drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c

   1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
   2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */
   3
   4 #include <linux/kernel.h>
   5 #include <linux/slab.h>
   6 #include <linux/errno.h>
   7 #include <linux/list.h>
   8 #include <linux/string.h>
   9 #include <linux/rhashtable.h>
  10 #include <linux/netdevice.h>
  11 #include <linux/mutex.h>
  12 #include <net/net_namespace.h>
  13 #include <net/tc_act/tc_vlan.h>
  14
  15 #include "reg.h"
  16 #include "core.h"
  17 #include "resources.h"
  18 #include "spectrum.h"
  19 #include "core_acl_flex_keys.h"
  20 #include "core_acl_flex_actions.h"
  21 #include "spectrum_acl_tcam.h"
  22
  23 struct mlxsw_sp_acl {
  24         struct mlxsw_sp *mlxsw_sp;
  25         struct mlxsw_afk *afk;
  26         struct mlxsw_sp_fid *dummy_fid;
  27         struct rhashtable ruleset_ht;
  28         struct list_head rules;
  29         struct mutex rules_lock; /* Protects rules list */
  30         struct {
  31                 struct delayed_work dw;
  32                 unsigned long interval; /* ms */
  33 #define MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS 1000
  34         } rule_activity_update;
  35         struct mlxsw_sp_acl_tcam tcam;
  36 };
  37
  38 struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl)
  39 {
  40         return acl->afk;
  41 }
  42
  43 struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam(struct mlxsw_sp_acl *acl)
  44 {
  45         return &acl->tcam;
  46 }
  47
  48 struct mlxsw_sp_acl_ruleset_ht_key {
  49         struct mlxsw_sp_flow_block *block;
  50         u32 chain_index;
  51         const struct mlxsw_sp_acl_profile_ops *ops;
  52 };
  53
  54 struct mlxsw_sp_acl_ruleset {
  55         struct rhash_head ht_node; /* Member of acl HT */
  56         struct mlxsw_sp_acl_ruleset_ht_key ht_key;
  57         struct rhashtable rule_ht;
  58         unsigned int ref_count;
  59         unsigned int min_prio;
  60         unsigned int max_prio;
  61         unsigned long priv[];
  62         /* priv has to be always the last item */
  63 };
  64
  65 struct mlxsw_sp_acl_rule {
  66         struct rhash_head ht_node; /* Member of rule HT */
  67         struct list_head list;
  68         unsigned long cookie; /* HT key */
  69         struct mlxsw_sp_acl_ruleset *ruleset;
  70         struct mlxsw_sp_acl_rule_info *rulei;
  71         u64 last_used;
  72         u64 last_packets;
  73         u64 last_bytes;
  74         u64 last_drops;
  75         unsigned long priv[];
  76         /* priv has to be always the last item */
  77 };
  78
  79 static const struct rhashtable_params mlxsw_sp_acl_ruleset_ht_params = {
  80         .key_len = sizeof(struct mlxsw_sp_acl_ruleset_ht_key),
  81         .key_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_key),
  82         .head_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_node),
  83         .automatic_shrinking = true,
  84 };
  85
  86 static const struct rhashtable_params mlxsw_sp_acl_rule_ht_params = {
  87         .key_len = sizeof(unsigned long),
  88         .key_offset = offsetof(struct mlxsw_sp_acl_rule, cookie),
  89         .head_offset = offsetof(struct mlxsw_sp_acl_rule, ht_node),
  90         .automatic_shrinking = true,
  91 };
  92
  93 struct mlxsw_sp_fid *mlxsw_sp_acl_dummy_fid(struct mlxsw_sp *mlxsw_sp)
  94 {
  95         return mlxsw_sp->acl->dummy_fid;
  96 }
  97
  98 static bool
  99 mlxsw_sp_acl_ruleset_is_singular(const struct mlxsw_sp_acl_ruleset *ruleset)
 100 {
 101         /* We hold a reference on ruleset ourselves */
 102         return ruleset->ref_count == 2;
 103 }
 104
 105 int mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp,
 106                               struct mlxsw_sp_flow_block *block,
 107                               struct mlxsw_sp_flow_block_binding *binding)
 108 {
 109         struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero;
 110         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 111
 112         return ops->ruleset_bind(mlxsw_sp, ruleset->priv,
 113                                  binding->mlxsw_sp_port, binding->ingress);
 114 }
 115
 116 void mlxsw_sp_acl_ruleset_unbind(struct mlxsw_sp *mlxsw_sp,
 117                                  struct mlxsw_sp_flow_block *block,
 118                                  struct mlxsw_sp_flow_block_binding *binding)
 119 {
 120         struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero;
 121         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 122
 123         ops->ruleset_unbind(mlxsw_sp, ruleset->priv,
 124                             binding->mlxsw_sp_port, binding->ingress);
 125 }
 126
 127 static int
 128 mlxsw_sp_acl_ruleset_block_bind(struct mlxsw_sp *mlxsw_sp,
 129                                 struct mlxsw_sp_acl_ruleset *ruleset,
 130                                 struct mlxsw_sp_flow_block *block)
 131 {
 132         struct mlxsw_sp_flow_block_binding *binding;
 133         int err;
 134
 135         block->ruleset_zero = ruleset;
 136         list_for_each_entry(binding, &block->binding_list, list) {
 137                 err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding);
 138                 if (err)
 139                         goto rollback;
 140         }
 141         return 0;
 142
 143 rollback:
 144         list_for_each_entry_continue_reverse(binding, &block->binding_list,
 145                                              list)
 146                 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding);
 147         block->ruleset_zero = NULL;
 148
 149         return err;
 150 }
 151
 152 static void
 153 mlxsw_sp_acl_ruleset_block_unbind(struct mlxsw_sp *mlxsw_sp,
 154                                   struct mlxsw_sp_acl_ruleset *ruleset,
 155                                   struct mlxsw_sp_flow_block *block)
 156 {
 157         struct mlxsw_sp_flow_block_binding *binding;
 158
 159         list_for_each_entry(binding, &block->binding_list, list)
 160                 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding);
 161         block->ruleset_zero = NULL;
 162 }
 163
 164 static struct mlxsw_sp_acl_ruleset *
 165 mlxsw_sp_acl_ruleset_create(struct mlxsw_sp *mlxsw_sp,
 166                             struct mlxsw_sp_flow_block *block, u32 chain_index,
 167                             const struct mlxsw_sp_acl_profile_ops *ops,
 168                             struct mlxsw_afk_element_usage *tmplt_elusage)
 169 {
 170         struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
 171         struct mlxsw_sp_acl_ruleset *ruleset;
 172         size_t alloc_size;
 173         int err;
 174
 175         alloc_size = sizeof(*ruleset) + ops->ruleset_priv_size;
 176         ruleset = kzalloc(alloc_size, GFP_KERNEL);
 177         if (!ruleset)
 178                 return ERR_PTR(-ENOMEM);
 179         ruleset->ref_count = 1;
 180         ruleset->ht_key.block = block;
 181         ruleset->ht_key.chain_index = chain_index;
 182         ruleset->ht_key.ops = ops;
 183
 184         err = rhashtable_init(&ruleset->rule_ht, &mlxsw_sp_acl_rule_ht_params);
 185         if (err)
 186                 goto err_rhashtable_init;
 187
 188         err = ops->ruleset_add(mlxsw_sp, &acl->tcam, ruleset->priv,
 189                                tmplt_elusage, &ruleset->min_prio,
 190                                &ruleset->max_prio);
 191         if (err)
 192                 goto err_ops_ruleset_add;
 193
 194         err = rhashtable_insert_fast(&acl->ruleset_ht, &ruleset->ht_node,
 195                                      mlxsw_sp_acl_ruleset_ht_params);
 196         if (err)
 197                 goto err_ht_insert;
 198
 199         return ruleset;
 200
 201 err_ht_insert:
 202         ops->ruleset_del(mlxsw_sp, ruleset->priv);
 203 err_ops_ruleset_add:
 204         rhashtable_destroy(&ruleset->rule_ht);
 205 err_rhashtable_init:
 206         kfree(ruleset);
 207         return ERR_PTR(err);
 208 }
 209
 210 static void mlxsw_sp_acl_ruleset_destroy(struct mlxsw_sp *mlxsw_sp,
 211                                          struct mlxsw_sp_acl_ruleset *ruleset)
 212 {
 213         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 214         struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
 215
 216         rhashtable_remove_fast(&acl->ruleset_ht, &ruleset->ht_node,
 217                                mlxsw_sp_acl_ruleset_ht_params);
 218         ops->ruleset_del(mlxsw_sp, ruleset->priv);
 219         rhashtable_destroy(&ruleset->rule_ht);
 220         kfree(ruleset);
 221 }
 222
 223 static void mlxsw_sp_acl_ruleset_ref_inc(struct mlxsw_sp_acl_ruleset *ruleset)
 224 {
 225         ruleset->ref_count++;
 226 }
 227
 228 static void mlxsw_sp_acl_ruleset_ref_dec(struct mlxsw_sp *mlxsw_sp,
 229                                          struct mlxsw_sp_acl_ruleset *ruleset)
 230 {
 231         if (--ruleset->ref_count)
 232                 return;
 233         mlxsw_sp_acl_ruleset_destroy(mlxsw_sp, ruleset);
 234 }
 235
 236 static struct mlxsw_sp_acl_ruleset *
 237 __mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp_acl *acl,
 238                               struct mlxsw_sp_flow_block *block, u32 chain_index,
 239                               const struct mlxsw_sp_acl_profile_ops *ops)
 240 {
 241         struct mlxsw_sp_acl_ruleset_ht_key ht_key;
 242
 243         memset(&ht_key, 0, sizeof(ht_key));
 244         ht_key.block = block;
 245         ht_key.chain_index = chain_index;
 246         ht_key.ops = ops;
 247         return rhashtable_lookup_fast(&acl->ruleset_ht, &ht_key,
 248                                       mlxsw_sp_acl_ruleset_ht_params);
 249 }
 250
 251 struct mlxsw_sp_acl_ruleset *
 252 mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp *mlxsw_sp,
 253                             struct mlxsw_sp_flow_block *block, u32 chain_index,
 254                             enum mlxsw_sp_acl_profile profile)
 255 {
 256         const struct mlxsw_sp_acl_profile_ops *ops;
 257         struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
 258         struct mlxsw_sp_acl_ruleset *ruleset;
 259
 260         ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile);
 261         if (!ops)
 262                 return ERR_PTR(-EINVAL);
 263         ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops);
 264         if (!ruleset)
 265                 return ERR_PTR(-ENOENT);
 266         return ruleset;
 267 }
 268
 269 struct mlxsw_sp_acl_ruleset *
 270 mlxsw_sp_acl_ruleset_get(struct mlxsw_sp *mlxsw_sp,
 271                          struct mlxsw_sp_flow_block *block, u32 chain_index,
 272                          enum mlxsw_sp_acl_profile profile,
 273                          struct mlxsw_afk_element_usage *tmplt_elusage)
 274 {
 275         const struct mlxsw_sp_acl_profile_ops *ops;
 276         struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
 277         struct mlxsw_sp_acl_ruleset *ruleset;
 278
 279         ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile);
 280         if (!ops)
 281                 return ERR_PTR(-EINVAL);
 282
 283         ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops);
 284         if (ruleset) {
 285                 mlxsw_sp_acl_ruleset_ref_inc(ruleset);
 286                 return ruleset;
 287         }
 288         return mlxsw_sp_acl_ruleset_create(mlxsw_sp, block, chain_index, ops,
 289                                            tmplt_elusage);
 290 }
 291
 292 void mlxsw_sp_acl_ruleset_put(struct mlxsw_sp *mlxsw_sp,
 293                               struct mlxsw_sp_acl_ruleset *ruleset)
 294 {
 295         mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
 296 }
 297
 298 u16 mlxsw_sp_acl_ruleset_group_id(struct mlxsw_sp_acl_ruleset *ruleset)
 299 {
 300         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 301
 302         return ops->ruleset_group_id(ruleset->priv);
 303 }
 304
 305 void mlxsw_sp_acl_ruleset_prio_get(struct mlxsw_sp_acl_ruleset *ruleset,
 306                                    unsigned int *p_min_prio,
 307                                    unsigned int *p_max_prio)
 308 {
 309         *p_min_prio = ruleset->min_prio;
 310         *p_max_prio = ruleset->max_prio;
 311 }
 312
 313 struct mlxsw_sp_acl_rule_info *
 314 mlxsw_sp_acl_rulei_create(struct mlxsw_sp_acl *acl,
 315                           struct mlxsw_afa_block *afa_block)
 316 {
 317         struct mlxsw_sp_acl_rule_info *rulei;
 318         int err;
 319
 320         rulei = kzalloc(sizeof(*rulei), GFP_KERNEL);
 321         if (!rulei)
 322                 return ERR_PTR(-ENOMEM);
 323
 324         if (afa_block) {
 325                 rulei->act_block = afa_block;
 326                 return rulei;
 327         }
 328
 329         rulei->act_block = mlxsw_afa_block_create(acl->mlxsw_sp->afa);
 330         if (IS_ERR(rulei->act_block)) {
 331                 err = PTR_ERR(rulei->act_block);
 332                 goto err_afa_block_create;
 333         }
 334         rulei->action_created = 1;
 335         return rulei;
 336
 337 err_afa_block_create:
 338         kfree(rulei);
 339         return ERR_PTR(err);
 340 }
 341
 342 void mlxsw_sp_acl_rulei_destroy(struct mlxsw_sp *mlxsw_sp,
 343                                 struct mlxsw_sp_acl_rule_info *rulei)
 344 {
 345         if (rulei->action_created)
 346                 mlxsw_afa_block_destroy(rulei->act_block);
 347         if (rulei->src_port_range_reg_valid)
 348                 mlxsw_sp_port_range_reg_put(mlxsw_sp,
 349                                             rulei->src_port_range_reg_index);
 350         if (rulei->dst_port_range_reg_valid)
 351                 mlxsw_sp_port_range_reg_put(mlxsw_sp,
 352                                             rulei->dst_port_range_reg_index);
 353         kfree(rulei);
 354 }
 355
 356 int mlxsw_sp_acl_rulei_commit(struct mlxsw_sp_acl_rule_info *rulei)
 357 {
 358         return mlxsw_afa_block_commit(rulei->act_block);
 359 }
 360
 361 void mlxsw_sp_acl_rulei_priority(struct mlxsw_sp_acl_rule_info *rulei,
 362                                  unsigned int priority)
 363 {
 364         rulei->priority = priority;
 365 }
 366
 367 void mlxsw_sp_acl_rulei_keymask_u32(struct mlxsw_sp_acl_rule_info *rulei,
 368                                     enum mlxsw_afk_element element,
 369                                     u32 key_value, u32 mask_value)
 370 {
 371         mlxsw_afk_values_add_u32(&rulei->values, element,
 372                                  key_value, mask_value);
 373 }
 374
 375 void mlxsw_sp_acl_rulei_keymask_buf(struct mlxsw_sp_acl_rule_info *rulei,
 376                                     enum mlxsw_afk_element element,
 377                                     const char *key_value,
 378                                     const char *mask_value, unsigned int len)
 379 {
 380         mlxsw_afk_values_add_buf(&rulei->values, element,
 381                                  key_value, mask_value, len);
 382 }
 383
 384 int mlxsw_sp_acl_rulei_act_continue(struct mlxsw_sp_acl_rule_info *rulei)
 385 {
 386         return mlxsw_afa_block_continue(rulei->act_block);
 387 }
 388
 389 int mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info *rulei,
 390                                 u16 group_id)
 391 {
 392         return mlxsw_afa_block_jump(rulei->act_block, group_id);
 393 }
 394
 395 int mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info *rulei)
 396 {
 397         return mlxsw_afa_block_terminate(rulei->act_block);
 398 }
 399
 400 int mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info *rulei,
 401                                 bool ingress,
 402                                 const struct flow_action_cookie *fa_cookie,
 403                                 struct netlink_ext_ack *extack)
 404 {
 405         return mlxsw_afa_block_append_drop(rulei->act_block, ingress,
 406                                            fa_cookie, extack);
 407 }
 408
 409 int mlxsw_sp_acl_rulei_act_trap(struct mlxsw_sp_acl_rule_info *rulei)
 410 {
 411         return mlxsw_afa_block_append_trap(rulei->act_block,
 412                                            MLXSW_TRAP_ID_ACL0);
 413 }
 414
 415 int mlxsw_sp_acl_rulei_act_fwd(struct mlxsw_sp *mlxsw_sp,
 416                                struct mlxsw_sp_acl_rule_info *rulei,
 417                                struct net_device *out_dev,
 418                                struct netlink_ext_ack *extack)
 419 {
 420         struct mlxsw_sp_port *mlxsw_sp_port;
 421         u16 local_port;
 422         bool in_port;
 423
 424         if (out_dev) {
 425                 if (!mlxsw_sp_port_dev_check(out_dev)) {
 426                         NL_SET_ERR_MSG_MOD(extack, "Invalid output device");
 427                         return -EINVAL;
 428                 }
 429                 mlxsw_sp_port = netdev_priv(out_dev);
 430                 if (mlxsw_sp_port->mlxsw_sp != mlxsw_sp) {
 431                         NL_SET_ERR_MSG_MOD(extack, "Invalid output device");
 432                         return -EINVAL;
 433                 }
 434                 local_port = mlxsw_sp_port->local_port;
 435                 in_port = false;
 436         } else {
 437                 /* If out_dev is NULL, the caller wants to
 438                  * set forward to ingress port.
 439                  */
 440                 local_port = 0;
 441                 in_port = true;
 442         }
 443         return mlxsw_afa_block_append_fwd(rulei->act_block,
 444                                           local_port, in_port, extack);
 445 }
 446
 447 int mlxsw_sp_acl_rulei_act_mirror(struct mlxsw_sp *mlxsw_sp,
 448                                   struct mlxsw_sp_acl_rule_info *rulei,
 449                                   struct mlxsw_sp_flow_block *block,
 450                                   struct net_device *out_dev,
 451                                   struct netlink_ext_ack *extack)
 452 {
 453         struct mlxsw_sp_flow_block_binding *binding;
 454         struct mlxsw_sp_port *in_port;
 455
 456         if (!list_is_singular(&block->binding_list)) {
 457                 NL_SET_ERR_MSG_MOD(extack, "Only a single mirror source is allowed");
 458                 return -EOPNOTSUPP;
 459         }
 460         binding = list_first_entry(&block->binding_list,
 461                                    struct mlxsw_sp_flow_block_binding, list);
 462         in_port = binding->mlxsw_sp_port;
 463
 464         return mlxsw_afa_block_append_mirror(rulei->act_block,
 465                                              in_port->local_port,
 466                                              out_dev,
 467                                              binding->ingress,
 468                                              extack);
 469 }
 470
 471 int mlxsw_sp_acl_rulei_act_vlan(struct mlxsw_sp *mlxsw_sp,
 472                                 struct mlxsw_sp_acl_rule_info *rulei,
 473                                 u32 action, u16 vid, u16 proto, u8 prio,
 474                                 struct netlink_ext_ack *extack)
 475 {
 476         u8 ethertype;
 477
 478         if (action == FLOW_ACTION_VLAN_MANGLE) {
 479                 switch (proto) {
 480                 case ETH_P_8021Q:
 481                         ethertype = 0;
 482                         break;
 483                 case ETH_P_8021AD:
 484                         ethertype = 1;
 485                         break;
 486                 default:
 487                         NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN protocol");
 488                         dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN protocol %#04x\n",
 489                                 proto);
 490                         return -EINVAL;
 491                 }
 492
 493                 return mlxsw_afa_block_append_vlan_modify(rulei->act_block,
 494                                                           vid, prio, ethertype,
 495                                                           extack);
 496         } else {
 497                 NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN action");
 498                 dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN action\n");
 499                 return -EINVAL;
 500         }
 501 }
 502
 503 int mlxsw_sp_acl_rulei_act_priority(struct mlxsw_sp *mlxsw_sp,
 504                                     struct mlxsw_sp_acl_rule_info *rulei,
 505                                     u32 prio, struct netlink_ext_ack *extack)
 506 {
 507         /* Even though both Linux and Spectrum switches support 16 priorities,
 508          * spectrum_qdisc only processes the first eight priomap elements, and
 509          * the DCB and PFC features are tied to 8 priorities as well. Therefore
 510          * bounce attempts to prioritize packets to higher priorities.
 511          */
 512         if (prio >= IEEE_8021QAZ_MAX_TCS) {
 513                 NL_SET_ERR_MSG_MOD(extack, "Only priorities 0..7 are supported");
 514                 return -EINVAL;
 515         }
 516         return mlxsw_afa_block_append_qos_switch_prio(rulei->act_block, prio,
 517                                                       extack);
 518 }
 519
 520 struct mlxsw_sp_acl_mangle_action {
 521         enum flow_action_mangle_base htype;
 522         /* Offset is u32-aligned. */
 523         u32 offset;
 524         /* Mask bits are unset for the modified field. */
 525         u32 mask;
 526         /* Shift required to extract the set value. */
 527         u32 shift;
 528         enum mlxsw_sp_acl_mangle_field field;
 529 };
 530
 531 #define MLXSW_SP_ACL_MANGLE_ACTION(_htype, _offset, _mask, _shift, _field) \
 532         {                                                               \
 533                 .htype = _htype,                                        \
 534                 .offset = _offset,                                      \
 535                 .mask = _mask,                                          \
 536                 .shift = _shift,                                        \
 537                 .field = MLXSW_SP_ACL_MANGLE_FIELD_##_field,            \
 538         }
 539
 540 #define MLXSW_SP_ACL_MANGLE_ACTION_IP4(_offset, _mask, _shift, _field) \
 541         MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_IP4,       \
 542                                    _offset, _mask, _shift, _field)
 543
 544 #define MLXSW_SP_ACL_MANGLE_ACTION_IP6(_offset, _mask, _shift, _field) \
 545         MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_IP6,       \
 546                                    _offset, _mask, _shift, _field)
 547
 548 #define MLXSW_SP_ACL_MANGLE_ACTION_TCP(_offset, _mask, _shift, _field) \
 549         MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_TCP, _offset, _mask, _shift, _field)
 550
 551 #define MLXSW_SP_ACL_MANGLE_ACTION_UDP(_offset, _mask, _shift, _field) \
 552         MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_UDP, _offset, _mask, _shift, _field)
 553
 554 static struct mlxsw_sp_acl_mangle_action mlxsw_sp_acl_mangle_actions[] = {
 555         MLXSW_SP_ACL_MANGLE_ACTION_IP4(0, 0xff00ffff, 16, IP_DSFIELD),
 556         MLXSW_SP_ACL_MANGLE_ACTION_IP4(0, 0xff03ffff, 18, IP_DSCP),
 557         MLXSW_SP_ACL_MANGLE_ACTION_IP4(0, 0xfffcffff, 16, IP_ECN),
 558
 559         MLXSW_SP_ACL_MANGLE_ACTION_IP6(0, 0xf00fffff, 20, IP_DSFIELD),
 560         MLXSW_SP_ACL_MANGLE_ACTION_IP6(0, 0xf03fffff, 22, IP_DSCP),
 561         MLXSW_SP_ACL_MANGLE_ACTION_IP6(0, 0xffcfffff, 20, IP_ECN),
 562
 563         MLXSW_SP_ACL_MANGLE_ACTION_TCP(0, 0x0000ffff, 16, IP_SPORT),
 564         MLXSW_SP_ACL_MANGLE_ACTION_TCP(0, 0xffff0000, 0,  IP_DPORT),
 565
 566         MLXSW_SP_ACL_MANGLE_ACTION_UDP(0, 0x0000ffff, 16, IP_SPORT),
 567         MLXSW_SP_ACL_MANGLE_ACTION_UDP(0, 0xffff0000, 0,  IP_DPORT),
 568
 569         MLXSW_SP_ACL_MANGLE_ACTION_IP4(12, 0x00000000, 0, IP4_SIP),
 570         MLXSW_SP_ACL_MANGLE_ACTION_IP4(16, 0x00000000, 0, IP4_DIP),
 571
 572         MLXSW_SP_ACL_MANGLE_ACTION_IP6(8, 0x00000000, 0, IP6_SIP_1),
 573         MLXSW_SP_ACL_MANGLE_ACTION_IP6(12, 0x00000000, 0, IP6_SIP_2),
 574         MLXSW_SP_ACL_MANGLE_ACTION_IP6(16, 0x00000000, 0, IP6_SIP_3),
 575         MLXSW_SP_ACL_MANGLE_ACTION_IP6(20, 0x00000000, 0, IP6_SIP_4),
 576         MLXSW_SP_ACL_MANGLE_ACTION_IP6(24, 0x00000000, 0, IP6_DIP_1),
 577         MLXSW_SP_ACL_MANGLE_ACTION_IP6(28, 0x00000000, 0, IP6_DIP_2),
 578         MLXSW_SP_ACL_MANGLE_ACTION_IP6(32, 0x00000000, 0, IP6_DIP_3),
 579         MLXSW_SP_ACL_MANGLE_ACTION_IP6(36, 0x00000000, 0, IP6_DIP_4),
 580 };
 581
 582 static int
 583 mlxsw_sp_acl_rulei_act_mangle_field(struct mlxsw_sp *mlxsw_sp,
 584                                     struct mlxsw_sp_acl_rule_info *rulei,
 585                                     struct mlxsw_sp_acl_mangle_action *mact,
 586                                     u32 val, struct netlink_ext_ack *extack)
 587 {
 588         switch (mact->field) {
 589         case MLXSW_SP_ACL_MANGLE_FIELD_IP_DSFIELD:
 590                 return mlxsw_afa_block_append_qos_dsfield(rulei->act_block,
 591                                                           val, extack);
 592         case MLXSW_SP_ACL_MANGLE_FIELD_IP_DSCP:
 593                 return mlxsw_afa_block_append_qos_dscp(rulei->act_block,
 594                                                        val, extack);
 595         case MLXSW_SP_ACL_MANGLE_FIELD_IP_ECN:
 596                 return mlxsw_afa_block_append_qos_ecn(rulei->act_block,
 597                                                       val, extack);
 598         default:
 599                 return -EOPNOTSUPP;
 600         }
 601 }
 602
 603 static int mlxsw_sp1_acl_rulei_act_mangle_field(struct mlxsw_sp *mlxsw_sp,
 604                                                 struct mlxsw_sp_acl_rule_info *rulei,
 605                                                 struct mlxsw_sp_acl_mangle_action *mact,
 606                                                 u32 val, struct netlink_ext_ack *extack)
 607 {
 608         int err;
 609
 610         err = mlxsw_sp_acl_rulei_act_mangle_field(mlxsw_sp, rulei, mact, val, extack);
 611         if (err != -EOPNOTSUPP)
 612                 return err;
 613
 614         NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field");
 615         return err;
 616 }
 617
 618 static int
 619 mlxsw_sp2_acl_rulei_act_mangle_field_ip_odd(struct mlxsw_sp_acl_rule_info *rulei,
 620                                             enum mlxsw_sp_acl_mangle_field field,
 621                                             u32 val, struct netlink_ext_ack *extack)
 622 {
 623         if (!rulei->ipv6_valid) {
 624                 rulei->ipv6.prev_val = val;
 625                 rulei->ipv6_valid = true;
 626                 rulei->ipv6.prev_field = field;
 627                 return 0;
 628         }
 629
 630         NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field order");
 631         return -EOPNOTSUPP;
 632 }
 633
 634 static int mlxsw_sp2_acl_rulei_act_mangle_field(struct mlxsw_sp *mlxsw_sp,
 635                                                 struct mlxsw_sp_acl_rule_info *rulei,
 636                                                 struct mlxsw_sp_acl_mangle_action *mact,
 637                                                 u32 val, struct netlink_ext_ack *extack)
 638 {
 639         int err;
 640
 641         err = mlxsw_sp_acl_rulei_act_mangle_field(mlxsw_sp, rulei, mact, val, extack);
 642         if (err != -EOPNOTSUPP)
 643                 return err;
 644
 645         switch (mact->field) {
 646         case MLXSW_SP_ACL_MANGLE_FIELD_IP_SPORT:
 647                 return mlxsw_afa_block_append_l4port(rulei->act_block, false, val, extack);
 648         case MLXSW_SP_ACL_MANGLE_FIELD_IP_DPORT:
 649                 return mlxsw_afa_block_append_l4port(rulei->act_block, true, val, extack);
 650         /* IPv4 fields */
 651         case MLXSW_SP_ACL_MANGLE_FIELD_IP4_SIP:
 652                 return mlxsw_afa_block_append_ip(rulei->act_block, false,
 653                                                  true, val, 0, extack);
 654         case MLXSW_SP_ACL_MANGLE_FIELD_IP4_DIP:
 655                 return mlxsw_afa_block_append_ip(rulei->act_block, true,
 656                                                  true, val, 0, extack);
 657         /* IPv6 fields */
 658         case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_1:
 659         case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_3:
 660         case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_1:
 661         case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_3:
 662                 return mlxsw_sp2_acl_rulei_act_mangle_field_ip_odd(rulei,
 663                                                                    mact->field,
 664                                                                    val, extack);
 665         case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_2:
 666                 if (rulei->ipv6_valid &&
 667                     rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_1) {
 668                         rulei->ipv6_valid = false;
 669                         return mlxsw_afa_block_append_ip(rulei->act_block,
 670                                                          false, false, val,
 671                                                          rulei->ipv6.prev_val,
 672                                                          extack);
 673                 }
 674                 break;
 675         case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_4:
 676                 if (rulei->ipv6_valid &&
 677                     rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_3) {
 678                         rulei->ipv6_valid = false;
 679                         return mlxsw_afa_block_append_ip(rulei->act_block,
 680                                                          false, true, val,
 681                                                          rulei->ipv6.prev_val,
 682                                                          extack);
 683                 }
 684                 break;
 685         case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_2:
 686                 if (rulei->ipv6_valid &&
 687                     rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_1) {
 688                         rulei->ipv6_valid = false;
 689                         return mlxsw_afa_block_append_ip(rulei->act_block,
 690                                                          true, false, val,
 691                                                          rulei->ipv6.prev_val,
 692                                                          extack);
 693                 }
 694                 break;
 695         case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_4:
 696                 if (rulei->ipv6_valid &&
 697                     rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_3) {
 698                         rulei->ipv6_valid = false;
 699                         return mlxsw_afa_block_append_ip(rulei->act_block,
 700                                                          true, true, val,
 701                                                          rulei->ipv6.prev_val,
 702                                                          extack);
 703                 }
 704                 break;
 705         default:
 706                 break;
 707         }
 708
 709         NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field");
 710         return err;
 711 }
 712
 713 int mlxsw_sp_acl_rulei_act_mangle(struct mlxsw_sp *mlxsw_sp,
 714                                   struct mlxsw_sp_acl_rule_info *rulei,
 715                                   enum flow_action_mangle_base htype,
 716                                   u32 offset, u32 mask, u32 val,
 717                                   struct netlink_ext_ack *extack)
 718 {
 719         const struct mlxsw_sp_acl_rulei_ops *acl_rulei_ops = mlxsw_sp->acl_rulei_ops;
 720         struct mlxsw_sp_acl_mangle_action *mact;
 721         size_t i;
 722
 723         for (i = 0; i < ARRAY_SIZE(mlxsw_sp_acl_mangle_actions); ++i) {
 724                 mact = &mlxsw_sp_acl_mangle_actions[i];
 725                 if (mact->htype == htype &&
 726                     mact->offset == offset &&
 727                     mact->mask == mask) {
 728                         val >>= mact->shift;
 729                         return acl_rulei_ops->act_mangle_field(mlxsw_sp,
 730                                                                rulei, mact,
 731                                                                val, extack);
 732                 }
 733         }
 734
 735         NL_SET_ERR_MSG_MOD(extack, "Unknown mangle field");
 736         return -EINVAL;
 737 }
 738
 739 int mlxsw_sp_acl_rulei_act_police(struct mlxsw_sp *mlxsw_sp,
 740                                   struct mlxsw_sp_acl_rule_info *rulei,
 741                                   u32 index, u64 rate_bytes_ps,
 742                                   u32 burst, struct netlink_ext_ack *extack)
 743 {
 744         int err;
 745
 746         err = mlxsw_afa_block_append_police(rulei->act_block, index,
 747                                             rate_bytes_ps, burst,
 748                                             &rulei->policer_index, extack);
 749         if (err)
 750                 return err;
 751
 752         rulei->policer_index_valid = true;
 753
 754         return 0;
 755 }
 756
 757 int mlxsw_sp_acl_rulei_act_count(struct mlxsw_sp *mlxsw_sp,
 758                                  struct mlxsw_sp_acl_rule_info *rulei,
 759                                  struct netlink_ext_ack *extack)
 760 {
 761         int err;
 762
 763         err = mlxsw_afa_block_append_counter(rulei->act_block,
 764                                              &rulei->counter_index, extack);
 765         if (err)
 766                 return err;
 767         rulei->counter_valid = true;
 768         return 0;
 769 }
 770
 771 int mlxsw_sp_acl_rulei_act_fid_set(struct mlxsw_sp *mlxsw_sp,
 772                                    struct mlxsw_sp_acl_rule_info *rulei,
 773                                    u16 fid, struct netlink_ext_ack *extack)
 774 {
 775         return mlxsw_afa_block_append_fid_set(rulei->act_block, fid, extack);
 776 }
 777
 778 int mlxsw_sp_acl_rulei_act_ignore(struct mlxsw_sp *mlxsw_sp,
 779                                   struct mlxsw_sp_acl_rule_info *rulei,
 780                                   bool disable_learning, bool disable_security)
 781 {
 782         return mlxsw_afa_block_append_ignore(rulei->act_block,
 783                                              disable_learning,
 784                                              disable_security);
 785 }
 786
 787 int mlxsw_sp_acl_rulei_act_sample(struct mlxsw_sp *mlxsw_sp,
 788                                   struct mlxsw_sp_acl_rule_info *rulei,
 789                                   struct mlxsw_sp_flow_block *block,
 790                                   struct psample_group *psample_group, u32 rate,
 791                                   u32 trunc_size, bool truncate,
 792                                   struct netlink_ext_ack *extack)
 793 {
 794         struct mlxsw_sp_flow_block_binding *binding;
 795         struct mlxsw_sp_port *mlxsw_sp_port;
 796
 797         if (!list_is_singular(&block->binding_list)) {
 798                 NL_SET_ERR_MSG_MOD(extack, "Only a single sampling source is allowed");
 799                 return -EOPNOTSUPP;
 800         }
 801         binding = list_first_entry(&block->binding_list,
 802                                    struct mlxsw_sp_flow_block_binding, list);
 803         mlxsw_sp_port = binding->mlxsw_sp_port;
 804
 805         return mlxsw_afa_block_append_sampler(rulei->act_block,
 806                                               mlxsw_sp_port->local_port,
 807                                               psample_group, rate, trunc_size,
 808                                               truncate, binding->ingress,
 809                                               extack);
 810 }
 811
 812 struct mlxsw_sp_acl_rule *
 813 mlxsw_sp_acl_rule_create(struct mlxsw_sp *mlxsw_sp,
 814                          struct mlxsw_sp_acl_ruleset *ruleset,
 815                          unsigned long cookie,
 816                          struct mlxsw_afa_block *afa_block,
 817                          struct netlink_ext_ack *extack)
 818 {
 819         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 820         struct mlxsw_sp_acl_rule *rule;
 821         int err;
 822
 823         mlxsw_sp_acl_ruleset_ref_inc(ruleset);
 824         rule = kzalloc(sizeof(*rule) + ops->rule_priv_size,
 825                        GFP_KERNEL);
 826         if (!rule) {
 827                 err = -ENOMEM;
 828                 goto err_alloc;
 829         }
 830         rule->cookie = cookie;
 831         rule->ruleset = ruleset;
 832
 833         rule->rulei = mlxsw_sp_acl_rulei_create(mlxsw_sp->acl, afa_block);
 834         if (IS_ERR(rule->rulei)) {
 835                 err = PTR_ERR(rule->rulei);
 836                 goto err_rulei_create;
 837         }
 838
 839         return rule;
 840
 841 err_rulei_create:
 842         kfree(rule);
 843 err_alloc:
 844         mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
 845         return ERR_PTR(err);
 846 }
 847
 848 void mlxsw_sp_acl_rule_destroy(struct mlxsw_sp *mlxsw_sp,
 849                                struct mlxsw_sp_acl_rule *rule)
 850 {
 851         struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
 852
 853         mlxsw_sp_acl_rulei_destroy(mlxsw_sp, rule->rulei);
 854         kfree(rule);
 855         mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
 856 }
 857
 858 int mlxsw_sp_acl_rule_add(struct mlxsw_sp *mlxsw_sp,
 859                           struct mlxsw_sp_acl_rule *rule)
 860 {
 861         struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
 862         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 863         struct mlxsw_sp_flow_block *block = ruleset->ht_key.block;
 864         int err;
 865
 866         err = ops->rule_add(mlxsw_sp, ruleset->priv, rule->priv, rule->rulei);
 867         if (err)
 868                 return err;
 869
 870         err = rhashtable_insert_fast(&ruleset->rule_ht, &rule->ht_node,
 871                                      mlxsw_sp_acl_rule_ht_params);
 872         if (err)
 873                 goto err_rhashtable_insert;
 874
 875         if (!ruleset->ht_key.chain_index &&
 876             mlxsw_sp_acl_ruleset_is_singular(ruleset)) {
 877                 /* We only need ruleset with chain index 0, the implicit
 878                  * one, to be directly bound to device. The rest of the
 879                  * rulesets are bound by "Goto action set".
 880                  */
 881                 err = mlxsw_sp_acl_ruleset_block_bind(mlxsw_sp, ruleset, block);
 882                 if (err)
 883                         goto err_ruleset_block_bind;
 884         }
 885
 886         mutex_lock(&mlxsw_sp->acl->rules_lock);
 887         list_add_tail(&rule->list, &mlxsw_sp->acl->rules);
 888         mutex_unlock(&mlxsw_sp->acl->rules_lock);
 889         block->rule_count++;
 890         block->ingress_blocker_rule_count += rule->rulei->ingress_bind_blocker;
 891         block->egress_blocker_rule_count += rule->rulei->egress_bind_blocker;
 892         return 0;
 893
 894 err_ruleset_block_bind:
 895         rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node,
 896                                mlxsw_sp_acl_rule_ht_params);
 897 err_rhashtable_insert:
 898         ops->rule_del(mlxsw_sp, rule->priv);
 899         return err;
 900 }
 901
 902 void mlxsw_sp_acl_rule_del(struct mlxsw_sp *mlxsw_sp,
 903                            struct mlxsw_sp_acl_rule *rule)
 904 {
 905         struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
 906         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 907         struct mlxsw_sp_flow_block *block = ruleset->ht_key.block;
 908
 909         block->egress_blocker_rule_count -= rule->rulei->egress_bind_blocker;
 910         block->ingress_blocker_rule_count -= rule->rulei->ingress_bind_blocker;
 911         block->rule_count--;
 912         mutex_lock(&mlxsw_sp->acl->rules_lock);
 913         list_del(&rule->list);
 914         mutex_unlock(&mlxsw_sp->acl->rules_lock);
 915         if (!ruleset->ht_key.chain_index &&
 916             mlxsw_sp_acl_ruleset_is_singular(ruleset))
 917                 mlxsw_sp_acl_ruleset_block_unbind(mlxsw_sp, ruleset, block);
 918         rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node,
 919                                mlxsw_sp_acl_rule_ht_params);
 920         ops->rule_del(mlxsw_sp, rule->priv);
 921 }
 922
 923 int mlxsw_sp_acl_rule_action_replace(struct mlxsw_sp *mlxsw_sp,
 924                                      struct mlxsw_sp_acl_rule *rule,
 925                                      struct mlxsw_afa_block *afa_block)
 926 {
 927         struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
 928         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 929         struct mlxsw_sp_acl_rule_info *rulei;
 930
 931         rulei = mlxsw_sp_acl_rule_rulei(rule);
 932         rulei->act_block = afa_block;
 933
 934         return ops->rule_action_replace(mlxsw_sp, rule->priv, rule->rulei);
 935 }
 936
 937 struct mlxsw_sp_acl_rule *
 938 mlxsw_sp_acl_rule_lookup(struct mlxsw_sp *mlxsw_sp,
 939                          struct mlxsw_sp_acl_ruleset *ruleset,
 940                          unsigned long cookie)
 941 {
 942         return rhashtable_lookup_fast(&ruleset->rule_ht, &cookie,
 943                                        mlxsw_sp_acl_rule_ht_params);
 944 }
 945
 946 struct mlxsw_sp_acl_rule_info *
 947 mlxsw_sp_acl_rule_rulei(struct mlxsw_sp_acl_rule *rule)
 948 {
 949         return rule->rulei;
 950 }
 951
 952 static int mlxsw_sp_acl_rule_activity_update(struct mlxsw_sp *mlxsw_sp,
 953                                              struct mlxsw_sp_acl_rule *rule)
 954 {
 955         struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
 956         const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 957         bool active;
 958         int err;
 959
 960         err = ops->rule_activity_get(mlxsw_sp, rule->priv, &active);
 961         if (err)
 962                 return err;
 963         if (active)
 964                 rule->last_used = jiffies;
 965         return 0;
 966 }
 967
 968 static int mlxsw_sp_acl_rules_activity_update(struct mlxsw_sp_acl *acl)
 969 {
 970         struct mlxsw_sp_acl_rule *rule;
 971         int err;
 972
 973         mutex_lock(&acl->rules_lock);
 974         list_for_each_entry(rule, &acl->rules, list) {
 975                 err = mlxsw_sp_acl_rule_activity_update(acl->mlxsw_sp,
 976                                                         rule);
 977                 if (err)
 978                         goto err_rule_update;
 979         }
 980         mutex_unlock(&acl->rules_lock);
 981         return 0;
 982
 983 err_rule_update:
 984         mutex_unlock(&acl->rules_lock);
 985         return err;
 986 }
 987
 988 static void mlxsw_sp_acl_rule_activity_work_schedule(struct mlxsw_sp_acl *acl)
 989 {
 990         unsigned long interval = acl->rule_activity_update.interval;
 991
 992         mlxsw_core_schedule_dw(&acl->rule_activity_update.dw,
 993                                msecs_to_jiffies(interval));
 994 }
 995
 996 static void mlxsw_sp_acl_rule_activity_update_work(struct work_struct *work)
 997 {
 998         struct mlxsw_sp_acl *acl = container_of(work, struct mlxsw_sp_acl,
 999                                                 rule_activity_update.dw.work);
1000         int err;
1001
1002         err = mlxsw_sp_acl_rules_activity_update(acl);
1003         if (err)
1004                 dev_err(acl->mlxsw_sp->bus_info->dev, "Could not update acl activity");
1005
1006         mlxsw_sp_acl_rule_activity_work_schedule(acl);
1007 }
1008
1009 int mlxsw_sp_acl_rule_get_stats(struct mlxsw_sp *mlxsw_sp,
1010                                 struct mlxsw_sp_acl_rule *rule,
1011                                 u64 *packets, u64 *bytes, u64 *drops,
1012                                 u64 *last_use,
1013                                 enum flow_action_hw_stats *used_hw_stats)
1014
1015 {
1016         enum mlxsw_sp_policer_type type = MLXSW_SP_POLICER_TYPE_SINGLE_RATE;
1017         struct mlxsw_sp_acl_rule_info *rulei;
1018         u64 current_packets = 0;
1019         u64 current_bytes = 0;
1020         u64 current_drops = 0;
1021         int err;
1022
1023         rulei = mlxsw_sp_acl_rule_rulei(rule);
1024         if (rulei->counter_valid) {
1025                 err = mlxsw_sp_flow_counter_get(mlxsw_sp, rulei->counter_index,
1026                                                 &current_packets,
1027                                                 &current_bytes);
1028                 if (err)
1029                         return err;
1030                 *used_hw_stats = FLOW_ACTION_HW_STATS_IMMEDIATE;
1031         }
1032         if (rulei->policer_index_valid) {
1033                 err = mlxsw_sp_policer_drops_counter_get(mlxsw_sp, type,
1034                                                          rulei->policer_index,
1035                                                          &current_drops);
1036                 if (err)
1037                         return err;
1038         }
1039         *packets = current_packets - rule->last_packets;
1040         *bytes = current_bytes - rule->last_bytes;
1041         *drops = current_drops - rule->last_drops;
1042         *last_use = rule->last_used;
1043
1044         rule->last_bytes = current_bytes;
1045         rule->last_packets = current_packets;
1046         rule->last_drops = current_drops;
1047
1048         return 0;
1049 }
1050
1051 int mlxsw_sp_acl_init(struct mlxsw_sp *mlxsw_sp)
1052 {
1053         struct mlxsw_sp_fid *fid;
1054         struct mlxsw_sp_acl *acl;
1055         size_t alloc_size;
1056         int err;
1057
1058         alloc_size = sizeof(*acl) + mlxsw_sp_acl_tcam_priv_size(mlxsw_sp);
1059         acl = kzalloc(alloc_size, GFP_KERNEL);
1060         if (!acl)
1061                 return -ENOMEM;
1062         mlxsw_sp->acl = acl;
1063         acl->mlxsw_sp = mlxsw_sp;
1064         acl->afk = mlxsw_afk_create(MLXSW_CORE_RES_GET(mlxsw_sp->core,
1065                                                        ACL_FLEX_KEYS),
1066                                     mlxsw_sp->afk_ops);
1067         if (!acl->afk) {
1068                 err = -ENOMEM;
1069                 goto err_afk_create;
1070         }
1071
1072         err = rhashtable_init(&acl->ruleset_ht,
1073                               &mlxsw_sp_acl_ruleset_ht_params);
1074         if (err)
1075                 goto err_rhashtable_init;
1076
1077         fid = mlxsw_sp_fid_dummy_get(mlxsw_sp);
1078         if (IS_ERR(fid)) {
1079                 err = PTR_ERR(fid);
1080                 goto err_fid_get;
1081         }
1082         acl->dummy_fid = fid;
1083
1084         INIT_LIST_HEAD(&acl->rules);
1085         mutex_init(&acl->rules_lock);
1086         err = mlxsw_sp_acl_tcam_init(mlxsw_sp, &acl->tcam);
1087         if (err)
1088                 goto err_acl_ops_init;
1089
1090         /* Create the delayed work for the rule activity_update */
1091         INIT_DELAYED_WORK(&acl->rule_activity_update.dw,
1092                           mlxsw_sp_acl_rule_activity_update_work);
1093         acl->rule_activity_update.interval = MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS;
1094         mlxsw_core_schedule_dw(&acl->rule_activity_update.dw, 0);
1095         return 0;
1096
1097 err_acl_ops_init:
1098         mutex_destroy(&acl->rules_lock);
1099         mlxsw_sp_fid_put(fid);
1100 err_fid_get:
1101         rhashtable_destroy(&acl->ruleset_ht);
1102 err_rhashtable_init:
1103         mlxsw_afk_destroy(acl->afk);
1104 err_afk_create:
1105         kfree(acl);
1106         return err;
1107 }
1108
1109 void mlxsw_sp_acl_fini(struct mlxsw_sp *mlxsw_sp)
1110 {
1111         struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
1112
1113         cancel_delayed_work_sync(&mlxsw_sp->acl->rule_activity_update.dw);
1114         mlxsw_sp_acl_tcam_fini(mlxsw_sp, &acl->tcam);
1115         mutex_destroy(&acl->rules_lock);
1116         WARN_ON(!list_empty(&acl->rules));
1117         mlxsw_sp_fid_put(acl->dummy_fid);
1118         rhashtable_destroy(&acl->ruleset_ht);
1119         mlxsw_afk_destroy(acl->afk);
1120         kfree(acl);
1121 }
1122
1123 struct mlxsw_sp_acl_rulei_ops mlxsw_sp1_acl_rulei_ops = {
1124         .act_mangle_field = mlxsw_sp1_acl_rulei_act_mangle_field,
1125 };
1126
1127 struct mlxsw_sp_acl_rulei_ops mlxsw_sp2_acl_rulei_ops = {
1128         .act_mangle_field = mlxsw_sp2_acl_rulei_act_mangle_field,
1129 };