* [net-next 7/8] net/mlx5: Add eswitch ACL vlan trunk api
2019-11-12 17:13 [pull request][net-next 0/8] Mellanox, mlx5 updates 2019-11-12 Saeed Mahameed
` (5 preceding siblings ...)
2019-11-12 17:13 ` [net-next 6/8] net/mlx5: Add devlink reload Saeed Mahameed
@ 2019-11-12 17:13 ` Saeed Mahameed
2019-11-12 17:13 ` [net-next 8/8] net/mlx5: Add vf ACL access via tc flower Saeed Mahameed
7 siblings, 0 replies; 15+ messages in thread
From: Saeed Mahameed @ 2019-11-12 17:13 UTC (permalink / raw)
To: David S. Miller; +Cc: netdev, Ariel Levkovich, Jakub Kicinski, Saeed Mahameed
From: Ariel Levkovich <lariel@mellanox.com>
The patch is adding an api to add/remove vlan id
to/from the eswitch ACL tables, per vport.
With this api, the driver can add and remove vlan ids
to the vport's ACL table and control the vlan ids the
vport can receive and transmit.
By default, the eswitch configuration allows the vport
to receive and transmit all of the vlan ids.
Once the first vlan id is added to the ACL table using
this api for a specific direction (ingress/egress),
the rest of the vlan ids are blocked in that direction
and will have to be added to the table as well if required
by the vport.
Signed-off-by: Ariel Levkovich <lariel@mellanox.com>
Cc: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
---
.../net/ethernet/mellanox/mlx5/core/eswitch.c | 498 +++++++++++++-----
.../net/ethernet/mellanox/mlx5/core/eswitch.h | 29 +-
.../mellanox/mlx5/core/eswitch_offloads.c | 8 +-
3 files changed, 400 insertions(+), 135 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index f2e400a23a59..41d67ca6cce3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -58,6 +58,11 @@ struct vport_addr {
bool mc_promisc;
};
+struct mlx5_acl_vlan {
+ struct mlx5_flow_handle *acl_vlan_rule;
+ struct list_head list;
+};
+
static void esw_destroy_legacy_fdb_table(struct mlx5_eswitch *esw);
static void esw_cleanup_vepa_rules(struct mlx5_eswitch *esw);
@@ -950,6 +955,7 @@ int esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
struct mlx5_vport *vport)
{
int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in);
+ struct mlx5_flow_group *untagged_grp = NULL;
struct mlx5_flow_group *vlan_grp = NULL;
struct mlx5_flow_group *drop_grp = NULL;
struct mlx5_core_dev *dev = esw->dev;
@@ -957,11 +963,7 @@ int esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
struct mlx5_flow_table *acl;
void *match_criteria;
u32 *flow_group_in;
- /* The egress acl table contains 2 rules:
- * 1)Allow traffic with vlan_tag=vst_vlan_id
- * 2)Drop all other traffic.
- */
- int table_size = 2;
+ int table_size;
int err = 0;
if (!MLX5_CAP_ESW_EGRESS_ACL(dev, ft_support))
@@ -984,6 +986,13 @@ int esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
if (!flow_group_in)
return -ENOMEM;
+ /* The egress acl table contains 3 groups:
+ * 1)Allow tagged traffic with vlan_tag=vst_vlan_id/vgt+_vlan_id
+ * 2)Allow untagged traffic
+ * 3)Drop all other traffic
+ */
+ table_size = VLAN_N_VID + 2;
+
acl = mlx5_create_vport_flow_table(root_ns, 0, table_size, 0, vport->vport);
if (IS_ERR(acl)) {
err = PTR_ERR(acl);
@@ -994,11 +1003,25 @@ int esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
MLX5_SET(create_flow_group_in, flow_group_in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
match_criteria = MLX5_ADDR_OF(create_flow_group_in, flow_group_in, match_criteria);
+
+ /* Create flow group for allowed untagged flow rule */
MLX5_SET_TO_ONES(fte_match_param, match_criteria, outer_headers.cvlan_tag);
- MLX5_SET_TO_ONES(fte_match_param, match_criteria, outer_headers.first_vid);
MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, 0);
MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 0);
+ untagged_grp = mlx5_create_flow_group(acl, flow_group_in);
+ if (IS_ERR(untagged_grp)) {
+ err = PTR_ERR(untagged_grp);
+ esw_warn(dev, "Failed to create E-Switch vport[%d] egress untagged flow group, err(%d)\n",
+ vport->vport, err);
+ goto out;
+ }
+
+ /* Create flow group for allowed tagged flow rules */
+ MLX5_SET_TO_ONES(fte_match_param, match_criteria, outer_headers.first_vid);
+ MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, 1);
+ MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, VLAN_N_VID);
+
vlan_grp = mlx5_create_flow_group(acl, flow_group_in);
if (IS_ERR(vlan_grp)) {
err = PTR_ERR(vlan_grp);
@@ -1007,9 +1030,10 @@ int esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
goto out;
}
+ /* Create flow group for drop rule */
memset(flow_group_in, 0, inlen);
- MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, 1);
- MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 1);
+ MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, VLAN_N_VID + 1);
+ MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, VLAN_N_VID + 1);
drop_grp = mlx5_create_flow_group(acl, flow_group_in);
if (IS_ERR(drop_grp)) {
err = PTR_ERR(drop_grp);
@@ -1021,27 +1045,45 @@ int esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
vport->egress.acl = acl;
vport->egress.drop_grp = drop_grp;
vport->egress.allowed_vlans_grp = vlan_grp;
+ vport->egress.allow_untagged_grp = untagged_grp;
+
out:
+ if (err) {
+ if (!IS_ERR_OR_NULL(vlan_grp))
+ mlx5_destroy_flow_group(vlan_grp);
+ if (!IS_ERR_OR_NULL(untagged_grp))
+ mlx5_destroy_flow_group(untagged_grp);
+ if (!IS_ERR_OR_NULL(acl))
+ mlx5_destroy_flow_table(acl);
+ }
kvfree(flow_group_in);
- if (err && !IS_ERR_OR_NULL(vlan_grp))
- mlx5_destroy_flow_group(vlan_grp);
- if (err && !IS_ERR_OR_NULL(acl))
- mlx5_destroy_flow_table(acl);
return err;
}
void esw_vport_cleanup_egress_rules(struct mlx5_eswitch *esw,
struct mlx5_vport *vport)
{
- if (!IS_ERR_OR_NULL(vport->egress.allowed_vlan)) {
- mlx5_del_flow_rules(vport->egress.allowed_vlan);
- vport->egress.allowed_vlan = NULL;
+ struct mlx5_acl_vlan *trunk_vlan_rule, *tmp;
+
+ if (!IS_ERR_OR_NULL(vport->egress.allowed_vst_vlan)) {
+ mlx5_del_flow_rules(vport->egress.allowed_vst_vlan);
+ vport->egress.allowed_vst_vlan = NULL;
+ }
+
+ list_for_each_entry_safe(trunk_vlan_rule, tmp,
+ &vport->egress.legacy.allowed_vlans_rules, list) {
+ mlx5_del_flow_rules(trunk_vlan_rule->acl_vlan_rule);
+ list_del(&trunk_vlan_rule->list);
+ kfree(trunk_vlan_rule);
}
if (!IS_ERR_OR_NULL(vport->egress.legacy.drop_rule)) {
mlx5_del_flow_rules(vport->egress.legacy.drop_rule);
vport->egress.legacy.drop_rule = NULL;
}
+
+ if (!IS_ERR_OR_NULL(vport->egress.legacy.allow_untagged_rule))
+ mlx5_del_flow_rules(vport->egress.legacy.allow_untagged_rule);
}
void esw_vport_disable_egress_acl(struct mlx5_eswitch *esw,
@@ -1053,9 +1095,11 @@ void esw_vport_disable_egress_acl(struct mlx5_eswitch *esw,
esw_debug(esw->dev, "Destroy vport[%d] E-Switch egress ACL\n", vport->vport);
esw_vport_cleanup_egress_rules(esw, vport);
+ mlx5_destroy_flow_group(vport->egress.allow_untagged_grp);
mlx5_destroy_flow_group(vport->egress.allowed_vlans_grp);
mlx5_destroy_flow_group(vport->egress.drop_grp);
mlx5_destroy_flow_table(vport->egress.acl);
+ vport->egress.allow_untagged_grp = NULL;
vport->egress.allowed_vlans_grp = NULL;
vport->egress.drop_grp = NULL;
vport->egress.acl = NULL;
@@ -1065,12 +1109,18 @@ static int
esw_vport_create_legacy_ingress_acl_groups(struct mlx5_eswitch *esw,
struct mlx5_vport *vport)
{
+ bool need_vlan_filter = !!bitmap_weight(vport->ingress.legacy.acl_vlan_8021q_bitmap,
+ VLAN_N_VID);
int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in);
+ struct mlx5_flow_group *untagged_spoof_grp = NULL;
+ struct mlx5_flow_table *acl = vport->ingress.acl;
+ struct mlx5_flow_group *tagged_spoof_grp = NULL;
+ struct mlx5_flow_group *drop_grp = NULL;
struct mlx5_core_dev *dev = esw->dev;
- struct mlx5_flow_group *g;
void *match_criteria;
+ int allow_grp_sz = 0;
u32 *flow_group_in;
- int err;
+ int err = 0;
flow_group_in = kvzalloc(inlen, GFP_KERNEL);
if (!flow_group_in)
@@ -1079,83 +1129,68 @@ esw_vport_create_legacy_ingress_acl_groups(struct mlx5_eswitch *esw,
match_criteria = MLX5_ADDR_OF(create_flow_group_in, flow_group_in, match_criteria);
MLX5_SET(create_flow_group_in, flow_group_in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
- MLX5_SET_TO_ONES(fte_match_param, match_criteria, outer_headers.cvlan_tag);
- MLX5_SET_TO_ONES(fte_match_param, match_criteria, outer_headers.smac_47_16);
- MLX5_SET_TO_ONES(fte_match_param, match_criteria, outer_headers.smac_15_0);
+
+ if (vport->info.vlan || vport->info.qos || need_vlan_filter)
+ MLX5_SET_TO_ONES(fte_match_param, match_criteria, outer_headers.cvlan_tag);
+
+ if (vport->info.spoofchk) {
+ MLX5_SET_TO_ONES(fte_match_param, match_criteria, outer_headers.smac_47_16);
+ MLX5_SET_TO_ONES(fte_match_param, match_criteria, outer_headers.smac_15_0);
+ }
+
MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, 0);
MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 0);
- g = mlx5_create_flow_group(vport->ingress.acl, flow_group_in);
- if (IS_ERR(g)) {
- err = PTR_ERR(g);
+ untagged_spoof_grp = mlx5_create_flow_group(acl, flow_group_in);
+ if (IS_ERR(untagged_spoof_grp)) {
+ err = PTR_ERR(untagged_spoof_grp);
esw_warn(dev, "vport[%d] ingress create untagged spoofchk flow group, err(%d)\n",
vport->vport, err);
- goto spoof_err;
+ goto out;
}
- vport->ingress.legacy.allow_untagged_spoofchk_grp = g;
+ allow_grp_sz += 1;
- memset(flow_group_in, 0, inlen);
- MLX5_SET(create_flow_group_in, flow_group_in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
- MLX5_SET_TO_ONES(fte_match_param, match_criteria, outer_headers.cvlan_tag);
+ if (!need_vlan_filter)
+ goto drop_grp;
+
+ MLX5_SET_TO_ONES(fte_match_param, match_criteria, outer_headers.first_vid);
MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, 1);
- MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 1);
+ MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, VLAN_N_VID);
- g = mlx5_create_flow_group(vport->ingress.acl, flow_group_in);
- if (IS_ERR(g)) {
- err = PTR_ERR(g);
- esw_warn(dev, "vport[%d] ingress create untagged flow group, err(%d)\n",
+ tagged_spoof_grp = mlx5_create_flow_group(acl, flow_group_in);
+ if (IS_ERR(tagged_spoof_grp)) {
+ err = PTR_ERR(tagged_spoof_grp);
+ esw_warn(dev, "Failed to create E-Switch vport[%d] ingress tagged spoofchk flow group, err(%d)\n",
vport->vport, err);
- goto untagged_err;
+ goto out;
}
- vport->ingress.legacy.allow_untagged_only_grp = g;
+ allow_grp_sz += VLAN_N_VID;
+drop_grp:
memset(flow_group_in, 0, inlen);
- MLX5_SET(create_flow_group_in, flow_group_in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
- MLX5_SET_TO_ONES(fte_match_param, match_criteria, outer_headers.smac_47_16);
- MLX5_SET_TO_ONES(fte_match_param, match_criteria, outer_headers.smac_15_0);
- MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, 2);
- MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 2);
+ MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, allow_grp_sz);
+ MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, allow_grp_sz);
- g = mlx5_create_flow_group(vport->ingress.acl, flow_group_in);
- if (IS_ERR(g)) {
- err = PTR_ERR(g);
- esw_warn(dev, "vport[%d] ingress create spoofchk flow group, err(%d)\n",
+ drop_grp = mlx5_create_flow_group(vport->ingress.acl, flow_group_in);
+ if (IS_ERR(drop_grp)) {
+ err = PTR_ERR(drop_grp);
+ esw_warn(dev, "vport[%d] ingress create drop flow group, err(%d)\n",
vport->vport, err);
- goto allow_spoof_err;
+ goto out;
}
- vport->ingress.legacy.allow_spoofchk_only_grp = g;
- memset(flow_group_in, 0, inlen);
- MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, 3);
- MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 3);
+ vport->ingress.legacy.allow_untagged_spoofchk_grp = untagged_spoof_grp;
+ vport->ingress.legacy.allow_tagged_spoofchk_grp = tagged_spoof_grp;
+ vport->ingress.legacy.drop_grp = drop_grp;
- g = mlx5_create_flow_group(vport->ingress.acl, flow_group_in);
- if (IS_ERR(g)) {
- err = PTR_ERR(g);
- esw_warn(dev, "vport[%d] ingress create drop flow group, err(%d)\n",
- vport->vport, err);
- goto drop_err;
+out:
+ if (err) {
+ if (!IS_ERR_OR_NULL(tagged_spoof_grp))
+ mlx5_destroy_flow_group(tagged_spoof_grp);
+ if (!IS_ERR_OR_NULL(untagged_spoof_grp))
+ mlx5_destroy_flow_group(untagged_spoof_grp);
}
- vport->ingress.legacy.drop_grp = g;
- kvfree(flow_group_in);
- return 0;
-drop_err:
- if (!IS_ERR_OR_NULL(vport->ingress.legacy.allow_spoofchk_only_grp)) {
- mlx5_destroy_flow_group(vport->ingress.legacy.allow_spoofchk_only_grp);
- vport->ingress.legacy.allow_spoofchk_only_grp = NULL;
- }
-allow_spoof_err:
- if (!IS_ERR_OR_NULL(vport->ingress.legacy.allow_untagged_only_grp)) {
- mlx5_destroy_flow_group(vport->ingress.legacy.allow_untagged_only_grp);
- vport->ingress.legacy.allow_untagged_only_grp = NULL;
- }
-untagged_err:
- if (!IS_ERR_OR_NULL(vport->ingress.legacy.allow_untagged_spoofchk_grp)) {
- mlx5_destroy_flow_group(vport->ingress.legacy.allow_untagged_spoofchk_grp);
- vport->ingress.legacy.allow_untagged_spoofchk_grp = NULL;
- }
-spoof_err:
kvfree(flow_group_in);
return err;
}
@@ -1207,14 +1242,23 @@ void esw_vport_destroy_ingress_acl_table(struct mlx5_vport *vport)
void esw_vport_cleanup_ingress_rules(struct mlx5_eswitch *esw,
struct mlx5_vport *vport)
{
+ struct mlx5_acl_vlan *trunk_vlan_rule, *tmp;
+
if (vport->ingress.legacy.drop_rule) {
mlx5_del_flow_rules(vport->ingress.legacy.drop_rule);
vport->ingress.legacy.drop_rule = NULL;
}
- if (vport->ingress.allow_rule) {
- mlx5_del_flow_rules(vport->ingress.allow_rule);
- vport->ingress.allow_rule = NULL;
+ list_for_each_entry_safe(trunk_vlan_rule, tmp,
+ &vport->ingress.legacy.allowed_vlans_rules, list) {
+ mlx5_del_flow_rules(trunk_vlan_rule->acl_vlan_rule);
+ list_del(&trunk_vlan_rule->list);
+ kfree(trunk_vlan_rule);
+ }
+
+ if (vport->ingress.allow_untagged_rule) {
+ mlx5_del_flow_rules(vport->ingress.allow_untagged_rule);
+ vport->ingress.allow_untagged_rule = NULL;
}
}
@@ -1227,18 +1271,14 @@ static void esw_vport_disable_legacy_ingress_acl(struct mlx5_eswitch *esw,
esw_debug(esw->dev, "Destroy vport[%d] E-Switch ingress ACL\n", vport->vport);
esw_vport_cleanup_ingress_rules(esw, vport);
- if (vport->ingress.legacy.allow_spoofchk_only_grp) {
- mlx5_destroy_flow_group(vport->ingress.legacy.allow_spoofchk_only_grp);
- vport->ingress.legacy.allow_spoofchk_only_grp = NULL;
- }
- if (vport->ingress.legacy.allow_untagged_only_grp) {
- mlx5_destroy_flow_group(vport->ingress.legacy.allow_untagged_only_grp);
- vport->ingress.legacy.allow_untagged_only_grp = NULL;
- }
if (vport->ingress.legacy.allow_untagged_spoofchk_grp) {
mlx5_destroy_flow_group(vport->ingress.legacy.allow_untagged_spoofchk_grp);
vport->ingress.legacy.allow_untagged_spoofchk_grp = NULL;
}
+ if (vport->ingress.legacy.allow_tagged_spoofchk_grp) {
+ mlx5_destroy_flow_group(vport->ingress.legacy.allow_tagged_spoofchk_grp);
+ vport->ingress.legacy.allow_tagged_spoofchk_grp = NULL;
+ }
if (vport->ingress.legacy.drop_grp) {
mlx5_destroy_flow_group(vport->ingress.legacy.drop_grp);
vport->ingress.legacy.drop_grp = NULL;
@@ -1252,30 +1292,45 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
struct mlx5_fc *counter = vport->ingress.legacy.drop_counter;
struct mlx5_flow_destination drop_ctr_dst = {0};
struct mlx5_flow_destination *dst = NULL;
+ struct mlx5_acl_vlan *trunk_vlan_rule;
struct mlx5_flow_act flow_act = {0};
struct mlx5_flow_spec *spec = NULL;
+ bool need_vlan_filter;
+ bool need_acl_table;
int dest_num = 0;
+ u16 vlan_id = 0;
+ int table_size;
int err = 0;
u8 *smac_v;
- /* The ingress acl table contains 4 groups
- * (2 active rules at the same time -
- * 1 allow rule from one of the first 3 groups.
- * 1 drop rule from the last group):
- * 1)Allow untagged traffic with smac=original mac.
- * 2)Allow untagged traffic.
- * 3)Allow traffic with smac=original mac.
- * 4)Drop all other traffic.
- */
- int table_size = 4;
-
esw_vport_cleanup_ingress_rules(esw, vport);
- if (!vport->info.vlan && !vport->info.qos && !vport->info.spoofchk) {
+ need_vlan_filter = !!bitmap_weight(vport->ingress.legacy.acl_vlan_8021q_bitmap,
+ VLAN_N_VID);
+ need_acl_table = vport->info.vlan || vport->info.qos ||
+ vport->info.spoofchk || need_vlan_filter;
+
+ if (!need_acl_table) {
esw_vport_disable_legacy_ingress_acl(esw, vport);
return 0;
}
+ if ((vport->info.vlan || vport->info.qos) && need_vlan_filter) {
+ mlx5_core_warn(esw->dev,
+ "vport[%d] configure ingress rules failed, Cannot enable both VGT+ and VST\n",
+ vport->vport);
+ return -EPERM;
+ }
+
+ /* The ingress acl table contains 3 groups
+ * (2 active rules at the same time -
+ * 1 allow rule from one of the first 2 groups.
+ * 1 drop rule from the last group):
+ * 1)Allow untagged traffic with/without smac=original mac.
+ * 2)Allow tagged (VLAN trunk list) traffic with/without smac=original mac.
+ * 3)Drop all other traffic.
+ */
+ table_size = need_vlan_filter ? 8192 : 4;
if (!vport->ingress.acl) {
err = esw_vport_create_ingress_acl_table(esw, vport, table_size);
if (err) {
@@ -1300,7 +1355,10 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
goto out;
}
- if (vport->info.vlan || vport->info.qos)
+ spec->match_criteria_enable = MLX5_MATCH_OUTER_HEADERS;
+ flow_act.action = MLX5_FLOW_CONTEXT_ACTION_ALLOW;
+
+ if (vport->info.vlan || vport->info.qos || need_vlan_filter)
MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, outer_headers.cvlan_tag);
if (vport->info.spoofchk) {
@@ -1312,20 +1370,52 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
ether_addr_copy(smac_v, vport->info.mac);
}
- spec->match_criteria_enable = MLX5_MATCH_OUTER_HEADERS;
- flow_act.action = MLX5_FLOW_CONTEXT_ACTION_ALLOW;
- vport->ingress.allow_rule =
- mlx5_add_flow_rules(vport->ingress.acl, spec,
- &flow_act, NULL, 0);
- if (IS_ERR(vport->ingress.allow_rule)) {
- err = PTR_ERR(vport->ingress.allow_rule);
- esw_warn(esw->dev,
- "vport[%d] configure ingress allow rule, err(%d)\n",
- vport->vport, err);
- vport->ingress.allow_rule = NULL;
- goto out;
+ /* Allow untagged */
+ if (!need_vlan_filter ||
+ (need_vlan_filter && test_bit(0, vport->ingress.legacy.acl_vlan_8021q_bitmap))) {
+ vport->ingress.allow_untagged_rule =
+ mlx5_add_flow_rules(vport->ingress.acl, spec,
+ &flow_act, NULL, 0);
+ if (IS_ERR(vport->ingress.allow_untagged_rule)) {
+ err = PTR_ERR(vport->ingress.allow_untagged_rule);
+ esw_warn(esw->dev,
+ "vport[%d] configure ingress allow rule, err(%d)\n",
+ vport->vport, err);
+ vport->ingress.allow_untagged_rule = NULL;
+ goto out;
+ }
}
+ if (!need_vlan_filter)
+ goto drop_rule;
+
+ /* Allow tagged (VLAN trunk list) */
+ MLX5_SET_TO_ONES(fte_match_param, spec->match_value, outer_headers.cvlan_tag);
+ MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, outer_headers.first_vid);
+
+ for_each_set_bit(vlan_id, vport->ingress.legacy.acl_vlan_8021q_bitmap, VLAN_N_VID) {
+ trunk_vlan_rule = kzalloc(sizeof(*trunk_vlan_rule), GFP_KERNEL);
+ if (!trunk_vlan_rule) {
+ err = -ENOMEM;
+ goto out;
+ }
+
+ MLX5_SET(fte_match_param, spec->match_value, outer_headers.first_vid,
+ vlan_id);
+ trunk_vlan_rule->acl_vlan_rule =
+ mlx5_add_flow_rules(vport->ingress.acl, spec, &flow_act, NULL, 0);
+ if (IS_ERR(trunk_vlan_rule->acl_vlan_rule)) {
+ err = PTR_ERR(trunk_vlan_rule->acl_vlan_rule);
+ esw_warn(esw->dev,
+ "vport[%d] configure ingress allowed vlan rule failed, err(%d)\n",
+ vport->vport, err);
+ kfree(trunk_vlan_rule);
+ continue;
+ }
+ list_add(&trunk_vlan_rule->list, &vport->ingress.legacy.allowed_vlans_rules);
+ }
+
+drop_rule:
memset(spec, 0, sizeof(*spec));
flow_act.action = MLX5_FLOW_CONTEXT_ACTION_DROP;
@@ -1348,11 +1438,11 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
vport->ingress.legacy.drop_rule = NULL;
goto out;
}
- kvfree(spec);
- return 0;
out:
- esw_vport_disable_legacy_ingress_acl(esw, vport);
+ if (err)
+ esw_vport_disable_legacy_ingress_acl(esw, vport);
+
kvfree(spec);
return err;
}
@@ -1365,7 +1455,7 @@ int mlx5_esw_create_vport_egress_acl_vlan(struct mlx5_eswitch *esw,
struct mlx5_flow_spec *spec;
int err = 0;
- if (vport->egress.allowed_vlan)
+ if (vport->egress.allowed_vst_vlan)
return -EEXIST;
spec = kvzalloc(sizeof(*spec), GFP_KERNEL);
@@ -1379,15 +1469,15 @@ int mlx5_esw_create_vport_egress_acl_vlan(struct mlx5_eswitch *esw,
spec->match_criteria_enable = MLX5_MATCH_OUTER_HEADERS;
flow_act.action = flow_action;
- vport->egress.allowed_vlan =
+ vport->egress.allowed_vst_vlan =
mlx5_add_flow_rules(vport->egress.acl, spec,
&flow_act, NULL, 0);
- if (IS_ERR(vport->egress.allowed_vlan)) {
- err = PTR_ERR(vport->egress.allowed_vlan);
+ if (IS_ERR(vport->egress.allowed_vst_vlan)) {
+ err = PTR_ERR(vport->egress.allowed_vst_vlan);
esw_warn(esw->dev,
"vport[%d] configure egress vlan rule failed, err(%d)\n",
vport->vport, err);
- vport->egress.allowed_vlan = NULL;
+ vport->egress.allowed_vst_vlan = NULL;
}
kvfree(spec);
@@ -1400,14 +1490,21 @@ static int esw_vport_egress_config(struct mlx5_eswitch *esw,
struct mlx5_fc *counter = vport->egress.legacy.drop_counter;
struct mlx5_flow_destination drop_ctr_dst = {0};
struct mlx5_flow_destination *dst = NULL;
+ struct mlx5_acl_vlan *trunk_vlan_rule;
struct mlx5_flow_act flow_act = {0};
struct mlx5_flow_spec *spec;
+ bool need_vlan_filter;
+ bool need_acl_table;
int dest_num = 0;
+ u16 vlan_id = 0;
int err = 0;
esw_vport_cleanup_egress_rules(esw, vport);
- if (!vport->info.vlan && !vport->info.qos) {
+ need_vlan_filter = !!bitmap_weight(vport->egress.legacy.acl_vlan_8021q_bitmap,
+ VLAN_N_VID);
+ need_acl_table = vport->info.vlan || vport->info.qos || need_vlan_filter;
+ if (!need_acl_table) {
esw_vport_disable_egress_acl(esw, vport);
return 0;
}
@@ -1424,17 +1521,67 @@ static int esw_vport_egress_config(struct mlx5_eswitch *esw,
"vport[%d] configure egress rules, vlan(%d) qos(%d)\n",
vport->vport, vport->info.vlan, vport->info.qos);
- /* Allowed vlan rule */
- err = mlx5_esw_create_vport_egress_acl_vlan(esw, vport, vport->info.vlan,
- MLX5_FLOW_CONTEXT_ACTION_ALLOW);
- if (err)
- return err;
-
- /* Drop others rule (star rule) */
spec = kvzalloc(sizeof(*spec), GFP_KERNEL);
- if (!spec)
+ if (!spec) {
+ err = -ENOMEM;
goto out;
+ }
+
+ MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, outer_headers.cvlan_tag);
+ spec->match_criteria_enable = MLX5_MATCH_OUTER_HEADERS;
+ flow_act.action = MLX5_FLOW_CONTEXT_ACTION_ALLOW;
+
+ /* Allow untagged */
+ if (need_vlan_filter && test_bit(0, vport->egress.legacy.acl_vlan_8021q_bitmap)) {
+ vport->egress.legacy.allow_untagged_rule =
+ mlx5_add_flow_rules(vport->egress.acl, spec,
+ &flow_act, NULL, 0);
+ if (IS_ERR(vport->egress.legacy.allow_untagged_rule)) {
+ err = PTR_ERR(vport->egress.legacy.allow_untagged_rule);
+ esw_warn(esw->dev,
+ "vport[%d] configure egress allow rule, err(%d)\n",
+ vport->vport, err);
+ vport->egress.legacy.allow_untagged_rule = NULL;
+ }
+ }
+ /* VST rule */
+ if (vport->info.vlan || vport->info.qos) {
+ err = mlx5_esw_create_vport_egress_acl_vlan(esw, vport, vport->info.vlan,
+ MLX5_FLOW_CONTEXT_ACTION_ALLOW);
+ if (err)
+ goto out;
+ }
+
+ /* Allowed trunk vlans rules (VGT+) */
+ MLX5_SET_TO_ONES(fte_match_param, spec->match_value, outer_headers.cvlan_tag);
+ MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, outer_headers.first_vid);
+
+ for_each_set_bit(vlan_id, vport->egress.legacy.acl_vlan_8021q_bitmap, VLAN_N_VID) {
+ trunk_vlan_rule = kzalloc(sizeof(*trunk_vlan_rule), GFP_KERNEL);
+ if (!trunk_vlan_rule) {
+ err = -ENOMEM;
+ goto out;
+ }
+
+ MLX5_SET(fte_match_param, spec->match_value, outer_headers.first_vid,
+ vlan_id);
+ trunk_vlan_rule->acl_vlan_rule =
+ mlx5_add_flow_rules(vport->egress.acl, spec, &flow_act, NULL, 0);
+ if (IS_ERR(trunk_vlan_rule->acl_vlan_rule)) {
+ err = PTR_ERR(trunk_vlan_rule->acl_vlan_rule);
+ esw_warn(esw->dev,
+ "vport[%d] configure egress allowed vlan rule failed, err(%d)\n",
+ vport->vport, err);
+ kfree(trunk_vlan_rule);
+ continue;
+ }
+ list_add(&trunk_vlan_rule->list, &vport->egress.legacy.allowed_vlans_rules);
+ }
+
+ /* Drop others rule (star rule) */
+
+ memset(spec, 0, sizeof(*spec));
flow_act.action = MLX5_FLOW_CONTEXT_ACTION_DROP;
/* Attach egress drop flow counter */
@@ -1455,7 +1602,11 @@ static int esw_vport_egress_config(struct mlx5_eswitch *esw,
vport->vport, err);
vport->egress.legacy.drop_rule = NULL;
}
+
out:
+ if (err)
+ esw_vport_cleanup_egress_rules(esw, vport);
+
kvfree(spec);
return err;
}
@@ -1787,6 +1938,11 @@ static int esw_enable_vport(struct mlx5_eswitch *esw, struct mlx5_vport *vport,
esw_debug(esw->dev, "Enabling VPORT(%d)\n", vport_num);
+ bitmap_zero(vport->ingress.legacy.acl_vlan_8021q_bitmap, VLAN_N_VID);
+ bitmap_zero(vport->egress.legacy.acl_vlan_8021q_bitmap, VLAN_N_VID);
+ INIT_LIST_HEAD(&vport->egress.legacy.allowed_vlans_rules);
+ INIT_LIST_HEAD(&vport->ingress.legacy.allowed_vlans_rules);
+
/* Restore old vport configuration */
esw_apply_vport_conf(esw, vport);
@@ -2268,6 +2424,7 @@ int mlx5_eswitch_get_vport_config(struct mlx5_eswitch *esw,
ivi->trusted = evport->info.trusted;
ivi->min_tx_rate = evport->info.min_rate;
ivi->max_tx_rate = evport->info.max_rate;
+
mutex_unlock(&esw->state_lock);
return 0;
@@ -2286,6 +2443,15 @@ int __mlx5_eswitch_set_vport_vlan(struct mlx5_eswitch *esw,
if (vlan > 4095 || qos > 7)
return -EINVAL;
+ if (bitmap_weight(evport->ingress.legacy.acl_vlan_8021q_bitmap, VLAN_N_VID) ||
+ bitmap_weight(evport->egress.legacy.acl_vlan_8021q_bitmap, VLAN_N_VID)) {
+ err = -EPERM;
+ mlx5_core_warn(esw->dev,
+ "VST is not allowed when operating in VGT+ mode vport(%d)\n",
+ vport);
+ return -EPERM;
+ }
+
err = modify_esw_vport_cvlan(esw->dev, vport, vlan, qos, set_flags);
if (err)
return err;
@@ -2628,6 +2794,84 @@ static int mlx5_eswitch_query_vport_drop_stats(struct mlx5_core_dev *dev,
return 0;
}
+int mlx5_eswitch_add_vport_trunk_vlan(struct mlx5_eswitch *esw,
+ u16 vport, u16 vlanid,
+ enum mlx5_acl_flow_direction dir)
+{
+ struct mlx5_vport *evport;
+ unsigned long *vlan_bm;
+ int err = 0;
+
+ if (!ESW_ALLOWED(esw))
+ return -EPERM;
+
+ mutex_lock(&esw->state_lock);
+
+ evport = mlx5_eswitch_get_vport(esw, vport);
+ if (IS_ERR(evport) || vlanid >= VLAN_N_VID) {
+ err = -EINVAL;
+ goto unlock;
+ }
+
+ if (evport->info.vlan || evport->info.qos) {
+ err = -EPERM;
+ mlx5_core_warn(esw->dev,
+ "VGT+ is not allowed when operating in VST mode vport(%d)\n",
+ vport);
+ goto unlock;
+ }
+
+ vlan_bm = (dir == MLX5_ACL_EGRESS) ? evport->egress.legacy.acl_vlan_8021q_bitmap :
+ evport->ingress.legacy.acl_vlan_8021q_bitmap;
+ if (!test_bit(vlanid, vlan_bm)) {
+ bitmap_set(vlan_bm, vlanid, 1);
+ err = (dir == MLX5_ACL_EGRESS) ? esw_vport_egress_config(esw, evport) :
+ esw_vport_ingress_config(esw, evport);
+ }
+
+ if (err)
+ bitmap_clear(vlan_bm, vlanid, 1);
+
+unlock:
+ mutex_unlock(&esw->state_lock);
+
+ return err;
+}
+
+int mlx5_eswitch_del_vport_trunk_vlan(struct mlx5_eswitch *esw,
+ u16 vport, u16 vlanid,
+ enum mlx5_acl_flow_direction dir)
+{
+ struct mlx5_vport *evport;
+ unsigned long *vlan_bm;
+ int err = 0;
+
+ if (!ESW_ALLOWED(esw))
+ return -EPERM;
+
+ mutex_lock(&esw->state_lock);
+
+ evport = mlx5_eswitch_get_vport(esw, vport);
+
+ if (IS_ERR(evport) || vlanid >= VLAN_N_VID) {
+ err = -EINVAL;
+ goto unlock;
+ }
+
+ vlan_bm = (dir == MLX5_ACL_EGRESS) ? evport->egress.legacy.acl_vlan_8021q_bitmap :
+ evport->ingress.legacy.acl_vlan_8021q_bitmap;
+ if (test_bit(vlanid, vlan_bm)) {
+ bitmap_clear(vlan_bm, vlanid, 1);
+ err = (dir == MLX5_ACL_EGRESS) ? esw_vport_egress_config(esw, evport) :
+ esw_vport_ingress_config(esw, evport);
+ }
+
+unlock:
+ mutex_unlock(&esw->state_lock);
+
+ return err;
+}
+
int mlx5_eswitch_get_vport_stats(struct mlx5_eswitch *esw,
u16 vport_num,
struct ifla_vf_stats *vf_stats)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index 920d8f529fb9..5c84dbdb300f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -35,6 +35,8 @@
#include <linux/if_ether.h>
#include <linux/if_link.h>
+#include <linux/if_vlan.h>
+#include <linux/bitmap.h>
#include <linux/atomic.h>
#include <net/devlink.h>
#include <linux/mlx5/device.h>
@@ -51,6 +53,9 @@
#define MLX5_MAX_MC_PER_VPORT(dev) \
(1 << MLX5_CAP_GEN(dev, log_max_current_mc_list))
+#define MLX5_MAX_VLAN_PER_VPORT(dev) \
+ (1 << MLX5_CAP_GEN(dev, log_max_vlan_list))
+
#define MLX5_MIN_BW_SHARE 1
#define MLX5_RATE_TO_BW_SHARE(rate, divider, limit) \
@@ -65,14 +70,15 @@
struct vport_ingress {
struct mlx5_flow_table *acl;
- struct mlx5_flow_handle *allow_rule;
+ struct mlx5_flow_handle *allow_untagged_rule;
struct {
- struct mlx5_flow_group *allow_spoofchk_only_grp;
+ DECLARE_BITMAP(acl_vlan_8021q_bitmap, VLAN_N_VID);
struct mlx5_flow_group *allow_untagged_spoofchk_grp;
- struct mlx5_flow_group *allow_untagged_only_grp;
+ struct mlx5_flow_group *allow_tagged_spoofchk_grp;
struct mlx5_flow_group *drop_grp;
struct mlx5_flow_handle *drop_rule;
struct mlx5_fc *drop_counter;
+ struct list_head allowed_vlans_rules;
} legacy;
struct {
struct mlx5_flow_group *metadata_grp;
@@ -83,11 +89,15 @@ struct vport_ingress {
struct vport_egress {
struct mlx5_flow_table *acl;
+ struct mlx5_flow_group *allow_untagged_grp;
struct mlx5_flow_group *allowed_vlans_grp;
struct mlx5_flow_group *drop_grp;
- struct mlx5_flow_handle *allowed_vlan;
+ struct mlx5_flow_handle *allowed_vst_vlan;
struct {
+ DECLARE_BITMAP(acl_vlan_8021q_bitmap, VLAN_N_VID);
struct mlx5_flow_handle *drop_rule;
+ struct list_head allowed_vlans_rules;
+ struct mlx5_flow_handle *allow_untagged_rule;
struct mlx5_fc *drop_counter;
} legacy;
};
@@ -221,6 +231,11 @@ enum {
MLX5_ESWITCH_VPORT_MATCH_METADATA = BIT(0),
};
+enum mlx5_acl_flow_direction {
+ MLX5_ACL_EGRESS,
+ MLX5_ACL_INGRESS,
+};
+
struct mlx5_eswitch {
struct mlx5_core_dev *dev;
struct mlx5_nb nb;
@@ -292,6 +307,12 @@ int mlx5_eswitch_set_vepa(struct mlx5_eswitch *esw, u8 setting);
int mlx5_eswitch_get_vepa(struct mlx5_eswitch *esw, u8 *setting);
int mlx5_eswitch_get_vport_config(struct mlx5_eswitch *esw,
u16 vport, struct ifla_vf_info *ivi);
+int mlx5_eswitch_add_vport_trunk_vlan(struct mlx5_eswitch *esw,
+ u16 vport, u16 vlanid,
+ enum mlx5_acl_flow_direction dir);
+int mlx5_eswitch_del_vport_trunk_vlan(struct mlx5_eswitch *esw,
+ u16 vport, u16 vlanid,
+ enum mlx5_acl_flow_direction dir);
int mlx5_eswitch_get_vport_stats(struct mlx5_eswitch *esw,
u16 vport,
struct ifla_vf_stats *vf_stats);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 138a9d328b91..633cda35dd1f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -1782,15 +1782,15 @@ static int esw_vport_ingress_prio_tag_config(struct mlx5_eswitch *esw,
flow_act.modify_hdr = vport->ingress.offloads.modify_metadata;
}
- vport->ingress.allow_rule =
+ vport->ingress.allow_untagged_rule =
mlx5_add_flow_rules(vport->ingress.acl, spec,
&flow_act, NULL, 0);
- if (IS_ERR(vport->ingress.allow_rule)) {
- err = PTR_ERR(vport->ingress.allow_rule);
+ if (IS_ERR(vport->ingress.allow_untagged_rule)) {
+ err = PTR_ERR(vport->ingress.allow_untagged_rule);
esw_warn(esw->dev,
"vport[%d] configure ingress untagged allow rule, err(%d)\n",
vport->vport, err);
- vport->ingress.allow_rule = NULL;
+ vport->ingress.allow_untagged_rule = NULL;
goto out;
}
--
2.21.0
^ permalink raw reply related [flat|nested] 15+ messages in thread* [net-next 8/8] net/mlx5: Add vf ACL access via tc flower
2019-11-12 17:13 [pull request][net-next 0/8] Mellanox, mlx5 updates 2019-11-12 Saeed Mahameed
` (6 preceding siblings ...)
2019-11-12 17:13 ` [net-next 7/8] net/mlx5: Add eswitch ACL vlan trunk api Saeed Mahameed
@ 2019-11-12 17:13 ` Saeed Mahameed
2019-11-12 23:41 ` Jakub Kicinski
7 siblings, 1 reply; 15+ messages in thread
From: Saeed Mahameed @ 2019-11-12 17:13 UTC (permalink / raw)
To: David S. Miller; +Cc: netdev, Ariel Levkovich, Jakub Kicinski, Saeed Mahameed
From: Ariel Levkovich <lariel@mellanox.com>
Implementing vf ACL access via tc flower api to allow
admins configure the allowed vlan ids on a vf interface.
To add a vlan id to a vf's ingress/egress ACL table while
in legacy sriov mode, the implementation intercepts tc flows
created on the pf device where the flower matching keys include
the vf's mac address as the src_mac (eswitch ingress) or the
dst_mac (eswitch egress) while the action is accept.
In such cases, the mlx5 driver interpets these flows as adding
a vlan id to the vf's ingress/egress ACL table and updates
the rules in that table using eswitch ACL configuration api
that is introduced in a previous patch.
Signed-off-by: Ariel Levkovich <lariel@mellanox.com>
Cc: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
---
.../net/ethernet/mellanox/mlx5/core/en_tc.c | 139 +++++++++++++++++-
.../net/ethernet/mellanox/mlx5/core/eswitch.c | 19 +++
.../net/ethernet/mellanox/mlx5/core/eswitch.h | 1 +
3 files changed, 152 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index bb970b2ebf8a..66b51a3d67c9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -68,6 +68,12 @@ struct mlx5_nic_flow_attr {
struct mlx5_fc *counter;
};
+struct mlx5_vf_acl_flow_attr {
+ u16 acl_vlanid;
+ u16 vport;
+ enum mlx5_acl_flow_direction dir;
+};
+
#define MLX5E_TC_FLOW_BASE (MLX5E_TC_FLAG_LAST_EXPORTED_BIT + 1)
enum {
@@ -82,6 +88,7 @@ enum {
MLX5E_TC_FLOW_FLAG_DUP = MLX5E_TC_FLOW_BASE + 4,
MLX5E_TC_FLOW_FLAG_NOT_READY = MLX5E_TC_FLOW_BASE + 5,
MLX5E_TC_FLOW_FLAG_DELETED = MLX5E_TC_FLOW_BASE + 6,
+ MLX5E_TC_FLOW_FLAG_VF_ACL = MLX5E_TC_FLOW_BASE + 7,
};
#define MLX5E_TC_MAX_SPLITS 1
@@ -135,6 +142,7 @@ struct mlx5e_tc_flow {
union {
struct mlx5_esw_flow_attr esw_attr[0];
struct mlx5_nic_flow_attr nic_attr[0];
+ struct mlx5_vf_acl_flow_attr acl_attr[0];
};
};
@@ -991,6 +999,15 @@ mlx5e_tc_add_nic_flow(struct mlx5e_priv *priv,
return PTR_ERR_OR_ZERO(flow->rule[0]);
}
+static void mlx5e_tc_del_vf_acl_flow(struct mlx5e_priv *priv,
+ struct mlx5e_tc_flow *flow)
+{
+ mlx5_eswitch_del_vport_trunk_vlan(priv->mdev->priv.eswitch,
+ flow->acl_attr->vport,
+ flow->acl_attr->acl_vlanid,
+ flow->acl_attr->dir);
+}
+
static void mlx5e_tc_del_nic_flow(struct mlx5e_priv *priv,
struct mlx5e_tc_flow *flow)
{
@@ -1640,6 +1657,8 @@ static void mlx5e_tc_del_flow(struct mlx5e_priv *priv,
if (mlx5e_is_eswitch_flow(flow)) {
mlx5e_tc_del_fdb_peer_flow(flow);
mlx5e_tc_del_fdb_flow(priv, flow);
+ } else if (flow_flag_test(flow, VF_ACL)) {
+ mlx5e_tc_del_vf_acl_flow(priv, flow);
} else {
mlx5e_tc_del_nic_flow(priv, flow);
}
@@ -3718,6 +3737,110 @@ mlx5e_add_fdb_flow(struct mlx5e_priv *priv,
return err;
}
+static bool
+parse_vf_acl_flow(struct mlx5_eswitch *esw,
+ struct flow_cls_offload *f,
+ struct mlx5_vf_acl_flow_attr *attr)
+{
+ struct flow_rule *rule = flow_cls_offload_flow_rule(f);
+ struct flow_dissector *dissector = rule->match.dissector;
+ struct flow_action *flow_action = &rule->action;
+ struct flow_match_eth_addrs match_eth;
+ const struct flow_action_entry *act;
+ struct flow_match_vlan match_vlan;
+ int i;
+
+ if (!esw || esw->mode != MLX5_ESWITCH_LEGACY)
+ return false;
+
+ if (dissector->used_keys ^
+ (BIT(FLOW_DISSECTOR_KEY_CONTROL) |
+ BIT(FLOW_DISSECTOR_KEY_BASIC) |
+ BIT(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
+ BIT(FLOW_DISSECTOR_KEY_VLAN)))
+ return false;
+
+ /* Allowing only ACCEPT action for acl */
+ if (!flow_action_has_entries(flow_action))
+ return false;
+ flow_action_for_each(i, act, flow_action)
+ if (act->id != FLOW_ACTION_ACCEPT)
+ return false;
+
+ flow_rule_match_vlan(rule, &match_vlan);
+ if (!match_vlan.mask->vlan_id ||
+ match_vlan.mask->vlan_priority)
+ return false;
+
+ if (match_vlan.key->vlan_tpid != htons(ETH_P_8021Q))
+ return false;
+
+ attr->acl_vlanid = match_vlan.key->vlan_id;
+
+ flow_rule_match_eth_addrs(rule, &match_eth);
+ if (!is_zero_ether_addr(match_eth.mask->dst) &&
+ !is_zero_ether_addr(match_eth.mask->src))
+ return false;
+
+ if (!is_zero_ether_addr(match_eth.mask->src))
+ attr->dir = MLX5_ACL_INGRESS;
+ else if (!is_zero_ether_addr(match_eth.mask->dst))
+ attr->dir = MLX5_ACL_EGRESS;
+ else
+ return false;
+
+ return true;
+}
+
+static int
+mlx5e_add_vf_acl_flow(struct mlx5e_priv *priv,
+ struct flow_cls_offload *f,
+ unsigned long flow_flags,
+ struct mlx5_vf_acl_flow_attr *acl_attr,
+ struct mlx5e_tc_flow **__flow)
+{
+ struct flow_rule *rule = flow_cls_offload_flow_rule(f);
+ struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+ struct mlx5e_tc_flow_parse_attr *parse_attr;
+ struct flow_match_eth_addrs match;
+ struct mlx5e_tc_flow *flow;
+ int attr_size, vport, err;
+
+ flow_rule_match_eth_addrs(rule, &match);
+ vport = mlx5_get_vport_by_mac(esw, (acl_attr->dir == MLX5_ACL_INGRESS) ?
+ match.key->src :
+ match.key->dst);
+ if (vport <= 0)
+ return -ENOENT;
+
+ acl_attr->vport = vport;
+ flow_flags |= BIT(MLX5E_TC_FLOW_FLAG_VF_ACL);
+
+ attr_size = sizeof(struct mlx5_vf_acl_flow_attr);
+ err = mlx5e_alloc_flow(priv, attr_size, f, flow_flags,
+ &parse_attr, &flow);
+ if (err)
+ return err;
+
+ *flow->acl_attr = *acl_attr;
+ err = mlx5_eswitch_add_vport_trunk_vlan(esw, acl_attr->vport,
+ acl_attr->acl_vlanid, acl_attr->dir);
+ if (err)
+ goto err_free;
+
+ flow_flag_set(flow, OFFLOADED);
+ kvfree(parse_attr);
+ *__flow = flow;
+
+ return 0;
+
+err_free:
+ mlx5e_flow_put(priv, flow);
+ kvfree(parse_attr);
+
+ return err;
+}
+
static int
mlx5e_add_nic_flow(struct mlx5e_priv *priv,
struct flow_cls_offload *f,
@@ -3777,8 +3900,8 @@ mlx5e_tc_add_flow(struct mlx5e_priv *priv,
struct mlx5e_tc_flow **flow)
{
struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+ struct mlx5_vf_acl_flow_attr attr;
unsigned long flow_flags;
- int err;
get_flags(flags, &flow_flags);
@@ -3786,13 +3909,15 @@ mlx5e_tc_add_flow(struct mlx5e_priv *priv,
return -EOPNOTSUPP;
if (esw && esw->mode == MLX5_ESWITCH_OFFLOADS)
- err = mlx5e_add_fdb_flow(priv, f, flow_flags,
- filter_dev, flow);
- else
- err = mlx5e_add_nic_flow(priv, f, flow_flags,
- filter_dev, flow);
+ return mlx5e_add_fdb_flow(priv, f, flow_flags,
+ filter_dev, flow);
- return err;
+ if (parse_vf_acl_flow(esw, f, &attr))
+ return mlx5e_add_vf_acl_flow(priv, f, flow_flags,
+ &attr, flow);
+
+ return mlx5e_add_nic_flow(priv, f, flow_flags,
+ filter_dev, flow);
}
int mlx5e_configure_flower(struct net_device *dev, struct mlx5e_priv *priv,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index 41d67ca6cce3..11436f19b566 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -66,6 +66,25 @@ struct mlx5_acl_vlan {
static void esw_destroy_legacy_fdb_table(struct mlx5_eswitch *esw);
static void esw_cleanup_vepa_rules(struct mlx5_eswitch *esw);
+int mlx5_get_vport_by_mac(struct mlx5_eswitch *esw, u8 *mac)
+{
+ struct mlx5_vport *evport;
+ int vport = -ENOENT;
+ int i;
+
+ mutex_lock(&esw->state_lock);
+ mlx5_esw_for_all_vports(esw, i, evport) {
+ if (!ether_addr_equal(mac, evport->info.mac))
+ continue;
+
+ vport = i;
+ break;
+ }
+
+ mutex_unlock(&esw->state_lock);
+ return vport;
+}
+
struct mlx5_vport *__must_check
mlx5_eswitch_get_vport(struct mlx5_eswitch *esw, u16 vport_num)
{
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index 5c84dbdb300f..9cfe34d8877f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -630,6 +630,7 @@ bool mlx5_eswitch_is_vf_vport(const struct mlx5_eswitch *esw, u16 vport_num);
void mlx5_eswitch_update_num_of_vfs(struct mlx5_eswitch *esw, const int num_vfs);
int mlx5_esw_funcs_changed_handler(struct notifier_block *nb, unsigned long type, void *data);
+int mlx5_get_vport_by_mac(struct mlx5_eswitch *esw, u8 *mac);
int
mlx5_eswitch_enable_pf_vf_vports(struct mlx5_eswitch *esw,
--
2.21.0
^ permalink raw reply related [flat|nested] 15+ messages in thread