1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0 2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */ 3 4 #include <linux/kernel.h> 5 #include <linux/slab.h> 6 #include <linux/errno.h> 7 #include <linux/list.h> 8 #include <linux/string.h> 9 #include <linux/rhashtable.h> 10 #include <linux/netdevice.h> 11 #include <linux/mutex.h> 12 #include <net/net_namespace.h> 13 #include <net/tc_act/tc_vlan.h> 14 15 #include "reg.h" 16 #include "core.h" 17 #include "resources.h" 18 #include "spectrum.h" 19 #include "core_acl_flex_keys.h" 20 #include "core_acl_flex_actions.h" 21 #include "spectrum_acl_tcam.h" 22 23 struct mlxsw_sp_acl { 24 struct mlxsw_sp *mlxsw_sp; 25 struct mlxsw_afk *afk; 26 struct mlxsw_sp_fid *dummy_fid; 27 struct rhashtable ruleset_ht; 28 struct list_head rules; 29 struct mutex rules_lock; /* Protects rules list */ 30 struct { 31 struct delayed_work dw; 32 unsigned long interval; /* ms */ 33 #define MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS 1000 34 } rule_activity_update; 35 struct mlxsw_sp_acl_tcam tcam; 36 }; 37 38 struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl) 39 { 40 return acl->afk; 41 } 42 43 struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam(struct mlxsw_sp_acl *acl) 44 { 45 return &acl->tcam; 46 } 47 48 struct mlxsw_sp_acl_ruleset_ht_key { 49 struct mlxsw_sp_flow_block *block; 50 u32 chain_index; 51 const struct mlxsw_sp_acl_profile_ops *ops; 52 }; 53 54 struct mlxsw_sp_acl_ruleset { 55 struct rhash_head ht_node; /* Member of acl HT */ 56 struct mlxsw_sp_acl_ruleset_ht_key ht_key; 57 struct rhashtable rule_ht; 58 unsigned int ref_count; 59 unsigned int min_prio; 60 unsigned int max_prio; 61 unsigned long priv[]; 62 /* priv has to be always the last item */ 63 }; 64 65 struct mlxsw_sp_acl_rule { 66 struct rhash_head ht_node; /* Member of rule HT */ 67 struct list_head list; 68 unsigned long cookie; /* HT key */ 69 struct mlxsw_sp_acl_ruleset *ruleset; 70 struct mlxsw_sp_acl_rule_info *rulei; 71 u64 last_used; 72 u64 last_packets; 73 u64 last_bytes; 74 u64 last_drops; 75 unsigned long priv[]; 76 /* priv has to be always the last item */ 77 }; 78 79 static const struct rhashtable_params mlxsw_sp_acl_ruleset_ht_params = { 80 .key_len = sizeof(struct mlxsw_sp_acl_ruleset_ht_key), 81 .key_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_key), 82 .head_offset = offsetof(struct mlxsw_sp_acl_ruleset, ht_node), 83 .automatic_shrinking = true, 84 }; 85 86 static const struct rhashtable_params mlxsw_sp_acl_rule_ht_params = { 87 .key_len = sizeof(unsigned long), 88 .key_offset = offsetof(struct mlxsw_sp_acl_rule, cookie), 89 .head_offset = offsetof(struct mlxsw_sp_acl_rule, ht_node), 90 .automatic_shrinking = true, 91 }; 92 93 struct mlxsw_sp_fid *mlxsw_sp_acl_dummy_fid(struct mlxsw_sp *mlxsw_sp) 94 { 95 return mlxsw_sp->acl->dummy_fid; 96 } 97 98 static bool 99 mlxsw_sp_acl_ruleset_is_singular(const struct mlxsw_sp_acl_ruleset *ruleset) 100 { 101 /* We hold a reference on ruleset ourselves */ 102 return ruleset->ref_count == 2; 103 } 104 105 int mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp, 106 struct mlxsw_sp_flow_block *block, 107 struct mlxsw_sp_flow_block_binding *binding) 108 { 109 struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero; 110 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 111 112 return ops->ruleset_bind(mlxsw_sp, ruleset->priv, 113 binding->mlxsw_sp_port, binding->ingress); 114 } 115 116 void mlxsw_sp_acl_ruleset_unbind(struct mlxsw_sp *mlxsw_sp, 117 struct mlxsw_sp_flow_block *block, 118 struct mlxsw_sp_flow_block_binding *binding) 119 { 120 struct mlxsw_sp_acl_ruleset *ruleset = block->ruleset_zero; 121 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 122 123 ops->ruleset_unbind(mlxsw_sp, ruleset->priv, 124 binding->mlxsw_sp_port, binding->ingress); 125 } 126 127 static int 128 mlxsw_sp_acl_ruleset_block_bind(struct mlxsw_sp *mlxsw_sp, 129 struct mlxsw_sp_acl_ruleset *ruleset, 130 struct mlxsw_sp_flow_block *block) 131 { 132 struct mlxsw_sp_flow_block_binding *binding; 133 int err; 134 135 block->ruleset_zero = ruleset; 136 list_for_each_entry(binding, &block->binding_list, list) { 137 err = mlxsw_sp_acl_ruleset_bind(mlxsw_sp, block, binding); 138 if (err) 139 goto rollback; 140 } 141 return 0; 142 143 rollback: 144 list_for_each_entry_continue_reverse(binding, &block->binding_list, 145 list) 146 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding); 147 block->ruleset_zero = NULL; 148 149 return err; 150 } 151 152 static void 153 mlxsw_sp_acl_ruleset_block_unbind(struct mlxsw_sp *mlxsw_sp, 154 struct mlxsw_sp_acl_ruleset *ruleset, 155 struct mlxsw_sp_flow_block *block) 156 { 157 struct mlxsw_sp_flow_block_binding *binding; 158 159 list_for_each_entry(binding, &block->binding_list, list) 160 mlxsw_sp_acl_ruleset_unbind(mlxsw_sp, block, binding); 161 block->ruleset_zero = NULL; 162 } 163 164 static struct mlxsw_sp_acl_ruleset * 165 mlxsw_sp_acl_ruleset_create(struct mlxsw_sp *mlxsw_sp, 166 struct mlxsw_sp_flow_block *block, u32 chain_index, 167 const struct mlxsw_sp_acl_profile_ops *ops, 168 struct mlxsw_afk_element_usage *tmplt_elusage) 169 { 170 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 171 struct mlxsw_sp_acl_ruleset *ruleset; 172 size_t alloc_size; 173 int err; 174 175 alloc_size = sizeof(*ruleset) + ops->ruleset_priv_size; 176 ruleset = kzalloc(alloc_size, GFP_KERNEL); 177 if (!ruleset) 178 return ERR_PTR(-ENOMEM); 179 ruleset->ref_count = 1; 180 ruleset->ht_key.block = block; 181 ruleset->ht_key.chain_index = chain_index; 182 ruleset->ht_key.ops = ops; 183 184 err = rhashtable_init(&ruleset->rule_ht, &mlxsw_sp_acl_rule_ht_params); 185 if (err) 186 goto err_rhashtable_init; 187 188 err = ops->ruleset_add(mlxsw_sp, &acl->tcam, ruleset->priv, 189 tmplt_elusage, &ruleset->min_prio, 190 &ruleset->max_prio); 191 if (err) 192 goto err_ops_ruleset_add; 193 194 err = rhashtable_insert_fast(&acl->ruleset_ht, &ruleset->ht_node, 195 mlxsw_sp_acl_ruleset_ht_params); 196 if (err) 197 goto err_ht_insert; 198 199 return ruleset; 200 201 err_ht_insert: 202 ops->ruleset_del(mlxsw_sp, ruleset->priv); 203 err_ops_ruleset_add: 204 rhashtable_destroy(&ruleset->rule_ht); 205 err_rhashtable_init: 206 kfree(ruleset); 207 return ERR_PTR(err); 208 } 209 210 static void mlxsw_sp_acl_ruleset_destroy(struct mlxsw_sp *mlxsw_sp, 211 struct mlxsw_sp_acl_ruleset *ruleset) 212 { 213 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 214 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 215 216 rhashtable_remove_fast(&acl->ruleset_ht, &ruleset->ht_node, 217 mlxsw_sp_acl_ruleset_ht_params); 218 ops->ruleset_del(mlxsw_sp, ruleset->priv); 219 rhashtable_destroy(&ruleset->rule_ht); 220 kfree(ruleset); 221 } 222 223 static void mlxsw_sp_acl_ruleset_ref_inc(struct mlxsw_sp_acl_ruleset *ruleset) 224 { 225 ruleset->ref_count++; 226 } 227 228 static void mlxsw_sp_acl_ruleset_ref_dec(struct mlxsw_sp *mlxsw_sp, 229 struct mlxsw_sp_acl_ruleset *ruleset) 230 { 231 if (--ruleset->ref_count) 232 return; 233 mlxsw_sp_acl_ruleset_destroy(mlxsw_sp, ruleset); 234 } 235 236 static struct mlxsw_sp_acl_ruleset * 237 __mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp_acl *acl, 238 struct mlxsw_sp_flow_block *block, u32 chain_index, 239 const struct mlxsw_sp_acl_profile_ops *ops) 240 { 241 struct mlxsw_sp_acl_ruleset_ht_key ht_key; 242 243 memset(&ht_key, 0, sizeof(ht_key)); 244 ht_key.block = block; 245 ht_key.chain_index = chain_index; 246 ht_key.ops = ops; 247 return rhashtable_lookup_fast(&acl->ruleset_ht, &ht_key, 248 mlxsw_sp_acl_ruleset_ht_params); 249 } 250 251 struct mlxsw_sp_acl_ruleset * 252 mlxsw_sp_acl_ruleset_lookup(struct mlxsw_sp *mlxsw_sp, 253 struct mlxsw_sp_flow_block *block, u32 chain_index, 254 enum mlxsw_sp_acl_profile profile) 255 { 256 const struct mlxsw_sp_acl_profile_ops *ops; 257 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 258 struct mlxsw_sp_acl_ruleset *ruleset; 259 260 ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile); 261 if (!ops) 262 return ERR_PTR(-EINVAL); 263 ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops); 264 if (!ruleset) 265 return ERR_PTR(-ENOENT); 266 return ruleset; 267 } 268 269 struct mlxsw_sp_acl_ruleset * 270 mlxsw_sp_acl_ruleset_get(struct mlxsw_sp *mlxsw_sp, 271 struct mlxsw_sp_flow_block *block, u32 chain_index, 272 enum mlxsw_sp_acl_profile profile, 273 struct mlxsw_afk_element_usage *tmplt_elusage) 274 { 275 const struct mlxsw_sp_acl_profile_ops *ops; 276 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 277 struct mlxsw_sp_acl_ruleset *ruleset; 278 279 ops = mlxsw_sp_acl_tcam_profile_ops(mlxsw_sp, profile); 280 if (!ops) 281 return ERR_PTR(-EINVAL); 282 283 ruleset = __mlxsw_sp_acl_ruleset_lookup(acl, block, chain_index, ops); 284 if (ruleset) { 285 mlxsw_sp_acl_ruleset_ref_inc(ruleset); 286 return ruleset; 287 } 288 return mlxsw_sp_acl_ruleset_create(mlxsw_sp, block, chain_index, ops, 289 tmplt_elusage); 290 } 291 292 void mlxsw_sp_acl_ruleset_put(struct mlxsw_sp *mlxsw_sp, 293 struct mlxsw_sp_acl_ruleset *ruleset) 294 { 295 mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset); 296 } 297 298 u16 mlxsw_sp_acl_ruleset_group_id(struct mlxsw_sp_acl_ruleset *ruleset) 299 { 300 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 301 302 return ops->ruleset_group_id(ruleset->priv); 303 } 304 305 void mlxsw_sp_acl_ruleset_prio_get(struct mlxsw_sp_acl_ruleset *ruleset, 306 unsigned int *p_min_prio, 307 unsigned int *p_max_prio) 308 { 309 *p_min_prio = ruleset->min_prio; 310 *p_max_prio = ruleset->max_prio; 311 } 312 313 struct mlxsw_sp_acl_rule_info * 314 mlxsw_sp_acl_rulei_create(struct mlxsw_sp_acl *acl, 315 struct mlxsw_afa_block *afa_block) 316 { 317 struct mlxsw_sp_acl_rule_info *rulei; 318 int err; 319 320 rulei = kzalloc(sizeof(*rulei), GFP_KERNEL); 321 if (!rulei) 322 return ERR_PTR(-ENOMEM); 323 324 if (afa_block) { 325 rulei->act_block = afa_block; 326 return rulei; 327 } 328 329 rulei->act_block = mlxsw_afa_block_create(acl->mlxsw_sp->afa); 330 if (IS_ERR(rulei->act_block)) { 331 err = PTR_ERR(rulei->act_block); 332 goto err_afa_block_create; 333 } 334 rulei->action_created = 1; 335 return rulei; 336 337 err_afa_block_create: 338 kfree(rulei); 339 return ERR_PTR(err); 340 } 341 342 void mlxsw_sp_acl_rulei_destroy(struct mlxsw_sp *mlxsw_sp, 343 struct mlxsw_sp_acl_rule_info *rulei) 344 { 345 if (rulei->action_created) 346 mlxsw_afa_block_destroy(rulei->act_block); 347 if (rulei->src_port_range_reg_valid) 348 mlxsw_sp_port_range_reg_put(mlxsw_sp, 349 rulei->src_port_range_reg_index); 350 if (rulei->dst_port_range_reg_valid) 351 mlxsw_sp_port_range_reg_put(mlxsw_sp, 352 rulei->dst_port_range_reg_index); 353 kfree(rulei); 354 } 355 356 int mlxsw_sp_acl_rulei_commit(struct mlxsw_sp_acl_rule_info *rulei) 357 { 358 return mlxsw_afa_block_commit(rulei->act_block); 359 } 360 361 void mlxsw_sp_acl_rulei_priority(struct mlxsw_sp_acl_rule_info *rulei, 362 unsigned int priority) 363 { 364 rulei->priority = priority; 365 } 366 367 void mlxsw_sp_acl_rulei_keymask_u32(struct mlxsw_sp_acl_rule_info *rulei, 368 enum mlxsw_afk_element element, 369 u32 key_value, u32 mask_value) 370 { 371 mlxsw_afk_values_add_u32(&rulei->values, element, 372 key_value, mask_value); 373 } 374 375 void mlxsw_sp_acl_rulei_keymask_buf(struct mlxsw_sp_acl_rule_info *rulei, 376 enum mlxsw_afk_element element, 377 const char *key_value, 378 const char *mask_value, unsigned int len) 379 { 380 mlxsw_afk_values_add_buf(&rulei->values, element, 381 key_value, mask_value, len); 382 } 383 384 int mlxsw_sp_acl_rulei_act_continue(struct mlxsw_sp_acl_rule_info *rulei) 385 { 386 return mlxsw_afa_block_continue(rulei->act_block); 387 } 388 389 int mlxsw_sp_acl_rulei_act_jump(struct mlxsw_sp_acl_rule_info *rulei, 390 u16 group_id) 391 { 392 return mlxsw_afa_block_jump(rulei->act_block, group_id); 393 } 394 395 int mlxsw_sp_acl_rulei_act_terminate(struct mlxsw_sp_acl_rule_info *rulei) 396 { 397 return mlxsw_afa_block_terminate(rulei->act_block); 398 } 399 400 int mlxsw_sp_acl_rulei_act_drop(struct mlxsw_sp_acl_rule_info *rulei, 401 bool ingress, 402 const struct flow_action_cookie *fa_cookie, 403 struct netlink_ext_ack *extack) 404 { 405 return mlxsw_afa_block_append_drop(rulei->act_block, ingress, 406 fa_cookie, extack); 407 } 408 409 int mlxsw_sp_acl_rulei_act_trap(struct mlxsw_sp_acl_rule_info *rulei) 410 { 411 return mlxsw_afa_block_append_trap(rulei->act_block, 412 MLXSW_TRAP_ID_ACL0); 413 } 414 415 int mlxsw_sp_acl_rulei_act_fwd(struct mlxsw_sp *mlxsw_sp, 416 struct mlxsw_sp_acl_rule_info *rulei, 417 struct net_device *out_dev, 418 struct netlink_ext_ack *extack) 419 { 420 struct mlxsw_sp_port *mlxsw_sp_port; 421 u16 local_port; 422 bool in_port; 423 424 if (out_dev) { 425 if (!mlxsw_sp_port_dev_check(out_dev)) { 426 NL_SET_ERR_MSG_MOD(extack, "Invalid output device"); 427 return -EINVAL; 428 } 429 mlxsw_sp_port = netdev_priv(out_dev); 430 if (mlxsw_sp_port->mlxsw_sp != mlxsw_sp) { 431 NL_SET_ERR_MSG_MOD(extack, "Invalid output device"); 432 return -EINVAL; 433 } 434 local_port = mlxsw_sp_port->local_port; 435 in_port = false; 436 } else { 437 /* If out_dev is NULL, the caller wants to 438 * set forward to ingress port. 439 */ 440 local_port = 0; 441 in_port = true; 442 } 443 return mlxsw_afa_block_append_fwd(rulei->act_block, 444 local_port, in_port, extack); 445 } 446 447 int mlxsw_sp_acl_rulei_act_mirror(struct mlxsw_sp *mlxsw_sp, 448 struct mlxsw_sp_acl_rule_info *rulei, 449 struct mlxsw_sp_flow_block *block, 450 struct net_device *out_dev, 451 struct netlink_ext_ack *extack) 452 { 453 struct mlxsw_sp_flow_block_binding *binding; 454 struct mlxsw_sp_port *in_port; 455 456 if (!list_is_singular(&block->binding_list)) { 457 NL_SET_ERR_MSG_MOD(extack, "Only a single mirror source is allowed"); 458 return -EOPNOTSUPP; 459 } 460 binding = list_first_entry(&block->binding_list, 461 struct mlxsw_sp_flow_block_binding, list); 462 in_port = binding->mlxsw_sp_port; 463 464 return mlxsw_afa_block_append_mirror(rulei->act_block, 465 in_port->local_port, 466 out_dev, 467 binding->ingress, 468 extack); 469 } 470 471 int mlxsw_sp_acl_rulei_act_vlan(struct mlxsw_sp *mlxsw_sp, 472 struct mlxsw_sp_acl_rule_info *rulei, 473 u32 action, u16 vid, u16 proto, u8 prio, 474 struct netlink_ext_ack *extack) 475 { 476 u8 ethertype; 477 478 if (action == FLOW_ACTION_VLAN_MANGLE) { 479 switch (proto) { 480 case ETH_P_8021Q: 481 ethertype = 0; 482 break; 483 case ETH_P_8021AD: 484 ethertype = 1; 485 break; 486 default: 487 NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN protocol"); 488 dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN protocol %#04x\n", 489 proto); 490 return -EINVAL; 491 } 492 493 return mlxsw_afa_block_append_vlan_modify(rulei->act_block, 494 vid, prio, ethertype, 495 extack); 496 } else { 497 NL_SET_ERR_MSG_MOD(extack, "Unsupported VLAN action"); 498 dev_err(mlxsw_sp->bus_info->dev, "Unsupported VLAN action\n"); 499 return -EINVAL; 500 } 501 } 502 503 int mlxsw_sp_acl_rulei_act_priority(struct mlxsw_sp *mlxsw_sp, 504 struct mlxsw_sp_acl_rule_info *rulei, 505 u32 prio, struct netlink_ext_ack *extack) 506 { 507 /* Even though both Linux and Spectrum switches support 16 priorities, 508 * spectrum_qdisc only processes the first eight priomap elements, and 509 * the DCB and PFC features are tied to 8 priorities as well. Therefore 510 * bounce attempts to prioritize packets to higher priorities. 511 */ 512 if (prio >= IEEE_8021QAZ_MAX_TCS) { 513 NL_SET_ERR_MSG_MOD(extack, "Only priorities 0..7 are supported"); 514 return -EINVAL; 515 } 516 return mlxsw_afa_block_append_qos_switch_prio(rulei->act_block, prio, 517 extack); 518 } 519 520 struct mlxsw_sp_acl_mangle_action { 521 enum flow_action_mangle_base htype; 522 /* Offset is u32-aligned. */ 523 u32 offset; 524 /* Mask bits are unset for the modified field. */ 525 u32 mask; 526 /* Shift required to extract the set value. */ 527 u32 shift; 528 enum mlxsw_sp_acl_mangle_field field; 529 }; 530 531 #define MLXSW_SP_ACL_MANGLE_ACTION(_htype, _offset, _mask, _shift, _field) \ 532 { \ 533 .htype = _htype, \ 534 .offset = _offset, \ 535 .mask = _mask, \ 536 .shift = _shift, \ 537 .field = MLXSW_SP_ACL_MANGLE_FIELD_##_field, \ 538 } 539 540 #define MLXSW_SP_ACL_MANGLE_ACTION_IP4(_offset, _mask, _shift, _field) \ 541 MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_IP4, \ 542 _offset, _mask, _shift, _field) 543 544 #define MLXSW_SP_ACL_MANGLE_ACTION_IP6(_offset, _mask, _shift, _field) \ 545 MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_IP6, \ 546 _offset, _mask, _shift, _field) 547 548 #define MLXSW_SP_ACL_MANGLE_ACTION_TCP(_offset, _mask, _shift, _field) \ 549 MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_TCP, _offset, _mask, _shift, _field) 550 551 #define MLXSW_SP_ACL_MANGLE_ACTION_UDP(_offset, _mask, _shift, _field) \ 552 MLXSW_SP_ACL_MANGLE_ACTION(FLOW_ACT_MANGLE_HDR_TYPE_UDP, _offset, _mask, _shift, _field) 553 554 static struct mlxsw_sp_acl_mangle_action mlxsw_sp_acl_mangle_actions[] = { 555 MLXSW_SP_ACL_MANGLE_ACTION_IP4(0, 0xff00ffff, 16, IP_DSFIELD), 556 MLXSW_SP_ACL_MANGLE_ACTION_IP4(0, 0xff03ffff, 18, IP_DSCP), 557 MLXSW_SP_ACL_MANGLE_ACTION_IP4(0, 0xfffcffff, 16, IP_ECN), 558 559 MLXSW_SP_ACL_MANGLE_ACTION_IP6(0, 0xf00fffff, 20, IP_DSFIELD), 560 MLXSW_SP_ACL_MANGLE_ACTION_IP6(0, 0xf03fffff, 22, IP_DSCP), 561 MLXSW_SP_ACL_MANGLE_ACTION_IP6(0, 0xffcfffff, 20, IP_ECN), 562 563 MLXSW_SP_ACL_MANGLE_ACTION_TCP(0, 0x0000ffff, 16, IP_SPORT), 564 MLXSW_SP_ACL_MANGLE_ACTION_TCP(0, 0xffff0000, 0, IP_DPORT), 565 566 MLXSW_SP_ACL_MANGLE_ACTION_UDP(0, 0x0000ffff, 16, IP_SPORT), 567 MLXSW_SP_ACL_MANGLE_ACTION_UDP(0, 0xffff0000, 0, IP_DPORT), 568 569 MLXSW_SP_ACL_MANGLE_ACTION_IP4(12, 0x00000000, 0, IP4_SIP), 570 MLXSW_SP_ACL_MANGLE_ACTION_IP4(16, 0x00000000, 0, IP4_DIP), 571 572 MLXSW_SP_ACL_MANGLE_ACTION_IP6(8, 0x00000000, 0, IP6_SIP_1), 573 MLXSW_SP_ACL_MANGLE_ACTION_IP6(12, 0x00000000, 0, IP6_SIP_2), 574 MLXSW_SP_ACL_MANGLE_ACTION_IP6(16, 0x00000000, 0, IP6_SIP_3), 575 MLXSW_SP_ACL_MANGLE_ACTION_IP6(20, 0x00000000, 0, IP6_SIP_4), 576 MLXSW_SP_ACL_MANGLE_ACTION_IP6(24, 0x00000000, 0, IP6_DIP_1), 577 MLXSW_SP_ACL_MANGLE_ACTION_IP6(28, 0x00000000, 0, IP6_DIP_2), 578 MLXSW_SP_ACL_MANGLE_ACTION_IP6(32, 0x00000000, 0, IP6_DIP_3), 579 MLXSW_SP_ACL_MANGLE_ACTION_IP6(36, 0x00000000, 0, IP6_DIP_4), 580 }; 581 582 static int 583 mlxsw_sp_acl_rulei_act_mangle_field(struct mlxsw_sp *mlxsw_sp, 584 struct mlxsw_sp_acl_rule_info *rulei, 585 struct mlxsw_sp_acl_mangle_action *mact, 586 u32 val, struct netlink_ext_ack *extack) 587 { 588 switch (mact->field) { 589 case MLXSW_SP_ACL_MANGLE_FIELD_IP_DSFIELD: 590 return mlxsw_afa_block_append_qos_dsfield(rulei->act_block, 591 val, extack); 592 case MLXSW_SP_ACL_MANGLE_FIELD_IP_DSCP: 593 return mlxsw_afa_block_append_qos_dscp(rulei->act_block, 594 val, extack); 595 case MLXSW_SP_ACL_MANGLE_FIELD_IP_ECN: 596 return mlxsw_afa_block_append_qos_ecn(rulei->act_block, 597 val, extack); 598 default: 599 return -EOPNOTSUPP; 600 } 601 } 602 603 static int mlxsw_sp1_acl_rulei_act_mangle_field(struct mlxsw_sp *mlxsw_sp, 604 struct mlxsw_sp_acl_rule_info *rulei, 605 struct mlxsw_sp_acl_mangle_action *mact, 606 u32 val, struct netlink_ext_ack *extack) 607 { 608 int err; 609 610 err = mlxsw_sp_acl_rulei_act_mangle_field(mlxsw_sp, rulei, mact, val, extack); 611 if (err != -EOPNOTSUPP) 612 return err; 613 614 NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field"); 615 return err; 616 } 617 618 static int 619 mlxsw_sp2_acl_rulei_act_mangle_field_ip_odd(struct mlxsw_sp_acl_rule_info *rulei, 620 enum mlxsw_sp_acl_mangle_field field, 621 u32 val, struct netlink_ext_ack *extack) 622 { 623 if (!rulei->ipv6_valid) { 624 rulei->ipv6.prev_val = val; 625 rulei->ipv6_valid = true; 626 rulei->ipv6.prev_field = field; 627 return 0; 628 } 629 630 NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field order"); 631 return -EOPNOTSUPP; 632 } 633 634 static int mlxsw_sp2_acl_rulei_act_mangle_field(struct mlxsw_sp *mlxsw_sp, 635 struct mlxsw_sp_acl_rule_info *rulei, 636 struct mlxsw_sp_acl_mangle_action *mact, 637 u32 val, struct netlink_ext_ack *extack) 638 { 639 int err; 640 641 err = mlxsw_sp_acl_rulei_act_mangle_field(mlxsw_sp, rulei, mact, val, extack); 642 if (err != -EOPNOTSUPP) 643 return err; 644 645 switch (mact->field) { 646 case MLXSW_SP_ACL_MANGLE_FIELD_IP_SPORT: 647 return mlxsw_afa_block_append_l4port(rulei->act_block, false, val, extack); 648 case MLXSW_SP_ACL_MANGLE_FIELD_IP_DPORT: 649 return mlxsw_afa_block_append_l4port(rulei->act_block, true, val, extack); 650 /* IPv4 fields */ 651 case MLXSW_SP_ACL_MANGLE_FIELD_IP4_SIP: 652 return mlxsw_afa_block_append_ip(rulei->act_block, false, 653 true, val, 0, extack); 654 case MLXSW_SP_ACL_MANGLE_FIELD_IP4_DIP: 655 return mlxsw_afa_block_append_ip(rulei->act_block, true, 656 true, val, 0, extack); 657 /* IPv6 fields */ 658 case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_1: 659 case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_3: 660 case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_1: 661 case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_3: 662 return mlxsw_sp2_acl_rulei_act_mangle_field_ip_odd(rulei, 663 mact->field, 664 val, extack); 665 case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_2: 666 if (rulei->ipv6_valid && 667 rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_1) { 668 rulei->ipv6_valid = false; 669 return mlxsw_afa_block_append_ip(rulei->act_block, 670 false, false, val, 671 rulei->ipv6.prev_val, 672 extack); 673 } 674 break; 675 case MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_4: 676 if (rulei->ipv6_valid && 677 rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_SIP_3) { 678 rulei->ipv6_valid = false; 679 return mlxsw_afa_block_append_ip(rulei->act_block, 680 false, true, val, 681 rulei->ipv6.prev_val, 682 extack); 683 } 684 break; 685 case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_2: 686 if (rulei->ipv6_valid && 687 rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_1) { 688 rulei->ipv6_valid = false; 689 return mlxsw_afa_block_append_ip(rulei->act_block, 690 true, false, val, 691 rulei->ipv6.prev_val, 692 extack); 693 } 694 break; 695 case MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_4: 696 if (rulei->ipv6_valid && 697 rulei->ipv6.prev_field == MLXSW_SP_ACL_MANGLE_FIELD_IP6_DIP_3) { 698 rulei->ipv6_valid = false; 699 return mlxsw_afa_block_append_ip(rulei->act_block, 700 true, true, val, 701 rulei->ipv6.prev_val, 702 extack); 703 } 704 break; 705 default: 706 break; 707 } 708 709 NL_SET_ERR_MSG_MOD(extack, "Unsupported mangle field"); 710 return err; 711 } 712 713 int mlxsw_sp_acl_rulei_act_mangle(struct mlxsw_sp *mlxsw_sp, 714 struct mlxsw_sp_acl_rule_info *rulei, 715 enum flow_action_mangle_base htype, 716 u32 offset, u32 mask, u32 val, 717 struct netlink_ext_ack *extack) 718 { 719 const struct mlxsw_sp_acl_rulei_ops *acl_rulei_ops = mlxsw_sp->acl_rulei_ops; 720 struct mlxsw_sp_acl_mangle_action *mact; 721 size_t i; 722 723 for (i = 0; i < ARRAY_SIZE(mlxsw_sp_acl_mangle_actions); ++i) { 724 mact = &mlxsw_sp_acl_mangle_actions[i]; 725 if (mact->htype == htype && 726 mact->offset == offset && 727 mact->mask == mask) { 728 val >>= mact->shift; 729 return acl_rulei_ops->act_mangle_field(mlxsw_sp, 730 rulei, mact, 731 val, extack); 732 } 733 } 734 735 NL_SET_ERR_MSG_MOD(extack, "Unknown mangle field"); 736 return -EINVAL; 737 } 738 739 int mlxsw_sp_acl_rulei_act_police(struct mlxsw_sp *mlxsw_sp, 740 struct mlxsw_sp_acl_rule_info *rulei, 741 u32 index, u64 rate_bytes_ps, 742 u32 burst, struct netlink_ext_ack *extack) 743 { 744 int err; 745 746 err = mlxsw_afa_block_append_police(rulei->act_block, index, 747 rate_bytes_ps, burst, 748 &rulei->policer_index, extack); 749 if (err) 750 return err; 751 752 rulei->policer_index_valid = true; 753 754 return 0; 755 } 756 757 int mlxsw_sp_acl_rulei_act_count(struct mlxsw_sp *mlxsw_sp, 758 struct mlxsw_sp_acl_rule_info *rulei, 759 struct netlink_ext_ack *extack) 760 { 761 int err; 762 763 err = mlxsw_afa_block_append_counter(rulei->act_block, 764 &rulei->counter_index, extack); 765 if (err) 766 return err; 767 rulei->counter_valid = true; 768 return 0; 769 } 770 771 int mlxsw_sp_acl_rulei_act_fid_set(struct mlxsw_sp *mlxsw_sp, 772 struct mlxsw_sp_acl_rule_info *rulei, 773 u16 fid, struct netlink_ext_ack *extack) 774 { 775 return mlxsw_afa_block_append_fid_set(rulei->act_block, fid, extack); 776 } 777 778 int mlxsw_sp_acl_rulei_act_ignore(struct mlxsw_sp *mlxsw_sp, 779 struct mlxsw_sp_acl_rule_info *rulei, 780 bool disable_learning, bool disable_security) 781 { 782 return mlxsw_afa_block_append_ignore(rulei->act_block, 783 disable_learning, 784 disable_security); 785 } 786 787 int mlxsw_sp_acl_rulei_act_sample(struct mlxsw_sp *mlxsw_sp, 788 struct mlxsw_sp_acl_rule_info *rulei, 789 struct mlxsw_sp_flow_block *block, 790 struct psample_group *psample_group, u32 rate, 791 u32 trunc_size, bool truncate, 792 struct netlink_ext_ack *extack) 793 { 794 struct mlxsw_sp_flow_block_binding *binding; 795 struct mlxsw_sp_port *mlxsw_sp_port; 796 797 if (!list_is_singular(&block->binding_list)) { 798 NL_SET_ERR_MSG_MOD(extack, "Only a single sampling source is allowed"); 799 return -EOPNOTSUPP; 800 } 801 binding = list_first_entry(&block->binding_list, 802 struct mlxsw_sp_flow_block_binding, list); 803 mlxsw_sp_port = binding->mlxsw_sp_port; 804 805 return mlxsw_afa_block_append_sampler(rulei->act_block, 806 mlxsw_sp_port->local_port, 807 psample_group, rate, trunc_size, 808 truncate, binding->ingress, 809 extack); 810 } 811 812 struct mlxsw_sp_acl_rule * 813 mlxsw_sp_acl_rule_create(struct mlxsw_sp *mlxsw_sp, 814 struct mlxsw_sp_acl_ruleset *ruleset, 815 unsigned long cookie, 816 struct mlxsw_afa_block *afa_block, 817 struct netlink_ext_ack *extack) 818 { 819 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 820 struct mlxsw_sp_acl_rule *rule; 821 int err; 822 823 mlxsw_sp_acl_ruleset_ref_inc(ruleset); 824 rule = kzalloc(sizeof(*rule) + ops->rule_priv_size, 825 GFP_KERNEL); 826 if (!rule) { 827 err = -ENOMEM; 828 goto err_alloc; 829 } 830 rule->cookie = cookie; 831 rule->ruleset = ruleset; 832 833 rule->rulei = mlxsw_sp_acl_rulei_create(mlxsw_sp->acl, afa_block); 834 if (IS_ERR(rule->rulei)) { 835 err = PTR_ERR(rule->rulei); 836 goto err_rulei_create; 837 } 838 839 return rule; 840 841 err_rulei_create: 842 kfree(rule); 843 err_alloc: 844 mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset); 845 return ERR_PTR(err); 846 } 847 848 void mlxsw_sp_acl_rule_destroy(struct mlxsw_sp *mlxsw_sp, 849 struct mlxsw_sp_acl_rule *rule) 850 { 851 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 852 853 mlxsw_sp_acl_rulei_destroy(mlxsw_sp, rule->rulei); 854 kfree(rule); 855 mlxsw_sp_acl_ruleset_ref_dec(mlxsw_sp, ruleset); 856 } 857 858 int mlxsw_sp_acl_rule_add(struct mlxsw_sp *mlxsw_sp, 859 struct mlxsw_sp_acl_rule *rule) 860 { 861 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 862 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 863 struct mlxsw_sp_flow_block *block = ruleset->ht_key.block; 864 int err; 865 866 err = ops->rule_add(mlxsw_sp, ruleset->priv, rule->priv, rule->rulei); 867 if (err) 868 return err; 869 870 err = rhashtable_insert_fast(&ruleset->rule_ht, &rule->ht_node, 871 mlxsw_sp_acl_rule_ht_params); 872 if (err) 873 goto err_rhashtable_insert; 874 875 if (!ruleset->ht_key.chain_index && 876 mlxsw_sp_acl_ruleset_is_singular(ruleset)) { 877 /* We only need ruleset with chain index 0, the implicit 878 * one, to be directly bound to device. The rest of the 879 * rulesets are bound by "Goto action set". 880 */ 881 err = mlxsw_sp_acl_ruleset_block_bind(mlxsw_sp, ruleset, block); 882 if (err) 883 goto err_ruleset_block_bind; 884 } 885 886 mutex_lock(&mlxsw_sp->acl->rules_lock); 887 list_add_tail(&rule->list, &mlxsw_sp->acl->rules); 888 mutex_unlock(&mlxsw_sp->acl->rules_lock); 889 block->rule_count++; 890 block->ingress_blocker_rule_count += rule->rulei->ingress_bind_blocker; 891 block->egress_blocker_rule_count += rule->rulei->egress_bind_blocker; 892 return 0; 893 894 err_ruleset_block_bind: 895 rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node, 896 mlxsw_sp_acl_rule_ht_params); 897 err_rhashtable_insert: 898 ops->rule_del(mlxsw_sp, rule->priv); 899 return err; 900 } 901 902 void mlxsw_sp_acl_rule_del(struct mlxsw_sp *mlxsw_sp, 903 struct mlxsw_sp_acl_rule *rule) 904 { 905 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 906 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 907 struct mlxsw_sp_flow_block *block = ruleset->ht_key.block; 908 909 block->egress_blocker_rule_count -= rule->rulei->egress_bind_blocker; 910 block->ingress_blocker_rule_count -= rule->rulei->ingress_bind_blocker; 911 block->rule_count--; 912 mutex_lock(&mlxsw_sp->acl->rules_lock); 913 list_del(&rule->list); 914 mutex_unlock(&mlxsw_sp->acl->rules_lock); 915 if (!ruleset->ht_key.chain_index && 916 mlxsw_sp_acl_ruleset_is_singular(ruleset)) 917 mlxsw_sp_acl_ruleset_block_unbind(mlxsw_sp, ruleset, block); 918 rhashtable_remove_fast(&ruleset->rule_ht, &rule->ht_node, 919 mlxsw_sp_acl_rule_ht_params); 920 ops->rule_del(mlxsw_sp, rule->priv); 921 } 922 923 int mlxsw_sp_acl_rule_action_replace(struct mlxsw_sp *mlxsw_sp, 924 struct mlxsw_sp_acl_rule *rule, 925 struct mlxsw_afa_block *afa_block) 926 { 927 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 928 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 929 struct mlxsw_sp_acl_rule_info *rulei; 930 931 rulei = mlxsw_sp_acl_rule_rulei(rule); 932 rulei->act_block = afa_block; 933 934 return ops->rule_action_replace(mlxsw_sp, rule->priv, rule->rulei); 935 } 936 937 struct mlxsw_sp_acl_rule * 938 mlxsw_sp_acl_rule_lookup(struct mlxsw_sp *mlxsw_sp, 939 struct mlxsw_sp_acl_ruleset *ruleset, 940 unsigned long cookie) 941 { 942 return rhashtable_lookup_fast(&ruleset->rule_ht, &cookie, 943 mlxsw_sp_acl_rule_ht_params); 944 } 945 946 struct mlxsw_sp_acl_rule_info * 947 mlxsw_sp_acl_rule_rulei(struct mlxsw_sp_acl_rule *rule) 948 { 949 return rule->rulei; 950 } 951 952 static int mlxsw_sp_acl_rule_activity_update(struct mlxsw_sp *mlxsw_sp, 953 struct mlxsw_sp_acl_rule *rule) 954 { 955 struct mlxsw_sp_acl_ruleset *ruleset = rule->ruleset; 956 const struct mlxsw_sp_acl_profile_ops *ops = ruleset->ht_key.ops; 957 bool active; 958 int err; 959 960 err = ops->rule_activity_get(mlxsw_sp, rule->priv, &active); 961 if (err) 962 return err; 963 if (active) 964 rule->last_used = jiffies; 965 return 0; 966 } 967 968 static int mlxsw_sp_acl_rules_activity_update(struct mlxsw_sp_acl *acl) 969 { 970 struct mlxsw_sp_acl_rule *rule; 971 int err; 972 973 mutex_lock(&acl->rules_lock); 974 list_for_each_entry(rule, &acl->rules, list) { 975 err = mlxsw_sp_acl_rule_activity_update(acl->mlxsw_sp, 976 rule); 977 if (err) 978 goto err_rule_update; 979 } 980 mutex_unlock(&acl->rules_lock); 981 return 0; 982 983 err_rule_update: 984 mutex_unlock(&acl->rules_lock); 985 return err; 986 } 987 988 static void mlxsw_sp_acl_rule_activity_work_schedule(struct mlxsw_sp_acl *acl) 989 { 990 unsigned long interval = acl->rule_activity_update.interval; 991 992 mlxsw_core_schedule_dw(&acl->rule_activity_update.dw, 993 msecs_to_jiffies(interval)); 994 } 995 996 static void mlxsw_sp_acl_rule_activity_update_work(struct work_struct *work) 997 { 998 struct mlxsw_sp_acl *acl = container_of(work, struct mlxsw_sp_acl, 999 rule_activity_update.dw.work); 1000 int err; 1001 1002 err = mlxsw_sp_acl_rules_activity_update(acl); 1003 if (err) 1004 dev_err(acl->mlxsw_sp->bus_info->dev, "Could not update acl activity"); 1005 1006 mlxsw_sp_acl_rule_activity_work_schedule(acl); 1007 } 1008 1009 int mlxsw_sp_acl_rule_get_stats(struct mlxsw_sp *mlxsw_sp, 1010 struct mlxsw_sp_acl_rule *rule, 1011 u64 *packets, u64 *bytes, u64 *drops, 1012 u64 *last_use, 1013 enum flow_action_hw_stats *used_hw_stats) 1014 1015 { 1016 enum mlxsw_sp_policer_type type = MLXSW_SP_POLICER_TYPE_SINGLE_RATE; 1017 struct mlxsw_sp_acl_rule_info *rulei; 1018 u64 current_packets = 0; 1019 u64 current_bytes = 0; 1020 u64 current_drops = 0; 1021 int err; 1022 1023 rulei = mlxsw_sp_acl_rule_rulei(rule); 1024 if (rulei->counter_valid) { 1025 err = mlxsw_sp_flow_counter_get(mlxsw_sp, rulei->counter_index, 1026 ¤t_packets, 1027 ¤t_bytes); 1028 if (err) 1029 return err; 1030 *used_hw_stats = FLOW_ACTION_HW_STATS_IMMEDIATE; 1031 } 1032 if (rulei->policer_index_valid) { 1033 err = mlxsw_sp_policer_drops_counter_get(mlxsw_sp, type, 1034 rulei->policer_index, 1035 ¤t_drops); 1036 if (err) 1037 return err; 1038 } 1039 *packets = current_packets - rule->last_packets; 1040 *bytes = current_bytes - rule->last_bytes; 1041 *drops = current_drops - rule->last_drops; 1042 *last_use = rule->last_used; 1043 1044 rule->last_bytes = current_bytes; 1045 rule->last_packets = current_packets; 1046 rule->last_drops = current_drops; 1047 1048 return 0; 1049 } 1050 1051 int mlxsw_sp_acl_init(struct mlxsw_sp *mlxsw_sp) 1052 { 1053 struct mlxsw_sp_fid *fid; 1054 struct mlxsw_sp_acl *acl; 1055 size_t alloc_size; 1056 int err; 1057 1058 alloc_size = sizeof(*acl) + mlxsw_sp_acl_tcam_priv_size(mlxsw_sp); 1059 acl = kzalloc(alloc_size, GFP_KERNEL); 1060 if (!acl) 1061 return -ENOMEM; 1062 mlxsw_sp->acl = acl; 1063 acl->mlxsw_sp = mlxsw_sp; 1064 acl->afk = mlxsw_afk_create(MLXSW_CORE_RES_GET(mlxsw_sp->core, 1065 ACL_FLEX_KEYS), 1066 mlxsw_sp->afk_ops); 1067 if (!acl->afk) { 1068 err = -ENOMEM; 1069 goto err_afk_create; 1070 } 1071 1072 err = rhashtable_init(&acl->ruleset_ht, 1073 &mlxsw_sp_acl_ruleset_ht_params); 1074 if (err) 1075 goto err_rhashtable_init; 1076 1077 fid = mlxsw_sp_fid_dummy_get(mlxsw_sp); 1078 if (IS_ERR(fid)) { 1079 err = PTR_ERR(fid); 1080 goto err_fid_get; 1081 } 1082 acl->dummy_fid = fid; 1083 1084 INIT_LIST_HEAD(&acl->rules); 1085 mutex_init(&acl->rules_lock); 1086 err = mlxsw_sp_acl_tcam_init(mlxsw_sp, &acl->tcam); 1087 if (err) 1088 goto err_acl_ops_init; 1089 1090 /* Create the delayed work for the rule activity_update */ 1091 INIT_DELAYED_WORK(&acl->rule_activity_update.dw, 1092 mlxsw_sp_acl_rule_activity_update_work); 1093 acl->rule_activity_update.interval = MLXSW_SP_ACL_RULE_ACTIVITY_UPDATE_PERIOD_MS; 1094 mlxsw_core_schedule_dw(&acl->rule_activity_update.dw, 0); 1095 return 0; 1096 1097 err_acl_ops_init: 1098 mutex_destroy(&acl->rules_lock); 1099 mlxsw_sp_fid_put(fid); 1100 err_fid_get: 1101 rhashtable_destroy(&acl->ruleset_ht); 1102 err_rhashtable_init: 1103 mlxsw_afk_destroy(acl->afk); 1104 err_afk_create: 1105 kfree(acl); 1106 return err; 1107 } 1108 1109 void mlxsw_sp_acl_fini(struct mlxsw_sp *mlxsw_sp) 1110 { 1111 struct mlxsw_sp_acl *acl = mlxsw_sp->acl; 1112 1113 cancel_delayed_work_sync(&mlxsw_sp->acl->rule_activity_update.dw); 1114 mlxsw_sp_acl_tcam_fini(mlxsw_sp, &acl->tcam); 1115 mutex_destroy(&acl->rules_lock); 1116 WARN_ON(!list_empty(&acl->rules)); 1117 mlxsw_sp_fid_put(acl->dummy_fid); 1118 rhashtable_destroy(&acl->ruleset_ht); 1119 mlxsw_afk_destroy(acl->afk); 1120 kfree(acl); 1121 } 1122 1123 struct mlxsw_sp_acl_rulei_ops mlxsw_sp1_acl_rulei_ops = { 1124 .act_mangle_field = mlxsw_sp1_acl_rulei_act_mangle_field, 1125 }; 1126 1127 struct mlxsw_sp_acl_rulei_ops mlxsw_sp2_acl_rulei_ops = { 1128 .act_mangle_field = mlxsw_sp2_acl_rulei_act_mangle_field, 1129 }; 1130