1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */
3 
4 #include <linux/kernel.h>
5 #include <linux/slab.h>
6 #include <linux/errno.h>
7 #include <linux/list.h>
8 #include <linux/string.h>
9 #include <linux/rhashtable.h>
10 #include <linux/netdevice.h>
11 #include <linux/mutex.h>
12 #include <linux/refcount.h>
13 #include <net/net_namespace.h>
14 #include <net/tc_act/tc_vlan.h>
15 
16 #include "reg.h"
17 #include "core.h"
18 #include "resources.h"
19 #include "spectrum.h"
20 #include "core_acl_flex_keys.h"
21 #include "core_acl_flex_actions.h"
22 #include "spectrum_acl_tcam.h"
23 
24 struct mlxsw_sp_acl {
25 	struct mlxsw_sp *mlxsw_sp;
26 	struct mlxsw_afk *afk;
27 	struct mlxsw_sp_fid *dummy_fid;
28 	struct rhashtable ruleset_ht;
29 	struct list_head rules;
30 	struct mutex rules_lock; /* Protects rules list */
31 	struct {
32 		struct delayed_work dw;
33 		unsigned long interval;	/* ms */
34 #define MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS 1000
35 	} rule_activity_update;
36 	struct mlxsw_sp_acl_tcam tcam;
37 };
38 
mlxsw_sp_acl_afk(struct mlxsw_sp_acl * acl)39 struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl)
40 {
41 	return acl->afk;
42 }
43 
mlxsw_sp_acl_to_tcam(struct mlxsw_sp_acl * acl)44 struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam(struct mlxsw_sp_acl *acl)
45 {
46 	return &acl->tcam;
47 }
48 
49 struct mlxsw_sp_acl_ruleset_ht_key {
50 	struct mlxsw_sp_flow_block *block;
51 	u32 chain_index;
52 	const struct mlxsw_sp_acl_profile_ops *ops;
53 };
54 
55 struct mlxsw_sp_acl_ruleset {
56 	struct rhash_head ht_node; /* Member of acl HT */
57 	struct mlxsw_sp_acl_ruleset_ht_key ht_key;
58 	struct rhashtable rule_ht;
59 	refcount_t ref_count;
60 	unsigned int min_prio;
61 	unsigned int max_prio;
62 	unsigned long priv[];
63 	/* priv has to be always the last item */
64 };
65 
66 struct mlxsw_sp_acl_rule {
67 	struct rhash_head ht_node; /* Member of rule HT */
68 	struct list_head list;
69 	unsigned long cookie; /* HT key */
70 	struct mlxsw_sp_acl_ruleset *ruleset;
71 	struct mlxsw_sp_acl_rule_info *rulei;
72 	u64 last_used;
73 	u64 last_packets;
74 	u64 last_bytes;
75 	u64 last_drops;
76 	unsigned long priv[];
77 	/* priv has to be always the last item */
78 };
79 
80 static const struct rhashtable_params mlxsw_sp_acl_ruleset_ht_params = {
81 	.key_len = sizeof(struct mlxsw_sp_acl_ruleset_ht_key),
82 	.key_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_key),
83 	.head_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_node),
84 	.automatic_shrinking = true,
85 };
86 
87 static const struct rhashtable_params mlxsw_sp_acl_rule_ht_params = {
88 	.key_len = sizeof(unsigned long),
89 	.key_offset = offsetof(struct mlxsw_sp_acl_rule, cookie),
90 	.head_offset = offsetof(struct mlxsw_sp_acl_rule, ht_node),
91 	.automatic_shrinking = true,
92 };
93 
mlxsw_sp_acl_dummy_fid(struct mlxsw_sp * mlxsw_sp)94 struct mlxsw_sp_fid *mlxsw_sp_acl_dummy_fid(struct mlxsw_sp *mlxsw_sp)
95 {
96 	return mlxsw_sp->acl->dummy_fid;
97 }
98 
99 static bool
mlxsw_sp_acl_ruleset_is_singular(const struct mlxsw_sp_acl_ruleset * ruleset)100 mlxsw_sp_acl_ruleset_is_singular(const struct mlxsw_sp_acl_ruleset *ruleset)
101 {
102 	/* We hold a reference on ruleset ourselves */
103 	return refcount_read(&ruleset->ref_count) == 2;
104 }
105 
mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_flow_block * block,struct mlxsw_sp_flow_block_binding * binding)106 int mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp,
107 			      struct mlxsw_sp_flow_block *block,
108 			      struct mlxsw_sp_flow_block_binding *binding)
109 {
110 	struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero;
111 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
112 
113 	return ops->ruleset_bind(mlxsw_sp, ruleset->priv,
114 				 binding->mlxsw_sp_port, binding->ingress);
115 }
116 
mlxsw_sp_acl_ruleset_unbind(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_flow_block * block,struct mlxsw_sp_flow_block_binding * binding)117 void mlxsw_sp_acl_ruleset_unbind(struct mlxsw_sp *mlxsw_sp,
118 				 struct mlxsw_sp_flow_block *block,
119 				 struct mlxsw_sp_flow_block_binding *binding)
120 {
121 	struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero;
122 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
123 
124 	ops->ruleset_unbind(mlxsw_sp, ruleset->priv,
125 			    binding->mlxsw_sp_port, binding->ingress);
126 }
127 
128 static int
mlxsw_sp_acl_ruleset_block_bind(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_ruleset * ruleset,struct mlxsw_sp_flow_block * block)129 mlxsw_sp_acl_ruleset_block_bind(struct mlxsw_sp *mlxsw_sp,
130 				struct mlxsw_sp_acl_ruleset *ruleset,
131 				struct mlxsw_sp_flow_block *block)
132 {
133 	struct mlxsw_sp_flow_block_binding *binding;
134 	int err;
135 
136 	block->ruleset_zero = ruleset;
137 	list_for_each_entry(binding, &block->binding_list, list) {
138 		err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding);
139 		if (err)
140 			goto rollback;
141 	}
142 	return 0;
143 
144 rollback:
145 	list_for_each_entry_continue_reverse(binding, &block->binding_list,
146 					     list)
147 		mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding);
148 	block->ruleset_zero = NULL;
149 
150 	return err;
151 }
152 
153 static void
mlxsw_sp_acl_ruleset_block_unbind(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_ruleset * ruleset,struct mlxsw_sp_flow_block * block)154 mlxsw_sp_acl_ruleset_block_unbind(struct mlxsw_sp *mlxsw_sp,
155 				  struct mlxsw_sp_acl_ruleset *ruleset,
156 				  struct mlxsw_sp_flow_block *block)
157 {
158 	struct mlxsw_sp_flow_block_binding *binding;
159 
160 	list_for_each_entry(binding, &block->binding_list, list)
161 		mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding);
162 	block->ruleset_zero = NULL;
163 }
164 
165 static struct mlxsw_sp_acl_ruleset *
mlxsw_sp_acl_ruleset_create(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_flow_block * block,u32 chain_index,const struct mlxsw_sp_acl_profile_ops * ops,struct mlxsw_afk_element_usage * tmplt_elusage)166 mlxsw_sp_acl_ruleset_create(struct mlxsw_sp *mlxsw_sp,
167 			    struct mlxsw_sp_flow_block *block, u32 chain_index,
168 			    const struct mlxsw_sp_acl_profile_ops *ops,
169 			    struct mlxsw_afk_element_usage *tmplt_elusage)
170 {
171 	struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
172 	struct mlxsw_sp_acl_ruleset *ruleset;
173 	size_t alloc_size;
174 	int err;
175 
176 	alloc_size = sizeof(*ruleset) + ops->ruleset_priv_size;
177 	ruleset = kzalloc(alloc_size, GFP_KERNEL);
178 	if (!ruleset)
179 		return ERR_PTR(-ENOMEM);
180 	refcount_set(&ruleset->ref_count, 1);
181 	ruleset->ht_key.block = block;
182 	ruleset->ht_key.chain_index = chain_index;
183 	ruleset->ht_key.ops = ops;
184 
185 	err = rhashtable_init(&ruleset->rule_ht, &mlxsw_sp_acl_rule_ht_params);
186 	if (err)
187 		goto err_rhashtable_init;
188 
189 	err = ops->ruleset_add(mlxsw_sp, &acl->tcam, ruleset->priv,
190 			       tmplt_elusage, &ruleset->min_prio,
191 			       &ruleset->max_prio);
192 	if (err)
193 		goto err_ops_ruleset_add;
194 
195 	err = rhashtable_insert_fast(&acl->ruleset_ht, &ruleset->ht_node,
196 				     mlxsw_sp_acl_ruleset_ht_params);
197 	if (err)
198 		goto err_ht_insert;
199 
200 	return ruleset;
201 
202 err_ht_insert:
203 	ops->ruleset_del(mlxsw_sp, ruleset->priv);
204 err_ops_ruleset_add:
205 	rhashtable_destroy(&ruleset->rule_ht);
206 err_rhashtable_init:
207 	kfree(ruleset);
208 	return ERR_PTR(err);
209 }
210 
mlxsw_sp_acl_ruleset_destroy(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_ruleset * ruleset)211 static void mlxsw_sp_acl_ruleset_destroy(struct mlxsw_sp *mlxsw_sp,
212 					 struct mlxsw_sp_acl_ruleset *ruleset)
213 {
214 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
215 	struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
216 
217 	rhashtable_remove_fast(&acl->ruleset_ht, &ruleset->ht_node,
218 			       mlxsw_sp_acl_ruleset_ht_params);
219 	ops->ruleset_del(mlxsw_sp, ruleset->priv);
220 	rhashtable_destroy(&ruleset->rule_ht);
221 	kfree(ruleset);
222 }
223 
mlxsw_sp_acl_ruleset_ref_inc(struct mlxsw_sp_acl_ruleset * ruleset)224 static void mlxsw_sp_acl_ruleset_ref_inc(struct mlxsw_sp_acl_ruleset *ruleset)
225 {
226 	refcount_inc(&ruleset->ref_count);
227 }
228 
mlxsw_sp_acl_ruleset_ref_dec(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_ruleset * ruleset)229 static void mlxsw_sp_acl_ruleset_ref_dec(struct mlxsw_sp *mlxsw_sp,
230 					 struct mlxsw_sp_acl_ruleset *ruleset)
231 {
232 	if (!refcount_dec_and_test(&ruleset->ref_count))
233 		return;
234 	mlxsw_sp_acl_ruleset_destroy(mlxsw_sp, ruleset);
235 }
236 
237 static struct mlxsw_sp_acl_ruleset *
__mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp_acl * acl,struct mlxsw_sp_flow_block * block,u32 chain_index,const struct mlxsw_sp_acl_profile_ops * ops)238 __mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp_acl *acl,
239 			      struct mlxsw_sp_flow_block *block, u32 chain_index,
240 			      const struct mlxsw_sp_acl_profile_ops *ops)
241 {
242 	struct mlxsw_sp_acl_ruleset_ht_key ht_key;
243 
244 	memset(&ht_key, 0, sizeof(ht_key));
245 	ht_key.block = block;
246 	ht_key.chain_index = chain_index;
247 	ht_key.ops = ops;
248 	return rhashtable_lookup_fast(&acl->ruleset_ht, &ht_key,
249 				      mlxsw_sp_acl_ruleset_ht_params);
250 }
251 
252 struct mlxsw_sp_acl_ruleset *
mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_flow_block * block,u32 chain_index,enum mlxsw_sp_acl_profile profile)253 mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp *mlxsw_sp,
254 			    struct mlxsw_sp_flow_block *block, u32 chain_index,
255 			    enum mlxsw_sp_acl_profile profile)
256 {
257 	const struct mlxsw_sp_acl_profile_ops *ops;
258 	struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
259 	struct mlxsw_sp_acl_ruleset *ruleset;
260 
261 	ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile);
262 	if (!ops)
263 		return ERR_PTR(-EINVAL);
264 	ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops);
265 	if (!ruleset)
266 		return ERR_PTR(-ENOENT);
267 	return ruleset;
268 }
269 
270 struct mlxsw_sp_acl_ruleset *
mlxsw_sp_acl_ruleset_get(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_flow_block * block,u32 chain_index,enum mlxsw_sp_acl_profile profile,struct mlxsw_afk_element_usage * tmplt_elusage)271 mlxsw_sp_acl_ruleset_get(struct mlxsw_sp *mlxsw_sp,
272 			 struct mlxsw_sp_flow_block *block, u32 chain_index,
273 			 enum mlxsw_sp_acl_profile profile,
274 			 struct mlxsw_afk_element_usage *tmplt_elusage)
275 {
276 	const struct mlxsw_sp_acl_profile_ops *ops;
277 	struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
278 	struct mlxsw_sp_acl_ruleset *ruleset;
279 
280 	ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile);
281 	if (!ops)
282 		return ERR_PTR(-EINVAL);
283 
284 	ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops);
285 	if (ruleset) {
286 		mlxsw_sp_acl_ruleset_ref_inc(ruleset);
287 		return ruleset;
288 	}
289 	return mlxsw_sp_acl_ruleset_create(mlxsw_sp, block, chain_index, ops,
290 					   tmplt_elusage);
291 }
292 
mlxsw_sp_acl_ruleset_put(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_ruleset * ruleset)293 void mlxsw_sp_acl_ruleset_put(struct mlxsw_sp *mlxsw_sp,
294 			      struct mlxsw_sp_acl_ruleset *ruleset)
295 {
296 	mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
297 }
298 
mlxsw_sp_acl_ruleset_group_id(struct mlxsw_sp_acl_ruleset * ruleset)299 u16 mlxsw_sp_acl_ruleset_group_id(struct mlxsw_sp_acl_ruleset *ruleset)
300 {
301 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
302 
303 	return ops->ruleset_group_id(ruleset->priv);
304 }
305 
mlxsw_sp_acl_ruleset_prio_get(struct mlxsw_sp_acl_ruleset * ruleset,unsigned int * p_min_prio,unsigned int * p_max_prio)306 void mlxsw_sp_acl_ruleset_prio_get(struct mlxsw_sp_acl_ruleset *ruleset,
307 				   unsigned int *p_min_prio,
308 				   unsigned int *p_max_prio)
309 {
310 	*p_min_prio = ruleset->min_prio;
311 	*p_max_prio = ruleset->max_prio;
312 }
313 
314 struct mlxsw_sp_acl_rule_info *
mlxsw_sp_acl_rulei_create(struct mlxsw_sp_acl * acl,struct mlxsw_afa_block * afa_block)315 mlxsw_sp_acl_rulei_create(struct mlxsw_sp_acl *acl,
316 			  struct mlxsw_afa_block *afa_block)
317 {
318 	struct mlxsw_sp_acl_rule_info *rulei;
319 	int err;
320 
321 	rulei = kzalloc(sizeof(*rulei), GFP_KERNEL);
322 	if (!rulei)
323 		return ERR_PTR(-ENOMEM);
324 
325 	if (afa_block) {
326 		rulei->act_block = afa_block;
327 		return rulei;
328 	}
329 
330 	rulei->act_block = mlxsw_afa_block_create(acl->mlxsw_sp->afa);
331 	if (IS_ERR(rulei->act_block)) {
332 		err = PTR_ERR(rulei->act_block);
333 		goto err_afa_block_create;
334 	}
335 	rulei->action_created = 1;
336 	return rulei;
337 
338 err_afa_block_create:
339 	kfree(rulei);
340 	return ERR_PTR(err);
341 }
342 
mlxsw_sp_acl_rulei_destroy(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei)343 void mlxsw_sp_acl_rulei_destroy(struct mlxsw_sp *mlxsw_sp,
344 				struct mlxsw_sp_acl_rule_info *rulei)
345 {
346 	if (rulei->action_created)
347 		mlxsw_afa_block_destroy(rulei->act_block);
348 	if (rulei->src_port_range_reg_valid)
349 		mlxsw_sp_port_range_reg_put(mlxsw_sp,
350 					    rulei->src_port_range_reg_index);
351 	if (rulei->dst_port_range_reg_valid)
352 		mlxsw_sp_port_range_reg_put(mlxsw_sp,
353 					    rulei->dst_port_range_reg_index);
354 	kfree(rulei);
355 }
356 
mlxsw_sp_acl_rulei_commit(struct mlxsw_sp_acl_rule_info * rulei)357 int mlxsw_sp_acl_rulei_commit(struct mlxsw_sp_acl_rule_info *rulei)
358 {
359 	return mlxsw_afa_block_commit(rulei->act_block);
360 }
361 
mlxsw_sp_acl_rulei_priority(struct mlxsw_sp_acl_rule_info * rulei,unsigned int priority)362 void mlxsw_sp_acl_rulei_priority(struct mlxsw_sp_acl_rule_info *rulei,
363 				 unsigned int priority)
364 {
365 	rulei->priority = priority;
366 }
367 
mlxsw_sp_acl_rulei_keymask_u32(struct mlxsw_sp_acl_rule_info * rulei,enum mlxsw_afk_element element,u32 key_value,u32 mask_value)368 void mlxsw_sp_acl_rulei_keymask_u32(struct mlxsw_sp_acl_rule_info *rulei,
369 				    enum mlxsw_afk_element element,
370 				    u32 key_value, u32 mask_value)
371 {
372 	mlxsw_afk_values_add_u32(&rulei->values, element,
373 				 key_value, mask_value);
374 }
375 
mlxsw_sp_acl_rulei_keymask_buf(struct mlxsw_sp_acl_rule_info * rulei,enum mlxsw_afk_element element,const char * key_value,const char * mask_value,unsigned int len)376 void mlxsw_sp_acl_rulei_keymask_buf(struct mlxsw_sp_acl_rule_info *rulei,
377 				    enum mlxsw_afk_element element,
378 				    const char *key_value,
379 				    const char *mask_value, unsigned int len)
380 {
381 	mlxsw_afk_values_add_buf(&rulei->values, element,
382 				 key_value, mask_value, len);
383 }
384 
mlxsw_sp_acl_rulei_act_continue(struct mlxsw_sp_acl_rule_info * rulei)385 int mlxsw_sp_acl_rulei_act_continue(struct mlxsw_sp_acl_rule_info *rulei)
386 {
387 	return mlxsw_afa_block_continue(rulei->act_block);
388 }
389 
mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info * rulei,u16 group_id)390 int mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info *rulei,
391 				u16 group_id)
392 {
393 	return mlxsw_afa_block_jump(rulei->act_block, group_id);
394 }
395 
mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info * rulei)396 int mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info *rulei)
397 {
398 	return mlxsw_afa_block_terminate(rulei->act_block);
399 }
400 
mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info * rulei,bool ingress,const struct flow_action_cookie * fa_cookie,struct netlink_ext_ack * extack)401 int mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info *rulei,
402 				bool ingress,
403 				const struct flow_action_cookie *fa_cookie,
404 				struct netlink_ext_ack *extack)
405 {
406 	return mlxsw_afa_block_append_drop(rulei->act_block, ingress,
407 					   fa_cookie, extack);
408 }
409 
mlxsw_sp_acl_rulei_act_trap(struct mlxsw_sp_acl_rule_info * rulei)410 int mlxsw_sp_acl_rulei_act_trap(struct mlxsw_sp_acl_rule_info *rulei)
411 {
412 	return mlxsw_afa_block_append_trap(rulei->act_block,
413 					   MLXSW_TRAP_ID_ACL0);
414 }
415 
mlxsw_sp_acl_rulei_act_fwd(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,struct net_device * out_dev,struct netlink_ext_ack * extack)416 int mlxsw_sp_acl_rulei_act_fwd(struct mlxsw_sp *mlxsw_sp,
417 			       struct mlxsw_sp_acl_rule_info *rulei,
418 			       struct net_device *out_dev,
419 			       struct netlink_ext_ack *extack)
420 {
421 	struct mlxsw_sp_port *mlxsw_sp_port;
422 	u16 local_port;
423 	bool in_port;
424 
425 	if (out_dev) {
426 		if (!mlxsw_sp_port_dev_check(out_dev)) {
427 			NL_SET_ERR_MSG_MOD(extack, "Invalid output device");
428 			return -EINVAL;
429 		}
430 		mlxsw_sp_port = netdev_priv(out_dev);
431 		if (mlxsw_sp_port->mlxsw_sp != mlxsw_sp) {
432 			NL_SET_ERR_MSG_MOD(extack, "Invalid output device");
433 			return -EINVAL;
434 		}
435 		local_port = mlxsw_sp_port->local_port;
436 		in_port = false;
437 	} else {
438 		/* If out_dev is NULL, the caller wants to
439 		 * set forward to ingress port.
440 		 */
441 		local_port = 0;
442 		in_port = true;
443 	}
444 	return mlxsw_afa_block_append_fwd(rulei->act_block,
445 					  local_port, in_port, extack);
446 }
447 
mlxsw_sp_acl_rulei_act_mirror(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,struct mlxsw_sp_flow_block * block,struct net_device * out_dev,struct netlink_ext_ack * extack)448 int mlxsw_sp_acl_rulei_act_mirror(struct mlxsw_sp *mlxsw_sp,
449 				  struct mlxsw_sp_acl_rule_info *rulei,
450 				  struct mlxsw_sp_flow_block *block,
451 				  struct net_device *out_dev,
452 				  struct netlink_ext_ack *extack)
453 {
454 	struct mlxsw_sp_flow_block_binding *binding;
455 	struct mlxsw_sp_port *in_port;
456 
457 	if (!list_is_singular(&block->binding_list)) {
458 		NL_SET_ERR_MSG_MOD(extack, "Only a single mirror source is allowed");
459 		return -EOPNOTSUPP;
460 	}
461 	binding = list_first_entry(&block->binding_list,
462 				   struct mlxsw_sp_flow_block_binding, list);
463 	in_port = binding->mlxsw_sp_port;
464 
465 	return mlxsw_afa_block_append_mirror(rulei->act_block,
466 					     in_port->local_port,
467 					     out_dev,
468 					     binding->ingress,
469 					     extack);
470 }
471 
mlxsw_sp_acl_rulei_act_vlan(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,u32 action,u16 vid,u16 proto,u8 prio,struct netlink_ext_ack * extack)472 int mlxsw_sp_acl_rulei_act_vlan(struct mlxsw_sp *mlxsw_sp,
473 				struct mlxsw_sp_acl_rule_info *rulei,
474 				u32 action, u16 vid, u16 proto, u8 prio,
475 				struct netlink_ext_ack *extack)
476 {
477 	u8 ethertype;
478 
479 	if (action == FLOW_ACTION_VLAN_MANGLE) {
480 		switch (proto) {
481 		case ETH_P_8021Q:
482 			ethertype = 0;
483 			break;
484 		case ETH_P_8021AD:
485 			ethertype = 1;
486 			break;
487 		default:
488 			NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN protocol");
489 			dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN protocol %#04x\n",
490 				proto);
491 			return -EINVAL;
492 		}
493 
494 		return mlxsw_afa_block_append_vlan_modify(rulei->act_block,
495 							  vid, prio, ethertype,
496 							  extack);
497 	} else {
498 		NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN action");
499 		dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN action\n");
500 		return -EINVAL;
501 	}
502 }
503 
mlxsw_sp_acl_rulei_act_priority(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,u32 prio,struct netlink_ext_ack * extack)504 int mlxsw_sp_acl_rulei_act_priority(struct mlxsw_sp *mlxsw_sp,
505 				    struct mlxsw_sp_acl_rule_info *rulei,
506 				    u32 prio, struct netlink_ext_ack *extack)
507 {
508 	/* Even though both Linux and Spectrum switches support 16 priorities,
509 	 * spectrum_qdisc only processes the first eight priomap elements, and
510 	 * the DCB and PFC features are tied to 8 priorities as well. Therefore
511 	 * bounce attempts to prioritize packets to higher priorities.
512 	 */
513 	if (prio >= IEEE_8021QAZ_MAX_TCS) {
514 		NL_SET_ERR_MSG_MOD(extack, "Only priorities 0..7 are supported");
515 		return -EINVAL;
516 	}
517 	return mlxsw_afa_block_append_qos_switch_prio(rulei->act_block, prio,
518 						      extack);
519 }
520 
521 struct mlxsw_sp_acl_mangle_action {
522 	enum flow_action_mangle_base htype;
523 	/* Offset is u32-aligned. */
524 	u32 offset;
525 	/* Mask bits are unset for the modified field. */
526 	u32 mask;
527 	/* Shift required to extract the set value. */
528 	u32 shift;
529 	enum mlxsw_sp_acl_mangle_field field;
530 };
531 
532 #define MLXSW_SP_ACL_MANGLE_ACTION(_htype, _offset, _mask, _shift, _field) \
533 	{								\
534 		.htype = _htype,					\
535 		.offset = _offset,					\
536 		.mask = _mask,						\
537 		.shift = _shift,					\
538 		.field = MLXSW_SP_ACL_MANGLE_FIELD_##_field,		\
539 	}
540 
541 #define MLXSW_SP_ACL_MANGLE_ACTION_IP4(_offset, _mask, _shift, _field) \
542 	MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_IP4,       \
543 				   _offset, _mask, _shift, _field)
544 
545 #define MLXSW_SP_ACL_MANGLE_ACTION_IP6(_offset, _mask, _shift, _field) \
546 	MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_IP6,       \
547 				   _offset, _mask, _shift, _field)
548 
549 #define MLXSW_SP_ACL_MANGLE_ACTION_TCP(_offset, _mask, _shift, _field) \
550 	MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_TCP, _offset, _mask, _shift, _field)
551 
552 #define MLXSW_SP_ACL_MANGLE_ACTION_UDP(_offset, _mask, _shift, _field) \
553 	MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_UDP, _offset, _mask, _shift, _field)
554 
555 static struct mlxsw_sp_acl_mangle_action mlxsw_sp_acl_mangle_actions[] = {
556 	MLXSW_SP_ACL_MANGLE_ACTION_IP4(0, 0xff00ffff, 16, IP_DSFIELD),
557 	MLXSW_SP_ACL_MANGLE_ACTION_IP4(0, 0xff03ffff, 18, IP_DSCP),
558 	MLXSW_SP_ACL_MANGLE_ACTION_IP4(0, 0xfffcffff, 16, IP_ECN),
559 
560 	MLXSW_SP_ACL_MANGLE_ACTION_IP6(0, 0xf00fffff, 20, IP_DSFIELD),
561 	MLXSW_SP_ACL_MANGLE_ACTION_IP6(0, 0xf03fffff, 22, IP_DSCP),
562 	MLXSW_SP_ACL_MANGLE_ACTION_IP6(0, 0xffcfffff, 20, IP_ECN),
563 
564 	MLXSW_SP_ACL_MANGLE_ACTION_TCP(0, 0x0000ffff, 16, IP_SPORT),
565 	MLXSW_SP_ACL_MANGLE_ACTION_TCP(0, 0xffff0000, 0,  IP_DPORT),
566 
567 	MLXSW_SP_ACL_MANGLE_ACTION_UDP(0, 0x0000ffff, 16, IP_SPORT),
568 	MLXSW_SP_ACL_MANGLE_ACTION_UDP(0, 0xffff0000, 0,  IP_DPORT),
569 
570 	MLXSW_SP_ACL_MANGLE_ACTION_IP4(12, 0x00000000, 0, IP4_SIP),
571 	MLXSW_SP_ACL_MANGLE_ACTION_IP4(16, 0x00000000, 0, IP4_DIP),
572 
573 	MLXSW_SP_ACL_MANGLE_ACTION_IP6(8, 0x00000000, 0, IP6_SIP_1),
574 	MLXSW_SP_ACL_MANGLE_ACTION_IP6(12, 0x00000000, 0, IP6_SIP_2),
575 	MLXSW_SP_ACL_MANGLE_ACTION_IP6(16, 0x00000000, 0, IP6_SIP_3),
576 	MLXSW_SP_ACL_MANGLE_ACTION_IP6(20, 0x00000000, 0, IP6_SIP_4),
577 	MLXSW_SP_ACL_MANGLE_ACTION_IP6(24, 0x00000000, 0, IP6_DIP_1),
578 	MLXSW_SP_ACL_MANGLE_ACTION_IP6(28, 0x00000000, 0, IP6_DIP_2),
579 	MLXSW_SP_ACL_MANGLE_ACTION_IP6(32, 0x00000000, 0, IP6_DIP_3),
580 	MLXSW_SP_ACL_MANGLE_ACTION_IP6(36, 0x00000000, 0, IP6_DIP_4),
581 };
582 
583 static int
mlxsw_sp_acl_rulei_act_mangle_field(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,struct mlxsw_sp_acl_mangle_action * mact,u32 val,struct netlink_ext_ack * extack)584 mlxsw_sp_acl_rulei_act_mangle_field(struct mlxsw_sp *mlxsw_sp,
585 				    struct mlxsw_sp_acl_rule_info *rulei,
586 				    struct mlxsw_sp_acl_mangle_action *mact,
587 				    u32 val, struct netlink_ext_ack *extack)
588 {
589 	switch (mact->field) {
590 	case MLXSW_SP_ACL_MANGLE_FIELD_IP_DSFIELD:
591 		return mlxsw_afa_block_append_qos_dsfield(rulei->act_block,
592 							  val, extack);
593 	case MLXSW_SP_ACL_MANGLE_FIELD_IP_DSCP:
594 		return mlxsw_afa_block_append_qos_dscp(rulei->act_block,
595 						       val, extack);
596 	case MLXSW_SP_ACL_MANGLE_FIELD_IP_ECN:
597 		return mlxsw_afa_block_append_qos_ecn(rulei->act_block,
598 						      val, extack);
599 	default:
600 		return -EOPNOTSUPP;
601 	}
602 }
603 
mlxsw_sp1_acl_rulei_act_mangle_field(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,struct mlxsw_sp_acl_mangle_action * mact,u32 val,struct netlink_ext_ack * extack)604 static int mlxsw_sp1_acl_rulei_act_mangle_field(struct mlxsw_sp *mlxsw_sp,
605 						struct mlxsw_sp_acl_rule_info *rulei,
606 						struct mlxsw_sp_acl_mangle_action *mact,
607 						u32 val, struct netlink_ext_ack *extack)
608 {
609 	int err;
610 
611 	err = mlxsw_sp_acl_rulei_act_mangle_field(mlxsw_sp, rulei, mact, val, extack);
612 	if (err != -EOPNOTSUPP)
613 		return err;
614 
615 	NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field");
616 	return err;
617 }
618 
619 static int
mlxsw_sp2_acl_rulei_act_mangle_field_ip_odd(struct mlxsw_sp_acl_rule_info * rulei,enum mlxsw_sp_acl_mangle_field field,u32 val,struct netlink_ext_ack * extack)620 mlxsw_sp2_acl_rulei_act_mangle_field_ip_odd(struct mlxsw_sp_acl_rule_info *rulei,
621 					    enum mlxsw_sp_acl_mangle_field field,
622 					    u32 val, struct netlink_ext_ack *extack)
623 {
624 	if (!rulei->ipv6_valid) {
625 		rulei->ipv6.prev_val = val;
626 		rulei->ipv6_valid = true;
627 		rulei->ipv6.prev_field = field;
628 		return 0;
629 	}
630 
631 	NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field order");
632 	return -EOPNOTSUPP;
633 }
634 
mlxsw_sp2_acl_rulei_act_mangle_field(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,struct mlxsw_sp_acl_mangle_action * mact,u32 val,struct netlink_ext_ack * extack)635 static int mlxsw_sp2_acl_rulei_act_mangle_field(struct mlxsw_sp *mlxsw_sp,
636 						struct mlxsw_sp_acl_rule_info *rulei,
637 						struct mlxsw_sp_acl_mangle_action *mact,
638 						u32 val, struct netlink_ext_ack *extack)
639 {
640 	int err;
641 
642 	err = mlxsw_sp_acl_rulei_act_mangle_field(mlxsw_sp, rulei, mact, val, extack);
643 	if (err != -EOPNOTSUPP)
644 		return err;
645 
646 	switch (mact->field) {
647 	case MLXSW_SP_ACL_MANGLE_FIELD_IP_SPORT:
648 		return mlxsw_afa_block_append_l4port(rulei->act_block, false, val, extack);
649 	case MLXSW_SP_ACL_MANGLE_FIELD_IP_DPORT:
650 		return mlxsw_afa_block_append_l4port(rulei->act_block, true, val, extack);
651 	/* IPv4 fields */
652 	case MLXSW_SP_ACL_MANGLE_FIELD_IP4_SIP:
653 		return mlxsw_afa_block_append_ip(rulei->act_block, false,
654 						 true, val, 0, extack);
655 	case MLXSW_SP_ACL_MANGLE_FIELD_IP4_DIP:
656 		return mlxsw_afa_block_append_ip(rulei->act_block, true,
657 						 true, val, 0, extack);
658 	/* IPv6 fields */
659 	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_1:
660 	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_3:
661 	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_1:
662 	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_3:
663 		return mlxsw_sp2_acl_rulei_act_mangle_field_ip_odd(rulei,
664 								   mact->field,
665 								   val, extack);
666 	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_2:
667 		if (rulei->ipv6_valid &&
668 		    rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_1) {
669 			rulei->ipv6_valid = false;
670 			return mlxsw_afa_block_append_ip(rulei->act_block,
671 							 false, false, val,
672 							 rulei->ipv6.prev_val,
673 							 extack);
674 		}
675 		break;
676 	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_4:
677 		if (rulei->ipv6_valid &&
678 		    rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_3) {
679 			rulei->ipv6_valid = false;
680 			return mlxsw_afa_block_append_ip(rulei->act_block,
681 							 false, true, val,
682 							 rulei->ipv6.prev_val,
683 							 extack);
684 		}
685 		break;
686 	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_2:
687 		if (rulei->ipv6_valid &&
688 		    rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_1) {
689 			rulei->ipv6_valid = false;
690 			return mlxsw_afa_block_append_ip(rulei->act_block,
691 							 true, false, val,
692 							 rulei->ipv6.prev_val,
693 							 extack);
694 		}
695 		break;
696 	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_4:
697 		if (rulei->ipv6_valid &&
698 		    rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_3) {
699 			rulei->ipv6_valid = false;
700 			return mlxsw_afa_block_append_ip(rulei->act_block,
701 							 true, true, val,
702 							 rulei->ipv6.prev_val,
703 							 extack);
704 		}
705 		break;
706 	default:
707 		break;
708 	}
709 
710 	NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field");
711 	return err;
712 }
713 
mlxsw_sp_acl_rulei_act_mangle(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,enum flow_action_mangle_base htype,u32 offset,u32 mask,u32 val,struct netlink_ext_ack * extack)714 int mlxsw_sp_acl_rulei_act_mangle(struct mlxsw_sp *mlxsw_sp,
715 				  struct mlxsw_sp_acl_rule_info *rulei,
716 				  enum flow_action_mangle_base htype,
717 				  u32 offset, u32 mask, u32 val,
718 				  struct netlink_ext_ack *extack)
719 {
720 	const struct mlxsw_sp_acl_rulei_ops *acl_rulei_ops = mlxsw_sp->acl_rulei_ops;
721 	struct mlxsw_sp_acl_mangle_action *mact;
722 	size_t i;
723 
724 	for (i = 0; i < ARRAY_SIZE(mlxsw_sp_acl_mangle_actions); ++i) {
725 		mact = &mlxsw_sp_acl_mangle_actions[i];
726 		if (mact->htype == htype &&
727 		    mact->offset == offset &&
728 		    mact->mask == mask) {
729 			val >>= mact->shift;
730 			return acl_rulei_ops->act_mangle_field(mlxsw_sp,
731 							       rulei, mact,
732 							       val, extack);
733 		}
734 	}
735 
736 	NL_SET_ERR_MSG_MOD(extack, "Unknown mangle field");
737 	return -EINVAL;
738 }
739 
mlxsw_sp_acl_rulei_act_police(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,u32 index,u64 rate_bytes_ps,u32 burst,struct netlink_ext_ack * extack)740 int mlxsw_sp_acl_rulei_act_police(struct mlxsw_sp *mlxsw_sp,
741 				  struct mlxsw_sp_acl_rule_info *rulei,
742 				  u32 index, u64 rate_bytes_ps,
743 				  u32 burst, struct netlink_ext_ack *extack)
744 {
745 	int err;
746 
747 	err = mlxsw_afa_block_append_police(rulei->act_block, index,
748 					    rate_bytes_ps, burst,
749 					    &rulei->policer_index, extack);
750 	if (err)
751 		return err;
752 
753 	rulei->policer_index_valid = true;
754 
755 	return 0;
756 }
757 
mlxsw_sp_acl_rulei_act_count(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,struct netlink_ext_ack * extack)758 int mlxsw_sp_acl_rulei_act_count(struct mlxsw_sp *mlxsw_sp,
759 				 struct mlxsw_sp_acl_rule_info *rulei,
760 				 struct netlink_ext_ack *extack)
761 {
762 	int err;
763 
764 	err = mlxsw_afa_block_append_counter(rulei->act_block,
765 					     &rulei->counter_index, extack);
766 	if (err)
767 		return err;
768 	rulei->counter_valid = true;
769 	return 0;
770 }
771 
mlxsw_sp_acl_rulei_act_fid_set(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,u16 fid,struct netlink_ext_ack * extack)772 int mlxsw_sp_acl_rulei_act_fid_set(struct mlxsw_sp *mlxsw_sp,
773 				   struct mlxsw_sp_acl_rule_info *rulei,
774 				   u16 fid, struct netlink_ext_ack *extack)
775 {
776 	return mlxsw_afa_block_append_fid_set(rulei->act_block, fid, extack);
777 }
778 
mlxsw_sp_acl_rulei_act_ignore(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,bool disable_learning,bool disable_security)779 int mlxsw_sp_acl_rulei_act_ignore(struct mlxsw_sp *mlxsw_sp,
780 				  struct mlxsw_sp_acl_rule_info *rulei,
781 				  bool disable_learning, bool disable_security)
782 {
783 	return mlxsw_afa_block_append_ignore(rulei->act_block,
784 					     disable_learning,
785 					     disable_security);
786 }
787 
mlxsw_sp_acl_rulei_act_sample(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,struct mlxsw_sp_flow_block * block,struct psample_group * psample_group,u32 rate,u32 trunc_size,bool truncate,struct netlink_ext_ack * extack)788 int mlxsw_sp_acl_rulei_act_sample(struct mlxsw_sp *mlxsw_sp,
789 				  struct mlxsw_sp_acl_rule_info *rulei,
790 				  struct mlxsw_sp_flow_block *block,
791 				  struct psample_group *psample_group, u32 rate,
792 				  u32 trunc_size, bool truncate,
793 				  struct netlink_ext_ack *extack)
794 {
795 	struct mlxsw_sp_flow_block_binding *binding;
796 	struct mlxsw_sp_port *mlxsw_sp_port;
797 
798 	if (!list_is_singular(&block->binding_list)) {
799 		NL_SET_ERR_MSG_MOD(extack, "Only a single sampling source is allowed");
800 		return -EOPNOTSUPP;
801 	}
802 	binding = list_first_entry(&block->binding_list,
803 				   struct mlxsw_sp_flow_block_binding, list);
804 	mlxsw_sp_port = binding->mlxsw_sp_port;
805 
806 	return mlxsw_afa_block_append_sampler(rulei->act_block,
807 					      mlxsw_sp_port->local_port,
808 					      psample_group, rate, trunc_size,
809 					      truncate, binding->ingress,
810 					      extack);
811 }
812 
813 struct mlxsw_sp_acl_rule *
mlxsw_sp_acl_rule_create(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_ruleset * ruleset,unsigned long cookie,struct mlxsw_afa_block * afa_block,struct netlink_ext_ack * extack)814 mlxsw_sp_acl_rule_create(struct mlxsw_sp *mlxsw_sp,
815 			 struct mlxsw_sp_acl_ruleset *ruleset,
816 			 unsigned long cookie,
817 			 struct mlxsw_afa_block *afa_block,
818 			 struct netlink_ext_ack *extack)
819 {
820 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
821 	struct mlxsw_sp_acl_rule *rule;
822 	int err;
823 
824 	mlxsw_sp_acl_ruleset_ref_inc(ruleset);
825 	rule = kzalloc(sizeof(*rule) + ops->rule_priv_size,
826 		       GFP_KERNEL);
827 	if (!rule) {
828 		err = -ENOMEM;
829 		goto err_alloc;
830 	}
831 	rule->cookie = cookie;
832 	rule->ruleset = ruleset;
833 
834 	rule->rulei = mlxsw_sp_acl_rulei_create(mlxsw_sp->acl, afa_block);
835 	if (IS_ERR(rule->rulei)) {
836 		err = PTR_ERR(rule->rulei);
837 		goto err_rulei_create;
838 	}
839 
840 	return rule;
841 
842 err_rulei_create:
843 	kfree(rule);
844 err_alloc:
845 	mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
846 	return ERR_PTR(err);
847 }
848 
mlxsw_sp_acl_rule_destroy(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule * rule)849 void mlxsw_sp_acl_rule_destroy(struct mlxsw_sp *mlxsw_sp,
850 			       struct mlxsw_sp_acl_rule *rule)
851 {
852 	struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
853 
854 	mlxsw_sp_acl_rulei_destroy(mlxsw_sp, rule->rulei);
855 	kfree(rule);
856 	mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
857 }
858 
mlxsw_sp_acl_rule_add(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule * rule)859 int mlxsw_sp_acl_rule_add(struct mlxsw_sp *mlxsw_sp,
860 			  struct mlxsw_sp_acl_rule *rule)
861 {
862 	struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
863 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
864 	struct mlxsw_sp_flow_block *block = ruleset->ht_key.block;
865 	int err;
866 
867 	err = ops->rule_add(mlxsw_sp, ruleset->priv, rule->priv, rule->rulei);
868 	if (err)
869 		return err;
870 
871 	err = rhashtable_insert_fast(&ruleset->rule_ht, &rule->ht_node,
872 				     mlxsw_sp_acl_rule_ht_params);
873 	if (err)
874 		goto err_rhashtable_insert;
875 
876 	if (!ruleset->ht_key.chain_index &&
877 	    mlxsw_sp_acl_ruleset_is_singular(ruleset)) {
878 		/* We only need ruleset with chain index 0, the implicit
879 		 * one, to be directly bound to device. The rest of the
880 		 * rulesets are bound by "Goto action set".
881 		 */
882 		err = mlxsw_sp_acl_ruleset_block_bind(mlxsw_sp, ruleset, block);
883 		if (err)
884 			goto err_ruleset_block_bind;
885 	}
886 
887 	mutex_lock(&mlxsw_sp->acl->rules_lock);
888 	list_add_tail(&rule->list, &mlxsw_sp->acl->rules);
889 	mutex_unlock(&mlxsw_sp->acl->rules_lock);
890 	block->rule_count++;
891 	block->ingress_blocker_rule_count += rule->rulei->ingress_bind_blocker;
892 	block->egress_blocker_rule_count += rule->rulei->egress_bind_blocker;
893 	return 0;
894 
895 err_ruleset_block_bind:
896 	rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node,
897 			       mlxsw_sp_acl_rule_ht_params);
898 err_rhashtable_insert:
899 	ops->rule_del(mlxsw_sp, rule->priv);
900 	return err;
901 }
902 
mlxsw_sp_acl_rule_del(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule * rule)903 void mlxsw_sp_acl_rule_del(struct mlxsw_sp *mlxsw_sp,
904 			   struct mlxsw_sp_acl_rule *rule)
905 {
906 	struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
907 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
908 	struct mlxsw_sp_flow_block *block = ruleset->ht_key.block;
909 
910 	block->egress_blocker_rule_count -= rule->rulei->egress_bind_blocker;
911 	block->ingress_blocker_rule_count -= rule->rulei->ingress_bind_blocker;
912 	block->rule_count--;
913 	mutex_lock(&mlxsw_sp->acl->rules_lock);
914 	list_del(&rule->list);
915 	mutex_unlock(&mlxsw_sp->acl->rules_lock);
916 	if (!ruleset->ht_key.chain_index &&
917 	    mlxsw_sp_acl_ruleset_is_singular(ruleset))
918 		mlxsw_sp_acl_ruleset_block_unbind(mlxsw_sp, ruleset, block);
919 	rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node,
920 			       mlxsw_sp_acl_rule_ht_params);
921 	ops->rule_del(mlxsw_sp, rule->priv);
922 }
923 
mlxsw_sp_acl_rule_action_replace(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule * rule,struct mlxsw_afa_block * afa_block)924 int mlxsw_sp_acl_rule_action_replace(struct mlxsw_sp *mlxsw_sp,
925 				     struct mlxsw_sp_acl_rule *rule,
926 				     struct mlxsw_afa_block *afa_block)
927 {
928 	struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
929 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
930 	struct mlxsw_sp_acl_rule_info *rulei;
931 
932 	rulei = mlxsw_sp_acl_rule_rulei(rule);
933 	rulei->act_block = afa_block;
934 
935 	return ops->rule_action_replace(mlxsw_sp, rule->priv, rule->rulei);
936 }
937 
938 struct mlxsw_sp_acl_rule *
mlxsw_sp_acl_rule_lookup(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_ruleset * ruleset,unsigned long cookie)939 mlxsw_sp_acl_rule_lookup(struct mlxsw_sp *mlxsw_sp,
940 			 struct mlxsw_sp_acl_ruleset *ruleset,
941 			 unsigned long cookie)
942 {
943 	return rhashtable_lookup_fast(&ruleset->rule_ht, &cookie,
944 				       mlxsw_sp_acl_rule_ht_params);
945 }
946 
947 struct mlxsw_sp_acl_rule_info *
mlxsw_sp_acl_rule_rulei(struct mlxsw_sp_acl_rule * rule)948 mlxsw_sp_acl_rule_rulei(struct mlxsw_sp_acl_rule *rule)
949 {
950 	return rule->rulei;
951 }
952 
mlxsw_sp_acl_rule_activity_update(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule * rule)953 static int mlxsw_sp_acl_rule_activity_update(struct mlxsw_sp *mlxsw_sp,
954 					     struct mlxsw_sp_acl_rule *rule)
955 {
956 	struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
957 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
958 	bool active;
959 	int err;
960 
961 	err = ops->rule_activity_get(mlxsw_sp, rule->priv, &active);
962 	if (err)
963 		return err;
964 	if (active)
965 		rule->last_used = jiffies;
966 	return 0;
967 }
968 
mlxsw_sp_acl_rules_activity_update(struct mlxsw_sp_acl * acl)969 static int mlxsw_sp_acl_rules_activity_update(struct mlxsw_sp_acl *acl)
970 {
971 	struct mlxsw_sp_acl_rule *rule;
972 	int err;
973 
974 	mutex_lock(&acl->rules_lock);
975 	list_for_each_entry(rule, &acl->rules, list) {
976 		err = mlxsw_sp_acl_rule_activity_update(acl->mlxsw_sp,
977 							rule);
978 		if (err)
979 			goto err_rule_update;
980 	}
981 	mutex_unlock(&acl->rules_lock);
982 	return 0;
983 
984 err_rule_update:
985 	mutex_unlock(&acl->rules_lock);
986 	return err;
987 }
988 
mlxsw_sp_acl_rule_activity_work_schedule(struct mlxsw_sp_acl * acl)989 static void mlxsw_sp_acl_rule_activity_work_schedule(struct mlxsw_sp_acl *acl)
990 {
991 	unsigned long interval = acl->rule_activity_update.interval;
992 
993 	mlxsw_core_schedule_dw(&acl->rule_activity_update.dw,
994 			       msecs_to_jiffies(interval));
995 }
996 
mlxsw_sp_acl_rule_activity_update_work(struct work_struct * work)997 static void mlxsw_sp_acl_rule_activity_update_work(struct work_struct *work)
998 {
999 	struct mlxsw_sp_acl *acl = container_of(work, struct mlxsw_sp_acl,
1000 						rule_activity_update.dw.work);
1001 	int err;
1002 
1003 	err = mlxsw_sp_acl_rules_activity_update(acl);
1004 	if (err)
1005 		dev_err(acl->mlxsw_sp->bus_info->dev, "Could not update acl activity");
1006 
1007 	mlxsw_sp_acl_rule_activity_work_schedule(acl);
1008 }
1009 
mlxsw_sp_acl_rule_get_stats(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule * rule,u64 * packets,u64 * bytes,u64 * drops,u64 * last_use,enum flow_action_hw_stats * used_hw_stats)1010 int mlxsw_sp_acl_rule_get_stats(struct mlxsw_sp *mlxsw_sp,
1011 				struct mlxsw_sp_acl_rule *rule,
1012 				u64 *packets, u64 *bytes, u64 *drops,
1013 				u64 *last_use,
1014 				enum flow_action_hw_stats *used_hw_stats)
1015 
1016 {
1017 	enum mlxsw_sp_policer_type type = MLXSW_SP_POLICER_TYPE_SINGLE_RATE;
1018 	struct mlxsw_sp_acl_rule_info *rulei;
1019 	u64 current_packets = 0;
1020 	u64 current_bytes = 0;
1021 	u64 current_drops = 0;
1022 	int err;
1023 
1024 	rulei = mlxsw_sp_acl_rule_rulei(rule);
1025 	if (rulei->counter_valid) {
1026 		err = mlxsw_sp_flow_counter_get(mlxsw_sp, rulei->counter_index,
1027 						&current_packets,
1028 						&current_bytes);
1029 		if (err)
1030 			return err;
1031 		*used_hw_stats = FLOW_ACTION_HW_STATS_IMMEDIATE;
1032 	}
1033 	if (rulei->policer_index_valid) {
1034 		err = mlxsw_sp_policer_drops_counter_get(mlxsw_sp, type,
1035 							 rulei->policer_index,
1036 							 &current_drops);
1037 		if (err)
1038 			return err;
1039 	}
1040 	*packets = current_packets - rule->last_packets;
1041 	*bytes = current_bytes - rule->last_bytes;
1042 	*drops = current_drops - rule->last_drops;
1043 	*last_use = rule->last_used;
1044 
1045 	rule->last_bytes = current_bytes;
1046 	rule->last_packets = current_packets;
1047 	rule->last_drops = current_drops;
1048 
1049 	return 0;
1050 }
1051 
mlxsw_sp_acl_init(struct mlxsw_sp * mlxsw_sp)1052 int mlxsw_sp_acl_init(struct mlxsw_sp *mlxsw_sp)
1053 {
1054 	struct mlxsw_sp_fid *fid;
1055 	struct mlxsw_sp_acl *acl;
1056 	size_t alloc_size;
1057 	int err;
1058 
1059 	alloc_size = sizeof(*acl) + mlxsw_sp_acl_tcam_priv_size(mlxsw_sp);
1060 	acl = kzalloc(alloc_size, GFP_KERNEL);
1061 	if (!acl)
1062 		return -ENOMEM;
1063 	mlxsw_sp->acl = acl;
1064 	acl->mlxsw_sp = mlxsw_sp;
1065 	acl->afk = mlxsw_afk_create(MLXSW_CORE_RES_GET(mlxsw_sp->core,
1066 						       ACL_FLEX_KEYS),
1067 				    mlxsw_sp->afk_ops);
1068 	if (!acl->afk) {
1069 		err = -ENOMEM;
1070 		goto err_afk_create;
1071 	}
1072 
1073 	err = rhashtable_init(&acl->ruleset_ht,
1074 			      &mlxsw_sp_acl_ruleset_ht_params);
1075 	if (err)
1076 		goto err_rhashtable_init;
1077 
1078 	fid = mlxsw_sp_fid_dummy_get(mlxsw_sp);
1079 	if (IS_ERR(fid)) {
1080 		err = PTR_ERR(fid);
1081 		goto err_fid_get;
1082 	}
1083 	acl->dummy_fid = fid;
1084 
1085 	INIT_LIST_HEAD(&acl->rules);
1086 	mutex_init(&acl->rules_lock);
1087 	err = mlxsw_sp_acl_tcam_init(mlxsw_sp, &acl->tcam);
1088 	if (err)
1089 		goto err_acl_ops_init;
1090 
1091 	/* Create the delayed work for the rule activity_update */
1092 	INIT_DELAYED_WORK(&acl->rule_activity_update.dw,
1093 			  mlxsw_sp_acl_rule_activity_update_work);
1094 	acl->rule_activity_update.interval = MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS;
1095 	mlxsw_core_schedule_dw(&acl->rule_activity_update.dw, 0);
1096 	return 0;
1097 
1098 err_acl_ops_init:
1099 	mutex_destroy(&acl->rules_lock);
1100 	mlxsw_sp_fid_put(fid);
1101 err_fid_get:
1102 	rhashtable_destroy(&acl->ruleset_ht);
1103 err_rhashtable_init:
1104 	mlxsw_afk_destroy(acl->afk);
1105 err_afk_create:
1106 	kfree(acl);
1107 	return err;
1108 }
1109 
mlxsw_sp_acl_fini(struct mlxsw_sp * mlxsw_sp)1110 void mlxsw_sp_acl_fini(struct mlxsw_sp *mlxsw_sp)
1111 {
1112 	struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
1113 
1114 	cancel_delayed_work_sync(&mlxsw_sp->acl->rule_activity_update.dw);
1115 	mlxsw_sp_acl_tcam_fini(mlxsw_sp, &acl->tcam);
1116 	mutex_destroy(&acl->rules_lock);
1117 	WARN_ON(!list_empty(&acl->rules));
1118 	mlxsw_sp_fid_put(acl->dummy_fid);
1119 	rhashtable_destroy(&acl->ruleset_ht);
1120 	mlxsw_afk_destroy(acl->afk);
1121 	kfree(acl);
1122 }
1123 
1124 struct mlxsw_sp_acl_rulei_ops mlxsw_sp1_acl_rulei_ops = {
1125 	.act_mangle_field = mlxsw_sp1_acl_rulei_act_mangle_field,
1126 };
1127 
1128 struct mlxsw_sp_acl_rulei_ops mlxsw_sp2_acl_rulei_ops = {
1129 	.act_mangle_field = mlxsw_sp2_acl_rulei_act_mangle_field,
1130 };
1131