openvswitch: enable NSH support

v16->17 - Fixed disputed check code: keep them in nsh_push and nsh_pop but also add them in __ovs_nla_copy_actions v15->v16 - Add csum recalculation for nsh_push, nsh_pop and set_nsh pointed out by Pravin - Move nsh key into the union with ipv4 and ipv6 and add check for nsh key in match_validate pointed out by Pravin - Add nsh check in validate_set and __ovs_nla_copy_actions v14->v15 - Check size in nsh_hdr_from_nlattr - Fixed four small issues pointed out By Jiri and Eric v13->v14 - Rename skb_push_nsh to nsh_push per Dave's comment - Rename skb_pop_nsh to nsh_pop per Dave's comment v12->v13 - Fix NSH header length check in set_nsh v11->v12 - Fix missing changes old comments pointed out - Fix new comments for v11 v10->v11 - Fix the left three disputable comments for v9 but not fixed in v10. v9->v10 - Change struct ovs_key_nsh to struct ovs_nsh_key_base base; __be32 context[NSH_MD1_CONTEXT_SIZE]; - Fix new comments for v9 v8->v9 - Fix build error reported by daily intel build because nsh module isn't selected by openvswitch v7->v8 - Rework nested value and mask for OVS_KEY_ATTR_NSH - Change pop_nsh to adapt to nsh kernel module - Fix many issues per comments from Jiri Benc v6->v7 - Remove NSH GSO patches in v6 because Jiri Benc reworked it as another patch series and they have been merged. - Change it to adapt to nsh kernel module added by NSH GSO patch series v5->v6 - Fix the rest comments for v4. - Add NSH GSO support for VxLAN-gpe + NSH and Eth + NSH. v4->v5 - Fix many comments by Jiri Benc and Eric Garver for v4. v3->v4 - Add new NSH match field ttl - Update NSH header to the latest format which will be final format and won't change per its author's confirmation. - Fix comments for v3. v2->v3 - Change OVS_KEY_ATTR_NSH to nested key to handle length-fixed attributes and length-variable attriubte more flexibly. - Remove struct ovs_action_push_nsh completely - Add code to handle nested attribute for SET_MASKED - Change PUSH_NSH to use the nested OVS_KEY_ATTR_NSH to transfer NSH header data. - Fix comments and coding style issues by Jiri and Eric v1->v2 - Change encap_nsh and decap_nsh to push_nsh and pop_nsh - Dynamically allocate struct ovs_action_push_nsh for length-variable metadata. OVS master and 2.8 branch has merged NSH userspace patch series, this patch is to enable NSH support in kernel data path in order that OVS can support NSH in compat mode by porting this. Signed-off-by: Yi Yang <yi.y.yang@intel.com> Acked-by: Jiri Benc <jbenc@redhat.com> Acked-by: Eric Garver <e@erig.me> Acked-by: Pravin Shelar <pshelar@ovn.org> Signed-off-by: David S. Miller <davem@davemloft.net>

Author: yi-y-yang

include/net/nsh.h

@@ -304,4 +304,7 @@ static inline void nsh_set_flags_ttl_len(struct nshhdr *nsh, u8 flags,
 NSH_FLAGS_MASK | NSH_TTL_MASK | NSH_LEN_MASK);
 }
 
+int nsh_push(struct sk_buff *skb, const struct nshhdr *pushed_nh);
+int nsh_pop(struct sk_buff *skb);
+
 #endif /* __NET_NSH_H */

include/uapi/linux/openvswitch.h

@@ -336,6 +336,7 @@ enum ovs_key_attr {
 OVS_KEY_ATTR_CT_LABELS,/* 16-octet connection tracking label */
 OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4, /* struct ovs_key_ct_tuple_ipv4 */
 OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6, /* struct ovs_key_ct_tuple_ipv6 */
+OVS_KEY_ATTR_NSH, /* Nested set of ovs_nsh_key_* */
 
 #ifdef __KERNEL__
 OVS_KEY_ATTR_TUNNEL_INFO, /* struct ip_tunnel_info */
@@ -495,6 +496,30 @@ struct ovs_key_ct_tuple_ipv6 {
 __u8 ipv6_proto;
 };
 
+enum ovs_nsh_key_attr {
+OVS_NSH_KEY_ATTR_UNSPEC,
+OVS_NSH_KEY_ATTR_BASE, /* struct ovs_nsh_key_base. */
+OVS_NSH_KEY_ATTR_MD1, /* struct ovs_nsh_key_md1. */
+OVS_NSH_KEY_ATTR_MD2, /* variable-length octets for MD type 2. */
+__OVS_NSH_KEY_ATTR_MAX
+};
+
+#define OVS_NSH_KEY_ATTR_MAX (__OVS_NSH_KEY_ATTR_MAX - 1)
+
+struct ovs_nsh_key_base {
+__u8 flags;
+__u8 ttl;
+__u8 mdtype;
+__u8 np;
+__be32 path_hdr;
+};
+
+#define NSH_MD1_CONTEXT_SIZE 4
+
+struct ovs_nsh_key_md1 {
+__be32 context[NSH_MD1_CONTEXT_SIZE];
+};
+
 /**
  * enum ovs_flow_attr - attributes for %OVS_FLOW_* commands.
  * @OVS_FLOW_ATTR_KEY: Nested %OVS_KEY_ATTR_* attributes specifying the flow
@@ -811,6 +836,8 @@ struct ovs_action_push_eth {
  * @OVS_ACTION_ATTR_POP_ETH: Pop the outermost Ethernet header off the
  * packet.
  * @OVS_ACTION_ATTR_CT_CLEAR: Clear conntrack state from the packet.
+ * @OVS_ACTION_ATTR_PUSH_NSH: push NSH header to the packet.
+ * @OVS_ACTION_ATTR_POP_NSH: pop the outermost NSH header off the packet.
  *
  * Only a single header can be set with a single %OVS_ACTION_ATTR_SET. Not all
  * fields within a header are modifiable, e.g. the IPv4 protocol and fragment
@@ -841,6 +868,8 @@ enum ovs_action_attr {
 OVS_ACTION_ATTR_PUSH_ETH, /* struct ovs_action_push_eth. */
 OVS_ACTION_ATTR_POP_ETH, /* No argument. */
 OVS_ACTION_ATTR_CT_CLEAR, /* No argument. */
+OVS_ACTION_ATTR_PUSH_NSH, /* Nested OVS_NSH_KEY_ATTR_*. */
+OVS_ACTION_ATTR_POP_NSH, /* No argument. */
 
 __OVS_ACTION_ATTR_MAX, /* Nothing past this will be accepted
  * from userspace. */

net/nsh/nsh.c

@@ -14,6 +14,66 @@
 #include <net/nsh.h>
 #include <net/tun_proto.h>
 
+int nsh_push(struct sk_buff *skb, const struct nshhdr *pushed_nh)
+{
+struct nshhdr *nh;
+size_t length = nsh_hdr_len(pushed_nh);
+u8 next_proto;
+
+if (skb->mac_len) {
+next_proto = TUN_P_ETHERNET;
+} else {
+next_proto = tun_p_from_eth_p(skb->protocol);
+if (!next_proto)
+return -EAFNOSUPPORT;
+}
+
+/* Add the NSH header */
+if (skb_cow_head(skb, length) < 0)
+return -ENOMEM;
+
+skb_push(skb, length);
+nh = (struct nshhdr *)(skb->data);
+memcpy(nh, pushed_nh, length);
+nh->np = next_proto;
+skb_postpush_rcsum(skb, nh, length);
+
+skb->protocol = htons(ETH_P_NSH);
+skb_reset_mac_header(skb);
+skb_reset_network_header(skb);
+skb_reset_mac_len(skb);
+
+return 0;
+}
+EXPORT_SYMBOL_GPL(nsh_push);
+
+int nsh_pop(struct sk_buff *skb)
+{
+struct nshhdr *nh;
+size_t length;
+__be16 inner_proto;
+
+if (!pskb_may_pull(skb, NSH_BASE_HDR_LEN))
+return -ENOMEM;
+nh = (struct nshhdr *)(skb->data);
+length = nsh_hdr_len(nh);
+inner_proto = tun_p_to_eth_p(nh->np);
+if (!pskb_may_pull(skb, length))
+return -ENOMEM;
+
+if (!inner_proto)
+return -EAFNOSUPPORT;
+
+skb_pull_rcsum(skb, length);
+skb_reset_mac_header(skb);
+skb_reset_network_header(skb);
+skb_reset_mac_len(skb);
+skb->protocol = inner_proto;
+
+return 0;
+}
+EXPORT_SYMBOL_GPL(nsh_pop);
+
 static struct sk_buff *nsh_gso_segment(struct sk_buff *skb,
  netdev_features_t features)
 {

net/openvswitch/Kconfig

@@ -14,6 +14,7 @@ config OPENVSWITCH
 select MPLS
 select NET_MPLS_GSO
 select DST_CACHE
+select NET_NSH
 ---help---
  Open vSwitch is a multilayer Ethernet switch targeted at virtualized
  environments. In addition to supporting a variety of features

net/openvswitch/actions.c

@@ -43,6 +43,7 @@
 #include "flow.h"
 #include "conntrack.h"
 #include "vport.h"
+#include "flow_netlink.h"
 
 struct deferred_action {
 struct sk_buff *skb;
@@ -380,6 +381,38 @@ static int push_eth(struct sk_buff *skb, struct sw_flow_key *key,
 return 0;
 }
 
+static int push_nsh(struct sk_buff *skb, struct sw_flow_key *key,
+ const struct nshhdr *nh)
+{
+int err;
+
+err = nsh_push(skb, nh);
+if (err)
+return err;
+
+/* safe right before invalidate_flow_key */
+key->mac_proto = MAC_PROTO_NONE;
+invalidate_flow_key(key);
+return 0;
+}
+
+static int pop_nsh(struct sk_buff *skb, struct sw_flow_key *key)
+{
+int err;
+
+err = nsh_pop(skb);
+if (err)
+return err;
+
+/* safe right before invalidate_flow_key */
+if (skb->protocol == htons(ETH_P_TEB))
+key->mac_proto = MAC_PROTO_ETHERNET;
+else
+key->mac_proto = MAC_PROTO_NONE;
+invalidate_flow_key(key);
+return 0;
+}
+
 static void update_ip_l4_checksum(struct sk_buff *skb, struct iphdr *nh,
  __be32 addr, __be32 new_addr)
 {
@@ -602,6 +635,69 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key,
 return 0;
 }
 
+static int set_nsh(struct sk_buff *skb, struct sw_flow_key *flow_key,
+ const struct nlattr *a)
+{
+struct nshhdr *nh;
+size_t length;
+int err;
+u8 flags;
+u8 ttl;
+int i;
+
+struct ovs_key_nsh key;
+struct ovs_key_nsh mask;
+
+err = nsh_key_from_nlattr(a, &key, &mask);
+if (err)
+return err;
+
+/* Make sure the NSH base header is there */
+if (!pskb_may_pull(skb, skb_network_offset(skb) + NSH_BASE_HDR_LEN))
+return -ENOMEM;
+
+nh = nsh_hdr(skb);
+length = nsh_hdr_len(nh);
+
+/* Make sure the whole NSH header is there */
+err = skb_ensure_writable(skb, skb_network_offset(skb) +
+ length);
+if (unlikely(err))
+return err;
+
+nh = nsh_hdr(skb);
+skb_postpull_rcsum(skb, nh, length);
+flags = nsh_get_flags(nh);
+flags = OVS_MASKED(flags, key.base.flags, mask.base.flags);
+flow_key->nsh.base.flags = flags;
+ttl = nsh_get_ttl(nh);
+ttl = OVS_MASKED(ttl, key.base.ttl, mask.base.ttl);
+flow_key->nsh.base.ttl = ttl;
+nsh_set_flags_and_ttl(nh, flags, ttl);
+nh->path_hdr = OVS_MASKED(nh->path_hdr, key.base.path_hdr,
+ mask.base.path_hdr);
+flow_key->nsh.base.path_hdr = nh->path_hdr;
+switch (nh->mdtype) {
+case NSH_M_TYPE1:
+for (i = 0; i < NSH_MD1_CONTEXT_SIZE; i++) {
+nh->md1.context[i] =
+ OVS_MASKED(nh->md1.context[i], key.context[i],
+ mask.context[i]);
+}
+memcpy(flow_key->nsh.context, nh->md1.context,
+ sizeof(nh->md1.context));
+break;
+case NSH_M_TYPE2:
+memset(flow_key->nsh.context, 0,
+ sizeof(flow_key->nsh.context));
+break;
+default:
+return -EINVAL;
+}
+skb_postpush_rcsum(skb, nh, length);
+return 0;
+}
+
 /* Must follow skb_ensure_writable() since that can move the skb data. */
 static void set_tp_port(struct sk_buff *skb, __be16 *port,
 __be16 new_port, __sum16 *check)
@@ -1024,6 +1120,10 @@ static int execute_masked_set_action(struct sk_buff *skb,
  get_mask(a, struct ovs_key_ethernet *));
 break;
 
+case OVS_KEY_ATTR_NSH:
+err = set_nsh(skb, flow_key, a);
+break;
+
 case OVS_KEY_ATTR_IPV4:
 err = set_ipv4(skb, flow_key, nla_data(a),
  get_mask(a, struct ovs_key_ipv4 *));
@@ -1214,6 +1314,22 @@ static int do_execute_actions(struct datapath *dp, struct sk_buff *skb,
 case OVS_ACTION_ATTR_POP_ETH:
 err = pop_eth(skb, key);
 break;
+
+case OVS_ACTION_ATTR_PUSH_NSH: {
+u8 buffer[NSH_HDR_MAX_LEN];
+struct nshhdr *nh = (struct nshhdr *)buffer;
+
+err = nsh_hdr_from_nlattr(nla_data(a), nh,
+ NSH_HDR_MAX_LEN);
+if (unlikely(err))
+break;
+err = push_nsh(skb, key, nh);
+break;
+}
+
+case OVS_ACTION_ATTR_POP_NSH:
+err = pop_nsh(skb, key);
+break;
 }
 
 if (unlikely(err)) {

net/openvswitch/flow.c

@@ -46,6 +46,7 @@
 #include <net/ipv6.h>
 #include <net/mpls.h>
 #include <net/ndisc.h>
+#include <net/nsh.h>
 
 #include "conntrack.h"
 #include "datapath.h"
@@ -490,6 +491,52 @@ static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key,
 return 0;
 }
 
+static int parse_nsh(struct sk_buff *skb, struct sw_flow_key *key)
+{
+struct nshhdr *nh;
+unsigned int nh_ofs = skb_network_offset(skb);
+u8 version, length;
+int err;
+
+err = check_header(skb, nh_ofs + NSH_BASE_HDR_LEN);
+if (unlikely(err))
+return err;
+
+nh = nsh_hdr(skb);
+version = nsh_get_ver(nh);
+length = nsh_hdr_len(nh);
+
+if (version != 0)
+return -EINVAL;
+
+err = check_header(skb, nh_ofs + length);
+if (unlikely(err))
+return err;
+
+nh = nsh_hdr(skb);
+key->nsh.base.flags = nsh_get_flags(nh);
+key->nsh.base.ttl = nsh_get_ttl(nh);
+key->nsh.base.mdtype = nh->mdtype;
+key->nsh.base.np = nh->np;
+key->nsh.base.path_hdr = nh->path_hdr;
+switch (key->nsh.base.mdtype) {
+case NSH_M_TYPE1:
+if (length != NSH_M_TYPE1_LEN)
+return -EINVAL;
+memcpy(key->nsh.context, nh->md1.context,
+ sizeof(nh->md1));
+break;
+case NSH_M_TYPE2:
+memset(key->nsh.context, 0,
+ sizeof(nh->md1));
+break;
+default:
+return -EINVAL;
+}
+
+return 0;
+}
+
 /**
  * key_extract - extracts a flow key from an Ethernet frame.
  * @skb: sk_buff that contains the frame, with skb->data pointing to the
@@ -735,6 +782,10 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
 memset(&key->tp, 0, sizeof(key->tp));
 }
 }
+} else if (key->eth.type == htons(ETH_P_NSH)) {
+error = parse_nsh(skb, key);
+if (error)
+return error;
 }
 return 0;
 }

net/openvswitch/flow.h

@@ -35,6 +35,7 @@
 #include <net/inet_ecn.h>
 #include <net/ip_tunnels.h>
 #include <net/dst_metadata.h>
+#include <net/nsh.h>
 
 struct sk_buff;
 
@@ -66,6 +67,11 @@ struct vlan_head {
 (offsetof(struct sw_flow_key, recirc_id) +	\
 FIELD_SIZEOF(struct sw_flow_key, recirc_id))
 
+struct ovs_key_nsh {
+struct ovs_nsh_key_base base;
+__be32 context[NSH_MD1_CONTEXT_SIZE];
+};
+
 struct sw_flow_key {
 u8 tun_opts[IP_TUNNEL_OPTS_MAX];
 u8 tun_opts_len;
@@ -143,6 +149,7 @@ struct sw_flow_key {
 } nd;
 };
 } ipv6;
+struct ovs_key_nsh nsh; /* network service header */
 };
 struct {
 /* Connection tracking fields not packed above. */