spectrum_acl.c

   1// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
   2/* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */
   3
   4#include <linux/kernel.h>
   5#include <linux/slab.h>
   6#include <linux/errno.h>
   7#include <linux/list.h>
   8#include <linux/string.h>
   9#include <linux/rhashtable.h>
  10#include <linux/netdevice.h>
  11#include <linux/mutex.h>
  12#include <linux/refcount.h>
  13#include <net/net_namespace.h>
  14#include <net/tc_act/tc_vlan.h>
  15
  16#include "reg.h"
  17#include "core.h"
  18#include "resources.h"
  19#include "spectrum.h"
  20#include "core_acl_flex_keys.h"
  21#include "core_acl_flex_actions.h"
  22#include "spectrum_acl_tcam.h"
  23
  24struct mlxsw_sp_acl {
  25	struct mlxsw_sp *mlxsw_sp;
  26	struct mlxsw_afk *afk;
  27	struct mlxsw_sp_fid *dummy_fid;
  28	struct rhashtable ruleset_ht;
  29	struct list_head rules;
  30	struct mutex rules_lock; /* Protects rules list */
  31	struct {
  32		struct delayed_work dw;
  33		unsigned long interval;	/* ms */
  34#define MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS 1000
  35	} rule_activity_update;
  36	struct mlxsw_sp_acl_tcam tcam;
  37};
  38
  39struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl)
  40{
  41	return acl->afk;
  42}
  43
  44struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam(struct mlxsw_sp_acl *acl)
  45{
  46	return &acl->tcam;
  47}
  48
  49struct mlxsw_sp_acl_ruleset_ht_key {
  50	struct mlxsw_sp_flow_block *block;
  51	u32 chain_index;
  52	const struct mlxsw_sp_acl_profile_ops *ops;
  53};
  54
  55struct mlxsw_sp_acl_ruleset {
  56	struct rhash_head ht_node; /* Member of acl HT */
  57	struct mlxsw_sp_acl_ruleset_ht_key ht_key;
  58	struct rhashtable rule_ht;
  59	refcount_t ref_count;
  60	unsigned int min_prio;
  61	unsigned int max_prio;
  62	unsigned long priv[];
  63	/* priv has to be always the last item */
  64};
  65
  66struct mlxsw_sp_acl_rule {
  67	struct rhash_head ht_node; /* Member of rule HT */
  68	struct list_head list;
  69	unsigned long cookie; /* HT key */
  70	struct mlxsw_sp_acl_ruleset *ruleset;
  71	struct mlxsw_sp_acl_rule_info *rulei;
  72	u64 last_used;
  73	u64 last_packets;
  74	u64 last_bytes;
  75	u64 last_drops;
  76	unsigned long priv[];
  77	/* priv has to be always the last item */
  78};
  79
  80static const struct rhashtable_params mlxsw_sp_acl_ruleset_ht_params = {
  81	.key_len = sizeof(struct mlxsw_sp_acl_ruleset_ht_key),
  82	.key_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_key),
  83	.head_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_node),
  84	.automatic_shrinking = true,
  85};
  86
  87static const struct rhashtable_params mlxsw_sp_acl_rule_ht_params = {
  88	.key_len = sizeof(unsigned long),
  89	.key_offset = offsetof(struct mlxsw_sp_acl_rule, cookie),
  90	.head_offset = offsetof(struct mlxsw_sp_acl_rule, ht_node),
  91	.automatic_shrinking = true,
  92};
  93
  94struct mlxsw_sp_fid *mlxsw_sp_acl_dummy_fid(struct mlxsw_sp *mlxsw_sp)
  95{
  96	return mlxsw_sp->acl->dummy_fid;
  97}
  98
  99static bool
 100mlxsw_sp_acl_ruleset_is_singular(const struct mlxsw_sp_acl_ruleset *ruleset)
 101{
 102	/* We hold a reference on ruleset ourselves */
 103	return refcount_read(&ruleset->ref_count) == 2;
 104}
 105
 106int mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp,
 107			      struct mlxsw_sp_flow_block *block,
 108			      struct mlxsw_sp_flow_block_binding *binding)
 109{
 110	struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero;
 111	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 112
 113	return ops->ruleset_bind(mlxsw_sp, ruleset->priv,
 114				 binding->mlxsw_sp_port, binding->ingress);
 115}
 116
 117void mlxsw_sp_acl_ruleset_unbind(struct mlxsw_sp *mlxsw_sp,
 118				 struct mlxsw_sp_flow_block *block,
 119				 struct mlxsw_sp_flow_block_binding *binding)
 120{
 121	struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero;
 122	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 123
 124	ops->ruleset_unbind(mlxsw_sp, ruleset->priv,
 125			    binding->mlxsw_sp_port, binding->ingress);
 126}
 127
 128static int
 129mlxsw_sp_acl_ruleset_block_bind(struct mlxsw_sp *mlxsw_sp,
 130				struct mlxsw_sp_acl_ruleset *ruleset,
 131				struct mlxsw_sp_flow_block *block)
 132{
 133	struct mlxsw_sp_flow_block_binding *binding;
 134	int err;
 135
 136	block->ruleset_zero = ruleset;
 137	list_for_each_entry(binding, &block->binding_list, list) {
 138		err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding);
 139		if (err)
 140			goto rollback;
 141	}
 142	return 0;
 143
 144rollback:
 145	list_for_each_entry_continue_reverse(binding, &block->binding_list,
 146					     list)
 147		mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding);
 148	block->ruleset_zero = NULL;
 149
 150	return err;
 151}
 152
 153static void
 154mlxsw_sp_acl_ruleset_block_unbind(struct mlxsw_sp *mlxsw_sp,
 155				  struct mlxsw_sp_acl_ruleset *ruleset,
 156				  struct mlxsw_sp_flow_block *block)
 157{
 158	struct mlxsw_sp_flow_block_binding *binding;
 159
 160	list_for_each_entry(binding, &block->binding_list, list)
 161		mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding);
 162	block->ruleset_zero = NULL;
 163}
 164
 165static struct mlxsw_sp_acl_ruleset *
 166mlxsw_sp_acl_ruleset_create(struct mlxsw_sp *mlxsw_sp,
 167			    struct mlxsw_sp_flow_block *block, u32 chain_index,
 168			    const struct mlxsw_sp_acl_profile_ops *ops,
 169			    struct mlxsw_afk_element_usage *tmplt_elusage)
 170{
 171	struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
 172	struct mlxsw_sp_acl_ruleset *ruleset;
 173	size_t alloc_size;
 174	int err;
 175
 176	alloc_size = sizeof(*ruleset) + ops->ruleset_priv_size;
 177	ruleset = kzalloc(alloc_size, GFP_KERNEL);
 178	if (!ruleset)
 179		return ERR_PTR(-ENOMEM);
 180	refcount_set(&ruleset->ref_count, 1);
 181	ruleset->ht_key.block = block;
 182	ruleset->ht_key.chain_index = chain_index;
 183	ruleset->ht_key.ops = ops;
 184
 185	err = rhashtable_init(&ruleset->rule_ht, &mlxsw_sp_acl_rule_ht_params);
 186	if (err)
 187		goto err_rhashtable_init;
 188
 189	err = ops->ruleset_add(mlxsw_sp, &acl->tcam, ruleset->priv,
 190			       tmplt_elusage, &ruleset->min_prio,
 191			       &ruleset->max_prio);
 192	if (err)
 193		goto err_ops_ruleset_add;
 194
 195	err = rhashtable_insert_fast(&acl->ruleset_ht, &ruleset->ht_node,
 196				     mlxsw_sp_acl_ruleset_ht_params);
 197	if (err)
 198		goto err_ht_insert;
 199
 200	return ruleset;
 201
 202err_ht_insert:
 203	ops->ruleset_del(mlxsw_sp, ruleset->priv);
 204err_ops_ruleset_add:
 205	rhashtable_destroy(&ruleset->rule_ht);
 206err_rhashtable_init:
 207	kfree(ruleset);
 208	return ERR_PTR(err);
 209}
 210
 211static void mlxsw_sp_acl_ruleset_destroy(struct mlxsw_sp *mlxsw_sp,
 212					 struct mlxsw_sp_acl_ruleset *ruleset)
 213{
 214	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 215	struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
 216
 217	rhashtable_remove_fast(&acl->ruleset_ht, &ruleset->ht_node,
 218			       mlxsw_sp_acl_ruleset_ht_params);
 219	ops->ruleset_del(mlxsw_sp, ruleset->priv);
 220	rhashtable_destroy(&ruleset->rule_ht);
 221	kfree(ruleset);
 222}
 223
 224static void mlxsw_sp_acl_ruleset_ref_inc(struct mlxsw_sp_acl_ruleset *ruleset)
 225{
 226	refcount_inc(&ruleset->ref_count);
 227}
 228
 229static void mlxsw_sp_acl_ruleset_ref_dec(struct mlxsw_sp *mlxsw_sp,
 230					 struct mlxsw_sp_acl_ruleset *ruleset)
 231{
 232	if (!refcount_dec_and_test(&ruleset->ref_count))
 233		return;
 234	mlxsw_sp_acl_ruleset_destroy(mlxsw_sp, ruleset);
 235}
 236
 237static struct mlxsw_sp_acl_ruleset *
 238__mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp_acl *acl,
 239			      struct mlxsw_sp_flow_block *block, u32 chain_index,
 240			      const struct mlxsw_sp_acl_profile_ops *ops)
 241{
 242	struct mlxsw_sp_acl_ruleset_ht_key ht_key;
 243
 244	memset(&ht_key, 0, sizeof(ht_key));
 245	ht_key.block = block;
 246	ht_key.chain_index = chain_index;
 247	ht_key.ops = ops;
 248	return rhashtable_lookup_fast(&acl->ruleset_ht, &ht_key,
 249				      mlxsw_sp_acl_ruleset_ht_params);
 250}
 251
 252struct mlxsw_sp_acl_ruleset *
 253mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp *mlxsw_sp,
 254			    struct mlxsw_sp_flow_block *block, u32 chain_index,
 255			    enum mlxsw_sp_acl_profile profile)
 256{
 257	const struct mlxsw_sp_acl_profile_ops *ops;
 258	struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
 259	struct mlxsw_sp_acl_ruleset *ruleset;
 260
 261	ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile);
 262	if (!ops)
 263		return ERR_PTR(-EINVAL);
 264	ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops);
 265	if (!ruleset)
 266		return ERR_PTR(-ENOENT);
 267	return ruleset;
 268}
 269
 270struct mlxsw_sp_acl_ruleset *
 271mlxsw_sp_acl_ruleset_get(struct mlxsw_sp *mlxsw_sp,
 272			 struct mlxsw_sp_flow_block *block, u32 chain_index,
 273			 enum mlxsw_sp_acl_profile profile,
 274			 struct mlxsw_afk_element_usage *tmplt_elusage)
 275{
 276	const struct mlxsw_sp_acl_profile_ops *ops;
 277	struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
 278	struct mlxsw_sp_acl_ruleset *ruleset;
 279
 280	ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile);
 281	if (!ops)
 282		return ERR_PTR(-EINVAL);
 283
 284	ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops);
 285	if (ruleset) {
 286		mlxsw_sp_acl_ruleset_ref_inc(ruleset);
 287		return ruleset;
 288	}
 289	return mlxsw_sp_acl_ruleset_create(mlxsw_sp, block, chain_index, ops,
 290					   tmplt_elusage);
 291}
 292
 293void mlxsw_sp_acl_ruleset_put(struct mlxsw_sp *mlxsw_sp,
 294			      struct mlxsw_sp_acl_ruleset *ruleset)
 295{
 296	mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
 297}
 298
 299u16 mlxsw_sp_acl_ruleset_group_id(struct mlxsw_sp_acl_ruleset *ruleset)
 300{
 301	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 302
 303	return ops->ruleset_group_id(ruleset->priv);
 304}
 305
 306void mlxsw_sp_acl_ruleset_prio_get(struct mlxsw_sp_acl_ruleset *ruleset,
 307				   unsigned int *p_min_prio,
 308				   unsigned int *p_max_prio)
 309{
 310	*p_min_prio = ruleset->min_prio;
 311	*p_max_prio = ruleset->max_prio;
 312}
 313
 314struct mlxsw_sp_acl_rule_info *
 315mlxsw_sp_acl_rulei_create(struct mlxsw_sp_acl *acl,
 316			  struct mlxsw_afa_block *afa_block)
 317{
 318	struct mlxsw_sp_acl_rule_info *rulei;
 319	int err;
 320
 321	rulei = kzalloc(sizeof(*rulei), GFP_KERNEL);
 322	if (!rulei)
 323		return ERR_PTR(-ENOMEM);
 324
 325	if (afa_block) {
 326		rulei->act_block = afa_block;
 327		return rulei;
 328	}
 329
 330	rulei->act_block = mlxsw_afa_block_create(acl->mlxsw_sp->afa);
 331	if (IS_ERR(rulei->act_block)) {
 332		err = PTR_ERR(rulei->act_block);
 333		goto err_afa_block_create;
 334	}
 335	rulei->action_created = 1;
 336	return rulei;
 337
 338err_afa_block_create:
 339	kfree(rulei);
 340	return ERR_PTR(err);
 341}
 342
 343void mlxsw_sp_acl_rulei_destroy(struct mlxsw_sp *mlxsw_sp,
 344				struct mlxsw_sp_acl_rule_info *rulei)
 345{
 346	if (rulei->action_created)
 347		mlxsw_afa_block_destroy(rulei->act_block);
 348	if (rulei->src_port_range_reg_valid)
 349		mlxsw_sp_port_range_reg_put(mlxsw_sp,
 350					    rulei->src_port_range_reg_index);
 351	if (rulei->dst_port_range_reg_valid)
 352		mlxsw_sp_port_range_reg_put(mlxsw_sp,
 353					    rulei->dst_port_range_reg_index);
 354	kfree(rulei);
 355}
 356
 357int mlxsw_sp_acl_rulei_commit(struct mlxsw_sp_acl_rule_info *rulei)
 358{
 359	return mlxsw_afa_block_commit(rulei->act_block);
 360}
 361
 362void mlxsw_sp_acl_rulei_priority(struct mlxsw_sp_acl_rule_info *rulei,
 363				 unsigned int priority)
 364{
 365	rulei->priority = priority;
 366}
 367
 368void mlxsw_sp_acl_rulei_keymask_u32(struct mlxsw_sp_acl_rule_info *rulei,
 369				    enum mlxsw_afk_element element,
 370				    u32 key_value, u32 mask_value)
 371{
 372	mlxsw_afk_values_add_u32(&rulei->values, element,
 373				 key_value, mask_value);
 374}
 375
 376void mlxsw_sp_acl_rulei_keymask_buf(struct mlxsw_sp_acl_rule_info *rulei,
 377				    enum mlxsw_afk_element element,
 378				    const char *key_value,
 379				    const char *mask_value, unsigned int len)
 380{
 381	mlxsw_afk_values_add_buf(&rulei->values, element,
 382				 key_value, mask_value, len);
 383}
 384
 385int mlxsw_sp_acl_rulei_act_continue(struct mlxsw_sp_acl_rule_info *rulei)
 386{
 387	return mlxsw_afa_block_continue(rulei->act_block);
 388}
 389
 390int mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info *rulei,
 391				u16 group_id)
 392{
 393	return mlxsw_afa_block_jump(rulei->act_block, group_id);
 394}
 395
 396int mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info *rulei)
 397{
 398	return mlxsw_afa_block_terminate(rulei->act_block);
 399}
 400
 401int mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info *rulei,
 402				bool ingress,
 403				const struct flow_action_cookie *fa_cookie,
 404				struct netlink_ext_ack *extack)
 405{
 406	return mlxsw_afa_block_append_drop(rulei->act_block, ingress,
 407					   fa_cookie, extack);
 408}
 409
 410int mlxsw_sp_acl_rulei_act_trap(struct mlxsw_sp_acl_rule_info *rulei)
 411{
 412	return mlxsw_afa_block_append_trap(rulei->act_block,
 413					   MLXSW_TRAP_ID_ACL0);
 414}
 415
 416int mlxsw_sp_acl_rulei_act_fwd(struct mlxsw_sp *mlxsw_sp,
 417			       struct mlxsw_sp_acl_rule_info *rulei,
 418			       struct net_device *out_dev,
 419			       struct netlink_ext_ack *extack)
 420{
 421	struct mlxsw_sp_port *mlxsw_sp_port;
 422	u16 local_port;
 423	bool in_port;
 424
 425	if (out_dev) {
 426		if (!mlxsw_sp_port_dev_check(out_dev)) {
 427			NL_SET_ERR_MSG_MOD(extack, "Invalid output device");
 428			return -EINVAL;
 429		}
 430		mlxsw_sp_port = netdev_priv(out_dev);
 431		if (mlxsw_sp_port->mlxsw_sp != mlxsw_sp) {
 432			NL_SET_ERR_MSG_MOD(extack, "Invalid output device");
 433			return -EINVAL;
 434		}
 435		local_port = mlxsw_sp_port->local_port;
 436		in_port = false;
 437	} else {
 438		/* If out_dev is NULL, the caller wants to
 439		 * set forward to ingress port.
 440		 */
 441		local_port = 0;
 442		in_port = true;
 443	}
 444	return mlxsw_afa_block_append_fwd(rulei->act_block,
 445					  local_port, in_port, extack);
 446}
 447
 448int mlxsw_sp_acl_rulei_act_mirror(struct mlxsw_sp *mlxsw_sp,
 449				  struct mlxsw_sp_acl_rule_info *rulei,
 450				  struct mlxsw_sp_flow_block *block,
 451				  struct net_device *out_dev,
 452				  struct netlink_ext_ack *extack)
 453{
 454	struct mlxsw_sp_flow_block_binding *binding;
 455	struct mlxsw_sp_port *in_port;
 456
 457	if (!list_is_singular(&block->binding_list)) {
 458		NL_SET_ERR_MSG_MOD(extack, "Only a single mirror source is allowed");
 459		return -EOPNOTSUPP;
 460	}
 461	binding = list_first_entry(&block->binding_list,
 462				   struct mlxsw_sp_flow_block_binding, list);
 463	in_port = binding->mlxsw_sp_port;
 464
 465	return mlxsw_afa_block_append_mirror(rulei->act_block,
 466					     in_port->local_port,
 467					     out_dev,
 468					     binding->ingress,
 469					     extack);
 470}
 471
 472int mlxsw_sp_acl_rulei_act_vlan(struct mlxsw_sp *mlxsw_sp,
 473				struct mlxsw_sp_acl_rule_info *rulei,
 474				u32 action, u16 vid, u16 proto, u8 prio,
 475				struct netlink_ext_ack *extack)
 476{
 477	u8 ethertype;
 478
 479	if (action == FLOW_ACTION_VLAN_MANGLE) {
 480		switch (proto) {
 481		case ETH_P_8021Q:
 482			ethertype = 0;
 483			break;
 484		case ETH_P_8021AD:
 485			ethertype = 1;
 486			break;
 487		default:
 488			NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN protocol");
 489			dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN protocol %#04x\n",
 490				proto);
 491			return -EINVAL;
 492		}
 493
 494		return mlxsw_afa_block_append_vlan_modify(rulei->act_block,
 495							  vid, prio, ethertype,
 496							  extack);
 497	} else {
 498		NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN action");
 499		dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN action\n");
 500		return -EINVAL;
 501	}
 502}
 503
 504int mlxsw_sp_acl_rulei_act_priority(struct mlxsw_sp *mlxsw_sp,
 505				    struct mlxsw_sp_acl_rule_info *rulei,
 506				    u32 prio, struct netlink_ext_ack *extack)
 507{
 508	/* Even though both Linux and Spectrum switches support 16 priorities,
 509	 * spectrum_qdisc only processes the first eight priomap elements, and
 510	 * the DCB and PFC features are tied to 8 priorities as well. Therefore
 511	 * bounce attempts to prioritize packets to higher priorities.
 512	 */
 513	if (prio >= IEEE_8021QAZ_MAX_TCS) {
 514		NL_SET_ERR_MSG_MOD(extack, "Only priorities 0..7 are supported");
 515		return -EINVAL;
 516	}
 517	return mlxsw_afa_block_append_qos_switch_prio(rulei->act_block, prio,
 518						      extack);
 519}
 520
 521struct mlxsw_sp_acl_mangle_action {
 522	enum flow_action_mangle_base htype;
 523	/* Offset is u32-aligned. */
 524	u32 offset;
 525	/* Mask bits are unset for the modified field. */
 526	u32 mask;
 527	/* Shift required to extract the set value. */
 528	u32 shift;
 529	enum mlxsw_sp_acl_mangle_field field;
 530};
 531
 532#define MLXSW_SP_ACL_MANGLE_ACTION(_htype, _offset, _mask, _shift, _field) \
 533	{								\
 534		.htype = _htype,					\
 535		.offset = _offset,					\
 536		.mask = _mask,						\
 537		.shift = _shift,					\
 538		.field = MLXSW_SP_ACL_MANGLE_FIELD_##_field,		\
 539	}
 540
 541#define MLXSW_SP_ACL_MANGLE_ACTION_IP4(_offset, _mask, _shift, _field) \
 542	MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_IP4,       \
 543				   _offset, _mask, _shift, _field)
 544
 545#define MLXSW_SP_ACL_MANGLE_ACTION_IP6(_offset, _mask, _shift, _field) \
 546	MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_IP6,       \
 547				   _offset, _mask, _shift, _field)
 548
 549#define MLXSW_SP_ACL_MANGLE_ACTION_TCP(_offset, _mask, _shift, _field) \
 550	MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_TCP, _offset, _mask, _shift, _field)
 551
 552#define MLXSW_SP_ACL_MANGLE_ACTION_UDP(_offset, _mask, _shift, _field) \
 553	MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_UDP, _offset, _mask, _shift, _field)
 554
 555static struct mlxsw_sp_acl_mangle_action mlxsw_sp_acl_mangle_actions[] = {
 556	MLXSW_SP_ACL_MANGLE_ACTION_IP4(0, 0xff00ffff, 16, IP_DSFIELD),
 557	MLXSW_SP_ACL_MANGLE_ACTION_IP4(0, 0xff03ffff, 18, IP_DSCP),
 558	MLXSW_SP_ACL_MANGLE_ACTION_IP4(0, 0xfffcffff, 16, IP_ECN),
 559
 560	MLXSW_SP_ACL_MANGLE_ACTION_IP6(0, 0xf00fffff, 20, IP_DSFIELD),
 561	MLXSW_SP_ACL_MANGLE_ACTION_IP6(0, 0xf03fffff, 22, IP_DSCP),
 562	MLXSW_SP_ACL_MANGLE_ACTION_IP6(0, 0xffcfffff, 20, IP_ECN),
 563
 564	MLXSW_SP_ACL_MANGLE_ACTION_TCP(0, 0x0000ffff, 16, IP_SPORT),
 565	MLXSW_SP_ACL_MANGLE_ACTION_TCP(0, 0xffff0000, 0,  IP_DPORT),
 566
 567	MLXSW_SP_ACL_MANGLE_ACTION_UDP(0, 0x0000ffff, 16, IP_SPORT),
 568	MLXSW_SP_ACL_MANGLE_ACTION_UDP(0, 0xffff0000, 0,  IP_DPORT),
 569
 570	MLXSW_SP_ACL_MANGLE_ACTION_IP4(12, 0x00000000, 0, IP4_SIP),
 571	MLXSW_SP_ACL_MANGLE_ACTION_IP4(16, 0x00000000, 0, IP4_DIP),
 572
 573	MLXSW_SP_ACL_MANGLE_ACTION_IP6(8, 0x00000000, 0, IP6_SIP_1),
 574	MLXSW_SP_ACL_MANGLE_ACTION_IP6(12, 0x00000000, 0, IP6_SIP_2),
 575	MLXSW_SP_ACL_MANGLE_ACTION_IP6(16, 0x00000000, 0, IP6_SIP_3),
 576	MLXSW_SP_ACL_MANGLE_ACTION_IP6(20, 0x00000000, 0, IP6_SIP_4),
 577	MLXSW_SP_ACL_MANGLE_ACTION_IP6(24, 0x00000000, 0, IP6_DIP_1),
 578	MLXSW_SP_ACL_MANGLE_ACTION_IP6(28, 0x00000000, 0, IP6_DIP_2),
 579	MLXSW_SP_ACL_MANGLE_ACTION_IP6(32, 0x00000000, 0, IP6_DIP_3),
 580	MLXSW_SP_ACL_MANGLE_ACTION_IP6(36, 0x00000000, 0, IP6_DIP_4),
 581};
 582
 583static int
 584mlxsw_sp_acl_rulei_act_mangle_field(struct mlxsw_sp *mlxsw_sp,
 585				    struct mlxsw_sp_acl_rule_info *rulei,
 586				    struct mlxsw_sp_acl_mangle_action *mact,
 587				    u32 val, struct netlink_ext_ack *extack)
 588{
 589	switch (mact->field) {
 590	case MLXSW_SP_ACL_MANGLE_FIELD_IP_DSFIELD:
 591		return mlxsw_afa_block_append_qos_dsfield(rulei->act_block,
 592							  val, extack);
 593	case MLXSW_SP_ACL_MANGLE_FIELD_IP_DSCP:
 594		return mlxsw_afa_block_append_qos_dscp(rulei->act_block,
 595						       val, extack);
 596	case MLXSW_SP_ACL_MANGLE_FIELD_IP_ECN:
 597		return mlxsw_afa_block_append_qos_ecn(rulei->act_block,
 598						      val, extack);
 599	default:
 600		return -EOPNOTSUPP;
 601	}
 602}
 603
 604static int mlxsw_sp1_acl_rulei_act_mangle_field(struct mlxsw_sp *mlxsw_sp,
 605						struct mlxsw_sp_acl_rule_info *rulei,
 606						struct mlxsw_sp_acl_mangle_action *mact,
 607						u32 val, struct netlink_ext_ack *extack)
 608{
 609	int err;
 610
 611	err = mlxsw_sp_acl_rulei_act_mangle_field(mlxsw_sp, rulei, mact, val, extack);
 612	if (err != -EOPNOTSUPP)
 613		return err;
 614
 615	NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field");
 616	return err;
 617}
 618
 619static int
 620mlxsw_sp2_acl_rulei_act_mangle_field_ip_odd(struct mlxsw_sp_acl_rule_info *rulei,
 621					    enum mlxsw_sp_acl_mangle_field field,
 622					    u32 val, struct netlink_ext_ack *extack)
 623{
 624	if (!rulei->ipv6_valid) {
 625		rulei->ipv6.prev_val = val;
 626		rulei->ipv6_valid = true;
 627		rulei->ipv6.prev_field = field;
 628		return 0;
 629	}
 630
 631	NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field order");
 632	return -EOPNOTSUPP;
 633}
 634
 635static int mlxsw_sp2_acl_rulei_act_mangle_field(struct mlxsw_sp *mlxsw_sp,
 636						struct mlxsw_sp_acl_rule_info *rulei,
 637						struct mlxsw_sp_acl_mangle_action *mact,
 638						u32 val, struct netlink_ext_ack *extack)
 639{
 640	int err;
 641
 642	err = mlxsw_sp_acl_rulei_act_mangle_field(mlxsw_sp, rulei, mact, val, extack);
 643	if (err != -EOPNOTSUPP)
 644		return err;
 645
 646	switch (mact->field) {
 647	case MLXSW_SP_ACL_MANGLE_FIELD_IP_SPORT:
 648		return mlxsw_afa_block_append_l4port(rulei->act_block, false, val, extack);
 649	case MLXSW_SP_ACL_MANGLE_FIELD_IP_DPORT:
 650		return mlxsw_afa_block_append_l4port(rulei->act_block, true, val, extack);
 651	/* IPv4 fields */
 652	case MLXSW_SP_ACL_MANGLE_FIELD_IP4_SIP:
 653		return mlxsw_afa_block_append_ip(rulei->act_block, false,
 654						 true, val, 0, extack);
 655	case MLXSW_SP_ACL_MANGLE_FIELD_IP4_DIP:
 656		return mlxsw_afa_block_append_ip(rulei->act_block, true,
 657						 true, val, 0, extack);
 658	/* IPv6 fields */
 659	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_1:
 660	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_3:
 661	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_1:
 662	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_3:
 663		return mlxsw_sp2_acl_rulei_act_mangle_field_ip_odd(rulei,
 664								   mact->field,
 665								   val, extack);
 666	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_2:
 667		if (rulei->ipv6_valid &&
 668		    rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_1) {
 669			rulei->ipv6_valid = false;
 670			return mlxsw_afa_block_append_ip(rulei->act_block,
 671							 false, false, val,
 672							 rulei->ipv6.prev_val,
 673							 extack);
 674		}
 675		break;
 676	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_4:
 677		if (rulei->ipv6_valid &&
 678		    rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_3) {
 679			rulei->ipv6_valid = false;
 680			return mlxsw_afa_block_append_ip(rulei->act_block,
 681							 false, true, val,
 682							 rulei->ipv6.prev_val,
 683							 extack);
 684		}
 685		break;
 686	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_2:
 687		if (rulei->ipv6_valid &&
 688		    rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_1) {
 689			rulei->ipv6_valid = false;
 690			return mlxsw_afa_block_append_ip(rulei->act_block,
 691							 true, false, val,
 692							 rulei->ipv6.prev_val,
 693							 extack);
 694		}
 695		break;
 696	case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_4:
 697		if (rulei->ipv6_valid &&
 698		    rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_3) {
 699			rulei->ipv6_valid = false;
 700			return mlxsw_afa_block_append_ip(rulei->act_block,
 701							 true, true, val,
 702							 rulei->ipv6.prev_val,
 703							 extack);
 704		}
 705		break;
 706	default:
 707		break;
 708	}
 709
 710	NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field");
 711	return err;
 712}
 713
 714int mlxsw_sp_acl_rulei_act_mangle(struct mlxsw_sp *mlxsw_sp,
 715				  struct mlxsw_sp_acl_rule_info *rulei,
 716				  enum flow_action_mangle_base htype,
 717				  u32 offset, u32 mask, u32 val,
 718				  struct netlink_ext_ack *extack)
 719{
 720	const struct mlxsw_sp_acl_rulei_ops *acl_rulei_ops = mlxsw_sp->acl_rulei_ops;
 721	struct mlxsw_sp_acl_mangle_action *mact;
 722	size_t i;
 723
 724	for (i = 0; i < ARRAY_SIZE(mlxsw_sp_acl_mangle_actions); ++i) {
 725		mact = &mlxsw_sp_acl_mangle_actions[i];
 726		if (mact->htype == htype &&
 727		    mact->offset == offset &&
 728		    mact->mask == mask) {
 729			val >>= mact->shift;
 730			return acl_rulei_ops->act_mangle_field(mlxsw_sp,
 731							       rulei, mact,
 732							       val, extack);
 733		}
 734	}
 735
 736	NL_SET_ERR_MSG_MOD(extack, "Unknown mangle field");
 737	return -EINVAL;
 738}
 739
 740int mlxsw_sp_acl_rulei_act_police(struct mlxsw_sp *mlxsw_sp,
 741				  struct mlxsw_sp_acl_rule_info *rulei,
 742				  u32 index, u64 rate_bytes_ps,
 743				  u32 burst, struct netlink_ext_ack *extack)
 744{
 745	int err;
 746
 747	err = mlxsw_afa_block_append_police(rulei->act_block, index,
 748					    rate_bytes_ps, burst,
 749					    &rulei->policer_index, extack);
 750	if (err)
 751		return err;
 752
 753	rulei->policer_index_valid = true;
 754
 755	return 0;
 756}
 757
 758int mlxsw_sp_acl_rulei_act_count(struct mlxsw_sp *mlxsw_sp,
 759				 struct mlxsw_sp_acl_rule_info *rulei,
 760				 struct netlink_ext_ack *extack)
 761{
 762	int err;
 763
 764	err = mlxsw_afa_block_append_counter(rulei->act_block,
 765					     &rulei->counter_index, extack);
 766	if (err)
 767		return err;
 768	rulei->counter_valid = true;
 769	return 0;
 770}
 771
 772int mlxsw_sp_acl_rulei_act_fid_set(struct mlxsw_sp *mlxsw_sp,
 773				   struct mlxsw_sp_acl_rule_info *rulei,
 774				   u16 fid, struct netlink_ext_ack *extack)
 775{
 776	return mlxsw_afa_block_append_fid_set(rulei->act_block, fid, extack);
 777}
 778
 779int mlxsw_sp_acl_rulei_act_ignore(struct mlxsw_sp *mlxsw_sp,
 780				  struct mlxsw_sp_acl_rule_info *rulei,
 781				  bool disable_learning, bool disable_security)
 782{
 783	return mlxsw_afa_block_append_ignore(rulei->act_block,
 784					     disable_learning,
 785					     disable_security);
 786}
 787
 788int mlxsw_sp_acl_rulei_act_sample(struct mlxsw_sp *mlxsw_sp,
 789				  struct mlxsw_sp_acl_rule_info *rulei,
 790				  struct mlxsw_sp_flow_block *block,
 791				  struct psample_group *psample_group, u32 rate,
 792				  u32 trunc_size, bool truncate,
 793				  struct netlink_ext_ack *extack)
 794{
 795	struct mlxsw_sp_flow_block_binding *binding;
 796	struct mlxsw_sp_port *mlxsw_sp_port;
 797
 798	if (!list_is_singular(&block->binding_list)) {
 799		NL_SET_ERR_MSG_MOD(extack, "Only a single sampling source is allowed");
 800		return -EOPNOTSUPP;
 801	}
 802	binding = list_first_entry(&block->binding_list,
 803				   struct mlxsw_sp_flow_block_binding, list);
 804	mlxsw_sp_port = binding->mlxsw_sp_port;
 805
 806	return mlxsw_afa_block_append_sampler(rulei->act_block,
 807					      mlxsw_sp_port->local_port,
 808					      psample_group, rate, trunc_size,
 809					      truncate, binding->ingress,
 810					      extack);
 811}
 812
 813struct mlxsw_sp_acl_rule *
 814mlxsw_sp_acl_rule_create(struct mlxsw_sp *mlxsw_sp,
 815			 struct mlxsw_sp_acl_ruleset *ruleset,
 816			 unsigned long cookie,
 817			 struct mlxsw_afa_block *afa_block,
 818			 struct netlink_ext_ack *extack)
 819{
 820	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 821	struct mlxsw_sp_acl_rule *rule;
 822	int err;
 823
 824	mlxsw_sp_acl_ruleset_ref_inc(ruleset);
 825	rule = kzalloc(sizeof(*rule) + ops->rule_priv_size,
 826		       GFP_KERNEL);
 827	if (!rule) {
 828		err = -ENOMEM;
 829		goto err_alloc;
 830	}
 831	rule->cookie = cookie;
 832	rule->ruleset = ruleset;
 833
 834	rule->rulei = mlxsw_sp_acl_rulei_create(mlxsw_sp->acl, afa_block);
 835	if (IS_ERR(rule->rulei)) {
 836		err = PTR_ERR(rule->rulei);
 837		goto err_rulei_create;
 838	}
 839
 840	return rule;
 841
 842err_rulei_create:
 843	kfree(rule);
 844err_alloc:
 845	mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
 846	return ERR_PTR(err);
 847}
 848
 849void mlxsw_sp_acl_rule_destroy(struct mlxsw_sp *mlxsw_sp,
 850			       struct mlxsw_sp_acl_rule *rule)
 851{
 852	struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
 853
 854	mlxsw_sp_acl_rulei_destroy(mlxsw_sp, rule->rulei);
 855	kfree(rule);
 856	mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset);
 857}
 858
 859int mlxsw_sp_acl_rule_add(struct mlxsw_sp *mlxsw_sp,
 860			  struct mlxsw_sp_acl_rule *rule)
 861{
 862	struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
 863	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 864	struct mlxsw_sp_flow_block *block = ruleset->ht_key.block;
 865	int err;
 866
 867	err = ops->rule_add(mlxsw_sp, ruleset->priv, rule->priv, rule->rulei);
 868	if (err)
 869		return err;
 870
 871	err = rhashtable_insert_fast(&ruleset->rule_ht, &rule->ht_node,
 872				     mlxsw_sp_acl_rule_ht_params);
 873	if (err)
 874		goto err_rhashtable_insert;
 875
 876	if (!ruleset->ht_key.chain_index &&
 877	    mlxsw_sp_acl_ruleset_is_singular(ruleset)) {
 878		/* We only need ruleset with chain index 0, the implicit
 879		 * one, to be directly bound to device. The rest of the
 880		 * rulesets are bound by "Goto action set".
 881		 */
 882		err = mlxsw_sp_acl_ruleset_block_bind(mlxsw_sp, ruleset, block);
 883		if (err)
 884			goto err_ruleset_block_bind;
 885	}
 886
 887	mutex_lock(&mlxsw_sp->acl->rules_lock);
 888	list_add_tail(&rule->list, &mlxsw_sp->acl->rules);
 889	mutex_unlock(&mlxsw_sp->acl->rules_lock);
 890	block->rule_count++;
 891	block->ingress_blocker_rule_count += rule->rulei->ingress_bind_blocker;
 892	block->egress_blocker_rule_count += rule->rulei->egress_bind_blocker;
 893	return 0;
 894
 895err_ruleset_block_bind:
 896	rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node,
 897			       mlxsw_sp_acl_rule_ht_params);
 898err_rhashtable_insert:
 899	ops->rule_del(mlxsw_sp, rule->priv);
 900	return err;
 901}
 902
 903void mlxsw_sp_acl_rule_del(struct mlxsw_sp *mlxsw_sp,
 904			   struct mlxsw_sp_acl_rule *rule)
 905{
 906	struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
 907	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 908	struct mlxsw_sp_flow_block *block = ruleset->ht_key.block;
 909
 910	block->egress_blocker_rule_count -= rule->rulei->egress_bind_blocker;
 911	block->ingress_blocker_rule_count -= rule->rulei->ingress_bind_blocker;
 912	block->rule_count--;
 913	mutex_lock(&mlxsw_sp->acl->rules_lock);
 914	list_del(&rule->list);
 915	mutex_unlock(&mlxsw_sp->acl->rules_lock);
 916	if (!ruleset->ht_key.chain_index &&
 917	    mlxsw_sp_acl_ruleset_is_singular(ruleset))
 918		mlxsw_sp_acl_ruleset_block_unbind(mlxsw_sp, ruleset, block);
 919	rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node,
 920			       mlxsw_sp_acl_rule_ht_params);
 921	ops->rule_del(mlxsw_sp, rule->priv);
 922}
 923
 924int mlxsw_sp_acl_rule_action_replace(struct mlxsw_sp *mlxsw_sp,
 925				     struct mlxsw_sp_acl_rule *rule,
 926				     struct mlxsw_afa_block *afa_block)
 927{
 928	struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
 929	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 930	struct mlxsw_sp_acl_rule_info *rulei;
 931
 932	rulei = mlxsw_sp_acl_rule_rulei(rule);
 933	rulei->act_block = afa_block;
 934
 935	return ops->rule_action_replace(mlxsw_sp, rule->priv, rule->rulei);
 936}
 937
 938struct mlxsw_sp_acl_rule *
 939mlxsw_sp_acl_rule_lookup(struct mlxsw_sp *mlxsw_sp,
 940			 struct mlxsw_sp_acl_ruleset *ruleset,
 941			 unsigned long cookie)
 942{
 943	return rhashtable_lookup_fast(&ruleset->rule_ht, &cookie,
 944				       mlxsw_sp_acl_rule_ht_params);
 945}
 946
 947struct mlxsw_sp_acl_rule_info *
 948mlxsw_sp_acl_rule_rulei(struct mlxsw_sp_acl_rule *rule)
 949{
 950	return rule->rulei;
 951}
 952
 953static int mlxsw_sp_acl_rule_activity_update(struct mlxsw_sp *mlxsw_sp,
 954					     struct mlxsw_sp_acl_rule *rule)
 955{
 956	struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset;
 957	const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops;
 958	bool active;
 959	int err;
 960
 961	err = ops->rule_activity_get(mlxsw_sp, rule->priv, &active);
 962	if (err)
 963		return err;
 964	if (active)
 965		rule->last_used = jiffies;
 966	return 0;
 967}
 968
 969static int mlxsw_sp_acl_rules_activity_update(struct mlxsw_sp_acl *acl)
 970{
 971	struct mlxsw_sp_acl_rule *rule;
 972	int err;
 973
 974	mutex_lock(&acl->rules_lock);
 975	list_for_each_entry(rule, &acl->rules, list) {
 976		err = mlxsw_sp_acl_rule_activity_update(acl->mlxsw_sp,
 977							rule);
 978		if (err)
 979			goto err_rule_update;
 980	}
 981	mutex_unlock(&acl->rules_lock);
 982	return 0;
 983
 984err_rule_update:
 985	mutex_unlock(&acl->rules_lock);
 986	return err;
 987}
 988
 989static void mlxsw_sp_acl_rule_activity_work_schedule(struct mlxsw_sp_acl *acl)
 990{
 991	unsigned long interval = acl->rule_activity_update.interval;
 992
 993	mlxsw_core_schedule_dw(&acl->rule_activity_update.dw,
 994			       msecs_to_jiffies(interval));
 995}
 996
 997static void mlxsw_sp_acl_rule_activity_update_work(struct work_struct *work)
 998{
 999	struct mlxsw_sp_acl *acl = container_of(work, struct mlxsw_sp_acl,
1000						rule_activity_update.dw.work);
1001	int err;
1002
1003	err = mlxsw_sp_acl_rules_activity_update(acl);
1004	if (err)
1005		dev_err(acl->mlxsw_sp->bus_info->dev, "Could not update acl activity");
1006
1007	mlxsw_sp_acl_rule_activity_work_schedule(acl);
1008}
1009
1010int mlxsw_sp_acl_rule_get_stats(struct mlxsw_sp *mlxsw_sp,
1011				struct mlxsw_sp_acl_rule *rule,
1012				u64 *packets, u64 *bytes, u64 *drops,
1013				u64 *last_use,
1014				enum flow_action_hw_stats *used_hw_stats)
1015
1016{
1017	enum mlxsw_sp_policer_type type = MLXSW_SP_POLICER_TYPE_SINGLE_RATE;
1018	struct mlxsw_sp_acl_rule_info *rulei;
1019	u64 current_packets = 0;
1020	u64 current_bytes = 0;
1021	u64 current_drops = 0;
1022	int err;
1023
1024	rulei = mlxsw_sp_acl_rule_rulei(rule);
1025	if (rulei->counter_valid) {
1026		err = mlxsw_sp_flow_counter_get(mlxsw_sp, rulei->counter_index,
1027						false, &current_packets,
1028						&current_bytes);
1029		if (err)
1030			return err;
1031		*used_hw_stats = FLOW_ACTION_HW_STATS_IMMEDIATE;
1032	}
1033	if (rulei->policer_index_valid) {
1034		err = mlxsw_sp_policer_drops_counter_get(mlxsw_sp, type,
1035							 rulei->policer_index,
1036							 &current_drops);
1037		if (err)
1038			return err;
1039	}
1040	*packets = current_packets - rule->last_packets;
1041	*bytes = current_bytes - rule->last_bytes;
1042	*drops = current_drops - rule->last_drops;
1043	*last_use = rule->last_used;
1044
1045	rule->last_bytes = current_bytes;
1046	rule->last_packets = current_packets;
1047	rule->last_drops = current_drops;
1048
1049	return 0;
1050}
1051
1052int mlxsw_sp_acl_init(struct mlxsw_sp *mlxsw_sp)
1053{
1054	struct mlxsw_sp_fid *fid;
1055	struct mlxsw_sp_acl *acl;
1056	size_t alloc_size;
1057	int err;
1058
1059	alloc_size = sizeof(*acl) + mlxsw_sp_acl_tcam_priv_size(mlxsw_sp);
1060	acl = kzalloc(alloc_size, GFP_KERNEL);
1061	if (!acl)
1062		return -ENOMEM;
1063	mlxsw_sp->acl = acl;
1064	acl->mlxsw_sp = mlxsw_sp;
1065	acl->afk = mlxsw_afk_create(MLXSW_CORE_RES_GET(mlxsw_sp->core,
1066						       ACL_FLEX_KEYS),
1067				    mlxsw_sp->afk_ops);
1068	if (!acl->afk) {
1069		err = -ENOMEM;
1070		goto err_afk_create;
1071	}
1072
1073	err = rhashtable_init(&acl->ruleset_ht,
1074			      &mlxsw_sp_acl_ruleset_ht_params);
1075	if (err)
1076		goto err_rhashtable_init;
1077
1078	fid = mlxsw_sp_fid_dummy_get(mlxsw_sp);
1079	if (IS_ERR(fid)) {
1080		err = PTR_ERR(fid);
1081		goto err_fid_get;
1082	}
1083	acl->dummy_fid = fid;
1084
1085	INIT_LIST_HEAD(&acl->rules);
1086	mutex_init(&acl->rules_lock);
1087	err = mlxsw_sp_acl_tcam_init(mlxsw_sp, &acl->tcam);
1088	if (err)
1089		goto err_acl_ops_init;
1090
1091	/* Create the delayed work for the rule activity_update */
1092	INIT_DELAYED_WORK(&acl->rule_activity_update.dw,
1093			  mlxsw_sp_acl_rule_activity_update_work);
1094	acl->rule_activity_update.interval = MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS;
1095	mlxsw_core_schedule_dw(&acl->rule_activity_update.dw, 0);
1096	return 0;
1097
1098err_acl_ops_init:
1099	mutex_destroy(&acl->rules_lock);
1100	mlxsw_sp_fid_put(fid);
1101err_fid_get:
1102	rhashtable_destroy(&acl->ruleset_ht);
1103err_rhashtable_init:
1104	mlxsw_afk_destroy(acl->afk);
1105err_afk_create:
1106	kfree(acl);
1107	return err;
1108}
1109
1110void mlxsw_sp_acl_fini(struct mlxsw_sp *mlxsw_sp)
1111{
1112	struct mlxsw_sp_acl *acl = mlxsw_sp->acl;
1113
1114	cancel_delayed_work_sync(&mlxsw_sp->acl->rule_activity_update.dw);
1115	mlxsw_sp_acl_tcam_fini(mlxsw_sp, &acl->tcam);
1116	mutex_destroy(&acl->rules_lock);
1117	WARN_ON(!list_empty(&acl->rules));
1118	mlxsw_sp_fid_put(acl->dummy_fid);
1119	rhashtable_destroy(&acl->ruleset_ht);
1120	mlxsw_afk_destroy(acl->afk);
1121	kfree(acl);
1122}
1123
1124struct mlxsw_sp_acl_rulei_ops mlxsw_sp1_acl_rulei_ops = {
1125	.act_mangle_field = mlxsw_sp1_acl_rulei_act_mangle_field,
1126};
1127
1128struct mlxsw_sp_acl_rulei_ops mlxsw_sp2_acl_rulei_ops = {
1129	.act_mangle_field = mlxsw_sp2_acl_rulei_act_mangle_field,
1130};