kernel/drivers/net/ethernet/sfc/tc.h, branch linux-6.18.y

sfc: support offloading ct(nat) action in RHS rules

2023-10-15T13:25:03Z

If an IP address and/or L4 port for NAPT is available from a CT match, the MAE will perform the edits; if no CT lookup has been performed for this packet, the CT lookup did not return a match, or the matched CT entry did not include NAPT, the action will have no effect. Reviewed-by: Pieter Jansen van Vuuren Signed-off-by: Edward Cree Signed-off-by: David S. Miller

sfc: support TC rules which require OR-AR-CT-AR flow

2023-10-06T10:05:45Z

When a foreign LHS rule (TC rule from a tunnel netdev which requests conntrack lookup) matches on inner headers or enc_key_id, these matches cannot be performed by the Outer Rule table, as the keys are only available after the tunnel type has been identified (by the OR lookup) and the rest of the headers parsed accordingly. Offload such rules with an Action Rule, using the LOOKUP_CONTROL section of the AR response to specify the conntrack and/or recirculation actions, combined with an Outer Rule which performs only the usual Encap Match duties. This processing flow, as it requires two AR lookups per packet, is less performant than OR-CT-AR, so only use it where necessary. Reviewed-by: Pieter Jansen van Vuuren Signed-off-by: Edward Cree Signed-off-by: David S. Miller

sfc: support TC left-hand-side rules on foreign netdevs

2023-10-06T10:05:44Z

Allow a tunnel netdevice (such as a vxlan) to offload conntrack lookups, in much the same way as efx netdevs. To ensure this rule does not overlap with other tunnel rules on the same sip,dip,dport tuple, register a pseudo encap match of a new type (EFX_TC_EM_PSEUDO_OR), which unlike PSEUDO_MASK may only be referenced once (because an actual Outer Rule in hardware exists, although its fw_id is not recorded in the encap match entry). Reviewed-by: Pieter Jansen van Vuuren Signed-off-by: Edward Cree Signed-off-by: David S. Miller

sfc: add decrement ttl by offloading set ipv4 ttl actions

2023-08-27T05:56:54Z

Offload pedit set ipv4 ttl field, where the ttl field has already been matched and the new value is one less, by translating it to a decrement. Co-developed-by: Edward Cree Signed-off-by: Edward Cree Signed-off-by: Pieter Jansen van Vuuren Signed-off-by: David S. Miller

sfc: introduce ethernet pedit set action infrastructure

2023-08-27T05:56:54Z

Introduce the initial ethernet pedit set action infrastructure in preparation for adding mac src and dst pedit action offloads. Co-developed-by: Edward Cree Signed-off-by: Edward Cree Signed-off-by: Pieter Jansen van Vuuren Signed-off-by: David S. Miller

sfc: offload left-hand side rules for conntrack

2023-08-09T10:14:38Z

Handle the (comparatively) simple case of a -trk rule on an efx netdev (i.e. not a tunnel decap rule) with ct and goto chain actions. Reviewed-by: Pieter Jansen van Vuuren Reviewed-by: Simon Horman Signed-off-by: Edward Cree Signed-off-by: David S. Miller

sfc: conntrack state matches in TC rules

2023-08-09T10:14:38Z

Parse ct_state trk/est, mark and zone out of flower keys, and plumb them through to the hardware, performing some minor translations. Nothing can actually hit them yet as we're not offloading any DO_CT actions. Reviewed-by: Pieter Jansen van Vuuren Reviewed-by: Simon Horman Signed-off-by: Edward Cree Signed-off-by: David S. Miller

sfc: handle non-zero chain_index on TC rules

2023-08-09T10:14:38Z

Map it to an 8-bit recirc_id for use by the hardware. Currently nothing in the driver is offloading 'goto chain' actions, so these rules cannot yet be hit. Reviewed-by: Pieter Jansen van Vuuren Reviewed-by: Simon Horman Signed-off-by: Edward Cree Signed-off-by: David S. Miller

sfc: offload conntrack flow entries (match only) from CT zones

2023-08-09T10:14:38Z

No handling yet for FLOW_ACTION_MANGLE (NAT or NAPT) actions. Reviewed-by: Pieter Jansen van Vuuren Reviewed-by: Simon Horman Signed-off-by: Edward Cree Signed-off-by: David S. Miller

sfc: functions to register for conntrack zone offload

2023-08-09T10:14:37Z

Bind a stub callback to the netfilter flow table. Reviewed-by: Pieter Jansen van Vuuren Reviewed-by: Simon Horman Signed-off-by: Edward Cree Signed-off-by: David S. Miller