Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 120ffd84 authored by John Hurley's avatar John Hurley Committed by David S. Miller
Browse files

nfp: flower: verify pre-tunnel rules 



Pre-tunnel rules must direct packets to an internal port based on L2
information. Rules that egress to an internal port are already indicated
by a non-NULL device in its nfp_fl_payload struct. Verfiy the rest of the
match fields indicate that the rule is a pre-tunnel rule. This requires a
full match on the destination MAC address, an option VLAN field, and no
specific matches on other lower layer fields (with the exception of L4
proto and flags).

If a rule is identified as a pre-tunnel rule then mark it for offload to
the pre-tunnel table. Similarly, remove it from the pre-tunnel table on
rule deletion. The actual offloading of these commands is left to a
following patch.

Signed-off-by: default avatarJohn Hurley <john.hurley@netronome.com>
Reviewed-by: default avatarSimon Horman <simon.horman@netronome.com>
Acked-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f5c977ee

drivers/net/ethernet/netronome/nfp/flower/main.h

+5 −0
Original line number Diff line number Diff line
@@ -283,6 +283,7 @@ struct nfp_fl_payload { 
	bool in_hw;

	struct {

		struct net_device *dev;

		__be16 vlan_tci;

	} pre_tun_rule;

};
@@ -419,4 +420,8 @@ void 
nfp_flower_non_repr_priv_put(struct nfp_app *app, struct net_device *netdev);

u32 nfp_flower_get_port_id_from_netdev(struct nfp_app *app,

				       struct net_device *netdev);

int nfp_flower_xmit_pre_tun_flow(struct nfp_app *app,

				 struct nfp_fl_payload *flow);

int nfp_flower_xmit_pre_tun_del_flow(struct nfp_app *app,

				     struct nfp_fl_payload *flow);

#endif

drivers/net/ethernet/netronome/nfp/flower/offload.c

+98 −5
Original line number Diff line number Diff line
@@ -61,6 +61,11 @@ 
	 NFP_FLOWER_LAYER_IPV4 | \

	 NFP_FLOWER_LAYER_IPV6)



#define NFP_FLOWER_PRE_TUN_RULE_FIELDS \

	(NFP_FLOWER_LAYER_PORT | \

	 NFP_FLOWER_LAYER_MAC | \

	 NFP_FLOWER_LAYER_IPV4)



struct nfp_flower_merge_check {

	union {

		struct {
@@ -1012,9 +1017,91 @@ nfp_flower_validate_pre_tun_rule(struct nfp_app *app, 
				 struct nfp_fl_payload *flow,

				 struct netlink_ext_ack *extack)

{

	struct nfp_flower_meta_tci *meta_tci;

	struct nfp_flower_mac_mpls *mac;

	struct nfp_fl_act_head *act;

	u8 *mask = flow->mask_data;

	bool vlan = false;

	int act_offset;

	u8 key_layer;



	meta_tci = (struct nfp_flower_meta_tci *)flow->unmasked_data;

	if (meta_tci->tci & cpu_to_be16(NFP_FLOWER_MASK_VLAN_PRESENT)) {

		u16 vlan_tci = be16_to_cpu(meta_tci->tci);



		vlan_tci &= ~NFP_FLOWER_MASK_VLAN_PRESENT;

		flow->pre_tun_rule.vlan_tci = cpu_to_be16(vlan_tci);

		vlan = true;

	} else {

		flow->pre_tun_rule.vlan_tci = cpu_to_be16(0xffff);

	}



	key_layer = meta_tci->nfp_flow_key_layer;

	if (key_layer & ~NFP_FLOWER_PRE_TUN_RULE_FIELDS) {

		NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: too many match fields");

		return -EOPNOTSUPP;

	}



	if (!(key_layer & NFP_FLOWER_LAYER_MAC)) {

		NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: MAC fields match required");

		return -EOPNOTSUPP;

	}



	/* Skip fields known to exist. */

	mask += sizeof(struct nfp_flower_meta_tci);

	mask += sizeof(struct nfp_flower_in_port);



	/* Ensure destination MAC address is fully matched. */

	mac = (struct nfp_flower_mac_mpls *)mask;

	if (!is_broadcast_ether_addr(&mac->mac_dst[0])) {

		NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: dest MAC field must not be masked");

		return -EOPNOTSUPP;

	}



	if (key_layer & NFP_FLOWER_LAYER_IPV4) {

		int ip_flags = offsetof(struct nfp_flower_ipv4, ip_ext.flags);

		int ip_proto = offsetof(struct nfp_flower_ipv4, ip_ext.proto);

		int i;



		mask += sizeof(struct nfp_flower_mac_mpls);



		/* Ensure proto and flags are the only IP layer fields. */

		for (i = 0; i < sizeof(struct nfp_flower_ipv4); i++)

			if (mask[i] && i != ip_flags && i != ip_proto) {

				NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: only flags and proto can be matched in ip header");

				return -EOPNOTSUPP;

			}

	}



	/* Action must be a single egress or pop_vlan and egress. */

	act_offset = 0;

	act = (struct nfp_fl_act_head *)&flow->action_data[act_offset];

	if (vlan) {

		if (act->jump_id != NFP_FL_ACTION_OPCODE_POP_VLAN) {

			NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: match on VLAN must have VLAN pop as first action");

			return -EOPNOTSUPP;

		}



		act_offset += act->len_lw << NFP_FL_LW_SIZ;

		act = (struct nfp_fl_act_head *)&flow->action_data[act_offset];

	}



	if (act->jump_id != NFP_FL_ACTION_OPCODE_OUTPUT) {

		NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: non egress action detected where egress was expected");

		return -EOPNOTSUPP;

	}



	act_offset += act->len_lw << NFP_FL_LW_SIZ;



	/* Ensure there are no more actions after egress. */

	if (act_offset != flow->meta.act_len) {

		NL_SET_ERR_MSG_MOD(extack, "unsupported pre-tunnel rule: egress is not the last action");

		return -EOPNOTSUPP;

	}



	return 0;

}



/**

 * nfp_flower_add_offload() - Adds a new flow to hardware.

 * @app:	Pointer to the APP handle
@@ -1083,6 +1170,9 @@ nfp_flower_add_offload(struct nfp_app *app, struct net_device *netdev, 
		goto err_release_metadata;

	}



	if (flow_pay->pre_tun_rule.dev)

		err = nfp_flower_xmit_pre_tun_flow(app, flow_pay);

	else

		err = nfp_flower_xmit_flow(app, flow_pay,

					   NFP_FLOWER_CMSG_TYPE_FLOW_ADD);

	if (err)
@@ -1226,6 +1316,9 @@ nfp_flower_del_offload(struct nfp_app *app, struct net_device *netdev, 
		goto err_free_merge_flow;

	}



	if (nfp_flow->pre_tun_rule.dev)

		err = nfp_flower_xmit_pre_tun_del_flow(app, nfp_flow);

	else

		err = nfp_flower_xmit_flow(app, nfp_flow,

					   NFP_FLOWER_CMSG_TYPE_FLOW_DEL);

	/* Fall through on error. */

drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c

+12 −0
Original line number Diff line number Diff line
@@ -832,6 +832,18 @@ int nfp_tunnel_mac_event_handler(struct nfp_app *app, 
	return NOTIFY_OK;

}



int nfp_flower_xmit_pre_tun_flow(struct nfp_app *app,

				 struct nfp_fl_payload *flow)

{

	return -EOPNOTSUPP;

}



int nfp_flower_xmit_pre_tun_del_flow(struct nfp_app *app,

				     struct nfp_fl_payload *flow)

{

	return -EOPNOTSUPP;

}



int nfp_tunnel_config_start(struct nfp_app *app)

{

	struct nfp_flower_priv *priv = app->priv;