spectrum_flower.c

  1// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
  2/* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */
  3
  4#include <linux/kernel.h>
  5#include <linux/errno.h>
  6#include <linux/netdevice.h>
  7#include <linux/log2.h>
  8#include <net/net_namespace.h>
  9#include <net/flow_dissector.h>
 10#include <net/pkt_cls.h>
 11#include <net/tc_act/tc_gact.h>
 12#include <net/tc_act/tc_mirred.h>
 13#include <net/tc_act/tc_vlan.h>
 14
 15#include "spectrum.h"
 16#include "core_acl_flex_keys.h"
 17
 18static int mlxsw_sp_policer_validate(const struct flow_action *action,
 19				     const struct flow_action_entry *act,
 20				     struct netlink_ext_ack *extack)
 21{
 22	if (act->police.exceed.act_id != FLOW_ACTION_DROP) {
 23		NL_SET_ERR_MSG_MOD(extack,
 24				   "Offload not supported when exceed action is not drop");
 25		return -EOPNOTSUPP;
 26	}
 27
 28	if (act->police.notexceed.act_id != FLOW_ACTION_PIPE &&
 29	    act->police.notexceed.act_id != FLOW_ACTION_ACCEPT) {
 30		NL_SET_ERR_MSG_MOD(extack,
 31				   "Offload not supported when conform action is not pipe or ok");
 32		return -EOPNOTSUPP;
 33	}
 34
 35	if (act->police.notexceed.act_id == FLOW_ACTION_ACCEPT &&
 36	    !flow_action_is_last_entry(action, act)) {
 37		NL_SET_ERR_MSG_MOD(extack,
 38				   "Offload not supported when conform action is ok, but action is not last");
 39		return -EOPNOTSUPP;
 40	}
 41
 42	if (act->police.peakrate_bytes_ps ||
 43	    act->police.avrate || act->police.overhead) {
 44		NL_SET_ERR_MSG_MOD(extack,
 45				   "Offload not supported when peakrate/avrate/overhead is configured");
 46		return -EOPNOTSUPP;
 47	}
 48
 49	if (act->police.rate_pkt_ps) {
 50		NL_SET_ERR_MSG_MOD(extack,
 51				   "QoS offload not support packets per second");
 52		return -EOPNOTSUPP;
 53	}
 54
 55	return 0;
 56}
 57
 58static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
 59					 struct mlxsw_sp_flow_block *block,
 60					 struct mlxsw_sp_acl_rule_info *rulei,
 61					 struct flow_action *flow_action,
 62					 struct netlink_ext_ack *extack)
 63{
 64	const struct flow_action_entry *act;
 65	int mirror_act_count = 0;
 66	int police_act_count = 0;
 67	int sample_act_count = 0;
 68	int err, i;
 69
 70	if (!flow_action_has_entries(flow_action))
 71		return 0;
 72	if (!flow_action_mixed_hw_stats_check(flow_action, extack))
 73		return -EOPNOTSUPP;
 74
 75	act = flow_action_first_entry_get(flow_action);
 76	if (act->hw_stats & FLOW_ACTION_HW_STATS_DISABLED) {
 77		/* Nothing to do */
 78	} else if (act->hw_stats & FLOW_ACTION_HW_STATS_IMMEDIATE) {
 79		/* Count action is inserted first */
 80		err = mlxsw_sp_acl_rulei_act_count(mlxsw_sp, rulei, extack);
 81		if (err)
 82			return err;
 83	} else {
 84		NL_SET_ERR_MSG_MOD(extack, "Unsupported action HW stats type");
 85		return -EOPNOTSUPP;
 86	}
 87
 88	flow_action_for_each(i, act, flow_action) {
 89		switch (act->id) {
 90		case FLOW_ACTION_ACCEPT:
 91			err = mlxsw_sp_acl_rulei_act_terminate(rulei);
 92			if (err) {
 93				NL_SET_ERR_MSG_MOD(extack, "Cannot append terminate action");
 94				return err;
 95			}
 96			break;
 97		case FLOW_ACTION_DROP: {
 98			bool ingress;
 99
100			if (mlxsw_sp_flow_block_is_mixed_bound(block)) {
101				NL_SET_ERR_MSG_MOD(extack, "Drop action is not supported when block is bound to ingress and egress");
102				return -EOPNOTSUPP;
103			}
104			ingress = mlxsw_sp_flow_block_is_ingress_bound(block);
105			err = mlxsw_sp_acl_rulei_act_drop(rulei, ingress,
106							  act->user_cookie, extack);
107			if (err) {
108				NL_SET_ERR_MSG_MOD(extack, "Cannot append drop action");
109				return err;
110			}
111
112			/* Forbid block with this rulei to be bound
113			 * to ingress/egress in future. Ingress rule is
114			 * a blocker for egress and vice versa.
115			 */
116			if (ingress)
117				rulei->egress_bind_blocker = 1;
118			else
119				rulei->ingress_bind_blocker = 1;
120			}
121			break;
122		case FLOW_ACTION_TRAP:
123			err = mlxsw_sp_acl_rulei_act_trap(rulei);
124			if (err) {
125				NL_SET_ERR_MSG_MOD(extack, "Cannot append trap action");
126				return err;
127			}
128			break;
129		case FLOW_ACTION_GOTO: {
130			u32 chain_index = act->chain_index;
131			struct mlxsw_sp_acl_ruleset *ruleset;
132			u16 group_id;
133
134			ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
135							      chain_index,
136							      MLXSW_SP_ACL_PROFILE_FLOWER);
137			if (IS_ERR(ruleset))
138				return PTR_ERR(ruleset);
139
140			group_id = mlxsw_sp_acl_ruleset_group_id(ruleset);
141			err = mlxsw_sp_acl_rulei_act_jump(rulei, group_id);
142			if (err) {
143				NL_SET_ERR_MSG_MOD(extack, "Cannot append jump action");
144				return err;
145			}
146			}
147			break;
148		case FLOW_ACTION_REDIRECT: {
149			struct net_device *out_dev;
150			struct mlxsw_sp_fid *fid;
151			u16 fid_index;
152
153			if (mlxsw_sp_flow_block_is_egress_bound(block)) {
154				NL_SET_ERR_MSG_MOD(extack, "Redirect action is not supported on egress");
155				return -EOPNOTSUPP;
156			}
157
158			/* Forbid block with this rulei to be bound
159			 * to egress in future.
160			 */
161			rulei->egress_bind_blocker = 1;
162
163			/* Ignore learning and security lookup as redirection
164			 * using ingress filters happens before the bridge.
165			 */
166			err = mlxsw_sp_acl_rulei_act_ignore(mlxsw_sp, rulei,
167							    true, true);
168			if (err) {
169				NL_SET_ERR_MSG_MOD(extack, "Cannot append ignore action");
170				return err;
171			}
172
173			fid = mlxsw_sp_acl_dummy_fid(mlxsw_sp);
174			fid_index = mlxsw_sp_fid_index(fid);
175			err = mlxsw_sp_acl_rulei_act_fid_set(mlxsw_sp, rulei,
176							     fid_index, extack);
177			if (err)
178				return err;
179
180			out_dev = act->dev;
181			err = mlxsw_sp_acl_rulei_act_fwd(mlxsw_sp, rulei,
182							 out_dev, extack);
183			if (err)
184				return err;
185			}
186			break;
187		case FLOW_ACTION_MIRRED: {
188			struct net_device *out_dev = act->dev;
189
190			if (mirror_act_count++) {
191				NL_SET_ERR_MSG_MOD(extack, "Multiple mirror actions per rule are not supported");
192				return -EOPNOTSUPP;
193			}
194
195			if (sample_act_count) {
196				NL_SET_ERR_MSG_MOD(extack, "Mirror action after sample action is not supported");
197				return -EOPNOTSUPP;
198			}
199
200			err = mlxsw_sp_acl_rulei_act_mirror(mlxsw_sp, rulei,
201							    block, out_dev,
202							    extack);
203			if (err)
204				return err;
205			}
206			break;
207		case FLOW_ACTION_VLAN_MANGLE: {
208			u16 proto = be16_to_cpu(act->vlan.proto);
209			u8 prio = act->vlan.prio;
210			u16 vid = act->vlan.vid;
211
212			err = mlxsw_sp_acl_rulei_act_vlan(mlxsw_sp, rulei,
213							  act->id, vid,
214							  proto, prio, extack);
215			if (err)
216				return err;
217			break;
218			}
219		case FLOW_ACTION_PRIORITY:
220			err = mlxsw_sp_acl_rulei_act_priority(mlxsw_sp, rulei,
221							      act->priority,
222							      extack);
223			if (err)
224				return err;
225			break;
226		case FLOW_ACTION_MANGLE: {
227			enum flow_action_mangle_base htype = act->mangle.htype;
228			__be32 be_mask = (__force __be32) act->mangle.mask;
229			__be32 be_val = (__force __be32) act->mangle.val;
230			u32 offset = act->mangle.offset;
231			u32 mask = be32_to_cpu(be_mask);
232			u32 val = be32_to_cpu(be_val);
233
234			err = mlxsw_sp_acl_rulei_act_mangle(mlxsw_sp, rulei,
235							    htype, offset,
236							    mask, val, extack);
237			if (err)
238				return err;
239			break;
240			}
241		case FLOW_ACTION_POLICE: {
242			u32 burst;
243
244			if (police_act_count++) {
245				NL_SET_ERR_MSG_MOD(extack, "Multiple police actions per rule are not supported");
246				return -EOPNOTSUPP;
247			}
248
249			err = mlxsw_sp_policer_validate(flow_action, act, extack);
250			if (err)
251				return err;
252
253			/* The kernel might adjust the requested burst size so
254			 * that it is not exactly a power of two. Re-adjust it
255			 * here since the hardware only supports burst sizes
256			 * that are a power of two.
257			 */
258			burst = roundup_pow_of_two(act->police.burst);
259			err = mlxsw_sp_acl_rulei_act_police(mlxsw_sp, rulei,
260							    act->hw_index,
261							    act->police.rate_bytes_ps,
262							    burst, extack);
263			if (err)
264				return err;
265			break;
266			}
267		case FLOW_ACTION_SAMPLE: {
268			if (sample_act_count++) {
269				NL_SET_ERR_MSG_MOD(extack, "Multiple sample actions per rule are not supported");
270				return -EOPNOTSUPP;
271			}
272
273			if (mirror_act_count) {
274				NL_SET_ERR_MSG_MOD(extack, "Sample action after mirror action is not supported");
275				return -EOPNOTSUPP;
276			}
277
278			err = mlxsw_sp_acl_rulei_act_sample(mlxsw_sp, rulei,
279							    block,
280							    act->sample.psample_group,
281							    act->sample.rate,
282							    act->sample.trunc_size,
283							    act->sample.truncate,
284							    extack);
285			if (err)
286				return err;
287			break;
288			}
289		default:
290			NL_SET_ERR_MSG_MOD(extack, "Unsupported action");
291			dev_err(mlxsw_sp->bus_info->dev, "Unsupported action\n");
292			return -EOPNOTSUPP;
293		}
294	}
295
296	if (rulei->ipv6_valid) {
297		NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field");
298		return -EOPNOTSUPP;
299	}
300
301	return 0;
302}
303
304static int
305mlxsw_sp_flower_parse_meta_iif(struct mlxsw_sp_acl_rule_info *rulei,
306			       const struct mlxsw_sp_flow_block *block,
307			       const struct flow_match_meta *match,
308			       struct netlink_ext_ack *extack)
309{
310	struct mlxsw_sp_port *mlxsw_sp_port;
311	struct net_device *ingress_dev;
312
313	if (!match->mask->ingress_ifindex)
314		return 0;
315
316	if (match->mask->ingress_ifindex != 0xFFFFFFFF) {
317		NL_SET_ERR_MSG_MOD(extack, "Unsupported ingress ifindex mask");
318		return -EINVAL;
319	}
320
321	ingress_dev = __dev_get_by_index(block->net,
322					 match->key->ingress_ifindex);
323	if (!ingress_dev) {
324		NL_SET_ERR_MSG_MOD(extack, "Can't find specified ingress port to match on");
325		return -EINVAL;
326	}
327
328	if (!mlxsw_sp_port_dev_check(ingress_dev)) {
329		NL_SET_ERR_MSG_MOD(extack, "Can't match on non-mlxsw ingress port");
330		return -EINVAL;
331	}
332
333	mlxsw_sp_port = netdev_priv(ingress_dev);
334	if (mlxsw_sp_port->mlxsw_sp != block->mlxsw_sp) {
335		NL_SET_ERR_MSG_MOD(extack, "Can't match on a port from different device");
336		return -EINVAL;
337	}
338
339	mlxsw_sp_acl_rulei_keymask_u32(rulei,
340				       MLXSW_AFK_ELEMENT_SRC_SYS_PORT,
341				       mlxsw_sp_port->local_port,
342				       0xFFFFFFFF);
343
344	return 0;
345}
346
347static int mlxsw_sp_flower_parse_meta(struct mlxsw_sp_acl_rule_info *rulei,
348				      struct flow_cls_offload *f,
349				      struct mlxsw_sp_flow_block *block)
350{
351	struct flow_rule *rule = flow_cls_offload_flow_rule(f);
352	struct flow_match_meta match;
353
354	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META))
355		return 0;
356
357	flow_rule_match_meta(rule, &match);
358
359	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_FDB_MISS,
360				       match.key->l2_miss, match.mask->l2_miss);
361
362	return mlxsw_sp_flower_parse_meta_iif(rulei, block, &match,
363					      f->common.extack);
364}
365
366static void mlxsw_sp_flower_parse_ipv4(struct mlxsw_sp_acl_rule_info *rulei,
367				       struct flow_cls_offload *f)
368{
369	struct flow_match_ipv4_addrs match;
370
371	flow_rule_match_ipv4_addrs(f->rule, &match);
372
373	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31,
374				       (char *) &match.key->src,
375				       (char *) &match.mask->src, 4);
376	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31,
377				       (char *) &match.key->dst,
378				       (char *) &match.mask->dst, 4);
379}
380
381static void mlxsw_sp_flower_parse_ipv6(struct mlxsw_sp_acl_rule_info *rulei,
382				       struct flow_cls_offload *f)
383{
384	struct flow_match_ipv6_addrs match;
385
386	flow_rule_match_ipv6_addrs(f->rule, &match);
387
388	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_96_127,
389				       &match.key->src.s6_addr[0x0],
390				       &match.mask->src.s6_addr[0x0], 4);
391	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_64_95,
392				       &match.key->src.s6_addr[0x4],
393				       &match.mask->src.s6_addr[0x4], 4);
394	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_32_63,
395				       &match.key->src.s6_addr[0x8],
396				       &match.mask->src.s6_addr[0x8], 4);
397	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31,
398				       &match.key->src.s6_addr[0xC],
399				       &match.mask->src.s6_addr[0xC], 4);
400	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_96_127,
401				       &match.key->dst.s6_addr[0x0],
402				       &match.mask->dst.s6_addr[0x0], 4);
403	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_64_95,
404				       &match.key->dst.s6_addr[0x4],
405				       &match.mask->dst.s6_addr[0x4], 4);
406	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_32_63,
407				       &match.key->dst.s6_addr[0x8],
408				       &match.mask->dst.s6_addr[0x8], 4);
409	mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31,
410				       &match.key->dst.s6_addr[0xC],
411				       &match.mask->dst.s6_addr[0xC], 4);
412}
413
414static int mlxsw_sp_flower_parse_ports(struct mlxsw_sp *mlxsw_sp,
415				       struct mlxsw_sp_acl_rule_info *rulei,
416				       struct flow_cls_offload *f,
417				       u8 ip_proto)
418{
419	const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
420	struct flow_match_ports match;
421
422	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS))
423		return 0;
424
425	if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
426		NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported");
427		dev_err(mlxsw_sp->bus_info->dev, "Only UDP and TCP keys are supported\n");
428		return -EINVAL;
429	}
430
431	flow_rule_match_ports(rule, &match);
432	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_L4_PORT,
433				       ntohs(match.key->dst),
434				       ntohs(match.mask->dst));
435	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_L4_PORT,
436				       ntohs(match.key->src),
437				       ntohs(match.mask->src));
438	return 0;
439}
440
441static int
442mlxsw_sp_flower_parse_ports_range(struct mlxsw_sp *mlxsw_sp,
443				  struct mlxsw_sp_acl_rule_info *rulei,
444				  struct flow_cls_offload *f, u8 ip_proto)
445{
446	const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
447	struct flow_match_ports_range match;
448	u32 key_mask_value = 0;
449
450	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS_RANGE))
451		return 0;
452
453	if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
454		NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported");
455		return -EINVAL;
456	}
457
458	flow_rule_match_ports_range(rule, &match);
459
460	if (match.mask->tp_min.src) {
461		struct mlxsw_sp_port_range range = {
462			.min = ntohs(match.key->tp_min.src),
463			.max = ntohs(match.key->tp_max.src),
464			.source = true,
465		};
466		u8 prr_index;
467		int err;
468
469		err = mlxsw_sp_port_range_reg_get(mlxsw_sp, &range,
470						  f->common.extack, &prr_index);
471		if (err)
472			return err;
473
474		rulei->src_port_range_reg_index = prr_index;
475		rulei->src_port_range_reg_valid = true;
476		key_mask_value |= BIT(prr_index);
477	}
478
479	if (match.mask->tp_min.dst) {
480		struct mlxsw_sp_port_range range = {
481			.min = ntohs(match.key->tp_min.dst),
482			.max = ntohs(match.key->tp_max.dst),
483		};
484		u8 prr_index;
485		int err;
486
487		err = mlxsw_sp_port_range_reg_get(mlxsw_sp, &range,
488						  f->common.extack, &prr_index);
489		if (err)
490			return err;
491
492		rulei->dst_port_range_reg_index = prr_index;
493		rulei->dst_port_range_reg_valid = true;
494		key_mask_value |= BIT(prr_index);
495	}
496
497	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_L4_PORT_RANGE,
498				       key_mask_value, key_mask_value);
499
500	return 0;
501}
502
503static int mlxsw_sp_flower_parse_tcp(struct mlxsw_sp *mlxsw_sp,
504				     struct mlxsw_sp_acl_rule_info *rulei,
505				     struct flow_cls_offload *f,
506				     u8 ip_proto)
507{
508	const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
509	struct flow_match_tcp match;
510
511	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_TCP))
512		return 0;
513
514	if (ip_proto != IPPROTO_TCP) {
515		NL_SET_ERR_MSG_MOD(f->common.extack, "TCP keys supported only for TCP");
516		dev_err(mlxsw_sp->bus_info->dev, "TCP keys supported only for TCP\n");
517		return -EINVAL;
518	}
519
520	flow_rule_match_tcp(rule, &match);
521
522	if (match.mask->flags & htons(0x0E00)) {
523		NL_SET_ERR_MSG_MOD(f->common.extack, "TCP flags match not supported on reserved bits");
524		dev_err(mlxsw_sp->bus_info->dev, "TCP flags match not supported on reserved bits\n");
525		return -EINVAL;
526	}
527
528	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_TCP_FLAGS,
529				       ntohs(match.key->flags),
530				       ntohs(match.mask->flags));
531	return 0;
532}
533
534static int mlxsw_sp_flower_parse_ip(struct mlxsw_sp *mlxsw_sp,
535				    struct mlxsw_sp_acl_rule_info *rulei,
536				    struct flow_cls_offload *f,
537				    u16 n_proto)
538{
539	const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
540	struct flow_match_ip match;
541
542	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IP))
543		return 0;
544
545	if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6) {
546		NL_SET_ERR_MSG_MOD(f->common.extack, "IP keys supported only for IPv4/6");
547		dev_err(mlxsw_sp->bus_info->dev, "IP keys supported only for IPv4/6\n");
548		return -EINVAL;
549	}
550
551	flow_rule_match_ip(rule, &match);
552
553	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_TTL_,
554				       match.key->ttl, match.mask->ttl);
555
556	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_ECN,
557				       match.key->tos & 0x3,
558				       match.mask->tos & 0x3);
559
560	mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_DSCP,
561				       match.key->tos >> 2,
562				       match.mask->tos >> 2);
563
564	return 0;
565}
566
567static int mlxsw_sp_flower_parse(struct mlxsw_sp *mlxsw_sp,
568				 struct mlxsw_sp_flow_block *block,
569				 struct mlxsw_sp_acl_rule_info *rulei,
570				 struct flow_cls_offload *f)
571{
572	struct flow_rule *rule = flow_cls_offload_flow_rule(f);
573	struct flow_dissector *dissector = rule->match.dissector;
574	u16 n_proto_mask = 0;
575	u16 n_proto_key = 0;
576	u16 addr_type = 0;
577	u8 ip_proto = 0;
578	int err;
579
580	if (dissector->used_keys &
581	    ~(BIT_ULL(FLOW_DISSECTOR_KEY_META) |
582	      BIT_ULL(FLOW_DISSECTOR_KEY_CONTROL) |
583	      BIT_ULL(FLOW_DISSECTOR_KEY_BASIC) |
584	      BIT_ULL(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
585	      BIT_ULL(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
586	      BIT_ULL(FLOW_DISSECTOR_KEY_IPV6_ADDRS) |
587	      BIT_ULL(FLOW_DISSECTOR_KEY_PORTS) |
588	      BIT_ULL(FLOW_DISSECTOR_KEY_PORTS_RANGE) |
589	      BIT_ULL(FLOW_DISSECTOR_KEY_TCP) |
590	      BIT_ULL(FLOW_DISSECTOR_KEY_IP) |
591	      BIT_ULL(FLOW_DISSECTOR_KEY_VLAN))) {
592		dev_err(mlxsw_sp->bus_info->dev, "Unsupported key\n");
593		NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported key");
594		return -EOPNOTSUPP;
595	}
596
597	mlxsw_sp_acl_rulei_priority(rulei, f->common.prio);
598
599	err = mlxsw_sp_flower_parse_meta(rulei, f, block);
600	if (err)
601		return err;
602
603	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CONTROL)) {
604		struct flow_match_control match;
605
606		flow_rule_match_control(rule, &match);
607		addr_type = match.key->addr_type;
608
609		if (flow_rule_has_control_flags(match.mask->flags,
610						f->common.extack))
611			return -EOPNOTSUPP;
612	}
613
614	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) {
615		struct flow_match_basic match;
616
617		flow_rule_match_basic(rule, &match);
618		n_proto_key = ntohs(match.key->n_proto);
619		n_proto_mask = ntohs(match.mask->n_proto);
620
621		if (n_proto_key == ETH_P_ALL) {
622			n_proto_key = 0;
623			n_proto_mask = 0;
624		}
625		mlxsw_sp_acl_rulei_keymask_u32(rulei,
626					       MLXSW_AFK_ELEMENT_ETHERTYPE,
627					       n_proto_key, n_proto_mask);
628
629		ip_proto = match.key->ip_proto;
630		mlxsw_sp_acl_rulei_keymask_u32(rulei,
631					       MLXSW_AFK_ELEMENT_IP_PROTO,
632					       match.key->ip_proto,
633					       match.mask->ip_proto);
634	}
635
636	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
637		struct flow_match_eth_addrs match;
638
639		flow_rule_match_eth_addrs(rule, &match);
640		mlxsw_sp_acl_rulei_keymask_buf(rulei,
641					       MLXSW_AFK_ELEMENT_DMAC_32_47,
642					       match.key->dst,
643					       match.mask->dst, 2);
644		mlxsw_sp_acl_rulei_keymask_buf(rulei,
645					       MLXSW_AFK_ELEMENT_DMAC_0_31,
646					       match.key->dst + 2,
647					       match.mask->dst + 2, 4);
648		mlxsw_sp_acl_rulei_keymask_buf(rulei,
649					       MLXSW_AFK_ELEMENT_SMAC_32_47,
650					       match.key->src,
651					       match.mask->src, 2);
652		mlxsw_sp_acl_rulei_keymask_buf(rulei,
653					       MLXSW_AFK_ELEMENT_SMAC_0_31,
654					       match.key->src + 2,
655					       match.mask->src + 2, 4);
656	}
657
658	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) {
659		struct flow_match_vlan match;
660
661		flow_rule_match_vlan(rule, &match);
662		if (mlxsw_sp_flow_block_is_egress_bound(block) &&
663		    match.mask->vlan_id) {
664			NL_SET_ERR_MSG_MOD(f->common.extack, "vlan_id key is not supported on egress");
665			return -EOPNOTSUPP;
666		}
667
668		/* Forbid block with this rulei to be bound
669		 * to egress in future.
670		 */
671		rulei->egress_bind_blocker = 1;
672
673		if (match.mask->vlan_id != 0)
674			mlxsw_sp_acl_rulei_keymask_u32(rulei,
675						       MLXSW_AFK_ELEMENT_VID,
676						       match.key->vlan_id,
677						       match.mask->vlan_id);
678		if (match.mask->vlan_priority != 0)
679			mlxsw_sp_acl_rulei_keymask_u32(rulei,
680						       MLXSW_AFK_ELEMENT_PCP,
681						       match.key->vlan_priority,
682						       match.mask->vlan_priority);
683	}
684
685	if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS)
686		mlxsw_sp_flower_parse_ipv4(rulei, f);
687
688	if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS)
689		mlxsw_sp_flower_parse_ipv6(rulei, f);
690
691	err = mlxsw_sp_flower_parse_ports(mlxsw_sp, rulei, f, ip_proto);
692	if (err)
693		return err;
694
695	err = mlxsw_sp_flower_parse_ports_range(mlxsw_sp, rulei, f, ip_proto);
696	if (err)
697		return err;
698
699	err = mlxsw_sp_flower_parse_tcp(mlxsw_sp, rulei, f, ip_proto);
700	if (err)
701		return err;
702
703	err = mlxsw_sp_flower_parse_ip(mlxsw_sp, rulei, f, n_proto_key & n_proto_mask);
704	if (err)
705		return err;
706
707	return mlxsw_sp_flower_parse_actions(mlxsw_sp, block, rulei,
708					     &f->rule->action,
709					     f->common.extack);
710}
711
712static int mlxsw_sp_flower_mall_prio_check(struct mlxsw_sp_flow_block *block,
713					   struct flow_cls_offload *f)
714{
715	bool ingress = mlxsw_sp_flow_block_is_ingress_bound(block);
716	unsigned int mall_min_prio;
717	unsigned int mall_max_prio;
718	int err;
719
720	err = mlxsw_sp_mall_prio_get(block, f->common.chain_index,
721				     &mall_min_prio, &mall_max_prio);
722	if (err) {
723		if (err == -ENOENT)
724			/* No matchall filters installed on this chain. */
725			return 0;
726		NL_SET_ERR_MSG(f->common.extack, "Failed to get matchall priorities");
727		return err;
728	}
729	if (ingress && f->common.prio <= mall_min_prio) {
730		NL_SET_ERR_MSG(f->common.extack, "Failed to add in front of existing matchall rules");
731		return -EOPNOTSUPP;
732	}
733	if (!ingress && f->common.prio >= mall_max_prio) {
734		NL_SET_ERR_MSG(f->common.extack, "Failed to add behind of existing matchall rules");
735		return -EOPNOTSUPP;
736	}
737	return 0;
738}
739
740int mlxsw_sp_flower_replace(struct mlxsw_sp *mlxsw_sp,
741			    struct mlxsw_sp_flow_block *block,
742			    struct flow_cls_offload *f)
743{
744	struct mlxsw_sp_acl_rule_info *rulei;
745	struct mlxsw_sp_acl_ruleset *ruleset;
746	struct mlxsw_sp_acl_rule *rule;
747	int err;
748
749	err = mlxsw_sp_flower_mall_prio_check(block, f);
750	if (err)
751		return err;
752
753	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
754					   f->common.chain_index,
755					   MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
756	if (IS_ERR(ruleset))
757		return PTR_ERR(ruleset);
758
759	rule = mlxsw_sp_acl_rule_create(mlxsw_sp, ruleset, f->cookie, NULL,
760					f->common.extack);
761	if (IS_ERR(rule)) {
762		err = PTR_ERR(rule);
763		goto err_rule_create;
764	}
765
766	rulei = mlxsw_sp_acl_rule_rulei(rule);
767	err = mlxsw_sp_flower_parse(mlxsw_sp, block, rulei, f);
768	if (err)
769		goto err_flower_parse;
770
771	err = mlxsw_sp_acl_rulei_commit(rulei);
772	if (err)
773		goto err_rulei_commit;
774
775	err = mlxsw_sp_acl_rule_add(mlxsw_sp, rule);
776	if (err)
777		goto err_rule_add;
778
779	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
780	return 0;
781
782err_rule_add:
783err_rulei_commit:
784err_flower_parse:
785	mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
786err_rule_create:
787	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
788	return err;
789}
790
791void mlxsw_sp_flower_destroy(struct mlxsw_sp *mlxsw_sp,
792			     struct mlxsw_sp_flow_block *block,
793			     struct flow_cls_offload *f)
794{
795	struct mlxsw_sp_acl_ruleset *ruleset;
796	struct mlxsw_sp_acl_rule *rule;
797
798	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
799					   f->common.chain_index,
800					   MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
801	if (IS_ERR(ruleset))
802		return;
803
804	rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
805	if (rule) {
806		mlxsw_sp_acl_rule_del(mlxsw_sp, rule);
807		mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
808	}
809
810	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
811}
812
813int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp,
814			  struct mlxsw_sp_flow_block *block,
815			  struct flow_cls_offload *f)
816{
817	enum flow_action_hw_stats used_hw_stats = FLOW_ACTION_HW_STATS_DISABLED;
818	struct mlxsw_sp_acl_ruleset *ruleset;
819	struct mlxsw_sp_acl_rule *rule;
820	u64 packets;
821	u64 lastuse;
822	u64 bytes;
823	u64 drops;
824	int err;
825
826	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
827					   f->common.chain_index,
828					   MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
829	if (WARN_ON(IS_ERR(ruleset)))
830		return -EINVAL;
831
832	rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
833	if (!rule) {
834		err = -EINVAL;
835		goto err_rule_get_stats;
836	}
837
838	err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes,
839					  &drops, &lastuse, &used_hw_stats);
840	if (err)
841		goto err_rule_get_stats;
842
843	flow_stats_update(&f->stats, bytes, packets, drops, lastuse,
844			  used_hw_stats);
845
846	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
847	return 0;
848
849err_rule_get_stats:
850	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
851	return err;
852}
853
854int mlxsw_sp_flower_tmplt_create(struct mlxsw_sp *mlxsw_sp,
855				 struct mlxsw_sp_flow_block *block,
856				 struct flow_cls_offload *f)
857{
858	struct mlxsw_sp_acl_ruleset *ruleset;
859	struct mlxsw_sp_acl_rule_info rulei;
860	int err;
861
862	memset(&rulei, 0, sizeof(rulei));
863	err = mlxsw_sp_flower_parse(mlxsw_sp, block, &rulei, f);
864	if (err)
865		return err;
866	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
867					   f->common.chain_index,
868					   MLXSW_SP_ACL_PROFILE_FLOWER,
869					   &rulei.values.elusage);
870
871	/* keep the reference to the ruleset */
872	return PTR_ERR_OR_ZERO(ruleset);
873}
874
875void mlxsw_sp_flower_tmplt_destroy(struct mlxsw_sp *mlxsw_sp,
876				   struct mlxsw_sp_flow_block *block,
877				   struct flow_cls_offload *f)
878{
879	struct mlxsw_sp_acl_ruleset *ruleset;
880
881	ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
882					   f->common.chain_index,
883					   MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
884	if (IS_ERR(ruleset))
885		return;
886	/* put the reference to the ruleset kept in create */
887	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
888	mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
889}
890
891int mlxsw_sp_flower_prio_get(struct mlxsw_sp *mlxsw_sp,
892			     struct mlxsw_sp_flow_block *block,
893			     u32 chain_index, unsigned int *p_min_prio,
894			     unsigned int *p_max_prio)
895{
896	struct mlxsw_sp_acl_ruleset *ruleset;
897
898	ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
899					      chain_index,
900					      MLXSW_SP_ACL_PROFILE_FLOWER);
901	if (IS_ERR(ruleset))
902		/* In case there are no flower rules, the caller
903		 * receives -ENOENT to indicate there is no need
904		 * to check the priorities.
905		 */
906		return PTR_ERR(ruleset);
907	mlxsw_sp_acl_ruleset_prio_get(ruleset, p_min_prio, p_max_prio);
908	return 0;
909}