Skip to content

Commit 10652f3

Browse files
paravmellanoxSaeed Mahameed
paravmellanox
authored and
Saeed Mahameed
committed
net/mlx5: Refactor ingress acl configuration
Drop, untagged, spoof check and untagged spoof check flow groups are limited to legacy mode only. Therefore, following refactoring is done to (a) improve code readability (b) have better code split between legacy and offloads mode 1. Move legacy flow groups under legacy structure 2. Add validity check for group deletion 3. Restrict scope of esw_vport_disable_ingress_acl to legacy mode 4. Rename esw_vport_enable_ingress_acl() to esw_vport_create_ingress_acl_table() and limit its scope to table creation 5. Introduce legacy flow groups creation helper esw_legacy_create_ingress_acl_groups() and keep its scope to legacy mode 6. Reduce offloads ingress groups from 4 to just 1 metadata group per vport 7. Removed redundant IS_ERR_OR_NULL as entries are marked NULL on free. 8. Shortern error message to remove redundant 'E-switch' Signed-off-by: Parav Pandit <[email protected]> Signed-off-by: Saeed Mahameed <[email protected]>
1 parent a962d7a commit 10652f3

File tree

3 files changed

+200
-114
lines changed

3 files changed

+200
-114
lines changed

‎drivers/net/ethernet/mellanox/mlx5/core/eswitch.c

Lines changed: 132 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -1070,57 +1070,21 @@ void esw_vport_disable_egress_acl(struct mlx5_eswitch *esw,
10701070
vport->egress.acl = NULL;
10711071
}
10721072

1073-
int esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
1074-
struct mlx5_vport *vport)
1073+
static int
1074+
esw_vport_create_legacy_ingress_acl_groups(struct mlx5_eswitch *esw,
1075+
struct mlx5_vport *vport)
10751076
{
10761077
int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in);
10771078
struct mlx5_core_dev *dev = esw->dev;
1078-
struct mlx5_flow_namespace *root_ns;
1079-
struct mlx5_flow_table *acl;
10801079
struct mlx5_flow_group *g;
10811080
void *match_criteria;
10821081
u32 *flow_group_in;
1083-
/* The ingress acl table contains 4 groups
1084-
* (2 active rules at the same time -
1085-
* 1 allow rule from one of the first 3 groups.
1086-
* 1 drop rule from the last group):
1087-
* 1)Allow untagged traffic with smac=original mac.
1088-
* 2)Allow untagged traffic.
1089-
* 3)Allow traffic with smac=original mac.
1090-
* 4)Drop all other traffic.
1091-
*/
1092-
int table_size = 4;
1093-
int err = 0;
1094-
1095-
if (!MLX5_CAP_ESW_INGRESS_ACL(dev, ft_support))
1096-
return -EOPNOTSUPP;
1097-
1098-
if (!IS_ERR_OR_NULL(vport->ingress.acl))
1099-
return 0;
1100-
1101-
esw_debug(dev, "Create vport[%d] ingress ACL log_max_size(%d)\n",
1102-
vport->vport, MLX5_CAP_ESW_INGRESS_ACL(dev, log_max_ft_size));
1103-
1104-
root_ns = mlx5_get_flow_vport_acl_namespace(dev, MLX5_FLOW_NAMESPACE_ESW_INGRESS,
1105-
mlx5_eswitch_vport_num_to_index(esw, vport->vport));
1106-
if (!root_ns) {
1107-
esw_warn(dev, "Failed to get E-Switch ingress flow namespace for vport (%d)\n", vport->vport);
1108-
return -EOPNOTSUPP;
1109-
}
1082+
int err;
11101083

11111084
flow_group_in = kvzalloc(inlen, GFP_KERNEL);
11121085
if (!flow_group_in)
11131086
return -ENOMEM;
11141087

1115-
acl = mlx5_create_vport_flow_table(root_ns, 0, table_size, 0, vport->vport);
1116-
if (IS_ERR(acl)) {
1117-
err = PTR_ERR(acl);
1118-
esw_warn(dev, "Failed to create E-Switch vport[%d] ingress flow Table, err(%d)\n",
1119-
vport->vport, err);
1120-
goto out;
1121-
}
1122-
vport->ingress.acl = acl;
1123-
11241088
match_criteria = MLX5_ADDR_OF(create_flow_group_in, flow_group_in, match_criteria);
11251089

11261090
MLX5_SET(create_flow_group_in, flow_group_in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
@@ -1130,29 +1094,29 @@ int esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
11301094
MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, 0);
11311095
MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 0);
11321096

1133-
g = mlx5_create_flow_group(acl, flow_group_in);
1097+
g = mlx5_create_flow_group(vport->ingress.acl, flow_group_in);
11341098
if (IS_ERR(g)) {
11351099
err = PTR_ERR(g);
1136-
esw_warn(dev, "Failed to create E-Switch vport[%d] ingress untagged spoofchk flow group, err(%d)\n",
1100+
esw_warn(dev, "vport[%d] ingress create untagged spoofchk flow group, err(%d)\n",
11371101
vport->vport, err);
1138-
goto out;
1102+
goto spoof_err;
11391103
}
1140-
vport->ingress.allow_untagged_spoofchk_grp = g;
1104+
vport->ingress.legacy.allow_untagged_spoofchk_grp = g;
11411105

11421106
memset(flow_group_in, 0, inlen);
11431107
MLX5_SET(create_flow_group_in, flow_group_in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
11441108
MLX5_SET_TO_ONES(fte_match_param, match_criteria, outer_headers.cvlan_tag);
11451109
MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, 1);
11461110
MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 1);
11471111

1148-
g = mlx5_create_flow_group(acl, flow_group_in);
1112+
g = mlx5_create_flow_group(vport->ingress.acl, flow_group_in);
11491113
if (IS_ERR(g)) {
11501114
err = PTR_ERR(g);
1151-
esw_warn(dev, "Failed to create E-Switch vport[%d] ingress untagged flow group, err(%d)\n",
1115+
esw_warn(dev, "vport[%d] ingress create untagged flow group, err(%d)\n",
11521116
vport->vport, err);
1153-
goto out;
1117+
goto untagged_err;
11541118
}
1155-
vport->ingress.allow_untagged_only_grp = g;
1119+
vport->ingress.legacy.allow_untagged_only_grp = g;
11561120

11571121
memset(flow_group_in, 0, inlen);
11581122
MLX5_SET(create_flow_group_in, flow_group_in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
@@ -1161,80 +1125,134 @@ int esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
11611125
MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, 2);
11621126
MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 2);
11631127

1164-
g = mlx5_create_flow_group(acl, flow_group_in);
1128+
g = mlx5_create_flow_group(vport->ingress.acl, flow_group_in);
11651129
if (IS_ERR(g)) {
11661130
err = PTR_ERR(g);
1167-
esw_warn(dev, "Failed to create E-Switch vport[%d] ingress spoofchk flow group, err(%d)\n",
1131+
esw_warn(dev, "vport[%d] ingress create spoofchk flow group, err(%d)\n",
11681132
vport->vport, err);
1169-
goto out;
1133+
goto allow_spoof_err;
11701134
}
1171-
vport->ingress.allow_spoofchk_only_grp = g;
1135+
vport->ingress.legacy.allow_spoofchk_only_grp = g;
11721136

11731137
memset(flow_group_in, 0, inlen);
11741138
MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, 3);
11751139
MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, 3);
11761140

1177-
g = mlx5_create_flow_group(acl, flow_group_in);
1141+
g = mlx5_create_flow_group(vport->ingress.acl, flow_group_in);
11781142
if (IS_ERR(g)) {
11791143
err = PTR_ERR(g);
1180-
esw_warn(dev, "Failed to create E-Switch vport[%d] ingress drop flow group, err(%d)\n",
1144+
esw_warn(dev, "vport[%d] ingress create drop flow group, err(%d)\n",
11811145
vport->vport, err);
1182-
goto out;
1146+
goto drop_err;
11831147
}
1184-
vport->ingress.drop_grp = g;
1148+
vport->ingress.legacy.drop_grp = g;
1149+
kvfree(flow_group_in);
1150+
return 0;
11851151

1186-
out:
1187-
if (err) {
1188-
if (!IS_ERR_OR_NULL(vport->ingress.allow_spoofchk_only_grp))
1189-
mlx5_destroy_flow_group(
1190-
vport->ingress.allow_spoofchk_only_grp);
1191-
if (!IS_ERR_OR_NULL(vport->ingress.allow_untagged_only_grp))
1192-
mlx5_destroy_flow_group(
1193-
vport->ingress.allow_untagged_only_grp);
1194-
if (!IS_ERR_OR_NULL(vport->ingress.allow_untagged_spoofchk_grp))
1195-
mlx5_destroy_flow_group(
1196-
vport->ingress.allow_untagged_spoofchk_grp);
1197-
if (!IS_ERR_OR_NULL(vport->ingress.acl))
1198-
mlx5_destroy_flow_table(vport->ingress.acl);
1152+
drop_err:
1153+
if (!IS_ERR_OR_NULL(vport->ingress.legacy.allow_spoofchk_only_grp)) {
1154+
mlx5_destroy_flow_group(vport->ingress.legacy.allow_spoofchk_only_grp);
1155+
vport->ingress.legacy.allow_spoofchk_only_grp = NULL;
11991156
}
1200-
1157+
allow_spoof_err:
1158+
if (!IS_ERR_OR_NULL(vport->ingress.legacy.allow_untagged_only_grp)) {
1159+
mlx5_destroy_flow_group(vport->ingress.legacy.allow_untagged_only_grp);
1160+
vport->ingress.legacy.allow_untagged_only_grp = NULL;
1161+
}
1162+
untagged_err:
1163+
if (!IS_ERR_OR_NULL(vport->ingress.legacy.allow_untagged_spoofchk_grp)) {
1164+
mlx5_destroy_flow_group(vport->ingress.legacy.allow_untagged_spoofchk_grp);
1165+
vport->ingress.legacy.allow_untagged_spoofchk_grp = NULL;
1166+
}
1167+
spoof_err:
12011168
kvfree(flow_group_in);
12021169
return err;
12031170
}
12041171

1172+
int esw_vport_create_ingress_acl_table(struct mlx5_eswitch *esw,
1173+
struct mlx5_vport *vport, int table_size)
1174+
{
1175+
struct mlx5_core_dev *dev = esw->dev;
1176+
struct mlx5_flow_namespace *root_ns;
1177+
struct mlx5_flow_table *acl;
1178+
int vport_index;
1179+
int err;
1180+
1181+
if (!MLX5_CAP_ESW_INGRESS_ACL(dev, ft_support))
1182+
return -EOPNOTSUPP;
1183+
1184+
esw_debug(dev, "Create vport[%d] ingress ACL log_max_size(%d)\n",
1185+
vport->vport, MLX5_CAP_ESW_INGRESS_ACL(dev, log_max_ft_size));
1186+
1187+
vport_index = mlx5_eswitch_vport_num_to_index(esw, vport->vport);
1188+
root_ns = mlx5_get_flow_vport_acl_namespace(dev, MLX5_FLOW_NAMESPACE_ESW_INGRESS,
1189+
vport_index);
1190+
if (!root_ns) {
1191+
esw_warn(dev, "Failed to get E-Switch ingress flow namespace for vport (%d)\n",
1192+
vport->vport);
1193+
return -EOPNOTSUPP;
1194+
}
1195+
1196+
acl = mlx5_create_vport_flow_table(root_ns, 0, table_size, 0, vport->vport);
1197+
if (IS_ERR(acl)) {
1198+
err = PTR_ERR(acl);
1199+
esw_warn(dev, "vport[%d] ingress create flow Table, err(%d)\n",
1200+
vport->vport, err);
1201+
return err;
1202+
}
1203+
vport->ingress.acl = acl;
1204+
return 0;
1205+
}
1206+
1207+
void esw_vport_destroy_ingress_acl_table(struct mlx5_vport *vport)
1208+
{
1209+
if (!vport->ingress.acl)
1210+
return;
1211+
1212+
mlx5_destroy_flow_table(vport->ingress.acl);
1213+
vport->ingress.acl = NULL;
1214+
}
1215+
12051216
void esw_vport_cleanup_ingress_rules(struct mlx5_eswitch *esw,
12061217
struct mlx5_vport *vport)
12071218
{
1208-
if (!IS_ERR_OR_NULL(vport->ingress.legacy.drop_rule)) {
1219+
if (vport->ingress.legacy.drop_rule) {
12091220
mlx5_del_flow_rules(vport->ingress.legacy.drop_rule);
12101221
vport->ingress.legacy.drop_rule = NULL;
12111222
}
12121223

1213-
if (!IS_ERR_OR_NULL(vport->ingress.allow_rule)) {
1224+
if (vport->ingress.allow_rule) {
12141225
mlx5_del_flow_rules(vport->ingress.allow_rule);
12151226
vport->ingress.allow_rule = NULL;
12161227
}
12171228
}
12181229

1219-
void esw_vport_disable_ingress_acl(struct mlx5_eswitch *esw,
1220-
struct mlx5_vport *vport)
1230+
static void esw_vport_disable_legacy_ingress_acl(struct mlx5_eswitch *esw,
1231+
struct mlx5_vport *vport)
12211232
{
1222-
if (IS_ERR_OR_NULL(vport->ingress.acl))
1233+
if (!vport->ingress.acl)
12231234
return;
12241235

12251236
esw_debug(esw->dev, "Destroy vport[%d] E-Switch ingress ACL\n", vport->vport);
12261237

12271238
esw_vport_cleanup_ingress_rules(esw, vport);
1228-
mlx5_destroy_flow_group(vport->ingress.allow_spoofchk_only_grp);
1229-
mlx5_destroy_flow_group(vport->ingress.allow_untagged_only_grp);
1230-
mlx5_destroy_flow_group(vport->ingress.allow_untagged_spoofchk_grp);
1231-
mlx5_destroy_flow_group(vport->ingress.drop_grp);
1232-
mlx5_destroy_flow_table(vport->ingress.acl);
1233-
vport->ingress.acl = NULL;
1234-
vport->ingress.drop_grp = NULL;
1235-
vport->ingress.allow_spoofchk_only_grp = NULL;
1236-
vport->ingress.allow_untagged_only_grp = NULL;
1237-
vport->ingress.allow_untagged_spoofchk_grp = NULL;
1239+
if (vport->ingress.legacy.allow_spoofchk_only_grp) {
1240+
mlx5_destroy_flow_group(vport->ingress.legacy.allow_spoofchk_only_grp);
1241+
vport->ingress.legacy.allow_spoofchk_only_grp = NULL;
1242+
}
1243+
if (vport->ingress.legacy.allow_untagged_only_grp) {
1244+
mlx5_destroy_flow_group(vport->ingress.legacy.allow_untagged_only_grp);
1245+
vport->ingress.legacy.allow_untagged_only_grp = NULL;
1246+
}
1247+
if (vport->ingress.legacy.allow_untagged_spoofchk_grp) {
1248+
mlx5_destroy_flow_group(vport->ingress.legacy.allow_untagged_spoofchk_grp);
1249+
vport->ingress.legacy.allow_untagged_spoofchk_grp = NULL;
1250+
}
1251+
if (vport->ingress.legacy.drop_grp) {
1252+
mlx5_destroy_flow_group(vport->ingress.legacy.drop_grp);
1253+
vport->ingress.legacy.drop_grp = NULL;
1254+
}
1255+
esw_vport_destroy_ingress_acl_table(vport);
12381256
}
12391257

12401258
static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
@@ -1249,19 +1267,36 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
12491267
int err = 0;
12501268
u8 *smac_v;
12511269

1270+
/* The ingress acl table contains 4 groups
1271+
* (2 active rules at the same time -
1272+
* 1 allow rule from one of the first 3 groups.
1273+
* 1 drop rule from the last group):
1274+
* 1)Allow untagged traffic with smac=original mac.
1275+
* 2)Allow untagged traffic.
1276+
* 3)Allow traffic with smac=original mac.
1277+
* 4)Drop all other traffic.
1278+
*/
1279+
int table_size = 4;
1280+
12521281
esw_vport_cleanup_ingress_rules(esw, vport);
12531282

12541283
if (!vport->info.vlan && !vport->info.qos && !vport->info.spoofchk) {
1255-
esw_vport_disable_ingress_acl(esw, vport);
1284+
esw_vport_disable_legacy_ingress_acl(esw, vport);
12561285
return 0;
12571286
}
12581287

1259-
err = esw_vport_enable_ingress_acl(esw, vport);
1260-
if (err) {
1261-
mlx5_core_warn(esw->dev,
1262-
"failed to enable ingress acl (%d) on vport[%d]\n",
1263-
err, vport->vport);
1264-
return err;
1288+
if (!vport->ingress.acl) {
1289+
err = esw_vport_create_ingress_acl_table(esw, vport, table_size);
1290+
if (err) {
1291+
esw_warn(esw->dev,
1292+
"vport[%d] enable ingress acl err (%d)\n",
1293+
err, vport->vport);
1294+
return err;
1295+
}
1296+
1297+
err = esw_vport_create_legacy_ingress_acl_groups(esw, vport);
1298+
if (err)
1299+
goto out;
12651300
}
12661301

12671302
esw_debug(esw->dev,
@@ -1322,10 +1357,11 @@ static int esw_vport_ingress_config(struct mlx5_eswitch *esw,
13221357
vport->ingress.legacy.drop_rule = NULL;
13231358
goto out;
13241359
}
1360+
kvfree(spec);
1361+
return 0;
13251362

13261363
out:
1327-
if (err)
1328-
esw_vport_cleanup_ingress_rules(esw, vport);
1364+
esw_vport_disable_legacy_ingress_acl(esw, vport);
13291365
kvfree(spec);
13301366
return err;
13311367
}
@@ -1705,7 +1741,7 @@ static int esw_vport_create_legacy_acl_tables(struct mlx5_eswitch *esw,
17051741
return 0;
17061742

17071743
egress_err:
1708-
esw_vport_disable_ingress_acl(esw, vport);
1744+
esw_vport_disable_legacy_ingress_acl(esw, vport);
17091745
mlx5_fc_destroy(esw->dev, vport->egress.legacy.drop_counter);
17101746
vport->egress.legacy.drop_counter = NULL;
17111747

@@ -1735,7 +1771,7 @@ static void esw_vport_destroy_legacy_acl_tables(struct mlx5_eswitch *esw,
17351771
mlx5_fc_destroy(esw->dev, vport->egress.legacy.drop_counter);
17361772
vport->egress.legacy.drop_counter = NULL;
17371773

1738-
esw_vport_disable_ingress_acl(esw, vport);
1774+
esw_vport_disable_legacy_ingress_acl(esw, vport);
17391775
mlx5_fc_destroy(esw->dev, vport->ingress.legacy.drop_counter);
17401776
vport->ingress.legacy.drop_counter = NULL;
17411777
}

‎drivers/net/ethernet/mellanox/mlx5/core/eswitch.h

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -65,16 +65,17 @@
6565

6666
struct vport_ingress {
6767
struct mlx5_flow_table *acl;
68-
struct mlx5_flow_group *allow_untagged_spoofchk_grp;
69-
struct mlx5_flow_group *allow_spoofchk_only_grp;
70-
struct mlx5_flow_group *allow_untagged_only_grp;
71-
struct mlx5_flow_group *drop_grp;
72-
struct mlx5_flow_handle *allow_rule;
68+
struct mlx5_flow_handle *allow_rule;
7369
struct {
70+
struct mlx5_flow_group *allow_spoofchk_only_grp;
71+
struct mlx5_flow_group *allow_untagged_spoofchk_grp;
72+
struct mlx5_flow_group *allow_untagged_only_grp;
73+
struct mlx5_flow_group *drop_grp;
7474
struct mlx5_flow_handle *drop_rule;
7575
struct mlx5_fc *drop_counter;
7676
} legacy;
7777
struct {
78+
struct mlx5_flow_group *metadata_grp;
7879
struct mlx5_modify_hdr *modify_metadata;
7980
struct mlx5_flow_handle *modify_metadata_rule;
8081
} offloads;
@@ -257,16 +258,16 @@ void esw_offloads_cleanup_reps(struct mlx5_eswitch *esw);
257258
int esw_offloads_init_reps(struct mlx5_eswitch *esw);
258259
void esw_vport_cleanup_ingress_rules(struct mlx5_eswitch *esw,
259260
struct mlx5_vport *vport);
260-
int esw_vport_enable_ingress_acl(struct mlx5_eswitch *esw,
261-
struct mlx5_vport *vport);
261+
int esw_vport_create_ingress_acl_table(struct mlx5_eswitch *esw,
262+
struct mlx5_vport *vport,
263+
int table_size);
264+
void esw_vport_destroy_ingress_acl_table(struct mlx5_vport *vport);
262265
void esw_vport_cleanup_egress_rules(struct mlx5_eswitch *esw,
263266
struct mlx5_vport *vport);
264267
int esw_vport_enable_egress_acl(struct mlx5_eswitch *esw,
265268
struct mlx5_vport *vport);
266269
void esw_vport_disable_egress_acl(struct mlx5_eswitch *esw,
267270
struct mlx5_vport *vport);
268-
void esw_vport_disable_ingress_acl(struct mlx5_eswitch *esw,
269-
struct mlx5_vport *vport);
270271
int mlx5_esw_modify_vport_rate(struct mlx5_eswitch *esw, u16 vport_num,
271272
u32 rate_mbps);
272273

0 commit comments

Comments
 (0)