Skip to contentSkip to conversation

Support more IPsec selectors in mlx5 packet offload

PATCH In review Leon Romanovsky 2 participants 4 messages Aug 8, 2023 – Aug 10, 2023

Subsystems (4)
Networking Network drivers Mellanox mlx5 core Mellanox Ethernet innova drivers
lore
Share & tools
lore

Leon Romanovsky

author
#0 lore raw

cover Support more IPsec selectors in mlx5 packet offload

From: Leon Romanovsky <[email protected]>

These two patches add ability to configure proto both UDP and TCP selectors in RX and TX directions.

Thanks

Emeel Hakim (1):
net/mlx5e: Support IPsec upper protocol selector field offload for RX

Leon Romanovsky (1):
net/mlx5e: Support IPsec upper TCP protocol selector

 .../mellanox/mlx5/core/en_accel/ipsec.c       | 13 +++---
 .../mellanox/mlx5/core/en_accel/ipsec_fs.c    | 45 ++++++++++++++-----
 2 files changed, 40 insertions(+), 18 deletions(-)
Signature · 1 line
2.41.0
author
#1 lore raw

PATCH 1/2 net/mlx5e: Support IPsec upper protocol selector field offload for RX

From: Emeel Hakim <[email protected]>

Support RX policy/state upper protocol selector field offload, to enable selecting RX traffic for IPsec operation based on l4 protocol UDP with specific source/destination port.

Signed-off-by Emeel Hakim <[email protected]>
Reviewed-by Raed Salem <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
---
 .../net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c   | 10 ++++------
 .../ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c    |  2 ++
 2 files changed, 6 insertions(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +4 -6
index 40350227b3c3..9ee169b72d9d 100644
@@ -442,9 +442,8 @@ static int mlx5e_xfrm_validate_state(struct mlx5_core_dev *mdev,
 		return -EINVAL;
 	}
 
-	if (x->sel.proto != IPPROTO_IP &&
-	    (x->sel.proto != IPPROTO_UDP || x->xso.dir != XFRM_DEV_OFFLOAD_OUT)) {
-		NL_SET_ERR_MSG_MOD(extack, "Device does not support upper protocol other than UDP, and only Tx direction");
+	if (x->sel.proto != IPPROTO_IP && x->sel.proto != IPPROTO_UDP) {
+		NL_SET_ERR_MSG_MOD(extack, "Device does not support upper protocol other than UDP");
 		return -EINVAL;
 	}
 

@@ -1000,9 +999,8 @@ static int mlx5e_xfrm_validate_policy(struct mlx5_core_dev *mdev,
 		return -EINVAL;
 	}
 
-	if (sel->proto != IPPROTO_IP &&
-	    (sel->proto != IPPROTO_UDP || x->xdo.dir != XFRM_DEV_OFFLOAD_OUT)) {
-		NL_SET_ERR_MSG_MOD(extack, "Device does not support upper protocol other than UDP, and only Tx direction");
+	if (x->selector.proto != IPPROTO_IP && x->selector.proto != IPPROTO_UDP) {
+		NL_SET_ERR_MSG_MOD(extack, "Device does not support upper protocol other than UDP");
 		return -EINVAL;
 	}
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +2 -0
index 3781c72d97f1..f5e29b7f5ba0 100644
@@ -1243,6 +1243,7 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
 	setup_fte_spi(spec, attrs->spi);
 	setup_fte_esp(spec);
 	setup_fte_no_frags(spec);
+	setup_fte_upper_proto_match(spec, &attrs->upspec);
 
 	if (rx != ipsec->rx_esw)
 		err = setup_modify_header(ipsec, attrs->type,

@@ -1519,6 +1520,7 @@ static int rx_add_policy(struct mlx5e_ipsec_pol_entry *pol_entry)
 		setup_fte_addr6(spec, attrs->saddr.a6, attrs->daddr.a6);
 
 	setup_fte_no_frags(spec);
+	setup_fte_upper_proto_match(spec, &attrs->upspec);
 
 	switch (attrs->action) {
 	case XFRM_POLICY_ALLOW:
Signature · 1 line
2.41.0
author
#2 lore raw

PATCH 2/2 net/mlx5e: Support IPsec upper TCP protocol selector

In reply to Leon Romanovsky

From: Leon Romanovsky <[email protected]>

Support TCP as protocol selector for policy and state in IPsec packet offload mode.

Example of state configuration is as follows:
ip xfrm state add src 192.168.25.3 dst 192.168.25.1 \

	proto esp spi 1001 reqid 10001 aead 'rfc4106(gcm(aes))' \
	0x54a7588d36873b031e4bd46301be5a86b3a53879 128 mode transport \
	offload packet dev re0 dir in sel src 192.168.25.3 dst 192.168.25.1 \
	proto tcp dport 9003
Acked-by Raed Salem <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
---
 .../mellanox/mlx5/core/en_accel/ipsec.c       | 11 +++--
 .../mellanox/mlx5/core/en_accel/ipsec_fs.c    | 43 +++++++++++++------
 2 files changed, 38 insertions(+), 16 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +7 -4
index 9ee169b72d9d..6f21694c7b13 100644
@@ -442,8 +442,9 @@ static int mlx5e_xfrm_validate_state(struct mlx5_core_dev *mdev,
 		return -EINVAL;
 	}
 
-	if (x->sel.proto != IPPROTO_IP && x->sel.proto != IPPROTO_UDP) {
-		NL_SET_ERR_MSG_MOD(extack, "Device does not support upper protocol other than UDP");
+	if (x->sel.proto != IPPROTO_IP && x->sel.proto != IPPROTO_UDP &&
+	    x->sel.proto != IPPROTO_TCP) {
+		NL_SET_ERR_MSG_MOD(extack, "Device does not support upper protocol other than TCP/UDP");
 		return -EINVAL;
 	}
 

@@ -999,8 +1000,10 @@ static int mlx5e_xfrm_validate_policy(struct mlx5_core_dev *mdev,
 		return -EINVAL;
 	}
 
-	if (x->selector.proto != IPPROTO_IP && x->selector.proto != IPPROTO_UDP) {
-		NL_SET_ERR_MSG_MOD(extack, "Device does not support upper protocol other than UDP");
+	if (x->selector.proto != IPPROTO_IP &&
+	    x->selector.proto != IPPROTO_UDP &&
+	    x->selector.proto != IPPROTO_TCP) {
+		NL_SET_ERR_MSG_MOD(extack, "Device does not support upper protocol other than TCP/UDP");
 		return -EINVAL;
 	}
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +31 -12

54 lines not on this page · raw message

Signature · 1 line
2.41.0
reviewer Reviewed-by on the v1 series
#3 lore raw
In reply to Leon Romanovsky
Quoted 5 lines · Leon Romanovsky

From: Leon Romanovsky <[email protected]>

These two patches add ability to configure proto both UDP and TCP selectors in RX and TX directions.

Quoted 7 lines

Thanks

Emeel Hakim (1):
net/mlx5e: Support IPsec upper protocol selector field offload for RX

Leon Romanovsky (1):
net/mlx5e: Support IPsec upper TCP protocol selector

Thanks Emeel and Leon,

this looks good to me.

For series,

Reviewed-by Simon Horman <[email protected]>