mlxsw: spectrum_matchall: Forbid to insert matchall rules in collision with flower...

On ingress, the matchall rules doing mirroring and sampling are offloaded
into hardware blocks that are processed before any flower rules.
On egress, the matchall mirroring rules are offloaded into hardware
block that is processed after all flower rules.

Therefore check the priorities of inserted matchall rules against
existing flower rules and ensure the correct ordering.

Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index 456dbaa5ee2607d9b73ed2a1fe1798d6b74b278a..147a5634244ba596e502d242afe2a8380dbaae83 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -894,7 +894,8 @@ extern const struct mlxsw_afk_ops mlxsw_sp1_afk_ops;
 extern const struct mlxsw_afk_ops mlxsw_sp2_afk_ops;
 
 /* spectrum_matchall.c */
-int mlxsw_sp_mall_replace(struct mlxsw_sp_flow_block *block,
+int mlxsw_sp_mall_replace(struct mlxsw_sp *mlxsw_sp,
+                         struct mlxsw_sp_flow_block *block,
                          struct tc_cls_matchall_offload *f);
 void mlxsw_sp_mall_destroy(struct mlxsw_sp_flow_block *block,
                           struct tc_cls_matchall_offload *f);

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flow.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flow.c
index 76644f6a81211f460cdb8902fd5a8c6dc012a669..47b66f347ff1dbebcc7a4e1fb6de88171193ae6c 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flow.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flow.c
@@ -135,9 +135,11 @@ static int mlxsw_sp_flow_block_unbind(struct mlxsw_sp *mlxsw_sp,
 static int mlxsw_sp_flow_block_mall_cb(struct mlxsw_sp_flow_block *flow_block,
                                       struct tc_cls_matchall_offload *f)
 {
+       struct mlxsw_sp *mlxsw_sp = mlxsw_sp_flow_block_mlxsw_sp(flow_block);
+
        switch (f->command) {
        case TC_CLSMATCHALL_REPLACE:
-               return mlxsw_sp_mall_replace(flow_block, f);
+               return mlxsw_sp_mall_replace(mlxsw_sp, flow_block, f);
        case TC_CLSMATCHALL_DESTROY:
                mlxsw_sp_mall_destroy(flow_block, f);
                return 0;

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_matchall.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_matchall.c
index b11bab76b2e118d8126cc6eea398e5149534adc8..f1a44a8eda557bf3367b6affd3b864a8a9116caa 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_matchall.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_matchall.c
@@ -192,13 +192,17 @@ static void mlxsw_sp_mall_prio_update(struct mlxsw_sp_flow_block *block)
        }
 }
 
-int mlxsw_sp_mall_replace(struct mlxsw_sp_flow_block *block,
+int mlxsw_sp_mall_replace(struct mlxsw_sp *mlxsw_sp,
+                         struct mlxsw_sp_flow_block *block,
                          struct tc_cls_matchall_offload *f)
 {
        struct mlxsw_sp_flow_block_binding *binding;
        struct mlxsw_sp_mall_entry *mall_entry;
        __be16 protocol = f->common.protocol;
        struct flow_action_entry *act;
+       unsigned int flower_min_prio;
+       unsigned int flower_max_prio;
+       bool flower_prio_valid;
        int err;
 
        if (!flow_offload_has_one_action(&f->rule->action)) {
@@ -216,6 +220,19 @@ int mlxsw_sp_mall_replace(struct mlxsw_sp_flow_block *block,
                return -EOPNOTSUPP;
        }
 
+       err = mlxsw_sp_flower_prio_get(mlxsw_sp, block, f->common.chain_index,
+                                      &flower_min_prio, &flower_max_prio);
+       if (err) {
+               if (err != -ENOENT) {
+                       NL_SET_ERR_MSG(f->common.extack, "Failed to get flower priorities");
+                       return err;
+               }
+               flower_prio_valid = false;
+               /* No flower filters are installed in specified chain. */
+       } else {
+               flower_prio_valid = true;
+       }
+
        mall_entry = kzalloc(sizeof(*mall_entry), GFP_KERNEL);
        if (!mall_entry)
                return -ENOMEM;
@@ -226,6 +243,18 @@ int mlxsw_sp_mall_replace(struct mlxsw_sp_flow_block *block,
        act = &f->rule->action.entries[0];
 
        if (act->id == FLOW_ACTION_MIRRED && protocol == htons(ETH_P_ALL)) {
+               if (flower_prio_valid && mall_entry->ingress &&
+                   mall_entry->priority >= flower_min_prio) {
+                       NL_SET_ERR_MSG(f->common.extack, "Failed to add behind existing flower rules");
+                       err = -EOPNOTSUPP;
+                       goto errout;
+               }
+               if (flower_prio_valid && !mall_entry->ingress &&
+                   mall_entry->priority <= flower_max_prio) {
+                       NL_SET_ERR_MSG(f->common.extack, "Failed to add in front of existing flower rules");
+                       err = -EOPNOTSUPP;
+                       goto errout;
+               }
                mall_entry->type = MLXSW_SP_MALL_ACTION_TYPE_MIRROR;
                mall_entry->mirror.to_dev = act->dev;
        } else if (act->id == FLOW_ACTION_SAMPLE &&
@@ -235,6 +264,12 @@ int mlxsw_sp_mall_replace(struct mlxsw_sp_flow_block *block,
                        err = -EOPNOTSUPP;
                        goto errout;
                }
+               if (flower_prio_valid &&
+                   mall_entry->priority >= flower_min_prio) {
+                       NL_SET_ERR_MSG(f->common.extack, "Failed to add behind existing flower rules");
+                       err = -EOPNOTSUPP;
+                       goto errout;
+               }
                if (act->sample.rate > MLXSW_REG_MPSC_RATE_MAX) {
                        NL_SET_ERR_MSG(f->common.extack, "Sample rate not supported");
                        err = -EOPNOTSUPP;