drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c

   1 // SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
   2 /* Copyright (c) 2017-2018 Mellanox Technologies. All rights reserved */
   3
   4 #include <linux/kernel.h>
   5 #include <linux/errno.h>
   6 #include <linux/netdevice.h>
   7 #include <net/net_namespace.h>
   8 #include <net/flow_dissector.h>
   9 #include <net/pkt_cls.h>
  10 #include <net/tc_act/tc_gact.h>
  11 #include <net/tc_act/tc_mirred.h>
  12 #include <net/tc_act/tc_vlan.h>
  13
  14 #include "spectrum.h"
  15 #include "core_acl_flex_keys.h"
  16
  17 static int mlxsw_sp_flower_parse_actions(struct mlxsw_sp *mlxsw_sp,
  18                                          struct mlxsw_sp_acl_block *block,
  19                                          struct mlxsw_sp_acl_rule_info *rulei,
  20                                          struct flow_action *flow_action,
  21                                          struct netlink_ext_ack *extack)
  22 {
  23         const struct flow_action_entry *act;
  24         int mirror_act_count = 0;
  25         int err, i;
  26
  27         if (!flow_action_has_entries(flow_action))
  28                 return 0;
  29
  30         /* Count action is inserted first */
  31         err = mlxsw_sp_acl_rulei_act_count(mlxsw_sp, rulei, extack);
  32         if (err)
  33                 return err;
  34
  35         flow_action_for_each(i, act, flow_action) {
  36                 switch (act->id) {
  37                 case FLOW_ACTION_ACCEPT:
  38                         err = mlxsw_sp_acl_rulei_act_terminate(rulei);
  39                         if (err) {
  40                                 NL_SET_ERR_MSG_MOD(extack, "Cannot append terminate action");
  41                                 return err;
  42                         }
  43                         break;
  44                 case FLOW_ACTION_DROP:
  45                         err = mlxsw_sp_acl_rulei_act_drop(rulei);
  46                         if (err) {
  47                                 NL_SET_ERR_MSG_MOD(extack, "Cannot append drop action");
  48                                 return err;
  49                         }
  50                         break;
  51                 case FLOW_ACTION_TRAP:
  52                         err = mlxsw_sp_acl_rulei_act_trap(rulei);
  53                         if (err) {
  54                                 NL_SET_ERR_MSG_MOD(extack, "Cannot append trap action");
  55                                 return err;
  56                         }
  57                         break;
  58                 case FLOW_ACTION_GOTO: {
  59                         u32 chain_index = act->chain_index;
  60                         struct mlxsw_sp_acl_ruleset *ruleset;
  61                         u16 group_id;
  62
  63                         ruleset = mlxsw_sp_acl_ruleset_lookup(mlxsw_sp, block,
  64                                                               chain_index,
  65                                                               MLXSW_SP_ACL_PROFILE_FLOWER);
  66                         if (IS_ERR(ruleset))
  67                                 return PTR_ERR(ruleset);
  68
  69                         group_id = mlxsw_sp_acl_ruleset_group_id(ruleset);
  70                         err = mlxsw_sp_acl_rulei_act_jump(rulei, group_id);
  71                         if (err) {
  72                                 NL_SET_ERR_MSG_MOD(extack, "Cannot append jump action");
  73                                 return err;
  74                         }
  75                         }
  76                         break;
  77                 case FLOW_ACTION_REDIRECT: {
  78                         struct net_device *out_dev;
  79                         struct mlxsw_sp_fid *fid;
  80                         u16 fid_index;
  81
  82                         fid = mlxsw_sp_acl_dummy_fid(mlxsw_sp);
  83                         fid_index = mlxsw_sp_fid_index(fid);
  84                         err = mlxsw_sp_acl_rulei_act_fid_set(mlxsw_sp, rulei,
  85                                                              fid_index, extack);
  86                         if (err)
  87                                 return err;
  88
  89                         out_dev = act->dev;
  90                         err = mlxsw_sp_acl_rulei_act_fwd(mlxsw_sp, rulei,
  91                                                          out_dev, extack);
  92                         if (err)
  93                                 return err;
  94                         }
  95                         break;
  96                 case FLOW_ACTION_MIRRED: {
  97                         struct net_device *out_dev = act->dev;
  98
  99                         if (mirror_act_count++) {
 100                                 NL_SET_ERR_MSG_MOD(extack, "Multiple mirror actions per rule are not supported");
 101                                 return -EOPNOTSUPP;
 102                         }
 103
 104                         err = mlxsw_sp_acl_rulei_act_mirror(mlxsw_sp, rulei,
 105                                                             block, out_dev,
 106                                                             extack);
 107                         if (err)
 108                                 return err;
 109                         }
 110                         break;
 111                 case FLOW_ACTION_VLAN_MANGLE: {
 112                         u16 proto = be16_to_cpu(act->vlan.proto);
 113                         u8 prio = act->vlan.prio;
 114                         u16 vid = act->vlan.vid;
 115
 116                         return mlxsw_sp_acl_rulei_act_vlan(mlxsw_sp, rulei,
 117                                                            act->id, vid,
 118                                                            proto, prio, extack);
 119                         }
 120                 default:
 121                         NL_SET_ERR_MSG_MOD(extack, "Unsupported action");
 122                         dev_err(mlxsw_sp->bus_info->dev, "Unsupported action\n");
 123                         return -EOPNOTSUPP;
 124                 }
 125         }
 126         return 0;
 127 }
 128
 129 static int mlxsw_sp_flower_parse_meta(struct mlxsw_sp_acl_rule_info *rulei,
 130                                       struct flow_cls_offload *f,
 131                                       struct mlxsw_sp_acl_block *block)
 132 {
 133         struct flow_rule *rule = flow_cls_offload_flow_rule(f);
 134         struct mlxsw_sp_port *mlxsw_sp_port;
 135         struct net_device *ingress_dev;
 136         struct flow_match_meta match;
 137
 138         if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META))
 139                 return 0;
 140
 141         flow_rule_match_meta(rule, &match);
 142         if (match.mask->ingress_ifindex != 0xFFFFFFFF) {
 143                 NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported ingress ifindex mask");
 144                 return -EINVAL;
 145         }
 146
 147         ingress_dev = __dev_get_by_index(block->net,
 148                                          match.key->ingress_ifindex);
 149         if (!ingress_dev) {
 150                 NL_SET_ERR_MSG_MOD(f->common.extack, "Can't find specified ingress port to match on");
 151                 return -EINVAL;
 152         }
 153
 154         if (!mlxsw_sp_port_dev_check(ingress_dev)) {
 155                 NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on non-mlxsw ingress port");
 156                 return -EINVAL;
 157         }
 158
 159         mlxsw_sp_port = netdev_priv(ingress_dev);
 160         if (mlxsw_sp_port->mlxsw_sp != block->mlxsw_sp) {
 161                 NL_SET_ERR_MSG_MOD(f->common.extack, "Can't match on a port from different device");
 162                 return -EINVAL;
 163         }
 164
 165         mlxsw_sp_acl_rulei_keymask_u32(rulei,
 166                                        MLXSW_AFK_ELEMENT_SRC_SYS_PORT,
 167                                        mlxsw_sp_port->local_port,
 168                                        0xFFFFFFFF);
 169         return 0;
 170 }
 171
 172 static void mlxsw_sp_flower_parse_ipv4(struct mlxsw_sp_acl_rule_info *rulei,
 173                                        struct flow_cls_offload *f)
 174 {
 175         struct flow_match_ipv4_addrs match;
 176
 177         flow_rule_match_ipv4_addrs(f->rule, &match);
 178
 179         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31,
 180                                        (char *) &match.key->src,
 181                                        (char *) &match.mask->src, 4);
 182         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31,
 183                                        (char *) &match.key->dst,
 184                                        (char *) &match.mask->dst, 4);
 185 }
 186
 187 static void mlxsw_sp_flower_parse_ipv6(struct mlxsw_sp_acl_rule_info *rulei,
 188                                        struct flow_cls_offload *f)
 189 {
 190         struct flow_match_ipv6_addrs match;
 191
 192         flow_rule_match_ipv6_addrs(f->rule, &match);
 193
 194         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_96_127,
 195                                        &match.key->src.s6_addr[0x0],
 196                                        &match.mask->src.s6_addr[0x0], 4);
 197         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_64_95,
 198                                        &match.key->src.s6_addr[0x4],
 199                                        &match.mask->src.s6_addr[0x4], 4);
 200         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_32_63,
 201                                        &match.key->src.s6_addr[0x8],
 202                                        &match.mask->src.s6_addr[0x8], 4);
 203         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_SRC_IP_0_31,
 204                                        &match.key->src.s6_addr[0xC],
 205                                        &match.mask->src.s6_addr[0xC], 4);
 206         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_96_127,
 207                                        &match.key->dst.s6_addr[0x0],
 208                                        &match.mask->dst.s6_addr[0x0], 4);
 209         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_64_95,
 210                                        &match.key->dst.s6_addr[0x4],
 211                                        &match.mask->dst.s6_addr[0x4], 4);
 212         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_32_63,
 213                                        &match.key->dst.s6_addr[0x8],
 214                                        &match.mask->dst.s6_addr[0x8], 4);
 215         mlxsw_sp_acl_rulei_keymask_buf(rulei, MLXSW_AFK_ELEMENT_DST_IP_0_31,
 216                                        &match.key->dst.s6_addr[0xC],
 217                                        &match.mask->dst.s6_addr[0xC], 4);
 218 }
 219
 220 static int mlxsw_sp_flower_parse_ports(struct mlxsw_sp *mlxsw_sp,
 221                                        struct mlxsw_sp_acl_rule_info *rulei,
 222                                        struct flow_cls_offload *f,
 223                                        u8 ip_proto)
 224 {
 225         const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
 226         struct flow_match_ports match;
 227
 228         if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS))
 229                 return 0;
 230
 231         if (ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
 232                 NL_SET_ERR_MSG_MOD(f->common.extack, "Only UDP and TCP keys are supported");
 233                 dev_err(mlxsw_sp->bus_info->dev, "Only UDP and TCP keys are supported\n");
 234                 return -EINVAL;
 235         }
 236
 237         flow_rule_match_ports(rule, &match);
 238         mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_DST_L4_PORT,
 239                                        ntohs(match.key->dst),
 240                                        ntohs(match.mask->dst));
 241         mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_SRC_L4_PORT,
 242                                        ntohs(match.key->src),
 243                                        ntohs(match.mask->src));
 244         return 0;
 245 }
 246
 247 static int mlxsw_sp_flower_parse_tcp(struct mlxsw_sp *mlxsw_sp,
 248                                      struct mlxsw_sp_acl_rule_info *rulei,
 249                                      struct flow_cls_offload *f,
 250                                      u8 ip_proto)
 251 {
 252         const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
 253         struct flow_match_tcp match;
 254
 255         if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_TCP))
 256                 return 0;
 257
 258         if (ip_proto != IPPROTO_TCP) {
 259                 NL_SET_ERR_MSG_MOD(f->common.extack, "TCP keys supported only for TCP");
 260                 dev_err(mlxsw_sp->bus_info->dev, "TCP keys supported only for TCP\n");
 261                 return -EINVAL;
 262         }
 263
 264         flow_rule_match_tcp(rule, &match);
 265
 266         mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_TCP_FLAGS,
 267                                        ntohs(match.key->flags),
 268                                        ntohs(match.mask->flags));
 269         return 0;
 270 }
 271
 272 static int mlxsw_sp_flower_parse_ip(struct mlxsw_sp *mlxsw_sp,
 273                                     struct mlxsw_sp_acl_rule_info *rulei,
 274                                     struct flow_cls_offload *f,
 275                                     u16 n_proto)
 276 {
 277         const struct flow_rule *rule = flow_cls_offload_flow_rule(f);
 278         struct flow_match_ip match;
 279
 280         if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_IP))
 281                 return 0;
 282
 283         if (n_proto != ETH_P_IP && n_proto != ETH_P_IPV6) {
 284                 NL_SET_ERR_MSG_MOD(f->common.extack, "IP keys supported only for IPv4/6");
 285                 dev_err(mlxsw_sp->bus_info->dev, "IP keys supported only for IPv4/6\n");
 286                 return -EINVAL;
 287         }
 288
 289         flow_rule_match_ip(rule, &match);
 290
 291         mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_TTL_,
 292                                        match.key->ttl, match.mask->ttl);
 293
 294         mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_ECN,
 295                                        match.key->tos & 0x3,
 296                                        match.mask->tos & 0x3);
 297
 298         mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_DSCP,
 299                                        match.key->tos >> 2,
 300                                        match.mask->tos >> 2);
 301
 302         return 0;
 303 }
 304
 305 static int mlxsw_sp_flower_parse(struct mlxsw_sp *mlxsw_sp,
 306                                  struct mlxsw_sp_acl_block *block,
 307                                  struct mlxsw_sp_acl_rule_info *rulei,
 308                                  struct flow_cls_offload *f)
 309 {
 310         struct flow_rule *rule = flow_cls_offload_flow_rule(f);
 311         struct flow_dissector *dissector = rule->match.dissector;
 312         u16 n_proto_mask = 0;
 313         u16 n_proto_key = 0;
 314         u16 addr_type = 0;
 315         u8 ip_proto = 0;
 316         int err;
 317
 318         if (dissector->used_keys &
 319             ~(BIT(FLOW_DISSECTOR_KEY_META) |
 320               BIT(FLOW_DISSECTOR_KEY_CONTROL) |
 321               BIT(FLOW_DISSECTOR_KEY_BASIC) |
 322               BIT(FLOW_DISSECTOR_KEY_ETH_ADDRS) |
 323               BIT(FLOW_DISSECTOR_KEY_IPV4_ADDRS) |
 324               BIT(FLOW_DISSECTOR_KEY_IPV6_ADDRS) |
 325               BIT(FLOW_DISSECTOR_KEY_PORTS) |
 326               BIT(FLOW_DISSECTOR_KEY_TCP) |
 327               BIT(FLOW_DISSECTOR_KEY_IP) |
 328               BIT(FLOW_DISSECTOR_KEY_VLAN))) {
 329                 dev_err(mlxsw_sp->bus_info->dev, "Unsupported key\n");
 330                 NL_SET_ERR_MSG_MOD(f->common.extack, "Unsupported key");
 331                 return -EOPNOTSUPP;
 332         }
 333
 334         mlxsw_sp_acl_rulei_priority(rulei, f->common.prio);
 335
 336         err = mlxsw_sp_flower_parse_meta(rulei, f, block);
 337         if (err)
 338                 return err;
 339
 340         if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CONTROL)) {
 341                 struct flow_match_control match;
 342
 343                 flow_rule_match_control(rule, &match);
 344                 addr_type = match.key->addr_type;
 345         }
 346
 347         if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) {
 348                 struct flow_match_basic match;
 349
 350                 flow_rule_match_basic(rule, &match);
 351                 n_proto_key = ntohs(match.key->n_proto);
 352                 n_proto_mask = ntohs(match.mask->n_proto);
 353
 354                 if (n_proto_key == ETH_P_ALL) {
 355                         n_proto_key = 0;
 356                         n_proto_mask = 0;
 357                 }
 358                 mlxsw_sp_acl_rulei_keymask_u32(rulei,
 359                                                MLXSW_AFK_ELEMENT_ETHERTYPE,
 360                                                n_proto_key, n_proto_mask);
 361
 362                 ip_proto = match.key->ip_proto;
 363                 mlxsw_sp_acl_rulei_keymask_u32(rulei,
 364                                                MLXSW_AFK_ELEMENT_IP_PROTO,
 365                                                match.key->ip_proto,
 366                                                match.mask->ip_proto);
 367         }
 368
 369         if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
 370                 struct flow_match_eth_addrs match;
 371
 372                 flow_rule_match_eth_addrs(rule, &match);
 373                 mlxsw_sp_acl_rulei_keymask_buf(rulei,
 374                                                MLXSW_AFK_ELEMENT_DMAC_32_47,
 375                                                match.key->dst,
 376                                                match.mask->dst, 2);
 377                 mlxsw_sp_acl_rulei_keymask_buf(rulei,
 378                                                MLXSW_AFK_ELEMENT_DMAC_0_31,
 379                                                match.key->dst + 2,
 380                                                match.mask->dst + 2, 4);
 381                 mlxsw_sp_acl_rulei_keymask_buf(rulei,
 382                                                MLXSW_AFK_ELEMENT_SMAC_32_47,
 383                                                match.key->src,
 384                                                match.mask->src, 2);
 385                 mlxsw_sp_acl_rulei_keymask_buf(rulei,
 386                                                MLXSW_AFK_ELEMENT_SMAC_0_31,
 387                                                match.key->src + 2,
 388                                                match.mask->src + 2, 4);
 389         }
 390
 391         if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_VLAN)) {
 392                 struct flow_match_vlan match;
 393
 394                 flow_rule_match_vlan(rule, &match);
 395                 if (mlxsw_sp_acl_block_is_egress_bound(block)) {
 396                         NL_SET_ERR_MSG_MOD(f->common.extack, "vlan_id key is not supported on egress");
 397                         return -EOPNOTSUPP;
 398                 }
 399                 if (match.mask->vlan_id != 0)
 400                         mlxsw_sp_acl_rulei_keymask_u32(rulei,
 401                                                        MLXSW_AFK_ELEMENT_VID,
 402                                                        match.key->vlan_id,
 403                                                        match.mask->vlan_id);
 404                 if (match.mask->vlan_priority != 0)
 405                         mlxsw_sp_acl_rulei_keymask_u32(rulei,
 406                                                        MLXSW_AFK_ELEMENT_PCP,
 407                                                        match.key->vlan_priority,
 408                                                        match.mask->vlan_priority);
 409         }
 410
 411         if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS)
 412                 mlxsw_sp_flower_parse_ipv4(rulei, f);
 413
 414         if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS)
 415                 mlxsw_sp_flower_parse_ipv6(rulei, f);
 416
 417         err = mlxsw_sp_flower_parse_ports(mlxsw_sp, rulei, f, ip_proto);
 418         if (err)
 419                 return err;
 420         err = mlxsw_sp_flower_parse_tcp(mlxsw_sp, rulei, f, ip_proto);
 421         if (err)
 422                 return err;
 423
 424         err = mlxsw_sp_flower_parse_ip(mlxsw_sp, rulei, f, n_proto_key & n_proto_mask);
 425         if (err)
 426                 return err;
 427
 428         return mlxsw_sp_flower_parse_actions(mlxsw_sp, block, rulei,
 429                                              &f->rule->action,
 430                                              f->common.extack);
 431 }
 432
 433 int mlxsw_sp_flower_replace(struct mlxsw_sp *mlxsw_sp,
 434                             struct mlxsw_sp_acl_block *block,
 435                             struct flow_cls_offload *f)
 436 {
 437         struct mlxsw_sp_acl_rule_info *rulei;
 438         struct mlxsw_sp_acl_ruleset *ruleset;
 439         struct mlxsw_sp_acl_rule *rule;
 440         int err;
 441
 442         ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
 443                                            f->common.chain_index,
 444                                            MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
 445         if (IS_ERR(ruleset))
 446                 return PTR_ERR(ruleset);
 447
 448         rule = mlxsw_sp_acl_rule_create(mlxsw_sp, ruleset, f->cookie, NULL,
 449                                         f->common.extack);
 450         if (IS_ERR(rule)) {
 451                 err = PTR_ERR(rule);
 452                 goto err_rule_create;
 453         }
 454
 455         rulei = mlxsw_sp_acl_rule_rulei(rule);
 456         err = mlxsw_sp_flower_parse(mlxsw_sp, block, rulei, f);
 457         if (err)
 458                 goto err_flower_parse;
 459
 460         err = mlxsw_sp_acl_rulei_commit(rulei);
 461         if (err)
 462                 goto err_rulei_commit;
 463
 464         err = mlxsw_sp_acl_rule_add(mlxsw_sp, rule);
 465         if (err)
 466                 goto err_rule_add;
 467
 468         mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
 469         return 0;
 470
 471 err_rule_add:
 472 err_rulei_commit:
 473 err_flower_parse:
 474         mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
 475 err_rule_create:
 476         mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
 477         return err;
 478 }
 479
 480 void mlxsw_sp_flower_destroy(struct mlxsw_sp *mlxsw_sp,
 481                              struct mlxsw_sp_acl_block *block,
 482                              struct flow_cls_offload *f)
 483 {
 484         struct mlxsw_sp_acl_ruleset *ruleset;
 485         struct mlxsw_sp_acl_rule *rule;
 486
 487         ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
 488                                            f->common.chain_index,
 489                                            MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
 490         if (IS_ERR(ruleset))
 491                 return;
 492
 493         rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
 494         if (rule) {
 495                 mlxsw_sp_acl_rule_del(mlxsw_sp, rule);
 496                 mlxsw_sp_acl_rule_destroy(mlxsw_sp, rule);
 497         }
 498
 499         mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
 500 }
 501
 502 int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp,
 503                           struct mlxsw_sp_acl_block *block,
 504                           struct flow_cls_offload *f)
 505 {
 506         struct mlxsw_sp_acl_ruleset *ruleset;
 507         struct mlxsw_sp_acl_rule *rule;
 508         u64 packets;
 509         u64 lastuse;
 510         u64 bytes;
 511         int err;
 512
 513         ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
 514                                            f->common.chain_index,
 515                                            MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
 516         if (WARN_ON(IS_ERR(ruleset)))
 517                 return -EINVAL;
 518
 519         rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
 520         if (!rule)
 521                 return -EINVAL;
 522
 523         err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes,
 524                                           &lastuse);
 525         if (err)
 526                 goto err_rule_get_stats;
 527
 528         flow_stats_update(&f->stats, bytes, packets, lastuse);
 529
 530         mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
 531         return 0;
 532
 533 err_rule_get_stats:
 534         mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
 535         return err;
 536 }
 537
 538 int mlxsw_sp_flower_tmplt_create(struct mlxsw_sp *mlxsw_sp,
 539                                  struct mlxsw_sp_acl_block *block,
 540                                  struct flow_cls_offload *f)
 541 {
 542         struct mlxsw_sp_acl_ruleset *ruleset;
 543         struct mlxsw_sp_acl_rule_info rulei;
 544         int err;
 545
 546         memset(&rulei, 0, sizeof(rulei));
 547         err = mlxsw_sp_flower_parse(mlxsw_sp, block, &rulei, f);
 548         if (err)
 549                 return err;
 550         ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
 551                                            f->common.chain_index,
 552                                            MLXSW_SP_ACL_PROFILE_FLOWER,
 553                                            &rulei.values.elusage);
 554
 555         /* keep the reference to the ruleset */
 556         return PTR_ERR_OR_ZERO(ruleset);
 557 }
 558
 559 void mlxsw_sp_flower_tmplt_destroy(struct mlxsw_sp *mlxsw_sp,
 560                                    struct mlxsw_sp_acl_block *block,
 561                                    struct flow_cls_offload *f)
 562 {
 563         struct mlxsw_sp_acl_ruleset *ruleset;
 564
 565         ruleset = mlxsw_sp_acl_ruleset_get(mlxsw_sp, block,
 566                                            f->common.chain_index,
 567                                            MLXSW_SP_ACL_PROFILE_FLOWER, NULL);
 568         if (IS_ERR(ruleset))
 569                 return;
 570         /* put the reference to the ruleset kept in create */
 571         mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
 572         mlxsw_sp_acl_ruleset_put(mlxsw_sp, ruleset);
 573 }