1321 			memcpy(&nh->md2, nla_data(a), mdlen);
1322 			break;
1323 
1324 		default:
1325 			return -EINVAL;
1326 		}
1327 	}
1328 
1329 	/* nsh header length  = NSH_BASE_HDR_LEN + mdlen */
1330 	nh->ver_flags_ttl_len = 0;
1331 	nsh_set_flags_ttl_len(nh, flags, ttl, NSH_BASE_HDR_LEN + mdlen);
1332 
1333 	return 0;
1334 }
1335 
1336 int nsh_key_from_nlattr(const struct nlattr *attr,
1337 			struct ovs_key_nsh *nsh, struct ovs_key_nsh *nsh_mask)
1338 {
1339 	struct nlattr *a;
1340 	int rem;
1341 
1342 	/* validate_nsh has check this, so we needn't do duplicate check here
1343 	 */
1344 	nla_for_each_nested(a, attr, rem) {
1345 		int type = nla_type(a);
1346 
1347 		switch (type) {
1348 		case OVS_NSH_KEY_ATTR_BASE: {
1349 			const struct ovs_nsh_key_base *base = nla_data(a);
1350 			const struct ovs_nsh_key_base *base_mask = base + 1;
1351 
1352 			nsh->base = *base;
1353 			nsh_mask->base = *base_mask;
1354 			break;
1355 		}
1356 		case OVS_NSH_KEY_ATTR_MD1: {
1357 			const struct ovs_nsh_key_md1 *md1 = nla_data(a);
1358 			const struct ovs_nsh_key_md1 *md1_mask = md1 + 1;
1359 
1360 			memcpy(nsh->context, md1->context, sizeof(*md1));
1361 			memcpy(nsh_mask->context, md1_mask->context,
1362 			       sizeof(*md1_mask));
1363 			break;
1364 		}
1365 		case OVS_NSH_KEY_ATTR_MD2:
1366 			/* Not supported yet */
1367 			return -ENOTSUPP;
1368 		default:
1369 			return -EINVAL;
1370 		}
1371 	}
1372 
1373 	return 0;
1374 }
1375 
1376 static int nsh_key_put_from_nlattr(const struct nlattr *attr,
1377 				   struct sw_flow_match *match, bool is_mask,
1378 				   bool is_push_nsh, bool log)
1379 {
1380 	struct nlattr *a;
1381 	int rem;
1382 	bool has_base = false;
1383 	bool has_md1 = false;
1384 	bool has_md2 = false;
1385 	u8 mdtype = 0;
1386 	int mdlen = 0;
1387 
1388 	if (WARN_ON(is_push_nsh && is_mask))
1389 		return -EINVAL;
1390 
1391 	nla_for_each_nested(a, attr, rem) {
1392 		int type = nla_type(a);
1393 		int i;
1394 
1395 		if (type > OVS_NSH_KEY_ATTR_MAX) {
1396 			OVS_NLERR(log, "nsh attr %d is out of range max %d",
1397 				  type, OVS_NSH_KEY_ATTR_MAX);
1398 			return -EINVAL;
1399 		}
1400 
1401 		if (!check_attr_len(nla_len(a),
1402 				    ovs_nsh_key_attr_lens[type].len)) {
1403 			OVS_NLERR(
1404 			    log,
1405 			    "nsh attr %d has unexpected len %d expected %d",
1406 			    type,
1407 			    nla_len(a),
1408 			    ovs_nsh_key_attr_lens[type].len
1409 			);
1410 			return -EINVAL;
1411 		}
1412 
1413 		switch (type) {
1414 		case OVS_NSH_KEY_ATTR_BASE: {
1415 			const struct ovs_nsh_key_base *base = nla_data(a);
1416 
1417 			has_base = true;
1418 			mdtype = base->mdtype;
1419 			SW_FLOW_KEY_PUT(match, nsh.base.flags,
1420 					base->flags, is_mask);
1421 			SW_FLOW_KEY_PUT(match, nsh.base.ttl,
1422 					base->ttl, is_mask);
1423 			SW_FLOW_KEY_PUT(match, nsh.base.mdtype,
1424 					base->mdtype, is_mask);
1425 			SW_FLOW_KEY_PUT(match, nsh.base.np,
1426 					base->np, is_mask);
1427 			SW_FLOW_KEY_PUT(match, nsh.base.path_hdr,
1428 					base->path_hdr, is_mask);
1429 			break;
1430 		}
1431 		case OVS_NSH_KEY_ATTR_MD1: {
1432 			const struct ovs_nsh_key_md1 *md1 = nla_data(a);
1433 
1434 			has_md1 = true;
1435 			for (i = 0; i < NSH_MD1_CONTEXT_SIZE; i++)
1436 				SW_FLOW_KEY_PUT(match, nsh.context[i],
1437 						md1->context[i], is_mask);
1438 			break;
1439 		}
1440 		case OVS_NSH_KEY_ATTR_MD2:
1441 			if (!is_push_nsh) /* Not supported MD type 2 yet */
1442 				return -ENOTSUPP;
1443 
1444 			has_md2 = true;
1445 			mdlen = nla_len(a);
1446 			if (mdlen > NSH_CTX_HDRS_MAX_LEN || mdlen <= 0) {
1447 				OVS_NLERR(
1448 				    log,
1449 				    "Invalid MD length %d for MD type %d",
1450 				    mdlen,
1451 				    mdtype
1452 				);
1453 				return -EINVAL;
1454 			}
1455 			break;
1456 		default:
1457 			OVS_NLERR(log, "Unknown nsh attribute %d",
1458 				  type);
1459 			return -EINVAL;
1460 		}
1461 	}
1462 
1463 	if (rem > 0) {
1464 		OVS_NLERR(log, "nsh attribute has %d unknown bytes.", rem);
1465 		return -EINVAL;
1466 	}
1467 
1468 	if (has_md1 && has_md2) {
1469 		OVS_NLERR(
1470 		    1,
1471 		    "invalid nsh attribute: md1 and md2 are exclusive."
1472 		);
1473 		return -EINVAL;
1474 	}
1475 
1476 	if (!is_mask) {
1477 		if ((has_md1 && mdtype != NSH_M_TYPE1) ||
1478 		    (has_md2 && mdtype != NSH_M_TYPE2)) {
1479 			OVS_NLERR(1, "nsh attribute has unmatched MD type %d.",
1480 				  mdtype);
1481 			return -EINVAL;
1482 		}
1483 
1484 		if (is_push_nsh &&
1485 		    (!has_base || (!has_md1 && !has_md2))) {
1486 			OVS_NLERR(
1487 			    1,
1488 			    "push_nsh: missing base or metadata attributes"
1489 			);
1490 			return -EINVAL;
1491 		}
1492 	}
1493 
1494 	return 0;
1495 }
1496 
1497 static int ovs_key_from_nlattrs(struct net *net, struct sw_flow_match *match,
1498 				u64 attrs, const struct nlattr **a,
1499 				bool is_mask, bool log)
1500 {
1501 	int err;
1502 
1503 	err = metadata_from_nlattrs(net, match, &attrs, a, is_mask, log);
1504 	if (err)
1505 		return err;
1506 
1507 	if (attrs & (1 << OVS_KEY_ATTR_ETHERNET)) {
1508 		const struct ovs_key_ethernet *eth_key;
1509 
1510 		eth_key = nla_data(a[OVS_KEY_ATTR_ETHERNET]);
1511 		SW_FLOW_KEY_MEMCPY(match, eth.src,
1512 				eth_key->eth_src, ETH_ALEN, is_mask);
1513 		SW_FLOW_KEY_MEMCPY(match, eth.dst,
1514 				eth_key->eth_dst, ETH_ALEN, is_mask);
1515 		attrs &= ~(1 << OVS_KEY_ATTR_ETHERNET);
1516 
1517 		if (attrs & (1 << OVS_KEY_ATTR_VLAN)) {
1518 			/* VLAN attribute is always parsed before getting here since it
1519 			 * may occur multiple times.
1520 			 */
1521 			OVS_NLERR(log, "VLAN attribute unexpected.");
1522 			return -EINVAL;
1523 		}
1524 
1525 		if (attrs & (1 << OVS_KEY_ATTR_ETHERTYPE)) {
1526 			err = parse_eth_type_from_nlattrs(match, &attrs, a, is_mask,
1527 							  log);
1528 			if (err)
1529 				return err;
1530 		} else if (!is_mask) {
1531 			SW_FLOW_KEY_PUT(match, eth.type, htons(ETH_P_802_2), is_mask);
1532 		}
1533 	} else if (!match->key->eth.type) {
1534 		OVS_NLERR(log, "Either Ethernet header or EtherType is required.");
1535 		return -EINVAL;
1536 	}
1537 
1538 	if (attrs & (1 << OVS_KEY_ATTR_IPV4)) {
1539 		const struct ovs_key_ipv4 *ipv4_key;
1540 
1541 		ipv4_key = nla_data(a[OVS_KEY_ATTR_IPV4]);
1542 		if (!is_mask && ipv4_key->ipv4_frag > OVS_FRAG_TYPE_MAX) {
1543 			OVS_NLERR(log, "IPv4 frag type %d is out of range max %d",
1544 				  ipv4_key->ipv4_frag, OVS_FRAG_TYPE_MAX);
1545 			return -EINVAL;
1546 		}
1547 		SW_FLOW_KEY_PUT(match, ip.proto,
1548 				ipv4_key->ipv4_proto, is_mask);
1549 		SW_FLOW_KEY_PUT(match, ip.tos,
1550 				ipv4_key->ipv4_tos, is_mask);
1551 		SW_FLOW_KEY_PUT(match, ip.ttl,
1552 				ipv4_key->ipv4_ttl, is_mask);
1553 		SW_FLOW_KEY_PUT(match, ip.frag,
1554 				ipv4_key->ipv4_frag, is_mask);
1555 		SW_FLOW_KEY_PUT(match, ipv4.addr.src,
1556 				ipv4_key->ipv4_src, is_mask);
1557 		SW_FLOW_KEY_PUT(match, ipv4.addr.dst,
1558 				ipv4_key->ipv4_dst, is_mask);
1559 		attrs &= ~(1 << OVS_KEY_ATTR_IPV4);
1560 	}
1561 
1562 	if (attrs & (1 << OVS_KEY_ATTR_IPV6)) {
1563 		const struct ovs_key_ipv6 *ipv6_key;
1564 
1565 		ipv6_key = nla_data(a[OVS_KEY_ATTR_IPV6]);
1566 		if (!is_mask && ipv6_key->ipv6_frag > OVS_FRAG_TYPE_MAX) {
1567 			OVS_NLERR(log, "IPv6 frag type %d is out of range max %d",
1568 				  ipv6_key->ipv6_frag, OVS_FRAG_TYPE_MAX);
1569 			return -EINVAL;
1570 		}
1571 
1572 		if (!is_mask && ipv6_key->ipv6_label & htonl(0xFFF00000)) {
1573 			OVS_NLERR(log, "IPv6 flow label %x is out of range (max=%x)",
1574 				  ntohl(ipv6_key->ipv6_label), (1 << 20) - 1);
1575 			return -EINVAL;
1576 		}
1577 
1578 		SW_FLOW_KEY_PUT(match, ipv6.label,
1579 				ipv6_key->ipv6_label, is_mask);
1580 		SW_FLOW_KEY_PUT(match, ip.proto,
1581 				ipv6_key->ipv6_proto, is_mask);
1582 		SW_FLOW_KEY_PUT(match, ip.tos,
1583 				ipv6_key->ipv6_tclass, is_mask);
1584 		SW_FLOW_KEY_PUT(match, ip.ttl,
1585 				ipv6_key->ipv6_hlimit, is_mask);
1586 		SW_FLOW_KEY_PUT(match, ip.frag,
1587 				ipv6_key->ipv6_frag, is_mask);
1588 		SW_FLOW_KEY_MEMCPY(match, ipv6.addr.src,
1589 				ipv6_key->ipv6_src,
1590 				sizeof(match->key->ipv6.addr.src),
1591 				is_mask);
1592 		SW_FLOW_KEY_MEMCPY(match, ipv6.addr.dst,
1593 				ipv6_key->ipv6_dst,
1594 				sizeof(match->key->ipv6.addr.dst),
1595 				is_mask);
1596 
1597 		attrs &= ~(1 << OVS_KEY_ATTR_IPV6);
1598 	}
1599 
1600 	if (attrs & (1 << OVS_KEY_ATTR_ARP)) {
1601 		const struct ovs_key_arp *arp_key;
1602 
1603 		arp_key = nla_data(a[OVS_KEY_ATTR_ARP]);
1604 		if (!is_mask && (arp_key->arp_op & htons(0xff00))) {
1605 			OVS_NLERR(log, "Unknown ARP opcode (opcode=%d).",
1606 				  arp_key->arp_op);
1607 			return -EINVAL;
1608 		}
1609 
1610 		SW_FLOW_KEY_PUT(match, ipv4.addr.src,
1611 				arp_key->arp_sip, is_mask);
1612 		SW_FLOW_KEY_PUT(match, ipv4.addr.dst,
1613 			arp_key->arp_tip, is_mask);
1614 		SW_FLOW_KEY_PUT(match, ip.proto,
1615 				ntohs(arp_key->arp_op), is_mask);
1616 		SW_FLOW_KEY_MEMCPY(match, ipv4.arp.sha,
1617 				arp_key->arp_sha, ETH_ALEN, is_mask);
1618 		SW_FLOW_KEY_MEMCPY(match, ipv4.arp.tha,
1619 				arp_key->arp_tha, ETH_ALEN, is_mask);
1620 
1621 		attrs &= ~(1 << OVS_KEY_ATTR_ARP);
1622 	}
1623 
1624 	if (attrs & (1 << OVS_KEY_ATTR_NSH)) {
1625 		if (nsh_key_put_from_nlattr(a[OVS_KEY_ATTR_NSH], match,
1626 					    is_mask, false, log) < 0)
1627 			return -EINVAL;
1628 		attrs &= ~(1 << OVS_KEY_ATTR_NSH);
1629 	}
1630 
1631 	if (attrs & (1 << OVS_KEY_ATTR_MPLS)) {
1632 		const struct ovs_key_mpls *mpls_key;
1633 		u32 hdr_len;
1634 		u32 label_count, label_count_mask, i;
1635 
1636 		mpls_key = nla_data(a[OVS_KEY_ATTR_MPLS]);
1637 		hdr_len = nla_len(a[OVS_KEY_ATTR_MPLS]);
1638 		label_count = hdr_len / sizeof(struct ovs_key_mpls);
1639 
1640 		if (label_count == 0 || label_count > MPLS_LABEL_DEPTH ||
1641 		    hdr_len % sizeof(struct ovs_key_mpls))
1642 			return -EINVAL;
1643 
1644 		label_count_mask =  GENMASK(label_count - 1, 0);
1645 
1646 		for (i = 0 ; i < label_count; i++)
1647 			SW_FLOW_KEY_PUT(match, mpls.lse[i],
1648 					mpls_key[i].mpls_lse, is_mask);
1649 
1650 		SW_FLOW_KEY_PUT(match, mpls.num_labels_mask,
1651 				label_count_mask, is_mask);
1652 
1653 		attrs &= ~(1 << OVS_KEY_ATTR_MPLS);
1654 	 }
1655 
1656 	if (attrs & (1 << OVS_KEY_ATTR_TCP)) {
1657 		const struct ovs_key_tcp *tcp_key;
1658 
1659 		tcp_key = nla_data(a[OVS_KEY_ATTR_TCP]);
1660 		SW_FLOW_KEY_PUT(match, tp.src, tcp_key->tcp_src, is_mask);
1661 		SW_FLOW_KEY_PUT(match, tp.dst, tcp_key->tcp_dst, is_mask);
1662 		attrs &= ~(1 << OVS_KEY_ATTR_TCP);
1663 	}
1664 
1665 	if (attrs & (1 << OVS_KEY_ATTR_TCP_FLAGS)) {
1666 		SW_FLOW_KEY_PUT(match, tp.flags,
1667 				nla_get_be16(a[OVS_KEY_ATTR_TCP_FLAGS]),
1668 				is_mask);
1669 		attrs &= ~(1 << OVS_KEY_ATTR_TCP_FLAGS);
1670 	}
1671 
1672 	if (attrs & (1 << OVS_KEY_ATTR_UDP)) {
1673 		const struct ovs_key_udp *udp_key;
1674 
1675 		udp_key = nla_data(a[OVS_KEY_ATTR_UDP]);
1676 		SW_FLOW_KEY_PUT(match, tp.src, udp_key->udp_src, is_mask);
1677 		SW_FLOW_KEY_PUT(match, tp.dst, udp_key->udp_dst, is_mask);
1678 		attrs &= ~(1 << OVS_KEY_ATTR_UDP);
1679 	}
1680 
1681 	if (attrs & (1 << OVS_KEY_ATTR_SCTP)) {
1682 		const struct ovs_key_sctp *sctp_key;
1683 
1684 		sctp_key = nla_data(a[OVS_KEY_ATTR_SCTP]);
1685 		SW_FLOW_KEY_PUT(match, tp.src, sctp_key->sctp_src, is_mask);
1686 		SW_FLOW_KEY_PUT(match, tp.dst, sctp_key->sctp_dst, is_mask);
1687 		attrs &= ~(1 << OVS_KEY_ATTR_SCTP);
1688 	}
1689 
1690 	if (attrs & (1 << OVS_KEY_ATTR_ICMP)) {
1691 		const struct ovs_key_icmp *icmp_key;
1692 
1693 		icmp_key = nla_data(a[OVS_KEY_ATTR_ICMP]);
1694 		SW_FLOW_KEY_PUT(match, tp.src,
1695 				htons(icmp_key->icmp_type), is_mask);
1696 		SW_FLOW_KEY_PUT(match, tp.dst,
1697 				htons(icmp_key->icmp_code), is_mask);
1698 		attrs &= ~(1 << OVS_KEY_ATTR_ICMP);
1699 	}
1700 
1701 	if (attrs & (1 << OVS_KEY_ATTR_ICMPV6)) {
1702 		const struct ovs_key_icmpv6 *icmpv6_key;
1703 
1704 		icmpv6_key = nla_data(a[OVS_KEY_ATTR_ICMPV6]);
1705 		SW_FLOW_KEY_PUT(match, tp.src,
1706 				htons(icmpv6_key->icmpv6_type), is_mask);
1707 		SW_FLOW_KEY_PUT(match, tp.dst,
1708 				htons(icmpv6_key->icmpv6_code), is_mask);
1709 		attrs &= ~(1 << OVS_KEY_ATTR_ICMPV6);
1710 	}
1711 
1712 	if (attrs & (1 << OVS_KEY_ATTR_ND)) {
1713 		const struct ovs_key_nd *nd_key;
1714 
1715 		nd_key = nla_data(a[OVS_KEY_ATTR_ND]);
1716 		SW_FLOW_KEY_MEMCPY(match, ipv6.nd.target,
1717 			nd_key->nd_target,
1718 			sizeof(match->key->ipv6.nd.target),
1719 			is_mask);
1720 		SW_FLOW_KEY_MEMCPY(match, ipv6.nd.sll,
1721 			nd_key->nd_sll, ETH_ALEN, is_mask);
1722 		SW_FLOW_KEY_MEMCPY(match, ipv6.nd.tll,
1723 				nd_key->nd_tll, ETH_ALEN, is_mask);
1724 		attrs &= ~(1 << OVS_KEY_ATTR_ND);
1725 	}
1726 
1727 	if (attrs != 0) {
1728 		OVS_NLERR(log, "Unknown key attributes %llx",
1729 			  (unsigned long long)attrs);
1730 		return -EINVAL;
1731 	}
1732 
1733 	return 0;
1734 }
1735 
1736 static void nlattr_set(struct nlattr *attr, u8 val,
1737 		       const struct ovs_len_tbl *tbl)
1738 {
1739 	struct nlattr *nla;
1740 	int rem;
1741 
1742 	/* The nlattr stream should already have been validated */
1743 	nla_for_each_nested(nla, attr, rem) {
1744 		if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED)
1745 			nlattr_set(nla, val, tbl[nla_type(nla)].next ? : tbl);
1746 		else
1747 			memset(nla_data(nla), val, nla_len(nla));
1748 
1749 		if (nla_type(nla) == OVS_KEY_ATTR_CT_STATE)
1750 			*(u32 *)nla_data(nla) &= CT_SUPPORTED_MASK;
1751 	}
1752 }
1753 
1754 static void mask_set_nlattr(struct nlattr *attr, u8 val)
1755 {
1756 	nlattr_set(attr, val, ovs_key_lens);
1757 }
1758 
1759 /**
1760  * ovs_nla_get_match - parses Netlink attributes into a flow key and
1761  * mask. In case the 'mask' is NULL, the flow is treated as exact match
1762  * flow. Otherwise, it is treated as a wildcarded flow, except the mask
1763  * does not include any don't care bit.
1764  * @net: Used to determine per-namespace field support.
1765  * @match: receives the extracted flow match information.
1766  * @key: Netlink attribute holding nested %OVS_KEY_ATTR_* Netlink attribute
1767  * sequence. The fields should of the packet that triggered the creation
1768  * of this flow.
1769  * @mask: Optional. Netlink attribute holding nested %OVS_KEY_ATTR_* Netlink
1770  * attribute specifies the mask field of the wildcarded flow.
1771  * @log: Boolean to allow kernel error logging.  Normally true, but when
1772  * probing for feature compatibility this should be passed in as false to
1773  * suppress unnecessary error logging.
1774  */
1775 int ovs_nla_get_match(struct net *net, struct sw_flow_match *match,
1776 		      const struct nlattr *nla_key,
1777 		      const struct nlattr *nla_mask,
1778 		      bool log)
1779 {
1780 	const struct nlattr *a[OVS_KEY_ATTR_MAX + 1];
1781 	struct nlattr *newmask = NULL;
1782 	u64 key_attrs = 0;
1783 	u64 mask_attrs = 0;
1784 	int err;
1785 
1786 	err = parse_flow_nlattrs(nla_key, a, &key_attrs, log);
1787 	if (err)
1788 		return err;
1789 
1790 	err = parse_vlan_from_nlattrs(match, &key_attrs, a, false, log);
1791 	if (err)
1792 		return err;
1793 
1794 	err = ovs_key_from_nlattrs(net, match, key_attrs, a, false, log);
1795 	if (err)
1796 		return err;
1797 
1798 	if (match->mask) {
1799 		if (!nla_mask) {
1800 			/* Create an exact match mask. We need to set to 0xff
1801 			 * all the 'match->mask' fields that have been touched
1802 			 * in 'match->key'. We cannot simply memset
1803 			 * 'match->mask', because padding bytes and fields not
1804 			 * specified in 'match->key' should be left to 0.
1805 			 * Instead, we use a stream of netlink attributes,
1806 			 * copied from 'key' and set to 0xff.
1807 			 * ovs_key_from_nlattrs() will take care of filling
1808 			 * 'match->mask' appropriately.
1809 			 */
1810 			newmask = kmemdup(nla_key,
1811 					  nla_total_size(nla_len(nla_key)),
1812 					  GFP_KERNEL);
1813 			if (!newmask)
1814 				return -ENOMEM;
1815 
1816 			mask_set_nlattr(newmask, 0xff);
1817 
1818 			/* The userspace does not send tunnel attributes that
1819 			 * are 0, but we should not wildcard them nonetheless.
1820 			 */
1821 			if (match->key->tun_proto)
1822 				SW_FLOW_KEY_MEMSET_FIELD(match, tun_key,
1823 							 0xff, true);
1824 
1825 			nla_mask = newmask;
1826 		}
1827 
1828 		err = parse_flow_mask_nlattrs(nla_mask, a, &mask_attrs, log);
1829 		if (err)
1830 			goto free_newmask;
1831 
1832 		/* Always match on tci. */
1833 		SW_FLOW_KEY_PUT(match, eth.vlan.tci, htons(0xffff), true);
1834 		SW_FLOW_KEY_PUT(match, eth.cvlan.tci, htons(0xffff), true);
1835 
1836 		err = parse_vlan_from_nlattrs(match, &mask_attrs, a, true, log);
1837 		if (err)
1838 			goto free_newmask;
1839 
1840 		err = ovs_key_from_nlattrs(net, match, mask_attrs, a, true,
1841 					   log);
1842 		if (err)
1843 			goto free_newmask;
1844 	}
1845 
1846 	if (!match_validate(match, key_attrs, mask_attrs, log))
1847 		err = -EINVAL;
1848 
1849 free_newmask:
1850 	kfree(newmask);
1851 	return err;
1852 }
1853 
1854 static size_t get_ufid_len(const struct nlattr *attr, bool log)
1855 {
1856 	size_t len;
1857 
1858 	if (!attr)
1859 		return 0;
1860 
1861 	len = nla_len(attr);
1862 	if (len < 1 || len > MAX_UFID_LENGTH) {
1863 		OVS_NLERR(log, "ufid size %u bytes exceeds the range (1, %d)",
1864 			  nla_len(attr), MAX_UFID_LENGTH);
1865 		return 0;
1866 	}
1867 
1868 	return len;
1869 }
1870 
1871 /* Initializes 'flow->ufid', returning true if 'attr' contains a valid UFID,
1872  * or false otherwise.
1873  */
1874 bool ovs_nla_get_ufid(struct sw_flow_id *sfid, const struct nlattr *attr,
1875 		      bool log)
1876 {
1877 	sfid->ufid_len = get_ufid_len(attr, log);
1878 	if (sfid->ufid_len)
1879 		memcpy(sfid->ufid, nla_data(attr), sfid->ufid_len);
1880 
1881 	return sfid->ufid_len;
1882 }
1883 
1884 int ovs_nla_get_identifier(struct sw_flow_id *sfid, const struct nlattr *ufid,
1885 			   const struct sw_flow_key *key, bool log)
1886 {
1887 	struct sw_flow_key *new_key;
1888 
1889 	if (ovs_nla_get_ufid(sfid, ufid, log))
1890 		return 0;
1891 
1892 	/* If UFID was not provided, use unmasked key. */
1893 	new_key = kmalloc(sizeof(*new_key), GFP_KERNEL);
1894 	if (!new_key)
1895 		return -ENOMEM;
1896 	memcpy(new_key, key, sizeof(*key));
1897 	sfid->unmasked_key = new_key;
1898 
1899 	return 0;
1900 }
1901 
1902 u32 ovs_nla_get_ufid_flags(const struct nlattr *attr)
1903 {
1904 	return attr ? nla_get_u32(attr) : 0;
1905 }
1906 
1907 /**
1908  * ovs_nla_get_flow_metadata - parses Netlink attributes into a flow key.
1909  * @net: Network namespace.
1910  * @key: Receives extracted in_port, priority, tun_key, skb_mark and conntrack
1911  * metadata.
1912  * @a: Array of netlink attributes holding parsed %OVS_KEY_ATTR_* Netlink
1913  * attributes.
1914  * @attrs: Bit mask for the netlink attributes included in @a.
1915  * @log: Boolean to allow kernel error logging.  Normally true, but when
1916  * probing for feature compatibility this should be passed in as false to
1917  * suppress unnecessary error logging.
1918  *
1919  * This parses a series of Netlink attributes that form a flow key, which must
1920  * take the same form accepted by flow_from_nlattrs(), but only enough of it to
1921  * get the metadata, that is, the parts of the flow key that cannot be
1922  * extracted from the packet itself.
1923  *
1924  * This must be called before the packet key fields are filled in 'key'.
1925  */
1926 
1927 int ovs_nla_get_flow_metadata(struct net *net,
1928 			      const struct nlattr *a[OVS_KEY_ATTR_MAX + 1],
1929 			      u64 attrs, struct sw_flow_key *key, bool log)
1930 {
1931 	struct sw_flow_match match;
1932 
1933 	memset(&match, 0, sizeof(match));
1934 	match.key = key;
1935 
1936 	key->ct_state = 0;
1937 	key->ct_zone = 0;
1938 	key->ct_orig_proto = 0;
1939 	memset(&key->ct, 0, sizeof(key->ct));
1940 	memset(&key->ipv4.ct_orig, 0, sizeof(key->ipv4.ct_orig));
1941 	memset(&key->ipv6.ct_orig, 0, sizeof(key->ipv6.ct_orig));
1942 
1943 	key->phy.in_port = DP_MAX_PORTS;
1944 
1945 	return metadata_from_nlattrs(net, &match, &attrs, a, false, log);
1946 }
1947 
1948 static int ovs_nla_put_vlan(struct sk_buff *skb, const struct vlan_head *vh,
1949 			    bool is_mask)
1950 {
1951 	__be16 eth_type = !is_mask ? vh->tpid : htons(0xffff);
1952 
1953 	if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, eth_type) ||
1954 	    nla_put_be16(skb, OVS_KEY_ATTR_VLAN, vh->tci))
1955 		return -EMSGSIZE;
1956 	return 0;
1957 }
1958 
1959 static int nsh_key_to_nlattr(const struct ovs_key_nsh *nsh, bool is_mask,
1960 			     struct sk_buff *skb)
1961 {
1962 	struct nlattr *start;
1963 
1964 	start = nla_nest_start_noflag(skb, OVS_KEY_ATTR_NSH);
1965 	if (!start)
1966 		return -EMSGSIZE;
1967 
1968 	if (nla_put(skb, OVS_NSH_KEY_ATTR_BASE, sizeof(nsh->base), &nsh->base))
1969 		goto nla_put_failure;
1970 
1971 	if (is_mask || nsh->base.mdtype == NSH_M_TYPE1) {
1972 		if (nla_put(skb, OVS_NSH_KEY_ATTR_MD1,
1973 			    sizeof(nsh->context), nsh->context))
1974 			goto nla_put_failure;
1975 	}
1976 
1977 	/* Don't support MD type 2 yet */
1978 
1979 	nla_nest_end(skb, start);
1980 
1981 	return 0;
1982 
1983 nla_put_failure:
1984 	return -EMSGSIZE;
1985 }
1986 
1987 static int __ovs_nla_put_key(const struct sw_flow_key *swkey,
1988 			     const struct sw_flow_key *output, bool is_mask,
1989 			     struct sk_buff *skb)
1990 {
1991 	struct ovs_key_ethernet *eth_key;
1992 	struct nlattr *nla;
1993 	struct nlattr *encap = NULL;
1994 	struct nlattr *in_encap = NULL;
1995 
1996 	if (nla_put_u32(skb, OVS_KEY_ATTR_RECIRC_ID, output->recirc_id))
1997 		goto nla_put_failure;
1998 
1999 	if (nla_put_u32(skb, OVS_KEY_ATTR_DP_HASH, output->ovs_flow_hash))
2000 		goto nla_put_failure;
2001 
2002 	if (nla_put_u32(skb, OVS_KEY_ATTR_PRIORITY, output->phy.priority))
2003 		goto nla_put_failure;
2004 
2005 	if ((swkey->tun_proto || is_mask)) {
2006 		const void *opts = NULL;
2007 
2008 		if (output->tun_key.tun_flags & TUNNEL_OPTIONS_PRESENT)
2009 			opts = TUN_METADATA_OPTS(output, swkey->tun_opts_len);
2010 
2011 		if (ip_tun_to_nlattr(skb, &output->tun_key, opts,
2012 				     swkey->tun_opts_len, swkey->tun_proto, 0))
2013 			goto nla_put_failure;
2014 	}
2015 
2016 	if (swkey->phy.in_port == DP_MAX_PORTS) {
2017 		if (is_mask && (output->phy.in_port == 0xffff))
2018 			if (nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT, 0xffffffff))
2019 				goto nla_put_failure;
2020 	} else {
2021 		u16 upper_u16;
2022 		upper_u16 = !is_mask ? 0 : 0xffff;
2023 
2024 		if (nla_put_u32(skb, OVS_KEY_ATTR_IN_PORT,
2025 				(upper_u16 << 16) | output->phy.in_port))
2026 			goto nla_put_failure;
2027 	}
2028 
2029 	if (nla_put_u32(skb, OVS_KEY_ATTR_SKB_MARK, output->phy.skb_mark))
2030 		goto nla_put_failure;
2031 
2032 	if (ovs_ct_put_key(swkey, output, skb))
2033 		goto nla_put_failure;
2034 
2035 	if (ovs_key_mac_proto(swkey) == MAC_PROTO_ETHERNET) {
2036 		nla = nla_reserve(skb, OVS_KEY_ATTR_ETHERNET, sizeof(*eth_key));
2037 		if (!nla)
2038 			goto nla_put_failure;
2039 
2040 		eth_key = nla_data(nla);
2041 		ether_addr_copy(eth_key->eth_src, output->eth.src);
2042 		ether_addr_copy(eth_key->eth_dst, output->eth.dst);
2043 
2044 		if (swkey->eth.vlan.tci || eth_type_vlan(swkey->eth.type)) {
2045 			if (ovs_nla_put_vlan(skb, &output->eth.vlan, is_mask))
2046 				goto nla_put_failure;
2047 			encap = nla_nest_start_noflag(skb, OVS_KEY_ATTR_ENCAP);
2048 			if (!swkey->eth.vlan.tci)
2049 				goto unencap;
2050 
2051 			if (swkey->eth.cvlan.tci || eth_type_vlan(swkey->eth.type)) {
2052 				if (ovs_nla_put_vlan(skb, &output->eth.cvlan, is_mask))
2053 					goto nla_put_failure;
2054 				in_encap = nla_nest_start_noflag(skb,
2055 								 OVS_KEY_ATTR_ENCAP);
2056 				if (!swkey->eth.cvlan.tci)
2057 					goto unencap;
2058 			}
2059 		}
2060 
2061 		if (swkey->eth.type == htons(ETH_P_802_2)) {
2062 			/*
2063 			* Ethertype 802.2 is represented in the netlink with omitted
2064 			* OVS_KEY_ATTR_ETHERTYPE in the flow key attribute, and
2065 			* 0xffff in the mask attribute.  Ethertype can also
2066 			* be wildcarded.
2067 			*/
2068 			if (is_mask && output->eth.type)
2069 				if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE,
2070 							output->eth.type))
2071 					goto nla_put_failure;
2072 			goto unencap;
2073 		}
2074 	}
2075 
2076 	if (nla_put_be16(skb, OVS_KEY_ATTR_ETHERTYPE, output->eth.type))
2077 		goto nla_put_failure;
2078 
2079 	if (eth_type_vlan(swkey->eth.type)) {
2080 		/* There are 3 VLAN tags, we don't know anything about the rest
2081 		 * of the packet, so truncate here.
2082 		 */
2083 		WARN_ON_ONCE(!(encap && in_encap));
2084 		goto unencap;
2085 	}
2086 
2087 	if (swkey->eth.type == htons(ETH_P_IP)) {
2088 		struct ovs_key_ipv4 *ipv4_key;
2089 
2090 		nla = nla_reserve(skb, OVS_KEY_ATTR_IPV4, sizeof(*ipv4_key));
2091 		if (!nla)
2092 			goto nla_put_failure;
2093 		ipv4_key = nla_data(nla);
2094 		ipv4_key->ipv4_src = output->ipv4.addr.src;
2095 		ipv4_key->ipv4_dst = output->ipv4.addr.dst;
2096 		ipv4_key->ipv4_proto = output->ip.proto;
2097 		ipv4_key->ipv4_tos = output->ip.tos;
2098 		ipv4_key->ipv4_ttl = output->ip.ttl;
2099 		ipv4_key->ipv4_frag = output->ip.frag;
2100 	} else if (swkey->eth.type == htons(ETH_P_IPV6)) {
2101 		struct ovs_key_ipv6 *ipv6_key;
2102 
2103 		nla = nla_reserve(skb, OVS_KEY_ATTR_IPV6, sizeof(*ipv6_key));
2104 		if (!nla)
2105 			goto nla_put_failure;
2106 		ipv6_key = nla_data(nla);
2107 		memcpy(ipv6_key->ipv6_src, &output->ipv6.addr.src,
2108 				sizeof(ipv6_key->ipv6_src));
2109 		memcpy(ipv6_key->ipv6_dst, &output->ipv6.addr.dst,
2110 				sizeof(ipv6_key->ipv6_dst));
2111 		ipv6_key->ipv6_label = output->ipv6.label;
2112 		ipv6_key->ipv6_proto = output->ip.proto;
2113 		ipv6_key->ipv6_tclass = output->ip.tos;
2114 		ipv6_key->ipv6_hlimit = output->ip.ttl;
2115 		ipv6_key->ipv6_frag = output->ip.frag;
2116 	} else if (swkey->eth.type == htons(ETH_P_NSH)) {
2117 		if (nsh_key_to_nlattr(&output->nsh, is_mask, skb))
2118 			goto nla_put_failure;
2119 	} else if (swkey->eth.type == htons(ETH_P_ARP) ||
2120 		   swkey->eth.type == htons(ETH_P_RARP)) {
2121 		struct ovs_key_arp *arp_key;
2122 
2123 		nla = nla_reserve(skb, OVS_KEY_ATTR_ARP, sizeof(*arp_key));
2124 		if (!nla)
2125 			goto nla_put_failure;
2126 		arp_key = nla_data(nla);
2127 		memset(arp_key, 0, sizeof(struct ovs_key_arp));
2128 		arp_key->arp_sip = output->ipv4.addr.src;
2129 		arp_key->arp_tip = output->ipv4.addr.dst;
2130 		arp_key->arp_op = htons(output->ip.proto);
2131 		ether_addr_copy(arp_key->arp_sha, output->ipv4.arp.sha);
2132 		ether_addr_copy(arp_key->arp_tha, output->ipv4.arp.tha);
2133 	} else if (eth_p_mpls(swkey->eth.type)) {
2134 		u8 i, num_labels;
2135 		struct ovs_key_mpls *mpls_key;
2136 
2137 		num_labels = hweight_long(output->mpls.num_labels_mask);
2138 		nla = nla_reserve(skb, OVS_KEY_ATTR_MPLS,
2139 				  num_labels * sizeof(*mpls_key));
2140 		if (!nla)
2141 			goto nla_put_failure;
2142 
2143 		mpls_key = nla_data(nla);
2144 		for (i = 0; i < num_labels; i++)
2145 			mpls_key[i].mpls_lse = output->mpls.lse[i];
2146 	}
2147 
2148 	if ((swkey->eth.type == htons(ETH_P_IP) ||
2149 	     swkey->eth.type == htons(ETH_P_IPV6)) &&
2150 	     swkey->ip.frag != OVS_FRAG_TYPE_LATER) {
2151 
2152 		if (swkey->ip.proto == IPPROTO_TCP) {
2153 			struct ovs_key_tcp *tcp_key;
2154 
2155 			nla = nla_reserve(skb, OVS_KEY_ATTR_TCP, sizeof(*tcp_key));
2156 			if (!nla)
2157 				goto nla_put_failure;
2158 			tcp_key = nla_data(nla);
2159 			tcp_key->tcp_src = output->tp.src;
2160 			tcp_key->tcp_dst = output->tp.dst;
2161 			if (nla_put_be16(skb, OVS_KEY_ATTR_TCP_FLAGS,
2162 					 output->tp.flags))
2163 				goto nla_put_failure;
2164 		} else if (swkey->ip.proto == IPPROTO_UDP) {
2165 			struct ovs_key_udp *udp_key;
2166 
2167 			nla = nla_reserve(skb, OVS_KEY_ATTR_UDP, sizeof(*udp_key));
2168 			if (!nla)
2169 				goto nla_put_failure;
2170 			udp_key = nla_data(nla);
2171 			udp_key->udp_src = output->tp.src;
2172 			udp_key->udp_dst = output->tp.dst;
2173 		} else if (swkey->ip.proto == IPPROTO_SCTP) {
2174 			struct ovs_key_sctp *sctp_key;
2175 
2176 			nla = nla_reserve(skb, OVS_KEY_ATTR_SCTP, sizeof(*sctp_key));
2177 			if (!nla)
2178 				goto nla_put_failure;
2179 			sctp_key = nla_data(nla);
2180 			sctp_key->sctp_src = output->tp.src;
2181 			sctp_key->sctp_dst = output->tp.dst;
2182 		} else if (swkey->eth.type == htons(ETH_P_IP) &&
2183 			   swkey->ip.proto == IPPROTO_ICMP) {
2184 			struct ovs_key_icmp *icmp_key;
2185 
2186 			nla = nla_reserve(skb, OVS_KEY_ATTR_ICMP, sizeof(*icmp_key));
2187 			if (!nla)
2188 				goto nla_put_failure;
2189 			icmp_key = nla_data(nla);
2190 			icmp_key->icmp_type = ntohs(output->tp.src);
2191 			icmp_key->icmp_code = ntohs(output->tp.dst);
2192 		} else if (swkey->eth.type == htons(ETH_P_IPV6) &&
2193 			   swkey->ip.proto == IPPROTO_ICMPV6) {
2194 			struct ovs_key_icmpv6 *icmpv6_key;
2195 
2196 			nla = nla_reserve(skb, OVS_KEY_ATTR_ICMPV6,
2197 						sizeof(*icmpv6_key));
2198 			if (!nla)
2199 				goto nla_put_failure;
2200 			icmpv6_key = nla_data(nla);
2201 			icmpv6_key->icmpv6_type = ntohs(output->tp.src);
2202 			icmpv6_key->icmpv6_code = ntohs(output->tp.dst);
2203 
2204 			if (icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_SOLICITATION ||
2205 			    icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_ADVERTISEMENT) {
2206 				struct ovs_key_nd *nd_key;
2207 
2208 				nla = nla_reserve(skb, OVS_KEY_ATTR_ND, sizeof(*nd_key));
2209 				if (!nla)
2210 					goto nla_put_failure;
2211 				nd_key = nla_data(nla);
2212 				memcpy(nd_key->nd_target, &output->ipv6.nd.target,
2213 							sizeof(nd_key->nd_target));
2214 				ether_addr_copy(nd_key->nd_sll, output->ipv6.nd.sll);
2215 				ether_addr_copy(nd_key->nd_tll, output->ipv6.nd.tll);
2216 			}
2217 		}
2218 	}
2219 
2220 unencap:
2221 	if (in_encap)
2222 		nla_nest_end(skb, in_encap);
2223 	if (encap)
2224 		nla_nest_end(skb, encap);
2225 
2226 	return 0;
2227 
2228 nla_put_failure:
2229 	return -EMSGSIZE;
2230 }
2231 
2232 int ovs_nla_put_key(const struct sw_flow_key *swkey,
2233 		    const struct sw_flow_key *output, int attr, bool is_mask,
2234 		    struct sk_buff *skb)
2235 {
2236 	int err;
2237 	struct nlattr *nla;
2238 
2239 	nla = nla_nest_start_noflag(skb, attr);
2240 	if (!nla)
2241 		return -EMSGSIZE;
2242 	err = __ovs_nla_put_key(swkey, output, is_mask, skb);
2243 	if (err)
2244 		return err;
2245 	nla_nest_end(skb, nla);
2246 
2247 	return 0;
2248 }
2249 
2250 /* Called with ovs_mutex or RCU read lock. */
2251 int ovs_nla_put_identifier(const struct sw_flow *flow, struct sk_buff *skb)
2252 {
2253 	if (ovs_identifier_is_ufid(&flow->id))
2254 		return nla_put(skb, OVS_FLOW_ATTR_UFID, flow->id.ufid_len,
2255 			       flow->id.ufid);
2256 
2257 	return ovs_nla_put_key(flow->id.unmasked_key, flow->id.unmasked_key,
2258 			       OVS_FLOW_ATTR_KEY, false, skb);
2259 }
2260 
2261 /* Called with ovs_mutex or RCU read lock. */
2262 int ovs_nla_put_masked_key(const struct sw_flow *flow, struct sk_buff *skb)
2263 {
2264 	return ovs_nla_put_key(&flow->key, &flow->key,
2265 				OVS_FLOW_ATTR_KEY, false, skb);
2266 }
2267 
2268 /* Called with ovs_mutex or RCU read lock. */
2269 int ovs_nla_put_mask(const struct sw_flow *flow, struct sk_buff *skb)
2270 {
2271 	return ovs_nla_put_key(&flow->key, &flow->mask->key,
2272 				OVS_FLOW_ATTR_MASK, true, skb);
2273 }
2274 
2275 #define MAX_ACTIONS_BUFSIZE	(32 * 1024)
2276 
2277 static struct sw_flow_actions *nla_alloc_flow_actions(int size)
2278 {
2279 	struct sw_flow_actions *sfa;
2280 
2281 	WARN_ON_ONCE(size > MAX_ACTIONS_BUFSIZE);
2282 
2283 	sfa = kmalloc(sizeof(*sfa) + size, GFP_KERNEL);
2284 	if (!sfa)
2285 		return ERR_PTR(-ENOMEM);
2286 
2287 	sfa->actions_len = 0;
2288 	return sfa;
2289 }
2290 
2291 static void ovs_nla_free_set_action(const struct nlattr *a)
2292 {
2293 	const struct nlattr *ovs_key = nla_data(a);
2294 	struct ovs_tunnel_info *ovs_tun;
2295 
2296 	switch (nla_type(ovs_key)) {
2297 	case OVS_KEY_ATTR_TUNNEL_INFO:
2298 		ovs_tun = nla_data(ovs_key);
2299 		dst_release((struct dst_entry *)ovs_tun->tun_dst);
2300 		break;
2301 	}
2302 }
2303 
2304 void ovs_nla_free_flow_actions(struct sw_flow_actions *sf_acts)
2305 {
2306 	const struct nlattr *a;
2307 	int rem;
2308 
2309 	if (!sf_acts)
2310 		return;
2311 
2312 	nla_for_each_attr(a, sf_acts->actions, sf_acts->actions_len, rem) {
2313 		switch (nla_type(a)) {
2314 		case OVS_ACTION_ATTR_SET:
2315 			ovs_nla_free_set_action(a);
2316 			break;
2317 		case OVS_ACTION_ATTR_CT:
2318 			ovs_ct_free_action(a);
2319 			break;
2320 		}
2321 	}
2322 
2323 	kfree(sf_acts);
2324 }
2325 
2326 static void __ovs_nla_free_flow_actions(struct rcu_head *head)
2327 {
2328 	ovs_nla_free_flow_actions(container_of(head, struct sw_flow_actions, rcu));
2329 }
2330 
2331 /* Schedules 'sf_acts' to be freed after the next RCU grace period.
2332  * The caller must hold rcu_read_lock for this to be sensible. */
2333 void ovs_nla_free_flow_actions_rcu(struct sw_flow_actions *sf_acts)
2334 {
2335 	call_rcu(&sf_acts->rcu, __ovs_nla_free_flow_actions);
2336 }
2337 
2338 static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
2339 				       int attr_len, bool log)
2340 {
2341 
2342 	struct sw_flow_actions *acts;
2343 	int new_acts_size;
2344 	size_t req_size = NLA_ALIGN(attr_len);
2345 	int next_offset = offsetof(struct sw_flow_actions, actions) +
2346 					(*sfa)->actions_len;
2347 
2348 	if (req_size <= (ksize(*sfa) - next_offset))
2349 		goto out;
2350 
2351 	new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2);
2352 
2353 	if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
2354 		if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) {
2355 			OVS_NLERR(log, "Flow action size exceeds max %u",
2356 				  MAX_ACTIONS_BUFSIZE);
2357 			return ERR_PTR(-EMSGSIZE);
2358 		}
2359 		new_acts_size = MAX_ACTIONS_BUFSIZE;
2360 	}
2361 
2362 	acts = nla_alloc_flow_actions(new_acts_size);
2363 	if (IS_ERR(acts))
2364 		return (void *)acts;
2365 
2366 	memcpy(acts->actions, (*sfa)->actions, (*sfa)->actions_len);
2367 	acts->actions_len = (*sfa)->actions_len;
2368 	acts->orig_len = (*sfa)->orig_len;
2369 	kfree(*sfa);
2370 	*sfa = acts;
2371 
2372 out:
2373 	(*sfa)->actions_len += req_size;
2374 	return  (struct nlattr *) ((unsigned char *)(*sfa) + next_offset);
2375 }
2376 
2377 static struct nlattr *__add_action(struct sw_flow_actions **sfa,
2378 				   int attrtype, void *data, int len, bool log)
2379 {
2380 	struct nlattr *a;
2381 
2382 	a = reserve_sfa_size(sfa, nla_attr_size(len), log);
2383 	if (IS_ERR(a))
2384 		return a;
2385 
2386 	a->nla_type = attrtype;
2387 	a->nla_len = nla_attr_size(len);
2388 
2389 	if (data)
2390 		memcpy(nla_data(a), data, len);
2391 	memset((unsigned char *) a + a->nla_len, 0, nla_padlen(len));
2392 
2393 	return a;
2394 }
2395 
2396 int ovs_nla_add_action(struct sw_flow_actions **sfa, int attrtype, void *data,
2397 		       int len, bool log)
2398 {
2399 	struct nlattr *a;
2400 
2401 	a = __add_action(sfa, attrtype, data, len, log);
2402 
2403 	return PTR_ERR_OR_ZERO(a);
2404 }
2405 
2406 static inline int add_nested_action_start(struct sw_flow_actions **sfa,
2407 					  int attrtype, bool log)
2408 {
2409 	int used = (*sfa)->actions_len;
2410 	int err;
2411 
2412 	err = ovs_nla_add_action(sfa, attrtype, NULL, 0, log);
2413 	if (err)
2414 		return err;
2415 
2416 	return used;
2417 }
2418 
2419 static inline void add_nested_action_end(struct sw_flow_actions *sfa,
2420 					 int st_offset)
2421 {
2422 	struct nlattr *a = (struct nlattr *) ((unsigned char *)sfa->actions +
2423 							       st_offset);
2424 
2425 	a->nla_len = sfa->actions_len - st_offset;
2426 }
2427 
2428 static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
2429 				  const struct sw_flow_key *key,
2430 				  struct sw_flow_actions **sfa,
2431 				  __be16 eth_type, __be16 vlan_tci,
2432 				  u32 mpls_label_count, bool log);
2433 
2434 static int validate_and_copy_sample(struct net *net, const struct nlattr *attr,
2435 				    const struct sw_flow_key *key,
2436 				    struct sw_flow_actions **sfa,
2437 				    __be16 eth_type, __be16 vlan_tci,
2438 				    u32 mpls_label_count, bool log, bool last)
2439 {
2440 	const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1];
2441 	const struct nlattr *probability, *actions;
2442 	const struct nlattr *a;
2443 	int rem, start, err;
2444 	struct sample_arg arg;
2445 
2446 	memset(attrs, 0, sizeof(attrs));
2447 	nla_for_each_nested(a, attr, rem) {
2448 		int type = nla_type(a);
2449 		if (!type || type > OVS_SAMPLE_ATTR_MAX || attrs[type])
2450 			return -EINVAL;
2451 		attrs[type] = a;
2452 	}
2453 	if (rem)
2454 		return -EINVAL;
2455 
2456 	probability = attrs[OVS_SAMPLE_ATTR_PROBABILITY];
2457 	if (!probability || nla_len(probability) != sizeof(u32))
2458 		return -EINVAL;
2459 
2460 	actions = attrs[OVS_SAMPLE_ATTR_ACTIONS];
2461 	if (!actions || (nla_len(actions) && nla_len(actions) < NLA_HDRLEN))
2462 		return -EINVAL;
2463 
2464 	/* validation done, copy sample action. */
2465 	start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SAMPLE, log);
2466 	if (start < 0)
2467 		return start;
2468 
2469 	/* When both skb and flow may be changed, put the sample
2470 	 * into a deferred fifo. On the other hand, if only skb
2471 	 * may be modified, the actions can be executed in place.
2472 	 *
2473 	 * Do this analysis at the flow installation time.
2474 	 * Set 'clone_action->exec' to true if the actions can be
2475 	 * executed without being deferred.
2476 	 *
2477 	 * If the sample is the last action, it can always be excuted
2478 	 * rather than deferred.
2479 	 */
2480 	arg.exec = last || !actions_may_change_flow(actions);
2481 	arg.probability = nla_get_u32(probability);
2482 
2483 	err = ovs_nla_add_action(sfa, OVS_SAMPLE_ATTR_ARG, &arg, sizeof(arg),
2484 				 log);
2485 	if (err)
2486 		return err;
2487 
2488 	err = __ovs_nla_copy_actions(net, actions, key, sfa,
2489 				     eth_type, vlan_tci, mpls_label_count, log);
2490 
2491 	if (err)
2492 		return err;
2493 
2494 	add_nested_action_end(*sfa, start);
2495 
2496 	return 0;
2497 }
2498 
2499 static int validate_and_copy_dec_ttl(struct net *net,
2500 				     const struct nlattr *attr,
2501 				     const struct sw_flow_key *key,
2502 				     struct sw_flow_actions **sfa,
2503 				     __be16 eth_type, __be16 vlan_tci,
2504 				     u32 mpls_label_count, bool log)
2505 {
2506 	int start, err;
2507 	u32 nested = true;
2508 
2509 	if (!nla_len(attr))
2510 		return ovs_nla_add_action(sfa, OVS_ACTION_ATTR_DEC_TTL,
2511 					  NULL, 0, log);
2512 
2513 	start = add_nested_action_start(sfa, OVS_ACTION_ATTR_DEC_TTL, log);
2514 	if (start < 0)
2515 		return start;
2516 
2517 	err = ovs_nla_add_action(sfa, OVS_DEC_TTL_ATTR_ACTION, &nested,
2518 				 sizeof(nested), log);
2519 
2520 	if (err)
2521 		return err;
2522 
2523 	err = __ovs_nla_copy_actions(net, attr, key, sfa, eth_type,
2524 				     vlan_tci, mpls_label_count, log);
2525 	if (err)
2526 		return err;
2527 
2528 	add_nested_action_end(*sfa, start);
2529 	return 0;
2530 }
2531 
2532 static int validate_and_copy_clone(struct net *net,
2533 				   const struct nlattr *attr,
2534 				   const struct sw_flow_key *key,
2535 				   struct sw_flow_actions **sfa,
2536 				   __be16 eth_type, __be16 vlan_tci,
2537 				   u32 mpls_label_count, bool log, bool last)
2538 {
2539 	int start, err;
2540 	u32 exec;
2541 
2542 	if (nla_len(attr) && nla_len(attr) < NLA_HDRLEN)
2543 		return -EINVAL;
2544 
2545 	start = add_nested_action_start(sfa, OVS_ACTION_ATTR_CLONE, log);
2546 	if (start < 0)
2547 		return start;
2548 
2549 	exec = last || !actions_may_change_flow(attr);
2550 
2551 	err = ovs_nla_add_action(sfa, OVS_CLONE_ATTR_EXEC, &exec,
2552 				 sizeof(exec), log);
2553 	if (err)
2554 		return err;
2555 
2556 	err = __ovs_nla_copy_actions(net, attr, key, sfa,
2557 				     eth_type, vlan_tci, mpls_label_count, log);
2558 	if (err)
2559 		return err;
2560 
2561 	add_nested_action_end(*sfa, start);
2562 
2563 	return 0;
2564 }
2565 
2566 void ovs_match_init(struct sw_flow_match *match,
2567 		    struct sw_flow_key *key,
2568 		    bool reset_key,
2569 		    struct sw_flow_mask *mask)
2570 {
2571 	memset(match, 0, sizeof(*match));
2572 	match->key = key;
2573 	match->mask = mask;
2574 
2575 	if (reset_key)
2576 		memset(key, 0, sizeof(*key));
2577 
2578 	if (mask) {
2579 		memset(&mask->key, 0, sizeof(mask->key));
2580 		mask->range.start = mask->range.end = 0;
2581 	}
2582 }
2583 
2584 static int validate_geneve_opts(struct sw_flow_key *key)
2585 {
2586 	struct geneve_opt *option;
2587 	int opts_len = key->tun_opts_len;
2588 	bool crit_opt = false;
2589 
2590 	option = (struct geneve_opt *)TUN_METADATA_OPTS(key, key->tun_opts_len);
2591 	while (opts_len > 0) {
2592 		int len;
2593 
2594 		if (opts_len < sizeof(*option))
2595 			return -EINVAL;
2596 
2597 		len = sizeof(*option) + option->length * 4;
2598 		if (len > opts_len)
2599 			return -EINVAL;
2600 
2601 		crit_opt |= !!(option->type & GENEVE_CRIT_OPT_TYPE);
2602 
2603 		option = (struct geneve_opt *)((u8 *)option + len);
2604 		opts_len -= len;
2605 	}
2606 
2607 	key->tun_key.tun_flags |= crit_opt ? TUNNEL_CRIT_OPT : 0;
2608 
2609 	return 0;
2610 }
2611 
2612 static int validate_and_copy_set_tun(const struct nlattr *attr,
2613 				     struct sw_flow_actions **sfa, bool log)
2614 {
2615 	struct sw_flow_match match;
2616 	struct sw_flow_key key;
2617 	struct metadata_dst *tun_dst;
2618 	struct ip_tunnel_info *tun_info;
2619 	struct ovs_tunnel_info *ovs_tun;
2620 	struct nlattr *a;
2621 	int err = 0, start, opts_type;
2622 	__be16 dst_opt_type;
2623 
2624 	dst_opt_type = 0;
2625 	ovs_match_init(&match, &key, true, NULL);
2626 	opts_type = ip_tun_from_nlattr(nla_data(attr), &match, false, log);
2627 	if (opts_type < 0)
2628 		return opts_type;
2629 
2630 	if (key.tun_opts_len) {
2631 		switch (opts_type) {
2632 		case OVS_TUNNEL_KEY_ATTR_GENEVE_OPTS:
2633 			err = validate_geneve_opts(&key);
2634 			if (err < 0)
2635 				return err;
2636 			dst_opt_type = TUNNEL_GENEVE_OPT;
2637 			break;
2638 		case OVS_TUNNEL_KEY_ATTR_VXLAN_OPTS:
2639 			dst_opt_type = TUNNEL_VXLAN_OPT;
2640 			break;
2641 		case OVS_TUNNEL_KEY_ATTR_ERSPAN_OPTS:
2642 			dst_opt_type = TUNNEL_ERSPAN_OPT;
2643 			break;
2644 		}
2645 	}
2646 
2647 	start = add_nested_action_start(sfa, OVS_ACTION_ATTR_SET, log);
2648 	if (start < 0)
2649 		return start;
2650 
2651 	tun_dst = metadata_dst_alloc(key.tun_opts_len, METADATA_IP_TUNNEL,
2652 				     GFP_KERNEL);
2653 
2654 	if (!tun_dst)
2655 		return -ENOMEM;
2656 
2657 	err = dst_cache_init(&tun_dst->u.tun_info.dst_cache, GFP_KERNEL);
2658 	if (err) {
2659 		dst_release((struct dst_entry *)tun_dst);
2660 		return err;
2661 	}
2662 
2663 	a = __add_action(sfa, OVS_KEY_ATTR_TUNNEL_INFO, NULL,
2664 			 sizeof(*ovs_tun), log);
2665 	if (IS_ERR(a)) {
2666 		dst_release((struct dst_entry *)tun_dst);
2667 		return PTR_ERR(a);
2668 	}
2669 
2670 	ovs_tun = nla_data(a);
2671 	ovs_tun->tun_dst = tun_dst;
2672 
2673 	tun_info = &tun_dst->u.tun_info;
2674 	tun_info->mode = IP_TUNNEL_INFO_TX;
2675 	if (key.tun_proto == AF_INET6)
2676 		tun_info->mode |= IP_TUNNEL_INFO_IPV6;
2677 	else if (key.tun_proto == AF_INET && key.tun_key.u.ipv4.dst == 0)
2678 		tun_info->mode |= IP_TUNNEL_INFO_BRIDGE;
2679 	tun_info->key = key.tun_key;
2680 
2681 	/* We need to store the options in the action itself since
2682 	 * everything else will go away after flow setup. We can append
2683 	 * it to tun_info and then point there.
2684 	 */
2685 	ip_tunnel_info_opts_set(tun_info,
2686 				TUN_METADATA_OPTS(&key, key.tun_opts_len),
2687 				key.tun_opts_len, dst_opt_type);
2688 	add_nested_action_end(*sfa, start);
2689 
2690 	return err;
2691 }
2692 
2693 static bool validate_nsh(const struct nlattr *attr, bool is_mask,
2694 			 bool is_push_nsh, bool log)
2695 {
2696 	struct sw_flow_match match;
2697 	struct sw_flow_key key;
2698 	int ret = 0;
2699 
2700 	ovs_match_init(&match, &key, true, NULL);
2701 	ret = nsh_key_put_from_nlattr(attr, &match, is_mask,
2702 				      is_push_nsh, log);
2703 	return !ret;
2704 }
2705 
2706 /* Return false if there are any non-masked bits set.
2707  * Mask follows data immediately, before any netlink padding.
2708  */
2709 static bool validate_masked(u8 *data, int len)
2710 {
2711 	u8 *mask = data + len;
2712 
2713 	while (len--)
2714 		if (*data++ & ~*mask++)
2715 			return false;
2716 
2717 	return true;
2718 }
2719 
2720 static int validate_set(const struct nlattr *a,
2721 			const struct sw_flow_key *flow_key,
2722 			struct sw_flow_actions **sfa, bool *skip_copy,
2723 			u8 mac_proto, __be16 eth_type, bool masked, bool log)
2724 {
2725 	const struct nlattr *ovs_key = nla_data(a);
2726 	int key_type = nla_type(ovs_key);
2727 	size_t key_len;
2728 
2729 	/* There can be only one key in a action */
2730 	if (nla_total_size(nla_len(ovs_key)) != nla_len(a))
2731 		return -EINVAL;
2732 
2733 	key_len = nla_len(ovs_key);
2734 	if (masked)
2735 		key_len /= 2;
2736 
2737 	if (key_type > OVS_KEY_ATTR_MAX ||
2738 	    !check_attr_len(key_len, ovs_key_lens[key_type].len))
2739 		return -EINVAL;
2740 
2741 	if (masked && !validate_masked(nla_data(ovs_key), key_len))
2742 		return -EINVAL;
2743 
2744 	switch (key_type) {
2745 	case OVS_KEY_ATTR_PRIORITY:
2746 	case OVS_KEY_ATTR_SKB_MARK:
2747 	case OVS_KEY_ATTR_CT_MARK:
2748 	case OVS_KEY_ATTR_CT_LABELS:
2749 		break;
2750 
2751 	case OVS_KEY_ATTR_ETHERNET:
2752 		if (mac_proto != MAC_PROTO_ETHERNET)
2753 			return -EINVAL;
2754 		break;
2755 
2756 	case OVS_KEY_ATTR_TUNNEL: {
2757 		int err;
2758 
2759 		if (masked)
2760 			return -EINVAL; /* Masked tunnel set not supported. */
2761 
2762 		*skip_copy = true;
2763 		err = validate_and_copy_set_tun(a, sfa, log);
2764 		if (err)
2765 			return err;
2766 		break;
2767 	}
2768 	case OVS_KEY_ATTR_IPV4: {
2769 		const struct ovs_key_ipv4 *ipv4_key;
2770 
2771 		if (eth_type != htons(ETH_P_IP))
2772 			return -EINVAL;
2773 
2774 		ipv4_key = nla_data(ovs_key);
2775 
2776 		if (masked) {
2777 			const struct ovs_key_ipv4 *mask = ipv4_key + 1;
2778 
2779 			/* Non-writeable fields. */
2780 			if (mask->ipv4_proto || mask->ipv4_frag)
2781 				return -EINVAL;
2782 		} else {
2783 			if (ipv4_key->ipv4_proto != flow_key->ip.proto)
2784 				return -EINVAL;
2785 
2786 			if (ipv4_key->ipv4_frag != flow_key->ip.frag)
2787 				return -EINVAL;
2788 		}
2789 		break;
2790 	}
2791 	case OVS_KEY_ATTR_IPV6: {
2792 		const struct ovs_key_ipv6 *ipv6_key;
2793 
2794 		if (eth_type != htons(ETH_P_IPV6))
2795 			return -EINVAL;
2796 
2797 		ipv6_key = nla_data(ovs_key);
2798 
2799 		if (masked) {
2800 			const struct ovs_key_ipv6 *mask = ipv6_key + 1;
2801 
2802 			/* Non-writeable fields. */
2803 			if (mask->ipv6_proto || mask->ipv6_frag)
2804 				return -EINVAL;
2805 
2806 			/* Invalid bits in the flow label mask? */
2807 			if (ntohl(mask->ipv6_label) & 0xFFF00000)
2808 				return -EINVAL;
2809 		} else {
2810 			if (ipv6_key->ipv6_proto != flow_key->ip.proto)
2811 				return -EINVAL;
2812 
2813 			if (ipv6_key->ipv6_frag != flow_key->ip.frag)
2814 				return -EINVAL;
2815 		}
2816 		if (ntohl(ipv6_key->ipv6_label) & 0xFFF00000)
2817 			return -EINVAL;
2818 
2819 		break;
2820 	}
2821 	case OVS_KEY_ATTR_TCP:
2822 		if ((eth_type != htons(ETH_P_IP) &&
2823 		     eth_type != htons(ETH_P_IPV6)) ||
2824 		    flow_key->ip.proto != IPPROTO_TCP)
2825 			return -EINVAL;
2826 
2827 		break;
2828 
2829 	case OVS_KEY_ATTR_UDP:
2830 		if ((eth_type != htons(ETH_P_IP) &&
2831 		     eth_type != htons(ETH_P_IPV6)) ||
2832 		    flow_key->ip.proto != IPPROTO_UDP)
2833 			return -EINVAL;
2834 
2835 		break;
2836 
2837 	case OVS_KEY_ATTR_MPLS:
2838 		if (!eth_p_mpls(eth_type))
2839 			return -EINVAL;
2840 		break;
2841 
2842 	case OVS_KEY_ATTR_SCTP:
2843 		if ((eth_type != htons(ETH_P_IP) &&
2844 		     eth_type != htons(ETH_P_IPV6)) ||
2845 		    flow_key->ip.proto != IPPROTO_SCTP)
2846 			return -EINVAL;
2847 
2848 		break;
2849 
2850 	case OVS_KEY_ATTR_NSH:
2851 		if (eth_type != htons(ETH_P_NSH))
2852 			return -EINVAL;
2853 		if (!validate_nsh(nla_data(a), masked, false, log))
2854 			return -EINVAL;
2855 		break;
2856 
2857 	default:
2858 		return -EINVAL;
2859 	}
2860 
2861 	/* Convert non-masked non-tunnel set actions to masked set actions. */
2862 	if (!masked && key_type != OVS_KEY_ATTR_TUNNEL) {
2863 		int start, len = key_len * 2;
2864 		struct nlattr *at;
2865 
2866 		*skip_copy = true;
2867 
2868 		start = add_nested_action_start(sfa,
2869 						OVS_ACTION_ATTR_SET_TO_MASKED,
2870 						log);
2871 		if (start < 0)
2872 			return start;
2873 
2874 		at = __add_action(sfa, key_type, NULL, len, log);
2875 		if (IS_ERR(at))
2876 			return PTR_ERR(at);
2877 
2878 		memcpy(nla_data(at), nla_data(ovs_key), key_len); /* Key. */
2879 		memset(nla_data(at) + key_len, 0xff, key_len);    /* Mask. */
2880 		/* Clear non-writeable bits from otherwise writeable fields. */
2881 		if (key_type == OVS_KEY_ATTR_IPV6) {
2882 			struct ovs_key_ipv6 *mask = nla_data(at) + key_len;
2883 
2884 			mask->ipv6_label &= htonl(0x000FFFFF);
2885 		}
2886 		add_nested_action_end(*sfa, start);
2887 	}
2888 
2889 	return 0;
2890 }
2891 
2892 static int validate_userspace(const struct nlattr *attr)
2893 {
2894 	static const struct nla_policy userspace_policy[OVS_USERSPACE_ATTR_MAX + 1] = {
2895 		[OVS_USERSPACE_ATTR_PID] = {.type = NLA_U32 },
2896 		[OVS_USERSPACE_ATTR_USERDATA] = {.type = NLA_UNSPEC },
2897 		[OVS_USERSPACE_ATTR_EGRESS_TUN_PORT] = {.type = NLA_U32 },
2898 	};
2899 	struct nlattr *a[OVS_USERSPACE_ATTR_MAX + 1];
2900 	int error;
2901 
2902 	error = nla_parse_nested_deprecated(a, OVS_USERSPACE_ATTR_MAX, attr,
2903 					    userspace_policy, NULL);
2904 	if (error)
2905 		return error;
2906 
2907 	if (!a[OVS_USERSPACE_ATTR_PID] ||
2908 	    !nla_get_u32(a[OVS_USERSPACE_ATTR_PID]))
2909 		return -EINVAL;
2910 
2911 	return 0;
2912 }
2913 
2914 static const struct nla_policy cpl_policy[OVS_CHECK_PKT_LEN_ATTR_MAX + 1] = {
2915 	[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN] = {.type = NLA_U16 },
2916 	[OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER] = {.type = NLA_NESTED },
2917 	[OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL] = {.type = NLA_NESTED },
2918 };
2919 
2920 static int validate_and_copy_check_pkt_len(struct net *net,
2921 					   const struct nlattr *attr,
2922 					   const struct sw_flow_key *key,
2923 					   struct sw_flow_actions **sfa,
2924 					   __be16 eth_type, __be16 vlan_tci,
2925 					   u32 mpls_label_count,
2926 					   bool log, bool last)
2927 {
2928 	const struct nlattr *acts_if_greater, *acts_if_lesser_eq;
2929 	struct nlattr *a[OVS_CHECK_PKT_LEN_ATTR_MAX + 1];
2930 	struct check_pkt_len_arg arg;
2931 	int nested_acts_start;
2932 	int start, err;
2933 
2934 	err = nla_parse_deprecated_strict(a, OVS_CHECK_PKT_LEN_ATTR_MAX,
2935 					  nla_data(attr), nla_len(attr),
2936 					  cpl_policy, NULL);
2937 	if (err)
2938 		return err;
2939 
2940 	if (!a[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN] ||
2941 	    !nla_get_u16(a[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN]))
2942 		return -EINVAL;
2943 
2944 	acts_if_lesser_eq = a[OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL];
2945 	acts_if_greater = a[OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER];
2946 
2947 	/* Both the nested action should be present. */
2948 	if (!acts_if_greater || !acts_if_lesser_eq)
2949 		return -EINVAL;
2950 
2951 	/* validation done, copy the nested actions. */
2952 	start = add_nested_action_start(sfa, OVS_ACTION_ATTR_CHECK_PKT_LEN,
2953 					log);
2954 	if (start < 0)
2955 		return start;
2956 
2957 	arg.pkt_len = nla_get_u16(a[OVS_CHECK_PKT_LEN_ATTR_PKT_LEN]);
2958 	arg.exec_for_lesser_equal =
2959 		last || !actions_may_change_flow(acts_if_lesser_eq);
2960 	arg.exec_for_greater =
2961 		last || !actions_may_change_flow(acts_if_greater);
2962 
2963 	err = ovs_nla_add_action(sfa, OVS_CHECK_PKT_LEN_ATTR_ARG, &arg,
2964 				 sizeof(arg), log);
2965 	if (err)
2966 		return err;
2967 
2968 	nested_acts_start = add_nested_action_start(sfa,
2969 		OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL, log);
2970 	if (nested_acts_start < 0)
2971 		return nested_acts_start;
2972 
2973 	err = __ovs_nla_copy_actions(net, acts_if_lesser_eq, key, sfa,
2974 				     eth_type, vlan_tci, mpls_label_count, log);
2975 
2976 	if (err)
2977 		return err;
2978 
2979 	add_nested_action_end(*sfa, nested_acts_start);
2980 
2981 	nested_acts_start = add_nested_action_start(sfa,
2982 		OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER, log);
2983 	if (nested_acts_start < 0)
2984 		return nested_acts_start;
2985 
2986 	err = __ovs_nla_copy_actions(net, acts_if_greater, key, sfa,
2987 				     eth_type, vlan_tci, mpls_label_count, log);
2988 
2989 	if (err)
2990 		return err;
2991 
2992 	add_nested_action_end(*sfa, nested_acts_start);
2993 	add_nested_action_end(*sfa, start);
2994 	return 0;
2995 }
2996 
2997 static int copy_action(const struct nlattr *from,
2998 		       struct sw_flow_actions **sfa, bool log)
2999 {
3000 	int totlen = NLA_ALIGN(from->nla_len);
3001 	struct nlattr *to;
3002 
3003 	to = reserve_sfa_size(sfa, from->nla_len, log);
3004 	if (IS_ERR(to))
3005 		return PTR_ERR(to);
3006 
3007 	memcpy(to, from, totlen);
3008 	return 0;
3009 }
3010 
3011 static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
3012 				  const struct sw_flow_key *key,
3013 				  struct sw_flow_actions **sfa,
3014 				  __be16 eth_type, __be16 vlan_tci,
3015 				  u32 mpls_label_count, bool log)
3016 {
3017 	u8 mac_proto = ovs_key_mac_proto(key);
3018 	const struct nlattr *a;
3019 	int rem, err;
3020 
3021 	nla_for_each_nested(a, attr, rem) {
3022 		/* Expected argument lengths, (u32)-1 for variable length. */
3023 		static const u32 action_lens[OVS_ACTION_ATTR_MAX + 1] = {
3024 			[OVS_ACTION_ATTR_OUTPUT] = sizeof(u32),
3025 			[OVS_ACTION_ATTR_RECIRC] = sizeof(u32),
3026 			[OVS_ACTION_ATTR_USERSPACE] = (u32)-1,
3027 			[OVS_ACTION_ATTR_PUSH_MPLS] = sizeof(struct ovs_action_push_mpls),
3028 			[OVS_ACTION_ATTR_POP_MPLS] = sizeof(__be16),
3029 			[OVS_ACTION_ATTR_PUSH_VLAN] = sizeof(struct ovs_action_push_vlan),
3030 			[OVS_ACTION_ATTR_POP_VLAN] = 0,
3031 			[OVS_ACTION_ATTR_SET] = (u32)-1,
3032 			[OVS_ACTION_ATTR_SET_MASKED] = (u32)-1,
3033 			[OVS_ACTION_ATTR_SAMPLE] = (u32)-1,
3034 			[OVS_ACTION_ATTR_HASH] = sizeof(struct ovs_action_hash),
3035 			[OVS_ACTION_ATTR_CT] = (u32)-1,
3036 			[OVS_ACTION_ATTR_CT_CLEAR] = 0,
3037 			[OVS_ACTION_ATTR_TRUNC] = sizeof(struct ovs_action_trunc),
3038 			[OVS_ACTION_ATTR_PUSH_ETH] = sizeof(struct ovs_action_push_eth),
3039 			[OVS_ACTION_ATTR_POP_ETH] = 0,
3040 			[OVS_ACTION_ATTR_PUSH_NSH] = (u32)-1,
3041 			[OVS_ACTION_ATTR_POP_NSH] = 0,
3042 			[OVS_ACTION_ATTR_METER] = sizeof(u32),
3043 			[OVS_ACTION_ATTR_CLONE] = (u32)-1,
3044 			[OVS_ACTION_ATTR_CHECK_PKT_LEN] = (u32)-1,
3045 			[OVS_ACTION_ATTR_ADD_MPLS] = sizeof(struct ovs_action_add_mpls),
3046 			[OVS_ACTION_ATTR_DEC_TTL] = (u32)-1,
3047 		};
3048 		const struct ovs_action_push_vlan *vlan;
3049 		int type = nla_type(a);
3050 		bool skip_copy;
3051 
3052 		if (type > OVS_ACTION_ATTR_MAX ||
3053 		    (action_lens[type] != nla_len(a) &&
3054 		     action_lens[type] != (u32)-1))
3055 			return -EINVAL;
3056 
3057 		skip_copy = false;
3058 		switch (type) {
3059 		case OVS_ACTION_ATTR_UNSPEC:
3060 			return -EINVAL;
3061 
3062 		case OVS_ACTION_ATTR_USERSPACE:
3063 			err = validate_userspace(a);
3064 			if (err)
3065 				return err;
3066 			break;
3067 
3068 		case OVS_ACTION_ATTR_OUTPUT:
3069 			if (nla_get_u32(a) >= DP_MAX_PORTS)
3070 				return -EINVAL;
3071 			break;
3072 
3073 		case OVS_ACTION_ATTR_TRUNC: {
3074 			const struct ovs_action_trunc *trunc = nla_data(a);
3075 
3076 			if (trunc->max_len < ETH_HLEN)
3077 				return -EINVAL;
3078 			break;
3079 		}
3080 
3081 		case OVS_ACTION_ATTR_HASH: {
3082 			const struct ovs_action_hash *act_hash = nla_data(a);
3083 
3084 			switch (act_hash->hash_alg) {
3085 			case OVS_HASH_ALG_L4:
3086 				break;
3087 			default:
3088 				return  -EINVAL;
3089 			}
3090 
3091 			break;
3092 		}
3093 
3094 		case OVS_ACTION_ATTR_POP_VLAN:
3095 			if (mac_proto != MAC_PROTO_ETHERNET)
3096 				return -EINVAL;
3097 			vlan_tci = htons(0);
3098 			break;
3099 
3100 		case OVS_ACTION_ATTR_PUSH_VLAN:
3101 			if (mac_proto != MAC_PROTO_ETHERNET)
3102 				return -EINVAL;
3103 			vlan = nla_data(a);
3104 			if (!eth_type_vlan(vlan->vlan_tpid))
3105 				return -EINVAL;
3106 			if (!(vlan->vlan_tci & htons(VLAN_CFI_MASK)))
3107 				return -EINVAL;
3108 			vlan_tci = vlan->vlan_tci;
3109 			break;
3110 
3111 		case OVS_ACTION_ATTR_RECIRC:
3112 			break;
3113 
3114 		case OVS_ACTION_ATTR_ADD_MPLS: {
3115 			const struct ovs_action_add_mpls *mpls = nla_data(a);
3116 
3117 			if (!eth_p_mpls(mpls->mpls_ethertype))
3118 				return -EINVAL;
3119 
3120 			if (mpls->tun_flags & OVS_MPLS_L3_TUNNEL_FLAG_MASK) {
3121 				if (vlan_tci & htons(VLAN_CFI_MASK) ||
3122 				    (eth_type != htons(ETH_P_IP) &&
3123 				     eth_type != htons(ETH_P_IPV6) &&
3124 				     eth_type != htons(ETH_P_ARP) &&
3125 				     eth_type != htons(ETH_P_RARP) &&
3126 				     !eth_p_mpls(eth_type)))
3127 					return -EINVAL;
3128 				mpls_label_count++;
3129 			} else {
3130 				if (mac_proto == MAC_PROTO_ETHERNET) {
3131 					mpls_label_count = 1;
3132 					mac_proto = MAC_PROTO_NONE;
3133 				} else {
3134 					mpls_label_count++;
3135 				}
3136 			}
3137 			eth_type = mpls->mpls_ethertype;
3138 			break;
3139 		}
3140 
3141 		case OVS_ACTION_ATTR_PUSH_MPLS: {
3142 			const struct ovs_action_push_mpls *mpls = nla_data(a);
3143 
3144 			if (!eth_p_mpls(mpls->mpls_ethertype))
3145 				return -EINVAL;
3146 			/* Prohibit push MPLS other than to a white list
3147 			 * for packets that have a known tag order.
3148 			 */
3149 			if (vlan_tci & htons(VLAN_CFI_MASK) ||
3150 			    (eth_type != htons(ETH_P_IP) &&
3151 			     eth_type != htons(ETH_P_IPV6) &&
3152 			     eth_type != htons(ETH_P_ARP) &&
3153 			     eth_type != htons(ETH_P_RARP) &&
3154 			     !eth_p_mpls(eth_type)))
3155 				return -EINVAL;
3156 			eth_type = mpls->mpls_ethertype;
3157 			mpls_label_count++;
3158 			break;
3159 		}
3160 
3161 		case OVS_ACTION_ATTR_POP_MPLS: {
3162 			__be16  proto;
3163 			if (vlan_tci & htons(VLAN_CFI_MASK) ||
3164 			    !eth_p_mpls(eth_type))
3165 				return -EINVAL;
3166 
3167 			/* Disallow subsequent L2.5+ set actions and mpls_pop
3168 			 * actions once the last MPLS label in the packet is
3169 			 * is popped as there is no check here to ensure that
3170 			 * the new eth type is valid and thus set actions could
3171 			 * write off the end of the packet or otherwise corrupt
3172 			 * it.
3173 			 *
3174 			 * Support for these actions is planned using packet
3175 			 * recirculation.
3176 			 */
3177 			proto = nla_get_be16(a);
3178 
3179 			if (proto == htons(ETH_P_TEB) &&
3180 			    mac_proto != MAC_PROTO_NONE)
3181 				return -EINVAL;
3182 
3183 			mpls_label_count--;
3184 
3185 			if (!eth_p_mpls(proto) || !mpls_label_count)
3186 				eth_type = htons(0);
3187 			else
3188 				eth_type =  proto;
3189 
3190 			break;
3191 		}
3192 
3193 		case OVS_ACTION_ATTR_SET:
3194 			err = validate_set(a, key, sfa,
3195 					   &skip_copy, mac_proto, eth_type,
3196 					   false, log);
3197 			if (err)
3198 				return err;
3199 			break;
3200 
3201 		case OVS_ACTION_ATTR_SET_MASKED:
3202 			err = validate_set(a, key, sfa,
3203 					   &skip_copy, mac_proto, eth_type,
3204 					   true, log);
3205 			if (err)
3206 				return err;
3207 			break;
3208 
3209 		case OVS_ACTION_ATTR_SAMPLE: {
3210 			bool last = nla_is_last(a, rem);
3211 
3212 			err = validate_and_copy_sample(net, a, key, sfa,
3213 						       eth_type, vlan_tci,
3214 						       mpls_label_count,
3215 						       log, last);
3216 			if (err)
3217 				return err;
3218 			skip_copy = true;
3219 			break;
3220 		}
3221 
3222 		case OVS_ACTION_ATTR_CT:
3223 			err = ovs_ct_copy_action(net, a, key, sfa, log);
3224 			if (err)
3225 				return err;
3226 			skip_copy = true;
3227 			break;
3228 
3229 		case OVS_ACTION_ATTR_CT_CLEAR:
3230 			break;
3231 
3232 		case OVS_ACTION_ATTR_PUSH_ETH:
3233 			/* Disallow pushing an Ethernet header if one
3234 			 * is already present */
3235 			if (mac_proto != MAC_PROTO_NONE)
3236 				return -EINVAL;
3237 			mac_proto = MAC_PROTO_ETHERNET;
3238 			break;
3239 
3240 		case OVS_ACTION_ATTR_POP_ETH:
3241 			if (mac_proto != MAC_PROTO_ETHERNET)
3242 				return -EINVAL;
3243 			if (vlan_tci & htons(VLAN_CFI_MASK))
3244 				return -EINVAL;
3245 			mac_proto = MAC_PROTO_NONE;
3246 			break;
3247 
3248 		case OVS_ACTION_ATTR_PUSH_NSH:
3249 			if (mac_proto != MAC_PROTO_ETHERNET) {
3250 				u8 next_proto;
3251 
3252 				next_proto = tun_p_from_eth_p(eth_type);
3253 				if (!next_proto)
3254 					return -EINVAL;
3255 			}
3256 			mac_proto = MAC_PROTO_NONE;
3257 			if (!validate_nsh(nla_data(a), false, true, true))
3258 				return -EINVAL;
3259 			break;
3260 
3261 		case OVS_ACTION_ATTR_POP_NSH: {
3262 			__be16 inner_proto;
3263 
3264 			if (eth_type != htons(ETH_P_NSH))
3265 				return -EINVAL;
3266 			inner_proto = tun_p_to_eth_p(key->nsh.base.np);
3267 			if (!inner_proto)
3268 				return -EINVAL;
3269 			if (key->nsh.base.np == TUN_P_ETHERNET)
3270 				mac_proto = MAC_PROTO_ETHERNET;
3271 			else
3272 				mac_proto = MAC_PROTO_NONE;
3273 			break;
3274 		}
3275 
3276 		case OVS_ACTION_ATTR_METER:
3277 			/* Non-existent meters are simply ignored.  */
3278 			break;
3279 
3280 		case OVS_ACTION_ATTR_CLONE: {
3281 			bool last = nla_is_last(a, rem);
3282 
3283 			err = validate_and_copy_clone(net, a, key, sfa,
3284 						      eth_type, vlan_tci,
3285 						      mpls_label_count,
3286 						      log, last);
3287 			if (err)
3288 				return err;
3289 			skip_copy = true;
3290 			break;
3291 		}
3292 
3293 		case OVS_ACTION_ATTR_CHECK_PKT_LEN: {
3294 			bool last = nla_is_last(a, rem);
3295 
3296 			err = validate_and_copy_check_pkt_len(net, a, key, sfa,
3297 							      eth_type,
3298 							      vlan_tci,
3299 							      mpls_label_count,
3300 							      log, last);
3301 			if (err)
3302 				return err;
3303 			skip_copy = true;
3304 			break;
3305 		}
3306 
3307 		case OVS_ACTION_ATTR_DEC_TTL:
3308 			err = validate_and_copy_dec_ttl(net, a, key, sfa,
3309 							eth_type, vlan_tci,
3310 							mpls_label_count, log);
3311 			if (err)
3312 				return err;
3313 			skip_copy = true;
3314 			break;
3315 
3316 		default:
3317 			OVS_NLERR(log, "Unknown Action type %d", type);
3318 			return -EINVAL;
3319 		}
3320 		if (!skip_copy) {
3321 			err = copy_action(a, sfa, log);
3322 			if (err)
3323 				return err;
3324 		}
3325 	}
3326 
3327 	if (rem > 0)
3328 		return -EINVAL;
3329 
3330 	return 0;
3331 }
3332 
3333 /* 'key' must be the masked key. */
3334 int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
3335 			 const struct sw_flow_key *key,
3336 			 struct sw_flow_actions **sfa, bool log)
3337 {
3338 	int err;
3339 	u32 mpls_label_count = 0;
3340 
3341 	*sfa = nla_alloc_flow_actions(min(nla_len(attr), MAX_ACTIONS_BUFSIZE));
3342 	if (IS_ERR(*sfa))
3343 		return PTR_ERR(*sfa);
3344 
3345 	if (eth_p_mpls(key->eth.type))
3346 		mpls_label_count = hweight_long(key->mpls.num_labels_mask);
3347 
3348 	(*sfa)->orig_len = nla_len(attr);
3349 	err = __ovs_nla_copy_actions(net, attr, key, sfa, key->eth.type,
3350 				     key->eth.vlan.tci, mpls_label_count, log);
3351 	if (err)
3352 		ovs_nla_free_flow_actions(*sfa);
3353 
3354 	return err;
3355 }
3356 
3357 static int sample_action_to_attr(const struct nlattr *attr,
3358 				 struct sk_buff *skb)
3359 {
3360 	struct nlattr *start, *ac_start = NULL, *sample_arg;
3361 	int err = 0, rem = nla_len(attr);
3362 	const struct sample_arg *arg;
3363 	struct nlattr *actions;
3364 
3365 	start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_SAMPLE);
3366 	if (!start)
3367 		return -EMSGSIZE;
3368 
3369 	sample_arg = nla_data(attr);
3370 	arg = nla_data(sample_arg);
3371 	actions = nla_next(sample_arg, &rem);
3372 
3373 	if (nla_put_u32(skb, OVS_SAMPLE_ATTR_PROBABILITY, arg->probability)) {
3374 		err = -EMSGSIZE;
3375 		goto out;
3376 	}
3377 
3378 	ac_start = nla_nest_start_noflag(skb, OVS_SAMPLE_ATTR_ACTIONS);
3379 	if (!ac_start) {
3380 		err = -EMSGSIZE;
3381 		goto out;
3382 	}
3383 
3384 	err = ovs_nla_put_actions(actions, rem, skb);
3385 
3386 out:
3387 	if (err) {
3388 		nla_nest_cancel(skb, ac_start);
3389 		nla_nest_cancel(skb, start);
3390 	} else {
3391 		nla_nest_end(skb, ac_start);
3392 		nla_nest_end(skb, start);
3393 	}
3394 
3395 	return err;
3396 }
3397 
3398 static int clone_action_to_attr(const struct nlattr *attr,
3399 				struct sk_buff *skb)
3400 {
3401 	struct nlattr *start;
3402 	int err = 0, rem = nla_len(attr);
3403 
3404 	start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CLONE);
3405 	if (!start)
3406 		return -EMSGSIZE;
3407 
3408 	err = ovs_nla_put_actions(nla_data(attr), rem, skb);
3409 
3410 	if (err)
3411 		nla_nest_cancel(skb, start);
3412 	else
3413 		nla_nest_end(skb, start);
3414 
3415 	return err;
3416 }
3417 
3418 static int check_pkt_len_action_to_attr(const struct nlattr *attr,
3419 					struct sk_buff *skb)
3420 {
3421 	struct nlattr *start, *ac_start = NULL;
3422 	const struct check_pkt_len_arg *arg;
3423 	const struct nlattr *a, *cpl_arg;
3424 	int err = 0, rem = nla_len(attr);
3425 
3426 	start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_CHECK_PKT_LEN);
3427 	if (!start)
3428 		return -EMSGSIZE;
3429 
3430 	/* The first nested attribute in 'attr' is always
3431 	 * 'OVS_CHECK_PKT_LEN_ATTR_ARG'.
3432 	 */
3433 	cpl_arg = nla_data(attr);
3434 	arg = nla_data(cpl_arg);
3435 
3436 	if (nla_put_u16(skb, OVS_CHECK_PKT_LEN_ATTR_PKT_LEN, arg->pkt_len)) {
3437 		err = -EMSGSIZE;
3438 		goto out;
3439 	}
3440 
3441 	/* Second nested attribute in 'attr' is always
3442 	 * 'OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL'.
3443 	 */
3444 	a = nla_next(cpl_arg, &rem);
3445 	ac_start =  nla_nest_start_noflag(skb,
3446 					  OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL);
3447 	if (!ac_start) {
3448 		err = -EMSGSIZE;
3449 		goto out;
3450 	}
3451 
3452 	err = ovs_nla_put_actions(nla_data(a), nla_len(a), skb);
3453 	if (err) {
3454 		nla_nest_cancel(skb, ac_start);
3455 		goto out;
3456 	} else {
3457 		nla_nest_end(skb, ac_start);
3458 	}
3459 
3460 	/* Third nested attribute in 'attr' is always
3461 	 * OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER.
3462 	 */
3463 	a = nla_next(a, &rem);
3464 	ac_start =  nla_nest_start_noflag(skb,
3465 					  OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER);
3466 	if (!ac_start) {
3467 		err = -EMSGSIZE;
3468 		goto out;
3469 	}
3470 
3471 	err = ovs_nla_put_actions(nla_data(a), nla_len(a), skb);
3472 	if (err) {
3473 		nla_nest_cancel(skb, ac_start);
3474 		goto out;
3475 	} else {
3476 		nla_nest_end(skb, ac_start);
3477 	}
3478 
3479 	nla_nest_end(skb, start);
3480 	return 0;
3481 
3482 out:
3483 	nla_nest_cancel(skb, start);
3484 	return err;
3485 }
3486 
3487 static int dec_ttl_action_to_attr(const struct nlattr *attr,
3488 				  struct sk_buff *skb)
3489 {
3490 	int err = 0, rem = nla_len(attr);
3491 	struct nlattr *start;
3492 
3493 	start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_DEC_TTL);
3494 
3495 	if (!start)
3496 		return -EMSGSIZE;
3497 
3498 	err = ovs_nla_put_actions(nla_data(attr), rem, skb);
3499 	if (err)
3500 		nla_nest_cancel(skb, start);
3501 	else
3502 		nla_nest_end(skb, start);
3503 
3504 	return err;
3505 }
3506 
3507 static int set_action_to_attr(const struct nlattr *a, struct sk_buff *skb)
3508 {
3509 	const struct nlattr *ovs_key = nla_data(a);
3510 	int key_type = nla_type(ovs_key);
3511 	struct nlattr *start;
3512 	int err;
3513 
3514 	switch (key_type) {
3515 	case OVS_KEY_ATTR_TUNNEL_INFO: {
3516 		struct ovs_tunnel_info *ovs_tun = nla_data(ovs_key);
3517 		struct ip_tunnel_info *tun_info = &ovs_tun->tun_dst->u.tun_info;
3518 
3519 		start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_SET);
3520 		if (!start)
3521 			return -EMSGSIZE;
3522 
3523 		err =  ip_tun_to_nlattr(skb, &tun_info->key,
3524 					ip_tunnel_info_opts(tun_info),
3525 					tun_info->options_len,
3526 					ip_tunnel_info_af(tun_info), tun_info->mode);
3527 		if (err)
3528 			return err;
3529 		nla_nest_end(skb, start);
3530 		break;
3531 	}
3532 	default:
3533 		if (nla_put(skb, OVS_ACTION_ATTR_SET, nla_len(a), ovs_key))
3534 			return -EMSGSIZE;
3535 		break;
3536 	}
3537 
3538 	return 0;
3539 }
3540 
3541 static int masked_set_action_to_set_action_attr(const struct nlattr *a,
3542 						struct sk_buff *skb)
3543 {
3544 	const struct nlattr *ovs_key = nla_data(a);
3545 	struct nlattr *nla;
3546 	size_t key_len = nla_len(ovs_key) / 2;
3547 
3548 	/* Revert the conversion we did from a non-masked set action to
3549 	 * masked set action.
3550 	 */
3551 	nla = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_SET);
3552 	if (!nla)
3553 		return -EMSGSIZE;
3554 
3555 	if (nla_put(skb, nla_type(ovs_key), key_len, nla_data(ovs_key)))
3556 		return -EMSGSIZE;
3557 
3558 	nla_nest_end(skb, nla);
3559 	return 0;
3560 }
3561 
3562 int ovs_nla_put_actions(const struct nlattr *attr, int len, struct sk_buff *skb)
3563 {
3564 	const struct nlattr *a;
3565 	int rem, err;
3566 
3567 	nla_for_each_attr(a, attr, len, rem) {
3568 		int type = nla_type(a);
3569 
3570 		switch (type) {
3571 		case OVS_ACTION_ATTR_SET:
3572 			err = set_action_to_attr(a, skb);
3573 			if (err)
3574 				return err;
3575 			break;
3576 
3577 		case OVS_ACTION_ATTR_SET_TO_MASKED:
3578 			err = masked_set_action_to_set_action_attr(a, skb);
3579 			if (err)
3580 				return err;
3581 			break;
3582 
3583 		case OVS_ACTION_ATTR_SAMPLE:
3584 			err = sample_action_to_attr(a, skb);
3585 			if (err)
3586 				return err;
3587 			break;
3588 
3589 		case OVS_ACTION_ATTR_CT:
3590 			err = ovs_ct_action_to_attr(nla_data(a), skb);
3591 			if (err)
3592 				return err;
3593 			break;
3594 
3595 		case OVS_ACTION_ATTR_CLONE:
3596 			err = clone_action_to_attr(a, skb);
3597 			if (err)
3598 				return err;
3599 			break;
3600 
3601 		case OVS_ACTION_ATTR_CHECK_PKT_LEN:
3602 			err = check_pkt_len_action_to_attr(a, skb);
3603 			if (err)
3604 				return err;
3605 			break;
3606 
3607 		case OVS_ACTION_ATTR_DEC_TTL:
3608 			err = dec_ttl_action_to_attr(a, skb);
3609 			if (err)
3610 				return err;
3611 			break;
3612 
3613 		default:
3614 			if (nla_put(skb, type, nla_len(a), nla_data(a)))
3615 				return -EMSGSIZE;
3616 			break;
3617 		}
3618 	}
3619 
3620 	return 0;
3621 }
3622