drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c

   1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
   2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */
   3
   4 #include <linux/kernel.h>
   5 #include <linux/errno.h>
   6 #include <linux/netdevice.h>
   7 #include <linux/log2.h>
   8 #include <net/net_namespace.h>
   9 #include <net/flow_dissector.h>
  10 #include <net/pkt_cls.h>
  11 #include <net/tc_act/tc_gact.h>
  12 #include <net/tc_act/tc_mirred.h>
  13 #include <net/tc_act/tc_vlan.h>
  14
  15 #include "spectrum.h"
  16 #include "core_acl_flex_keys.h"
  17
  18 static int mlxsw_sp_policer_validate(const struct flow_action *action,
  19                                      const struct flow_action_entry *act,
  20                                      struct netlink_ext_ack *extack)
  21 {
  22         if (act->police.exceed.act_id != FLOW_ACTION_DROP) {
  23                 NL_SET_ERR_MSG_MOD(extack,
  24                                    "Offload not supported when exceed action is not drop");
  25                 return -EOPNOTSUPP;
  26         }
  27
  28         if (act->police.notexceed.act_id != FLOW_ACTION_PIPE &&
  29             act->police.notexceed.act_id != FLOW_ACTION_ACCEPT) {
  30                 NL_SET_ERR_MSG_MOD(extack,
  31                                    "Offload not supported when conform action is not pipe or ok");
  32                 return -EOPNOTSUPP;
  33         }
  34
  35         if (act->police.notexceed.act_id == FLOW_ACTION_ACCEPT &&
  36             !flow_action_is_last_entry(action, act)) {
  37                 NL_SET_ERR_MSG_MOD(extack,
  38                                    "Offload not supported when conform action is ok, but action is not last");
  39                 return -EOPNOTSUPP;
  40         }
  41
  42         if (act->police.peakrate_bytes_ps ||
  43             act->police.avrate || act->police.overhead) {
  44                 NL_SET_ERR_MSG_MOD(extack,
  45                                    "Offload not supported when peakrate/avrate/overhead is configured");
  46                 return -EOPNOTSUPP;
  47         }
  48
  49         if (act->police.rate_pkt_ps) {
  50                 NL_SET_ERR_MSG_MOD(extack,
  51                                    "QoS offload not support packets per second");
  52                 return -EOPNOTSUPP;
  53         }
  54
  55         return 0;
  56 }
  57
  58 static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
  59                                          struct mlxsw_sp_flow_block *block,
  60                                          struct mlxsw_sp_acl_rule_info *rulei,
  61                                          struct flow_action *flow_action,
  62                                          struct netlink_ext_ack *extack)
  63 {
  64         const struct flow_action_entry *act;
  65         int mirror_act_count = 0;
  66         int police_act_count = 0;
  67         int sample_act_count = 0;
  68         int err, i;
  69
  70         if (!flow_action_has_entries(flow_action))
  71                 return 0;
  72         if (!flow_action_mixed_hw_stats_check(flow_action, extack))
  73                 return -EOPNOTSUPP;
  74
  75         act = flow_action_first_entry_get(flow_action);
  76         if (act->hw_stats & FLOW_ACTION_HW_STATS_DISABLED) {
  77                 /* Nothing to do */
  78         } else if (act->hw_stats & FLOW_ACTION_HW_STATS_IMMEDIATE) {
  79                 /* Count action is inserted first */
  80                 err = mlxsw_sp_acl_rulei_act_count(mlxsw_sp, rulei, extack);
  81                 if (err)
  82                         return err;
  83         } else {
  84                 NL_SET_ERR_MSG_MOD(extack, "Unsupported action HW stats type");
  85                 return -EOPNOTSUPP;
  86         }
  87
  88         flow_action_for_each(i, act, flow_action) {
  89                 switch (act->id) {
  90                 case FLOW_ACTION_ACCEPT:
  91                         err = mlxsw_sp_acl_rulei_act_terminate(rulei);
  92                         if (err) {
  93                                 NL_SET_ERR_MSG_MOD(extack, "Cannot append terminate action");
  94                                 return err;
  95                         }
  96                         break;
  97                 case FLOW_ACTION_DROP: {
  98                         bool ingress;
  99
 100                         if (mlxsw_sp_flow_block_is_mixed_bound(block)) {
 101                                 NL_SET_ERR_MSG_MOD(extack, "Drop action is not supported when block is bound to ingress and egress");
 102                                 return -EOPNOTSUPP;
 103                         }
 104                         ingress = mlxsw_sp_flow_block_is_ingress_bound(block);
 105                         err = mlxsw_sp_acl_rulei_act_drop(rulei, ingress,
 106                                                           act->user_cookie, extack);
 107                         if (err) {
 108                                 NL_SET_ERR_MSG_MOD(extack, "Cannot append drop action");
 109                                 return err;
 110                         }
 111
 112                         /* Forbid block with this rulei to be bound
 113                          * to ingress/egress in future. Ingress rule is
 114                          * a blocker for egress and vice versa.
 115                          */
 116                         if (ingress)
 117                                 rulei->egress_bind_blocker = 1;
 118                         else
 119                                 rulei->ingress_bind_blocker = 1;
 120                         }
 121                         break;
 122                 case FLOW_ACTION_TRAP:
 123                         err = mlxsw_sp_acl_rulei_act_trap(rulei);
 124                         if (err) {
 125                                 NL_SET_ERR_MSG_MOD(extack, "Cannot append trap action");
 126                                 return err;
 127                         }
 128                         break;
 129                 case FLOW_ACTION_GOTO: {
 130                         u32 chain_index = act->chain_index;
 131                         struct mlxsw_sp_acl_ruleset *ruleset;
 132                         u16 group_id;
 133
 134                         ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
 135                                                               chain_index,
 136                                                               MLXSW_SP_ACL_PROFILE_FLOWER);
 137                         if (IS_ERR(ruleset))
 138                                 return PTR_ERR(ruleset);
 139
 140                         group_id = mlxsw_sp_acl_ruleset_group_id(ruleset);
 141                         err = mlxsw_sp_acl_rulei_act_jump(rulei, group_id);
 142                         if (err) {
 143                                 NL_SET_ERR_MSG_MOD(extack, "Cannot append jump action");
 144                                 return err;
 145                         }
 146                         }
 147                         break;
 148                 case FLOW_ACTION_REDIRECT: {
 149                         struct net_device *out_dev;
 150                         struct mlxsw_sp_fid *fid;
 151                         u16 fid_index;
 152
 153                         if (mlxsw_sp_flow_block_is_egress_bound(block)) {
 154                                 NL_SET_ERR_MSG_MOD(extack, "Redirect action is not supported on egress");
 155                                 return -EOPNOTSUPP;
 156                         }
 157
 158                         /* Forbid block with this rulei to be bound
 159                          * to egress in future.
 160                          */
 161                         rulei->egress_bind_blocker = 1;
 162
 163                         fid = mlxsw_sp_acl_dummy_fid(mlxsw_sp);
 164                         fid_index = mlxsw_sp_fid_index(fid);
 165                         err = mlxsw_sp_acl_rulei_act_fid_set(mlxsw_sp, rulei,
 166                                                              fid_index, extack);
 167                         if (err)
 168                                 return err;
 169
 170                         out_dev = act->dev;
 171                         err = mlxsw_sp_acl_rulei_act_fwd(mlxsw_sp, rulei,
 172                                                          out_dev, extack);
 173                         if (err)
 174                                 return err;
 175                         }
 176                         break;
 177                 case FLOW_ACTION_MIRRED: {
 178                         struct net_device *out_dev = act->dev;
 179
 180                         if (mirror_act_count++) {
 181                                 NL_SET_ERR_MSG_MOD(extack, "Multiple mirror actions per rule are not supported");
 182                                 return -EOPNOTSUPP;
 183                         }
 184
 185                         err = mlxsw_sp_acl_rulei_act_mirror(mlxsw_sp, rulei,
 186                                                             block, out_dev,
 187                                                             extack);
 188                         if (err)
 189                                 return err;
 190                         }
 191                         break;
 192                 case FLOW_ACTION_VLAN_MANGLE: {
 193                         u16 proto = be16_to_cpu(act->vlan.proto);
 194                         u8 prio = act->vlan.prio;
 195                         u16 vid = act->vlan.vid;
 196
 197                         err = mlxsw_sp_acl_rulei_act_vlan(mlxsw_sp, rulei,
 198                                                           act->id, vid,
 199                                                           proto, prio, extack);
 200                         if (err)
 201                                 return err;
 202                         break;
 203                         }
 204                 case FLOW_ACTION_PRIORITY:
 205                         err = mlxsw_sp_acl_rulei_act_priority(mlxsw_sp, rulei,
 206                                                               act->priority,
 207                                                               extack);
 208                         if (err)
 209                                 return err;
 210                         break;
 211                 case FLOW_ACTION_MANGLE: {
 212                         enum flow_action_mangle_base htype = act->mangle.htype;
 213                         __be32 be_mask = (__force __be32) act->mangle.mask;
 214                         __be32 be_val = (__force __be32) act->mangle.val;
 215                         u32 offset = act->mangle.offset;
 216                         u32 mask = be32_to_cpu(be_mask);
 217                         u32 val = be32_to_cpu(be_val);
 218
 219                         err = mlxsw_sp_acl_rulei_act_mangle(mlxsw_sp, rulei,
 220                                                             htype, offset,
 221                                                             mask, val, extack);
 222                         if (err)
 223                                 return err;
 224                         break;
 225                         }
 226                 case FLOW_ACTION_POLICE: {
 227                         u32 burst;
 228
 229                         if (police_act_count++) {
 230                                 NL_SET_ERR_MSG_MOD(extack, "Multiple police actions per rule are not supported");
 231                                 return -EOPNOTSUPP;
 232                         }
 233
 234                         err = mlxsw_sp_policer_validate(flow_action, act, extack);
 235                         if (err)
 236                                 return err;
 237
 238                         /* The kernel might adjust the requested burst size so
 239                          * that it is not exactly a power of two. Re-adjust it
 240                          * here since the hardware only supports burst sizes
 241                          * that are a power of two.
 242                          */
 243                         burst = roundup_pow_of_two(act->police.burst);
 244                         err = mlxsw_sp_acl_rulei_act_police(mlxsw_sp, rulei,
 245                                                             act->hw_index,
 246                                                             act->police.rate_bytes_ps,
 247                                                             burst, extack);
 248                         if (err)
 249                                 return err;
 250                         break;
 251                         }
 252                 case FLOW_ACTION_SAMPLE: {
 253                         if (sample_act_count++) {
 254                                 NL_SET_ERR_MSG_MOD(extack, "Multiple sample actions per rule are not supported");
 255                                 return -EOPNOTSUPP;
 256                         }
 257
 258                         err = mlxsw_sp_acl_rulei_act_sample(mlxsw_sp, rulei,
 259                                                             block,
 260                                                             act->sample.psample_group,
 261                                                             act->sample.rate,
 262                                                             act->sample.trunc_size,
 263                                                             act->sample.truncate,
 264                                                             extack);
 265                         if (err)
 266                                 return err;
 267                         break;
 268                         }
 269                 default:
 270                         NL_SET_ERR_MSG_MOD(extack, "Unsupported action");
 271                         dev_err(mlxsw_sp->bus_info->dev, "Unsupported action\n");
 272                         return -EOPNOTSUPP;
 273                 }
 274         }
 275
 276         if (rulei->ipv6_valid) {
 277                 NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field");
 278                 return -EOPNOTSUPP;
 279         }
 280
 281         return 0;
 282 }
 283
 284 static int
 285 mlxsw_sp_flower_parse_meta_iif(struct mlxsw_sp_acl_rule_info *rulei,
 286                                const struct mlxsw_sp_flow_block *block,
 287                                const struct flow_match_meta *match,
 288                                struct netlink_ext_ack *extack)
 289 {
 290         struct mlxsw_sp_port *mlxsw_sp_port;
 291         struct net_device *ingress_dev;
 292
 293         if (!match->mask->ingress_ifindex)
 294                 return 0;
 295
 296         if (match->mask->ingress_ifindex != 0xFFFFFFFF) {
 297                 NL_SET_ERR_MSG_MOD(extack, "Unsupported ingress ifindex mask");
 298                 return -EINVAL;
 299         }
 300
 301         ingress_dev = __dev_get_by_index(block->net,
 302                                          match->key->ingress_ifindex);
 303         if (!ingress_dev) {
 304                 NL_SET_ERR_MSG_MOD(extack, "Can't find specified ingress port to match on");
 305                 return -EINVAL;
 306         }
 307
 308         if (!mlxsw_sp_port_dev_check(ingress_dev)) {
 309                 NL_SET_ERR_MSG_MOD(extack, "Can't match on non-mlxsw ingress port");
 310                 return -EINVAL;
 311         }
 312
 313         mlxsw_sp_port = netdev_priv(ingress_dev);
 314         if (mlxsw_sp_port->mlxsw_sp != block->mlxsw_sp) {
 315                 NL_SET_ERR_MSG_MOD(extack, "Can't match on a port from different device");
 316                 return -EINVAL;
 317         }
 318
 319         mlxsw_sp_acl_rulei_keymask_u32(rulei,
 320                                        MLXSW_AFK_ELEMENT_SRC_SYS_PORT,
 321                                        mlxsw_sp_port->local_port,
 322                                        0xFFFFFFFF);
 323
 324         return 0;
 325 }
 326
 327 static int mlxsw_sp_flower_parse_meta(struct mlxsw_sp_acl_rule_info *rulei,
 328                                       struct flow_cls_offload *f,
 329                                       struct mlxsw_sp_flow_block *block)
 330 {
 331         struct flow_rule *rule = flow_cls_offload_flow_rule(f);
 332         struct flow_match_meta match;
 333
 334         if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META))
 335                 return 0;
 336
 337         flow_rule_match_meta(rule, &match);
 338
 339         mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_FDB_MISS,
 340                                        match.key->l2_miss, match.mask->l2_miss);
 341
 342         return mlxsw_sp_flower_parse_meta_iif(rulei, block, &match,
 343                                               f->common.extack);
 344 }
 345
 346 static void mlxsw_sp_flower_parse_ipv4(struct mlxsw_sp_acl_rule_info *rulei,
 347                                        struct flow_cls_offload *f)
 348 {
 349         struct flow_match_ipv4_addrs match;
 350
 351         flow_rule_match_ipv4_addrs(f->rule, &match);
 352
 353         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31,
 354                                        (char *) &match.key->src,
 355                                        (char *) &match.mask->src, 4);
 356         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31,
 357                                        (char *) &match.key->dst,
 358                                        (char *) &match.mask->dst, 4);
 359 }
 360
 361 static void mlxsw_sp_flower_parse_ipv6(struct mlxsw_sp_acl_rule_info *rulei,
 362                                        struct flow_cls_offload *f)
 363 {
 364         struct flow_match_ipv6_addrs match;
 365
 366         flow_rule_match_ipv6_addrs(f->rule, &match);
 367
 368         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_96_127,
 369                                        &match.key->src.s6_addr[0x0],
 370                                        &match.mask->src.s6_addr[0x0], 4);
 371         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_64_95,
 372                                        &match.key->src.s6_addr[0x4],
 373                                        &match.mask->src.s6_addr[0x4], 4);
 374         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_32_63,
 375                                        &match.key->src.s6_addr[0x8],
 376                                        &match.mask->src.s6_addr[0x8], 4);
 377         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31,
 378                                        &match.key->src.s6_addr[0xC],
 379                                        &match.mask->src.s6_addr[0xC], 4);
 380         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_96_127,
 381                                        &match.key->dst.s6_addr[0x0],
 382                                        &match.mask->dst.s6_addr[0x0], 4);
 383         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_64_95,
 384                                        &match.key->dst.s6_addr[0x4],
 385                                        &match.mask->dst.s6_addr[0x4], 4);
 386         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_32_63,
 387                                        &match.key->dst.s6_addr[0x8],
 388                                        &match.mask->dst.s6_addr[0x8], 4);
 389         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31,
 390                                        &match.key->dst.s6_addr[0xC],
 391                                        &match.mask->dst.s6_addr[0xC], 4);
 392 }
 393
 394 static int mlxsw_sp_flower_parse_ports(struct mlxsw_sp *mlxsw_sp,
 395                                        struct mlxsw_sp_acl_rule_info *rulei,
 396                                        struct flow_cls_offload *f,
 397                                        u8 ip_proto)
 398 {
 399         const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
 400         struct flow_match_ports match;
 401
 402         if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS))
 403                 return 0;
 404
 405         if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
 406                 NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported");
 407                 dev_err(mlxsw_sp->bus_info->dev, "Only UDP and TCP keys are supported\n");
 408                 return -EINVAL;
 409         }
 410
 411         flow_rule_match_ports(rule, &match);
 412         mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_L4_PORT,
 413                                        ntohs(match.key->dst),
 414                                        ntohs(match.mask->dst));
 415         mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_L4_PORT,
 416                                        ntohs(match.key->src),
 417                                        ntohs(match.mask->src));
 418         return 0;
 419 }
 420
 421 static int mlxsw_sp_flower_parse_tcp(struct mlxsw_sp *mlxsw_sp,
 422                                      struct mlxsw_sp_acl_rule_info *rulei,
 423                                      struct flow_cls_offload *f,
 424                                      u8 ip_proto)
 425 {
 426         const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
 427         struct flow_match_tcp match;
 428
 429         if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_TCP))
 430                 return 0;
 431
 432         if (ip_proto != IPPROTO_TCP) {
 433                 NL_SET_ERR_MSG_MOD(f->common.extack, "TCP keys supported only for TCP");
 434                 dev_err(mlxsw_sp->bus_info->dev, "TCP keys supported only for TCP\n");
 435                 return -EINVAL;
 436         }
 437
 438         flow_rule_match_tcp(rule, &match);
 439
 440         if (match.mask->flags & htons(0x0E00)) {
 441                 NL_SET_ERR_MSG_MOD(f->common.extack, "TCP flags match not supported on reserved bits");
 442                 dev_err(mlxsw_sp->bus_info->dev, "TCP flags match not supported on reserved bits\n");
 443                 return -EINVAL;
 444         }
 445
 446         mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_TCP_FLAGS,
 447                                        ntohs(match.key->flags),
 448                                        ntohs(match.mask->flags));
 449         return 0;
 450 }
 451
 452 static int mlxsw_sp_flower_parse_ip(struct mlxsw_sp *mlxsw_sp,
 453                                     struct mlxsw_sp_acl_rule_info *rulei,
 454                                     struct flow_cls_offload *f,
 455                                     u16 n_proto)
 456 {
 457         const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
 458         struct flow_match_ip match;
 459
 460         if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IP))
 461                 return 0;
 462
 463         if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6) {
 464                 NL_SET_ERR_MSG_MOD(f->common.extack, "IP keys supported only for IPv4/6");
 465                 dev_err(mlxsw_sp->bus_info->dev, "IP keys supported only for IPv4/6\n");
 466                 return -EINVAL;
 467         }
 468
 469         flow_rule_match_ip(rule, &match);
 470
 471         mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_TTL_,
 472                                        match.key->ttl, match.mask->ttl);
 473
 474         mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_ECN,
 475                                        match.key->tos & 0x3,
 476                                        match.mask->tos & 0x3);
 477
 478         mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_DSCP,
 479                                        match.key->tos >> 2,
 480                                        match.mask->tos >> 2);
 481
 482         return 0;
 483 }
 484
 485 static int mlxsw_sp_flower_parse(struct mlxsw_sp *mlxsw_sp,
 486                                  struct mlxsw_sp_flow_block *block,
 487                                  struct mlxsw_sp_acl_rule_info *rulei,
 488                                  struct flow_cls_offload *f)
 489 {
 490         struct flow_rule *rule = flow_cls_offload_flow_rule(f);
 491         struct flow_dissector *dissector = rule->match.dissector;
 492         u16 n_proto_mask = 0;
 493         u16 n_proto_key = 0;
 494         u16 addr_type = 0;
 495         u8 ip_proto = 0;
 496         int err;
 497
 498         if (dissector->used_keys &
 499             ~(BIT(FLOW_DISSECTOR_KEY_META) |
 500               BIT(FLOW_DISSECTOR_KEY_CONTROL) |
 501               BIT(FLOW_DISSECTOR_KEY_BASIC) |
 502               BIT(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
 503               BIT(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
 504               BIT(FLOW_DISSECTOR_KEY_IPV6_ADDRS) |
 505               BIT(FLOW_DISSECTOR_KEY_PORTS) |
 506               BIT(FLOW_DISSECTOR_KEY_TCP) |
 507               BIT(FLOW_DISSECTOR_KEY_IP) |
 508               BIT(FLOW_DISSECTOR_KEY_VLAN))) {
 509                 dev_err(mlxsw_sp->bus_info->dev, "Unsupported key\n");
 510                 NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported key");
 511                 return -EOPNOTSUPP;
 512         }
 513
 514         mlxsw_sp_acl_rulei_priority(rulei, f->common.prio);
 515
 516         err = mlxsw_sp_flower_parse_meta(rulei, f, block);
 517         if (err)
 518                 return err;
 519
 520         if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CONTROL)) {
 521                 struct flow_match_control match;
 522
 523                 flow_rule_match_control(rule, &match);
 524                 addr_type = match.key->addr_type;
 525         }
 526
 527         if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) {
 528                 struct flow_match_basic match;
 529
 530                 flow_rule_match_basic(rule, &match);
 531                 n_proto_key = ntohs(match.key->n_proto);
 532                 n_proto_mask = ntohs(match.mask->n_proto);
 533
 534                 if (n_proto_key == ETH_P_ALL) {
 535                         n_proto_key = 0;
 536                         n_proto_mask = 0;
 537                 }
 538                 mlxsw_sp_acl_rulei_keymask_u32(rulei,
 539                                                MLXSW_AFK_ELEMENT_ETHERTYPE,
 540                                                n_proto_key, n_proto_mask);
 541
 542                 ip_proto = match.key->ip_proto;
 543                 mlxsw_sp_acl_rulei_keymask_u32(rulei,
 544                                                MLXSW_AFK_ELEMENT_IP_PROTO,
 545                                                match.key->ip_proto,
 546                                                match.mask->ip_proto);
 547         }
 548
 549         if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
 550                 struct flow_match_eth_addrs match;
 551
 552                 flow_rule_match_eth_addrs(rule, &match);
 553                 mlxsw_sp_acl_rulei_keymask_buf(rulei,
 554                                                MLXSW_AFK_ELEMENT_DMAC_32_47,
 555                                                match.key->dst,
 556                                                match.mask->dst, 2);
 557                 mlxsw_sp_acl_rulei_keymask_buf(rulei,
 558                                                MLXSW_AFK_ELEMENT_DMAC_0_31,
 559                                                match.key->dst + 2,
 560                                                match.mask->dst + 2, 4);
 561                 mlxsw_sp_acl_rulei_keymask_buf(rulei,
 562                                                MLXSW_AFK_ELEMENT_SMAC_32_47,
 563                                                match.key->src,
 564                                                match.mask->src, 2);
 565                 mlxsw_sp_acl_rulei_keymask_buf(rulei,
 566                                                MLXSW_AFK_ELEMENT_SMAC_0_31,
 567                                                match.key->src + 2,
 568                                                match.mask->src + 2, 4);
 569         }
 570
 571         if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) {
 572                 struct flow_match_vlan match;
 573
 574                 flow_rule_match_vlan(rule, &match);
 575                 if (mlxsw_sp_flow_block_is_egress_bound(block) &&
 576                     match.mask->vlan_id) {
 577                         NL_SET_ERR_MSG_MOD(f->common.extack, "vlan_id key is not supported on egress");
 578                         return -EOPNOTSUPP;
 579                 }
 580
 581                 /* Forbid block with this rulei to be bound
 582                  * to egress in future.
 583                  */
 584                 rulei->egress_bind_blocker = 1;
 585
 586                 if (match.mask->vlan_id != 0)
 587                         mlxsw_sp_acl_rulei_keymask_u32(rulei,
 588                                                        MLXSW_AFK_ELEMENT_VID,
 589                                                        match.key->vlan_id,
 590                                                        match.mask->vlan_id);
 591                 if (match.mask->vlan_priority != 0)
 592                         mlxsw_sp_acl_rulei_keymask_u32(rulei,
 593                                                        MLXSW_AFK_ELEMENT_PCP,
 594                                                        match.key->vlan_priority,
 595                                                        match.mask->vlan_priority);
 596         }
 597
 598         if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS)
 599                 mlxsw_sp_flower_parse_ipv4(rulei, f);
 600
 601         if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS)
 602                 mlxsw_sp_flower_parse_ipv6(rulei, f);
 603
 604         err = mlxsw_sp_flower_parse_ports(mlxsw_sp, rulei, f, ip_proto);
 605         if (err)
 606                 return err;
 607         err = mlxsw_sp_flower_parse_tcp(mlxsw_sp, rulei, f, ip_proto);
 608         if (err)
 609                 return err;
 610
 611         err = mlxsw_sp_flower_parse_ip(mlxsw_sp, rulei, f, n_proto_key & n_proto_mask);
 612         if (err)
 613                 return err;
 614
 615         return mlxsw_sp_flower_parse_actions(mlxsw_sp, block, rulei,
 616                                              &f->rule->action,
 617                                              f->common.extack);
 618 }
 619
 620 static int mlxsw_sp_flower_mall_prio_check(struct mlxsw_sp_flow_block *block,
 621                                            struct flow_cls_offload *f)
 622 {
 623         bool ingress = mlxsw_sp_flow_block_is_ingress_bound(block);
 624         unsigned int mall_min_prio;
 625         unsigned int mall_max_prio;
 626         int err;
 627
 628         err = mlxsw_sp_mall_prio_get(block, f->common.chain_index,
 629                                      &mall_min_prio, &mall_max_prio);
 630         if (err) {
 631                 if (err == -ENOENT)
 632                         /* No matchall filters installed on this chain. */
 633                         return 0;
 634                 NL_SET_ERR_MSG(f->common.extack, "Failed to get matchall priorities");
 635                 return err;
 636         }
 637         if (ingress && f->common.prio <= mall_min_prio) {
 638                 NL_SET_ERR_MSG(f->common.extack, "Failed to add in front of existing matchall rules");
 639                 return -EOPNOTSUPP;
 640         }
 641         if (!ingress && f->common.prio >= mall_max_prio) {
 642                 NL_SET_ERR_MSG(f->common.extack, "Failed to add behind of existing matchall rules");
 643                 return -EOPNOTSUPP;
 644         }
 645         return 0;
 646 }
 647
 648 int mlxsw_sp_flower_replace(struct mlxsw_sp *mlxsw_sp,
 649                             struct mlxsw_sp_flow_block *block,
 650                             struct flow_cls_offload *f)
 651 {
 652         struct mlxsw_sp_acl_rule_info *rulei;
 653         struct mlxsw_sp_acl_ruleset *ruleset;
 654         struct mlxsw_sp_acl_rule *rule;
 655         int err;
 656
 657         err = mlxsw_sp_flower_mall_prio_check(block, f);
 658         if (err)
 659                 return err;
 660
 661         ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
 662                                            f->common.chain_index,
 663                                            MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
 664         if (IS_ERR(ruleset))
 665                 return PTR_ERR(ruleset);
 666
 667         rule = mlxsw_sp_acl_rule_create(mlxsw_sp, ruleset, f->cookie, NULL,
 668                                         f->common.extack);
 669         if (IS_ERR(rule)) {
 670                 err = PTR_ERR(rule);
 671                 goto err_rule_create;
 672         }
 673
 674         rulei = mlxsw_sp_acl_rule_rulei(rule);
 675         err = mlxsw_sp_flower_parse(mlxsw_sp, block, rulei, f);
 676         if (err)
 677                 goto err_flower_parse;
 678
 679         err = mlxsw_sp_acl_rulei_commit(rulei);
 680         if (err)
 681                 goto err_rulei_commit;
 682
 683         err = mlxsw_sp_acl_rule_add(mlxsw_sp, rule);
 684         if (err)
 685                 goto err_rule_add;
 686
 687         mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
 688         return 0;
 689
 690 err_rule_add:
 691 err_rulei_commit:
 692 err_flower_parse:
 693         mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
 694 err_rule_create:
 695         mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
 696         return err;
 697 }
 698
 699 void mlxsw_sp_flower_destroy(struct mlxsw_sp *mlxsw_sp,
 700                              struct mlxsw_sp_flow_block *block,
 701                              struct flow_cls_offload *f)
 702 {
 703         struct mlxsw_sp_acl_ruleset *ruleset;
 704         struct mlxsw_sp_acl_rule *rule;
 705
 706         ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
 707                                            f->common.chain_index,
 708                                            MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
 709         if (IS_ERR(ruleset))
 710                 return;
 711
 712         rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
 713         if (rule) {
 714                 mlxsw_sp_acl_rule_del(mlxsw_sp, rule);
 715                 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
 716         }
 717
 718         mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
 719 }
 720
 721 int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp,
 722                           struct mlxsw_sp_flow_block *block,
 723                           struct flow_cls_offload *f)
 724 {
 725         enum flow_action_hw_stats used_hw_stats = FLOW_ACTION_HW_STATS_DISABLED;
 726         struct mlxsw_sp_acl_ruleset *ruleset;
 727         struct mlxsw_sp_acl_rule *rule;
 728         u64 packets;
 729         u64 lastuse;
 730         u64 bytes;
 731         u64 drops;
 732         int err;
 733
 734         ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
 735                                            f->common.chain_index,
 736                                            MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
 737         if (WARN_ON(IS_ERR(ruleset)))
 738                 return -EINVAL;
 739
 740         rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
 741         if (!rule)
 742                 return -EINVAL;
 743
 744         err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes,
 745                                           &drops, &lastuse, &used_hw_stats);
 746         if (err)
 747                 goto err_rule_get_stats;
 748
 749         flow_stats_update(&f->stats, bytes, packets, drops, lastuse,
 750                           used_hw_stats);
 751
 752         mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
 753         return 0;
 754
 755 err_rule_get_stats:
 756         mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
 757         return err;
 758 }
 759
 760 int mlxsw_sp_flower_tmplt_create(struct mlxsw_sp *mlxsw_sp,
 761                                  struct mlxsw_sp_flow_block *block,
 762                                  struct flow_cls_offload *f)
 763 {
 764         struct mlxsw_sp_acl_ruleset *ruleset;
 765         struct mlxsw_sp_acl_rule_info rulei;
 766         int err;
 767
 768         memset(&rulei, 0, sizeof(rulei));
 769         err = mlxsw_sp_flower_parse(mlxsw_sp, block, &rulei, f);
 770         if (err)
 771                 return err;
 772         ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
 773                                            f->common.chain_index,
 774                                            MLXSW_SP_ACL_PROFILE_FLOWER,
 775                                            &rulei.values.elusage);
 776
 777         /* keep the reference to the ruleset */
 778         return PTR_ERR_OR_ZERO(ruleset);
 779 }
 780
 781 void mlxsw_sp_flower_tmplt_destroy(struct mlxsw_sp *mlxsw_sp,
 782                                    struct mlxsw_sp_flow_block *block,
 783                                    struct flow_cls_offload *f)
 784 {
 785         struct mlxsw_sp_acl_ruleset *ruleset;
 786
 787         ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
 788                                            f->common.chain_index,
 789                                            MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
 790         if (IS_ERR(ruleset))
 791                 return;
 792         /* put the reference to the ruleset kept in create */
 793         mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
 794         mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
 795 }
 796
 797 int mlxsw_sp_flower_prio_get(struct mlxsw_sp *mlxsw_sp,
 798                              struct mlxsw_sp_flow_block *block,
 799                              u32 chain_index, unsigned int *p_min_prio,
 800                              unsigned int *p_max_prio)
 801 {
 802         struct mlxsw_sp_acl_ruleset *ruleset;
 803
 804         ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
 805                                               chain_index,
 806                                               MLXSW_SP_ACL_PROFILE_FLOWER);
 807         if (IS_ERR(ruleset))
 808                 /* In case there are no flower rules, the caller
 809                  * receives -ENOENT to indicate there is no need
 810                  * to check the priorities.
 811                  */
 812                 return PTR_ERR(ruleset);
 813         mlxsw_sp_acl_ruleset_prio_get(ruleset, p_min_prio, p_max_prio);
 814         return 0;
 815 }