1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */
3 
4 #include <linux/kernel.h>
5 #include <linux/slab.h>
6 #include <linux/errno.h>
7 #include <linux/list.h>
8 #include <linux/string.h>
9 #include <linux/rhashtable.h>
10 #include <linux/netdevice.h>
11 #include <net/net_namespace.h>
12 #include <net/tc_act/tc_vlan.h>
13 
14 #include "reg.h"
15 #include "core.h"
16 #include "resources.h"
17 #include "spectrum.h"
18 #include "core_acl_flex_keys.h"
19 #include "core_acl_flex_actions.h"
20 #include "spectrum_acl_tcam.h"
21 
22 struct mlxsw_sp_acl {
23 	struct mlxsw_sp *mlxsw_sp;
24 	struct mlxsw_afk *afk;
25 	struct mlxsw_sp_fid *dummy_fid;
26 	struct rhashtable ruleset_ht;
27 	struct list_head rules;
28 	struct {
29 		struct delayed_work dw;
30 		unsigned long interval;	/* ms */
31 #define MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS 1000
32 	} rule_activity_update;
33 	struct mlxsw_sp_acl_tcam tcam;
34 };
35 
36 struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl)
37 {
38 	return acl->afk;
39 }
40 
41 struct mlxsw_sp_acl_block_binding {
42 	struct list_head list;
43 	struct net_device *dev;
44 	struct mlxsw_sp_port *mlxsw_sp_port;
45 	bool ingress;
46 };
47 
48 struct mlxsw_sp_acl_block {
49 	struct list_head binding_list;
50 	struct mlxsw_sp_acl_ruleset *ruleset_zero;
51 	struct mlxsw_sp *mlxsw_sp;
52 	unsigned int rule_count;
53 	unsigned int disable_count;
54 };
55 
56 struct mlxsw_sp_acl_ruleset_ht_key {
57 	struct mlxsw_sp_acl_block *block;
58 	u32 chain_index;
59 	const struct mlxsw_sp_acl_profile_ops *ops;
60 };
61 
62 struct mlxsw_sp_acl_ruleset {
63 	struct rhash_head ht_node; /* Member of acl HT */
64 	struct mlxsw_sp_acl_ruleset_ht_key ht_key;
65 	struct rhashtable rule_ht;
66 	unsigned int ref_count;
67 	unsigned long priv[0];
68 	/* priv has to be always the last item */
69 };
70 
71 struct mlxsw_sp_acl_rule {
72 	struct rhash_head ht_node; /* Member of rule HT */
73 	struct list_head list;
74 	unsigned long cookie; /* HT key */
75 	struct mlxsw_sp_acl_ruleset *ruleset;
76 	struct mlxsw_sp_acl_rule_info *rulei;
77 	u64 last_used;
78 	u64 last_packets;
79 	u64 last_bytes;
80 	unsigned long priv[0];
81 	/* priv has to be always the last item */
82 };
83 
84 static const struct rhashtable_params mlxsw_sp_acl_ruleset_ht_params = {
85 	.key_len = sizeof(struct mlxsw_sp_acl_ruleset_ht_key),
86 	.key_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_key),
87 	.head_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_node),
88 	.automatic_shrinking = true,
89 };
90 
91 static const struct rhashtable_params mlxsw_sp_acl_rule_ht_params = {
92 	.key_len = sizeof(unsigned long),
93 	.key_offset = offsetof(struct mlxsw_sp_acl_rule, cookie),
94 	.head_offset = offsetof(struct mlxsw_sp_acl_rule, ht_node),
95 	.automatic_shrinking = true,
96 };
97 
98 struct mlxsw_sp_fid *mlxsw_sp_acl_dummy_fid(struct mlxsw_sp *mlxsw_sp)
99 {
100 	return mlxsw_sp->acl->dummy_fid;
101 }
102 
103 struct mlxsw_sp *mlxsw_sp_acl_block_mlxsw_sp(struct mlxsw_sp_acl_block *block)
104 {
105 	return block->mlxsw_sp;
106 }
107 
108 unsigned int mlxsw_sp_acl_block_rule_count(struct mlxsw_sp_acl_block *block)
109 {
110 	return block ? block->rule_count : 0;
111 }
112 
113 void mlxsw_sp_acl_block_disable_inc(struct mlxsw_sp_acl_block *block)
114 {
115 	if (block)
116 		block->disable_count++;
117 }
118 
119 void mlxsw_sp_acl_block_disable_dec(struct mlxsw_sp_acl_block *block)
120 {
121 	if (block)
122 		block->disable_count--;
123 }
124 
125 bool mlxsw_sp_acl_block_disabled(struct mlxsw_sp_acl_block *block)
126 {
127 	return block->disable_count;
128 }
129 
130 bool mlxsw_sp_acl_block_is_egress_bound(struct mlxsw_sp_acl_block *block)
131 {
132 	struct mlxsw_sp_acl_block_binding *binding;
133 
134 	list_for_each_entry(binding, &block->binding_list, list) {
135 		if (!binding->ingress)
136 			return true;
137 	}
138 	return false;
139 }
140 
141 static bool
142 mlxsw_sp_acl_ruleset_is_singular(const struct mlxsw_sp_acl_ruleset *ruleset)
143 {
144 	/* We hold a reference on ruleset ourselves */
145 	return ruleset->ref_count == 2;
146 }
147 
148 static int
149 mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp,
150 			  struct mlxsw_sp_acl_block *block,
151 			  struct mlxsw_sp_acl_block_binding *binding)
152 {
153 	struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero;
154 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
155 
156 	return ops->ruleset_bind(mlxsw_sp, ruleset->priv,
157 				 binding->mlxsw_sp_port, binding->ingress);
158 }
159 
160 static void
161 mlxsw_sp_acl_ruleset_unbind(struct mlxsw_sp *mlxsw_sp,
162 			    struct mlxsw_sp_acl_block *block,
163 			    struct mlxsw_sp_acl_block_binding *binding)
164 {
165 	struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero;
166 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
167 
168 	ops->ruleset_unbind(mlxsw_sp, ruleset->priv,
169 			    binding->mlxsw_sp_port, binding->ingress);
170 }
171 
172 static bool mlxsw_sp_acl_ruleset_block_bound(struct mlxsw_sp_acl_block *block)
173 {
174 	return block->ruleset_zero;
175 }
176 
177 static int
178 mlxsw_sp_acl_ruleset_block_bind(struct mlxsw_sp *mlxsw_sp,
179 				struct mlxsw_sp_acl_ruleset *ruleset,
180 				struct mlxsw_sp_acl_block *block)
181 {
182 	struct mlxsw_sp_acl_block_binding *binding;
183 	int err;
184 
185 	block->ruleset_zero = ruleset;
186 	list_for_each_entry(binding, &block->binding_list, list) {
187 		err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding);
188 		if (err)
189 			goto rollback;
190 	}
191 	return 0;
192 
193 rollback:
194 	list_for_each_entry_continue_reverse(binding, &block->binding_list,
195 					     list)
196 		mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding);
197 	block->ruleset_zero = NULL;
198 
199 	return err;
200 }
201 
202 static void
203 mlxsw_sp_acl_ruleset_block_unbind(struct mlxsw_sp *mlxsw_sp,
204 				  struct mlxsw_sp_acl_ruleset *ruleset,
205 				  struct mlxsw_sp_acl_block *block)
206 {
207 	struct mlxsw_sp_acl_block_binding *binding;
208 
209 	list_for_each_entry(binding, &block->binding_list, list)
210 		mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding);
211 	block->ruleset_zero = NULL;
212 }
213 
214 struct mlxsw_sp_acl_block *mlxsw_sp_acl_block_create(struct mlxsw_sp *mlxsw_sp,
215 						     struct net *net)
216 {
217 	struct mlxsw_sp_acl_block *block;
218 
219 	block = kzalloc(sizeof(*block), GFP_KERNEL);
220 	if (!block)
221 		return NULL;
222 	INIT_LIST_HEAD(&block->binding_list);
223 	block->mlxsw_sp = mlxsw_sp;
224 	return block;
225 }
226 
227 void mlxsw_sp_acl_block_destroy(struct mlxsw_sp_acl_block *block)
228 {
229 	WARN_ON(!list_empty(&block->binding_list));
230 	kfree(block);
231 }
232 
233 static struct mlxsw_sp_acl_block_binding *
234 mlxsw_sp_acl_block_lookup(struct mlxsw_sp_acl_block *block,
235 			  struct mlxsw_sp_port *mlxsw_sp_port, bool ingress)
236 {
237 	struct mlxsw_sp_acl_block_binding *binding;
238 
239 	list_for_each_entry(binding, &block->binding_list, list)
240 		if (binding->mlxsw_sp_port == mlxsw_sp_port &&
241 		    binding->ingress == ingress)
242 			return binding;
243 	return NULL;
244 }
245 
246 int mlxsw_sp_acl_block_bind(struct mlxsw_sp *mlxsw_sp,
247 			    struct mlxsw_sp_acl_block *block,
248 			    struct mlxsw_sp_port *mlxsw_sp_port,
249 			    bool ingress)
250 {
251 	struct mlxsw_sp_acl_block_binding *binding;
252 	int err;
253 
254 	if (WARN_ON(mlxsw_sp_acl_block_lookup(block, mlxsw_sp_port, ingress)))
255 		return -EEXIST;
256 
257 	binding = kzalloc(sizeof(*binding), GFP_KERNEL);
258 	if (!binding)
259 		return -ENOMEM;
260 	binding->mlxsw_sp_port = mlxsw_sp_port;
261 	binding->ingress = ingress;
262 
263 	if (mlxsw_sp_acl_ruleset_block_bound(block)) {
264 		err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding);
265 		if (err)
266 			goto err_ruleset_bind;
267 	}
268 
269 	list_add(&binding->list, &block->binding_list);
270 	return 0;
271 
272 err_ruleset_bind:
273 	kfree(binding);
274 	return err;
275 }
276 
277 int mlxsw_sp_acl_block_unbind(struct mlxsw_sp *mlxsw_sp,
278 			      struct mlxsw_sp_acl_block *block,
279 			      struct mlxsw_sp_port *mlxsw_sp_port,
280 			      bool ingress)
281 {
282 	struct mlxsw_sp_acl_block_binding *binding;
283 
284 	binding = mlxsw_sp_acl_block_lookup(block, mlxsw_sp_port, ingress);
285 	if (!binding)
286 		return -ENOENT;
287 
288 	list_del(&binding->list);
289 
290 	if (mlxsw_sp_acl_ruleset_block_bound(block))
291 		mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding);
292 
293 	kfree(binding);
294 	return 0;
295 }
296 
297 static struct mlxsw_sp_acl_ruleset *
298 mlxsw_sp_acl_ruleset_create(struct mlxsw_sp *mlxsw_sp,
299 			    struct mlxsw_sp_acl_block *block, u32 chain_index,
300 			    const struct mlxsw_sp_acl_profile_ops *ops,
301 			    struct mlxsw_afk_element_usage *tmplt_elusage)
302 {
303 	struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
304 	struct mlxsw_sp_acl_ruleset *ruleset;
305 	size_t alloc_size;
306 	int err;
307 
308 	alloc_size = sizeof(*ruleset) + ops->ruleset_priv_size;
309 	ruleset = kzalloc(alloc_size, GFP_KERNEL);
310 	if (!ruleset)
311 		return ERR_PTR(-ENOMEM);
312 	ruleset->ref_count = 1;
313 	ruleset->ht_key.block = block;
314 	ruleset->ht_key.chain_index = chain_index;
315 	ruleset->ht_key.ops = ops;
316 
317 	err = rhashtable_init(&ruleset->rule_ht, &mlxsw_sp_acl_rule_ht_params);
318 	if (err)
319 		goto err_rhashtable_init;
320 
321 	err = ops->ruleset_add(mlxsw_sp, &acl->tcam, ruleset->priv,
322 			       tmplt_elusage);
323 	if (err)
324 		goto err_ops_ruleset_add;
325 
326 	err = rhashtable_insert_fast(&acl->ruleset_ht, &ruleset->ht_node,
327 				     mlxsw_sp_acl_ruleset_ht_params);
328 	if (err)
329 		goto err_ht_insert;
330 
331 	return ruleset;
332 
333 err_ht_insert:
334 	ops->ruleset_del(mlxsw_sp, ruleset->priv);
335 err_ops_ruleset_add:
336 	rhashtable_destroy(&ruleset->rule_ht);
337 err_rhashtable_init:
338 	kfree(ruleset);
339 	return ERR_PTR(err);
340 }
341 
342 static void mlxsw_sp_acl_ruleset_destroy(struct mlxsw_sp *mlxsw_sp,
343 					 struct mlxsw_sp_acl_ruleset *ruleset)
344 {
345 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
346 	struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
347 
348 	rhashtable_remove_fast(&acl->ruleset_ht, &ruleset->ht_node,
349 			       mlxsw_sp_acl_ruleset_ht_params);
350 	ops->ruleset_del(mlxsw_sp, ruleset->priv);
351 	rhashtable_destroy(&ruleset->rule_ht);
352 	kfree(ruleset);
353 }
354 
355 static void mlxsw_sp_acl_ruleset_ref_inc(struct mlxsw_sp_acl_ruleset *ruleset)
356 {
357 	ruleset->ref_count++;
358 }
359 
360 static void mlxsw_sp_acl_ruleset_ref_dec(struct mlxsw_sp *mlxsw_sp,
361 					 struct mlxsw_sp_acl_ruleset *ruleset)
362 {
363 	if (--ruleset->ref_count)
364 		return;
365 	mlxsw_sp_acl_ruleset_destroy(mlxsw_sp, ruleset);
366 }
367 
368 static struct mlxsw_sp_acl_ruleset *
369 __mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp_acl *acl,
370 			      struct mlxsw_sp_acl_block *block, u32 chain_index,
371 			      const struct mlxsw_sp_acl_profile_ops *ops)
372 {
373 	struct mlxsw_sp_acl_ruleset_ht_key ht_key;
374 
375 	memset(&ht_key, 0, sizeof(ht_key));
376 	ht_key.block = block;
377 	ht_key.chain_index = chain_index;
378 	ht_key.ops = ops;
379 	return rhashtable_lookup_fast(&acl->ruleset_ht, &ht_key,
380 				      mlxsw_sp_acl_ruleset_ht_params);
381 }
382 
383 struct mlxsw_sp_acl_ruleset *
384 mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp *mlxsw_sp,
385 			    struct mlxsw_sp_acl_block *block, u32 chain_index,
386 			    enum mlxsw_sp_acl_profile profile)
387 {
388 	const struct mlxsw_sp_acl_profile_ops *ops;
389 	struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
390 	struct mlxsw_sp_acl_ruleset *ruleset;
391 
392 	ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile);
393 	if (!ops)
394 		return ERR_PTR(-EINVAL);
395 	ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops);
396 	if (!ruleset)
397 		return ERR_PTR(-ENOENT);
398 	return ruleset;
399 }
400 
401 struct mlxsw_sp_acl_ruleset *
402 mlxsw_sp_acl_ruleset_get(struct mlxsw_sp *mlxsw_sp,
403 			 struct mlxsw_sp_acl_block *block, u32 chain_index,
404 			 enum mlxsw_sp_acl_profile profile,
405 			 struct mlxsw_afk_element_usage *tmplt_elusage)
406 {
407 	const struct mlxsw_sp_acl_profile_ops *ops;
408 	struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
409 	struct mlxsw_sp_acl_ruleset *ruleset;
410 
411 	ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile);
412 	if (!ops)
413 		return ERR_PTR(-EINVAL);
414 
415 	ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops);
416 	if (ruleset) {
417 		mlxsw_sp_acl_ruleset_ref_inc(ruleset);
418 		return ruleset;
419 	}
420 	return mlxsw_sp_acl_ruleset_create(mlxsw_sp, block, chain_index, ops,
421 					   tmplt_elusage);
422 }
423 
424 void mlxsw_sp_acl_ruleset_put(struct mlxsw_sp *mlxsw_sp,
425 			      struct mlxsw_sp_acl_ruleset *ruleset)
426 {
427 	mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
428 }
429 
430 u16 mlxsw_sp_acl_ruleset_group_id(struct mlxsw_sp_acl_ruleset *ruleset)
431 {
432 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
433 
434 	return ops->ruleset_group_id(ruleset->priv);
435 }
436 
437 struct mlxsw_sp_acl_rule_info *
438 mlxsw_sp_acl_rulei_create(struct mlxsw_sp_acl *acl,
439 			  struct mlxsw_afa_block *afa_block)
440 {
441 	struct mlxsw_sp_acl_rule_info *rulei;
442 	int err;
443 
444 	rulei = kzalloc(sizeof(*rulei), GFP_KERNEL);
445 	if (!rulei)
446 		return NULL;
447 
448 	if (afa_block) {
449 		rulei->act_block = afa_block;
450 		return rulei;
451 	}
452 
453 	rulei->act_block = mlxsw_afa_block_create(acl->mlxsw_sp->afa);
454 	if (IS_ERR(rulei->act_block)) {
455 		err = PTR_ERR(rulei->act_block);
456 		goto err_afa_block_create;
457 	}
458 	rulei->action_created = 1;
459 	return rulei;
460 
461 err_afa_block_create:
462 	kfree(rulei);
463 	return ERR_PTR(err);
464 }
465 
466 void mlxsw_sp_acl_rulei_destroy(struct mlxsw_sp_acl_rule_info *rulei)
467 {
468 	if (rulei->action_created)
469 		mlxsw_afa_block_destroy(rulei->act_block);
470 	kfree(rulei);
471 }
472 
473 int mlxsw_sp_acl_rulei_commit(struct mlxsw_sp_acl_rule_info *rulei)
474 {
475 	return mlxsw_afa_block_commit(rulei->act_block);
476 }
477 
478 void mlxsw_sp_acl_rulei_priority(struct mlxsw_sp_acl_rule_info *rulei,
479 				 unsigned int priority)
480 {
481 	rulei->priority = priority >> 16;
482 }
483 
484 void mlxsw_sp_acl_rulei_keymask_u32(struct mlxsw_sp_acl_rule_info *rulei,
485 				    enum mlxsw_afk_element element,
486 				    u32 key_value, u32 mask_value)
487 {
488 	mlxsw_afk_values_add_u32(&rulei->values, element,
489 				 key_value, mask_value);
490 }
491 
492 void mlxsw_sp_acl_rulei_keymask_buf(struct mlxsw_sp_acl_rule_info *rulei,
493 				    enum mlxsw_afk_element element,
494 				    const char *key_value,
495 				    const char *mask_value, unsigned int len)
496 {
497 	mlxsw_afk_values_add_buf(&rulei->values, element,
498 				 key_value, mask_value, len);
499 }
500 
501 int mlxsw_sp_acl_rulei_act_continue(struct mlxsw_sp_acl_rule_info *rulei)
502 {
503 	return mlxsw_afa_block_continue(rulei->act_block);
504 }
505 
506 int mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info *rulei,
507 				u16 group_id)
508 {
509 	return mlxsw_afa_block_jump(rulei->act_block, group_id);
510 }
511 
512 int mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info *rulei)
513 {
514 	return mlxsw_afa_block_terminate(rulei->act_block);
515 }
516 
517 int mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info *rulei)
518 {
519 	return mlxsw_afa_block_append_drop(rulei->act_block);
520 }
521 
522 int mlxsw_sp_acl_rulei_act_trap(struct mlxsw_sp_acl_rule_info *rulei)
523 {
524 	return mlxsw_afa_block_append_trap(rulei->act_block,
525 					   MLXSW_TRAP_ID_ACL0);
526 }
527 
528 int mlxsw_sp_acl_rulei_act_fwd(struct mlxsw_sp *mlxsw_sp,
529 			       struct mlxsw_sp_acl_rule_info *rulei,
530 			       struct net_device *out_dev,
531 			       struct netlink_ext_ack *extack)
532 {
533 	struct mlxsw_sp_port *mlxsw_sp_port;
534 	u8 local_port;
535 	bool in_port;
536 
537 	if (out_dev) {
538 		if (!mlxsw_sp_port_dev_check(out_dev)) {
539 			NL_SET_ERR_MSG_MOD(extack, "Invalid output device");
540 			return -EINVAL;
541 		}
542 		mlxsw_sp_port = netdev_priv(out_dev);
543 		if (mlxsw_sp_port->mlxsw_sp != mlxsw_sp) {
544 			NL_SET_ERR_MSG_MOD(extack, "Invalid output device");
545 			return -EINVAL;
546 		}
547 		local_port = mlxsw_sp_port->local_port;
548 		in_port = false;
549 	} else {
550 		/* If out_dev is NULL, the caller wants to
551 		 * set forward to ingress port.
552 		 */
553 		local_port = 0;
554 		in_port = true;
555 	}
556 	return mlxsw_afa_block_append_fwd(rulei->act_block,
557 					  local_port, in_port, extack);
558 }
559 
560 int mlxsw_sp_acl_rulei_act_mirror(struct mlxsw_sp *mlxsw_sp,
561 				  struct mlxsw_sp_acl_rule_info *rulei,
562 				  struct mlxsw_sp_acl_block *block,
563 				  struct net_device *out_dev,
564 				  struct netlink_ext_ack *extack)
565 {
566 	struct mlxsw_sp_acl_block_binding *binding;
567 	struct mlxsw_sp_port *in_port;
568 
569 	if (!list_is_singular(&block->binding_list)) {
570 		NL_SET_ERR_MSG_MOD(extack, "Only a single mirror source is allowed");
571 		return -EOPNOTSUPP;
572 	}
573 	binding = list_first_entry(&block->binding_list,
574 				   struct mlxsw_sp_acl_block_binding, list);
575 	in_port = binding->mlxsw_sp_port;
576 
577 	return mlxsw_afa_block_append_mirror(rulei->act_block,
578 					     in_port->local_port,
579 					     out_dev,
580 					     binding->ingress,
581 					     extack);
582 }
583 
584 int mlxsw_sp_acl_rulei_act_vlan(struct mlxsw_sp *mlxsw_sp,
585 				struct mlxsw_sp_acl_rule_info *rulei,
586 				u32 action, u16 vid, u16 proto, u8 prio,
587 				struct netlink_ext_ack *extack)
588 {
589 	u8 ethertype;
590 
591 	if (action == TCA_VLAN_ACT_MODIFY) {
592 		switch (proto) {
593 		case ETH_P_8021Q:
594 			ethertype = 0;
595 			break;
596 		case ETH_P_8021AD:
597 			ethertype = 1;
598 			break;
599 		default:
600 			NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN protocol");
601 			dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN protocol %#04x\n",
602 				proto);
603 			return -EINVAL;
604 		}
605 
606 		return mlxsw_afa_block_append_vlan_modify(rulei->act_block,
607 							  vid, prio, ethertype,
608 							  extack);
609 	} else {
610 		NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN action");
611 		dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN action\n");
612 		return -EINVAL;
613 	}
614 }
615 
616 int mlxsw_sp_acl_rulei_act_count(struct mlxsw_sp *mlxsw_sp,
617 				 struct mlxsw_sp_acl_rule_info *rulei,
618 				 struct netlink_ext_ack *extack)
619 {
620 	return mlxsw_afa_block_append_counter(rulei->act_block,
621 					      &rulei->counter_index, extack);
622 }
623 
624 int mlxsw_sp_acl_rulei_act_fid_set(struct mlxsw_sp *mlxsw_sp,
625 				   struct mlxsw_sp_acl_rule_info *rulei,
626 				   u16 fid, struct netlink_ext_ack *extack)
627 {
628 	return mlxsw_afa_block_append_fid_set(rulei->act_block, fid, extack);
629 }
630 
631 struct mlxsw_sp_acl_rule *
632 mlxsw_sp_acl_rule_create(struct mlxsw_sp *mlxsw_sp,
633 			 struct mlxsw_sp_acl_ruleset *ruleset,
634 			 unsigned long cookie,
635 			 struct mlxsw_afa_block *afa_block,
636 			 struct netlink_ext_ack *extack)
637 {
638 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
639 	struct mlxsw_sp_acl_rule *rule;
640 	int err;
641 
642 	mlxsw_sp_acl_ruleset_ref_inc(ruleset);
643 	rule = kzalloc(sizeof(*rule) + ops->rule_priv_size(mlxsw_sp),
644 		       GFP_KERNEL);
645 	if (!rule) {
646 		err = -ENOMEM;
647 		goto err_alloc;
648 	}
649 	rule->cookie = cookie;
650 	rule->ruleset = ruleset;
651 
652 	rule->rulei = mlxsw_sp_acl_rulei_create(mlxsw_sp->acl, afa_block);
653 	if (IS_ERR(rule->rulei)) {
654 		err = PTR_ERR(rule->rulei);
655 		goto err_rulei_create;
656 	}
657 
658 	return rule;
659 
660 err_rulei_create:
661 	kfree(rule);
662 err_alloc:
663 	mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
664 	return ERR_PTR(err);
665 }
666 
667 void mlxsw_sp_acl_rule_destroy(struct mlxsw_sp *mlxsw_sp,
668 			       struct mlxsw_sp_acl_rule *rule)
669 {
670 	struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
671 
672 	mlxsw_sp_acl_rulei_destroy(rule->rulei);
673 	kfree(rule);
674 	mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
675 }
676 
677 int mlxsw_sp_acl_rule_add(struct mlxsw_sp *mlxsw_sp,
678 			  struct mlxsw_sp_acl_rule *rule)
679 {
680 	struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
681 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
682 	int err;
683 
684 	err = ops->rule_add(mlxsw_sp, ruleset->priv, rule->priv, rule->rulei);
685 	if (err)
686 		return err;
687 
688 	err = rhashtable_insert_fast(&ruleset->rule_ht, &rule->ht_node,
689 				     mlxsw_sp_acl_rule_ht_params);
690 	if (err)
691 		goto err_rhashtable_insert;
692 
693 	if (!ruleset->ht_key.chain_index &&
694 	    mlxsw_sp_acl_ruleset_is_singular(ruleset)) {
695 		/* We only need ruleset with chain index 0, the implicit
696 		 * one, to be directly bound to device. The rest of the
697 		 * rulesets are bound by "Goto action set".
698 		 */
699 		err = mlxsw_sp_acl_ruleset_block_bind(mlxsw_sp, ruleset,
700 						      ruleset->ht_key.block);
701 		if (err)
702 			goto err_ruleset_block_bind;
703 	}
704 
705 	list_add_tail(&rule->list, &mlxsw_sp->acl->rules);
706 	ruleset->ht_key.block->rule_count++;
707 	return 0;
708 
709 err_ruleset_block_bind:
710 	rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node,
711 			       mlxsw_sp_acl_rule_ht_params);
712 err_rhashtable_insert:
713 	ops->rule_del(mlxsw_sp, rule->priv);
714 	return err;
715 }
716 
717 void mlxsw_sp_acl_rule_del(struct mlxsw_sp *mlxsw_sp,
718 			   struct mlxsw_sp_acl_rule *rule)
719 {
720 	struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
721 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
722 
723 	ruleset->ht_key.block->rule_count--;
724 	list_del(&rule->list);
725 	if (!ruleset->ht_key.chain_index &&
726 	    mlxsw_sp_acl_ruleset_is_singular(ruleset))
727 		mlxsw_sp_acl_ruleset_block_unbind(mlxsw_sp, ruleset,
728 						  ruleset->ht_key.block);
729 	rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node,
730 			       mlxsw_sp_acl_rule_ht_params);
731 	ops->rule_del(mlxsw_sp, rule->priv);
732 }
733 
734 int mlxsw_sp_acl_rule_action_replace(struct mlxsw_sp *mlxsw_sp,
735 				     struct mlxsw_sp_acl_rule *rule,
736 				     struct mlxsw_afa_block *afa_block)
737 {
738 	struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
739 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
740 	struct mlxsw_sp_acl_rule_info *rulei;
741 
742 	rulei = mlxsw_sp_acl_rule_rulei(rule);
743 	rulei->act_block = afa_block;
744 
745 	return ops->rule_action_replace(mlxsw_sp, ruleset->priv, rule->priv,
746 					rule->rulei);
747 }
748 
749 struct mlxsw_sp_acl_rule *
750 mlxsw_sp_acl_rule_lookup(struct mlxsw_sp *mlxsw_sp,
751 			 struct mlxsw_sp_acl_ruleset *ruleset,
752 			 unsigned long cookie)
753 {
754 	return rhashtable_lookup_fast(&ruleset->rule_ht, &cookie,
755 				       mlxsw_sp_acl_rule_ht_params);
756 }
757 
758 struct mlxsw_sp_acl_rule_info *
759 mlxsw_sp_acl_rule_rulei(struct mlxsw_sp_acl_rule *rule)
760 {
761 	return rule->rulei;
762 }
763 
764 static int mlxsw_sp_acl_rule_activity_update(struct mlxsw_sp *mlxsw_sp,
765 					     struct mlxsw_sp_acl_rule *rule)
766 {
767 	struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
768 	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
769 	bool active;
770 	int err;
771 
772 	err = ops->rule_activity_get(mlxsw_sp, rule->priv, &active);
773 	if (err)
774 		return err;
775 	if (active)
776 		rule->last_used = jiffies;
777 	return 0;
778 }
779 
780 static int mlxsw_sp_acl_rules_activity_update(struct mlxsw_sp_acl *acl)
781 {
782 	struct mlxsw_sp_acl_rule *rule;
783 	int err;
784 
785 	/* Protect internal structures from changes */
786 	rtnl_lock();
787 	list_for_each_entry(rule, &acl->rules, list) {
788 		err = mlxsw_sp_acl_rule_activity_update(acl->mlxsw_sp,
789 							rule);
790 		if (err)
791 			goto err_rule_update;
792 	}
793 	rtnl_unlock();
794 	return 0;
795 
796 err_rule_update:
797 	rtnl_unlock();
798 	return err;
799 }
800 
801 static void mlxsw_sp_acl_rule_activity_work_schedule(struct mlxsw_sp_acl *acl)
802 {
803 	unsigned long interval = acl->rule_activity_update.interval;
804 
805 	mlxsw_core_schedule_dw(&acl->rule_activity_update.dw,
806 			       msecs_to_jiffies(interval));
807 }
808 
809 static void mlxsw_sp_acl_rul_activity_update_work(struct work_struct *work)
810 {
811 	struct mlxsw_sp_acl *acl = container_of(work, struct mlxsw_sp_acl,
812 						rule_activity_update.dw.work);
813 	int err;
814 
815 	err = mlxsw_sp_acl_rules_activity_update(acl);
816 	if (err)
817 		dev_err(acl->mlxsw_sp->bus_info->dev, "Could not update acl activity");
818 
819 	mlxsw_sp_acl_rule_activity_work_schedule(acl);
820 }
821 
822 int mlxsw_sp_acl_rule_get_stats(struct mlxsw_sp *mlxsw_sp,
823 				struct mlxsw_sp_acl_rule *rule,
824 				u64 *packets, u64 *bytes, u64 *last_use)
825 
826 {
827 	struct mlxsw_sp_acl_rule_info *rulei;
828 	u64 current_packets;
829 	u64 current_bytes;
830 	int err;
831 
832 	rulei = mlxsw_sp_acl_rule_rulei(rule);
833 	err = mlxsw_sp_flow_counter_get(mlxsw_sp, rulei->counter_index,
834 					&current_packets, &current_bytes);
835 	if (err)
836 		return err;
837 
838 	*packets = current_packets - rule->last_packets;
839 	*bytes = current_bytes - rule->last_bytes;
840 	*last_use = rule->last_used;
841 
842 	rule->last_bytes = current_bytes;
843 	rule->last_packets = current_packets;
844 
845 	return 0;
846 }
847 
848 int mlxsw_sp_acl_init(struct mlxsw_sp *mlxsw_sp)
849 {
850 	struct mlxsw_sp_fid *fid;
851 	struct mlxsw_sp_acl *acl;
852 	size_t alloc_size;
853 	int err;
854 
855 	alloc_size = sizeof(*acl) + mlxsw_sp_acl_tcam_priv_size(mlxsw_sp);
856 	acl = kzalloc(alloc_size, GFP_KERNEL);
857 	if (!acl)
858 		return -ENOMEM;
859 	mlxsw_sp->acl = acl;
860 	acl->mlxsw_sp = mlxsw_sp;
861 	acl->afk = mlxsw_afk_create(MLXSW_CORE_RES_GET(mlxsw_sp->core,
862 						       ACL_FLEX_KEYS),
863 				    mlxsw_sp->afk_ops);
864 	if (!acl->afk) {
865 		err = -ENOMEM;
866 		goto err_afk_create;
867 	}
868 
869 	err = rhashtable_init(&acl->ruleset_ht,
870 			      &mlxsw_sp_acl_ruleset_ht_params);
871 	if (err)
872 		goto err_rhashtable_init;
873 
874 	fid = mlxsw_sp_fid_dummy_get(mlxsw_sp);
875 	if (IS_ERR(fid)) {
876 		err = PTR_ERR(fid);
877 		goto err_fid_get;
878 	}
879 	acl->dummy_fid = fid;
880 
881 	INIT_LIST_HEAD(&acl->rules);
882 	err = mlxsw_sp_acl_tcam_init(mlxsw_sp, &acl->tcam);
883 	if (err)
884 		goto err_acl_ops_init;
885 
886 	/* Create the delayed work for the rule activity_update */
887 	INIT_DELAYED_WORK(&acl->rule_activity_update.dw,
888 			  mlxsw_sp_acl_rul_activity_update_work);
889 	acl->rule_activity_update.interval = MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS;
890 	mlxsw_core_schedule_dw(&acl->rule_activity_update.dw, 0);
891 	return 0;
892 
893 err_acl_ops_init:
894 	mlxsw_sp_fid_put(fid);
895 err_fid_get:
896 	rhashtable_destroy(&acl->ruleset_ht);
897 err_rhashtable_init:
898 	mlxsw_afk_destroy(acl->afk);
899 err_afk_create:
900 	kfree(acl);
901 	return err;
902 }
903 
904 void mlxsw_sp_acl_fini(struct mlxsw_sp *mlxsw_sp)
905 {
906 	struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
907 
908 	cancel_delayed_work_sync(&mlxsw_sp->acl->rule_activity_update.dw);
909 	mlxsw_sp_acl_tcam_fini(mlxsw_sp, &acl->tcam);
910 	WARN_ON(!list_empty(&acl->rules));
911 	mlxsw_sp_fid_put(acl->dummy_fid);
912 	rhashtable_destroy(&acl->ruleset_ht);
913 	mlxsw_afk_destroy(acl->afk);
914 	kfree(acl);
915 }
916