1 // SPDX-License-Identifier: GPL-2.0
6  * There are multiple groups of registers involved in ACL configuration:
8  * - Matching Rules: These registers define the criteria for matching incoming
13  * - Action Rules: These registers define how the ACL should modify the packet's
18  * - Processing Rules: These registers control the overall behavior of the ACL,
23  *                             +----------------------+
24  * +----------------------+    |    (optional)        |
27  * +----------------------+    +----------------------+
31  *               +----------------------+
35  *               +----------------------+
38  *               +----------------------+
43  *               +----------------------+
117  * ksz9477_dump_acl_index - Print the ACL entry at the specified index
121  * @index: The index of the ACL entry to print.
123  * This function prints the details of an ACL entry, located at a particular
127  * Return: 1 if the entry is non-empty and printed, 0 otherwise.
149 	dev_err(dev->dev, " Entry %02d, prio: %02d : %s", index,  in ksz9477_dump_acl_index()
156  * ksz9477_dump_acl - Print ACL entries
170 	if (count != KSZ9477_ACL_MAX_ENTRIES - 1)  in ksz9477_dump_acl()
171 		dev_err(dev->dev, " Empty ACL entries were skipped\n");  in ksz9477_dump_acl()
175  * ksz9477_acl_is_valid_matching_rule - Check if an ACL entry contains a valid
206  * ksz9477_acl_get_cont_entr - Get count of contiguous ACL entries and validate
210  * @index: Index of the starting ACL entry.
223  * linked Matching rules are contiguous in terms of their indices. It calculates
224  * and returns the number of these contiguous entries.
227  *    - 0 if the entry is empty and can be safely overwritten
228  *    - 1 if the entry represents a simple rule
229  *    - The number of contiguous entries if it is the root entry of a complex
231  *    - -ENOTEMPTY if the entry is part of a complex rule but not the root
233  *    - -EINVAL if the validation fails
238 	struct ksz9477_acl_priv *acl = dev->ports[port].acl_priv;  in ksz9477_acl_get_cont_entr()
239 	struct ksz9477_acl_entries *acles = &acl->acles;  in ksz9477_acl_get_cont_entr()
246 	entry = &acles->entries[index].entry[0];  in ksz9477_acl_get_cont_entr()
259 …dev_dbg(dev->dev, "ACL: entry %d starting with a valid matching rule, but no bits set in RuleSet\n…  in ksz9477_acl_get_cont_entr()
261 			return -ENOTEMPTY;  in ksz9477_acl_get_cont_entr()
272 	contiguous_count = end_idx - start_idx + 1;  in ksz9477_acl_get_cont_entr()
274 	/* Check if the number of bits set in val matches our calculated count */  in ksz9477_acl_get_cont_entr()
279 		dev_err(dev->dev, "ACL: number of bits set in RuleSet does not match calculated count\n");  in ksz9477_acl_get_cont_entr()
280 		return -EINVAL;  in ksz9477_acl_get_cont_entr()
285 		u8 *current_entry = &acles->entries[i].entry[0];  in ksz9477_acl_get_cont_entr()
291 			dev_err(dev->dev, "ACL: entry %d does not contain a valid matching rule\n",  in ksz9477_acl_get_cont_entr()
293 			return -EINVAL;  in ksz9477_acl_get_cont_entr()
301 				dev_err(dev->dev, "ACL: entry %d has non-empty RuleSet linkage\n",  in ksz9477_acl_get_cont_entr()
303 				return -EINVAL;  in ksz9477_acl_get_cont_entr()
312  * ksz9477_acl_update_linkage - Update the RuleSet linkage for an ACL entry
317  * @old_idx: The original index of the ACL entry before moving.
318  * @new_idx: The new index of the ACL entry after moving.
322  * linkage is represented by two 8-bit registers, which are combined
323  * into a 16-bit value for easier manipulation. The linkage bits are shifted
328  * be moved as complete blocks, maintaining the integrity of the RuleSet.
330  * Returns: 0 on success, or -EINVAL if any RuleSet linkage bits are lost
350 	 * RuleSet is filled only for the first entry of the set.  in ksz9477_acl_update_linkage()
356 		dev_err(dev->dev, "ACL: entry %d has unexpected ActionRule linkage: %d\n",  in ksz9477_acl_update_linkage()
358 		return -EINVAL;  in ksz9477_acl_update_linkage()
363 	/* Calculate the number of positions to shift */  in ksz9477_acl_update_linkage()
364 	shift = new_idx - old_idx;  in ksz9477_acl_update_linkage()
370 		rule_linkage >>= -shift;  in ksz9477_acl_update_linkage()
374 		dev_err(dev->dev, "ACL RuleSet linkage bits lost during move\n");  in ksz9477_acl_update_linkage()
375 		return -EINVAL;  in ksz9477_acl_update_linkage()
388  * ksz9477_validate_and_get_src_count - Validate source and destination indices
392  * @src_idx: Index of the starting ACL entry that needs to be validated.
393  * @dst_idx: Index of the destination where the source entries are intended to
395  * @src_count: Pointer to the variable that will hold the number of contiguous
397  * @dst_count: Pointer to the variable that will hold the number of contiguous
404  * and that the destination index isn't in the middle of a RuleSet. If all
405  * validations pass, the function returns the number of contiguous source and
419 		dev_err(dev->dev, "ACL: invalid entry index\n");  in ksz9477_validate_and_get_src_count()
420 		return -EINVAL;  in ksz9477_validate_and_get_src_count()
430 		dev_err(dev->dev, "ACL: source entry is empty\n");  in ksz9477_validate_and_get_src_count()
431 		return -EINVAL;  in ksz9477_validate_and_get_src_count()
435 		dev_err(dev->dev, "ACL: Not enough space at the destination. Move operation will fail.\n");  in ksz9477_validate_and_get_src_count()
436 		return -EINVAL;  in ksz9477_validate_and_get_src_count()
439 	/* Validate if the destination entry is empty or not in the middle of  in ksz9477_validate_and_get_src_count()
451  * ksz9477_move_entries_downwards - Move a range of ACL entries downwards in
455  * @start_idx: Starting index of the entries to be relocated.
456  * @num_entries_to_move: Number of consecutive entries to be relocated.
460  * This function is responsible for rearranging a specific block of ACL entries
465  * Return: 0 on successful relocation of entries, otherwise returns a negative
478 		e = &acles->entries[i];  in ksz9477_move_entries_downwards()
479 		*e = acles->entries[i + num_entries_to_move];  in ksz9477_move_entries_downwards()
481 		ret = ksz9477_acl_update_linkage(dev, &e->entry[0],  in ksz9477_move_entries_downwards()
491  * ksz9477_move_entries_upwards - Move a range of ACL entries upwards in the
495  * @start_idx: The starting index of the entries to be moved.
496  * @num_entries_to_move: Number of contiguous entries to be moved.
500  * This function rearranges a chunk of ACL entries by moving them upwards
515 	for (i = start_idx; i > target_idx; i--) {  in ksz9477_move_entries_upwards()
516 		b = i + num_entries_to_move - 1;  in ksz9477_move_entries_upwards()
518 		e = &acles->entries[b];  in ksz9477_move_entries_upwards()
519 		*e = acles->entries[i - 1];  in ksz9477_move_entries_upwards()
521 		ret = ksz9477_acl_update_linkage(dev, &e->entry[0], i - 1, b);  in ksz9477_move_entries_upwards()
530  * ksz9477_acl_move_entries - Move a block of contiguous ACL entries from a
534  * @src_idx: Index of the starting source ACL entry.
535  * @dst_idx: Index of the starting destination ACL entry.
537  * This function aims to move a block of contiguous ACL entries from the source
538  * index to the destination index while ensuring the integrity and validity of
541  * In case of any errors during the adjustments or copying, the function will
544  * Return: 0 if the move operation is successful. Returns -EINVAL for validation
551 	struct ksz9477_acl_priv *acl = dev->ports[port].acl_priv;  in ksz9477_acl_move_entries()
552 	struct ksz9477_acl_entries *acles = &acl->acles;  in ksz9477_acl_move_entries()
566 	 * downwards and the size of the entry located at dst_idx.  in ksz9477_acl_move_entries()
569 		dst_idx = dst_idx + dst_count - src_count;  in ksz9477_acl_move_entries()
573 		buffer[i] = acles->entries[src_idx + i];  in ksz9477_acl_move_entries()
593 		acles->entries[dst_idx + i] = buffer[i];  in ksz9477_acl_move_entries()
599  * ksz9477_get_next_block_start - Identify the starting index of the next ACL
606  * 'start' index and returns the beginning index of that block. If the block is
607  * invalid or if it reaches the end of the ACL entries without finding another
611  *  - The starting index of the next valid ACL block.
612  *  - KSZ9477_ACL_MAX_ENTRIES if no other valid blocks are found after 'start'.
613  *  - A negative error code if an error occurs while checking.
622 		if (block_size < 0 && block_size != -ENOTEMPTY)  in ksz9477_get_next_block_start()
634  * ksz9477_swap_acl_blocks - Swap two ACL blocks
637  * @i: The starting index of the first ACL block.
638  * @j: The starting index of the second ACL block.
641  * main purpose is to aid in the sorting and reordering of ACL blocks based on
642  * certain criteria, e.g., priority. It checks the validity of the block at
647  *  - 0 on successful swapping of blocks.
648  *  - -EINVAL if the block at index 'i' is empty.
649  *  - A negative error code if any other error occurs during the swap.
661 		dev_err(dev->dev, "ACL: swapping empty entry %d\n", i);  in ksz9477_swap_acl_blocks()
662 		return -EINVAL;  in ksz9477_swap_acl_blocks()
669 	ret = ksz9477_acl_move_entries(dev, port, j - current_block_size, i);  in ksz9477_swap_acl_blocks()
677  * ksz9477_sort_acl_entr_no_back - Sort ACL entries for a given port based on
682  * This function sorts ACL entries of the specified port using a variant of the
683  * bubble sort algorithm. It operates on blocks of ACL entries rather than
689  * This is done in order to maintain an organized order of ACL entries based on
693  *  - 0 on successful sorting of entries.
694  *  - A negative error code if any issue arises during sorting, e.g.,
699 	struct ksz9477_acl_priv *acl = dev->ports[port].acl_priv;  in ksz9477_sort_acl_entr_no_back()
700 	struct ksz9477_acl_entries *acles = &acl->acles;  in ksz9477_sort_acl_entr_no_back()
706 		curr = &acles->entries[i];  in ksz9477_sort_acl_entr_no_back()
713 			next = &acles->entries[j];  in ksz9477_sort_acl_entr_no_back()
715 			if (curr->prio > next->prio) {  in ksz9477_sort_acl_entr_no_back()
735  * ksz9477_sort_acl_entries - Sort the ACL entries for a given port.
740  * port. Before sorting, a backup of the original entries is created. If the
750 	struct ksz9477_acl_priv *acl = dev->ports[port].acl_priv;  in ksz9477_sort_acl_entries()
751 	struct ksz9477_acl_entries *acles = &acl->acles;  in ksz9477_sort_acl_entries()
754 	/* create a backup of the ACL entries, if something goes wrong  in ksz9477_sort_acl_entries()
757 	memcpy(backup, acles->entries, sizeof(backup));  in ksz9477_sort_acl_entries()
761 		dev_err(dev->dev, "ACL: failed to sort entries for port %d\n",  in ksz9477_sort_acl_entries()
763 		dev_err(dev->dev, "ACL dump before sorting:\n");  in ksz9477_sort_acl_entries()
765 		dev_err(dev->dev, "ACL dump after sorting:\n");  in ksz9477_sort_acl_entries()
766 		ksz9477_dump_acl(dev, acles->entries);  in ksz9477_sort_acl_entries()
768 		memcpy(acles->entries, backup, sizeof(backup));  in ksz9477_sort_acl_entries()
775  * ksz9477_acl_wait_ready - Waits for the ACL operation to complete on a given
792 	reg = dev->dev_ops->get_port_addr(port, KSZ9477_PORT_ACL_CTRL_0);  in ksz9477_acl_wait_ready()
794 	ret = regmap_read_poll_timeout(dev->regmap[0], reg, val,  in ksz9477_acl_wait_ready()
797 		dev_err(dev->dev, "Failed to read/write ACL table\n");  in ksz9477_acl_wait_ready()
803  * ksz9477_acl_entry_write - Writes an ACL entry to a given port at the
825 			dev_err(dev->dev, "Failed to write ACL entry %d\n", i);  in ksz9477_acl_entry_write()
841  * ksz9477_acl_port_enable - Enables ACL functionality on a given port.
849  * 0xn801 - KSZ9477S 5.2.8.2 Port Priority Control Register
850  *        Bit 7 - Highest Priority
851  *        Bit 6 - OR'ed Priority
852  *        Bit 4 - MAC Address Priority Classification
853  *        Bit 3 - VLAN Priority Classification
854  *        Bit 2 - 802.1p Priority Classification
855  *        Bit 1 - Diffserv Priority Classification
856  *        Bit 0 - ACL Priority Classification
858  * Current driver implementation sets 802.1p priority classification by default.
862  * 0xn803 - KSZ9477S 5.2.8.4 Port Authentication Control Register
863  *        Bit 2 - Access Control List (ACL) Enable
864  *        Bits 1:0 - Authentication Mode
897  * ksz9477_acl_port_disable - Disables ACL functionality on a given port.
902  * value of 0 to the REG_PORT_MRI_AUTHEN_CTRL control register and remove
920  * ksz9477_acl_write_list - Write a list of ACL entries to a given port.
925  * of ACL entries to the port, and disables ACL functionality if there are no
933 	struct ksz9477_acl_priv *acl = dev->ports[port].acl_priv;  in ksz9477_acl_write_list()
934 	struct ksz9477_acl_entries *acles = &acl->acles;  in ksz9477_acl_write_list()
943 	for (i = 0; i < ARRAY_SIZE(acles->entries); i++) {  in ksz9477_acl_write_list()
944 		u8 *entry = acles->entries[i].entry;  in ksz9477_acl_write_list()
947 		 * If last fields of the entry are not zero, it means  in ksz9477_acl_write_list()
951 		if (i >= acles->entries_count &&  in ksz9477_acl_write_list()
963 		if (i >= acles->entries_count &&  in ksz9477_acl_write_list()
971 	if (!acles->entries_count)  in ksz9477_acl_write_list()
978  * ksz9477_acl_remove_entries - Remove ACL entries with a given cookie from a
993 	int entries_count = acles->entries_count;  in ksz9477_acl_remove_entries()
995 	int src_idx = -1;  in ksz9477_acl_remove_entries()
1002 		if (acles->entries[i].cookie == cookie) {  in ksz9477_acl_remove_entries()
1009 	if (src_idx == -1)  in ksz9477_acl_remove_entries()
1012 	/* Get the size of the cookie entry. We may have complex entries. */  in ksz9477_acl_remove_entries()
1020 					     entries_count - src_count);  in ksz9477_acl_remove_entries()
1022 		dev_err(dev->dev, "Failed to move ACL entries down\n");  in ksz9477_acl_remove_entries()
1026 	/* Overwrite new empty places at the end of the list with zeros to make  in ksz9477_acl_remove_entries()
1030 	for (i = entries_count - src_count; i < entries_count; i++) {  in ksz9477_acl_remove_entries()
1031 		struct ksz9477_acl_entry *entry = &acles->entries[i];  in ksz9477_acl_remove_entries()
1036 		entry->entry[KSZ9477_ACL_PORT_ACCESS_10] = 0xff;  in ksz9477_acl_remove_entries()
1037 		entry->entry[KSZ9477_ACL_PORT_ACCESS_11] = 0xff;  in ksz9477_acl_remove_entries()
1041 	acles->entries_count -= src_count;  in ksz9477_acl_remove_entries()
1045  * ksz9477_port_acl_init - Initialize the ACL for a specified port on a ksz
1065 		return -ENOMEM;  in ksz9477_port_acl_init()
1067 	dev->ports[port].acl_priv = acl;  in ksz9477_port_acl_init()
1069 	acles = &acl->acles;  in ksz9477_port_acl_init()
1071 	for (i = 0; i < ARRAY_SIZE(acles->entries); i++) {  in ksz9477_port_acl_init()
1072 		u8 *entry = acles->entries[i].entry;  in ksz9477_port_acl_init()
1088 	kfree(dev->ports[port].acl_priv);  in ksz9477_port_acl_init()
1089 	dev->ports[port].acl_priv = NULL;  in ksz9477_port_acl_init()
1095  * ksz9477_port_acl_free - Free the ACL resources for a specified port on a ksz
1104 	if (!dev->ports[port].acl_priv)  in ksz9477_port_acl_free()
1109 	kfree(dev->ports[port].acl_priv);  in ksz9477_port_acl_free()
1110 	dev->ports[port].acl_priv = NULL;  in ksz9477_port_acl_free()
1114  * ksz9477_acl_set_reg - Set entry[16] and entry[17] depending on the updated
1117  * @reg: The register of the entry that needs to be updated
1121  * value. It also sets entry[0x10] and entry[0x11] according to the ACL byte
1124  * 0x10 - Byte Enable [15:8]
1126  * Each bit enables accessing one of the ACL bytes when a read or write is
1134  * 0x11 - Byte Enable [7:0]
1136  * Each bit enables accessing one of the ACL bytes when a read or write is
1150 				BIT(KSZ9477_ACL_PORT_ACCESS_7 - reg);  in ksz9477_acl_set_reg()
1154 			BIT(KSZ9477_ACL_PORT_ACCESS_F - reg);  in ksz9477_acl_set_reg()
1164  * ksz9477_acl_matching_rule_cfg_l2 - Configure an ACL filtering entry to match
1165  *				      L2 types of Ethernet frames
1173  * entry to match Layer 2 types of Ethernet frames based on the provided
1175  * or destination MAC address depending on the value of the is_src parameter.
1180  * 0x01 - Mode and Enable
1181  *        Bits 5:4 - MD (Mode)
1183  *        Bits 3:2 - ENB (Enable)
1187  *        Bit  1   - S/D (Source / Destination)
1190  *        Bit  0   - EQ (Equal / Not Equal)
1194  * 0x02-0x07 - MAC Address
1195  *        0x02 - MAC Address [47:40]
1196  *        0x03 - MAC Address [39:32]
1197  *        0x04 - MAC Address [31:24]
1198  *        0x05 - MAC Address [23:16]
1199  *        0x06 - MAC Address [15:8]
1200  *        0x07 - MAC Address [7:0]
1202  * 0x08-0x09 - EtherType
1203  *        0x08 - EtherType [15:8]
1204  *        0x09 - EtherType [7:0]
1237  * ksz9477_acl_action_rule_cfg - Set action for an ACL entry
1242  * This function sets the action for the specified ACL entry. It prepares
1247  * ACL Action Rule Parameters for Non-Count Modes (MD ≠ 01 or ENB ≠ 00)
1249  * 0x0A - PM, P, RPE, RP[2:1]
1250  *        Bits 7:6 - PM[1:0] - Priority Mode
1258  *        Bits 5:3 - P[2:0] - Priority value
1259  *        Bit  2   - RPE - Remark Priority Enable
1260  *        Bits 1:0 - RP[2:1] - Remarked Priority value (bits 2:1)
1265  * 0x0B - RP[0], MM
1266  *        Bit  7   - RP[0] - Remarked Priority value (bit 0)
1267  *        Bits 6:5 - MM[1:0] - Map Mode
1275  * 0x0D - FORWARD[n:0]
1276  *       Bits 7:0 - FORWARD[n:0] - Forwarding map. Bit 0 = port 1,
1300  * ksz9477_acl_processing_rule_set_action - Set the action for the processing
1303  * @action_idx: Index of the action to be applied
1305  * This function sets the action for the processing rule set by updating the
1311  * 0x00 - First Rule Number (FRN)
1312  *        Bits 3:0 - First Rule Number. Pointer to an Action rule entry.
1320  * ksz9477_acl_processing_rule_add_match - Add a matching rule to the rule set
1322  * @match_idx: Index of the matching rule to be added
1329  * 0x0E - RuleSet [15:8]
1330  *        Bits 7:0 - RuleSet [15:8] Specifies a set of one or more Matching rule
1331  *        entries. RuleSet has one bit for each of the 16 Matching rule entries.
1337  * 0x0F - RuleSet [7:0]
1338  *        Bits 7:0 - RuleSet [7:0]
1348 		vale |= BIT(match_idx - 8);  in ksz9477_acl_processing_rule_add_match()
1355  * ksz9477_acl_get_init_entry - Get a new uninitialized entry for a specified
1371 	struct ksz9477_acl_priv *acl = dev->ports[port].acl_priv;  in ksz9477_acl_get_init_entry()
1372 	struct ksz9477_acl_entries *acles = &acl->acles;  in ksz9477_acl_get_init_entry()
1375 	entry = &acles->entries[acles->entries_count];  in ksz9477_acl_get_init_entry()
1376 	entry->cookie = cookie;  in ksz9477_acl_get_init_entry()
1377 	entry->prio = prio;  in ksz9477_acl_get_init_entry()
1380 	entry->entry[KSZ9477_ACL_PORT_ACCESS_10] = 0;  in ksz9477_acl_get_init_entry()
1381 	entry->entry[KSZ9477_ACL_PORT_ACCESS_11] = 0;  in ksz9477_acl_get_init_entry()
1387  * ksz9477_acl_match_process_l2 - Configure Layer 2 ACL matching rules and
1395  * @prio: The priority of the entry.
1397  * This function sets up matching and processing rules for Layer 2 ACLs.
1404 	struct ksz9477_acl_priv *acl = dev->ports[port].acl_priv;  in ksz9477_acl_match_process_l2()
1405 	struct ksz9477_acl_entries *acles = &acl->acles;  in ksz9477_acl_match_process_l2()
1412 		ksz9477_acl_matching_rule_cfg_l2(entry->entry, ethtype, src_mac,  in ksz9477_acl_match_process_l2()
1416 		ksz9477_acl_processing_rule_add_match(entry->entry,  in ksz9477_acl_match_process_l2()
1417 						      acles->entries_count);  in ksz9477_acl_match_process_l2()
1418 		acles->entries_count++;  in ksz9477_acl_match_process_l2()
1419 		ksz9477_acl_processing_rule_add_match(entry->entry,  in ksz9477_acl_match_process_l2()
1420 						      acles->entries_count);  in ksz9477_acl_match_process_l2()
1423 		ksz9477_acl_matching_rule_cfg_l2(entry->entry, 0, dst_mac,  in ksz9477_acl_match_process_l2()
1425 		acles->entries_count++;  in ksz9477_acl_match_process_l2()
1430 		ksz9477_acl_matching_rule_cfg_l2(entry->entry, ethtype, mac,  in ksz9477_acl_match_process_l2()
1432 		ksz9477_acl_processing_rule_add_match(entry->entry,  in ksz9477_acl_match_process_l2()
1433 						      acles->entries_count);  in ksz9477_acl_match_process_l2()
1434 		acles->entries_count++;  in ksz9477_acl_match_process_l2()