net/mlx5: IPsec offload support

index 06d7b486c..f118b6e01 100644
@@ -334,6 +334,8 @@ struct vxlan_hdr {
 #define ETHER_TYPE_SLOW 0x8809 /**< Slow protocols (LACP and Marker). */
 #define ETHER_TYPE_TEB  0x6558 /**< Transparent Ethernet Bridging. */
 #define ETHER_TYPE_LLDP 0x88CC /**< LLDP Protocol. */
+#define ETHER_TYPE_MLNX 0X8CE4
+/**< Mellanox additional metadata in Ethernet frames. */
 
 #define ETHER_VXLAN_HLEN (sizeof(struct udp_hdr) + sizeof(struct vxlan_hdr))
 /**< VXLAN tunnel header length. */

index cd66fe162..00480cef0 100644
@@ -106,6 +106,14 @@
 #define MLX5DV_CONTEXT_FLAGS_CQE_128B_COMP (1 << 4)
 #endif
 
+#ifdef HAVE_IBV_IPSEC_SUPPORT
+#define MLX5_IPSEC_FLAGS \
+	(MLX5DV_CONTEXT_XFRM_FLAGS_ESP_AES_GCM_TX | \
+	 MLX5DV_CONTEXT_XFRM_FLAGS_ESP_AES_GCM_RX | \
+	 MLX5DV_CONTEXT_XFRM_FLAGS_ESP_AES_GCM_REQ_METADATA | \
+	 MLX5DV_CONTEXT_XFRM_FLAGS_ESP_AES_GCM_SPI_RSS_ONLY)
+#endif
+
 struct mlx5_args {
 	int cqe_comp;
 	int txq_inline;

index e6a69b823..c6a01d972 100644
@@ -117,6 +117,7 @@ struct priv {
 	unsigned int isolated:1; /* Whether isolated mode is enabled. */
 	unsigned int tx_vec_en:1; /* Whether Tx vector is enabled. */
 	unsigned int rx_vec_en:1; /* Whether Rx vector is enabled. */
+	unsigned int ipsec_en:1; /* Whether IPsec is enabled. */
 	unsigned int counter_set_supported:1; /* Counter set is supported. */
 	/* Whether Tx offloads for tunneled packets are supported. */
 	unsigned int max_tso_payload_sz; /* Maximum TCP payload for TSO. */

index ca9ad0fef..f0c7fba43 100644
@@ -680,6 +680,10 @@ mlx5_dev_infos_get(struct rte_eth_dev *dev, struct rte_eth_dev_info *info)
 			 DEV_TX_OFFLOAD_TCP_CKSUM);
 	if (priv->tso)
 		info->tx_offload_capa |= DEV_TX_OFFLOAD_TCP_TSO;
+	if (priv->ipsec_en) {
+		info->tx_offload_capa |= DEV_TX_OFFLOAD_SECURITY;
+		info->rx_offload_capa |= DEV_RX_OFFLOAD_SECURITY;
+	}
 	if (priv->tunnel_en)
 		info->tx_offload_capa |= (DEV_TX_OFFLOAD_OUTER_IPV4_CKSUM |
 					  DEV_TX_OFFLOAD_VXLAN_TNL_TSO |

index 2de310bcb..bd6270671 100644
@@ -342,4 +342,43 @@ mlx5_flow_mark_get(uint32_t val)
 #endif
 }
 
+/* IPsec offloads elements. */
+
+/* IPsec Rx code. */
+#define MLX5_IPSEC_RX_DECRYPTED 0x11
+#define MLX5_IPSEC_RX_AUTH_FAIL 0x12
+
+/* IPsec Tx code. */
+#define MLX5_IPSEC_TX_OFFLOAD 0x8
+
+/* Metadata length . */
+#define MLX5_METADATA_LEN 8
+
+/* Packet IPsec Rx metadata. */
+struct mlx5_rx_pkt_ipsec_metadata {
+	uint8_t reserved;
+	rte_be32_t sa_handle;
+} __rte_packed;
+
+/* Tx packet Metadata. */
+struct mlx5_tx_pkt_ipsec_metadata {
+	rte_be16_t mss_inv; /** MSS fixed point, used only in LSO. */
+	rte_be16_t seq; /** LSBs of the first TCP seq, only in LSO. */
+	uint8_t esp_next_proto; /* Next protocol of ESP. */
+} __rte_packed;
+
+/* Packet Metadata. */
+struct mlx5_pkt_metadata {
+	uint8_t syndrome;
+	union {
+		uint8_t raw[5];
+		struct mlx5_rx_pkt_ipsec_metadata rx;
+		struct mlx5_tx_pkt_ipsec_metadata tx;
+	} __rte_packed;
+	rte_be16_t ethertype;
+} __rte_packed;
+
+static_assert(sizeof(struct mlx5_pkt_metadata) == MLX5_METADATA_LEN,
+	      "wrong metadata size detected.");
+
 #endif /* RTE_PMD_MLX5_PRM_H_ */

146 lines not on this page · raw message

index b8c7925a3..e219d01ee 100644
@@ -115,7 +115,8 @@ struct mlx5_rxq_data {
 	unsigned int rss_hash:1; /* RSS hash result is enabled. */
 	unsigned int mark:1; /* Marked flow available on the queue. */
 	unsigned int pending_err:1; /* CQE error needs to be handled. */
-	unsigned int :14; /* Remaining bits. */
+	unsigned int ipsec_en:1; /* IPsec is enabled on this queue. */
+	unsigned int :13; /* Remaining bits. */
 	volatile uint32_t *rq_db;
 	volatile uint32_t *cq_db;
 	uint16_t port_id;

@@ -195,6 +196,7 @@ struct mlx5_txq_data {
 	uint16_t tunnel_en:1;
 	/* When set TX offload for tunneled packets are supported. */
 	uint16_t mpw_hdr_dseg:1; /* Enable DSEGs in the title WQEBB. */
+	uint16_t ipsec_en:1; /* Whether IPsec Tx offload is enabled. */
 	uint16_t max_inline; /* Multiple of RTE_CACHE_LINE_SIZE to inline. */
 	uint16_t inline_max_packet_sz; /* Max packet size for inlining. */
 	uint16_t mr_cache_idx; /* Index of last hit entry. */

index a786a6b63..4d53c6da5 100644
@@ -646,6 +646,7 @@ mlx5_priv_txq_new(struct priv *priv, uint16_t idx, uint16_t desc,
 	}
 	if (priv->tunnel_en)
 		tmpl->txq.tunnel_en = 1;
+	tmpl->txq.ipsec_en = priv->ipsec_en;
 	tmpl->txq.elts =
 		(struct rte_mbuf *(*)[1 << tmpl->txq.elts_n])(tmpl + 1);
 	tmpl->txq.stats.idx = idx;

index 00480cef0..e74026caf 100644
@@ -57,6 +57,7 @@
 #include <rte_bus_pci.h>
 #include <rte_common.h>
 #include <rte_kvargs.h>
+#include <rte_security.h>
 
 #include "mlx5.h"
 #include "mlx5_utils.h"

@@ -114,6 +115,9 @@
 	 MLX5DV_CONTEXT_XFRM_FLAGS_ESP_AES_GCM_SPI_RSS_ONLY)
 #endif
 
+/* Dev ops structure defined in mlx5_ipsec.c */
+extern const struct rte_security_ops mlx5_security_ops;
+
 struct mlx5_args {
 	int cqe_comp;
 	int txq_inline;

@@ -942,6 +946,14 @@ mlx5_pci_probe(struct rte_pci_driver *pci_drv, struct rte_pci_device *pci_dev)
 		mlx5dv_set_context_attr(ctx, MLX5DV_CTX_ATTR_BUF_ALLOCATORS,
 					(void *)((uintptr_t)&alctr));
 
+		if (priv->ipsec_en) {
+			priv->security = (struct rte_security_ctx){
+				.device = (void *)eth_dev,
+				.ops = &mlx5_security_ops,
+				.sess_cnt = 0,
+			};
+			eth_dev->security_ctx = &priv->security;
+		}
 		/* Bring Ethernet device up. */
 		DEBUG("forcing Ethernet interface up");
 		priv_set_flags(priv, ~IFF_UP, IFF_UP);

index c6a01d972..2927b851b 100644
@@ -58,6 +58,7 @@
 #include <rte_interrupts.h>
 #include <rte_errno.h>
 #include <rte_flow.h>
+#include <rte_security.h>
 
 #include "mlx5_utils.h"
 #include "mlx5_rxtx.h"

@@ -150,6 +151,7 @@ struct priv {
 	rte_spinlock_t lock; /* Lock for control functions. */
 	int primary_socket; /* Unix socket for primary process. */
 	struct rte_intr_handle intr_handle_socket; /* Interrupt handler. */
+	struct rte_security_ctx security; /* Security context. */
 };
 
 /**

322 lines not on this page · raw message

index 1eda83671..ff50470b5 100644
@@ -654,6 +654,9 @@ priv_flow_convert_actions(struct priv *priv,
 			  struct rte_flow_error *error,
 			  struct mlx5_flow_parse *parser)
 {
+	int ret = 0;
+	const char *msg = NULL;
+	const struct rte_flow_action *action = NULL;
 	/*
 	 * Add default RSS configuration necessary for Verbs to create QP even
 	 * if no RSS is necessary.

@@ -674,7 +677,7 @@ priv_flow_convert_actions(struct priv *priv,
 			uint16_t found = 0;
 
 			if (!queue || (queue->index > (priv->rxqs_n - 1)))
-				goto exit_action_not_supported;
+				goto error;
 			for (n = 0; n < parser->queues_n; ++n) {
 				if (parser->queues[n] == queue->index) {
 					found = 1;

@@ -682,11 +685,10 @@ priv_flow_convert_actions(struct priv *priv,
 				}
 			}
 			if (parser->queues_n > 1 && !found) {
-				rte_flow_error_set(error, ENOTSUP,
-					   RTE_FLOW_ERROR_TYPE_ACTION,
-					   actions,
-					   "queue action not in RSS queues");
-				return -rte_errno;
+				ret = ENOTSUP;
+				action = actions;
+				msg = "queue action not in RSS queues";
+				goto error;
 			}
 			if (!found) {
 				parser->queues_n = 1;

@@ -699,11 +701,10 @@ priv_flow_convert_actions(struct priv *priv,
 			uint16_t n;
 
 			if (!rss || !rss->num) {
-				rte_flow_error_set(error, EINVAL,
-						   RTE_FLOW_ERROR_TYPE_ACTION,
-						   actions,
-						   "no valid queues");
-				return -rte_errno;
+				ret = EINVAL;
+				action = actions;
+				msg = "no valid queues";
+				goto error;
 			}
 			if (parser->queues_n == 1) {
 				uint16_t found = 0;

@@ -717,22 +718,18 @@ priv_flow_convert_actions(struct priv *priv,
 					}
 				}
 				if (!found) {
-					rte_flow_error_set(error, ENOTSUP,
-						   RTE_FLOW_ERROR_TYPE_ACTION,
-						   actions,
-						   "queue action not in RSS"
-						   " queues");
-					return -rte_errno;
+					ret = ENOTSUP;
+					action = actions;
+					msg = "queue action not in RSS queues";
+					goto error;
 				}
 			}
 			for (n = 0; n < rss->num; ++n) {
 				if (rss->queue[n] >= priv->rxqs_n) {
-					rte_flow_error_set(error, EINVAL,
-						   RTE_FLOW_ERROR_TYPE_ACTION,
-						   actions,
-						   "queue id > number of"
-						   " queues");
-					return -rte_errno;
+					ret = EINVAL;
+					action = actions;
+					msg = "queue id > number of queues";
+					goto error;
 				}
 			}
 			for (n = 0; n < rss->num; ++n)

@@ -740,11 +737,10 @@ priv_flow_convert_actions(struct priv *priv,
 			parser->queues_n = rss->num;
 			if (priv_flow_convert_rss_conf(priv, parser,
 						       rss->rss_conf)) {
-				rte_flow_error_set(error, EINVAL,
-						   RTE_FLOW_ERROR_TYPE_ACTION,
-						   actions,
-						   "wrong RSS configuration");
-				return -rte_errno;
+				ret = EINVAL;
+				action = actions;
+				msg = "wrong RSS configuration";
+				goto error;
 			}
 		} else if (actions->type == RTE_FLOW_ACTION_TYPE_MARK) {
 			const struct rte_flow_action_mark *mark =

@@ -752,18 +748,15 @@ priv_flow_convert_actions(struct priv *priv,
 				actions->conf;
 
 			if (!mark) {
-				rte_flow_error_set(error, EINVAL,
-						   RTE_FLOW_ERROR_TYPE_ACTION,
-						   actions,
-						   "mark must be defined");
-				return -rte_errno;
+				ret = EINVAL;
+				action = actions;
+				msg = "mark must be defined";
+				goto error;
 			} else if (mark->id >= MLX5_FLOW_MARK_MAX) {
-				rte_flow_error_set(error, ENOTSUP,
-						   RTE_FLOW_ERROR_TYPE_ACTION,
-						   actions,
-						   "mark must be between 0"
-						   " and 16777199");
-				return -rte_errno;
+				ret = ENOTSUP;
+				action = actions;
+				msg = "mark must be between 0 and 16777199";
+				goto error;
 			}
 			parser->mark = 1;
 			parser->mark_id = mark->id;

@@ -773,21 +766,22 @@ priv_flow_convert_actions(struct priv *priv,
 			   priv->counter_set_supported) {
 			parser->count = 1;
 		} else {
-			goto exit_action_not_supported;
+			goto error;
 		}
 	}
 	if (parser->drop && parser->mark)
 		parser->mark = 0;
 	if (!parser->queues_n && !parser->drop) {
-		rte_flow_error_set(error, ENOTSUP, RTE_FLOW_ERROR_TYPE_HANDLE,
-				   NULL, "no valid action");
-		return -rte_errno;
+		ret = ENOTSUP;
+		msg = "no valid action";
+		goto error;
 	}
 	return 0;
-exit_action_not_supported:
-	rte_flow_error_set(error, ENOTSUP, RTE_FLOW_ERROR_TYPE_ACTION,
-			   actions, "action not supported");
-	return -rte_errno;
+error:
+	return rte_flow_error_set(error, ret,
+				  action ? RTE_FLOW_ERROR_TYPE_ACTION :
+				  RTE_FLOW_ERROR_TYPE_HANDLE,
+				  action, msg);
 }
 
 /**

index 2927b851b..cb25beb3c 100644
@@ -154,6 +154,13 @@ struct priv {
 	struct rte_security_ctx security; /* Security context. */
 };
 
+/* Security session. */
+struct mlx5_security_session {
+	struct rte_security_ipsec_xform ipsec_xform;
+	struct rte_eth_dev *dev;
+	struct ibv_action_xfrm  *ibv_action_xfrm;
+};
+
 /**
  * Lock private structure to protect it from concurrent access in the
  * control path.

500 lines not on this page · raw message

index 52a3add7a..e7086adbc 100644
@@ -57,6 +57,9 @@
 		      " please contact Mellanox")
 
 /* Extra verifications, this API is not unstreamed yet. */
+MLX5_IPSEC_SUPPORT_ERROR(IBV_FLOW_ATTR_FLAGS_EGRESS == 1 << 2);
+MLX5_IPSEC_SUPPORT_ERROR(IBV_FLOW_SPEC_ESP == 0x34);
+MLX5_IPSEC_SUPPORT_ERROR(IBV_FLOW_SPEC_ACTION_XFRM == 0x1002);
 MLX5_IPSEC_SUPPORT_ERROR(MLX5DV_CONTEXT_XFRM_FLAGS_ESP_AES_GCM_REQ_METADATA ==
 			 1u << 0);
 MLX5_IPSEC_SUPPORT_ERROR(MLX5DV_CONTEXT_XFRM_FLAGS_ESP_AES_GCM_RX == 1u << 1);

@@ -65,13 +68,6 @@ MLX5_IPSEC_SUPPORT_ERROR(MLX5DV_CONTEXT_XFRM_FLAGS_ESP_AES_GCM_SPI_RSS_ONLY ==
 			 1u << 3);
 #endif
 
-/* Security session. */
-struct mlx5_security_session {
-	struct rte_security_ipsec_xform ipsec_xform;
-	struct rte_eth_dev *dev;
-	struct ibv_action_xfrm  *ibv_action_xfrm;
-};
-
 /** MLX5 Crypto capabilities. */
 struct rte_cryptodev_capabilities mlx5_crypto_capabilities[] = {
 	/* AES GCM (128-bit) */

index e74026caf..0a7e9ac34 100644
@@ -95,6 +95,9 @@
 /* Device parameter to enable hardware Rx vector. */
 #define MLX5_RX_VEC_EN "rx_vec_en"
 
+/* Device parameter to enable hardware IPsec offload. */
+#define MLX5_IPSEC_EN "ipsec_en"
+
 /* Default PMD specific parameter value. */
 #define MLX5_ARG_UNSET (-1)
 

@@ -128,6 +131,7 @@ struct mlx5_args {
 	int tso;
 	int tx_vec_en;
 	int rx_vec_en;
+	int ipsec_en;
 };
 /**
  * Retrieve integer value from environment variable.

@@ -438,6 +442,8 @@ mlx5_args_check(const char *key, const char *val, void *opaque)
 		args->tx_vec_en = !!tmp;
 	} else if (strcmp(MLX5_RX_VEC_EN, key) == 0) {
 		args->rx_vec_en = !!tmp;
+	} else if (strcmp(MLX5_IPSEC_EN, key) == 0) {
+		args->ipsec_en = !!tmp;
 	} else {
 		WARN("%s: unknown parameter", key);
 		return -EINVAL;

@@ -469,6 +475,7 @@ mlx5_args(struct mlx5_args *args, struct rte_devargs *devargs)
 		MLX5_TSO,
 		MLX5_TX_VEC_EN,
 		MLX5_RX_VEC_EN,
+		MLX5_IPSEC_EN,
 		NULL,
 	};
 	struct rte_kvargs *kvlist;

@@ -528,6 +535,8 @@ mlx5_args_assign(struct priv *priv, struct mlx5_args *args)
 		priv->tx_vec_en = args->tx_vec_en;
 	if (args->rx_vec_en != MLX5_ARG_UNSET)
 		priv->rx_vec_en = args->rx_vec_en;
+	if (args->ipsec_en != MLX5_ARG_UNSET)
+		priv->ipsec_en = args->ipsec_en;
 }
 
 /**

@@ -556,6 +565,7 @@ mlx5_pci_probe(struct rte_pci_driver *pci_drv, struct rte_pci_device *pci_dev)
 	unsigned int mps;
 	unsigned int cqe_comp;
 	unsigned int tunnel_en = 0;
+	unsigned int ipsec_en = 0;
 	int idx;
 	int i;
 	struct mlx5dv_context attrs_out;

@@ -645,6 +655,13 @@ mlx5_pci_probe(struct rte_pci_driver *pci_drv, struct rte_pci_device *pci_dev)
 	ibv_dev = list[i];
 
 	DEBUG("device opened");
+#ifdef HAVE_IBV_IPSEC_SUPPORT
+	attrs_out.comp_mask |= MLX5DV_CONTEXT_MASK_XFRM_FLAGS;
+	mlx5dv_query_device(attr_ctx, &attrs_out);
+	if ((attrs_out.xfrm_flags & MLX5_IPSEC_FLAGS) == MLX5_IPSEC_FLAGS)
+		ipsec_en = 1;
+#endif
+	DEBUG("Tx/Rx IPsec offload is %ssupported", ipsec_en ? "" : "not ");
 	/*
 	 * Multi-packet send is supported by ConnectX-4 Lx PF as well
 	 * as all ConnectX-5 devices.

@@ -693,6 +710,7 @@ mlx5_pci_probe(struct rte_pci_driver *pci_drv, struct rte_pci_device *pci_dev)
 			.tso = MLX5_ARG_UNSET,
 			.tx_vec_en = MLX5_ARG_UNSET,
 			.rx_vec_en = MLX5_ARG_UNSET,
+			.ipsec_en = MLX5_ARG_UNSET,
 		};
 
 		mlx5_dev[idx].ports |= test;

@@ -787,6 +805,7 @@ mlx5_pci_probe(struct rte_pci_driver *pci_drv, struct rte_pci_device *pci_dev)
 		priv->mps = mps; /* Enable MPW by default if supported. */
 		priv->cqe_comp = cqe_comp;
 		priv->tunnel_en = tunnel_en;
+		priv->ipsec_en = ipsec_en;
 		/* Enable vector by default if supported. */
 		priv->tx_vec_en = 1;
 		priv->rx_vec_en = 1;

@@ -797,6 +816,19 @@ mlx5_pci_probe(struct rte_pci_driver *pci_drv, struct rte_pci_device *pci_dev)
 			goto port_error;
 		}
 		mlx5_args_assign(priv, &args);
+		if (priv->ipsec_en) {
+#ifndef HAVE_IBV_IPSEC_SUPPORT
+			priv->ipsec_en = 0;
+			WARN("IPsec Offload not supported.");
+#else /* HAVE_IBV_IPSEC_SUPPORT */
+			priv->txq_inline = RTE_CACHE_LINE_SIZE;
+			priv->txqs_inline = 0;
+			priv->mps = MLX5_MPW_DISABLED;
+			priv->tx_vec_en = 0;
+			priv->rx_vec_en = 0;
+			WARN("IPsec offload enabled");
+#endif /* HAVE_IBV_IPSEC_SUPPORT */
+		}
 		if (ibv_query_device_ex(ctx, NULL, &device_attr_ex)) {
 			ERROR("ibv_query_device_ex() failed");
 			goto port_error;