1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */
3
4 #include <linux/kernel.h>
5 #include <linux/slab.h>
6 #include <linux/errno.h>
7 #include <linux/list.h>
8 #include <linux/string.h>
9 #include <linux/rhashtable.h>
10 #include <linux/netdevice.h>
11 #include <net/net_namespace.h>
12 #include <net/tc_act/tc_vlan.h>
13
14 #include "reg.h"
15 #include "core.h"
16 #include "resources.h"
17 #include "spectrum.h"
18 #include "core_acl_flex_keys.h"
19 #include "core_acl_flex_actions.h"
20 #include "spectrum_acl_tcam.h"
21
22 struct mlxsw_sp_acl {
23 struct mlxsw_sp *mlxsw_sp;
24 struct mlxsw_afk *afk;
25 struct mlxsw_sp_fid *dummy_fid;
26 struct rhashtable ruleset_ht;
27 struct list_head rules;
28 struct {
29 struct delayed_work dw;
30 unsigned long interval; /* ms */
31 #define MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS 1000
32 } rule_activity_update;
33 struct mlxsw_sp_acl_tcam tcam;
34 };
35
mlxsw_sp_acl_afk(struct mlxsw_sp_acl * acl)36 struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl)
37 {
38 return acl->afk;
39 }
40
41 struct mlxsw_sp_acl_block_binding {
42 struct list_head list;
43 struct net_device *dev;
44 struct mlxsw_sp_port *mlxsw_sp_port;
45 bool ingress;
46 };
47
48 struct mlxsw_sp_acl_block {
49 struct list_head binding_list;
50 struct mlxsw_sp_acl_ruleset *ruleset_zero;
51 struct mlxsw_sp *mlxsw_sp;
52 unsigned int rule_count;
53 unsigned int disable_count;
54 };
55
56 struct mlxsw_sp_acl_ruleset_ht_key {
57 struct mlxsw_sp_acl_block *block;
58 u32 chain_index;
59 const struct mlxsw_sp_acl_profile_ops *ops;
60 };
61
62 struct mlxsw_sp_acl_ruleset {
63 struct rhash_head ht_node; /* Member of acl HT */
64 struct mlxsw_sp_acl_ruleset_ht_key ht_key;
65 struct rhashtable rule_ht;
66 unsigned int ref_count;
67 unsigned long priv[0];
68 /* priv has to be always the last item */
69 };
70
71 struct mlxsw_sp_acl_rule {
72 struct rhash_head ht_node; /* Member of rule HT */
73 struct list_head list;
74 unsigned long cookie; /* HT key */
75 struct mlxsw_sp_acl_ruleset *ruleset;
76 struct mlxsw_sp_acl_rule_info *rulei;
77 u64 last_used;
78 u64 last_packets;
79 u64 last_bytes;
80 unsigned long priv[0];
81 /* priv has to be always the last item */
82 };
83
84 static const struct rhashtable_params mlxsw_sp_acl_ruleset_ht_params = {
85 .key_len = sizeof(struct mlxsw_sp_acl_ruleset_ht_key),
86 .key_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_key),
87 .head_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_node),
88 .automatic_shrinking = true,
89 };
90
91 static const struct rhashtable_params mlxsw_sp_acl_rule_ht_params = {
92 .key_len = sizeof(unsigned long),
93 .key_offset = offsetof(struct mlxsw_sp_acl_rule, cookie),
94 .head_offset = offsetof(struct mlxsw_sp_acl_rule, ht_node),
95 .automatic_shrinking = true,
96 };
97
mlxsw_sp_acl_dummy_fid(struct mlxsw_sp * mlxsw_sp)98 struct mlxsw_sp_fid *mlxsw_sp_acl_dummy_fid(struct mlxsw_sp *mlxsw_sp)
99 {
100 return mlxsw_sp->acl->dummy_fid;
101 }
102
mlxsw_sp_acl_block_mlxsw_sp(struct mlxsw_sp_acl_block * block)103 struct mlxsw_sp *mlxsw_sp_acl_block_mlxsw_sp(struct mlxsw_sp_acl_block *block)
104 {
105 return block->mlxsw_sp;
106 }
107
mlxsw_sp_acl_block_rule_count(struct mlxsw_sp_acl_block * block)108 unsigned int mlxsw_sp_acl_block_rule_count(struct mlxsw_sp_acl_block *block)
109 {
110 return block ? block->rule_count : 0;
111 }
112
mlxsw_sp_acl_block_disable_inc(struct mlxsw_sp_acl_block * block)113 void mlxsw_sp_acl_block_disable_inc(struct mlxsw_sp_acl_block *block)
114 {
115 if (block)
116 block->disable_count++;
117 }
118
mlxsw_sp_acl_block_disable_dec(struct mlxsw_sp_acl_block * block)119 void mlxsw_sp_acl_block_disable_dec(struct mlxsw_sp_acl_block *block)
120 {
121 if (block)
122 block->disable_count--;
123 }
124
mlxsw_sp_acl_block_disabled(struct mlxsw_sp_acl_block * block)125 bool mlxsw_sp_acl_block_disabled(struct mlxsw_sp_acl_block *block)
126 {
127 return block->disable_count;
128 }
129
mlxsw_sp_acl_block_is_egress_bound(struct mlxsw_sp_acl_block * block)130 bool mlxsw_sp_acl_block_is_egress_bound(struct mlxsw_sp_acl_block *block)
131 {
132 struct mlxsw_sp_acl_block_binding *binding;
133
134 list_for_each_entry(binding, &block->binding_list, list) {
135 if (!binding->ingress)
136 return true;
137 }
138 return false;
139 }
140
141 static bool
mlxsw_sp_acl_ruleset_is_singular(const struct mlxsw_sp_acl_ruleset * ruleset)142 mlxsw_sp_acl_ruleset_is_singular(const struct mlxsw_sp_acl_ruleset *ruleset)
143 {
144 /* We hold a reference on ruleset ourselves */
145 return ruleset->ref_count == 2;
146 }
147
148 static int
mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_block * block,struct mlxsw_sp_acl_block_binding * binding)149 mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp,
150 struct mlxsw_sp_acl_block *block,
151 struct mlxsw_sp_acl_block_binding *binding)
152 {
153 struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero;
154 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
155
156 return ops->ruleset_bind(mlxsw_sp, ruleset->priv,
157 binding->mlxsw_sp_port, binding->ingress);
158 }
159
160 static void
mlxsw_sp_acl_ruleset_unbind(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_block * block,struct mlxsw_sp_acl_block_binding * binding)161 mlxsw_sp_acl_ruleset_unbind(struct mlxsw_sp *mlxsw_sp,
162 struct mlxsw_sp_acl_block *block,
163 struct mlxsw_sp_acl_block_binding *binding)
164 {
165 struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero;
166 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
167
168 ops->ruleset_unbind(mlxsw_sp, ruleset->priv,
169 binding->mlxsw_sp_port, binding->ingress);
170 }
171
mlxsw_sp_acl_ruleset_block_bound(struct mlxsw_sp_acl_block * block)172 static bool mlxsw_sp_acl_ruleset_block_bound(struct mlxsw_sp_acl_block *block)
173 {
174 return block->ruleset_zero;
175 }
176
177 static int
mlxsw_sp_acl_ruleset_block_bind(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_ruleset * ruleset,struct mlxsw_sp_acl_block * block)178 mlxsw_sp_acl_ruleset_block_bind(struct mlxsw_sp *mlxsw_sp,
179 struct mlxsw_sp_acl_ruleset *ruleset,
180 struct mlxsw_sp_acl_block *block)
181 {
182 struct mlxsw_sp_acl_block_binding *binding;
183 int err;
184
185 block->ruleset_zero = ruleset;
186 list_for_each_entry(binding, &block->binding_list, list) {
187 err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding);
188 if (err)
189 goto rollback;
190 }
191 return 0;
192
193 rollback:
194 list_for_each_entry_continue_reverse(binding, &block->binding_list,
195 list)
196 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding);
197 block->ruleset_zero = NULL;
198
199 return err;
200 }
201
202 static void
mlxsw_sp_acl_ruleset_block_unbind(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_ruleset * ruleset,struct mlxsw_sp_acl_block * block)203 mlxsw_sp_acl_ruleset_block_unbind(struct mlxsw_sp *mlxsw_sp,
204 struct mlxsw_sp_acl_ruleset *ruleset,
205 struct mlxsw_sp_acl_block *block)
206 {
207 struct mlxsw_sp_acl_block_binding *binding;
208
209 list_for_each_entry(binding, &block->binding_list, list)
210 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding);
211 block->ruleset_zero = NULL;
212 }
213
mlxsw_sp_acl_block_create(struct mlxsw_sp * mlxsw_sp,struct net * net)214 struct mlxsw_sp_acl_block *mlxsw_sp_acl_block_create(struct mlxsw_sp *mlxsw_sp,
215 struct net *net)
216 {
217 struct mlxsw_sp_acl_block *block;
218
219 block = kzalloc(sizeof(*block), GFP_KERNEL);
220 if (!block)
221 return NULL;
222 INIT_LIST_HEAD(&block->binding_list);
223 block->mlxsw_sp = mlxsw_sp;
224 return block;
225 }
226
mlxsw_sp_acl_block_destroy(struct mlxsw_sp_acl_block * block)227 void mlxsw_sp_acl_block_destroy(struct mlxsw_sp_acl_block *block)
228 {
229 WARN_ON(!list_empty(&block->binding_list));
230 kfree(block);
231 }
232
233 static struct mlxsw_sp_acl_block_binding *
mlxsw_sp_acl_block_lookup(struct mlxsw_sp_acl_block * block,struct mlxsw_sp_port * mlxsw_sp_port,bool ingress)234 mlxsw_sp_acl_block_lookup(struct mlxsw_sp_acl_block *block,
235 struct mlxsw_sp_port *mlxsw_sp_port, bool ingress)
236 {
237 struct mlxsw_sp_acl_block_binding *binding;
238
239 list_for_each_entry(binding, &block->binding_list, list)
240 if (binding->mlxsw_sp_port == mlxsw_sp_port &&
241 binding->ingress == ingress)
242 return binding;
243 return NULL;
244 }
245
mlxsw_sp_acl_block_bind(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_block * block,struct mlxsw_sp_port * mlxsw_sp_port,bool ingress)246 int mlxsw_sp_acl_block_bind(struct mlxsw_sp *mlxsw_sp,
247 struct mlxsw_sp_acl_block *block,
248 struct mlxsw_sp_port *mlxsw_sp_port,
249 bool ingress)
250 {
251 struct mlxsw_sp_acl_block_binding *binding;
252 int err;
253
254 if (WARN_ON(mlxsw_sp_acl_block_lookup(block, mlxsw_sp_port, ingress)))
255 return -EEXIST;
256
257 binding = kzalloc(sizeof(*binding), GFP_KERNEL);
258 if (!binding)
259 return -ENOMEM;
260 binding->mlxsw_sp_port = mlxsw_sp_port;
261 binding->ingress = ingress;
262
263 if (mlxsw_sp_acl_ruleset_block_bound(block)) {
264 err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding);
265 if (err)
266 goto err_ruleset_bind;
267 }
268
269 list_add(&binding->list, &block->binding_list);
270 return 0;
271
272 err_ruleset_bind:
273 kfree(binding);
274 return err;
275 }
276
mlxsw_sp_acl_block_unbind(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_block * block,struct mlxsw_sp_port * mlxsw_sp_port,bool ingress)277 int mlxsw_sp_acl_block_unbind(struct mlxsw_sp *mlxsw_sp,
278 struct mlxsw_sp_acl_block *block,
279 struct mlxsw_sp_port *mlxsw_sp_port,
280 bool ingress)
281 {
282 struct mlxsw_sp_acl_block_binding *binding;
283
284 binding = mlxsw_sp_acl_block_lookup(block, mlxsw_sp_port, ingress);
285 if (!binding)
286 return -ENOENT;
287
288 list_del(&binding->list);
289
290 if (mlxsw_sp_acl_ruleset_block_bound(block))
291 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding);
292
293 kfree(binding);
294 return 0;
295 }
296
297 static struct mlxsw_sp_acl_ruleset *
mlxsw_sp_acl_ruleset_create(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_block * block,u32 chain_index,const struct mlxsw_sp_acl_profile_ops * ops,struct mlxsw_afk_element_usage * tmplt_elusage)298 mlxsw_sp_acl_ruleset_create(struct mlxsw_sp *mlxsw_sp,
299 struct mlxsw_sp_acl_block *block, u32 chain_index,
300 const struct mlxsw_sp_acl_profile_ops *ops,
301 struct mlxsw_afk_element_usage *tmplt_elusage)
302 {
303 struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
304 struct mlxsw_sp_acl_ruleset *ruleset;
305 size_t alloc_size;
306 int err;
307
308 alloc_size = sizeof(*ruleset) + ops->ruleset_priv_size;
309 ruleset = kzalloc(alloc_size, GFP_KERNEL);
310 if (!ruleset)
311 return ERR_PTR(-ENOMEM);
312 ruleset->ref_count = 1;
313 ruleset->ht_key.block = block;
314 ruleset->ht_key.chain_index = chain_index;
315 ruleset->ht_key.ops = ops;
316
317 err = rhashtable_init(&ruleset->rule_ht, &mlxsw_sp_acl_rule_ht_params);
318 if (err)
319 goto err_rhashtable_init;
320
321 err = ops->ruleset_add(mlxsw_sp, &acl->tcam, ruleset->priv,
322 tmplt_elusage);
323 if (err)
324 goto err_ops_ruleset_add;
325
326 err = rhashtable_insert_fast(&acl->ruleset_ht, &ruleset->ht_node,
327 mlxsw_sp_acl_ruleset_ht_params);
328 if (err)
329 goto err_ht_insert;
330
331 return ruleset;
332
333 err_ht_insert:
334 ops->ruleset_del(mlxsw_sp, ruleset->priv);
335 err_ops_ruleset_add:
336 rhashtable_destroy(&ruleset->rule_ht);
337 err_rhashtable_init:
338 kfree(ruleset);
339 return ERR_PTR(err);
340 }
341
mlxsw_sp_acl_ruleset_destroy(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_ruleset * ruleset)342 static void mlxsw_sp_acl_ruleset_destroy(struct mlxsw_sp *mlxsw_sp,
343 struct mlxsw_sp_acl_ruleset *ruleset)
344 {
345 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
346 struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
347
348 rhashtable_remove_fast(&acl->ruleset_ht, &ruleset->ht_node,
349 mlxsw_sp_acl_ruleset_ht_params);
350 ops->ruleset_del(mlxsw_sp, ruleset->priv);
351 rhashtable_destroy(&ruleset->rule_ht);
352 kfree(ruleset);
353 }
354
mlxsw_sp_acl_ruleset_ref_inc(struct mlxsw_sp_acl_ruleset * ruleset)355 static void mlxsw_sp_acl_ruleset_ref_inc(struct mlxsw_sp_acl_ruleset *ruleset)
356 {
357 ruleset->ref_count++;
358 }
359
mlxsw_sp_acl_ruleset_ref_dec(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_ruleset * ruleset)360 static void mlxsw_sp_acl_ruleset_ref_dec(struct mlxsw_sp *mlxsw_sp,
361 struct mlxsw_sp_acl_ruleset *ruleset)
362 {
363 if (--ruleset->ref_count)
364 return;
365 mlxsw_sp_acl_ruleset_destroy(mlxsw_sp, ruleset);
366 }
367
368 static struct mlxsw_sp_acl_ruleset *
__mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp_acl * acl,struct mlxsw_sp_acl_block * block,u32 chain_index,const struct mlxsw_sp_acl_profile_ops * ops)369 __mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp_acl *acl,
370 struct mlxsw_sp_acl_block *block, u32 chain_index,
371 const struct mlxsw_sp_acl_profile_ops *ops)
372 {
373 struct mlxsw_sp_acl_ruleset_ht_key ht_key;
374
375 memset(&ht_key, 0, sizeof(ht_key));
376 ht_key.block = block;
377 ht_key.chain_index = chain_index;
378 ht_key.ops = ops;
379 return rhashtable_lookup_fast(&acl->ruleset_ht, &ht_key,
380 mlxsw_sp_acl_ruleset_ht_params);
381 }
382
383 struct mlxsw_sp_acl_ruleset *
mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_block * block,u32 chain_index,enum mlxsw_sp_acl_profile profile)384 mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp *mlxsw_sp,
385 struct mlxsw_sp_acl_block *block, u32 chain_index,
386 enum mlxsw_sp_acl_profile profile)
387 {
388 const struct mlxsw_sp_acl_profile_ops *ops;
389 struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
390 struct mlxsw_sp_acl_ruleset *ruleset;
391
392 ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile);
393 if (!ops)
394 return ERR_PTR(-EINVAL);
395 ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops);
396 if (!ruleset)
397 return ERR_PTR(-ENOENT);
398 return ruleset;
399 }
400
401 struct mlxsw_sp_acl_ruleset *
mlxsw_sp_acl_ruleset_get(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_block * block,u32 chain_index,enum mlxsw_sp_acl_profile profile,struct mlxsw_afk_element_usage * tmplt_elusage)402 mlxsw_sp_acl_ruleset_get(struct mlxsw_sp *mlxsw_sp,
403 struct mlxsw_sp_acl_block *block, u32 chain_index,
404 enum mlxsw_sp_acl_profile profile,
405 struct mlxsw_afk_element_usage *tmplt_elusage)
406 {
407 const struct mlxsw_sp_acl_profile_ops *ops;
408 struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
409 struct mlxsw_sp_acl_ruleset *ruleset;
410
411 ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile);
412 if (!ops)
413 return ERR_PTR(-EINVAL);
414
415 ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops);
416 if (ruleset) {
417 mlxsw_sp_acl_ruleset_ref_inc(ruleset);
418 return ruleset;
419 }
420 return mlxsw_sp_acl_ruleset_create(mlxsw_sp, block, chain_index, ops,
421 tmplt_elusage);
422 }
423
mlxsw_sp_acl_ruleset_put(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_ruleset * ruleset)424 void mlxsw_sp_acl_ruleset_put(struct mlxsw_sp *mlxsw_sp,
425 struct mlxsw_sp_acl_ruleset *ruleset)
426 {
427 mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
428 }
429
mlxsw_sp_acl_ruleset_group_id(struct mlxsw_sp_acl_ruleset * ruleset)430 u16 mlxsw_sp_acl_ruleset_group_id(struct mlxsw_sp_acl_ruleset *ruleset)
431 {
432 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
433
434 return ops->ruleset_group_id(ruleset->priv);
435 }
436
437 struct mlxsw_sp_acl_rule_info *
mlxsw_sp_acl_rulei_create(struct mlxsw_sp_acl * acl)438 mlxsw_sp_acl_rulei_create(struct mlxsw_sp_acl *acl)
439 {
440 struct mlxsw_sp_acl_rule_info *rulei;
441 int err;
442
443 rulei = kzalloc(sizeof(*rulei), GFP_KERNEL);
444 if (!rulei)
445 return NULL;
446 rulei->act_block = mlxsw_afa_block_create(acl->mlxsw_sp->afa);
447 if (IS_ERR(rulei->act_block)) {
448 err = PTR_ERR(rulei->act_block);
449 goto err_afa_block_create;
450 }
451 return rulei;
452
453 err_afa_block_create:
454 kfree(rulei);
455 return ERR_PTR(err);
456 }
457
mlxsw_sp_acl_rulei_destroy(struct mlxsw_sp_acl_rule_info * rulei)458 void mlxsw_sp_acl_rulei_destroy(struct mlxsw_sp_acl_rule_info *rulei)
459 {
460 mlxsw_afa_block_destroy(rulei->act_block);
461 kfree(rulei);
462 }
463
mlxsw_sp_acl_rulei_commit(struct mlxsw_sp_acl_rule_info * rulei)464 int mlxsw_sp_acl_rulei_commit(struct mlxsw_sp_acl_rule_info *rulei)
465 {
466 return mlxsw_afa_block_commit(rulei->act_block);
467 }
468
mlxsw_sp_acl_rulei_priority(struct mlxsw_sp_acl_rule_info * rulei,unsigned int priority)469 void mlxsw_sp_acl_rulei_priority(struct mlxsw_sp_acl_rule_info *rulei,
470 unsigned int priority)
471 {
472 rulei->priority = priority >> 16;
473 }
474
mlxsw_sp_acl_rulei_keymask_u32(struct mlxsw_sp_acl_rule_info * rulei,enum mlxsw_afk_element element,u32 key_value,u32 mask_value)475 void mlxsw_sp_acl_rulei_keymask_u32(struct mlxsw_sp_acl_rule_info *rulei,
476 enum mlxsw_afk_element element,
477 u32 key_value, u32 mask_value)
478 {
479 mlxsw_afk_values_add_u32(&rulei->values, element,
480 key_value, mask_value);
481 }
482
mlxsw_sp_acl_rulei_keymask_buf(struct mlxsw_sp_acl_rule_info * rulei,enum mlxsw_afk_element element,const char * key_value,const char * mask_value,unsigned int len)483 void mlxsw_sp_acl_rulei_keymask_buf(struct mlxsw_sp_acl_rule_info *rulei,
484 enum mlxsw_afk_element element,
485 const char *key_value,
486 const char *mask_value, unsigned int len)
487 {
488 mlxsw_afk_values_add_buf(&rulei->values, element,
489 key_value, mask_value, len);
490 }
491
mlxsw_sp_acl_rulei_act_continue(struct mlxsw_sp_acl_rule_info * rulei)492 int mlxsw_sp_acl_rulei_act_continue(struct mlxsw_sp_acl_rule_info *rulei)
493 {
494 return mlxsw_afa_block_continue(rulei->act_block);
495 }
496
mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info * rulei,u16 group_id)497 int mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info *rulei,
498 u16 group_id)
499 {
500 return mlxsw_afa_block_jump(rulei->act_block, group_id);
501 }
502
mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info * rulei)503 int mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info *rulei)
504 {
505 return mlxsw_afa_block_terminate(rulei->act_block);
506 }
507
mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info * rulei)508 int mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info *rulei)
509 {
510 return mlxsw_afa_block_append_drop(rulei->act_block);
511 }
512
mlxsw_sp_acl_rulei_act_trap(struct mlxsw_sp_acl_rule_info * rulei)513 int mlxsw_sp_acl_rulei_act_trap(struct mlxsw_sp_acl_rule_info *rulei)
514 {
515 return mlxsw_afa_block_append_trap(rulei->act_block,
516 MLXSW_TRAP_ID_ACL0);
517 }
518
mlxsw_sp_acl_rulei_act_fwd(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,struct net_device * out_dev,struct netlink_ext_ack * extack)519 int mlxsw_sp_acl_rulei_act_fwd(struct mlxsw_sp *mlxsw_sp,
520 struct mlxsw_sp_acl_rule_info *rulei,
521 struct net_device *out_dev,
522 struct netlink_ext_ack *extack)
523 {
524 struct mlxsw_sp_port *mlxsw_sp_port;
525 u8 local_port;
526 bool in_port;
527
528 if (out_dev) {
529 if (!mlxsw_sp_port_dev_check(out_dev)) {
530 NL_SET_ERR_MSG_MOD(extack, "Invalid output device");
531 return -EINVAL;
532 }
533 mlxsw_sp_port = netdev_priv(out_dev);
534 if (mlxsw_sp_port->mlxsw_sp != mlxsw_sp) {
535 NL_SET_ERR_MSG_MOD(extack, "Invalid output device");
536 return -EINVAL;
537 }
538 local_port = mlxsw_sp_port->local_port;
539 in_port = false;
540 } else {
541 /* If out_dev is NULL, the caller wants to
542 * set forward to ingress port.
543 */
544 local_port = 0;
545 in_port = true;
546 }
547 return mlxsw_afa_block_append_fwd(rulei->act_block,
548 local_port, in_port, extack);
549 }
550
mlxsw_sp_acl_rulei_act_mirror(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,struct mlxsw_sp_acl_block * block,struct net_device * out_dev,struct netlink_ext_ack * extack)551 int mlxsw_sp_acl_rulei_act_mirror(struct mlxsw_sp *mlxsw_sp,
552 struct mlxsw_sp_acl_rule_info *rulei,
553 struct mlxsw_sp_acl_block *block,
554 struct net_device *out_dev,
555 struct netlink_ext_ack *extack)
556 {
557 struct mlxsw_sp_acl_block_binding *binding;
558 struct mlxsw_sp_port *in_port;
559
560 if (!list_is_singular(&block->binding_list)) {
561 NL_SET_ERR_MSG_MOD(extack, "Only a single mirror source is allowed");
562 return -EOPNOTSUPP;
563 }
564 binding = list_first_entry(&block->binding_list,
565 struct mlxsw_sp_acl_block_binding, list);
566 in_port = binding->mlxsw_sp_port;
567
568 return mlxsw_afa_block_append_mirror(rulei->act_block,
569 in_port->local_port,
570 out_dev,
571 binding->ingress,
572 extack);
573 }
574
mlxsw_sp_acl_rulei_act_vlan(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,u32 action,u16 vid,u16 proto,u8 prio,struct netlink_ext_ack * extack)575 int mlxsw_sp_acl_rulei_act_vlan(struct mlxsw_sp *mlxsw_sp,
576 struct mlxsw_sp_acl_rule_info *rulei,
577 u32 action, u16 vid, u16 proto, u8 prio,
578 struct netlink_ext_ack *extack)
579 {
580 u8 ethertype;
581
582 if (action == TCA_VLAN_ACT_MODIFY) {
583 switch (proto) {
584 case ETH_P_8021Q:
585 ethertype = 0;
586 break;
587 case ETH_P_8021AD:
588 ethertype = 1;
589 break;
590 default:
591 NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN protocol");
592 dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN protocol %#04x\n",
593 proto);
594 return -EINVAL;
595 }
596
597 return mlxsw_afa_block_append_vlan_modify(rulei->act_block,
598 vid, prio, ethertype,
599 extack);
600 } else {
601 NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN action");
602 dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN action\n");
603 return -EINVAL;
604 }
605 }
606
mlxsw_sp_acl_rulei_act_count(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,struct netlink_ext_ack * extack)607 int mlxsw_sp_acl_rulei_act_count(struct mlxsw_sp *mlxsw_sp,
608 struct mlxsw_sp_acl_rule_info *rulei,
609 struct netlink_ext_ack *extack)
610 {
611 return mlxsw_afa_block_append_counter(rulei->act_block,
612 &rulei->counter_index, extack);
613 }
614
mlxsw_sp_acl_rulei_act_fid_set(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule_info * rulei,u16 fid,struct netlink_ext_ack * extack)615 int mlxsw_sp_acl_rulei_act_fid_set(struct mlxsw_sp *mlxsw_sp,
616 struct mlxsw_sp_acl_rule_info *rulei,
617 u16 fid, struct netlink_ext_ack *extack)
618 {
619 return mlxsw_afa_block_append_fid_set(rulei->act_block, fid, extack);
620 }
621
622 struct mlxsw_sp_acl_rule *
mlxsw_sp_acl_rule_create(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_ruleset * ruleset,unsigned long cookie,struct netlink_ext_ack * extack)623 mlxsw_sp_acl_rule_create(struct mlxsw_sp *mlxsw_sp,
624 struct mlxsw_sp_acl_ruleset *ruleset,
625 unsigned long cookie,
626 struct netlink_ext_ack *extack)
627 {
628 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
629 struct mlxsw_sp_acl_rule *rule;
630 int err;
631
632 mlxsw_sp_acl_ruleset_ref_inc(ruleset);
633 rule = kzalloc(sizeof(*rule) + ops->rule_priv_size(mlxsw_sp),
634 GFP_KERNEL);
635 if (!rule) {
636 err = -ENOMEM;
637 goto err_alloc;
638 }
639 rule->cookie = cookie;
640 rule->ruleset = ruleset;
641
642 rule->rulei = mlxsw_sp_acl_rulei_create(mlxsw_sp->acl);
643 if (IS_ERR(rule->rulei)) {
644 err = PTR_ERR(rule->rulei);
645 goto err_rulei_create;
646 }
647
648 return rule;
649
650 err_rulei_create:
651 kfree(rule);
652 err_alloc:
653 mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
654 return ERR_PTR(err);
655 }
656
mlxsw_sp_acl_rule_destroy(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule * rule)657 void mlxsw_sp_acl_rule_destroy(struct mlxsw_sp *mlxsw_sp,
658 struct mlxsw_sp_acl_rule *rule)
659 {
660 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
661
662 mlxsw_sp_acl_rulei_destroy(rule->rulei);
663 kfree(rule);
664 mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
665 }
666
mlxsw_sp_acl_rule_add(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule * rule)667 int mlxsw_sp_acl_rule_add(struct mlxsw_sp *mlxsw_sp,
668 struct mlxsw_sp_acl_rule *rule)
669 {
670 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
671 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
672 int err;
673
674 err = ops->rule_add(mlxsw_sp, ruleset->priv, rule->priv, rule->rulei);
675 if (err)
676 return err;
677
678 err = rhashtable_insert_fast(&ruleset->rule_ht, &rule->ht_node,
679 mlxsw_sp_acl_rule_ht_params);
680 if (err)
681 goto err_rhashtable_insert;
682
683 if (!ruleset->ht_key.chain_index &&
684 mlxsw_sp_acl_ruleset_is_singular(ruleset)) {
685 /* We only need ruleset with chain index 0, the implicit
686 * one, to be directly bound to device. The rest of the
687 * rulesets are bound by "Goto action set".
688 */
689 err = mlxsw_sp_acl_ruleset_block_bind(mlxsw_sp, ruleset,
690 ruleset->ht_key.block);
691 if (err)
692 goto err_ruleset_block_bind;
693 }
694
695 list_add_tail(&rule->list, &mlxsw_sp->acl->rules);
696 ruleset->ht_key.block->rule_count++;
697 return 0;
698
699 err_ruleset_block_bind:
700 rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node,
701 mlxsw_sp_acl_rule_ht_params);
702 err_rhashtable_insert:
703 ops->rule_del(mlxsw_sp, rule->priv);
704 return err;
705 }
706
mlxsw_sp_acl_rule_del(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule * rule)707 void mlxsw_sp_acl_rule_del(struct mlxsw_sp *mlxsw_sp,
708 struct mlxsw_sp_acl_rule *rule)
709 {
710 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
711 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
712
713 ruleset->ht_key.block->rule_count--;
714 list_del(&rule->list);
715 if (!ruleset->ht_key.chain_index &&
716 mlxsw_sp_acl_ruleset_is_singular(ruleset))
717 mlxsw_sp_acl_ruleset_block_unbind(mlxsw_sp, ruleset,
718 ruleset->ht_key.block);
719 rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node,
720 mlxsw_sp_acl_rule_ht_params);
721 ops->rule_del(mlxsw_sp, rule->priv);
722 }
723
724 struct mlxsw_sp_acl_rule *
mlxsw_sp_acl_rule_lookup(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_ruleset * ruleset,unsigned long cookie)725 mlxsw_sp_acl_rule_lookup(struct mlxsw_sp *mlxsw_sp,
726 struct mlxsw_sp_acl_ruleset *ruleset,
727 unsigned long cookie)
728 {
729 return rhashtable_lookup_fast(&ruleset->rule_ht, &cookie,
730 mlxsw_sp_acl_rule_ht_params);
731 }
732
733 struct mlxsw_sp_acl_rule_info *
mlxsw_sp_acl_rule_rulei(struct mlxsw_sp_acl_rule * rule)734 mlxsw_sp_acl_rule_rulei(struct mlxsw_sp_acl_rule *rule)
735 {
736 return rule->rulei;
737 }
738
mlxsw_sp_acl_rule_activity_update(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule * rule)739 static int mlxsw_sp_acl_rule_activity_update(struct mlxsw_sp *mlxsw_sp,
740 struct mlxsw_sp_acl_rule *rule)
741 {
742 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
743 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
744 bool active;
745 int err;
746
747 err = ops->rule_activity_get(mlxsw_sp, rule->priv, &active);
748 if (err)
749 return err;
750 if (active)
751 rule->last_used = jiffies;
752 return 0;
753 }
754
mlxsw_sp_acl_rules_activity_update(struct mlxsw_sp_acl * acl)755 static int mlxsw_sp_acl_rules_activity_update(struct mlxsw_sp_acl *acl)
756 {
757 struct mlxsw_sp_acl_rule *rule;
758 int err;
759
760 /* Protect internal structures from changes */
761 rtnl_lock();
762 list_for_each_entry(rule, &acl->rules, list) {
763 err = mlxsw_sp_acl_rule_activity_update(acl->mlxsw_sp,
764 rule);
765 if (err)
766 goto err_rule_update;
767 }
768 rtnl_unlock();
769 return 0;
770
771 err_rule_update:
772 rtnl_unlock();
773 return err;
774 }
775
mlxsw_sp_acl_rule_activity_work_schedule(struct mlxsw_sp_acl * acl)776 static void mlxsw_sp_acl_rule_activity_work_schedule(struct mlxsw_sp_acl *acl)
777 {
778 unsigned long interval = acl->rule_activity_update.interval;
779
780 mlxsw_core_schedule_dw(&acl->rule_activity_update.dw,
781 msecs_to_jiffies(interval));
782 }
783
mlxsw_sp_acl_rul_activity_update_work(struct work_struct * work)784 static void mlxsw_sp_acl_rul_activity_update_work(struct work_struct *work)
785 {
786 struct mlxsw_sp_acl *acl = container_of(work, struct mlxsw_sp_acl,
787 rule_activity_update.dw.work);
788 int err;
789
790 err = mlxsw_sp_acl_rules_activity_update(acl);
791 if (err)
792 dev_err(acl->mlxsw_sp->bus_info->dev, "Could not update acl activity");
793
794 mlxsw_sp_acl_rule_activity_work_schedule(acl);
795 }
796
mlxsw_sp_acl_rule_get_stats(struct mlxsw_sp * mlxsw_sp,struct mlxsw_sp_acl_rule * rule,u64 * packets,u64 * bytes,u64 * last_use)797 int mlxsw_sp_acl_rule_get_stats(struct mlxsw_sp *mlxsw_sp,
798 struct mlxsw_sp_acl_rule *rule,
799 u64 *packets, u64 *bytes, u64 *last_use)
800
801 {
802 struct mlxsw_sp_acl_rule_info *rulei;
803 u64 current_packets;
804 u64 current_bytes;
805 int err;
806
807 rulei = mlxsw_sp_acl_rule_rulei(rule);
808 err = mlxsw_sp_flow_counter_get(mlxsw_sp, rulei->counter_index,
809 ¤t_packets, ¤t_bytes);
810 if (err)
811 return err;
812
813 *packets = current_packets - rule->last_packets;
814 *bytes = current_bytes - rule->last_bytes;
815 *last_use = rule->last_used;
816
817 rule->last_bytes = current_bytes;
818 rule->last_packets = current_packets;
819
820 return 0;
821 }
822
mlxsw_sp_acl_init(struct mlxsw_sp * mlxsw_sp)823 int mlxsw_sp_acl_init(struct mlxsw_sp *mlxsw_sp)
824 {
825 struct mlxsw_sp_fid *fid;
826 struct mlxsw_sp_acl *acl;
827 size_t alloc_size;
828 int err;
829
830 alloc_size = sizeof(*acl) + mlxsw_sp_acl_tcam_priv_size(mlxsw_sp);
831 acl = kzalloc(alloc_size, GFP_KERNEL);
832 if (!acl)
833 return -ENOMEM;
834 mlxsw_sp->acl = acl;
835 acl->mlxsw_sp = mlxsw_sp;
836 acl->afk = mlxsw_afk_create(MLXSW_CORE_RES_GET(mlxsw_sp->core,
837 ACL_FLEX_KEYS),
838 mlxsw_sp->afk_ops);
839 if (!acl->afk) {
840 err = -ENOMEM;
841 goto err_afk_create;
842 }
843
844 err = rhashtable_init(&acl->ruleset_ht,
845 &mlxsw_sp_acl_ruleset_ht_params);
846 if (err)
847 goto err_rhashtable_init;
848
849 fid = mlxsw_sp_fid_dummy_get(mlxsw_sp);
850 if (IS_ERR(fid)) {
851 err = PTR_ERR(fid);
852 goto err_fid_get;
853 }
854 acl->dummy_fid = fid;
855
856 INIT_LIST_HEAD(&acl->rules);
857 err = mlxsw_sp_acl_tcam_init(mlxsw_sp, &acl->tcam);
858 if (err)
859 goto err_acl_ops_init;
860
861 /* Create the delayed work for the rule activity_update */
862 INIT_DELAYED_WORK(&acl->rule_activity_update.dw,
863 mlxsw_sp_acl_rul_activity_update_work);
864 acl->rule_activity_update.interval = MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS;
865 mlxsw_core_schedule_dw(&acl->rule_activity_update.dw, 0);
866 return 0;
867
868 err_acl_ops_init:
869 mlxsw_sp_fid_put(fid);
870 err_fid_get:
871 rhashtable_destroy(&acl->ruleset_ht);
872 err_rhashtable_init:
873 mlxsw_afk_destroy(acl->afk);
874 err_afk_create:
875 kfree(acl);
876 return err;
877 }
878
mlxsw_sp_acl_fini(struct mlxsw_sp * mlxsw_sp)879 void mlxsw_sp_acl_fini(struct mlxsw_sp *mlxsw_sp)
880 {
881 struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
882
883 cancel_delayed_work_sync(&mlxsw_sp->acl->rule_activity_update.dw);
884 mlxsw_sp_acl_tcam_fini(mlxsw_sp, &acl->tcam);
885 WARN_ON(!list_empty(&acl->rules));
886 mlxsw_sp_fid_put(acl->dummy_fid);
887 rhashtable_destroy(&acl->ruleset_ht);
888 mlxsw_afk_destroy(acl->afk);
889 kfree(acl);
890 }
891