1 /* SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB */
2 /* Copyright (c) 2018 Mellanox Technologies. */
3
4 #include <net/inet_ecn.h>
5 #include <net/vxlan.h>
6 #include <net/gre.h>
7 #include <net/geneve.h>
8 #include <net/bareudp.h>
9 #include "en/tc_tun.h"
10 #include "en/tc_priv.h"
11 #include "en_tc.h"
12 #include "rep/tc.h"
13 #include "rep/neigh.h"
14 #include "lag/lag.h"
15 #include "lag/mp.h"
16
17 struct mlx5e_tc_tun_route_attr {
18 struct net_device *out_dev;
19 struct net_device *route_dev;
20 union {
21 struct flowi4 fl4;
22 struct flowi6 fl6;
23 } fl;
24 struct neighbour *n;
25 u8 ttl;
26 };
27
28 #define TC_TUN_ROUTE_ATTR_INIT(name) struct mlx5e_tc_tun_route_attr name = {}
29
mlx5e_tc_tun_route_attr_cleanup(struct mlx5e_tc_tun_route_attr * attr)30 static void mlx5e_tc_tun_route_attr_cleanup(struct mlx5e_tc_tun_route_attr *attr)
31 {
32 if (attr->n)
33 neigh_release(attr->n);
34 dev_put(attr->route_dev);
35 }
36
mlx5e_get_tc_tun(struct net_device * tunnel_dev)37 struct mlx5e_tc_tunnel *mlx5e_get_tc_tun(struct net_device *tunnel_dev)
38 {
39 if (netif_is_vxlan(tunnel_dev))
40 return &vxlan_tunnel;
41 else if (netif_is_geneve(tunnel_dev))
42 return &geneve_tunnel;
43 else if (netif_is_gretap(tunnel_dev) ||
44 netif_is_ip6gretap(tunnel_dev))
45 return &gre_tunnel;
46 else if (netif_is_bareudp(tunnel_dev))
47 return &mplsoudp_tunnel;
48 else
49 return NULL;
50 }
51
get_route_and_out_devs(struct mlx5e_priv * priv,struct net_device * dev,struct net_device ** route_dev,struct net_device ** out_dev)52 static int get_route_and_out_devs(struct mlx5e_priv *priv,
53 struct net_device *dev,
54 struct net_device **route_dev,
55 struct net_device **out_dev)
56 {
57 struct net_device *uplink_dev, *uplink_upper, *real_dev;
58 struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
59 bool dst_is_lag_dev;
60
61 real_dev = is_vlan_dev(dev) ? vlan_dev_real_dev(dev) : dev;
62 uplink_dev = mlx5_eswitch_uplink_get_proto_dev(esw, REP_ETH);
63
64 rcu_read_lock();
65 uplink_upper = netdev_master_upper_dev_get_rcu(uplink_dev);
66 /* mlx5_lag_is_sriov() is a blocking function which can't be called
67 * while holding rcu read lock. Take the net_device for correctness
68 * sake.
69 */
70 dev_hold(uplink_upper);
71 rcu_read_unlock();
72
73 dst_is_lag_dev = (uplink_upper &&
74 netif_is_lag_master(uplink_upper) &&
75 real_dev == uplink_upper &&
76 mlx5_lag_is_sriov(priv->mdev));
77 dev_put(uplink_upper);
78
79 /* if the egress device isn't on the same HW e-switch or
80 * it's a LAG device, use the uplink
81 */
82 *route_dev = dev;
83 if (!netdev_port_same_parent_id(priv->netdev, real_dev) ||
84 dst_is_lag_dev || is_vlan_dev(*route_dev) ||
85 netif_is_ovs_master(*route_dev))
86 *out_dev = uplink_dev;
87 else if (mlx5e_eswitch_rep(dev) &&
88 mlx5e_is_valid_eswitch_fwd_dev(priv, dev))
89 *out_dev = *route_dev;
90 else
91 return -EOPNOTSUPP;
92
93 if (!mlx5e_eswitch_uplink_rep(*out_dev))
94 return -EOPNOTSUPP;
95
96 if (mlx5e_eswitch_uplink_rep(priv->netdev) && *out_dev != priv->netdev &&
97 !mlx5_lag_is_mpesw(priv->mdev))
98 return -EOPNOTSUPP;
99
100 return 0;
101 }
102
mlx5e_route_lookup_ipv4_get(struct mlx5e_priv * priv,struct net_device * dev,struct mlx5e_tc_tun_route_attr * attr)103 static int mlx5e_route_lookup_ipv4_get(struct mlx5e_priv *priv,
104 struct net_device *dev,
105 struct mlx5e_tc_tun_route_attr *attr)
106 {
107 struct net_device *route_dev;
108 struct net_device *out_dev;
109 struct neighbour *n;
110 struct rtable *rt;
111
112 #if IS_ENABLED(CONFIG_INET)
113 struct mlx5_core_dev *mdev = priv->mdev;
114 struct net_device *uplink_dev;
115 int ret;
116
117 if (mlx5_lag_is_multipath(mdev)) {
118 struct mlx5_eswitch *esw = mdev->priv.eswitch;
119
120 uplink_dev = mlx5_eswitch_uplink_get_proto_dev(esw, REP_ETH);
121 attr->fl.fl4.flowi4_oif = uplink_dev->ifindex;
122 } else {
123 struct mlx5e_tc_tunnel *tunnel = mlx5e_get_tc_tun(dev);
124
125 if (tunnel && tunnel->get_remote_ifindex)
126 attr->fl.fl4.flowi4_oif = tunnel->get_remote_ifindex(dev);
127 }
128
129 rt = ip_route_output_key(dev_net(dev), &attr->fl.fl4);
130 if (IS_ERR(rt))
131 return PTR_ERR(rt);
132
133 if (rt->rt_type != RTN_UNICAST) {
134 ret = -ENETUNREACH;
135 goto err_rt_release;
136 }
137
138 if (mlx5_lag_is_multipath(mdev) && rt->rt_gw_family != AF_INET) {
139 ret = -ENETUNREACH;
140 goto err_rt_release;
141 }
142 #else
143 return -EOPNOTSUPP;
144 #endif
145
146 ret = get_route_and_out_devs(priv, rt->dst.dev, &route_dev, &out_dev);
147 if (ret < 0)
148 goto err_rt_release;
149 dev_hold(route_dev);
150
151 if (!attr->ttl)
152 attr->ttl = ip4_dst_hoplimit(&rt->dst);
153 n = dst_neigh_lookup(&rt->dst, &attr->fl.fl4.daddr);
154 if (!n) {
155 ret = -ENOMEM;
156 goto err_dev_release;
157 }
158
159 ip_rt_put(rt);
160 attr->route_dev = route_dev;
161 attr->out_dev = out_dev;
162 attr->n = n;
163 return 0;
164
165 err_dev_release:
166 dev_put(route_dev);
167 err_rt_release:
168 ip_rt_put(rt);
169 return ret;
170 }
171
mlx5e_route_lookup_ipv4_put(struct mlx5e_tc_tun_route_attr * attr)172 static void mlx5e_route_lookup_ipv4_put(struct mlx5e_tc_tun_route_attr *attr)
173 {
174 mlx5e_tc_tun_route_attr_cleanup(attr);
175 }
176
mlx5e_netdev_kind(struct net_device * dev)177 static const char *mlx5e_netdev_kind(struct net_device *dev)
178 {
179 if (dev->rtnl_link_ops)
180 return dev->rtnl_link_ops->kind;
181 else
182 return "unknown";
183 }
184
mlx5e_gen_ip_tunnel_header(char buf[],__u8 * ip_proto,struct mlx5e_encap_entry * e)185 static int mlx5e_gen_ip_tunnel_header(char buf[], __u8 *ip_proto,
186 struct mlx5e_encap_entry *e)
187 {
188 if (!e->tunnel) {
189 pr_warn("mlx5: Cannot generate tunnel header for this tunnel\n");
190 return -EOPNOTSUPP;
191 }
192
193 return e->tunnel->generate_ip_tun_hdr(buf, ip_proto, e);
194 }
195
gen_eth_tnl_hdr(char * buf,struct net_device * dev,struct mlx5e_encap_entry * e,u16 proto)196 static char *gen_eth_tnl_hdr(char *buf, struct net_device *dev,
197 struct mlx5e_encap_entry *e,
198 u16 proto)
199 {
200 struct ethhdr *eth = (struct ethhdr *)buf;
201 char *ip;
202
203 ether_addr_copy(eth->h_dest, e->h_dest);
204 ether_addr_copy(eth->h_source, dev->dev_addr);
205 if (is_vlan_dev(dev)) {
206 struct vlan_hdr *vlan = (struct vlan_hdr *)
207 ((char *)eth + ETH_HLEN);
208 ip = (char *)vlan + VLAN_HLEN;
209 eth->h_proto = vlan_dev_vlan_proto(dev);
210 vlan->h_vlan_TCI = htons(vlan_dev_vlan_id(dev));
211 vlan->h_vlan_encapsulated_proto = htons(proto);
212 } else {
213 eth->h_proto = htons(proto);
214 ip = (char *)eth + ETH_HLEN;
215 }
216
217 return ip;
218 }
219
mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv * priv,struct net_device * mirred_dev,struct mlx5e_encap_entry * e)220 int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv,
221 struct net_device *mirred_dev,
222 struct mlx5e_encap_entry *e)
223 {
224 int max_encap_size = MLX5_CAP_ESW(priv->mdev, max_encap_header_size);
225 const struct ip_tunnel_key *tun_key = &e->tun_info->key;
226 struct mlx5_pkt_reformat_params reformat_params;
227 struct mlx5e_neigh m_neigh = {};
228 TC_TUN_ROUTE_ATTR_INIT(attr);
229 int ipv4_encap_size;
230 char *encap_header;
231 struct iphdr *ip;
232 u8 nud_state;
233 int err;
234
235 /* add the IP fields */
236 attr.fl.fl4.flowi4_tos = tun_key->tos & ~INET_ECN_MASK;
237 attr.fl.fl4.daddr = tun_key->u.ipv4.dst;
238 attr.fl.fl4.saddr = tun_key->u.ipv4.src;
239 attr.ttl = tun_key->ttl;
240
241 err = mlx5e_route_lookup_ipv4_get(priv, mirred_dev, &attr);
242 if (err)
243 return err;
244
245 ipv4_encap_size =
246 (is_vlan_dev(attr.route_dev) ? VLAN_ETH_HLEN : ETH_HLEN) +
247 sizeof(struct iphdr) +
248 e->tunnel->calc_hlen(e);
249
250 if (max_encap_size < ipv4_encap_size) {
251 mlx5_core_warn(priv->mdev, "encap size %d too big, max supported is %d\n",
252 ipv4_encap_size, max_encap_size);
253 err = -EOPNOTSUPP;
254 goto release_neigh;
255 }
256
257 encap_header = kzalloc(ipv4_encap_size, GFP_KERNEL);
258 if (!encap_header) {
259 err = -ENOMEM;
260 goto release_neigh;
261 }
262
263 m_neigh.family = attr.n->ops->family;
264 memcpy(&m_neigh.dst_ip, attr.n->primary_key, attr.n->tbl->key_len);
265 e->out_dev = attr.out_dev;
266 e->route_dev_ifindex = attr.route_dev->ifindex;
267
268 /* It's important to add the neigh to the hash table before checking
269 * the neigh validity state. So if we'll get a notification, in case the
270 * neigh changes it's validity state, we would find the relevant neigh
271 * in the hash.
272 */
273 err = mlx5e_rep_encap_entry_attach(netdev_priv(attr.out_dev), e, &m_neigh, attr.n->dev);
274 if (err)
275 goto free_encap;
276
277 read_lock_bh(&attr.n->lock);
278 nud_state = attr.n->nud_state;
279 ether_addr_copy(e->h_dest, attr.n->ha);
280 read_unlock_bh(&attr.n->lock);
281
282 /* add ethernet header */
283 ip = (struct iphdr *)gen_eth_tnl_hdr(encap_header, attr.route_dev, e,
284 ETH_P_IP);
285
286 /* add ip header */
287 ip->tos = tun_key->tos;
288 ip->version = 0x4;
289 ip->ihl = 0x5;
290 ip->ttl = attr.ttl;
291 ip->daddr = attr.fl.fl4.daddr;
292 ip->saddr = attr.fl.fl4.saddr;
293
294 /* add tunneling protocol header */
295 err = mlx5e_gen_ip_tunnel_header((char *)ip + sizeof(struct iphdr),
296 &ip->protocol, e);
297 if (err)
298 goto destroy_neigh_entry;
299
300 e->encap_size = ipv4_encap_size;
301 e->encap_header = encap_header;
302 encap_header = NULL;
303
304 if (!(nud_state & NUD_VALID)) {
305 neigh_event_send(attr.n, NULL);
306 /* the encap entry will be made valid on neigh update event
307 * and not used before that.
308 */
309 goto release_neigh;
310 }
311
312 memset(&reformat_params, 0, sizeof(reformat_params));
313 reformat_params.type = e->reformat_type;
314 reformat_params.size = e->encap_size;
315 reformat_params.data = e->encap_header;
316 e->pkt_reformat = mlx5_packet_reformat_alloc(priv->mdev, &reformat_params,
317 MLX5_FLOW_NAMESPACE_FDB);
318 if (IS_ERR(e->pkt_reformat)) {
319 err = PTR_ERR(e->pkt_reformat);
320 goto destroy_neigh_entry;
321 }
322
323 e->flags |= MLX5_ENCAP_ENTRY_VALID;
324 mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev));
325 mlx5e_route_lookup_ipv4_put(&attr);
326 return err;
327
328 destroy_neigh_entry:
329 mlx5e_rep_encap_entry_detach(netdev_priv(e->out_dev), e);
330 free_encap:
331 kfree(encap_header);
332 release_neigh:
333 mlx5e_route_lookup_ipv4_put(&attr);
334 return err;
335 }
336
mlx5e_tc_tun_update_header_ipv4(struct mlx5e_priv * priv,struct net_device * mirred_dev,struct mlx5e_encap_entry * e)337 int mlx5e_tc_tun_update_header_ipv4(struct mlx5e_priv *priv,
338 struct net_device *mirred_dev,
339 struct mlx5e_encap_entry *e)
340 {
341 int max_encap_size = MLX5_CAP_ESW(priv->mdev, max_encap_header_size);
342 const struct ip_tunnel_key *tun_key = &e->tun_info->key;
343 struct mlx5_pkt_reformat_params reformat_params;
344 TC_TUN_ROUTE_ATTR_INIT(attr);
345 int ipv4_encap_size;
346 char *encap_header;
347 struct iphdr *ip;
348 u8 nud_state;
349 int err;
350
351 /* add the IP fields */
352 attr.fl.fl4.flowi4_tos = tun_key->tos & ~INET_ECN_MASK;
353 attr.fl.fl4.daddr = tun_key->u.ipv4.dst;
354 attr.fl.fl4.saddr = tun_key->u.ipv4.src;
355 attr.ttl = tun_key->ttl;
356
357 err = mlx5e_route_lookup_ipv4_get(priv, mirred_dev, &attr);
358 if (err)
359 return err;
360
361 ipv4_encap_size =
362 (is_vlan_dev(attr.route_dev) ? VLAN_ETH_HLEN : ETH_HLEN) +
363 sizeof(struct iphdr) +
364 e->tunnel->calc_hlen(e);
365
366 if (max_encap_size < ipv4_encap_size) {
367 mlx5_core_warn(priv->mdev, "encap size %d too big, max supported is %d\n",
368 ipv4_encap_size, max_encap_size);
369 err = -EOPNOTSUPP;
370 goto release_neigh;
371 }
372
373 encap_header = kzalloc(ipv4_encap_size, GFP_KERNEL);
374 if (!encap_header) {
375 err = -ENOMEM;
376 goto release_neigh;
377 }
378
379 e->route_dev_ifindex = attr.route_dev->ifindex;
380
381 read_lock_bh(&attr.n->lock);
382 nud_state = attr.n->nud_state;
383 ether_addr_copy(e->h_dest, attr.n->ha);
384 WRITE_ONCE(e->nhe->neigh_dev, attr.n->dev);
385 read_unlock_bh(&attr.n->lock);
386
387 /* add ethernet header */
388 ip = (struct iphdr *)gen_eth_tnl_hdr(encap_header, attr.route_dev, e,
389 ETH_P_IP);
390
391 /* add ip header */
392 ip->tos = tun_key->tos;
393 ip->version = 0x4;
394 ip->ihl = 0x5;
395 ip->ttl = attr.ttl;
396 ip->daddr = attr.fl.fl4.daddr;
397 ip->saddr = attr.fl.fl4.saddr;
398
399 /* add tunneling protocol header */
400 err = mlx5e_gen_ip_tunnel_header((char *)ip + sizeof(struct iphdr),
401 &ip->protocol, e);
402 if (err)
403 goto free_encap;
404
405 e->encap_size = ipv4_encap_size;
406 kfree(e->encap_header);
407 e->encap_header = encap_header;
408 encap_header = NULL;
409
410 if (!(nud_state & NUD_VALID)) {
411 neigh_event_send(attr.n, NULL);
412 /* the encap entry will be made valid on neigh update event
413 * and not used before that.
414 */
415 goto release_neigh;
416 }
417
418 memset(&reformat_params, 0, sizeof(reformat_params));
419 reformat_params.type = e->reformat_type;
420 reformat_params.size = e->encap_size;
421 reformat_params.data = e->encap_header;
422 e->pkt_reformat = mlx5_packet_reformat_alloc(priv->mdev, &reformat_params,
423 MLX5_FLOW_NAMESPACE_FDB);
424 if (IS_ERR(e->pkt_reformat)) {
425 err = PTR_ERR(e->pkt_reformat);
426 goto free_encap;
427 }
428
429 e->flags |= MLX5_ENCAP_ENTRY_VALID;
430 mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev));
431 mlx5e_route_lookup_ipv4_put(&attr);
432 return err;
433
434 free_encap:
435 kfree(encap_header);
436 release_neigh:
437 mlx5e_route_lookup_ipv4_put(&attr);
438 return err;
439 }
440
441 #if IS_ENABLED(CONFIG_INET) && IS_ENABLED(CONFIG_IPV6)
mlx5e_route_lookup_ipv6_get(struct mlx5e_priv * priv,struct net_device * dev,struct mlx5e_tc_tun_route_attr * attr)442 static int mlx5e_route_lookup_ipv6_get(struct mlx5e_priv *priv,
443 struct net_device *dev,
444 struct mlx5e_tc_tun_route_attr *attr)
445 {
446 struct mlx5e_tc_tunnel *tunnel = mlx5e_get_tc_tun(dev);
447 struct net_device *route_dev;
448 struct net_device *out_dev;
449 struct dst_entry *dst;
450 struct neighbour *n;
451 int ret;
452
453 if (tunnel && tunnel->get_remote_ifindex)
454 attr->fl.fl6.flowi6_oif = tunnel->get_remote_ifindex(dev);
455 dst = ipv6_stub->ipv6_dst_lookup_flow(dev_net(dev), NULL, &attr->fl.fl6,
456 NULL);
457 if (IS_ERR(dst))
458 return PTR_ERR(dst);
459
460 if (!attr->ttl)
461 attr->ttl = ip6_dst_hoplimit(dst);
462
463 ret = get_route_and_out_devs(priv, dst->dev, &route_dev, &out_dev);
464 if (ret < 0)
465 goto err_dst_release;
466
467 dev_hold(route_dev);
468 n = dst_neigh_lookup(dst, &attr->fl.fl6.daddr);
469 if (!n) {
470 ret = -ENOMEM;
471 goto err_dev_release;
472 }
473
474 dst_release(dst);
475 attr->out_dev = out_dev;
476 attr->route_dev = route_dev;
477 attr->n = n;
478 return 0;
479
480 err_dev_release:
481 dev_put(route_dev);
482 err_dst_release:
483 dst_release(dst);
484 return ret;
485 }
486
mlx5e_route_lookup_ipv6_put(struct mlx5e_tc_tun_route_attr * attr)487 static void mlx5e_route_lookup_ipv6_put(struct mlx5e_tc_tun_route_attr *attr)
488 {
489 mlx5e_tc_tun_route_attr_cleanup(attr);
490 }
491
mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv * priv,struct net_device * mirred_dev,struct mlx5e_encap_entry * e)492 int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv,
493 struct net_device *mirred_dev,
494 struct mlx5e_encap_entry *e)
495 {
496 int max_encap_size = MLX5_CAP_ESW(priv->mdev, max_encap_header_size);
497 const struct ip_tunnel_key *tun_key = &e->tun_info->key;
498 struct mlx5_pkt_reformat_params reformat_params;
499 struct mlx5e_neigh m_neigh = {};
500 TC_TUN_ROUTE_ATTR_INIT(attr);
501 struct ipv6hdr *ip6h;
502 int ipv6_encap_size;
503 char *encap_header;
504 u8 nud_state;
505 int err;
506
507 attr.ttl = tun_key->ttl;
508 attr.fl.fl6.flowlabel = ip6_make_flowinfo(tun_key->tos, tun_key->label);
509 attr.fl.fl6.daddr = tun_key->u.ipv6.dst;
510 attr.fl.fl6.saddr = tun_key->u.ipv6.src;
511
512 err = mlx5e_route_lookup_ipv6_get(priv, mirred_dev, &attr);
513 if (err)
514 return err;
515
516 ipv6_encap_size =
517 (is_vlan_dev(attr.route_dev) ? VLAN_ETH_HLEN : ETH_HLEN) +
518 sizeof(struct ipv6hdr) +
519 e->tunnel->calc_hlen(e);
520
521 if (max_encap_size < ipv6_encap_size) {
522 mlx5_core_warn(priv->mdev, "encap size %d too big, max supported is %d\n",
523 ipv6_encap_size, max_encap_size);
524 err = -EOPNOTSUPP;
525 goto release_neigh;
526 }
527
528 encap_header = kzalloc(ipv6_encap_size, GFP_KERNEL);
529 if (!encap_header) {
530 err = -ENOMEM;
531 goto release_neigh;
532 }
533
534 m_neigh.family = attr.n->ops->family;
535 memcpy(&m_neigh.dst_ip, attr.n->primary_key, attr.n->tbl->key_len);
536 e->out_dev = attr.out_dev;
537 e->route_dev_ifindex = attr.route_dev->ifindex;
538
539 /* It's important to add the neigh to the hash table before checking
540 * the neigh validity state. So if we'll get a notification, in case the
541 * neigh changes it's validity state, we would find the relevant neigh
542 * in the hash.
543 */
544 err = mlx5e_rep_encap_entry_attach(netdev_priv(attr.out_dev), e, &m_neigh, attr.n->dev);
545 if (err)
546 goto free_encap;
547
548 read_lock_bh(&attr.n->lock);
549 nud_state = attr.n->nud_state;
550 ether_addr_copy(e->h_dest, attr.n->ha);
551 read_unlock_bh(&attr.n->lock);
552
553 /* add ethernet header */
554 ip6h = (struct ipv6hdr *)gen_eth_tnl_hdr(encap_header, attr.route_dev, e,
555 ETH_P_IPV6);
556
557 /* add ip header */
558 ip6_flow_hdr(ip6h, tun_key->tos, 0);
559 /* the HW fills up ipv6 payload len */
560 ip6h->hop_limit = attr.ttl;
561 ip6h->daddr = attr.fl.fl6.daddr;
562 ip6h->saddr = attr.fl.fl6.saddr;
563
564 /* add tunneling protocol header */
565 err = mlx5e_gen_ip_tunnel_header((char *)ip6h + sizeof(struct ipv6hdr),
566 &ip6h->nexthdr, e);
567 if (err)
568 goto destroy_neigh_entry;
569
570 e->encap_size = ipv6_encap_size;
571 e->encap_header = encap_header;
572 encap_header = NULL;
573
574 if (!(nud_state & NUD_VALID)) {
575 neigh_event_send(attr.n, NULL);
576 /* the encap entry will be made valid on neigh update event
577 * and not used before that.
578 */
579 goto release_neigh;
580 }
581
582 memset(&reformat_params, 0, sizeof(reformat_params));
583 reformat_params.type = e->reformat_type;
584 reformat_params.size = e->encap_size;
585 reformat_params.data = e->encap_header;
586 e->pkt_reformat = mlx5_packet_reformat_alloc(priv->mdev, &reformat_params,
587 MLX5_FLOW_NAMESPACE_FDB);
588 if (IS_ERR(e->pkt_reformat)) {
589 err = PTR_ERR(e->pkt_reformat);
590 goto destroy_neigh_entry;
591 }
592
593 e->flags |= MLX5_ENCAP_ENTRY_VALID;
594 mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev));
595 mlx5e_route_lookup_ipv6_put(&attr);
596 return err;
597
598 destroy_neigh_entry:
599 mlx5e_rep_encap_entry_detach(netdev_priv(e->out_dev), e);
600 free_encap:
601 kfree(encap_header);
602 release_neigh:
603 mlx5e_route_lookup_ipv6_put(&attr);
604 return err;
605 }
606
mlx5e_tc_tun_update_header_ipv6(struct mlx5e_priv * priv,struct net_device * mirred_dev,struct mlx5e_encap_entry * e)607 int mlx5e_tc_tun_update_header_ipv6(struct mlx5e_priv *priv,
608 struct net_device *mirred_dev,
609 struct mlx5e_encap_entry *e)
610 {
611 int max_encap_size = MLX5_CAP_ESW(priv->mdev, max_encap_header_size);
612 const struct ip_tunnel_key *tun_key = &e->tun_info->key;
613 struct mlx5_pkt_reformat_params reformat_params;
614 TC_TUN_ROUTE_ATTR_INIT(attr);
615 struct ipv6hdr *ip6h;
616 int ipv6_encap_size;
617 char *encap_header;
618 u8 nud_state;
619 int err;
620
621 attr.ttl = tun_key->ttl;
622
623 attr.fl.fl6.flowlabel = ip6_make_flowinfo(tun_key->tos, tun_key->label);
624 attr.fl.fl6.daddr = tun_key->u.ipv6.dst;
625 attr.fl.fl6.saddr = tun_key->u.ipv6.src;
626
627 err = mlx5e_route_lookup_ipv6_get(priv, mirred_dev, &attr);
628 if (err)
629 return err;
630
631 ipv6_encap_size =
632 (is_vlan_dev(attr.route_dev) ? VLAN_ETH_HLEN : ETH_HLEN) +
633 sizeof(struct ipv6hdr) +
634 e->tunnel->calc_hlen(e);
635
636 if (max_encap_size < ipv6_encap_size) {
637 mlx5_core_warn(priv->mdev, "encap size %d too big, max supported is %d\n",
638 ipv6_encap_size, max_encap_size);
639 err = -EOPNOTSUPP;
640 goto release_neigh;
641 }
642
643 encap_header = kzalloc(ipv6_encap_size, GFP_KERNEL);
644 if (!encap_header) {
645 err = -ENOMEM;
646 goto release_neigh;
647 }
648
649 e->route_dev_ifindex = attr.route_dev->ifindex;
650
651 read_lock_bh(&attr.n->lock);
652 nud_state = attr.n->nud_state;
653 ether_addr_copy(e->h_dest, attr.n->ha);
654 WRITE_ONCE(e->nhe->neigh_dev, attr.n->dev);
655 read_unlock_bh(&attr.n->lock);
656
657 /* add ethernet header */
658 ip6h = (struct ipv6hdr *)gen_eth_tnl_hdr(encap_header, attr.route_dev, e,
659 ETH_P_IPV6);
660
661 /* add ip header */
662 ip6_flow_hdr(ip6h, tun_key->tos, 0);
663 /* the HW fills up ipv6 payload len */
664 ip6h->hop_limit = attr.ttl;
665 ip6h->daddr = attr.fl.fl6.daddr;
666 ip6h->saddr = attr.fl.fl6.saddr;
667
668 /* add tunneling protocol header */
669 err = mlx5e_gen_ip_tunnel_header((char *)ip6h + sizeof(struct ipv6hdr),
670 &ip6h->nexthdr, e);
671 if (err)
672 goto free_encap;
673
674 e->encap_size = ipv6_encap_size;
675 kfree(e->encap_header);
676 e->encap_header = encap_header;
677 encap_header = NULL;
678
679 if (!(nud_state & NUD_VALID)) {
680 neigh_event_send(attr.n, NULL);
681 /* the encap entry will be made valid on neigh update event
682 * and not used before that.
683 */
684 goto release_neigh;
685 }
686
687 memset(&reformat_params, 0, sizeof(reformat_params));
688 reformat_params.type = e->reformat_type;
689 reformat_params.size = e->encap_size;
690 reformat_params.data = e->encap_header;
691 e->pkt_reformat = mlx5_packet_reformat_alloc(priv->mdev, &reformat_params,
692 MLX5_FLOW_NAMESPACE_FDB);
693 if (IS_ERR(e->pkt_reformat)) {
694 err = PTR_ERR(e->pkt_reformat);
695 goto free_encap;
696 }
697
698 e->flags |= MLX5_ENCAP_ENTRY_VALID;
699 mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev));
700 mlx5e_route_lookup_ipv6_put(&attr);
701 return err;
702
703 free_encap:
704 kfree(encap_header);
705 release_neigh:
706 mlx5e_route_lookup_ipv6_put(&attr);
707 return err;
708 }
709 #endif
710
mlx5e_tc_tun_route_lookup(struct mlx5e_priv * priv,struct mlx5_flow_spec * spec,struct mlx5_flow_attr * flow_attr,struct net_device * filter_dev)711 int mlx5e_tc_tun_route_lookup(struct mlx5e_priv *priv,
712 struct mlx5_flow_spec *spec,
713 struct mlx5_flow_attr *flow_attr,
714 struct net_device *filter_dev)
715 {
716 struct mlx5_esw_flow_attr *esw_attr = flow_attr->esw_attr;
717 struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
718 struct mlx5e_tc_int_port *int_port;
719 TC_TUN_ROUTE_ATTR_INIT(attr);
720 u16 vport_num;
721 int err = 0;
722
723 if (flow_attr->tun_ip_version == 4) {
724 /* Addresses are swapped for decap */
725 attr.fl.fl4.saddr = esw_attr->rx_tun_attr->dst_ip.v4;
726 attr.fl.fl4.daddr = esw_attr->rx_tun_attr->src_ip.v4;
727 err = mlx5e_route_lookup_ipv4_get(priv, filter_dev, &attr);
728 }
729 #if IS_ENABLED(CONFIG_INET) && IS_ENABLED(CONFIG_IPV6)
730 else if (flow_attr->tun_ip_version == 6) {
731 /* Addresses are swapped for decap */
732 attr.fl.fl6.saddr = esw_attr->rx_tun_attr->dst_ip.v6;
733 attr.fl.fl6.daddr = esw_attr->rx_tun_attr->src_ip.v6;
734 err = mlx5e_route_lookup_ipv6_get(priv, filter_dev, &attr);
735 }
736 #endif
737 else
738 return 0;
739
740 if (err)
741 return err;
742
743 if (attr.route_dev->netdev_ops == &mlx5e_netdev_ops &&
744 mlx5e_tc_is_vf_tunnel(attr.out_dev, attr.route_dev)) {
745 err = mlx5e_tc_query_route_vport(attr.out_dev, attr.route_dev, &vport_num);
746 if (err)
747 goto out;
748
749 esw_attr->rx_tun_attr->decap_vport = vport_num;
750 } else if (netif_is_ovs_master(attr.route_dev) && mlx5e_tc_int_port_supported(esw)) {
751 int_port = mlx5e_tc_int_port_get(mlx5e_get_int_port_priv(priv),
752 attr.route_dev->ifindex,
753 MLX5E_TC_INT_PORT_INGRESS);
754 if (IS_ERR(int_port)) {
755 err = PTR_ERR(int_port);
756 goto out;
757 }
758 esw_attr->int_port = int_port;
759 }
760
761 out:
762 if (flow_attr->tun_ip_version == 4)
763 mlx5e_route_lookup_ipv4_put(&attr);
764 #if IS_ENABLED(CONFIG_INET) && IS_ENABLED(CONFIG_IPV6)
765 else if (flow_attr->tun_ip_version == 6)
766 mlx5e_route_lookup_ipv6_put(&attr);
767 #endif
768 return err;
769 }
770
mlx5e_tc_tun_device_to_offload(struct mlx5e_priv * priv,struct net_device * netdev)771 bool mlx5e_tc_tun_device_to_offload(struct mlx5e_priv *priv,
772 struct net_device *netdev)
773 {
774 struct mlx5e_tc_tunnel *tunnel = mlx5e_get_tc_tun(netdev);
775
776 if (tunnel && tunnel->can_offload(priv))
777 return true;
778 else
779 return false;
780 }
781
mlx5e_tc_tun_init_encap_attr(struct net_device * tunnel_dev,struct mlx5e_priv * priv,struct mlx5e_encap_entry * e,struct netlink_ext_ack * extack)782 int mlx5e_tc_tun_init_encap_attr(struct net_device *tunnel_dev,
783 struct mlx5e_priv *priv,
784 struct mlx5e_encap_entry *e,
785 struct netlink_ext_ack *extack)
786 {
787 struct mlx5e_tc_tunnel *tunnel = mlx5e_get_tc_tun(tunnel_dev);
788
789 if (!tunnel) {
790 e->reformat_type = -1;
791 return -EOPNOTSUPP;
792 }
793
794 return tunnel->init_encap_attr(tunnel_dev, priv, e, extack);
795 }
796
mlx5e_tc_tun_parse(struct net_device * filter_dev,struct mlx5e_priv * priv,struct mlx5_flow_spec * spec,struct flow_cls_offload * f,u8 * match_level)797 int mlx5e_tc_tun_parse(struct net_device *filter_dev,
798 struct mlx5e_priv *priv,
799 struct mlx5_flow_spec *spec,
800 struct flow_cls_offload *f,
801 u8 *match_level)
802 {
803 struct mlx5e_tc_tunnel *tunnel = mlx5e_get_tc_tun(filter_dev);
804 struct flow_rule *rule = flow_cls_offload_flow_rule(f);
805 void *headers_c = MLX5_ADDR_OF(fte_match_param, spec->match_criteria,
806 outer_headers);
807 void *headers_v = MLX5_ADDR_OF(fte_match_param, spec->match_value,
808 outer_headers);
809 struct netlink_ext_ack *extack = f->common.extack;
810 int err = 0;
811
812 if (!tunnel) {
813 netdev_warn(priv->netdev,
814 "decapsulation offload is not supported for %s net device\n",
815 mlx5e_netdev_kind(filter_dev));
816 err = -EOPNOTSUPP;
817 goto out;
818 }
819
820 *match_level = tunnel->match_level;
821
822 if (tunnel->parse_udp_ports) {
823 err = tunnel->parse_udp_ports(priv, spec, f,
824 headers_c, headers_v);
825 if (err)
826 goto out;
827 }
828
829 if (tunnel->parse_tunnel) {
830 err = tunnel->parse_tunnel(priv, spec, f,
831 headers_c, headers_v);
832 if (err)
833 goto out;
834 }
835
836 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_CONTROL)) {
837 struct flow_dissector_key_basic key_basic = {};
838 struct flow_dissector_key_basic mask_basic = {
839 .n_proto = htons(0xFFFF),
840 };
841 struct flow_match_basic match_basic = {
842 .key = &key_basic, .mask = &mask_basic,
843 };
844 struct flow_match_control match;
845 u16 addr_type;
846
847 flow_rule_match_enc_control(rule, &match);
848 addr_type = match.key->addr_type;
849
850 if (flow_rule_has_enc_control_flags(match.mask->flags,
851 extack)) {
852 err = -EOPNOTSUPP;
853 goto out;
854 }
855
856 /* For tunnel addr_type used same key id`s as for non-tunnel */
857 if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) {
858 struct flow_match_ipv4_addrs match;
859
860 flow_rule_match_enc_ipv4_addrs(rule, &match);
861 MLX5_SET(fte_match_set_lyr_2_4, headers_c,
862 src_ipv4_src_ipv6.ipv4_layout.ipv4,
863 ntohl(match.mask->src));
864 MLX5_SET(fte_match_set_lyr_2_4, headers_v,
865 src_ipv4_src_ipv6.ipv4_layout.ipv4,
866 ntohl(match.key->src));
867
868 MLX5_SET(fte_match_set_lyr_2_4, headers_c,
869 dst_ipv4_dst_ipv6.ipv4_layout.ipv4,
870 ntohl(match.mask->dst));
871 MLX5_SET(fte_match_set_lyr_2_4, headers_v,
872 dst_ipv4_dst_ipv6.ipv4_layout.ipv4,
873 ntohl(match.key->dst));
874
875 key_basic.n_proto = htons(ETH_P_IP);
876 mlx5e_tc_set_ethertype(priv->mdev, &match_basic, true,
877 headers_c, headers_v);
878 } else if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS) {
879 struct flow_match_ipv6_addrs match;
880
881 flow_rule_match_enc_ipv6_addrs(rule, &match);
882 memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
883 src_ipv4_src_ipv6.ipv6_layout.ipv6),
884 &match.mask->src, MLX5_FLD_SZ_BYTES(ipv6_layout,
885 ipv6));
886 memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
887 src_ipv4_src_ipv6.ipv6_layout.ipv6),
888 &match.key->src, MLX5_FLD_SZ_BYTES(ipv6_layout,
889 ipv6));
890
891 memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_c,
892 dst_ipv4_dst_ipv6.ipv6_layout.ipv6),
893 &match.mask->dst, MLX5_FLD_SZ_BYTES(ipv6_layout,
894 ipv6));
895 memcpy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, headers_v,
896 dst_ipv4_dst_ipv6.ipv6_layout.ipv6),
897 &match.key->dst, MLX5_FLD_SZ_BYTES(ipv6_layout,
898 ipv6));
899
900 key_basic.n_proto = htons(ETH_P_IPV6);
901 mlx5e_tc_set_ethertype(priv->mdev, &match_basic, true,
902 headers_c, headers_v);
903 }
904 }
905
906 if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_IP)) {
907 struct flow_match_ip match;
908
909 flow_rule_match_enc_ip(rule, &match);
910 MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_ecn,
911 match.mask->tos & 0x3);
912 MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_ecn,
913 match.key->tos & 0x3);
914
915 MLX5_SET(fte_match_set_lyr_2_4, headers_c, ip_dscp,
916 match.mask->tos >> 2);
917 MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_dscp,
918 match.key->tos >> 2);
919
920 MLX5_SET(fte_match_set_lyr_2_4, headers_c, ttl_hoplimit,
921 match.mask->ttl);
922 MLX5_SET(fte_match_set_lyr_2_4, headers_v, ttl_hoplimit,
923 match.key->ttl);
924
925 if (match.mask->ttl &&
926 !MLX5_CAP_ESW_FLOWTABLE_FDB
927 (priv->mdev,
928 ft_field_support.outer_ipv4_ttl)) {
929 NL_SET_ERR_MSG_MOD(extack,
930 "Matching on TTL is not supported");
931 err = -EOPNOTSUPP;
932 goto out;
933 }
934 }
935
936 /* let software handle IP fragments */
937 MLX5_SET(fte_match_set_lyr_2_4, headers_c, frag, 1);
938 MLX5_SET(fte_match_set_lyr_2_4, headers_v, frag, 0);
939
940 return 0;
941
942 out:
943 return err;
944 }
945
mlx5e_tc_tun_parse_udp_ports(struct mlx5e_priv * priv,struct mlx5_flow_spec * spec,struct flow_cls_offload * f,void * headers_c,void * headers_v)946 int mlx5e_tc_tun_parse_udp_ports(struct mlx5e_priv *priv,
947 struct mlx5_flow_spec *spec,
948 struct flow_cls_offload *f,
949 void *headers_c,
950 void *headers_v)
951 {
952 struct flow_rule *rule = flow_cls_offload_flow_rule(f);
953 struct netlink_ext_ack *extack = f->common.extack;
954 struct flow_match_ports enc_ports;
955
956 /* Full udp dst port must be given */
957
958 if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ENC_PORTS)) {
959 NL_SET_ERR_MSG_MOD(extack,
960 "UDP tunnel decap filter must include enc_dst_port condition");
961 netdev_warn(priv->netdev,
962 "UDP tunnel decap filter must include enc_dst_port condition\n");
963 return -EOPNOTSUPP;
964 }
965
966 flow_rule_match_enc_ports(rule, &enc_ports);
967
968 if (memchr_inv(&enc_ports.mask->dst, 0xff,
969 sizeof(enc_ports.mask->dst))) {
970 NL_SET_ERR_MSG_MOD(extack,
971 "UDP tunnel decap filter must match enc_dst_port fully");
972 netdev_warn(priv->netdev,
973 "UDP tunnel decap filter must match enc_dst_port fully\n");
974 return -EOPNOTSUPP;
975 }
976
977 /* match on UDP protocol and dst port number */
978
979 MLX5_SET_TO_ONES(fte_match_set_lyr_2_4, headers_c, ip_protocol);
980 MLX5_SET(fte_match_set_lyr_2_4, headers_v, ip_protocol, IPPROTO_UDP);
981
982 MLX5_SET(fte_match_set_lyr_2_4, headers_c, udp_dport,
983 ntohs(enc_ports.mask->dst));
984 MLX5_SET(fte_match_set_lyr_2_4, headers_v, udp_dport,
985 ntohs(enc_ports.key->dst));
986
987 /* UDP src port on outer header is generated by HW,
988 * so it is probably a bad idea to request matching it.
989 * Nonetheless, it is allowed.
990 */
991
992 MLX5_SET(fte_match_set_lyr_2_4, headers_c, udp_sport,
993 ntohs(enc_ports.mask->src));
994 MLX5_SET(fte_match_set_lyr_2_4, headers_v, udp_sport,
995 ntohs(enc_ports.key->src));
996
997 return 0;
998 }
999