[PATCH v4 5/5] net/mlx5: validate the actions combination with NAT64

[Bing Zhao <bingz@nvidia.com>]

NAT64 is treated as a modify header action. The action order and
limitation should be the same as that of modify header in each
domain.

Since the last 2 TAG registers will be used implicitly in the
address backup mode, the values in these registers are no longer
valid after the NAT64 action. The application should not try to
match these TAGs after the rule that contains NAT64 action.

Signed-off-by: Bing Zhao <bingz@nvidia.com>
---
 drivers/net/mlx5/mlx5_flow.h    |  1 +
 drivers/net/mlx5/mlx5_flow_hw.c | 51 +++++++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+)

diff --git a/drivers/net/mlx5/mlx5_flow.h b/drivers/net/mlx5/mlx5_flow.h
index 897a283716..ea428a8c21 100644
--- a/drivers/net/mlx5/mlx5_flow.h
+++ b/drivers/net/mlx5/mlx5_flow.h
@@ -392,6 +392,7 @@ enum mlx5_feature_name {
 #define MLX5_FLOW_ACTION_PORT_REPRESENTOR (1ull << 47)
 #define MLX5_FLOW_ACTION_IPV6_ROUTING_REMOVE (1ull << 48)
 #define MLX5_FLOW_ACTION_IPV6_ROUTING_PUSH (1ull << 49)
+#define MLX5_FLOW_ACTION_NAT64 (1ull << 50)
 
 #define MLX5_FLOW_DROP_INCLUSIVE_ACTIONS \
 	(MLX5_FLOW_ACTION_COUNT | MLX5_FLOW_ACTION_SAMPLE | MLX5_FLOW_ACTION_AGE)
diff --git a/drivers/net/mlx5/mlx5_flow_hw.c b/drivers/net/mlx5/mlx5_flow_hw.c
index f32bdff98f..7730bcab6f 100644
--- a/drivers/net/mlx5/mlx5_flow_hw.c
+++ b/drivers/net/mlx5/mlx5_flow_hw.c
@@ -5866,6 +5866,50 @@ flow_hw_validate_action_default_miss(struct rte_eth_dev *dev,
 	return 0;
 }
 
+static int
+flow_hw_validate_action_nat64(struct rte_eth_dev *dev,
+			      const struct rte_flow_actions_template_attr *attr,
+			      const struct rte_flow_action *action,
+			      const struct rte_flow_action *mask,
+			      uint64_t action_flags,
+			      struct rte_flow_error *error)
+{
+	struct mlx5_priv *priv = dev->data->dev_private;
+	const struct rte_flow_action_nat64 *nat64_c;
+	enum rte_flow_nat64_type cov_type;
+
+	RTE_SET_USED(action_flags);
+	if (mask->conf && ((const struct rte_flow_action_nat64 *)mask->conf)->type) {
+		nat64_c = (const struct rte_flow_action_nat64 *)action->conf;
+		cov_type = nat64_c->type;
+		if ((attr->ingress && !priv->action_nat64[MLX5DR_TABLE_TYPE_NIC_RX][cov_type]) ||
+		    (attr->egress && !priv->action_nat64[MLX5DR_TABLE_TYPE_NIC_TX][cov_type]) ||
+		    (attr->transfer && !priv->action_nat64[MLX5DR_TABLE_TYPE_FDB][cov_type]))
+			goto err_out;
+	} else {
+		/*
+		 * Usually, the actions will be used on both directions. For non-masked actions,
+		 * both directions' actions will be checked.
+		 */
+		if (attr->ingress)
+			if (!priv->action_nat64[MLX5DR_TABLE_TYPE_NIC_RX][RTE_FLOW_NAT64_6TO4] ||
+			    !priv->action_nat64[MLX5DR_TABLE_TYPE_NIC_RX][RTE_FLOW_NAT64_4TO6])
+				goto err_out;
+		if (attr->egress)
+			if (!priv->action_nat64[MLX5DR_TABLE_TYPE_NIC_TX][RTE_FLOW_NAT64_6TO4] ||
+			    !priv->action_nat64[MLX5DR_TABLE_TYPE_NIC_TX][RTE_FLOW_NAT64_4TO6])
+				goto err_out;
+		if (attr->transfer)
+			if (!priv->action_nat64[MLX5DR_TABLE_TYPE_FDB][RTE_FLOW_NAT64_6TO4] ||
+			    !priv->action_nat64[MLX5DR_TABLE_TYPE_FDB][RTE_FLOW_NAT64_4TO6])
+				goto err_out;
+	}
+	return 0;
+err_out:
+	return rte_flow_error_set(error, EOPNOTSUPP, RTE_FLOW_ERROR_TYPE_ACTION,
+				  NULL, "NAT64 action is not supported.");
+}
+
 static int
 mlx5_flow_hw_actions_validate(struct rte_eth_dev *dev,
 			      const struct rte_flow_actions_template_attr *attr,
@@ -6066,6 +6110,13 @@ mlx5_flow_hw_actions_validate(struct rte_eth_dev *dev,
 				MLX5_HW_VLAN_PUSH_VID_IDX;
 			action_flags |= MLX5_FLOW_ACTION_OF_PUSH_VLAN;
 			break;
+		case RTE_FLOW_ACTION_TYPE_NAT64:
+			ret = flow_hw_validate_action_nat64(dev, attr, action, mask,
+							    action_flags, error);
+			if (ret != 0)
+				return ret;
+			action_flags |= MLX5_FLOW_ACTION_NAT64;
+			break;
 		case RTE_FLOW_ACTION_TYPE_END:
 			actions_end = true;
 			break;
-- 
2.39.3