1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0 2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */ 3 4 #include <linux/kernel.h> 5 #include <linux/slab.h> 6 #include <linux/errno.h> 7 #include <linux/list.h> 8 #include <linux/string.h> 9 #include <linux/rhashtable.h> 10 #include <linux/netdevice.h> 11 #include <net/net_namespace.h> 12 #include <net/tc_act/tc_vlan.h> 13 14 #include "reg.h" 15 #include "core.h" 16 #include "resources.h" 17 #include "spectrum.h" 18 #include "core_acl_flex_keys.h" 19 #include "core_acl_flex_actions.h" 20 #include "spectrum_acl_tcam.h" 21 22 struct mlxsw_sp_acl { 23 struct mlxsw_sp *mlxsw_sp; 24 struct mlxsw_afk *afk; 25 struct mlxsw_sp_fid *dummy_fid; 26 struct rhashtable ruleset_ht; 27 struct list_head rules; 28 struct { 29 struct delayed_work dw; 30 unsigned long interval; /* ms */ 31 #define MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS 1000 32 } rule_activity_update; 33 struct mlxsw_sp_acl_tcam tcam; 34 }; 35 36 struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl) 37 { 38 return acl->afk; 39 } 40 41 struct mlxsw_sp_acl_block_binding { 42 struct list_head list; 43 struct net_device *dev; 44 struct mlxsw_sp_port *mlxsw_sp_port; 45 bool ingress; 46 }; 47 48 struct mlxsw_sp_acl_ruleset_ht_key { 49 struct mlxsw_sp_acl_block *block; 50 u32 chain_index; 51 const struct mlxsw_sp_acl_profile_ops *ops; 52 }; 53 54 struct mlxsw_sp_acl_ruleset { 55 struct rhash_head ht_node; /* Member of acl HT */ 56 struct mlxsw_sp_acl_ruleset_ht_key ht_key; 57 struct rhashtable rule_ht; 58 unsigned int ref_count; 59 unsigned long priv[0]; 60 /* priv has to be always the last item */ 61 }; 62 63 struct mlxsw_sp_acl_rule { 64 struct rhash_head ht_node; /* Member of rule HT */ 65 struct list_head list; 66 unsigned long cookie; /* HT key */ 67 struct mlxsw_sp_acl_ruleset *ruleset; 68 struct mlxsw_sp_acl_rule_info *rulei; 69 u64 last_used; 70 u64 last_packets; 71 u64 last_bytes; 72 unsigned long priv[0]; 73 /* priv has to be always the last item */ 74 }; 75 76 static const struct rhashtable_params mlxsw_sp_acl_ruleset_ht_params = { 77 .key_len = sizeof(struct mlxsw_sp_acl_ruleset_ht_key), 78 .key_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_key), 79 .head_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_node), 80 .automatic_shrinking = true, 81 }; 82 83 static const struct rhashtable_params mlxsw_sp_acl_rule_ht_params = { 84 .key_len = sizeof(unsigned long), 85 .key_offset = offsetof(struct mlxsw_sp_acl_rule, cookie), 86 .head_offset = offsetof(struct mlxsw_sp_acl_rule, ht_node), 87 .automatic_shrinking = true, 88 }; 89 90 struct mlxsw_sp_fid *mlxsw_sp_acl_dummy_fid(struct mlxsw_sp *mlxsw_sp) 91 { 92 return mlxsw_sp->acl->dummy_fid; 93 } 94 95 struct mlxsw_sp *mlxsw_sp_acl_block_mlxsw_sp(struct mlxsw_sp_acl_block *block) 96 { 97 return block->mlxsw_sp; 98 } 99 100 unsigned int mlxsw_sp_acl_block_rule_count(struct mlxsw_sp_acl_block *block) 101 { 102 return block ? block->rule_count : 0; 103 } 104 105 void mlxsw_sp_acl_block_disable_inc(struct mlxsw_sp_acl_block *block) 106 { 107 if (block) 108 block->disable_count++; 109 } 110 111 void mlxsw_sp_acl_block_disable_dec(struct mlxsw_sp_acl_block *block) 112 { 113 if (block) 114 block->disable_count--; 115 } 116 117 bool mlxsw_sp_acl_block_disabled(struct mlxsw_sp_acl_block *block) 118 { 119 return block->disable_count; 120 } 121 122 bool mlxsw_sp_acl_block_is_egress_bound(struct mlxsw_sp_acl_block *block) 123 { 124 struct mlxsw_sp_acl_block_binding *binding; 125 126 list_for_each_entry(binding, &block->binding_list, list) { 127 if (!binding->ingress) 128 return true; 129 } 130 return false; 131 } 132 133 static bool 134 mlxsw_sp_acl_ruleset_is_singular(const struct mlxsw_sp_acl_ruleset *ruleset) 135 { 136 /* We hold a reference on ruleset ourselves */ 137 return ruleset->ref_count == 2; 138 } 139 140 static int 141 mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp, 142 struct mlxsw_sp_acl_block *block, 143 struct mlxsw_sp_acl_block_binding *binding) 144 { 145 struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero; 146 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 147 148 return ops->ruleset_bind(mlxsw_sp, ruleset->priv, 149 binding->mlxsw_sp_port, binding->ingress); 150 } 151 152 static void 153 mlxsw_sp_acl_ruleset_unbind(struct mlxsw_sp *mlxsw_sp, 154 struct mlxsw_sp_acl_block *block, 155 struct mlxsw_sp_acl_block_binding *binding) 156 { 157 struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero; 158 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 159 160 ops->ruleset_unbind(mlxsw_sp, ruleset->priv, 161 binding->mlxsw_sp_port, binding->ingress); 162 } 163 164 static bool mlxsw_sp_acl_ruleset_block_bound(struct mlxsw_sp_acl_block *block) 165 { 166 return block->ruleset_zero; 167 } 168 169 static int 170 mlxsw_sp_acl_ruleset_block_bind(struct mlxsw_sp *mlxsw_sp, 171 struct mlxsw_sp_acl_ruleset *ruleset, 172 struct mlxsw_sp_acl_block *block) 173 { 174 struct mlxsw_sp_acl_block_binding *binding; 175 int err; 176 177 block->ruleset_zero = ruleset; 178 list_for_each_entry(binding, &block->binding_list, list) { 179 err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding); 180 if (err) 181 goto rollback; 182 } 183 return 0; 184 185 rollback: 186 list_for_each_entry_continue_reverse(binding, &block->binding_list, 187 list) 188 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding); 189 block->ruleset_zero = NULL; 190 191 return err; 192 } 193 194 static void 195 mlxsw_sp_acl_ruleset_block_unbind(struct mlxsw_sp *mlxsw_sp, 196 struct mlxsw_sp_acl_ruleset *ruleset, 197 struct mlxsw_sp_acl_block *block) 198 { 199 struct mlxsw_sp_acl_block_binding *binding; 200 201 list_for_each_entry(binding, &block->binding_list, list) 202 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding); 203 block->ruleset_zero = NULL; 204 } 205 206 struct mlxsw_sp_acl_block *mlxsw_sp_acl_block_create(struct mlxsw_sp *mlxsw_sp, 207 struct net *net) 208 { 209 struct mlxsw_sp_acl_block *block; 210 211 block = kzalloc(sizeof(*block), GFP_KERNEL); 212 if (!block) 213 return NULL; 214 INIT_LIST_HEAD(&block->binding_list); 215 block->mlxsw_sp = mlxsw_sp; 216 block->net = net; 217 return block; 218 } 219 220 void mlxsw_sp_acl_block_destroy(struct mlxsw_sp_acl_block *block) 221 { 222 WARN_ON(!list_empty(&block->binding_list)); 223 kfree(block); 224 } 225 226 static struct mlxsw_sp_acl_block_binding * 227 mlxsw_sp_acl_block_lookup(struct mlxsw_sp_acl_block *block, 228 struct mlxsw_sp_port *mlxsw_sp_port, bool ingress) 229 { 230 struct mlxsw_sp_acl_block_binding *binding; 231 232 list_for_each_entry(binding, &block->binding_list, list) 233 if (binding->mlxsw_sp_port == mlxsw_sp_port && 234 binding->ingress == ingress) 235 return binding; 236 return NULL; 237 } 238 239 int mlxsw_sp_acl_block_bind(struct mlxsw_sp *mlxsw_sp, 240 struct mlxsw_sp_acl_block *block, 241 struct mlxsw_sp_port *mlxsw_sp_port, 242 bool ingress, 243 struct netlink_ext_ack *extack) 244 { 245 struct mlxsw_sp_acl_block_binding *binding; 246 int err; 247 248 if (WARN_ON(mlxsw_sp_acl_block_lookup(block, mlxsw_sp_port, ingress))) 249 return -EEXIST; 250 251 if (!ingress && block->egress_blocker_rule_count) { 252 NL_SET_ERR_MSG_MOD(extack, "Block cannot be bound to egress because it contains unsupported rules"); 253 return -EOPNOTSUPP; 254 } 255 256 binding = kzalloc(sizeof(*binding), GFP_KERNEL); 257 if (!binding) 258 return -ENOMEM; 259 binding->mlxsw_sp_port = mlxsw_sp_port; 260 binding->ingress = ingress; 261 262 if (mlxsw_sp_acl_ruleset_block_bound(block)) { 263 err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding); 264 if (err) 265 goto err_ruleset_bind; 266 } 267 268 list_add(&binding->list, &block->binding_list); 269 return 0; 270 271 err_ruleset_bind: 272 kfree(binding); 273 return err; 274 } 275 276 int mlxsw_sp_acl_block_unbind(struct mlxsw_sp *mlxsw_sp, 277 struct mlxsw_sp_acl_block *block, 278 struct mlxsw_sp_port *mlxsw_sp_port, 279 bool ingress) 280 { 281 struct mlxsw_sp_acl_block_binding *binding; 282 283 binding = mlxsw_sp_acl_block_lookup(block, mlxsw_sp_port, ingress); 284 if (!binding) 285 return -ENOENT; 286 287 list_del(&binding->list); 288 289 if (mlxsw_sp_acl_ruleset_block_bound(block)) 290 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding); 291 292 kfree(binding); 293 return 0; 294 } 295 296 static struct mlxsw_sp_acl_ruleset * 297 mlxsw_sp_acl_ruleset_create(struct mlxsw_sp *mlxsw_sp, 298 struct mlxsw_sp_acl_block *block, u32 chain_index, 299 const struct mlxsw_sp_acl_profile_ops *ops, 300 struct mlxsw_afk_element_usage *tmplt_elusage) 301 { 302 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 303 struct mlxsw_sp_acl_ruleset *ruleset; 304 size_t alloc_size; 305 int err; 306 307 alloc_size = sizeof(*ruleset) + ops->ruleset_priv_size; 308 ruleset = kzalloc(alloc_size, GFP_KERNEL); 309 if (!ruleset) 310 return ERR_PTR(-ENOMEM); 311 ruleset->ref_count = 1; 312 ruleset->ht_key.block = block; 313 ruleset->ht_key.chain_index = chain_index; 314 ruleset->ht_key.ops = ops; 315 316 err = rhashtable_init(&ruleset->rule_ht, &mlxsw_sp_acl_rule_ht_params); 317 if (err) 318 goto err_rhashtable_init; 319 320 err = ops->ruleset_add(mlxsw_sp, &acl->tcam, ruleset->priv, 321 tmplt_elusage); 322 if (err) 323 goto err_ops_ruleset_add; 324 325 err = rhashtable_insert_fast(&acl->ruleset_ht, &ruleset->ht_node, 326 mlxsw_sp_acl_ruleset_ht_params); 327 if (err) 328 goto err_ht_insert; 329 330 return ruleset; 331 332 err_ht_insert: 333 ops->ruleset_del(mlxsw_sp, ruleset->priv); 334 err_ops_ruleset_add: 335 rhashtable_destroy(&ruleset->rule_ht); 336 err_rhashtable_init: 337 kfree(ruleset); 338 return ERR_PTR(err); 339 } 340 341 static void mlxsw_sp_acl_ruleset_destroy(struct mlxsw_sp *mlxsw_sp, 342 struct mlxsw_sp_acl_ruleset *ruleset) 343 { 344 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 345 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 346 347 rhashtable_remove_fast(&acl->ruleset_ht, &ruleset->ht_node, 348 mlxsw_sp_acl_ruleset_ht_params); 349 ops->ruleset_del(mlxsw_sp, ruleset->priv); 350 rhashtable_destroy(&ruleset->rule_ht); 351 kfree(ruleset); 352 } 353 354 static void mlxsw_sp_acl_ruleset_ref_inc(struct mlxsw_sp_acl_ruleset *ruleset) 355 { 356 ruleset->ref_count++; 357 } 358 359 static void mlxsw_sp_acl_ruleset_ref_dec(struct mlxsw_sp *mlxsw_sp, 360 struct mlxsw_sp_acl_ruleset *ruleset) 361 { 362 if (--ruleset->ref_count) 363 return; 364 mlxsw_sp_acl_ruleset_destroy(mlxsw_sp, ruleset); 365 } 366 367 static struct mlxsw_sp_acl_ruleset * 368 __mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp_acl *acl, 369 struct mlxsw_sp_acl_block *block, u32 chain_index, 370 const struct mlxsw_sp_acl_profile_ops *ops) 371 { 372 struct mlxsw_sp_acl_ruleset_ht_key ht_key; 373 374 memset(&ht_key, 0, sizeof(ht_key)); 375 ht_key.block = block; 376 ht_key.chain_index = chain_index; 377 ht_key.ops = ops; 378 return rhashtable_lookup_fast(&acl->ruleset_ht, &ht_key, 379 mlxsw_sp_acl_ruleset_ht_params); 380 } 381 382 struct mlxsw_sp_acl_ruleset * 383 mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp *mlxsw_sp, 384 struct mlxsw_sp_acl_block *block, u32 chain_index, 385 enum mlxsw_sp_acl_profile profile) 386 { 387 const struct mlxsw_sp_acl_profile_ops *ops; 388 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 389 struct mlxsw_sp_acl_ruleset *ruleset; 390 391 ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile); 392 if (!ops) 393 return ERR_PTR(-EINVAL); 394 ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops); 395 if (!ruleset) 396 return ERR_PTR(-ENOENT); 397 return ruleset; 398 } 399 400 struct mlxsw_sp_acl_ruleset * 401 mlxsw_sp_acl_ruleset_get(struct mlxsw_sp *mlxsw_sp, 402 struct mlxsw_sp_acl_block *block, u32 chain_index, 403 enum mlxsw_sp_acl_profile profile, 404 struct mlxsw_afk_element_usage *tmplt_elusage) 405 { 406 const struct mlxsw_sp_acl_profile_ops *ops; 407 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 408 struct mlxsw_sp_acl_ruleset *ruleset; 409 410 ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile); 411 if (!ops) 412 return ERR_PTR(-EINVAL); 413 414 ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops); 415 if (ruleset) { 416 mlxsw_sp_acl_ruleset_ref_inc(ruleset); 417 return ruleset; 418 } 419 return mlxsw_sp_acl_ruleset_create(mlxsw_sp, block, chain_index, ops, 420 tmplt_elusage); 421 } 422 423 void mlxsw_sp_acl_ruleset_put(struct mlxsw_sp *mlxsw_sp, 424 struct mlxsw_sp_acl_ruleset *ruleset) 425 { 426 mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset); 427 } 428 429 u16 mlxsw_sp_acl_ruleset_group_id(struct mlxsw_sp_acl_ruleset *ruleset) 430 { 431 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 432 433 return ops->ruleset_group_id(ruleset->priv); 434 } 435 436 struct mlxsw_sp_acl_rule_info * 437 mlxsw_sp_acl_rulei_create(struct mlxsw_sp_acl *acl, 438 struct mlxsw_afa_block *afa_block) 439 { 440 struct mlxsw_sp_acl_rule_info *rulei; 441 int err; 442 443 rulei = kzalloc(sizeof(*rulei), GFP_KERNEL); 444 if (!rulei) 445 return NULL; 446 447 if (afa_block) { 448 rulei->act_block = afa_block; 449 return rulei; 450 } 451 452 rulei->act_block = mlxsw_afa_block_create(acl->mlxsw_sp->afa); 453 if (IS_ERR(rulei->act_block)) { 454 err = PTR_ERR(rulei->act_block); 455 goto err_afa_block_create; 456 } 457 rulei->action_created = 1; 458 return rulei; 459 460 err_afa_block_create: 461 kfree(rulei); 462 return ERR_PTR(err); 463 } 464 465 void mlxsw_sp_acl_rulei_destroy(struct mlxsw_sp_acl_rule_info *rulei) 466 { 467 if (rulei->action_created) 468 mlxsw_afa_block_destroy(rulei->act_block); 469 kfree(rulei); 470 } 471 472 int mlxsw_sp_acl_rulei_commit(struct mlxsw_sp_acl_rule_info *rulei) 473 { 474 return mlxsw_afa_block_commit(rulei->act_block); 475 } 476 477 void mlxsw_sp_acl_rulei_priority(struct mlxsw_sp_acl_rule_info *rulei, 478 unsigned int priority) 479 { 480 rulei->priority = priority; 481 } 482 483 void mlxsw_sp_acl_rulei_keymask_u32(struct mlxsw_sp_acl_rule_info *rulei, 484 enum mlxsw_afk_element element, 485 u32 key_value, u32 mask_value) 486 { 487 mlxsw_afk_values_add_u32(&rulei->values, element, 488 key_value, mask_value); 489 } 490 491 void mlxsw_sp_acl_rulei_keymask_buf(struct mlxsw_sp_acl_rule_info *rulei, 492 enum mlxsw_afk_element element, 493 const char *key_value, 494 const char *mask_value, unsigned int len) 495 { 496 mlxsw_afk_values_add_buf(&rulei->values, element, 497 key_value, mask_value, len); 498 } 499 500 int mlxsw_sp_acl_rulei_act_continue(struct mlxsw_sp_acl_rule_info *rulei) 501 { 502 return mlxsw_afa_block_continue(rulei->act_block); 503 } 504 505 int mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info *rulei, 506 u16 group_id) 507 { 508 return mlxsw_afa_block_jump(rulei->act_block, group_id); 509 } 510 511 int mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info *rulei) 512 { 513 return mlxsw_afa_block_terminate(rulei->act_block); 514 } 515 516 int mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info *rulei) 517 { 518 return mlxsw_afa_block_append_drop(rulei->act_block); 519 } 520 521 int mlxsw_sp_acl_rulei_act_trap(struct mlxsw_sp_acl_rule_info *rulei) 522 { 523 return mlxsw_afa_block_append_trap(rulei->act_block, 524 MLXSW_TRAP_ID_ACL0); 525 } 526 527 int mlxsw_sp_acl_rulei_act_fwd(struct mlxsw_sp *mlxsw_sp, 528 struct mlxsw_sp_acl_rule_info *rulei, 529 struct net_device *out_dev, 530 struct netlink_ext_ack *extack) 531 { 532 struct mlxsw_sp_port *mlxsw_sp_port; 533 u8 local_port; 534 bool in_port; 535 536 if (out_dev) { 537 if (!mlxsw_sp_port_dev_check(out_dev)) { 538 NL_SET_ERR_MSG_MOD(extack, "Invalid output device"); 539 return -EINVAL; 540 } 541 mlxsw_sp_port = netdev_priv(out_dev); 542 if (mlxsw_sp_port->mlxsw_sp != mlxsw_sp) { 543 NL_SET_ERR_MSG_MOD(extack, "Invalid output device"); 544 return -EINVAL; 545 } 546 local_port = mlxsw_sp_port->local_port; 547 in_port = false; 548 } else { 549 /* If out_dev is NULL, the caller wants to 550 * set forward to ingress port. 551 */ 552 local_port = 0; 553 in_port = true; 554 } 555 return mlxsw_afa_block_append_fwd(rulei->act_block, 556 local_port, in_port, extack); 557 } 558 559 int mlxsw_sp_acl_rulei_act_mirror(struct mlxsw_sp *mlxsw_sp, 560 struct mlxsw_sp_acl_rule_info *rulei, 561 struct mlxsw_sp_acl_block *block, 562 struct net_device *out_dev, 563 struct netlink_ext_ack *extack) 564 { 565 struct mlxsw_sp_acl_block_binding *binding; 566 struct mlxsw_sp_port *in_port; 567 568 if (!list_is_singular(&block->binding_list)) { 569 NL_SET_ERR_MSG_MOD(extack, "Only a single mirror source is allowed"); 570 return -EOPNOTSUPP; 571 } 572 binding = list_first_entry(&block->binding_list, 573 struct mlxsw_sp_acl_block_binding, list); 574 in_port = binding->mlxsw_sp_port; 575 576 return mlxsw_afa_block_append_mirror(rulei->act_block, 577 in_port->local_port, 578 out_dev, 579 binding->ingress, 580 extack); 581 } 582 583 int mlxsw_sp_acl_rulei_act_vlan(struct mlxsw_sp *mlxsw_sp, 584 struct mlxsw_sp_acl_rule_info *rulei, 585 u32 action, u16 vid, u16 proto, u8 prio, 586 struct netlink_ext_ack *extack) 587 { 588 u8 ethertype; 589 590 if (action == FLOW_ACTION_VLAN_MANGLE) { 591 switch (proto) { 592 case ETH_P_8021Q: 593 ethertype = 0; 594 break; 595 case ETH_P_8021AD: 596 ethertype = 1; 597 break; 598 default: 599 NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN protocol"); 600 dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN protocol %#04x\n", 601 proto); 602 return -EINVAL; 603 } 604 605 return mlxsw_afa_block_append_vlan_modify(rulei->act_block, 606 vid, prio, ethertype, 607 extack); 608 } else { 609 NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN action"); 610 dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN action\n"); 611 return -EINVAL; 612 } 613 } 614 615 int mlxsw_sp_acl_rulei_act_count(struct mlxsw_sp *mlxsw_sp, 616 struct mlxsw_sp_acl_rule_info *rulei, 617 struct netlink_ext_ack *extack) 618 { 619 return mlxsw_afa_block_append_counter(rulei->act_block, 620 &rulei->counter_index, extack); 621 } 622 623 int mlxsw_sp_acl_rulei_act_fid_set(struct mlxsw_sp *mlxsw_sp, 624 struct mlxsw_sp_acl_rule_info *rulei, 625 u16 fid, struct netlink_ext_ack *extack) 626 { 627 return mlxsw_afa_block_append_fid_set(rulei->act_block, fid, extack); 628 } 629 630 struct mlxsw_sp_acl_rule * 631 mlxsw_sp_acl_rule_create(struct mlxsw_sp *mlxsw_sp, 632 struct mlxsw_sp_acl_ruleset *ruleset, 633 unsigned long cookie, 634 struct mlxsw_afa_block *afa_block, 635 struct netlink_ext_ack *extack) 636 { 637 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 638 struct mlxsw_sp_acl_rule *rule; 639 int err; 640 641 mlxsw_sp_acl_ruleset_ref_inc(ruleset); 642 rule = kzalloc(sizeof(*rule) + ops->rule_priv_size, 643 GFP_KERNEL); 644 if (!rule) { 645 err = -ENOMEM; 646 goto err_alloc; 647 } 648 rule->cookie = cookie; 649 rule->ruleset = ruleset; 650 651 rule->rulei = mlxsw_sp_acl_rulei_create(mlxsw_sp->acl, afa_block); 652 if (IS_ERR(rule->rulei)) { 653 err = PTR_ERR(rule->rulei); 654 goto err_rulei_create; 655 } 656 657 return rule; 658 659 err_rulei_create: 660 kfree(rule); 661 err_alloc: 662 mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset); 663 return ERR_PTR(err); 664 } 665 666 void mlxsw_sp_acl_rule_destroy(struct mlxsw_sp *mlxsw_sp, 667 struct mlxsw_sp_acl_rule *rule) 668 { 669 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 670 671 mlxsw_sp_acl_rulei_destroy(rule->rulei); 672 kfree(rule); 673 mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset); 674 } 675 676 int mlxsw_sp_acl_rule_add(struct mlxsw_sp *mlxsw_sp, 677 struct mlxsw_sp_acl_rule *rule) 678 { 679 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 680 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 681 struct mlxsw_sp_acl_block *block = ruleset->ht_key.block; 682 int err; 683 684 err = ops->rule_add(mlxsw_sp, ruleset->priv, rule->priv, rule->rulei); 685 if (err) 686 return err; 687 688 err = rhashtable_insert_fast(&ruleset->rule_ht, &rule->ht_node, 689 mlxsw_sp_acl_rule_ht_params); 690 if (err) 691 goto err_rhashtable_insert; 692 693 if (!ruleset->ht_key.chain_index && 694 mlxsw_sp_acl_ruleset_is_singular(ruleset)) { 695 /* We only need ruleset with chain index 0, the implicit 696 * one, to be directly bound to device. The rest of the 697 * rulesets are bound by "Goto action set". 698 */ 699 err = mlxsw_sp_acl_ruleset_block_bind(mlxsw_sp, ruleset, block); 700 if (err) 701 goto err_ruleset_block_bind; 702 } 703 704 list_add_tail(&rule->list, &mlxsw_sp->acl->rules); 705 block->rule_count++; 706 block->egress_blocker_rule_count += rule->rulei->egress_bind_blocker; 707 return 0; 708 709 err_ruleset_block_bind: 710 rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node, 711 mlxsw_sp_acl_rule_ht_params); 712 err_rhashtable_insert: 713 ops->rule_del(mlxsw_sp, rule->priv); 714 return err; 715 } 716 717 void mlxsw_sp_acl_rule_del(struct mlxsw_sp *mlxsw_sp, 718 struct mlxsw_sp_acl_rule *rule) 719 { 720 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 721 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 722 struct mlxsw_sp_acl_block *block = ruleset->ht_key.block; 723 724 block->egress_blocker_rule_count -= rule->rulei->egress_bind_blocker; 725 ruleset->ht_key.block->rule_count--; 726 list_del(&rule->list); 727 if (!ruleset->ht_key.chain_index && 728 mlxsw_sp_acl_ruleset_is_singular(ruleset)) 729 mlxsw_sp_acl_ruleset_block_unbind(mlxsw_sp, ruleset, 730 ruleset->ht_key.block); 731 rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node, 732 mlxsw_sp_acl_rule_ht_params); 733 ops->rule_del(mlxsw_sp, rule->priv); 734 } 735 736 int mlxsw_sp_acl_rule_action_replace(struct mlxsw_sp *mlxsw_sp, 737 struct mlxsw_sp_acl_rule *rule, 738 struct mlxsw_afa_block *afa_block) 739 { 740 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 741 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 742 struct mlxsw_sp_acl_rule_info *rulei; 743 744 rulei = mlxsw_sp_acl_rule_rulei(rule); 745 rulei->act_block = afa_block; 746 747 return ops->rule_action_replace(mlxsw_sp, rule->priv, rule->rulei); 748 } 749 750 struct mlxsw_sp_acl_rule * 751 mlxsw_sp_acl_rule_lookup(struct mlxsw_sp *mlxsw_sp, 752 struct mlxsw_sp_acl_ruleset *ruleset, 753 unsigned long cookie) 754 { 755 return rhashtable_lookup_fast(&ruleset->rule_ht, &cookie, 756 mlxsw_sp_acl_rule_ht_params); 757 } 758 759 struct mlxsw_sp_acl_rule_info * 760 mlxsw_sp_acl_rule_rulei(struct mlxsw_sp_acl_rule *rule) 761 { 762 return rule->rulei; 763 } 764 765 static int mlxsw_sp_acl_rule_activity_update(struct mlxsw_sp *mlxsw_sp, 766 struct mlxsw_sp_acl_rule *rule) 767 { 768 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 769 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 770 bool active; 771 int err; 772 773 err = ops->rule_activity_get(mlxsw_sp, rule->priv, &active); 774 if (err) 775 return err; 776 if (active) 777 rule->last_used = jiffies; 778 return 0; 779 } 780 781 static int mlxsw_sp_acl_rules_activity_update(struct mlxsw_sp_acl *acl) 782 { 783 struct mlxsw_sp_acl_rule *rule; 784 int err; 785 786 /* Protect internal structures from changes */ 787 rtnl_lock(); 788 list_for_each_entry(rule, &acl->rules, list) { 789 err = mlxsw_sp_acl_rule_activity_update(acl->mlxsw_sp, 790 rule); 791 if (err) 792 goto err_rule_update; 793 } 794 rtnl_unlock(); 795 return 0; 796 797 err_rule_update: 798 rtnl_unlock(); 799 return err; 800 } 801 802 static void mlxsw_sp_acl_rule_activity_work_schedule(struct mlxsw_sp_acl *acl) 803 { 804 unsigned long interval = acl->rule_activity_update.interval; 805 806 mlxsw_core_schedule_dw(&acl->rule_activity_update.dw, 807 msecs_to_jiffies(interval)); 808 } 809 810 static void mlxsw_sp_acl_rule_activity_update_work(struct work_struct *work) 811 { 812 struct mlxsw_sp_acl *acl = container_of(work, struct mlxsw_sp_acl, 813 rule_activity_update.dw.work); 814 int err; 815 816 err = mlxsw_sp_acl_rules_activity_update(acl); 817 if (err) 818 dev_err(acl->mlxsw_sp->bus_info->dev, "Could not update acl activity"); 819 820 mlxsw_sp_acl_rule_activity_work_schedule(acl); 821 } 822 823 int mlxsw_sp_acl_rule_get_stats(struct mlxsw_sp *mlxsw_sp, 824 struct mlxsw_sp_acl_rule *rule, 825 u64 *packets, u64 *bytes, u64 *last_use) 826 827 { 828 struct mlxsw_sp_acl_rule_info *rulei; 829 u64 current_packets; 830 u64 current_bytes; 831 int err; 832 833 rulei = mlxsw_sp_acl_rule_rulei(rule); 834 err = mlxsw_sp_flow_counter_get(mlxsw_sp, rulei->counter_index, 835 ¤t_packets, ¤t_bytes); 836 if (err) 837 return err; 838 839 *packets = current_packets - rule->last_packets; 840 *bytes = current_bytes - rule->last_bytes; 841 *last_use = rule->last_used; 842 843 rule->last_bytes = current_bytes; 844 rule->last_packets = current_packets; 845 846 return 0; 847 } 848 849 int mlxsw_sp_acl_init(struct mlxsw_sp *mlxsw_sp) 850 { 851 struct mlxsw_sp_fid *fid; 852 struct mlxsw_sp_acl *acl; 853 size_t alloc_size; 854 int err; 855 856 alloc_size = sizeof(*acl) + mlxsw_sp_acl_tcam_priv_size(mlxsw_sp); 857 acl = kzalloc(alloc_size, GFP_KERNEL); 858 if (!acl) 859 return -ENOMEM; 860 mlxsw_sp->acl = acl; 861 acl->mlxsw_sp = mlxsw_sp; 862 acl->afk = mlxsw_afk_create(MLXSW_CORE_RES_GET(mlxsw_sp->core, 863 ACL_FLEX_KEYS), 864 mlxsw_sp->afk_ops); 865 if (!acl->afk) { 866 err = -ENOMEM; 867 goto err_afk_create; 868 } 869 870 err = rhashtable_init(&acl->ruleset_ht, 871 &mlxsw_sp_acl_ruleset_ht_params); 872 if (err) 873 goto err_rhashtable_init; 874 875 fid = mlxsw_sp_fid_dummy_get(mlxsw_sp); 876 if (IS_ERR(fid)) { 877 err = PTR_ERR(fid); 878 goto err_fid_get; 879 } 880 acl->dummy_fid = fid; 881 882 INIT_LIST_HEAD(&acl->rules); 883 err = mlxsw_sp_acl_tcam_init(mlxsw_sp, &acl->tcam); 884 if (err) 885 goto err_acl_ops_init; 886 887 /* Create the delayed work for the rule activity_update */ 888 INIT_DELAYED_WORK(&acl->rule_activity_update.dw, 889 mlxsw_sp_acl_rule_activity_update_work); 890 acl->rule_activity_update.interval = MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS; 891 mlxsw_core_schedule_dw(&acl->rule_activity_update.dw, 0); 892 return 0; 893 894 err_acl_ops_init: 895 mlxsw_sp_fid_put(fid); 896 err_fid_get: 897 rhashtable_destroy(&acl->ruleset_ht); 898 err_rhashtable_init: 899 mlxsw_afk_destroy(acl->afk); 900 err_afk_create: 901 kfree(acl); 902 return err; 903 } 904 905 void mlxsw_sp_acl_fini(struct mlxsw_sp *mlxsw_sp) 906 { 907 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 908 909 cancel_delayed_work_sync(&mlxsw_sp->acl->rule_activity_update.dw); 910 mlxsw_sp_acl_tcam_fini(mlxsw_sp, &acl->tcam); 911 WARN_ON(!list_empty(&acl->rules)); 912 mlxsw_sp_fid_put(acl->dummy_fid); 913 rhashtable_destroy(&acl->ruleset_ht); 914 mlxsw_afk_destroy(acl->afk); 915 kfree(acl); 916 } 917 918 u32 mlxsw_sp_acl_region_rehash_intrvl_get(struct mlxsw_sp *mlxsw_sp) 919 { 920 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 921 922 return mlxsw_sp_acl_tcam_vregion_rehash_intrvl_get(mlxsw_sp, 923 &acl->tcam); 924 } 925 926 int mlxsw_sp_acl_region_rehash_intrvl_set(struct mlxsw_sp *mlxsw_sp, u32 val) 927 { 928 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 929 930 return mlxsw_sp_acl_tcam_vregion_rehash_intrvl_set(mlxsw_sp, 931 &acl->tcam, val); 932 } 933