1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35#include <linux/kernel.h>
36#include <linux/errno.h>
37#include <linux/netdevice.h>
38#include <net/net_namespace.h>
39#include <net/flow_dissector.h>
40#include <net/pkt_cls.h>
41#include <net/tc_act/tc_gact.h>
42#include <net/tc_act/tc_mirred.h>
43#include <net/tc_act/tc_vlan.h>
44
45#include "spectrum.h"
46#include "core_acl_flex_keys.h"
47
48static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
49 struct mlxsw_sp_acl_block *block,
50 struct mlxsw_sp_acl_rule_info *rulei,
51 struct tcf_exts *exts)
52{
53 const struct tc_action *a;
54 LIST_HEAD(actions);
55 int err;
56
57 if (!tcf_exts_has_actions(exts))
58 return 0;
59
60
61 err = mlxsw_sp_acl_rulei_act_count(mlxsw_sp, rulei);
62 if (err)
63 return err;
64
65 tcf_exts_to_list(exts, &actions);
66 list_for_each_entry(a, &actions, list) {
67 if (is_tcf_gact_ok(a)) {
68 err = mlxsw_sp_acl_rulei_act_terminate(rulei);
69 if (err)
70 return err;
71 } else if (is_tcf_gact_shot(a)) {
72 err = mlxsw_sp_acl_rulei_act_drop(rulei);
73 if (err)
74 return err;
75 } else if (is_tcf_gact_trap(a)) {
76 err = mlxsw_sp_acl_rulei_act_trap(rulei);
77 if (err)
78 return err;
79 } else if (is_tcf_gact_goto_chain(a)) {
80 u32 chain_index = tcf_gact_goto_chain_index(a);
81 struct mlxsw_sp_acl_ruleset *ruleset;
82 u16 group_id;
83
84 ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
85 chain_index,
86 MLXSW_SP_ACL_PROFILE_FLOWER);
87 if (IS_ERR(ruleset))
88 return PTR_ERR(ruleset);
89
90 group_id = mlxsw_sp_acl_ruleset_group_id(ruleset);
91 err = mlxsw_sp_acl_rulei_act_jump(rulei, group_id);
92 if (err)
93 return err;
94 } else if (is_tcf_mirred_egress_redirect(a)) {
95 struct net_device *out_dev;
96 struct mlxsw_sp_fid *fid;
97 u16 fid_index;
98
99 fid = mlxsw_sp_acl_dummy_fid(mlxsw_sp);
100 fid_index = mlxsw_sp_fid_index(fid);
101 err = mlxsw_sp_acl_rulei_act_fid_set(mlxsw_sp, rulei,
102 fid_index);
103 if (err)
104 return err;
105
106 out_dev = tcf_mirred_dev(a);
107 err = mlxsw_sp_acl_rulei_act_fwd(mlxsw_sp, rulei,
108 out_dev);
109 if (err)
110 return err;
111 } else if (is_tcf_mirred_egress_mirror(a)) {
112 struct net_device *out_dev = tcf_mirred_dev(a);
113
114 err = mlxsw_sp_acl_rulei_act_mirror(mlxsw_sp, rulei,
115 block, out_dev);
116 if (err)
117 return err;
118 } else if (is_tcf_vlan(a)) {
119 u16 proto = be16_to_cpu(tcf_vlan_push_proto(a));
120 u32 action = tcf_vlan_action(a);
121 u8 prio = tcf_vlan_push_prio(a);
122 u16 vid = tcf_vlan_push_vid(a);
123
124 return mlxsw_sp_acl_rulei_act_vlan(mlxsw_sp, rulei,
125 action, vid,
126 proto, prio);
127 } else {
128 dev_err(mlxsw_sp->bus_info->dev, "Unsupported action\n");
129 return -EOPNOTSUPP;
130 }
131 }
132 return 0;
133}
134
135static void mlxsw_sp_flower_parse_ipv4(struct mlxsw_sp_acl_rule_info *rulei,
136 struct tc_cls_flower_offload *f)
137{
138 struct flow_dissector_key_ipv4_addrs *key =
139 skb_flow_dissector_target(f->dissector,
140 FLOW_DISSECTOR_KEY_IPV4_ADDRS,
141 f->key);
142 struct flow_dissector_key_ipv4_addrs *mask =
143 skb_flow_dissector_target(f->dissector,
144 FLOW_DISSECTOR_KEY_IPV4_ADDRS,
145 f->mask);
146
147 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_IP4,
148 ntohl(key->src), ntohl(mask->src));
149 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_IP4,
150 ntohl(key->dst), ntohl(mask->dst));
151}
152
153static void mlxsw_sp_flower_parse_ipv6(struct mlxsw_sp_acl_rule_info *rulei,
154 struct tc_cls_flower_offload *f)
155{
156 struct flow_dissector_key_ipv6_addrs *key =
157 skb_flow_dissector_target(f->dissector,
158 FLOW_DISSECTOR_KEY_IPV6_ADDRS,
159 f->key);
160 struct flow_dissector_key_ipv6_addrs *mask =
161 skb_flow_dissector_target(f->dissector,
162 FLOW_DISSECTOR_KEY_IPV6_ADDRS,
163 f->mask);
164 size_t addr_half_size = sizeof(key->src) / 2;
165
166 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP6_HI,
167 &key->src.s6_addr[0],
168 &mask->src.s6_addr[0],
169 addr_half_size);
170 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP6_LO,
171 &key->src.s6_addr[addr_half_size],
172 &mask->src.s6_addr[addr_half_size],
173 addr_half_size);
174 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP6_HI,
175 &key->dst.s6_addr[0],
176 &mask->dst.s6_addr[0],
177 addr_half_size);
178 mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP6_LO,
179 &key->dst.s6_addr[addr_half_size],
180 &mask->dst.s6_addr[addr_half_size],
181 addr_half_size);
182}
183
184static int mlxsw_sp_flower_parse_ports(struct mlxsw_sp *mlxsw_sp,
185 struct mlxsw_sp_acl_rule_info *rulei,
186 struct tc_cls_flower_offload *f,
187 u8 ip_proto)
188{
189 struct flow_dissector_key_ports *key, *mask;
190
191 if (!dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_PORTS))
192 return 0;
193
194 if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
195 dev_err(mlxsw_sp->bus_info->dev, "Only UDP and TCP keys are supported\n");
196 return -EINVAL;
197 }
198
199 key = skb_flow_dissector_target(f->dissector,
200 FLOW_DISSECTOR_KEY_PORTS,
201 f->key);
202 mask = skb_flow_dissector_target(f->dissector,
203 FLOW_DISSECTOR_KEY_PORTS,
204 f->mask);
205 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_L4_PORT,
206 ntohs(key->dst), ntohs(mask->dst));
207 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_L4_PORT,
208 ntohs(key->src), ntohs(mask->src));
209 return 0;
210}
211
212static int mlxsw_sp_flower_parse_tcp(struct mlxsw_sp *mlxsw_sp,
213 struct mlxsw_sp_acl_rule_info *rulei,
214 struct tc_cls_flower_offload *f,
215 u8 ip_proto)
216{
217 struct flow_dissector_key_tcp *key, *mask;
218
219 if (!dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_TCP))
220 return 0;
221
222 if (ip_proto != IPPROTO_TCP) {
223 dev_err(mlxsw_sp->bus_info->dev, "TCP keys supported only for TCP\n");
224 return -EINVAL;
225 }
226
227 key = skb_flow_dissector_target(f->dissector,
228 FLOW_DISSECTOR_KEY_TCP,
229 f->key);
230 mask = skb_flow_dissector_target(f->dissector,
231 FLOW_DISSECTOR_KEY_TCP,
232 f->mask);
233 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_TCP_FLAGS,
234 ntohs(key->flags), ntohs(mask->flags));
235 return 0;
236}
237
238static int mlxsw_sp_flower_parse_ip(struct mlxsw_sp *mlxsw_sp,
239 struct mlxsw_sp_acl_rule_info *rulei,
240 struct tc_cls_flower_offload *f,
241 u16 n_proto)
242{
243 struct flow_dissector_key_ip *key, *mask;
244
245 if (!dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_IP))
246 return 0;
247
248 if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6) {
249 dev_err(mlxsw_sp->bus_info->dev, "IP keys supported only for IPv4/6\n");
250 return -EINVAL;
251 }
252
253 key = skb_flow_dissector_target(f->dissector,
254 FLOW_DISSECTOR_KEY_IP,
255 f->key);
256 mask = skb_flow_dissector_target(f->dissector,
257 FLOW_DISSECTOR_KEY_IP,
258 f->mask);
259 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_TTL_,
260 key->ttl, mask->ttl);
261
262 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_ECN,
263 key->tos & 0x3, mask->tos & 0x3);
264
265 mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_DSCP,
266 key->tos >> 6, mask->tos >> 6);
267
268 return 0;
269}
270
271static int mlxsw_sp_flower_parse(struct mlxsw_sp *mlxsw_sp,
272 struct mlxsw_sp_acl_block *block,
273 struct mlxsw_sp_acl_rule_info *rulei,
274 struct tc_cls_flower_offload *f)
275{
276 u16 n_proto_mask = 0;
277 u16 n_proto_key = 0;
278 u16 addr_type = 0;
279 u8 ip_proto = 0;
280 int err;
281
282 if (f->dissector->used_keys &
283 ~(BIT(FLOW_DISSECTOR_KEY_CONTROL) |
284 BIT(FLOW_DISSECTOR_KEY_BASIC) |
285 BIT(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
286 BIT(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
287 BIT(FLOW_DISSECTOR_KEY_IPV6_ADDRS) |
288 BIT(FLOW_DISSECTOR_KEY_PORTS) |
289 BIT(FLOW_DISSECTOR_KEY_TCP) |
290 BIT(FLOW_DISSECTOR_KEY_IP) |
291 BIT(FLOW_DISSECTOR_KEY_VLAN))) {
292 dev_err(mlxsw_sp->bus_info->dev, "Unsupported key\n");
293 return -EOPNOTSUPP;
294 }
295
296 mlxsw_sp_acl_rulei_priority(rulei, f->common.prio);
297
298 if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CONTROL)) {
299 struct flow_dissector_key_control *key =
300 skb_flow_dissector_target(f->dissector,
301 FLOW_DISSECTOR_KEY_CONTROL,
302 f->key);
303 addr_type = key->addr_type;
304 }
305
306 if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_BASIC)) {
307 struct flow_dissector_key_basic *key =
308 skb_flow_dissector_target(f->dissector,
309 FLOW_DISSECTOR_KEY_BASIC,
310 f->key);
311 struct flow_dissector_key_basic *mask =
312 skb_flow_dissector_target(f->dissector,
313 FLOW_DISSECTOR_KEY_BASIC,
314 f->mask);
315 n_proto_key = ntohs(key->n_proto);
316 n_proto_mask = ntohs(mask->n_proto);
317
318 if (n_proto_key == ETH_P_ALL) {
319 n_proto_key = 0;
320 n_proto_mask = 0;
321 }
322 mlxsw_sp_acl_rulei_keymask_u32(rulei,
323 MLXSW_AFK_ELEMENT_ETHERTYPE,
324 n_proto_key, n_proto_mask);
325
326 ip_proto = key->ip_proto;
327 mlxsw_sp_acl_rulei_keymask_u32(rulei,
328 MLXSW_AFK_ELEMENT_IP_PROTO,
329 key->ip_proto, mask->ip_proto);
330 }
331
332 if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
333 struct flow_dissector_key_eth_addrs *key =
334 skb_flow_dissector_target(f->dissector,
335 FLOW_DISSECTOR_KEY_ETH_ADDRS,
336 f->key);
337 struct flow_dissector_key_eth_addrs *mask =
338 skb_flow_dissector_target(f->dissector,
339 FLOW_DISSECTOR_KEY_ETH_ADDRS,
340 f->mask);
341
342 mlxsw_sp_acl_rulei_keymask_buf(rulei,
343 MLXSW_AFK_ELEMENT_DMAC,
344 key->dst, mask->dst,
345 sizeof(key->dst));
346 mlxsw_sp_acl_rulei_keymask_buf(rulei,
347 MLXSW_AFK_ELEMENT_SMAC,
348 key->src, mask->src,
349 sizeof(key->src));
350 }
351
352 if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_VLAN)) {
353 struct flow_dissector_key_vlan *key =
354 skb_flow_dissector_target(f->dissector,
355 FLOW_DISSECTOR_KEY_VLAN,
356 f->key);
357 struct flow_dissector_key_vlan *mask =
358 skb_flow_dissector_target(f->dissector,
359 FLOW_DISSECTOR_KEY_VLAN,
360 f->mask);
361 if (mask->vlan_id != 0)
362 mlxsw_sp_acl_rulei_keymask_u32(rulei,
363 MLXSW_AFK_ELEMENT_VID,
364 key->vlan_id,
365 mask->vlan_id);
366 if (mask->vlan_priority != 0)
367 mlxsw_sp_acl_rulei_keymask_u32(rulei,
368 MLXSW_AFK_ELEMENT_PCP,
369 key->vlan_priority,
370 mask->vlan_priority);
371 }
372
373 if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS)
374 mlxsw_sp_flower_parse_ipv4(rulei, f);
375
376 if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS)
377 mlxsw_sp_flower_parse_ipv6(rulei, f);
378
379 err = mlxsw_sp_flower_parse_ports(mlxsw_sp, rulei, f, ip_proto);
380 if (err)
381 return err;
382 err = mlxsw_sp_flower_parse_tcp(mlxsw_sp, rulei, f, ip_proto);
383 if (err)
384 return err;
385
386 err = mlxsw_sp_flower_parse_ip(mlxsw_sp, rulei, f, n_proto_key & n_proto_mask);
387 if (err)
388 return err;
389
390 return mlxsw_sp_flower_parse_actions(mlxsw_sp, block, rulei, f->exts);
391}
392
393int mlxsw_sp_flower_replace(struct mlxsw_sp *mlxsw_sp,
394 struct mlxsw_sp_acl_block *block,
395 struct tc_cls_flower_offload *f)
396{
397 struct mlxsw_sp_acl_rule_info *rulei;
398 struct mlxsw_sp_acl_ruleset *ruleset;
399 struct mlxsw_sp_acl_rule *rule;
400 int err;
401
402 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
403 f->common.chain_index,
404 MLXSW_SP_ACL_PROFILE_FLOWER);
405 if (IS_ERR(ruleset))
406 return PTR_ERR(ruleset);
407
408 rule = mlxsw_sp_acl_rule_create(mlxsw_sp, ruleset, f->cookie);
409 if (IS_ERR(rule)) {
410 err = PTR_ERR(rule);
411 goto err_rule_create;
412 }
413
414 rulei = mlxsw_sp_acl_rule_rulei(rule);
415 err = mlxsw_sp_flower_parse(mlxsw_sp, block, rulei, f);
416 if (err)
417 goto err_flower_parse;
418
419 err = mlxsw_sp_acl_rulei_commit(rulei);
420 if (err)
421 goto err_rulei_commit;
422
423 err = mlxsw_sp_acl_rule_add(mlxsw_sp, rule);
424 if (err)
425 goto err_rule_add;
426
427 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
428 return 0;
429
430err_rule_add:
431err_rulei_commit:
432err_flower_parse:
433 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
434err_rule_create:
435 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
436 return err;
437}
438
439void mlxsw_sp_flower_destroy(struct mlxsw_sp *mlxsw_sp,
440 struct mlxsw_sp_acl_block *block,
441 struct tc_cls_flower_offload *f)
442{
443 struct mlxsw_sp_acl_ruleset *ruleset;
444 struct mlxsw_sp_acl_rule *rule;
445
446 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
447 f->common.chain_index,
448 MLXSW_SP_ACL_PROFILE_FLOWER);
449 if (IS_ERR(ruleset))
450 return;
451
452 rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
453 if (rule) {
454 mlxsw_sp_acl_rule_del(mlxsw_sp, rule);
455 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
456 }
457
458 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
459}
460
461int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp,
462 struct mlxsw_sp_acl_block *block,
463 struct tc_cls_flower_offload *f)
464{
465 struct mlxsw_sp_acl_ruleset *ruleset;
466 struct mlxsw_sp_acl_rule *rule;
467 u64 packets;
468 u64 lastuse;
469 u64 bytes;
470 int err;
471
472 ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
473 f->common.chain_index,
474 MLXSW_SP_ACL_PROFILE_FLOWER);
475 if (WARN_ON(IS_ERR(ruleset)))
476 return -EINVAL;
477
478 rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
479 if (!rule)
480 return -EINVAL;
481
482 err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes,
483 &lastuse);
484 if (err)
485 goto err_rule_get_stats;
486
487 tcf_exts_stats_update(f->exts, bytes, packets, lastuse);
488
489 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
490 return 0;
491
492err_rule_get_stats:
493 mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
494 return err;
495}
496
