drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c

   1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
   2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */
   3
   4 #include <linux/kernel.h>
   5 #include <linux/slab.h>
   6 #include <linux/errno.h>
   7 #include <linux/list.h>
   8 #include <linux/string.h>
   9 #include <linux/rhashtable.h>
  10 #include <linux/netdevice.h>
  11 #include <linux/mutex.h>
  12 #include <net/net_namespace.h>
  13 #include <net/tc_act/tc_vlan.h>
  14
  15 #include "reg.h"
  16 #include "core.h"
  17 #include "resources.h"
  18 #include "spectrum.h"
  19 #include "core_acl_flex_keys.h"
  20 #include "core_acl_flex_actions.h"
  21 #include "spectrum_acl_tcam.h"
  22
  23 struct mlxsw_sp_acl {
  24         struct mlxsw_sp *mlxsw_sp;
  25         struct mlxsw_afk *afk;
  26         struct mlxsw_sp_fid *dummy_fid;
  27         struct rhashtable ruleset_ht;
  28         struct list_head rules;
  29         struct mutex rules_lock; /* Protects rules list */
  30         struct {
  31                 struct delayed_work dw;
  32                 unsigned long interval; /* ms */
  33 #define MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS 1000
  34         } rule_activity_update;
  35         struct mlxsw_sp_acl_tcam tcam;
  36 };
  37
  38 struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl)
  39 {
  40         return acl->afk;
  41 }
  42
  43 struct mlxsw_sp_acl_block_binding {
  44         struct list_head list;
  45         struct net_device *dev;
  46         struct mlxsw_sp_port *mlxsw_sp_port;
  47         bool ingress;
  48 };
  49
  50 struct mlxsw_sp_acl_ruleset_ht_key {
  51         struct mlxsw_sp_acl_block *block;
  52         u32 chain_index;
  53         const struct mlxsw_sp_acl_profile_ops *ops;
  54 };
  55
  56 struct mlxsw_sp_acl_ruleset {
  57         struct rhash_head ht_node; /* Member of acl HT */
  58         struct mlxsw_sp_acl_ruleset_ht_key ht_key;
  59         struct rhashtable rule_ht;
  60         unsigned int ref_count;
  61         unsigned long priv[];
  62         /* priv has to be always the last item */
  63 };
  64
  65 struct mlxsw_sp_acl_rule {
  66         struct rhash_head ht_node; /* Member of rule HT */
  67         struct list_head list;
  68         unsigned long cookie; /* HT key */
  69         struct mlxsw_sp_acl_ruleset *ruleset;
  70         struct mlxsw_sp_acl_rule_info *rulei;
  71         u64 last_used;
  72         u64 last_packets;
  73         u64 last_bytes;
  74         unsigned long priv[];
  75         /* priv has to be always the last item */
  76 };
  77
  78 static const struct rhashtable_params mlxsw_sp_acl_ruleset_ht_params = {
  79         .key_len = sizeof(struct mlxsw_sp_acl_ruleset_ht_key),
  80         .key_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_key),
  81         .head_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_node),
  82         .automatic_shrinking = true,
  83 };
  84
  85 static const struct rhashtable_params mlxsw_sp_acl_rule_ht_params = {
  86         .key_len = sizeof(unsigned long),
  87         .key_offset = offsetof(struct mlxsw_sp_acl_rule, cookie),
  88         .head_offset = offsetof(struct mlxsw_sp_acl_rule, ht_node),
  89         .automatic_shrinking = true,
  90 };
  91
  92 struct mlxsw_sp_fid *mlxsw_sp_acl_dummy_fid(struct mlxsw_sp *mlxsw_sp)
  93 {
  94         return mlxsw_sp->acl->dummy_fid;
  95 }
  96
  97 struct mlxsw_sp *mlxsw_sp_acl_block_mlxsw_sp(struct mlxsw_sp_acl_block *block)
  98 {
  99         return block->mlxsw_sp;
 100 }
 101
 102 unsigned int
 103 mlxsw_sp_acl_block_rule_count(const struct mlxsw_sp_acl_block *block)
 104 {
 105         return block ? block->rule_count : 0;
 106 }
 107
 108 void mlxsw_sp_acl_block_disable_inc(struct mlxsw_sp_acl_block *block)
 109 {
 110         if (block)
 111                 block->disable_count++;
 112 }
 113
 114 void mlxsw_sp_acl_block_disable_dec(struct mlxsw_sp_acl_block *block)
 115 {
 116         if (block)
 117                 block->disable_count--;
 118 }
 119
 120 bool mlxsw_sp_acl_block_disabled(const struct mlxsw_sp_acl_block *block)
 121 {
 122         return block->disable_count;
 123 }
 124
 125 bool mlxsw_sp_acl_block_is_egress_bound(const struct mlxsw_sp_acl_block *block)
 126 {
 127         return block->egress_binding_count;
 128 }
 129
 130 bool mlxsw_sp_acl_block_is_ingress_bound(const struct mlxsw_sp_acl_block *block)
 131 {
 132         return block->ingress_binding_count;
 133 }
 134
 135 bool mlxsw_sp_acl_block_is_mixed_bound(const struct mlxsw_sp_acl_block *block)
 136 {
 137         return block->ingress_binding_count && block->egress_binding_count;
 138 }
 139
 140 static bool
 141 mlxsw_sp_acl_ruleset_is_singular(const struct mlxsw_sp_acl_ruleset *ruleset)
 142 {
 143         /* We hold a reference on ruleset ourselves */
 144         return ruleset->ref_count == 2;
 145 }
 146
 147 static int
 148 mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp,
 149                           struct mlxsw_sp_acl_block *block,
 150                           struct mlxsw_sp_acl_block_binding *binding)
 151 {
 152         struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero;
 153         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 154
 155         return ops->ruleset_bind(mlxsw_sp, ruleset->priv,
 156                                  binding->mlxsw_sp_port, binding->ingress);
 157 }
 158
 159 static void
 160 mlxsw_sp_acl_ruleset_unbind(struct mlxsw_sp *mlxsw_sp,
 161                             struct mlxsw_sp_acl_block *block,
 162                             struct mlxsw_sp_acl_block_binding *binding)
 163 {
 164         struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero;
 165         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 166
 167         ops->ruleset_unbind(mlxsw_sp, ruleset->priv,
 168                             binding->mlxsw_sp_port, binding->ingress);
 169 }
 170
 171 static bool
 172 mlxsw_sp_acl_ruleset_block_bound(const struct mlxsw_sp_acl_block *block)
 173 {
 174         return block->ruleset_zero;
 175 }
 176
 177 static int
 178 mlxsw_sp_acl_ruleset_block_bind(struct mlxsw_sp *mlxsw_sp,
 179                                 struct mlxsw_sp_acl_ruleset *ruleset,
 180                                 struct mlxsw_sp_acl_block *block)
 181 {
 182         struct mlxsw_sp_acl_block_binding *binding;
 183         int err;
 184
 185         block->ruleset_zero = ruleset;
 186         list_for_each_entry(binding, &block->binding_list, list) {
 187                 err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding);
 188                 if (err)
 189                         goto rollback;
 190         }
 191         return 0;
 192
 193 rollback:
 194         list_for_each_entry_continue_reverse(binding, &block->binding_list,
 195                                              list)
 196                 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding);
 197         block->ruleset_zero = NULL;
 198
 199         return err;
 200 }
 201
 202 static void
 203 mlxsw_sp_acl_ruleset_block_unbind(struct mlxsw_sp *mlxsw_sp,
 204                                   struct mlxsw_sp_acl_ruleset *ruleset,
 205                                   struct mlxsw_sp_acl_block *block)
 206 {
 207         struct mlxsw_sp_acl_block_binding *binding;
 208
 209         list_for_each_entry(binding, &block->binding_list, list)
 210                 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding);
 211         block->ruleset_zero = NULL;
 212 }
 213
 214 struct mlxsw_sp_acl_block *mlxsw_sp_acl_block_create(struct mlxsw_sp *mlxsw_sp,
 215                                                      struct net *net)
 216 {
 217         struct mlxsw_sp_acl_block *block;
 218
 219         block = kzalloc(sizeof(*block), GFP_KERNEL);
 220         if (!block)
 221                 return NULL;
 222         INIT_LIST_HEAD(&block->binding_list);
 223         block->mlxsw_sp = mlxsw_sp;
 224         block->net = net;
 225         return block;
 226 }
 227
 228 void mlxsw_sp_acl_block_destroy(struct mlxsw_sp_acl_block *block)
 229 {
 230         WARN_ON(!list_empty(&block->binding_list));
 231         kfree(block);
 232 }
 233
 234 static struct mlxsw_sp_acl_block_binding *
 235 mlxsw_sp_acl_block_lookup(struct mlxsw_sp_acl_block *block,
 236                           struct mlxsw_sp_port *mlxsw_sp_port, bool ingress)
 237 {
 238         struct mlxsw_sp_acl_block_binding *binding;
 239
 240         list_for_each_entry(binding, &block->binding_list, list)
 241                 if (binding->mlxsw_sp_port == mlxsw_sp_port &&
 242                     binding->ingress == ingress)
 243                         return binding;
 244         return NULL;
 245 }
 246
 247 int mlxsw_sp_acl_block_bind(struct mlxsw_sp *mlxsw_sp,
 248                             struct mlxsw_sp_acl_block *block,
 249                             struct mlxsw_sp_port *mlxsw_sp_port,
 250                             bool ingress,
 251                             struct netlink_ext_ack *extack)
 252 {
 253         struct mlxsw_sp_acl_block_binding *binding;
 254         int err;
 255
 256         if (WARN_ON(mlxsw_sp_acl_block_lookup(block, mlxsw_sp_port, ingress)))
 257                 return -EEXIST;
 258
 259         if (ingress && block->ingress_blocker_rule_count) {
 260                 NL_SET_ERR_MSG_MOD(extack, "Block cannot be bound to ingress because it contains unsupported rules");
 261                 return -EOPNOTSUPP;
 262         }
 263
 264         if (!ingress && block->egress_blocker_rule_count) {
 265                 NL_SET_ERR_MSG_MOD(extack, "Block cannot be bound to egress because it contains unsupported rules");
 266                 return -EOPNOTSUPP;
 267         }
 268
 269         binding = kzalloc(sizeof(*binding), GFP_KERNEL);
 270         if (!binding)
 271                 return -ENOMEM;
 272         binding->mlxsw_sp_port = mlxsw_sp_port;
 273         binding->ingress = ingress;
 274
 275         if (mlxsw_sp_acl_ruleset_block_bound(block)) {
 276                 err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding);
 277                 if (err)
 278                         goto err_ruleset_bind;
 279         }
 280
 281         if (ingress)
 282                 block->ingress_binding_count++;
 283         else
 284                 block->egress_binding_count++;
 285         list_add(&binding->list, &block->binding_list);
 286         return 0;
 287
 288 err_ruleset_bind:
 289         kfree(binding);
 290         return err;
 291 }
 292
 293 int mlxsw_sp_acl_block_unbind(struct mlxsw_sp *mlxsw_sp,
 294                               struct mlxsw_sp_acl_block *block,
 295                               struct mlxsw_sp_port *mlxsw_sp_port,
 296                               bool ingress)
 297 {
 298         struct mlxsw_sp_acl_block_binding *binding;
 299
 300         binding = mlxsw_sp_acl_block_lookup(block, mlxsw_sp_port, ingress);
 301         if (!binding)
 302                 return -ENOENT;
 303
 304         list_del(&binding->list);
 305
 306         if (ingress)
 307                 block->ingress_binding_count--;
 308         else
 309                 block->egress_binding_count--;
 310
 311         if (mlxsw_sp_acl_ruleset_block_bound(block))
 312                 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding);
 313
 314         kfree(binding);
 315         return 0;
 316 }
 317
 318 static struct mlxsw_sp_acl_ruleset *
 319 mlxsw_sp_acl_ruleset_create(struct mlxsw_sp *mlxsw_sp,
 320                             struct mlxsw_sp_acl_block *block, u32 chain_index,
 321                             const struct mlxsw_sp_acl_profile_ops *ops,
 322                             struct mlxsw_afk_element_usage *tmplt_elusage)
 323 {
 324         struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
 325         struct mlxsw_sp_acl_ruleset *ruleset;
 326         size_t alloc_size;
 327         int err;
 328
 329         alloc_size = sizeof(*ruleset) + ops->ruleset_priv_size;
 330         ruleset = kzalloc(alloc_size, GFP_KERNEL);
 331         if (!ruleset)
 332                 return ERR_PTR(-ENOMEM);
 333         ruleset->ref_count = 1;
 334         ruleset->ht_key.block = block;
 335         ruleset->ht_key.chain_index = chain_index;
 336         ruleset->ht_key.ops = ops;
 337
 338         err = rhashtable_init(&ruleset->rule_ht, &mlxsw_sp_acl_rule_ht_params);
 339         if (err)
 340                 goto err_rhashtable_init;
 341
 342         err = ops->ruleset_add(mlxsw_sp, &acl->tcam, ruleset->priv,
 343                                tmplt_elusage);
 344         if (err)
 345                 goto err_ops_ruleset_add;
 346
 347         err = rhashtable_insert_fast(&acl->ruleset_ht, &ruleset->ht_node,
 348                                      mlxsw_sp_acl_ruleset_ht_params);
 349         if (err)
 350                 goto err_ht_insert;
 351
 352         return ruleset;
 353
 354 err_ht_insert:
 355         ops->ruleset_del(mlxsw_sp, ruleset->priv);
 356 err_ops_ruleset_add:
 357         rhashtable_destroy(&ruleset->rule_ht);
 358 err_rhashtable_init:
 359         kfree(ruleset);
 360         return ERR_PTR(err);
 361 }
 362
 363 static void mlxsw_sp_acl_ruleset_destroy(struct mlxsw_sp *mlxsw_sp,
 364                                          struct mlxsw_sp_acl_ruleset *ruleset)
 365 {
 366         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 367         struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
 368
 369         rhashtable_remove_fast(&acl->ruleset_ht, &ruleset->ht_node,
 370                                mlxsw_sp_acl_ruleset_ht_params);
 371         ops->ruleset_del(mlxsw_sp, ruleset->priv);
 372         rhashtable_destroy(&ruleset->rule_ht);
 373         kfree(ruleset);
 374 }
 375
 376 static void mlxsw_sp_acl_ruleset_ref_inc(struct mlxsw_sp_acl_ruleset *ruleset)
 377 {
 378         ruleset->ref_count++;
 379 }
 380
 381 static void mlxsw_sp_acl_ruleset_ref_dec(struct mlxsw_sp *mlxsw_sp,
 382                                          struct mlxsw_sp_acl_ruleset *ruleset)
 383 {
 384         if (--ruleset->ref_count)
 385                 return;
 386         mlxsw_sp_acl_ruleset_destroy(mlxsw_sp, ruleset);
 387 }
 388
 389 static struct mlxsw_sp_acl_ruleset *
 390 __mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp_acl *acl,
 391                               struct mlxsw_sp_acl_block *block, u32 chain_index,
 392                               const struct mlxsw_sp_acl_profile_ops *ops)
 393 {
 394         struct mlxsw_sp_acl_ruleset_ht_key ht_key;
 395
 396         memset(&ht_key, 0, sizeof(ht_key));
 397         ht_key.block = block;
 398         ht_key.chain_index = chain_index;
 399         ht_key.ops = ops;
 400         return rhashtable_lookup_fast(&acl->ruleset_ht, &ht_key,
 401                                       mlxsw_sp_acl_ruleset_ht_params);
 402 }
 403
 404 struct mlxsw_sp_acl_ruleset *
 405 mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp *mlxsw_sp,
 406                             struct mlxsw_sp_acl_block *block, u32 chain_index,
 407                             enum mlxsw_sp_acl_profile profile)
 408 {
 409         const struct mlxsw_sp_acl_profile_ops *ops;
 410         struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
 411         struct mlxsw_sp_acl_ruleset *ruleset;
 412
 413         ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile);
 414         if (!ops)
 415                 return ERR_PTR(-EINVAL);
 416         ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops);
 417         if (!ruleset)
 418                 return ERR_PTR(-ENOENT);
 419         return ruleset;
 420 }
 421
 422 struct mlxsw_sp_acl_ruleset *
 423 mlxsw_sp_acl_ruleset_get(struct mlxsw_sp *mlxsw_sp,
 424                          struct mlxsw_sp_acl_block *block, u32 chain_index,
 425                          enum mlxsw_sp_acl_profile profile,
 426                          struct mlxsw_afk_element_usage *tmplt_elusage)
 427 {
 428         const struct mlxsw_sp_acl_profile_ops *ops;
 429         struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
 430         struct mlxsw_sp_acl_ruleset *ruleset;
 431
 432         ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile);
 433         if (!ops)
 434                 return ERR_PTR(-EINVAL);
 435
 436         ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops);
 437         if (ruleset) {
 438                 mlxsw_sp_acl_ruleset_ref_inc(ruleset);
 439                 return ruleset;
 440         }
 441         return mlxsw_sp_acl_ruleset_create(mlxsw_sp, block, chain_index, ops,
 442                                            tmplt_elusage);
 443 }
 444
 445 void mlxsw_sp_acl_ruleset_put(struct mlxsw_sp *mlxsw_sp,
 446                               struct mlxsw_sp_acl_ruleset *ruleset)
 447 {
 448         mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
 449 }
 450
 451 u16 mlxsw_sp_acl_ruleset_group_id(struct mlxsw_sp_acl_ruleset *ruleset)
 452 {
 453         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 454
 455         return ops->ruleset_group_id(ruleset->priv);
 456 }
 457
 458 struct mlxsw_sp_acl_rule_info *
 459 mlxsw_sp_acl_rulei_create(struct mlxsw_sp_acl *acl,
 460                           struct mlxsw_afa_block *afa_block)
 461 {
 462         struct mlxsw_sp_acl_rule_info *rulei;
 463         int err;
 464
 465         rulei = kzalloc(sizeof(*rulei), GFP_KERNEL);
 466         if (!rulei)
 467                 return NULL;
 468
 469         if (afa_block) {
 470                 rulei->act_block = afa_block;
 471                 return rulei;
 472         }
 473
 474         rulei->act_block = mlxsw_afa_block_create(acl->mlxsw_sp->afa);
 475         if (IS_ERR(rulei->act_block)) {
 476                 err = PTR_ERR(rulei->act_block);
 477                 goto err_afa_block_create;
 478         }
 479         rulei->action_created = 1;
 480         return rulei;
 481
 482 err_afa_block_create:
 483         kfree(rulei);
 484         return ERR_PTR(err);
 485 }
 486
 487 void mlxsw_sp_acl_rulei_destroy(struct mlxsw_sp_acl_rule_info *rulei)
 488 {
 489         if (rulei->action_created)
 490                 mlxsw_afa_block_destroy(rulei->act_block);
 491         kfree(rulei);
 492 }
 493
 494 int mlxsw_sp_acl_rulei_commit(struct mlxsw_sp_acl_rule_info *rulei)
 495 {
 496         return mlxsw_afa_block_commit(rulei->act_block);
 497 }
 498
 499 void mlxsw_sp_acl_rulei_priority(struct mlxsw_sp_acl_rule_info *rulei,
 500                                  unsigned int priority)
 501 {
 502         rulei->priority = priority;
 503 }
 504
 505 void mlxsw_sp_acl_rulei_keymask_u32(struct mlxsw_sp_acl_rule_info *rulei,
 506                                     enum mlxsw_afk_element element,
 507                                     u32 key_value, u32 mask_value)
 508 {
 509         mlxsw_afk_values_add_u32(&rulei->values, element,
 510                                  key_value, mask_value);
 511 }
 512
 513 void mlxsw_sp_acl_rulei_keymask_buf(struct mlxsw_sp_acl_rule_info *rulei,
 514                                     enum mlxsw_afk_element element,
 515                                     const char *key_value,
 516                                     const char *mask_value, unsigned int len)
 517 {
 518         mlxsw_afk_values_add_buf(&rulei->values, element,
 519                                  key_value, mask_value, len);
 520 }
 521
 522 int mlxsw_sp_acl_rulei_act_continue(struct mlxsw_sp_acl_rule_info *rulei)
 523 {
 524         return mlxsw_afa_block_continue(rulei->act_block);
 525 }
 526
 527 int mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info *rulei,
 528                                 u16 group_id)
 529 {
 530         return mlxsw_afa_block_jump(rulei->act_block, group_id);
 531 }
 532
 533 int mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info *rulei)
 534 {
 535         return mlxsw_afa_block_terminate(rulei->act_block);
 536 }
 537
 538 int mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info *rulei,
 539                                 bool ingress,
 540                                 const struct flow_action_cookie *fa_cookie,
 541                                 struct netlink_ext_ack *extack)
 542 {
 543         return mlxsw_afa_block_append_drop(rulei->act_block, ingress,
 544                                            fa_cookie, extack);
 545 }
 546
 547 int mlxsw_sp_acl_rulei_act_trap(struct mlxsw_sp_acl_rule_info *rulei)
 548 {
 549         return mlxsw_afa_block_append_trap(rulei->act_block,
 550                                            MLXSW_TRAP_ID_ACL0);
 551 }
 552
 553 int mlxsw_sp_acl_rulei_act_fwd(struct mlxsw_sp *mlxsw_sp,
 554                                struct mlxsw_sp_acl_rule_info *rulei,
 555                                struct net_device *out_dev,
 556                                struct netlink_ext_ack *extack)
 557 {
 558         struct mlxsw_sp_port *mlxsw_sp_port;
 559         u8 local_port;
 560         bool in_port;
 561
 562         if (out_dev) {
 563                 if (!mlxsw_sp_port_dev_check(out_dev)) {
 564                         NL_SET_ERR_MSG_MOD(extack, "Invalid output device");
 565                         return -EINVAL;
 566                 }
 567                 mlxsw_sp_port = netdev_priv(out_dev);
 568                 if (mlxsw_sp_port->mlxsw_sp != mlxsw_sp) {
 569                         NL_SET_ERR_MSG_MOD(extack, "Invalid output device");
 570                         return -EINVAL;
 571                 }
 572                 local_port = mlxsw_sp_port->local_port;
 573                 in_port = false;
 574         } else {
 575                 /* If out_dev is NULL, the caller wants to
 576                  * set forward to ingress port.
 577                  */
 578                 local_port = 0;
 579                 in_port = true;
 580         }
 581         return mlxsw_afa_block_append_fwd(rulei->act_block,
 582                                           local_port, in_port, extack);
 583 }
 584
 585 int mlxsw_sp_acl_rulei_act_mirror(struct mlxsw_sp *mlxsw_sp,
 586                                   struct mlxsw_sp_acl_rule_info *rulei,
 587                                   struct mlxsw_sp_acl_block *block,
 588                                   struct net_device *out_dev,
 589                                   struct netlink_ext_ack *extack)
 590 {
 591         struct mlxsw_sp_acl_block_binding *binding;
 592         struct mlxsw_sp_port *in_port;
 593
 594         if (!list_is_singular(&block->binding_list)) {
 595                 NL_SET_ERR_MSG_MOD(extack, "Only a single mirror source is allowed");
 596                 return -EOPNOTSUPP;
 597         }
 598         binding = list_first_entry(&block->binding_list,
 599                                    struct mlxsw_sp_acl_block_binding, list);
 600         in_port = binding->mlxsw_sp_port;
 601
 602         return mlxsw_afa_block_append_mirror(rulei->act_block,
 603                                              in_port->local_port,
 604                                              out_dev,
 605                                              binding->ingress,
 606                                              extack);
 607 }
 608
 609 int mlxsw_sp_acl_rulei_act_vlan(struct mlxsw_sp *mlxsw_sp,
 610                                 struct mlxsw_sp_acl_rule_info *rulei,
 611                                 u32 action, u16 vid, u16 proto, u8 prio,
 612                                 struct netlink_ext_ack *extack)
 613 {
 614         u8 ethertype;
 615
 616         if (action == FLOW_ACTION_VLAN_MANGLE) {
 617                 switch (proto) {
 618                 case ETH_P_8021Q:
 619                         ethertype = 0;
 620                         break;
 621                 case ETH_P_8021AD:
 622                         ethertype = 1;
 623                         break;
 624                 default:
 625                         NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN protocol");
 626                         dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN protocol %#04x\n",
 627                                 proto);
 628                         return -EINVAL;
 629                 }
 630
 631                 return mlxsw_afa_block_append_vlan_modify(rulei->act_block,
 632                                                           vid, prio, ethertype,
 633                                                           extack);
 634         } else {
 635                 NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN action");
 636                 dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN action\n");
 637                 return -EINVAL;
 638         }
 639 }
 640
 641 int mlxsw_sp_acl_rulei_act_priority(struct mlxsw_sp *mlxsw_sp,
 642                                     struct mlxsw_sp_acl_rule_info *rulei,
 643                                     u32 prio, struct netlink_ext_ack *extack)
 644 {
 645         /* Even though both Linux and Spectrum switches support 16 priorities,
 646          * spectrum_qdisc only processes the first eight priomap elements, and
 647          * the DCB and PFC features are tied to 8 priorities as well. Therefore
 648          * bounce attempts to prioritize packets to higher priorities.
 649          */
 650         if (prio >= IEEE_8021QAZ_MAX_TCS) {
 651                 NL_SET_ERR_MSG_MOD(extack, "Only priorities 0..7 are supported");
 652                 return -EINVAL;
 653         }
 654         return mlxsw_afa_block_append_qos_switch_prio(rulei->act_block, prio,
 655                                                       extack);
 656 }
 657
 658 enum mlxsw_sp_acl_mangle_field {
 659         MLXSW_SP_ACL_MANGLE_FIELD_IP_DSFIELD,
 660         MLXSW_SP_ACL_MANGLE_FIELD_IP_DSCP,
 661         MLXSW_SP_ACL_MANGLE_FIELD_IP_ECN,
 662 };
 663
 664 struct mlxsw_sp_acl_mangle_action {
 665         enum flow_action_mangle_base htype;
 666         /* Offset is u32-aligned. */
 667         u32 offset;
 668         /* Mask bits are unset for the modified field. */
 669         u32 mask;
 670         /* Shift required to extract the set value. */
 671         u32 shift;
 672         enum mlxsw_sp_acl_mangle_field field;
 673 };
 674
 675 #define MLXSW_SP_ACL_MANGLE_ACTION(_htype, _offset, _mask, _shift, _field) \
 676         {                                                               \
 677                 .htype = _htype,                                        \
 678                 .offset = _offset,                                      \
 679                 .mask = _mask,                                          \
 680                 .shift = _shift,                                        \
 681                 .field = MLXSW_SP_ACL_MANGLE_FIELD_##_field,            \
 682         }
 683
 684 #define MLXSW_SP_ACL_MANGLE_ACTION_IP4(_offset, _mask, _shift, _field) \
 685         MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_IP4,       \
 686                                    _offset, _mask, _shift, _field)
 687
 688 #define MLXSW_SP_ACL_MANGLE_ACTION_IP6(_offset, _mask, _shift, _field) \
 689         MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_IP6,       \
 690                                    _offset, _mask, _shift, _field)
 691
 692 static struct mlxsw_sp_acl_mangle_action mlxsw_sp_acl_mangle_actions[] = {
 693         MLXSW_SP_ACL_MANGLE_ACTION_IP4(0, 0xff00ffff, 16, IP_DSFIELD),
 694         MLXSW_SP_ACL_MANGLE_ACTION_IP4(0, 0xff03ffff, 18, IP_DSCP),
 695         MLXSW_SP_ACL_MANGLE_ACTION_IP4(0, 0xfffcffff, 16, IP_ECN),
 696         MLXSW_SP_ACL_MANGLE_ACTION_IP6(0, 0xf00fffff, 20, IP_DSFIELD),
 697         MLXSW_SP_ACL_MANGLE_ACTION_IP6(0, 0xf03fffff, 22, IP_DSCP),
 698         MLXSW_SP_ACL_MANGLE_ACTION_IP6(0, 0xffcfffff, 20, IP_ECN),
 699 };
 700
 701 static int
 702 mlxsw_sp_acl_rulei_act_mangle_field(struct mlxsw_sp *mlxsw_sp,
 703                                     struct mlxsw_sp_acl_rule_info *rulei,
 704                                     struct mlxsw_sp_acl_mangle_action *mact,
 705                                     u32 val, struct netlink_ext_ack *extack)
 706 {
 707         switch (mact->field) {
 708         case MLXSW_SP_ACL_MANGLE_FIELD_IP_DSFIELD:
 709                 return mlxsw_afa_block_append_qos_dsfield(rulei->act_block,
 710                                                           val, extack);
 711         case MLXSW_SP_ACL_MANGLE_FIELD_IP_DSCP:
 712                 return mlxsw_afa_block_append_qos_dscp(rulei->act_block,
 713                                                        val, extack);
 714         case MLXSW_SP_ACL_MANGLE_FIELD_IP_ECN:
 715                 return mlxsw_afa_block_append_qos_ecn(rulei->act_block,
 716                                                       val, extack);
 717         }
 718
 719         /* We shouldn't have gotten a match in the first place! */
 720         WARN_ONCE(1, "Unhandled mangle field");
 721         return -EINVAL;
 722 }
 723
 724 int mlxsw_sp_acl_rulei_act_mangle(struct mlxsw_sp *mlxsw_sp,
 725                                   struct mlxsw_sp_acl_rule_info *rulei,
 726                                   enum flow_action_mangle_base htype,
 727                                   u32 offset, u32 mask, u32 val,
 728                                   struct netlink_ext_ack *extack)
 729 {
 730         struct mlxsw_sp_acl_mangle_action *mact;
 731         size_t i;
 732
 733         for (i = 0; i < ARRAY_SIZE(mlxsw_sp_acl_mangle_actions); ++i) {
 734                 mact = &mlxsw_sp_acl_mangle_actions[i];
 735                 if (mact->htype == htype &&
 736                     mact->offset == offset &&
 737                     mact->mask == mask) {
 738                         val >>= mact->shift;
 739                         return mlxsw_sp_acl_rulei_act_mangle_field(mlxsw_sp,
 740                                                                    rulei, mact,
 741                                                                    val, extack);
 742                 }
 743         }
 744
 745         NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field");
 746         return -EINVAL;
 747 }
 748
 749 int mlxsw_sp_acl_rulei_act_count(struct mlxsw_sp *mlxsw_sp,
 750                                  struct mlxsw_sp_acl_rule_info *rulei,
 751                                  struct netlink_ext_ack *extack)
 752 {
 753         int err;
 754
 755         err = mlxsw_afa_block_append_counter(rulei->act_block,
 756                                              &rulei->counter_index, extack);
 757         if (err)
 758                 return err;
 759         rulei->counter_valid = true;
 760         return 0;
 761 }
 762
 763 int mlxsw_sp_acl_rulei_act_fid_set(struct mlxsw_sp *mlxsw_sp,
 764                                    struct mlxsw_sp_acl_rule_info *rulei,
 765                                    u16 fid, struct netlink_ext_ack *extack)
 766 {
 767         return mlxsw_afa_block_append_fid_set(rulei->act_block, fid, extack);
 768 }
 769
 770 struct mlxsw_sp_acl_rule *
 771 mlxsw_sp_acl_rule_create(struct mlxsw_sp *mlxsw_sp,
 772                          struct mlxsw_sp_acl_ruleset *ruleset,
 773                          unsigned long cookie,
 774                          struct mlxsw_afa_block *afa_block,
 775                          struct netlink_ext_ack *extack)
 776 {
 777         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 778         struct mlxsw_sp_acl_rule *rule;
 779         int err;
 780
 781         mlxsw_sp_acl_ruleset_ref_inc(ruleset);
 782         rule = kzalloc(sizeof(*rule) + ops->rule_priv_size,
 783                        GFP_KERNEL);
 784         if (!rule) {
 785                 err = -ENOMEM;
 786                 goto err_alloc;
 787         }
 788         rule->cookie = cookie;
 789         rule->ruleset = ruleset;
 790
 791         rule->rulei = mlxsw_sp_acl_rulei_create(mlxsw_sp->acl, afa_block);
 792         if (IS_ERR(rule->rulei)) {
 793                 err = PTR_ERR(rule->rulei);
 794                 goto err_rulei_create;
 795         }
 796
 797         return rule;
 798
 799 err_rulei_create:
 800         kfree(rule);
 801 err_alloc:
 802         mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
 803         return ERR_PTR(err);
 804 }
 805
 806 void mlxsw_sp_acl_rule_destroy(struct mlxsw_sp *mlxsw_sp,
 807                                struct mlxsw_sp_acl_rule *rule)
 808 {
 809         struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
 810
 811         mlxsw_sp_acl_rulei_destroy(rule->rulei);
 812         kfree(rule);
 813         mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
 814 }
 815
 816 int mlxsw_sp_acl_rule_add(struct mlxsw_sp *mlxsw_sp,
 817                           struct mlxsw_sp_acl_rule *rule)
 818 {
 819         struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
 820         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 821         struct mlxsw_sp_acl_block *block = ruleset->ht_key.block;
 822         int err;
 823
 824         err = ops->rule_add(mlxsw_sp, ruleset->priv, rule->priv, rule->rulei);
 825         if (err)
 826                 return err;
 827
 828         err = rhashtable_insert_fast(&ruleset->rule_ht, &rule->ht_node,
 829                                      mlxsw_sp_acl_rule_ht_params);
 830         if (err)
 831                 goto err_rhashtable_insert;
 832
 833         if (!ruleset->ht_key.chain_index &&
 834             mlxsw_sp_acl_ruleset_is_singular(ruleset)) {
 835                 /* We only need ruleset with chain index 0, the implicit
 836                  * one, to be directly bound to device. The rest of the
 837                  * rulesets are bound by "Goto action set".
 838                  */
 839                 err = mlxsw_sp_acl_ruleset_block_bind(mlxsw_sp, ruleset, block);
 840                 if (err)
 841                         goto err_ruleset_block_bind;
 842         }
 843
 844         mutex_lock(&mlxsw_sp->acl->rules_lock);
 845         list_add_tail(&rule->list, &mlxsw_sp->acl->rules);
 846         mutex_unlock(&mlxsw_sp->acl->rules_lock);
 847         block->rule_count++;
 848         block->ingress_blocker_rule_count += rule->rulei->ingress_bind_blocker;
 849         block->egress_blocker_rule_count += rule->rulei->egress_bind_blocker;
 850         return 0;
 851
 852 err_ruleset_block_bind:
 853         rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node,
 854                                mlxsw_sp_acl_rule_ht_params);
 855 err_rhashtable_insert:
 856         ops->rule_del(mlxsw_sp, rule->priv);
 857         return err;
 858 }
 859
 860 void mlxsw_sp_acl_rule_del(struct mlxsw_sp *mlxsw_sp,
 861                            struct mlxsw_sp_acl_rule *rule)
 862 {
 863         struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
 864         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 865         struct mlxsw_sp_acl_block *block = ruleset->ht_key.block;
 866
 867         block->egress_blocker_rule_count -= rule->rulei->egress_bind_blocker;
 868         block->ingress_blocker_rule_count -= rule->rulei->ingress_bind_blocker;
 869         ruleset->ht_key.block->rule_count--;
 870         mutex_lock(&mlxsw_sp->acl->rules_lock);
 871         list_del(&rule->list);
 872         mutex_unlock(&mlxsw_sp->acl->rules_lock);
 873         if (!ruleset->ht_key.chain_index &&
 874             mlxsw_sp_acl_ruleset_is_singular(ruleset))
 875                 mlxsw_sp_acl_ruleset_block_unbind(mlxsw_sp, ruleset,
 876                                                   ruleset->ht_key.block);
 877         rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node,
 878                                mlxsw_sp_acl_rule_ht_params);
 879         ops->rule_del(mlxsw_sp, rule->priv);
 880 }
 881
 882 int mlxsw_sp_acl_rule_action_replace(struct mlxsw_sp *mlxsw_sp,
 883                                      struct mlxsw_sp_acl_rule *rule,
 884                                      struct mlxsw_afa_block *afa_block)
 885 {
 886         struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
 887         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 888         struct mlxsw_sp_acl_rule_info *rulei;
 889
 890         rulei = mlxsw_sp_acl_rule_rulei(rule);
 891         rulei->act_block = afa_block;
 892
 893         return ops->rule_action_replace(mlxsw_sp, rule->priv, rule->rulei);
 894 }
 895
 896 struct mlxsw_sp_acl_rule *
 897 mlxsw_sp_acl_rule_lookup(struct mlxsw_sp *mlxsw_sp,
 898                          struct mlxsw_sp_acl_ruleset *ruleset,
 899                          unsigned long cookie)
 900 {
 901         return rhashtable_lookup_fast(&ruleset->rule_ht, &cookie,
 902                                        mlxsw_sp_acl_rule_ht_params);
 903 }
 904
 905 struct mlxsw_sp_acl_rule_info *
 906 mlxsw_sp_acl_rule_rulei(struct mlxsw_sp_acl_rule *rule)
 907 {
 908         return rule->rulei;
 909 }
 910
 911 static int mlxsw_sp_acl_rule_activity_update(struct mlxsw_sp *mlxsw_sp,
 912                                              struct mlxsw_sp_acl_rule *rule)
 913 {
 914         struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
 915         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 916         bool active;
 917         int err;
 918
 919         err = ops->rule_activity_get(mlxsw_sp, rule->priv, &active);
 920         if (err)
 921                 return err;
 922         if (active)
 923                 rule->last_used = jiffies;
 924         return 0;
 925 }
 926
 927 static int mlxsw_sp_acl_rules_activity_update(struct mlxsw_sp_acl *acl)
 928 {
 929         struct mlxsw_sp_acl_rule *rule;
 930         int err;
 931
 932         mutex_lock(&acl->rules_lock);
 933         list_for_each_entry(rule, &acl->rules, list) {
 934                 err = mlxsw_sp_acl_rule_activity_update(acl->mlxsw_sp,
 935                                                         rule);
 936                 if (err)
 937                         goto err_rule_update;
 938         }
 939         mutex_unlock(&acl->rules_lock);
 940         return 0;
 941
 942 err_rule_update:
 943         mutex_unlock(&acl->rules_lock);
 944         return err;
 945 }
 946
 947 static void mlxsw_sp_acl_rule_activity_work_schedule(struct mlxsw_sp_acl *acl)
 948 {
 949         unsigned long interval = acl->rule_activity_update.interval;
 950
 951         mlxsw_core_schedule_dw(&acl->rule_activity_update.dw,
 952                                msecs_to_jiffies(interval));
 953 }
 954
 955 static void mlxsw_sp_acl_rule_activity_update_work(struct work_struct *work)
 956 {
 957         struct mlxsw_sp_acl *acl = container_of(work, struct mlxsw_sp_acl,
 958                                                 rule_activity_update.dw.work);
 959         int err;
 960
 961         err = mlxsw_sp_acl_rules_activity_update(acl);
 962         if (err)
 963                 dev_err(acl->mlxsw_sp->bus_info->dev, "Could not update acl activity");
 964
 965         mlxsw_sp_acl_rule_activity_work_schedule(acl);
 966 }
 967
 968 int mlxsw_sp_acl_rule_get_stats(struct mlxsw_sp *mlxsw_sp,
 969                                 struct mlxsw_sp_acl_rule *rule,
 970                                 u64 *packets, u64 *bytes, u64 *last_use,
 971                                 enum flow_action_hw_stats *used_hw_stats)
 972
 973 {
 974         struct mlxsw_sp_acl_rule_info *rulei;
 975         u64 current_packets = 0;
 976         u64 current_bytes = 0;
 977         int err;
 978
 979         rulei = mlxsw_sp_acl_rule_rulei(rule);
 980         if (rulei->counter_valid) {
 981                 err = mlxsw_sp_flow_counter_get(mlxsw_sp, rulei->counter_index,
 982                                                 &current_packets,
 983                                                 &current_bytes);
 984                 if (err)
 985                         return err;
 986                 *used_hw_stats = FLOW_ACTION_HW_STATS_IMMEDIATE;
 987         }
 988         *packets = current_packets - rule->last_packets;
 989         *bytes = current_bytes - rule->last_bytes;
 990         *last_use = rule->last_used;
 991
 992         rule->last_bytes = current_bytes;
 993         rule->last_packets = current_packets;
 994
 995         return 0;
 996 }
 997
 998 int mlxsw_sp_acl_init(struct mlxsw_sp *mlxsw_sp)
 999 {
1000         struct mlxsw_sp_fid *fid;
1001         struct mlxsw_sp_acl *acl;
1002         size_t alloc_size;
1003         int err;
1004
1005         alloc_size = sizeof(*acl) + mlxsw_sp_acl_tcam_priv_size(mlxsw_sp);
1006         acl = kzalloc(alloc_size, GFP_KERNEL);
1007         if (!acl)
1008                 return -ENOMEM;
1009         mlxsw_sp->acl = acl;
1010         acl->mlxsw_sp = mlxsw_sp;
1011         acl->afk = mlxsw_afk_create(MLXSW_CORE_RES_GET(mlxsw_sp->core,
1012                                                        ACL_FLEX_KEYS),
1013                                     mlxsw_sp->afk_ops);
1014         if (!acl->afk) {
1015                 err = -ENOMEM;
1016                 goto err_afk_create;
1017         }
1018
1019         err = rhashtable_init(&acl->ruleset_ht,
1020                               &mlxsw_sp_acl_ruleset_ht_params);
1021         if (err)
1022                 goto err_rhashtable_init;
1023
1024         fid = mlxsw_sp_fid_dummy_get(mlxsw_sp);
1025         if (IS_ERR(fid)) {
1026                 err = PTR_ERR(fid);
1027                 goto err_fid_get;
1028         }
1029         acl->dummy_fid = fid;
1030
1031         INIT_LIST_HEAD(&acl->rules);
1032         mutex_init(&acl->rules_lock);
1033         err = mlxsw_sp_acl_tcam_init(mlxsw_sp, &acl->tcam);
1034         if (err)
1035                 goto err_acl_ops_init;
1036
1037         /* Create the delayed work for the rule activity_update */
1038         INIT_DELAYED_WORK(&acl->rule_activity_update.dw,
1039                           mlxsw_sp_acl_rule_activity_update_work);
1040         acl->rule_activity_update.interval = MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS;
1041         mlxsw_core_schedule_dw(&acl->rule_activity_update.dw, 0);
1042         return 0;
1043
1044 err_acl_ops_init:
1045         mutex_destroy(&acl->rules_lock);
1046         mlxsw_sp_fid_put(fid);
1047 err_fid_get:
1048         rhashtable_destroy(&acl->ruleset_ht);
1049 err_rhashtable_init:
1050         mlxsw_afk_destroy(acl->afk);
1051 err_afk_create:
1052         kfree(acl);
1053         return err;
1054 }
1055
1056 void mlxsw_sp_acl_fini(struct mlxsw_sp *mlxsw_sp)
1057 {
1058         struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
1059
1060         cancel_delayed_work_sync(&mlxsw_sp->acl->rule_activity_update.dw);
1061         mlxsw_sp_acl_tcam_fini(mlxsw_sp, &acl->tcam);
1062         mutex_destroy(&acl->rules_lock);
1063         WARN_ON(!list_empty(&acl->rules));
1064         mlxsw_sp_fid_put(acl->dummy_fid);
1065         rhashtable_destroy(&acl->ruleset_ht);
1066         mlxsw_afk_destroy(acl->afk);
1067         kfree(acl);
1068 }
1069
1070 u32 mlxsw_sp_acl_region_rehash_intrvl_get(struct mlxsw_sp *mlxsw_sp)
1071 {
1072         struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
1073
1074         return mlxsw_sp_acl_tcam_vregion_rehash_intrvl_get(mlxsw_sp,
1075                                                            &acl->tcam);
1076 }
1077
1078 int mlxsw_sp_acl_region_rehash_intrvl_set(struct mlxsw_sp *mlxsw_sp, u32 val)
1079 {
1080         struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
1081
1082         return mlxsw_sp_acl_tcam_vregion_rehash_intrvl_set(mlxsw_sp,
1083                                                            &acl->tcam, val);
1084 }