Commit 3c9561c0 authored by Edward Cree's avatar Edward Cree Committed by David S. Miller
Browse files

sfc: support TC decap rules matching on enc_ip_tos 



Allow efx_tc_encap_match entries to include an ip_tos and ip_tos_mask.
To avoid partially-overlapping Outer Rules (which can lead to undefined
 behaviour in the hardware), store extra "pseudo" entries in our
 encap_match hashtable, which are used to enforce that all Outer Rule
 entries within a given <src_ip,dst_ip,udp_dport> tuple (or IPv6
 equivalent) have the same ip_tos_mask.
The "direct" encap_match entry takes a reference on the "pseudo",
 allowing it to be destroyed when all "direct" entries using it are
 removed.
efx_tc_em_pseudo_type is an enum rather than just a bool because in
 future an additional pseudo-type will be added to support Conntrack
 offload.

Signed-off-by: default avatarEdward Cree <ecree.xilinx@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 56beb35d

drivers/net/ethernet/sfc/tc.c

+109 −36
Original line number Diff line number Diff line
@@ -202,6 +202,7 @@ static int efx_tc_flower_parse_match(struct efx_nic *efx, 
	      BIT(FLOW_DISSECTOR_KEY_ENC_KEYID) |

	      BIT(FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS) |

	      BIT(FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS) |

	      BIT(FLOW_DISSECTOR_KEY_ENC_IP) |

	      BIT(FLOW_DISSECTOR_KEY_ENC_PORTS) |

	      BIT(FLOW_DISSECTOR_KEY_ENC_CONTROL) |

	      BIT(FLOW_DISSECTOR_KEY_TCP) |
@@ -346,20 +347,47 @@ static int efx_tc_flower_parse_match(struct efx_nic *efx, 
	return 0;

}



static void efx_tc_flower_release_encap_match(struct efx_nic *efx,

					      struct efx_tc_encap_match *encap)

{

	int rc;



	if (!refcount_dec_and_test(&encap->ref))

		return; /* still in use */



	if (encap->type == EFX_TC_EM_DIRECT) {

		rc = efx_mae_unregister_encap_match(efx, encap);

		if (rc)

			/* Display message but carry on and remove entry from our

			 * SW tables, because there's not much we can do about it.

			 */

			netif_err(efx, drv, efx->net_dev,

				  "Failed to release encap match %#x, rc %d\n",

				  encap->fw_id, rc);

	}

	rhashtable_remove_fast(&efx->tc->encap_match_ht, &encap->linkage,

			       efx_tc_encap_match_ht_params);

	if (encap->pseudo)

		efx_tc_flower_release_encap_match(efx, encap->pseudo);

	kfree(encap);

}



static int efx_tc_flower_record_encap_match(struct efx_nic *efx,

					    struct efx_tc_match *match,

					    enum efx_encap_type type,

					    enum efx_tc_em_pseudo_type em_type,

					    u8 child_ip_tos_mask,

					    struct netlink_ext_ack *extack)

{

	struct efx_tc_encap_match *encap, *old;

	struct efx_tc_encap_match *encap, *old, *pseudo = NULL;

	bool ipv6 = false;

	int rc;



	/* We require that the socket-defining fields (IP addrs and UDP dest

	 * port) are present and exact-match.  Other fields are currently not

	 * allowed.  This meets what OVS will ask for, and means that we don't

	 * need to handle difficult checks for overlapping matches as could

	 * come up if we allowed masks or varying sets of match fields.

	 * port) are present and exact-match.  Other fields may only be used

	 * if the field-set (and any masks) are the same for all encap

	 * matches on the same <sip,dip,dport> tuple; this is enforced by

	 * pseudo encap matches.

	 */

	if (match->mask.enc_dst_ip | match->mask.enc_src_ip) {

		if (!IS_ALL_ONES(match->mask.enc_dst_ip)) {
@@ -402,21 +430,37 @@ static int efx_tc_flower_record_encap_match(struct efx_nic *efx, 
		return -EOPNOTSUPP;

	}

	if (match->mask.enc_ip_tos) {

		NL_SET_ERR_MSG_MOD(extack, "Egress encap match on IP ToS not supported");

		struct efx_tc_match pmatch = *match;



		if (em_type == EFX_TC_EM_PSEUDO_MASK) { /* can't happen */

			NL_SET_ERR_MSG_MOD(extack, "Bad recursion in egress encap match handler");

			return -EOPNOTSUPP;

		}

		pmatch.value.enc_ip_tos = 0;

		pmatch.mask.enc_ip_tos = 0;

		rc = efx_tc_flower_record_encap_match(efx, &pmatch, type,

						      EFX_TC_EM_PSEUDO_MASK,

						      match->mask.enc_ip_tos,

						      extack);

		if (rc)

			return rc;

		pseudo = pmatch.encap;

	}

	if (match->mask.enc_ip_ttl) {

		NL_SET_ERR_MSG_MOD(extack, "Egress encap match on IP TTL not supported");

		return -EOPNOTSUPP;

		rc = -EOPNOTSUPP;

		goto fail_pseudo;

	}



	rc = efx_mae_check_encap_match_caps(efx, ipv6, match->mask.enc_ip_tos, extack);

	if (rc)

		return rc;

		goto fail_pseudo;



	encap = kzalloc(sizeof(*encap), GFP_USER);

	if (!encap)

		return -ENOMEM;

	if (!encap) {

		rc = -ENOMEM;

		goto fail_pseudo;

	}

	encap->src_ip = match->value.enc_src_ip;

	encap->dst_ip = match->value.enc_dst_ip;

#ifdef CONFIG_IPV6
@@ -425,12 +469,56 @@ static int efx_tc_flower_record_encap_match(struct efx_nic *efx, 
#endif

	encap->udp_dport = match->value.enc_dport;

	encap->tun_type = type;

	encap->ip_tos = match->value.enc_ip_tos;

	encap->ip_tos_mask = match->mask.enc_ip_tos;

	encap->child_ip_tos_mask = child_ip_tos_mask;

	encap->type = em_type;

	encap->pseudo = pseudo;

	old = rhashtable_lookup_get_insert_fast(&efx->tc->encap_match_ht,

						&encap->linkage,

						efx_tc_encap_match_ht_params);

	if (old) {

		/* don't need our new entry */

		kfree(encap);

		if (pseudo) /* don't need our new pseudo either */

			efx_tc_flower_release_encap_match(efx, pseudo);

		/* check old and new em_types are compatible */

		switch (old->type) {

		case EFX_TC_EM_DIRECT:

			/* old EM is in hardware, so mustn't overlap with a

			 * pseudo, but may be shared with another direct EM

			 */

			if (em_type == EFX_TC_EM_DIRECT)

				break;

			NL_SET_ERR_MSG_MOD(extack, "Pseudo encap match conflicts with existing direct entry");

			return -EEXIST;

		case EFX_TC_EM_PSEUDO_MASK:

			/* old EM is protecting a ToS-qualified filter, so may

			 * only be shared with another pseudo for the same

			 * ToS mask.

			 */

			if (em_type != EFX_TC_EM_PSEUDO_MASK) {

				NL_SET_ERR_MSG_FMT_MOD(extack,

						       "%s encap match conflicts with existing pseudo(MASK) entry",

						       encap->type ? "Pseudo" : "Direct");

				return -EEXIST;

			}

			if (child_ip_tos_mask != old->child_ip_tos_mask) {

				NL_SET_ERR_MSG_FMT_MOD(extack,

						       "Pseudo encap match for TOS mask %#04x conflicts with existing pseudo(MASK) entry for TOS mask %#04x",

						       child_ip_tos_mask,

						       old->child_ip_tos_mask);

				return -EEXIST;

			}

			break;

		default: /* Unrecognised pseudo-type.  Just say no */

			NL_SET_ERR_MSG_FMT_MOD(extack,

					       "%s encap match conflicts with existing pseudo(%d) entry",

					       encap->type ? "Pseudo" : "Direct",

					       old->type);

			return -EEXIST;

		}

		/* check old and new tun_types are compatible */

		if (old->tun_type != type) {

			NL_SET_ERR_MSG_FMT_MOD(extack,

					       "Egress encap match with conflicting tun_type %u != %u",
@@ -442,11 +530,13 @@ static int efx_tc_flower_record_encap_match(struct efx_nic *efx, 
		/* existing entry found */

		encap = old;

	} else {

		if (em_type == EFX_TC_EM_DIRECT) {

			rc = efx_mae_register_encap_match(efx, encap);

			if (rc) {

				NL_SET_ERR_MSG_MOD(extack, "Failed to record egress encap match in HW");

				goto fail;

			}

		}

		refcount_set(&encap->ref, 1);

	}

	match->encap = encap;
@@ -455,30 +545,12 @@ static int efx_tc_flower_record_encap_match(struct efx_nic *efx, 
	rhashtable_remove_fast(&efx->tc->encap_match_ht, &encap->linkage,

			       efx_tc_encap_match_ht_params);

	kfree(encap);

fail_pseudo:

	if (pseudo)

		efx_tc_flower_release_encap_match(efx, pseudo);

	return rc;

}



static void efx_tc_flower_release_encap_match(struct efx_nic *efx,

					      struct efx_tc_encap_match *encap)

{

	int rc;



	if (!refcount_dec_and_test(&encap->ref))

		return; /* still in use */



	rc = efx_mae_unregister_encap_match(efx, encap);

	if (rc)

		/* Display message but carry on and remove entry from our

		 * SW tables, because there's not much we can do about it.

		 */

		netif_err(efx, drv, efx->net_dev,

			  "Failed to release encap match %#x, rc %d\n",

			  encap->fw_id, rc);

	rhashtable_remove_fast(&efx->tc->encap_match_ht, &encap->linkage,

			       efx_tc_encap_match_ht_params);

	kfree(encap);

}



static void efx_tc_delete_rule(struct efx_nic *efx, struct efx_tc_flow_rule *rule)

{

	efx_mae_delete_rule(efx, rule->fw_id);
@@ -632,6 +704,7 @@ static int efx_tc_flower_replace_foreign(struct efx_nic *efx, 
		}



		rc = efx_tc_flower_record_encap_match(efx, &match, type,

						      EFX_TC_EM_DIRECT, 0,

						      extack);

		if (rc)

			goto release;

drivers/net/ethernet/sfc/tc.h

+24 −0
Original line number Diff line number Diff line
@@ -74,6 +74,27 @@ static inline bool efx_tc_match_is_encap(const struct efx_tc_match_fields *mask) 
	       mask->enc_ip_ttl || mask->enc_sport || mask->enc_dport;

}



/**

 * enum efx_tc_em_pseudo_type - &struct efx_tc_encap_match pseudo type

 *

 * These are used to classify "pseudo" encap matches, which don't refer

 * to an entry in hardware but rather indicate that a section of the

 * match space is in use by another Outer Rule.

 *

 * @EFX_TC_EM_DIRECT: real HW entry in Outer Rule table; not a pseudo.

 *	Hardware index in &struct efx_tc_encap_match.fw_id is valid.

 * @EFX_TC_EM_PSEUDO_MASK: registered by an encap match which includes a

 *	match on an optional field (currently only ip_tos), to prevent an

 *	overlapping encap match _without_ optional fields.

 *	The pseudo encap match may be referenced again by an encap match

 *	with a different ip_tos value, but all ip_tos_mask must match the

 *	first (stored in our child_ip_tos_mask).

 */

enum efx_tc_em_pseudo_type {

	EFX_TC_EM_DIRECT,

	EFX_TC_EM_PSEUDO_MASK,

};



struct efx_tc_encap_match {

	__be32 src_ip, dst_ip;

	struct in6_addr src_ip6, dst_ip6;
@@ -81,8 +102,11 @@ struct efx_tc_encap_match { 
	u8 ip_tos, ip_tos_mask;

	struct rhash_head linkage;

	enum efx_encap_type tun_type;

	u8 child_ip_tos_mask;

	refcount_t ref;

	enum efx_tc_em_pseudo_type type;

	u32 fw_id; /* index of this entry in firmware encap match table */

	struct efx_tc_encap_match *pseudo; /* Referenced pseudo EM if needed */

};



struct efx_tc_match {