net: openvswitch: Support masked set actions.

OVS userspace already probes the openvswitch kernel module for
OVS_ACTION_ATTR_SET_MASKED support.  This patch adds the kernel module
implementation of masked set actions.

The existing set action sets many fields at once.  When only a subset
of the IP header fields, for example, should be modified, all the IP
fields need to be exact matched so that the other field values can be
copied to the set action.  A masked set action allows modification of
an arbitrary subset of the supported header bits without requiring the
rest to be matched.

Masked set action is now supported for all writeable key types, except
for the tunnel key.  The set tunnel action is an exception as any
input tunnel info is cleared before action processing starts, so there
is no tunnel info to mask.

The kernel module converts all (non-tunnel) set actions to masked set
actions.  This makes action processing more uniform, and results in
less branching and duplicating the action processing code.  When
returning actions to userspace, the fully masked set actions are
converted back to normal set actions.  We use a kernel internal action
code to be able to tell the userspace provided and converted masked
set actions apart.

Signed-off-by: Jarno Rajahalme <jrajahalme@nicira.com>
Acked-by: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 383 insertions, 173 deletions

diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index 7a8785a99243..bbd49a0c46c7 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -599,6 +599,12 @@ struct ovs_action_hash {
  * @OVS_ACTION_ATTR_SET: Replaces the contents of an existing header.  The
  * single nested %OVS_KEY_ATTR_* attribute specifies a header to modify and its
  * value.
+ * @OVS_ACTION_ATTR_SET_MASKED: Replaces the contents of an existing header.  A
+ * nested %OVS_KEY_ATTR_* attribute specifies a header to modify, its value,
+ * and a mask.  For every bit set in the mask, the corresponding bit value
+ * is copied from the value to the packet header field, rest of the bits are
+ * left unchanged.  The non-masked value bits must be passed in as zeroes.
+ * Masking is not supported for the %OVS_KEY_ATTR_TUNNEL attribute.
  * @OVS_ACTION_ATTR_PUSH_VLAN: Push a new outermost 802.1Q header onto the
  * packet.
  * @OVS_ACTION_ATTR_POP_VLAN: Pop the outermost 802.1Q header off the packet.
@@ -617,6 +623,9 @@ struct ovs_action_hash {
  * Only a single header can be set with a single %OVS_ACTION_ATTR_SET.  Not all
  * fields within a header are modifiable, e.g. the IPv4 protocol and fragment
  * type may not be changed.
+ *
+ * @OVS_ACTION_ATTR_SET_TO_MASKED: Kernel internal masked set action translated
+ * from the @OVS_ACTION_ATTR_SET.
  */
 
 enum ovs_action_attr {
@@ -631,8 +640,19 @@ enum ovs_action_attr {
         OVS_ACTION_ATTR_HASH,         /* struct ovs_action_hash. */
         OVS_ACTION_ATTR_PUSH_MPLS,    /* struct ovs_action_push_mpls. */
         OVS_ACTION_ATTR_POP_MPLS,     /* __be16 ethertype. */
+        OVS_ACTION_ATTR_SET_MASKED,   /* One nested OVS_KEY_ATTR_* including
+                                       * data immediately followed by a mask.
+                                       * The data must be zero for the unmasked
+                                       * bits. */
+
+        __OVS_ACTION_ATTR_MAX,        /* Nothing past this will be accepted
+                                       * from userspace. */
 
-        __OVS_ACTION_ATTR_MAX
+#ifdef __KERNEL__
+        OVS_ACTION_ATTR_SET_TO_MASKED, /* Kernel module internal masked
+                                        * set action converted from
+                                        * OVS_ACTION_ATTR_SET. */
+#endif
 };
 
 #define OVS_ACTION_ATTR_MAX (__OVS_ACTION_ATTR_MAX - 1)
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index b4cffe686126..b491c1c296fe 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -185,10 +185,15 @@ static int pop_mpls(struct sk_buff *skb, struct sw_flow_key *key,
         return 0;
 }
 
-static int set_mpls(struct sk_buff *skb, struct sw_flow_key *key,
-                    const __be32 *mpls_lse)
+/* 'KEY' must not have any bits set outside of the 'MASK' */
+#define MASKED(OLD, KEY, MASK) ((KEY) | ((OLD) & ~(MASK)))
+#define SET_MASKED(OLD, KEY, MASK) ((OLD) = MASKED(OLD, KEY, MASK))
+
+static int set_mpls(struct sk_buff *skb, struct sw_flow_key *flow_key,
+                    const __be32 *mpls_lse, const __be32 *mask)
 {
         __be32 *stack;
+        __be32 lse;
         int err;
 
         err = skb_ensure_writable(skb, skb->mac_len + MPLS_HLEN);
@@ -196,14 +201,16 @@ static int set_mpls(struct sk_buff *skb, struct sw_flow_key *key,
                 return err;
 
         stack = (__be32 *)skb_mpls_header(skb);
+        lse = MASKED(*stack, *mpls_lse, *mask);
         if (skb->ip_summed == CHECKSUM_COMPLETE) {
-                __be32 diff[] = { ~(*stack), *mpls_lse };
+                __be32 diff[] = { ~(*stack), lse };
+
                 skb->csum = ~csum_partial((char *)diff, sizeof(diff),
                                           ~skb->csum);
         }
 
-        *stack = *mpls_lse;
-        key->mpls.top_lse = *mpls_lse;
+        *stack = lse;
+        flow_key->mpls.top_lse = lse;
         return 0;
 }
 
@@ -230,23 +237,39 @@ static int push_vlan(struct sk_buff *skb, struct sw_flow_key *key,
                              ntohs(vlan->vlan_tci) & ~VLAN_TAG_PRESENT);
 }
 
-static int set_eth_addr(struct sk_buff *skb, struct sw_flow_key *key,
-                        const struct ovs_key_ethernet *eth_key)
+/* 'src' is already properly masked. */
+static void ether_addr_copy_masked(u8 *dst_, const u8 *src_, const u8 *mask_)
+{
+        u16 *dst = (u16 *)dst_;
+        const u16 *src = (const u16 *)src_;
+        const u16 *mask = (const u16 *)mask_;
+
+        SET_MASKED(dst[0], src[0], mask[0]);
+        SET_MASKED(dst[1], src[1], mask[1]);
+        SET_MASKED(dst[2], src[2], mask[2]);
+}
+
+static int set_eth_addr(struct sk_buff *skb, struct sw_flow_key *flow_key,
+                        const struct ovs_key_ethernet *key,
+                        const struct ovs_key_ethernet *mask)
 {
         int err;
+
         err = skb_ensure_writable(skb, ETH_HLEN);
         if (unlikely(err))
                 return err;
 
         skb_postpull_rcsum(skb, eth_hdr(skb), ETH_ALEN * 2);
 
-        ether_addr_copy(eth_hdr(skb)->h_source, eth_key->eth_src);
-        ether_addr_copy(eth_hdr(skb)->h_dest, eth_key->eth_dst);
+        ether_addr_copy_masked(eth_hdr(skb)->h_source, key->eth_src,
+                               mask->eth_src);
+        ether_addr_copy_masked(eth_hdr(skb)->h_dest, key->eth_dst,
+                               mask->eth_dst);
 
         ovs_skb_postpush_rcsum(skb, eth_hdr(skb), ETH_ALEN * 2);
 
-        ether_addr_copy(key->eth.src, eth_key->eth_src);
-        ether_addr_copy(key->eth.dst, eth_key->eth_dst);
+        ether_addr_copy(flow_key->eth.src, eth_hdr(skb)->h_source);
+        ether_addr_copy(flow_key->eth.dst, eth_hdr(skb)->h_dest);
         return 0;
 }
 
@@ -304,6 +327,15 @@ static void update_ipv6_checksum(struct sk_buff *skb, u8 l4_proto,
         }
 }
 
+static void mask_ipv6_addr(const __be32 old[4], const __be32 addr[4],
+                           const __be32 mask[4], __be32 masked[4])
+{
+        masked[0] = MASKED(old[0], addr[0], mask[0]);
+        masked[1] = MASKED(old[1], addr[1], mask[1]);
+        masked[2] = MASKED(old[2], addr[2], mask[2]);
+        masked[3] = MASKED(old[3], addr[3], mask[3]);
+}
+
 static void set_ipv6_addr(struct sk_buff *skb, u8 l4_proto,
                           __be32 addr[4], const __be32 new_addr[4],
                           bool recalculate_csum)
@@ -315,29 +347,29 @@ static void set_ipv6_addr(struct sk_buff *skb, u8 l4_proto,
         memcpy(addr, new_addr, sizeof(__be32[4]));
 }
 
-static void set_ipv6_tc(struct ipv6hdr *nh, u8 tc)
+static void set_ipv6_fl(struct ipv6hdr *nh, u32 fl, u32 mask)
 {
-        nh->priority = tc >> 4;
+        /* Bits 21-24 are always unmasked, so this retains their values. */