1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0 2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */ 3 4 #include <linux/kernel.h> 5 #include <linux/slab.h> 6 #include <linux/errno.h> 7 #include <linux/list.h> 8 #include <linux/string.h> 9 #include <linux/rhashtable.h> 10 #include <linux/netdevice.h> 11 #include <net/net_namespace.h> 12 #include <net/tc_act/tc_vlan.h> 13 14 #include "reg.h" 15 #include "core.h" 16 #include "resources.h" 17 #include "spectrum.h" 18 #include "core_acl_flex_keys.h" 19 #include "core_acl_flex_actions.h" 20 #include "spectrum_acl_tcam.h" 21 22 struct mlxsw_sp_acl { 23 struct mlxsw_sp *mlxsw_sp; 24 struct mlxsw_afk *afk; 25 struct mlxsw_sp_fid *dummy_fid; 26 struct rhashtable ruleset_ht; 27 struct list_head rules; 28 struct { 29 struct delayed_work dw; 30 unsigned long interval; /* ms */ 31 #define MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS 1000 32 } rule_activity_update; 33 struct mlxsw_sp_acl_tcam tcam; 34 }; 35 36 struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl) 37 { 38 return acl->afk; 39 } 40 41 struct mlxsw_sp_acl_block_binding { 42 struct list_head list; 43 struct net_device *dev; 44 struct mlxsw_sp_port *mlxsw_sp_port; 45 bool ingress; 46 }; 47 48 struct mlxsw_sp_acl_ruleset_ht_key { 49 struct mlxsw_sp_acl_block *block; 50 u32 chain_index; 51 const struct mlxsw_sp_acl_profile_ops *ops; 52 }; 53 54 struct mlxsw_sp_acl_ruleset { 55 struct rhash_head ht_node; /* Member of acl HT */ 56 struct mlxsw_sp_acl_ruleset_ht_key ht_key; 57 struct rhashtable rule_ht; 58 unsigned int ref_count; 59 unsigned long priv[0]; 60 /* priv has to be always the last item */ 61 }; 62 63 struct mlxsw_sp_acl_rule { 64 struct rhash_head ht_node; /* Member of rule HT */ 65 struct list_head list; 66 unsigned long cookie; /* HT key */ 67 struct mlxsw_sp_acl_ruleset *ruleset; 68 struct mlxsw_sp_acl_rule_info *rulei; 69 u64 last_used; 70 u64 last_packets; 71 u64 last_bytes; 72 unsigned long priv[0]; 73 /* priv has to be always the last item */ 74 }; 75 76 static const struct rhashtable_params mlxsw_sp_acl_ruleset_ht_params = { 77 .key_len = sizeof(struct mlxsw_sp_acl_ruleset_ht_key), 78 .key_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_key), 79 .head_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_node), 80 .automatic_shrinking = true, 81 }; 82 83 static const struct rhashtable_params mlxsw_sp_acl_rule_ht_params = { 84 .key_len = sizeof(unsigned long), 85 .key_offset = offsetof(struct mlxsw_sp_acl_rule, cookie), 86 .head_offset = offsetof(struct mlxsw_sp_acl_rule, ht_node), 87 .automatic_shrinking = true, 88 }; 89 90 struct mlxsw_sp_fid *mlxsw_sp_acl_dummy_fid(struct mlxsw_sp *mlxsw_sp) 91 { 92 return mlxsw_sp->acl->dummy_fid; 93 } 94 95 struct mlxsw_sp *mlxsw_sp_acl_block_mlxsw_sp(struct mlxsw_sp_acl_block *block) 96 { 97 return block->mlxsw_sp; 98 } 99 100 unsigned int mlxsw_sp_acl_block_rule_count(struct mlxsw_sp_acl_block *block) 101 { 102 return block ? block->rule_count : 0; 103 } 104 105 void mlxsw_sp_acl_block_disable_inc(struct mlxsw_sp_acl_block *block) 106 { 107 if (block) 108 block->disable_count++; 109 } 110 111 void mlxsw_sp_acl_block_disable_dec(struct mlxsw_sp_acl_block *block) 112 { 113 if (block) 114 block->disable_count--; 115 } 116 117 bool mlxsw_sp_acl_block_disabled(struct mlxsw_sp_acl_block *block) 118 { 119 return block->disable_count; 120 } 121 122 bool mlxsw_sp_acl_block_is_egress_bound(struct mlxsw_sp_acl_block *block) 123 { 124 struct mlxsw_sp_acl_block_binding *binding; 125 126 list_for_each_entry(binding, &block->binding_list, list) { 127 if (!binding->ingress) 128 return true; 129 } 130 return false; 131 } 132 133 static bool 134 mlxsw_sp_acl_ruleset_is_singular(const struct mlxsw_sp_acl_ruleset *ruleset) 135 { 136 /* We hold a reference on ruleset ourselves */ 137 return ruleset->ref_count == 2; 138 } 139 140 static int 141 mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp, 142 struct mlxsw_sp_acl_block *block, 143 struct mlxsw_sp_acl_block_binding *binding) 144 { 145 struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero; 146 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 147 148 return ops->ruleset_bind(mlxsw_sp, ruleset->priv, 149 binding->mlxsw_sp_port, binding->ingress); 150 } 151 152 static void 153 mlxsw_sp_acl_ruleset_unbind(struct mlxsw_sp *mlxsw_sp, 154 struct mlxsw_sp_acl_block *block, 155 struct mlxsw_sp_acl_block_binding *binding) 156 { 157 struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero; 158 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 159 160 ops->ruleset_unbind(mlxsw_sp, ruleset->priv, 161 binding->mlxsw_sp_port, binding->ingress); 162 } 163 164 static bool mlxsw_sp_acl_ruleset_block_bound(struct mlxsw_sp_acl_block *block) 165 { 166 return block->ruleset_zero; 167 } 168 169 static int 170 mlxsw_sp_acl_ruleset_block_bind(struct mlxsw_sp *mlxsw_sp, 171 struct mlxsw_sp_acl_ruleset *ruleset, 172 struct mlxsw_sp_acl_block *block) 173 { 174 struct mlxsw_sp_acl_block_binding *binding; 175 int err; 176 177 block->ruleset_zero = ruleset; 178 list_for_each_entry(binding, &block->binding_list, list) { 179 err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding); 180 if (err) 181 goto rollback; 182 } 183 return 0; 184 185 rollback: 186 list_for_each_entry_continue_reverse(binding, &block->binding_list, 187 list) 188 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding); 189 block->ruleset_zero = NULL; 190 191 return err; 192 } 193 194 static void 195 mlxsw_sp_acl_ruleset_block_unbind(struct mlxsw_sp *mlxsw_sp, 196 struct mlxsw_sp_acl_ruleset *ruleset, 197 struct mlxsw_sp_acl_block *block) 198 { 199 struct mlxsw_sp_acl_block_binding *binding; 200 201 list_for_each_entry(binding, &block->binding_list, list) 202 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding); 203 block->ruleset_zero = NULL; 204 } 205 206 struct mlxsw_sp_acl_block *mlxsw_sp_acl_block_create(struct mlxsw_sp *mlxsw_sp, 207 struct net *net) 208 { 209 struct mlxsw_sp_acl_block *block; 210 211 block = kzalloc(sizeof(*block), GFP_KERNEL); 212 if (!block) 213 return NULL; 214 INIT_LIST_HEAD(&block->binding_list); 215 block->mlxsw_sp = mlxsw_sp; 216 block->net = net; 217 return block; 218 } 219 220 void mlxsw_sp_acl_block_destroy(struct mlxsw_sp_acl_block *block) 221 { 222 WARN_ON(!list_empty(&block->binding_list)); 223 kfree(block); 224 } 225 226 static struct mlxsw_sp_acl_block_binding * 227 mlxsw_sp_acl_block_lookup(struct mlxsw_sp_acl_block *block, 228 struct mlxsw_sp_port *mlxsw_sp_port, bool ingress) 229 { 230 struct mlxsw_sp_acl_block_binding *binding; 231 232 list_for_each_entry(binding, &block->binding_list, list) 233 if (binding->mlxsw_sp_port == mlxsw_sp_port && 234 binding->ingress == ingress) 235 return binding; 236 return NULL; 237 } 238 239 int mlxsw_sp_acl_block_bind(struct mlxsw_sp *mlxsw_sp, 240 struct mlxsw_sp_acl_block *block, 241 struct mlxsw_sp_port *mlxsw_sp_port, 242 bool ingress) 243 { 244 struct mlxsw_sp_acl_block_binding *binding; 245 int err; 246 247 if (WARN_ON(mlxsw_sp_acl_block_lookup(block, mlxsw_sp_port, ingress))) 248 return -EEXIST; 249 250 binding = kzalloc(sizeof(*binding), GFP_KERNEL); 251 if (!binding) 252 return -ENOMEM; 253 binding->mlxsw_sp_port = mlxsw_sp_port; 254 binding->ingress = ingress; 255 256 if (mlxsw_sp_acl_ruleset_block_bound(block)) { 257 err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding); 258 if (err) 259 goto err_ruleset_bind; 260 } 261 262 list_add(&binding->list, &block->binding_list); 263 return 0; 264 265 err_ruleset_bind: 266 kfree(binding); 267 return err; 268 } 269 270 int mlxsw_sp_acl_block_unbind(struct mlxsw_sp *mlxsw_sp, 271 struct mlxsw_sp_acl_block *block, 272 struct mlxsw_sp_port *mlxsw_sp_port, 273 bool ingress) 274 { 275 struct mlxsw_sp_acl_block_binding *binding; 276 277 binding = mlxsw_sp_acl_block_lookup(block, mlxsw_sp_port, ingress); 278 if (!binding) 279 return -ENOENT; 280 281 list_del(&binding->list); 282 283 if (mlxsw_sp_acl_ruleset_block_bound(block)) 284 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding); 285 286 kfree(binding); 287 return 0; 288 } 289 290 static struct mlxsw_sp_acl_ruleset * 291 mlxsw_sp_acl_ruleset_create(struct mlxsw_sp *mlxsw_sp, 292 struct mlxsw_sp_acl_block *block, u32 chain_index, 293 const struct mlxsw_sp_acl_profile_ops *ops, 294 struct mlxsw_afk_element_usage *tmplt_elusage) 295 { 296 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 297 struct mlxsw_sp_acl_ruleset *ruleset; 298 size_t alloc_size; 299 int err; 300 301 alloc_size = sizeof(*ruleset) + ops->ruleset_priv_size; 302 ruleset = kzalloc(alloc_size, GFP_KERNEL); 303 if (!ruleset) 304 return ERR_PTR(-ENOMEM); 305 ruleset->ref_count = 1; 306 ruleset->ht_key.block = block; 307 ruleset->ht_key.chain_index = chain_index; 308 ruleset->ht_key.ops = ops; 309 310 err = rhashtable_init(&ruleset->rule_ht, &mlxsw_sp_acl_rule_ht_params); 311 if (err) 312 goto err_rhashtable_init; 313 314 err = ops->ruleset_add(mlxsw_sp, &acl->tcam, ruleset->priv, 315 tmplt_elusage); 316 if (err) 317 goto err_ops_ruleset_add; 318 319 err = rhashtable_insert_fast(&acl->ruleset_ht, &ruleset->ht_node, 320 mlxsw_sp_acl_ruleset_ht_params); 321 if (err) 322 goto err_ht_insert; 323 324 return ruleset; 325 326 err_ht_insert: 327 ops->ruleset_del(mlxsw_sp, ruleset->priv); 328 err_ops_ruleset_add: 329 rhashtable_destroy(&ruleset->rule_ht); 330 err_rhashtable_init: 331 kfree(ruleset); 332 return ERR_PTR(err); 333 } 334 335 static void mlxsw_sp_acl_ruleset_destroy(struct mlxsw_sp *mlxsw_sp, 336 struct mlxsw_sp_acl_ruleset *ruleset) 337 { 338 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 339 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 340 341 rhashtable_remove_fast(&acl->ruleset_ht, &ruleset->ht_node, 342 mlxsw_sp_acl_ruleset_ht_params); 343 ops->ruleset_del(mlxsw_sp, ruleset->priv); 344 rhashtable_destroy(&ruleset->rule_ht); 345 kfree(ruleset); 346 } 347 348 static void mlxsw_sp_acl_ruleset_ref_inc(struct mlxsw_sp_acl_ruleset *ruleset) 349 { 350 ruleset->ref_count++; 351 } 352 353 static void mlxsw_sp_acl_ruleset_ref_dec(struct mlxsw_sp *mlxsw_sp, 354 struct mlxsw_sp_acl_ruleset *ruleset) 355 { 356 if (--ruleset->ref_count) 357 return; 358 mlxsw_sp_acl_ruleset_destroy(mlxsw_sp, ruleset); 359 } 360 361 static struct mlxsw_sp_acl_ruleset * 362 __mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp_acl *acl, 363 struct mlxsw_sp_acl_block *block, u32 chain_index, 364 const struct mlxsw_sp_acl_profile_ops *ops) 365 { 366 struct mlxsw_sp_acl_ruleset_ht_key ht_key; 367 368 memset(&ht_key, 0, sizeof(ht_key)); 369 ht_key.block = block; 370 ht_key.chain_index = chain_index; 371 ht_key.ops = ops; 372 return rhashtable_lookup_fast(&acl->ruleset_ht, &ht_key, 373 mlxsw_sp_acl_ruleset_ht_params); 374 } 375 376 struct mlxsw_sp_acl_ruleset * 377 mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp *mlxsw_sp, 378 struct mlxsw_sp_acl_block *block, u32 chain_index, 379 enum mlxsw_sp_acl_profile profile) 380 { 381 const struct mlxsw_sp_acl_profile_ops *ops; 382 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 383 struct mlxsw_sp_acl_ruleset *ruleset; 384 385 ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile); 386 if (!ops) 387 return ERR_PTR(-EINVAL); 388 ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops); 389 if (!ruleset) 390 return ERR_PTR(-ENOENT); 391 return ruleset; 392 } 393 394 struct mlxsw_sp_acl_ruleset * 395 mlxsw_sp_acl_ruleset_get(struct mlxsw_sp *mlxsw_sp, 396 struct mlxsw_sp_acl_block *block, u32 chain_index, 397 enum mlxsw_sp_acl_profile profile, 398 struct mlxsw_afk_element_usage *tmplt_elusage) 399 { 400 const struct mlxsw_sp_acl_profile_ops *ops; 401 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 402 struct mlxsw_sp_acl_ruleset *ruleset; 403 404 ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile); 405 if (!ops) 406 return ERR_PTR(-EINVAL); 407 408 ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops); 409 if (ruleset) { 410 mlxsw_sp_acl_ruleset_ref_inc(ruleset); 411 return ruleset; 412 } 413 return mlxsw_sp_acl_ruleset_create(mlxsw_sp, block, chain_index, ops, 414 tmplt_elusage); 415 } 416 417 void mlxsw_sp_acl_ruleset_put(struct mlxsw_sp *mlxsw_sp, 418 struct mlxsw_sp_acl_ruleset *ruleset) 419 { 420 mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset); 421 } 422 423 u16 mlxsw_sp_acl_ruleset_group_id(struct mlxsw_sp_acl_ruleset *ruleset) 424 { 425 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 426 427 return ops->ruleset_group_id(ruleset->priv); 428 } 429 430 struct mlxsw_sp_acl_rule_info * 431 mlxsw_sp_acl_rulei_create(struct mlxsw_sp_acl *acl, 432 struct mlxsw_afa_block *afa_block) 433 { 434 struct mlxsw_sp_acl_rule_info *rulei; 435 int err; 436 437 rulei = kzalloc(sizeof(*rulei), GFP_KERNEL); 438 if (!rulei) 439 return NULL; 440 441 if (afa_block) { 442 rulei->act_block = afa_block; 443 return rulei; 444 } 445 446 rulei->act_block = mlxsw_afa_block_create(acl->mlxsw_sp->afa); 447 if (IS_ERR(rulei->act_block)) { 448 err = PTR_ERR(rulei->act_block); 449 goto err_afa_block_create; 450 } 451 rulei->action_created = 1; 452 return rulei; 453 454 err_afa_block_create: 455 kfree(rulei); 456 return ERR_PTR(err); 457 } 458 459 void mlxsw_sp_acl_rulei_destroy(struct mlxsw_sp_acl_rule_info *rulei) 460 { 461 if (rulei->action_created) 462 mlxsw_afa_block_destroy(rulei->act_block); 463 kfree(rulei); 464 } 465 466 int mlxsw_sp_acl_rulei_commit(struct mlxsw_sp_acl_rule_info *rulei) 467 { 468 return mlxsw_afa_block_commit(rulei->act_block); 469 } 470 471 void mlxsw_sp_acl_rulei_priority(struct mlxsw_sp_acl_rule_info *rulei, 472 unsigned int priority) 473 { 474 rulei->priority = priority >> 16; 475 } 476 477 void mlxsw_sp_acl_rulei_keymask_u32(struct mlxsw_sp_acl_rule_info *rulei, 478 enum mlxsw_afk_element element, 479 u32 key_value, u32 mask_value) 480 { 481 mlxsw_afk_values_add_u32(&rulei->values, element, 482 key_value, mask_value); 483 } 484 485 void mlxsw_sp_acl_rulei_keymask_buf(struct mlxsw_sp_acl_rule_info *rulei, 486 enum mlxsw_afk_element element, 487 const char *key_value, 488 const char *mask_value, unsigned int len) 489 { 490 mlxsw_afk_values_add_buf(&rulei->values, element, 491 key_value, mask_value, len); 492 } 493 494 int mlxsw_sp_acl_rulei_act_continue(struct mlxsw_sp_acl_rule_info *rulei) 495 { 496 return mlxsw_afa_block_continue(rulei->act_block); 497 } 498 499 int mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info *rulei, 500 u16 group_id) 501 { 502 return mlxsw_afa_block_jump(rulei->act_block, group_id); 503 } 504 505 int mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info *rulei) 506 { 507 return mlxsw_afa_block_terminate(rulei->act_block); 508 } 509 510 int mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info *rulei) 511 { 512 return mlxsw_afa_block_append_drop(rulei->act_block); 513 } 514 515 int mlxsw_sp_acl_rulei_act_trap(struct mlxsw_sp_acl_rule_info *rulei) 516 { 517 return mlxsw_afa_block_append_trap(rulei->act_block, 518 MLXSW_TRAP_ID_ACL0); 519 } 520 521 int mlxsw_sp_acl_rulei_act_fwd(struct mlxsw_sp *mlxsw_sp, 522 struct mlxsw_sp_acl_rule_info *rulei, 523 struct net_device *out_dev, 524 struct netlink_ext_ack *extack) 525 { 526 struct mlxsw_sp_port *mlxsw_sp_port; 527 u8 local_port; 528 bool in_port; 529 530 if (out_dev) { 531 if (!mlxsw_sp_port_dev_check(out_dev)) { 532 NL_SET_ERR_MSG_MOD(extack, "Invalid output device"); 533 return -EINVAL; 534 } 535 mlxsw_sp_port = netdev_priv(out_dev); 536 if (mlxsw_sp_port->mlxsw_sp != mlxsw_sp) { 537 NL_SET_ERR_MSG_MOD(extack, "Invalid output device"); 538 return -EINVAL; 539 } 540 local_port = mlxsw_sp_port->local_port; 541 in_port = false; 542 } else { 543 /* If out_dev is NULL, the caller wants to 544 * set forward to ingress port. 545 */ 546 local_port = 0; 547 in_port = true; 548 } 549 return mlxsw_afa_block_append_fwd(rulei->act_block, 550 local_port, in_port, extack); 551 } 552 553 int mlxsw_sp_acl_rulei_act_mirror(struct mlxsw_sp *mlxsw_sp, 554 struct mlxsw_sp_acl_rule_info *rulei, 555 struct mlxsw_sp_acl_block *block, 556 struct net_device *out_dev, 557 struct netlink_ext_ack *extack) 558 { 559 struct mlxsw_sp_acl_block_binding *binding; 560 struct mlxsw_sp_port *in_port; 561 562 if (!list_is_singular(&block->binding_list)) { 563 NL_SET_ERR_MSG_MOD(extack, "Only a single mirror source is allowed"); 564 return -EOPNOTSUPP; 565 } 566 binding = list_first_entry(&block->binding_list, 567 struct mlxsw_sp_acl_block_binding, list); 568 in_port = binding->mlxsw_sp_port; 569 570 return mlxsw_afa_block_append_mirror(rulei->act_block, 571 in_port->local_port, 572 out_dev, 573 binding->ingress, 574 extack); 575 } 576 577 int mlxsw_sp_acl_rulei_act_vlan(struct mlxsw_sp *mlxsw_sp, 578 struct mlxsw_sp_acl_rule_info *rulei, 579 u32 action, u16 vid, u16 proto, u8 prio, 580 struct netlink_ext_ack *extack) 581 { 582 u8 ethertype; 583 584 if (action == FLOW_ACTION_VLAN_MANGLE) { 585 switch (proto) { 586 case ETH_P_8021Q: 587 ethertype = 0; 588 break; 589 case ETH_P_8021AD: 590 ethertype = 1; 591 break; 592 default: 593 NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN protocol"); 594 dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN protocol %#04x\n", 595 proto); 596 return -EINVAL; 597 } 598 599 return mlxsw_afa_block_append_vlan_modify(rulei->act_block, 600 vid, prio, ethertype, 601 extack); 602 } else { 603 NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN action"); 604 dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN action\n"); 605 return -EINVAL; 606 } 607 } 608 609 int mlxsw_sp_acl_rulei_act_count(struct mlxsw_sp *mlxsw_sp, 610 struct mlxsw_sp_acl_rule_info *rulei, 611 struct netlink_ext_ack *extack) 612 { 613 return mlxsw_afa_block_append_counter(rulei->act_block, 614 &rulei->counter_index, extack); 615 } 616 617 int mlxsw_sp_acl_rulei_act_fid_set(struct mlxsw_sp *mlxsw_sp, 618 struct mlxsw_sp_acl_rule_info *rulei, 619 u16 fid, struct netlink_ext_ack *extack) 620 { 621 return mlxsw_afa_block_append_fid_set(rulei->act_block, fid, extack); 622 } 623 624 struct mlxsw_sp_acl_rule * 625 mlxsw_sp_acl_rule_create(struct mlxsw_sp *mlxsw_sp, 626 struct mlxsw_sp_acl_ruleset *ruleset, 627 unsigned long cookie, 628 struct mlxsw_afa_block *afa_block, 629 struct netlink_ext_ack *extack) 630 { 631 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 632 struct mlxsw_sp_acl_rule *rule; 633 int err; 634 635 mlxsw_sp_acl_ruleset_ref_inc(ruleset); 636 rule = kzalloc(sizeof(*rule) + ops->rule_priv_size, 637 GFP_KERNEL); 638 if (!rule) { 639 err = -ENOMEM; 640 goto err_alloc; 641 } 642 rule->cookie = cookie; 643 rule->ruleset = ruleset; 644 645 rule->rulei = mlxsw_sp_acl_rulei_create(mlxsw_sp->acl, afa_block); 646 if (IS_ERR(rule->rulei)) { 647 err = PTR_ERR(rule->rulei); 648 goto err_rulei_create; 649 } 650 651 return rule; 652 653 err_rulei_create: 654 kfree(rule); 655 err_alloc: 656 mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset); 657 return ERR_PTR(err); 658 } 659 660 void mlxsw_sp_acl_rule_destroy(struct mlxsw_sp *mlxsw_sp, 661 struct mlxsw_sp_acl_rule *rule) 662 { 663 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 664 665 mlxsw_sp_acl_rulei_destroy(rule->rulei); 666 kfree(rule); 667 mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset); 668 } 669 670 int mlxsw_sp_acl_rule_add(struct mlxsw_sp *mlxsw_sp, 671 struct mlxsw_sp_acl_rule *rule) 672 { 673 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 674 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 675 int err; 676 677 err = ops->rule_add(mlxsw_sp, ruleset->priv, rule->priv, rule->rulei); 678 if (err) 679 return err; 680 681 err = rhashtable_insert_fast(&ruleset->rule_ht, &rule->ht_node, 682 mlxsw_sp_acl_rule_ht_params); 683 if (err) 684 goto err_rhashtable_insert; 685 686 if (!ruleset->ht_key.chain_index && 687 mlxsw_sp_acl_ruleset_is_singular(ruleset)) { 688 /* We only need ruleset with chain index 0, the implicit 689 * one, to be directly bound to device. The rest of the 690 * rulesets are bound by "Goto action set". 691 */ 692 err = mlxsw_sp_acl_ruleset_block_bind(mlxsw_sp, ruleset, 693 ruleset->ht_key.block); 694 if (err) 695 goto err_ruleset_block_bind; 696 } 697 698 list_add_tail(&rule->list, &mlxsw_sp->acl->rules); 699 ruleset->ht_key.block->rule_count++; 700 return 0; 701 702 err_ruleset_block_bind: 703 rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node, 704 mlxsw_sp_acl_rule_ht_params); 705 err_rhashtable_insert: 706 ops->rule_del(mlxsw_sp, rule->priv); 707 return err; 708 } 709 710 void mlxsw_sp_acl_rule_del(struct mlxsw_sp *mlxsw_sp, 711 struct mlxsw_sp_acl_rule *rule) 712 { 713 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 714 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 715 716 ruleset->ht_key.block->rule_count--; 717 list_del(&rule->list); 718 if (!ruleset->ht_key.chain_index && 719 mlxsw_sp_acl_ruleset_is_singular(ruleset)) 720 mlxsw_sp_acl_ruleset_block_unbind(mlxsw_sp, ruleset, 721 ruleset->ht_key.block); 722 rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node, 723 mlxsw_sp_acl_rule_ht_params); 724 ops->rule_del(mlxsw_sp, rule->priv); 725 } 726 727 int mlxsw_sp_acl_rule_action_replace(struct mlxsw_sp *mlxsw_sp, 728 struct mlxsw_sp_acl_rule *rule, 729 struct mlxsw_afa_block *afa_block) 730 { 731 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 732 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 733 struct mlxsw_sp_acl_rule_info *rulei; 734 735 rulei = mlxsw_sp_acl_rule_rulei(rule); 736 rulei->act_block = afa_block; 737 738 return ops->rule_action_replace(mlxsw_sp, rule->priv, rule->rulei); 739 } 740 741 struct mlxsw_sp_acl_rule * 742 mlxsw_sp_acl_rule_lookup(struct mlxsw_sp *mlxsw_sp, 743 struct mlxsw_sp_acl_ruleset *ruleset, 744 unsigned long cookie) 745 { 746 return rhashtable_lookup_fast(&ruleset->rule_ht, &cookie, 747 mlxsw_sp_acl_rule_ht_params); 748 } 749 750 struct mlxsw_sp_acl_rule_info * 751 mlxsw_sp_acl_rule_rulei(struct mlxsw_sp_acl_rule *rule) 752 { 753 return rule->rulei; 754 } 755 756 static int mlxsw_sp_acl_rule_activity_update(struct mlxsw_sp *mlxsw_sp, 757 struct mlxsw_sp_acl_rule *rule) 758 { 759 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 760 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 761 bool active; 762 int err; 763 764 err = ops->rule_activity_get(mlxsw_sp, rule->priv, &active); 765 if (err) 766 return err; 767 if (active) 768 rule->last_used = jiffies; 769 return 0; 770 } 771 772 static int mlxsw_sp_acl_rules_activity_update(struct mlxsw_sp_acl *acl) 773 { 774 struct mlxsw_sp_acl_rule *rule; 775 int err; 776 777 /* Protect internal structures from changes */ 778 rtnl_lock(); 779 list_for_each_entry(rule, &acl->rules, list) { 780 err = mlxsw_sp_acl_rule_activity_update(acl->mlxsw_sp, 781 rule); 782 if (err) 783 goto err_rule_update; 784 } 785 rtnl_unlock(); 786 return 0; 787 788 err_rule_update: 789 rtnl_unlock(); 790 return err; 791 } 792 793 static void mlxsw_sp_acl_rule_activity_work_schedule(struct mlxsw_sp_acl *acl) 794 { 795 unsigned long interval = acl->rule_activity_update.interval; 796 797 mlxsw_core_schedule_dw(&acl->rule_activity_update.dw, 798 msecs_to_jiffies(interval)); 799 } 800 801 static void mlxsw_sp_acl_rule_activity_update_work(struct work_struct *work) 802 { 803 struct mlxsw_sp_acl *acl = container_of(work, struct mlxsw_sp_acl, 804 rule_activity_update.dw.work); 805 int err; 806 807 err = mlxsw_sp_acl_rules_activity_update(acl); 808 if (err) 809 dev_err(acl->mlxsw_sp->bus_info->dev, "Could not update acl activity"); 810 811 mlxsw_sp_acl_rule_activity_work_schedule(acl); 812 } 813 814 int mlxsw_sp_acl_rule_get_stats(struct mlxsw_sp *mlxsw_sp, 815 struct mlxsw_sp_acl_rule *rule, 816 u64 *packets, u64 *bytes, u64 *last_use) 817 818 { 819 struct mlxsw_sp_acl_rule_info *rulei; 820 u64 current_packets; 821 u64 current_bytes; 822 int err; 823 824 rulei = mlxsw_sp_acl_rule_rulei(rule); 825 err = mlxsw_sp_flow_counter_get(mlxsw_sp, rulei->counter_index, 826 ¤t_packets, ¤t_bytes); 827 if (err) 828 return err; 829 830 *packets = current_packets - rule->last_packets; 831 *bytes = current_bytes - rule->last_bytes; 832 *last_use = rule->last_used; 833 834 rule->last_bytes = current_bytes; 835 rule->last_packets = current_packets; 836 837 return 0; 838 } 839 840 int mlxsw_sp_acl_init(struct mlxsw_sp *mlxsw_sp) 841 { 842 struct mlxsw_sp_fid *fid; 843 struct mlxsw_sp_acl *acl; 844 size_t alloc_size; 845 int err; 846 847 alloc_size = sizeof(*acl) + mlxsw_sp_acl_tcam_priv_size(mlxsw_sp); 848 acl = kzalloc(alloc_size, GFP_KERNEL); 849 if (!acl) 850 return -ENOMEM; 851 mlxsw_sp->acl = acl; 852 acl->mlxsw_sp = mlxsw_sp; 853 acl->afk = mlxsw_afk_create(MLXSW_CORE_RES_GET(mlxsw_sp->core, 854 ACL_FLEX_KEYS), 855 mlxsw_sp->afk_ops); 856 if (!acl->afk) { 857 err = -ENOMEM; 858 goto err_afk_create; 859 } 860 861 err = rhashtable_init(&acl->ruleset_ht, 862 &mlxsw_sp_acl_ruleset_ht_params); 863 if (err) 864 goto err_rhashtable_init; 865 866 fid = mlxsw_sp_fid_dummy_get(mlxsw_sp); 867 if (IS_ERR(fid)) { 868 err = PTR_ERR(fid); 869 goto err_fid_get; 870 } 871 acl->dummy_fid = fid; 872 873 INIT_LIST_HEAD(&acl->rules); 874 err = mlxsw_sp_acl_tcam_init(mlxsw_sp, &acl->tcam); 875 if (err) 876 goto err_acl_ops_init; 877 878 /* Create the delayed work for the rule activity_update */ 879 INIT_DELAYED_WORK(&acl->rule_activity_update.dw, 880 mlxsw_sp_acl_rule_activity_update_work); 881 acl->rule_activity_update.interval = MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS; 882 mlxsw_core_schedule_dw(&acl->rule_activity_update.dw, 0); 883 return 0; 884 885 err_acl_ops_init: 886 mlxsw_sp_fid_put(fid); 887 err_fid_get: 888 rhashtable_destroy(&acl->ruleset_ht); 889 err_rhashtable_init: 890 mlxsw_afk_destroy(acl->afk); 891 err_afk_create: 892 kfree(acl); 893 return err; 894 } 895 896 void mlxsw_sp_acl_fini(struct mlxsw_sp *mlxsw_sp) 897 { 898 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 899 900 cancel_delayed_work_sync(&mlxsw_sp->acl->rule_activity_update.dw); 901 mlxsw_sp_acl_tcam_fini(mlxsw_sp, &acl->tcam); 902 WARN_ON(!list_empty(&acl->rules)); 903 mlxsw_sp_fid_put(acl->dummy_fid); 904 rhashtable_destroy(&acl->ruleset_ht); 905 mlxsw_afk_destroy(acl->afk); 906 kfree(acl); 907 } 908 909 u32 mlxsw_sp_acl_region_rehash_intrvl_get(struct mlxsw_sp *mlxsw_sp) 910 { 911 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 912 913 return mlxsw_sp_acl_tcam_vregion_rehash_intrvl_get(mlxsw_sp, 914 &acl->tcam); 915 } 916 917 int mlxsw_sp_acl_region_rehash_intrvl_set(struct mlxsw_sp *mlxsw_sp, u32 val) 918 { 919 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 920 921 return mlxsw_sp_acl_tcam_vregion_rehash_intrvl_set(mlxsw_sp, 922 &acl->tcam, val); 923 } 924