1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0 2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */ 3 4 #include <linux/kernel.h> 5 #include <linux/slab.h> 6 #include <linux/errno.h> 7 #include <linux/list.h> 8 #include <linux/string.h> 9 #include <linux/rhashtable.h> 10 #include <linux/netdevice.h> 11 #include <net/net_namespace.h> 12 #include <net/tc_act/tc_vlan.h> 13 14 #include "reg.h" 15 #include "core.h" 16 #include "resources.h" 17 #include "spectrum.h" 18 #include "core_acl_flex_keys.h" 19 #include "core_acl_flex_actions.h" 20 #include "spectrum_acl_tcam.h" 21 22 struct mlxsw_sp_acl { 23 struct mlxsw_sp *mlxsw_sp; 24 struct mlxsw_afk *afk; 25 struct mlxsw_sp_fid *dummy_fid; 26 struct rhashtable ruleset_ht; 27 struct list_head rules; 28 struct { 29 struct delayed_work dw; 30 unsigned long interval; /* ms */ 31 #define MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS 1000 32 } rule_activity_update; 33 struct mlxsw_sp_acl_tcam tcam; 34 }; 35 36 struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl) 37 { 38 return acl->afk; 39 } 40 41 struct mlxsw_sp_acl_block_binding { 42 struct list_head list; 43 struct net_device *dev; 44 struct mlxsw_sp_port *mlxsw_sp_port; 45 bool ingress; 46 }; 47 48 struct mlxsw_sp_acl_block { 49 struct list_head binding_list; 50 struct mlxsw_sp_acl_ruleset *ruleset_zero; 51 struct mlxsw_sp *mlxsw_sp; 52 unsigned int rule_count; 53 unsigned int disable_count; 54 }; 55 56 struct mlxsw_sp_acl_ruleset_ht_key { 57 struct mlxsw_sp_acl_block *block; 58 u32 chain_index; 59 const struct mlxsw_sp_acl_profile_ops *ops; 60 }; 61 62 struct mlxsw_sp_acl_ruleset { 63 struct rhash_head ht_node; /* Member of acl HT */ 64 struct mlxsw_sp_acl_ruleset_ht_key ht_key; 65 struct rhashtable rule_ht; 66 unsigned int ref_count; 67 unsigned long priv[0]; 68 /* priv has to be always the last item */ 69 }; 70 71 struct mlxsw_sp_acl_rule { 72 struct rhash_head ht_node; /* Member of rule HT */ 73 struct list_head list; 74 unsigned long cookie; /* HT key */ 75 struct mlxsw_sp_acl_ruleset *ruleset; 76 struct mlxsw_sp_acl_rule_info *rulei; 77 u64 last_used; 78 u64 last_packets; 79 u64 last_bytes; 80 unsigned long priv[0]; 81 /* priv has to be always the last item */ 82 }; 83 84 static const struct rhashtable_params mlxsw_sp_acl_ruleset_ht_params = { 85 .key_len = sizeof(struct mlxsw_sp_acl_ruleset_ht_key), 86 .key_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_key), 87 .head_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_node), 88 .automatic_shrinking = true, 89 }; 90 91 static const struct rhashtable_params mlxsw_sp_acl_rule_ht_params = { 92 .key_len = sizeof(unsigned long), 93 .key_offset = offsetof(struct mlxsw_sp_acl_rule, cookie), 94 .head_offset = offsetof(struct mlxsw_sp_acl_rule, ht_node), 95 .automatic_shrinking = true, 96 }; 97 98 struct mlxsw_sp_fid *mlxsw_sp_acl_dummy_fid(struct mlxsw_sp *mlxsw_sp) 99 { 100 return mlxsw_sp->acl->dummy_fid; 101 } 102 103 struct mlxsw_sp *mlxsw_sp_acl_block_mlxsw_sp(struct mlxsw_sp_acl_block *block) 104 { 105 return block->mlxsw_sp; 106 } 107 108 unsigned int mlxsw_sp_acl_block_rule_count(struct mlxsw_sp_acl_block *block) 109 { 110 return block ? block->rule_count : 0; 111 } 112 113 void mlxsw_sp_acl_block_disable_inc(struct mlxsw_sp_acl_block *block) 114 { 115 if (block) 116 block->disable_count++; 117 } 118 119 void mlxsw_sp_acl_block_disable_dec(struct mlxsw_sp_acl_block *block) 120 { 121 if (block) 122 block->disable_count--; 123 } 124 125 bool mlxsw_sp_acl_block_disabled(struct mlxsw_sp_acl_block *block) 126 { 127 return block->disable_count; 128 } 129 130 bool mlxsw_sp_acl_block_is_egress_bound(struct mlxsw_sp_acl_block *block) 131 { 132 struct mlxsw_sp_acl_block_binding *binding; 133 134 list_for_each_entry(binding, &block->binding_list, list) { 135 if (!binding->ingress) 136 return true; 137 } 138 return false; 139 } 140 141 static bool 142 mlxsw_sp_acl_ruleset_is_singular(const struct mlxsw_sp_acl_ruleset *ruleset) 143 { 144 /* We hold a reference on ruleset ourselves */ 145 return ruleset->ref_count == 2; 146 } 147 148 static int 149 mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp, 150 struct mlxsw_sp_acl_block *block, 151 struct mlxsw_sp_acl_block_binding *binding) 152 { 153 struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero; 154 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 155 156 return ops->ruleset_bind(mlxsw_sp, ruleset->priv, 157 binding->mlxsw_sp_port, binding->ingress); 158 } 159 160 static void 161 mlxsw_sp_acl_ruleset_unbind(struct mlxsw_sp *mlxsw_sp, 162 struct mlxsw_sp_acl_block *block, 163 struct mlxsw_sp_acl_block_binding *binding) 164 { 165 struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero; 166 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 167 168 ops->ruleset_unbind(mlxsw_sp, ruleset->priv, 169 binding->mlxsw_sp_port, binding->ingress); 170 } 171 172 static bool mlxsw_sp_acl_ruleset_block_bound(struct mlxsw_sp_acl_block *block) 173 { 174 return block->ruleset_zero; 175 } 176 177 static int 178 mlxsw_sp_acl_ruleset_block_bind(struct mlxsw_sp *mlxsw_sp, 179 struct mlxsw_sp_acl_ruleset *ruleset, 180 struct mlxsw_sp_acl_block *block) 181 { 182 struct mlxsw_sp_acl_block_binding *binding; 183 int err; 184 185 block->ruleset_zero = ruleset; 186 list_for_each_entry(binding, &block->binding_list, list) { 187 err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding); 188 if (err) 189 goto rollback; 190 } 191 return 0; 192 193 rollback: 194 list_for_each_entry_continue_reverse(binding, &block->binding_list, 195 list) 196 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding); 197 block->ruleset_zero = NULL; 198 199 return err; 200 } 201 202 static void 203 mlxsw_sp_acl_ruleset_block_unbind(struct mlxsw_sp *mlxsw_sp, 204 struct mlxsw_sp_acl_ruleset *ruleset, 205 struct mlxsw_sp_acl_block *block) 206 { 207 struct mlxsw_sp_acl_block_binding *binding; 208 209 list_for_each_entry(binding, &block->binding_list, list) 210 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding); 211 block->ruleset_zero = NULL; 212 } 213 214 struct mlxsw_sp_acl_block *mlxsw_sp_acl_block_create(struct mlxsw_sp *mlxsw_sp, 215 struct net *net) 216 { 217 struct mlxsw_sp_acl_block *block; 218 219 block = kzalloc(sizeof(*block), GFP_KERNEL); 220 if (!block) 221 return NULL; 222 INIT_LIST_HEAD(&block->binding_list); 223 block->mlxsw_sp = mlxsw_sp; 224 return block; 225 } 226 227 void mlxsw_sp_acl_block_destroy(struct mlxsw_sp_acl_block *block) 228 { 229 WARN_ON(!list_empty(&block->binding_list)); 230 kfree(block); 231 } 232 233 static struct mlxsw_sp_acl_block_binding * 234 mlxsw_sp_acl_block_lookup(struct mlxsw_sp_acl_block *block, 235 struct mlxsw_sp_port *mlxsw_sp_port, bool ingress) 236 { 237 struct mlxsw_sp_acl_block_binding *binding; 238 239 list_for_each_entry(binding, &block->binding_list, list) 240 if (binding->mlxsw_sp_port == mlxsw_sp_port && 241 binding->ingress == ingress) 242 return binding; 243 return NULL; 244 } 245 246 int mlxsw_sp_acl_block_bind(struct mlxsw_sp *mlxsw_sp, 247 struct mlxsw_sp_acl_block *block, 248 struct mlxsw_sp_port *mlxsw_sp_port, 249 bool ingress) 250 { 251 struct mlxsw_sp_acl_block_binding *binding; 252 int err; 253 254 if (WARN_ON(mlxsw_sp_acl_block_lookup(block, mlxsw_sp_port, ingress))) 255 return -EEXIST; 256 257 binding = kzalloc(sizeof(*binding), GFP_KERNEL); 258 if (!binding) 259 return -ENOMEM; 260 binding->mlxsw_sp_port = mlxsw_sp_port; 261 binding->ingress = ingress; 262 263 if (mlxsw_sp_acl_ruleset_block_bound(block)) { 264 err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding); 265 if (err) 266 goto err_ruleset_bind; 267 } 268 269 list_add(&binding->list, &block->binding_list); 270 return 0; 271 272 err_ruleset_bind: 273 kfree(binding); 274 return err; 275 } 276 277 int mlxsw_sp_acl_block_unbind(struct mlxsw_sp *mlxsw_sp, 278 struct mlxsw_sp_acl_block *block, 279 struct mlxsw_sp_port *mlxsw_sp_port, 280 bool ingress) 281 { 282 struct mlxsw_sp_acl_block_binding *binding; 283 284 binding = mlxsw_sp_acl_block_lookup(block, mlxsw_sp_port, ingress); 285 if (!binding) 286 return -ENOENT; 287 288 list_del(&binding->list); 289 290 if (mlxsw_sp_acl_ruleset_block_bound(block)) 291 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding); 292 293 kfree(binding); 294 return 0; 295 } 296 297 static struct mlxsw_sp_acl_ruleset * 298 mlxsw_sp_acl_ruleset_create(struct mlxsw_sp *mlxsw_sp, 299 struct mlxsw_sp_acl_block *block, u32 chain_index, 300 const struct mlxsw_sp_acl_profile_ops *ops, 301 struct mlxsw_afk_element_usage *tmplt_elusage) 302 { 303 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 304 struct mlxsw_sp_acl_ruleset *ruleset; 305 size_t alloc_size; 306 int err; 307 308 alloc_size = sizeof(*ruleset) + ops->ruleset_priv_size; 309 ruleset = kzalloc(alloc_size, GFP_KERNEL); 310 if (!ruleset) 311 return ERR_PTR(-ENOMEM); 312 ruleset->ref_count = 1; 313 ruleset->ht_key.block = block; 314 ruleset->ht_key.chain_index = chain_index; 315 ruleset->ht_key.ops = ops; 316 317 err = rhashtable_init(&ruleset->rule_ht, &mlxsw_sp_acl_rule_ht_params); 318 if (err) 319 goto err_rhashtable_init; 320 321 err = ops->ruleset_add(mlxsw_sp, &acl->tcam, ruleset->priv, 322 tmplt_elusage); 323 if (err) 324 goto err_ops_ruleset_add; 325 326 err = rhashtable_insert_fast(&acl->ruleset_ht, &ruleset->ht_node, 327 mlxsw_sp_acl_ruleset_ht_params); 328 if (err) 329 goto err_ht_insert; 330 331 return ruleset; 332 333 err_ht_insert: 334 ops->ruleset_del(mlxsw_sp, ruleset->priv); 335 err_ops_ruleset_add: 336 rhashtable_destroy(&ruleset->rule_ht); 337 err_rhashtable_init: 338 kfree(ruleset); 339 return ERR_PTR(err); 340 } 341 342 static void mlxsw_sp_acl_ruleset_destroy(struct mlxsw_sp *mlxsw_sp, 343 struct mlxsw_sp_acl_ruleset *ruleset) 344 { 345 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 346 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 347 348 rhashtable_remove_fast(&acl->ruleset_ht, &ruleset->ht_node, 349 mlxsw_sp_acl_ruleset_ht_params); 350 ops->ruleset_del(mlxsw_sp, ruleset->priv); 351 rhashtable_destroy(&ruleset->rule_ht); 352 kfree(ruleset); 353 } 354 355 static void mlxsw_sp_acl_ruleset_ref_inc(struct mlxsw_sp_acl_ruleset *ruleset) 356 { 357 ruleset->ref_count++; 358 } 359 360 static void mlxsw_sp_acl_ruleset_ref_dec(struct mlxsw_sp *mlxsw_sp, 361 struct mlxsw_sp_acl_ruleset *ruleset) 362 { 363 if (--ruleset->ref_count) 364 return; 365 mlxsw_sp_acl_ruleset_destroy(mlxsw_sp, ruleset); 366 } 367 368 static struct mlxsw_sp_acl_ruleset * 369 __mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp_acl *acl, 370 struct mlxsw_sp_acl_block *block, u32 chain_index, 371 const struct mlxsw_sp_acl_profile_ops *ops) 372 { 373 struct mlxsw_sp_acl_ruleset_ht_key ht_key; 374 375 memset(&ht_key, 0, sizeof(ht_key)); 376 ht_key.block = block; 377 ht_key.chain_index = chain_index; 378 ht_key.ops = ops; 379 return rhashtable_lookup_fast(&acl->ruleset_ht, &ht_key, 380 mlxsw_sp_acl_ruleset_ht_params); 381 } 382 383 struct mlxsw_sp_acl_ruleset * 384 mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp *mlxsw_sp, 385 struct mlxsw_sp_acl_block *block, u32 chain_index, 386 enum mlxsw_sp_acl_profile profile) 387 { 388 const struct mlxsw_sp_acl_profile_ops *ops; 389 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 390 struct mlxsw_sp_acl_ruleset *ruleset; 391 392 ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile); 393 if (!ops) 394 return ERR_PTR(-EINVAL); 395 ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops); 396 if (!ruleset) 397 return ERR_PTR(-ENOENT); 398 return ruleset; 399 } 400 401 struct mlxsw_sp_acl_ruleset * 402 mlxsw_sp_acl_ruleset_get(struct mlxsw_sp *mlxsw_sp, 403 struct mlxsw_sp_acl_block *block, u32 chain_index, 404 enum mlxsw_sp_acl_profile profile, 405 struct mlxsw_afk_element_usage *tmplt_elusage) 406 { 407 const struct mlxsw_sp_acl_profile_ops *ops; 408 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 409 struct mlxsw_sp_acl_ruleset *ruleset; 410 411 ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile); 412 if (!ops) 413 return ERR_PTR(-EINVAL); 414 415 ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops); 416 if (ruleset) { 417 mlxsw_sp_acl_ruleset_ref_inc(ruleset); 418 return ruleset; 419 } 420 return mlxsw_sp_acl_ruleset_create(mlxsw_sp, block, chain_index, ops, 421 tmplt_elusage); 422 } 423 424 void mlxsw_sp_acl_ruleset_put(struct mlxsw_sp *mlxsw_sp, 425 struct mlxsw_sp_acl_ruleset *ruleset) 426 { 427 mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset); 428 } 429 430 u16 mlxsw_sp_acl_ruleset_group_id(struct mlxsw_sp_acl_ruleset *ruleset) 431 { 432 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 433 434 return ops->ruleset_group_id(ruleset->priv); 435 } 436 437 struct mlxsw_sp_acl_rule_info * 438 mlxsw_sp_acl_rulei_create(struct mlxsw_sp_acl *acl, 439 struct mlxsw_afa_block *afa_block) 440 { 441 struct mlxsw_sp_acl_rule_info *rulei; 442 int err; 443 444 rulei = kzalloc(sizeof(*rulei), GFP_KERNEL); 445 if (!rulei) 446 return NULL; 447 448 if (afa_block) { 449 rulei->act_block = afa_block; 450 return rulei; 451 } 452 453 rulei->act_block = mlxsw_afa_block_create(acl->mlxsw_sp->afa); 454 if (IS_ERR(rulei->act_block)) { 455 err = PTR_ERR(rulei->act_block); 456 goto err_afa_block_create; 457 } 458 rulei->action_created = 1; 459 return rulei; 460 461 err_afa_block_create: 462 kfree(rulei); 463 return ERR_PTR(err); 464 } 465 466 void mlxsw_sp_acl_rulei_destroy(struct mlxsw_sp_acl_rule_info *rulei) 467 { 468 if (rulei->action_created) 469 mlxsw_afa_block_destroy(rulei->act_block); 470 kfree(rulei); 471 } 472 473 int mlxsw_sp_acl_rulei_commit(struct mlxsw_sp_acl_rule_info *rulei) 474 { 475 return mlxsw_afa_block_commit(rulei->act_block); 476 } 477 478 void mlxsw_sp_acl_rulei_priority(struct mlxsw_sp_acl_rule_info *rulei, 479 unsigned int priority) 480 { 481 rulei->priority = priority >> 16; 482 } 483 484 void mlxsw_sp_acl_rulei_keymask_u32(struct mlxsw_sp_acl_rule_info *rulei, 485 enum mlxsw_afk_element element, 486 u32 key_value, u32 mask_value) 487 { 488 mlxsw_afk_values_add_u32(&rulei->values, element, 489 key_value, mask_value); 490 } 491 492 void mlxsw_sp_acl_rulei_keymask_buf(struct mlxsw_sp_acl_rule_info *rulei, 493 enum mlxsw_afk_element element, 494 const char *key_value, 495 const char *mask_value, unsigned int len) 496 { 497 mlxsw_afk_values_add_buf(&rulei->values, element, 498 key_value, mask_value, len); 499 } 500 501 int mlxsw_sp_acl_rulei_act_continue(struct mlxsw_sp_acl_rule_info *rulei) 502 { 503 return mlxsw_afa_block_continue(rulei->act_block); 504 } 505 506 int mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info *rulei, 507 u16 group_id) 508 { 509 return mlxsw_afa_block_jump(rulei->act_block, group_id); 510 } 511 512 int mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info *rulei) 513 { 514 return mlxsw_afa_block_terminate(rulei->act_block); 515 } 516 517 int mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info *rulei) 518 { 519 return mlxsw_afa_block_append_drop(rulei->act_block); 520 } 521 522 int mlxsw_sp_acl_rulei_act_trap(struct mlxsw_sp_acl_rule_info *rulei) 523 { 524 return mlxsw_afa_block_append_trap(rulei->act_block, 525 MLXSW_TRAP_ID_ACL0); 526 } 527 528 int mlxsw_sp_acl_rulei_act_fwd(struct mlxsw_sp *mlxsw_sp, 529 struct mlxsw_sp_acl_rule_info *rulei, 530 struct net_device *out_dev, 531 struct netlink_ext_ack *extack) 532 { 533 struct mlxsw_sp_port *mlxsw_sp_port; 534 u8 local_port; 535 bool in_port; 536 537 if (out_dev) { 538 if (!mlxsw_sp_port_dev_check(out_dev)) { 539 NL_SET_ERR_MSG_MOD(extack, "Invalid output device"); 540 return -EINVAL; 541 } 542 mlxsw_sp_port = netdev_priv(out_dev); 543 if (mlxsw_sp_port->mlxsw_sp != mlxsw_sp) { 544 NL_SET_ERR_MSG_MOD(extack, "Invalid output device"); 545 return -EINVAL; 546 } 547 local_port = mlxsw_sp_port->local_port; 548 in_port = false; 549 } else { 550 /* If out_dev is NULL, the caller wants to 551 * set forward to ingress port. 552 */ 553 local_port = 0; 554 in_port = true; 555 } 556 return mlxsw_afa_block_append_fwd(rulei->act_block, 557 local_port, in_port, extack); 558 } 559 560 int mlxsw_sp_acl_rulei_act_mirror(struct mlxsw_sp *mlxsw_sp, 561 struct mlxsw_sp_acl_rule_info *rulei, 562 struct mlxsw_sp_acl_block *block, 563 struct net_device *out_dev, 564 struct netlink_ext_ack *extack) 565 { 566 struct mlxsw_sp_acl_block_binding *binding; 567 struct mlxsw_sp_port *in_port; 568 569 if (!list_is_singular(&block->binding_list)) { 570 NL_SET_ERR_MSG_MOD(extack, "Only a single mirror source is allowed"); 571 return -EOPNOTSUPP; 572 } 573 binding = list_first_entry(&block->binding_list, 574 struct mlxsw_sp_acl_block_binding, list); 575 in_port = binding->mlxsw_sp_port; 576 577 return mlxsw_afa_block_append_mirror(rulei->act_block, 578 in_port->local_port, 579 out_dev, 580 binding->ingress, 581 extack); 582 } 583 584 int mlxsw_sp_acl_rulei_act_vlan(struct mlxsw_sp *mlxsw_sp, 585 struct mlxsw_sp_acl_rule_info *rulei, 586 u32 action, u16 vid, u16 proto, u8 prio, 587 struct netlink_ext_ack *extack) 588 { 589 u8 ethertype; 590 591 if (action == TCA_VLAN_ACT_MODIFY) { 592 switch (proto) { 593 case ETH_P_8021Q: 594 ethertype = 0; 595 break; 596 case ETH_P_8021AD: 597 ethertype = 1; 598 break; 599 default: 600 NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN protocol"); 601 dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN protocol %#04x\n", 602 proto); 603 return -EINVAL; 604 } 605 606 return mlxsw_afa_block_append_vlan_modify(rulei->act_block, 607 vid, prio, ethertype, 608 extack); 609 } else { 610 NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN action"); 611 dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN action\n"); 612 return -EINVAL; 613 } 614 } 615 616 int mlxsw_sp_acl_rulei_act_count(struct mlxsw_sp *mlxsw_sp, 617 struct mlxsw_sp_acl_rule_info *rulei, 618 struct netlink_ext_ack *extack) 619 { 620 return mlxsw_afa_block_append_counter(rulei->act_block, 621 &rulei->counter_index, extack); 622 } 623 624 int mlxsw_sp_acl_rulei_act_fid_set(struct mlxsw_sp *mlxsw_sp, 625 struct mlxsw_sp_acl_rule_info *rulei, 626 u16 fid, struct netlink_ext_ack *extack) 627 { 628 return mlxsw_afa_block_append_fid_set(rulei->act_block, fid, extack); 629 } 630 631 struct mlxsw_sp_acl_rule * 632 mlxsw_sp_acl_rule_create(struct mlxsw_sp *mlxsw_sp, 633 struct mlxsw_sp_acl_ruleset *ruleset, 634 unsigned long cookie, 635 struct mlxsw_afa_block *afa_block, 636 struct netlink_ext_ack *extack) 637 { 638 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 639 struct mlxsw_sp_acl_rule *rule; 640 int err; 641 642 mlxsw_sp_acl_ruleset_ref_inc(ruleset); 643 rule = kzalloc(sizeof(*rule) + ops->rule_priv_size(mlxsw_sp), 644 GFP_KERNEL); 645 if (!rule) { 646 err = -ENOMEM; 647 goto err_alloc; 648 } 649 rule->cookie = cookie; 650 rule->ruleset = ruleset; 651 652 rule->rulei = mlxsw_sp_acl_rulei_create(mlxsw_sp->acl, afa_block); 653 if (IS_ERR(rule->rulei)) { 654 err = PTR_ERR(rule->rulei); 655 goto err_rulei_create; 656 } 657 658 return rule; 659 660 err_rulei_create: 661 kfree(rule); 662 err_alloc: 663 mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset); 664 return ERR_PTR(err); 665 } 666 667 void mlxsw_sp_acl_rule_destroy(struct mlxsw_sp *mlxsw_sp, 668 struct mlxsw_sp_acl_rule *rule) 669 { 670 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 671 672 mlxsw_sp_acl_rulei_destroy(rule->rulei); 673 kfree(rule); 674 mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset); 675 } 676 677 int mlxsw_sp_acl_rule_add(struct mlxsw_sp *mlxsw_sp, 678 struct mlxsw_sp_acl_rule *rule) 679 { 680 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 681 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 682 int err; 683 684 err = ops->rule_add(mlxsw_sp, ruleset->priv, rule->priv, rule->rulei); 685 if (err) 686 return err; 687 688 err = rhashtable_insert_fast(&ruleset->rule_ht, &rule->ht_node, 689 mlxsw_sp_acl_rule_ht_params); 690 if (err) 691 goto err_rhashtable_insert; 692 693 if (!ruleset->ht_key.chain_index && 694 mlxsw_sp_acl_ruleset_is_singular(ruleset)) { 695 /* We only need ruleset with chain index 0, the implicit 696 * one, to be directly bound to device. The rest of the 697 * rulesets are bound by "Goto action set". 698 */ 699 err = mlxsw_sp_acl_ruleset_block_bind(mlxsw_sp, ruleset, 700 ruleset->ht_key.block); 701 if (err) 702 goto err_ruleset_block_bind; 703 } 704 705 list_add_tail(&rule->list, &mlxsw_sp->acl->rules); 706 ruleset->ht_key.block->rule_count++; 707 return 0; 708 709 err_ruleset_block_bind: 710 rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node, 711 mlxsw_sp_acl_rule_ht_params); 712 err_rhashtable_insert: 713 ops->rule_del(mlxsw_sp, rule->priv); 714 return err; 715 } 716 717 void mlxsw_sp_acl_rule_del(struct mlxsw_sp *mlxsw_sp, 718 struct mlxsw_sp_acl_rule *rule) 719 { 720 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 721 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 722 723 ruleset->ht_key.block->rule_count--; 724 list_del(&rule->list); 725 if (!ruleset->ht_key.chain_index && 726 mlxsw_sp_acl_ruleset_is_singular(ruleset)) 727 mlxsw_sp_acl_ruleset_block_unbind(mlxsw_sp, ruleset, 728 ruleset->ht_key.block); 729 rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node, 730 mlxsw_sp_acl_rule_ht_params); 731 ops->rule_del(mlxsw_sp, rule->priv); 732 } 733 734 int mlxsw_sp_acl_rule_action_replace(struct mlxsw_sp *mlxsw_sp, 735 struct mlxsw_sp_acl_rule *rule, 736 struct mlxsw_afa_block *afa_block) 737 { 738 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 739 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 740 struct mlxsw_sp_acl_rule_info *rulei; 741 742 rulei = mlxsw_sp_acl_rule_rulei(rule); 743 rulei->act_block = afa_block; 744 745 return ops->rule_action_replace(mlxsw_sp, ruleset->priv, rule->priv, 746 rule->rulei); 747 } 748 749 struct mlxsw_sp_acl_rule * 750 mlxsw_sp_acl_rule_lookup(struct mlxsw_sp *mlxsw_sp, 751 struct mlxsw_sp_acl_ruleset *ruleset, 752 unsigned long cookie) 753 { 754 return rhashtable_lookup_fast(&ruleset->rule_ht, &cookie, 755 mlxsw_sp_acl_rule_ht_params); 756 } 757 758 struct mlxsw_sp_acl_rule_info * 759 mlxsw_sp_acl_rule_rulei(struct mlxsw_sp_acl_rule *rule) 760 { 761 return rule->rulei; 762 } 763 764 static int mlxsw_sp_acl_rule_activity_update(struct mlxsw_sp *mlxsw_sp, 765 struct mlxsw_sp_acl_rule *rule) 766 { 767 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 768 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 769 bool active; 770 int err; 771 772 err = ops->rule_activity_get(mlxsw_sp, rule->priv, &active); 773 if (err) 774 return err; 775 if (active) 776 rule->last_used = jiffies; 777 return 0; 778 } 779 780 static int mlxsw_sp_acl_rules_activity_update(struct mlxsw_sp_acl *acl) 781 { 782 struct mlxsw_sp_acl_rule *rule; 783 int err; 784 785 /* Protect internal structures from changes */ 786 rtnl_lock(); 787 list_for_each_entry(rule, &acl->rules, list) { 788 err = mlxsw_sp_acl_rule_activity_update(acl->mlxsw_sp, 789 rule); 790 if (err) 791 goto err_rule_update; 792 } 793 rtnl_unlock(); 794 return 0; 795 796 err_rule_update: 797 rtnl_unlock(); 798 return err; 799 } 800 801 static void mlxsw_sp_acl_rule_activity_work_schedule(struct mlxsw_sp_acl *acl) 802 { 803 unsigned long interval = acl->rule_activity_update.interval; 804 805 mlxsw_core_schedule_dw(&acl->rule_activity_update.dw, 806 msecs_to_jiffies(interval)); 807 } 808 809 static void mlxsw_sp_acl_rul_activity_update_work(struct work_struct *work) 810 { 811 struct mlxsw_sp_acl *acl = container_of(work, struct mlxsw_sp_acl, 812 rule_activity_update.dw.work); 813 int err; 814 815 err = mlxsw_sp_acl_rules_activity_update(acl); 816 if (err) 817 dev_err(acl->mlxsw_sp->bus_info->dev, "Could not update acl activity"); 818 819 mlxsw_sp_acl_rule_activity_work_schedule(acl); 820 } 821 822 int mlxsw_sp_acl_rule_get_stats(struct mlxsw_sp *mlxsw_sp, 823 struct mlxsw_sp_acl_rule *rule, 824 u64 *packets, u64 *bytes, u64 *last_use) 825 826 { 827 struct mlxsw_sp_acl_rule_info *rulei; 828 u64 current_packets; 829 u64 current_bytes; 830 int err; 831 832 rulei = mlxsw_sp_acl_rule_rulei(rule); 833 err = mlxsw_sp_flow_counter_get(mlxsw_sp, rulei->counter_index, 834 ¤t_packets, ¤t_bytes); 835 if (err) 836 return err; 837 838 *packets = current_packets - rule->last_packets; 839 *bytes = current_bytes - rule->last_bytes; 840 *last_use = rule->last_used; 841 842 rule->last_bytes = current_bytes; 843 rule->last_packets = current_packets; 844 845 return 0; 846 } 847 848 int mlxsw_sp_acl_init(struct mlxsw_sp *mlxsw_sp) 849 { 850 struct mlxsw_sp_fid *fid; 851 struct mlxsw_sp_acl *acl; 852 size_t alloc_size; 853 int err; 854 855 alloc_size = sizeof(*acl) + mlxsw_sp_acl_tcam_priv_size(mlxsw_sp); 856 acl = kzalloc(alloc_size, GFP_KERNEL); 857 if (!acl) 858 return -ENOMEM; 859 mlxsw_sp->acl = acl; 860 acl->mlxsw_sp = mlxsw_sp; 861 acl->afk = mlxsw_afk_create(MLXSW_CORE_RES_GET(mlxsw_sp->core, 862 ACL_FLEX_KEYS), 863 mlxsw_sp->afk_ops); 864 if (!acl->afk) { 865 err = -ENOMEM; 866 goto err_afk_create; 867 } 868 869 err = rhashtable_init(&acl->ruleset_ht, 870 &mlxsw_sp_acl_ruleset_ht_params); 871 if (err) 872 goto err_rhashtable_init; 873 874 fid = mlxsw_sp_fid_dummy_get(mlxsw_sp); 875 if (IS_ERR(fid)) { 876 err = PTR_ERR(fid); 877 goto err_fid_get; 878 } 879 acl->dummy_fid = fid; 880 881 INIT_LIST_HEAD(&acl->rules); 882 err = mlxsw_sp_acl_tcam_init(mlxsw_sp, &acl->tcam); 883 if (err) 884 goto err_acl_ops_init; 885 886 /* Create the delayed work for the rule activity_update */ 887 INIT_DELAYED_WORK(&acl->rule_activity_update.dw, 888 mlxsw_sp_acl_rul_activity_update_work); 889 acl->rule_activity_update.interval = MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS; 890 mlxsw_core_schedule_dw(&acl->rule_activity_update.dw, 0); 891 return 0; 892 893 err_acl_ops_init: 894 mlxsw_sp_fid_put(fid); 895 err_fid_get: 896 rhashtable_destroy(&acl->ruleset_ht); 897 err_rhashtable_init: 898 mlxsw_afk_destroy(acl->afk); 899 err_afk_create: 900 kfree(acl); 901 return err; 902 } 903 904 void mlxsw_sp_acl_fini(struct mlxsw_sp *mlxsw_sp) 905 { 906 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 907 908 cancel_delayed_work_sync(&mlxsw_sp->acl->rule_activity_update.dw); 909 mlxsw_sp_acl_tcam_fini(mlxsw_sp, &acl->tcam); 910 WARN_ON(!list_empty(&acl->rules)); 911 mlxsw_sp_fid_put(acl->dummy_fid); 912 rhashtable_destroy(&acl->ruleset_ht); 913 mlxsw_afk_destroy(acl->afk); 914 kfree(acl); 915 } 916