openvswitch: enable NSH support

v16->17
 - Fixed disputed check code: keep them in nsh_push and nsh_pop
   but also add them in __ovs_nla_copy_actions

v15->v16
 - Add csum recalculation for nsh_push, nsh_pop and set_nsh
   pointed out by Pravin
 - Move nsh key into the union with ipv4 and ipv6 and add
   check for nsh key in match_validate pointed out by Pravin
 - Add nsh check in validate_set and __ovs_nla_copy_actions

v14->v15
 - Check size in nsh_hdr_from_nlattr
 - Fixed four small issues pointed out By Jiri and Eric

v13->v14
 - Rename skb_push_nsh to nsh_push per Dave's comment
 - Rename skb_pop_nsh to nsh_pop per Dave's comment

v12->v13
 - Fix NSH header length check in set_nsh

v11->v12
 - Fix missing changes old comments pointed out
 - Fix new comments for v11

v10->v11
 - Fix the left three disputable comments for v9
   but not fixed in v10.

v9->v10
 - Change struct ovs_key_nsh to
       struct ovs_nsh_key_base base;
       __be32 context[NSH_MD1_CONTEXT_SIZE];
 - Fix new comments for v9

v8->v9
 - Fix build error reported by daily intel build
   because nsh module isn't selected by openvswitch

v7->v8
 - Rework nested value and mask for OVS_KEY_ATTR_NSH
 - Change pop_nsh to adapt to nsh kernel module
 - Fix many issues per comments from Jiri Benc

v6->v7
 - Remove NSH GSO patches in v6 because Jiri Benc
   reworked it as another patch series and they have
   been merged.
 - Change it to adapt to nsh kernel module added by NSH
   GSO patch series

v5->v6
 - Fix the rest comments for v4.
 - Add NSH GSO support for VxLAN-gpe + NSH and
   Eth + NSH.

v4->v5
 - Fix many comments by Jiri Benc and Eric Garver
   for v4.

v3->v4
 - Add new NSH match field ttl
 - Update NSH header to the latest format
   which will be final format and won't change
   per its author's confirmation.
 - Fix comments for v3.

v2->v3
 - Change OVS_KEY_ATTR_NSH to nested key to handle
   length-fixed attributes and length-variable
   attriubte more flexibly.
 - Remove struct ovs_action_push_nsh completely
 - Add code to handle nested attribute for SET_MASKED
 - Change PUSH_NSH to use the nested OVS_KEY_ATTR_NSH
   to transfer NSH header data.
 - Fix comments and coding style issues by Jiri and Eric

v1->v2
 - Change encap_nsh and decap_nsh to push_nsh and pop_nsh
 - Dynamically allocate struct ovs_action_push_nsh for
   length-variable metadata.

OVS master and 2.8 branch has merged NSH userspace
patch series, this patch is to enable NSH support
in kernel data path in order that OVS can support
NSH in compat mode by porting this.

Signed-off-by: Yi Yang <yi.y.yang@intel.com>
Acked-by: Jiri Benc <jbenc@redhat.com>
Acked-by: Eric Garver <e@erig.me>
Acked-by: Pravin Shelar <pshelar@ovn.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

6 files changed, 521 insertions, 2 deletions

diff --git a/net/openvswitch/Kconfig b/net/openvswitch/Kconfig
index ce947292ae77..2650205cdaf9 100644
--- a/net/openvswitch/Kconfig
+++ b/net/openvswitch/Kconfig
@@ -14,6 +14,7 @@ config OPENVSWITCH
         select MPLS
         select NET_MPLS_GSO
         select DST_CACHE
+        select NET_NSH
         ---help---
           Open vSwitch is a multilayer Ethernet switch targeted at virtualized
           environments.  In addition to supporting a variety of features
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index a551232daf61..9a6a6d51e421 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -43,6 +43,7 @@
 #include "flow.h"
 #include "conntrack.h"
 #include "vport.h"
+#include "flow_netlink.h"
 
 struct deferred_action {
         struct sk_buff *skb;
@@ -380,6 +381,38 @@ static int push_eth(struct sk_buff *skb, struct sw_flow_key *key,
         return 0;
 }
 
+static int push_nsh(struct sk_buff *skb, struct sw_flow_key *key,
+                    const struct nshhdr *nh)
+{
+        int err;
+
+        err = nsh_push(skb, nh);
+        if (err)
+                return err;
+
+        /* safe right before invalidate_flow_key */
+        key->mac_proto = MAC_PROTO_NONE;
+        invalidate_flow_key(key);
+        return 0;
+}
+
+static int pop_nsh(struct sk_buff *skb, struct sw_flow_key *key)
+{
+        int err;
+
+        err = nsh_pop(skb);
+        if (err)
+                return err;
+
+        /* safe right before invalidate_flow_key */
+        if (skb->protocol == htons(ETH_P_TEB))
+                key->mac_proto = MAC_PROTO_ETHERNET;
+        else
+                key->mac_proto = MAC_PROTO_NONE;
+        invalidate_flow_key(key);
+        return 0;
+}
+
 static void update_ip_l4_checksum(struct sk_buff *skb, struct iphdr *nh,
                                   __be32 addr, __be32 new_addr)
 {
@@ -602,6 +635,69 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key,
         return 0;
 }
 
+static int set_nsh(struct sk_buff *skb, struct sw_flow_key *flow_key,
+                   const struct nlattr *a)
+{
+        struct nshhdr *nh;
+        size_t length;
+        int err;
+        u8 flags;
+        u8 ttl;
+        int i;
+
+        struct ovs_key_nsh key;
+        struct ovs_key_nsh mask;
+
+        err = nsh_key_from_nlattr(a, &key, &mask);
+        if (err)
+                return err;
+
+        /* Make sure the NSH base header is there */
+        if (!pskb_may_pull(skb, skb_network_offset(skb) + NSH_BASE_HDR_LEN))
+                return -ENOMEM;
+
+        nh = nsh_hdr(skb);
+        length = nsh_hdr_len(nh);
+
+        /* Make sure the whole NSH header is there */
+        err = skb_ensure_writable(skb, skb_network_offset(skb) +
+                                       length);
+        if (unlikely(err))
+                return err;
+
+        nh = nsh_hdr(skb);
+        skb_postpull_rcsum(skb, nh, length);
+        flags = nsh_get_flags(nh);
+        flags = OVS_MASKED(flags, key.base.flags, mask.base.flags);
+        flow_key->nsh.base.flags = flags;
+        ttl = nsh_get_ttl(nh);
+        ttl = OVS_MASKED(ttl, key.base.ttl, mask.base.ttl);
+        flow_key->nsh.base.ttl = ttl;
+        nsh_set_flags_and_ttl(nh, flags, ttl);
+        nh->path_hdr = OVS_MASKED(nh->path_hdr, key.base.path_hdr,
+                                  mask.base.path_hdr);
+        flow_key->nsh.base.path_hdr = nh->path_hdr;
+        switch (nh->mdtype) {
+        case NSH_M_TYPE1:
+                for (i = 0; i < NSH_MD1_CONTEXT_SIZE; i++) {
+                        nh->md1.context[i] =
+                            OVS_MASKED(nh->md1.context[i], key.context[i],
+                                       mask.context[i]);
+                }
+                memcpy(flow_key->nsh.context, nh->md1.context,
+                       sizeof(nh->md1.context));
+                break;
+        case NSH_M_TYPE2:
+                memset(flow_key->nsh.context, 0,
+                       sizeof(flow_key->nsh.context));
+                break;
+        default:
+                return -EINVAL;
+        }
+        skb_postpush_rcsum(skb, nh, length);
+        return 0;
+}
+
 /* Must follow skb_ensure_writable() since that can move the skb data. */
 static void set_tp_port(struct sk_buff *skb, __be16 *port,
                         __be16 new_port, __sum16 *check)
@@ -1024,6 +1120,10 @@ static int execute_masked_set_action(struct sk_buff *skb,
                                    get_mask(a, struct ovs_key_ethernet *));
                 break;
 
+        case OVS_KEY_ATTR_NSH:
+                err = set_nsh(skb, flow_key, a);
+                break;
+
         case OVS_KEY_ATTR_IPV4:
                 err = set_ipv4(skb, flow_key, nla_data(a),
                                get_mask(a, struct ovs_key_ipv4 *));
@@ -1214,6 +1314,22 @@ static int do_execute_actions(struct datapath *dp, struct sk_buff *skb,
                 case OVS_ACTION_ATTR_POP_ETH:
                         err = pop_eth(skb, key);
                         break;
+
+                case OVS_ACTION_ATTR_PUSH_NSH: {
+                        u8 buffer[NSH_HDR_MAX_LEN];
+                        struct nshhdr *nh = (struct nshhdr *)buffer;
+
+                        err = nsh_hdr_from_nlattr(nla_data(a), nh,
+                                                  NSH_HDR_MAX_LEN);
+                        if (unlikely(err))
+                                break;
+                        err = push_nsh(skb, key, nh);
+                        break;
+                }
+
+                case OVS_ACTION_ATTR_POP_NSH:
+                        err = pop_nsh(skb, key);
+                        break;
                 }
 
                 if (unlikely(err)) {
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 8c94cef25a72..864ddb1e3642 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -46,6 +46,7 @@
 #include <net/ipv6.h>
 #include <net/mpls.h>
 #include <net/ndisc.h>
+#include <net/nsh.h>
 
 #include "conntrack.h"
 #include "datapath.h"
@@ -490,6 +491,52 @@ invalid:
         return 0;