mlx5 IPsec packet offload support (Part I)
Subsystems (5)
cover mlx5 IPsec packet offload support (Part I)
From: Leon Romanovsky <[email protected]>
Hi,
This series follows previously sent "Extend XFRM core to allow packet offload configuration" series [1].
It is first part with refactoring to mlx5 allow us natively extend mlx5 IPsec logic to support both crypto and packet offloads.
Thanks
[1] https://lore.kernel.org/all/[email protected]
Leon Romanovsky (16):
net/mlx5: Return ready to use ASO WQE
net/mlx5: Add HW definitions for IPsec packet offload net/mlx5e: Advertise IPsec packet offload support net/mlx5e: Store replay window in XFRM attributes net/mlx5e: Remove extra layers of defines
net/mlx5e: Create symmetric IPsec RX and TX flow steering structs net/mlx5e: Use mlx5 print routines for low level IPsec code net/mlx5e: Remove accesses to priv for low level IPsec FS code net/mlx5e: Create Advanced Steering Operation object for IPsec net/mlx5e: Create hardware IPsec packet offload objects net/mlx5e: Move IPsec flow table creation to separate function net/mlx5e: Refactor FTE setup code to be more clear net/mlx5e: Flatten the IPsec RX add rule path
net/mlx5e: Make clear what IPsec rx_err does
net/mlx5e: Group IPsec miss handles into separate struct net/mlx5e: Generalize creation of default IPsec miss group and rule
drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + .../ethernet/mellanox/mlx5/core/en/tc/meter.c | 1 - .../mellanox/mlx5/core/en_accel/ipsec.c | 50 +- .../mellanox/mlx5/core/en_accel/ipsec.h | 48 +- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 629 +++++++++--------- .../mlx5/core/en_accel/ipsec_offload.c | 107 ++- .../net/ethernet/mellanox/mlx5/core/lib/aso.c | 7 +- .../net/ethernet/mellanox/mlx5/core/lib/aso.h | 3 +- include/linux/mlx5/mlx5_ifc.h | 53 +- 9 files changed, 543 insertions(+), 356 deletions(-)
Signature · 1 line
2.38.1
PATCH 1/16 net/mlx5: Return ready to use ASO WQE
From: Leon Romanovsky <[email protected]>
There is no need in hiding returned ASO WQE type by providing void*, use the real type instead. Do it together with zeroing that memory, so ASO WQE will be ready to use immediately.
Reviewed-by Saeed Mahameed <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- drivers/net/ethernet/mellanox/mlx5/core/en/tc/meter.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c | 7 +++++-- drivers/net/ethernet/mellanox/mlx5/core/lib/aso.h | 2 +- 3 files changed, 6 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/tc/meter.c +0 -1
@@ -162,7 +162,6 @@ mlx5e_tc_meter_modify(struct mlx5_core_dev *mdev, MLX5_ACCESS_ASO_OPC_MOD_FLOW_METER); aso_ctrl = &aso_wqe->aso_ctrl; -memset (aso_ctrl,0 ,sizeof (*aso_ctrl)); aso_ctrl->data_mask_mode =MLX5_ASO_DATA_MASK_MODE_BYTEWISE_64BYTE <<6 ; aso_ctrl->condition_1_0_operand =MLX5_ASO_ALWAYS_TRUE |MLX5_ASO_ALWAYS_TRUE <<4 ;
drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c +5 -2
@@ -353,12 +353,15 @@ void mlx5_aso_build_wqe(struct mlx5_aso *aso, u8 ds_cnt, cseg->general_id =cpu_to_be32 (obj_id); } -void *mlx5_aso_get_wqe (struct mlx5_aso *aso) +struct mlx5_aso_wqe *mlx5_aso_get_wqe (struct mlx5_aso *aso) { +struct mlx5_aso_wqe *wqe;u16 pi; pi =mlx5_wq_cyc_ctr2ix (&aso->wq, aso->pc); -return mlx5_wq_cyc_get_wqe (&aso->wq, pi); + wqe =mlx5_wq_cyc_get_wqe (&aso->wq, pi); +memset (wqe,0 ,sizeof (*wqe)); +return wqe; } void mlx5_aso_post_wqe(struct mlx5_aso *aso, bool with_data,
drivers/net/ethernet/mellanox/mlx5/core/lib/aso.h +1 -1
@@ -77,7 +77,7 @@ enum {struct mlx5_aso ; -void *mlx5_aso_get_wqe (struct mlx5_aso *aso); +struct mlx5_aso_wqe *mlx5_aso_get_wqe (struct mlx5_aso *aso);void mlx5_aso_build_wqe (struct mlx5_aso *aso,u8 ds_cnt,struct mlx5_aso_wqe *aso_wqe,u32 obj_id,u32 opc_mode);
Signature · 1 line
2.38.1
PATCH 2/16 net/mlx5: Add HW definitions for IPsec packet offload
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Add all needed bits to support IPsec packet offload mode.
Reviewed-by Raed Salem <[email protected]>
Reviewed-by Saeed Mahameed <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- .../net/ethernet/mellanox/mlx5/core/lib/aso.h | 1 + include/linux/mlx5/mlx5_ifc.h | 53 +++++++++++++++++-- 2 files changed, 51 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/lib/aso.h +1 -0
@@ -71,6 +71,7 @@ enum { };enum { +MLX5_ACCESS_ASO_OPC_MOD_IPSEC =0x0 ,MLX5_ACCESS_ASO_OPC_MOD_FLOW_METER =0x2 ,MLX5_ACCESS_ASO_OPC_MOD_MACSEC =0x5 , };
include/linux/mlx5/mlx5_ifc.h +50 -3
84 lines not on this page · raw message
Signature · 1 line
2.38.1
PATCH 3/16 net/mlx5e: Advertise IPsec packet offload support
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Add needed capabilities check to determine if device supports IPsec packet offload mode.
Reviewed-by Raed Salem <[email protected]>
Reviewed-by Saeed Mahameed <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h | 1 + .../ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c | 6 ++++++ 2 files changed, 7 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +1 -0
@@ -88,6 +88,7 @@ struct mlx5_accel_esp_xfrm_attrs {enum mlx5_ipsec_cap {MLX5_IPSEC_CAP_CRYPTO =1 <<0 ,MLX5_IPSEC_CAP_ESN =1 <<1 , +MLX5_IPSEC_CAP_PACKET_OFFLOAD =1 <<2 , };struct mlx5e_priv ;
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c +6 -0
@@ -31,6 +31,12 @@ u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev) MLX5_CAP_ETH(mdev, insert_trailer) && MLX5_CAP_ETH(mdev, swp)) caps |=MLX5_IPSEC_CAP_CRYPTO ; +if (MLX5_CAP_IPSEC (mdev, ipsec_full_offload) && +MLX5_CAP_FLOWTABLE_NIC_TX (mdev, reformat_add_esp_trasport) && +MLX5_CAP_FLOWTABLE_NIC_RX (mdev, reformat_del_esp_trasport) && +MLX5_CAP_FLOWTABLE_NIC_RX (mdev, decap)) + caps |=MLX5_IPSEC_CAP_PACKET_OFFLOAD ; +if (!caps)return 0 ;
Signature · 1 line
2.38.1
PATCH 4/16 net/mlx5e: Store replay window in XFRM attributes
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
As a preparation for future extension of IPsec hardware object to allow configuration of packet offload mode, extend the XFRM validator to check replay window values.
Reviewed-by Raed Salem <[email protected]>
Reviewed-by Saeed Mahameed <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- .../net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 12 ++++++++++++ .../net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h | 1 + 2 files changed, 13 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +12 -0
@@ -166,6 +166,7 @@ mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry, attrs->esn = sa_entry->esn_state.esn;if (sa_entry->esn_state.overlap) attrs->flags |=MLX5_ACCEL_ESP_FLAGS_ESN_STATE_OVERLAP ; + attrs->replay_window = x->replay_esn->replay_window; }/* action */
@@ -257,6 +258,17 @@ static inline int mlx5e_xfrm_validate_state(struct xfrm_state *x)netdev_info (netdev,"Unsupported xfrm offload type\n" );return -EINVAL ; } +if (x->xso.type ==XFRM_DEV_OFFLOAD_PACKET ) { +if (x->replay_esn && x->replay_esn->replay_window !=32 && + x->replay_esn->replay_window !=64 && + x->replay_esn->replay_window !=128 && + x->replay_esn->replay_window !=256 ) { +netdev_info (netdev, +"Unsupported replay window size %u\n" , + x->replay_esn->replay_window); +return -EINVAL ; + } + }return 0 ; }
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +1 -0
@@ -83,6 +83,7 @@ struct mlx5_accel_esp_xfrm_attrs { } daddr;u8 is_ipv6; +u32 replay_window; };enum mlx5_ipsec_cap {
Signature · 1 line
2.38.1
PATCH 5/16 net/mlx5e: Remove extra layers of defines
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Instead of performing redefinition of XFRM core defines to same values but with MLX5_* prefix, cache the input values as is by making sure that the proper storage objects are used.
Reviewed-by Raed Salem <[email protected]>
Reviewed-by Saeed Mahameed <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- .../mellanox/mlx5/core/en_accel/ipsec.c | 17 ++++----------- .../mellanox/mlx5/core/en_accel/ipsec.h | 18 ++++------------ .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 21 ++++++++++--------- .../mlx5/core/en_accel/ipsec_offload.c | 10 ++++----- 4 files changed, 23 insertions(+), 43 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +4 -13
@@ -162,29 +162,20 @@ mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry,/* esn */ if (sa_entry->esn_state.trigger) { - attrs->flags |=MLX5_ACCEL_ESP_FLAGS_ESN_TRIGGERED ; + attrs->esn_trigger = true; attrs->esn = sa_entry->esn_state.esn; -if (sa_entry->esn_state.overlap) - attrs->flags |=MLX5_ACCEL_ESP_FLAGS_ESN_STATE_OVERLAP ; + attrs->esn_overlap = sa_entry->esn_state.overlap; attrs->replay_window = x->replay_esn->replay_window; } -/* action */ - attrs->action = (x->xso.dir ==XFRM_DEV_OFFLOAD_OUT ) ? -MLX5_ACCEL_ESP_ACTION_ENCRYPT : -MLX5_ACCEL_ESP_ACTION_DECRYPT ; -/* flags */ - attrs->flags |= (x->props.mode ==XFRM_MODE_TRANSPORT ) ? -MLX5_ACCEL_ESP_FLAGS_TRANSPORT : -MLX5_ACCEL_ESP_FLAGS_TUNNEL ; - + attrs->dir = x->xso.dir;/* spi */ attrs->spi =be32_to_cpu (x->id.spi);/* source , destination ips */ memcpy (&attrs->saddr, x->props.saddr.a6,sizeof (attrs->saddr));memcpy (&attrs->daddr, x->id.daddr.a6,sizeof (attrs->daddr)); - attrs->is_ipv6 = (x->props.family !=AF_INET ); + attrs->family = x->props.family; }static inline int mlx5e_xfrm_validate_state (struct xfrm_state *x)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +4 -14
@@ -43,18 +43,6 @@#define MLX5E_IPSEC_SADB_RX_BITS 10#define MLX5E_IPSEC_ESN_SCOPE_MID 0x80000000L -enum mlx5_accel_esp_flags { -MLX5_ACCEL_ESP_FLAGS_TUNNEL =0 ,/* Default */ -MLX5_ACCEL_ESP_FLAGS_TRANSPORT =1UL <<0 , -MLX5_ACCEL_ESP_FLAGS_ESN_TRIGGERED =1UL <<1 , -MLX5_ACCEL_ESP_FLAGS_ESN_STATE_OVERLAP =1UL <<2 , -}; - -enum mlx5_accel_esp_action { -MLX5_ACCEL_ESP_ACTION_DECRYPT , -MLX5_ACCEL_ESP_ACTION_ENCRYPT , -}; -struct aes_gcm_keymat {u64 seq_iv;
@@ -66,7 +54,6 @@ struct aes_gcm_keymat { };struct mlx5_accel_esp_xfrm_attrs { -enum mlx5_accel_esp_action action;u32 esn;u32 spi;u32 flags;
@@ -82,7 +69,10 @@ struct mlx5_accel_esp_xfrm_attrs {__be32 a6[4 ]; } daddr; -u8 is_ipv6; + u8 dir : 2; + u8 esn_overlap : 1; + u8 esn_trigger : 1; +u8 family;u32 replay_window; };
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +11 -10
@@ -341,7 +341,7 @@ static void setup_fte_common(struct mlx5_accel_esp_xfrm_attrs *attrs,struct mlx5_flow_spec *spec, struct mlx5_flow_act *flow_act) { - u8 ip_version = attrs->is_ipv6 ? 6 : 4; + u8 ip_version = (attrs->family == AF_INET) ? 4 : 6; spec->match_criteria_enable =MLX5_MATCH_OUTER_HEADERS |MLX5_MATCH_MISC_PARAMETERS ;
@@ -411,7 +411,7 @@ static int rx_add_rule(struct mlx5e_priv *priv,int err =0 ; accel_esp = priv->ipsec->rx_fs; - type = attrs->is_ipv6 ?ACCEL_FS_ESP6 :ACCEL_FS_ESP4 ; + type = (attrs->family ==AF_INET ) ?ACCEL_FS_ESP4 :ACCEL_FS_ESP6 ; fs_prot = &accel_esp->fs_prot[type]; err =rx_ft_get (priv, type);
@@ -453,8 +453,8 @@ static int rx_add_rule(struct mlx5e_priv *priv, rule =mlx5_add_flow_rules (fs_prot->ft, spec, &flow_act, &dest,1 );if (IS_ERR (rule)) { err =PTR_ERR (rule); -netdev_err (priv->netdev,"fail to add ipsec rule attrs->action=0x%x, err=%d\n" , - attrs->action, err); +netdev_err (priv->netdev,"fail to add RX ipsec rule err=%d\n" , + err); goto out_err; }
@@ -505,8 +505,8 @@ static int tx_add_rule(struct mlx5e_priv *priv, rule =mlx5_add_flow_rules (priv->ipsec->tx_fs->ft, spec, &flow_act,NULL ,0 );if (IS_ERR (rule)) { err =PTR_ERR (rule); -netdev_err (priv->netdev,"fail to add ipsec rule attrs->action=0x%x, err=%d\n" , - sa_entry->attrs.action, err); +netdev_err (priv->netdev,"fail to add TX ipsec rule err=%d\n" , + err); goto out; }
@@ -522,7 +522,7 @@ static int tx_add_rule(struct mlx5e_priv *priv,int mlx5e_accel_ipsec_fs_add_rule (struct mlx5e_priv *priv,struct mlx5e_ipsec_sa_entry *sa_entry) { -if (sa_entry->attrs.action ==MLX5_ACCEL_ESP_ACTION_ENCRYPT ) +if (sa_entry->attrs.dir ==XFRM_DEV_OFFLOAD_OUT )return tx_add_rule (priv, sa_entry);return rx_add_rule (priv, sa_entry);
@@ -533,17 +533,18 @@ void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_priv *priv, {struct mlx5e_ipsec_rule *ipsec_rule = &sa_entry->ipsec_rule;struct mlx5_core_dev *mdev =mlx5e_ipsec_sa2dev (sa_entry); +enum accel_fs_esp_type type;mlx5_del_flow_rules (ipsec_rule->rule); -if (sa_entry->attrs.action ==MLX5_ACCEL_ESP_ACTION_ENCRYPT ) { +if (sa_entry->attrs.dir ==XFRM_DEV_OFFLOAD_OUT ) {tx_ft_put (priv);return ; }mlx5_modify_header_dealloc (mdev, ipsec_rule->set_modify_hdr); -rx_ft_put (priv, - sa_entry->attrs.is_ipv6 ?ACCEL_FS_ESP6 :ACCEL_FS_ESP4 ); + type = (sa_entry->attrs.family ==AF_INET ) ?ACCEL_FS_ESP4 :ACCEL_FS_ESP6 ; +rx_ft_put (priv, type); }void mlx5e_accel_ipsec_fs_cleanup (struct mlx5e_ipsec *ipsec)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c +4 -6
@@ -72,11 +72,10 @@ static int mlx5_create_ipsec_obj(struct mlx5e_ipsec_sa_entry *sa_entry) salt_iv_p =MLX5_ADDR_OF (ipsec_obj, obj, implicit_iv);memcpy (salt_iv_p, &aes_gcm->seq_iv,sizeof (aes_gcm->seq_iv));/* esn */ -if (attrs->flags &MLX5_ACCEL_ESP_FLAGS_ESN_TRIGGERED ) { +if (attrs->esn_trigger) {MLX5_SET (ipsec_obj, obj, esn_en,1 );MLX5_SET (ipsec_obj, obj, esn_msb, attrs->esn); -if (attrs->flags &MLX5_ACCEL_ESP_FLAGS_ESN_STATE_OVERLAP ) -MLX5_SET (ipsec_obj, obj, esn_overlap,1 ); +MLX5_SET (ipsec_obj, obj, esn_overlap, attrs->esn_overlap); }MLX5_SET (ipsec_obj, obj, dekn, sa_entry->enc_key_id);
@@ -158,7 +157,7 @@ static int mlx5_modify_ipsec_obj(struct mlx5e_ipsec_sa_entry *sa_entry,void *obj;int err; -if (!(attrs->flags &MLX5_ACCEL_ESP_FLAGS_ESN_TRIGGERED )) +if (!attrs->esn_trigger)return 0 ; general_obj_types =MLX5_CAP_GEN_64 (mdev, general_obj_types);
@@ -189,8 +188,7 @@ static int mlx5_modify_ipsec_obj(struct mlx5e_ipsec_sa_entry *sa_entry,MLX5_MODIFY_IPSEC_BITMASK_ESN_OVERLAP | MLX5_MODIFY_IPSEC_BITMASK_ESN_MSB);MLX5_SET (ipsec_obj, obj, esn_msb, attrs->esn); -if (attrs->flags &MLX5_ACCEL_ESP_FLAGS_ESN_STATE_OVERLAP ) -MLX5_SET (ipsec_obj, obj, esn_overlap,1 ); +MLX5_SET (ipsec_obj, obj, esn_overlap, attrs->esn_overlap);/* general object fields set */ MLX5_SET (general_obj_in_cmd_hdr, in, opcode,MLX5_CMD_OP_MODIFY_GENERAL_OBJECT );
Signature · 1 line
2.38.1
PATCH 6/16 net/mlx5e: Create symmetric IPsec RX and TX flow steering structs
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Remove AF family obfuscation by creating symmetric structs for RX and TX IPsec flow steering chains. This simplifies to us low level IPsec FS creation logic without need to dig into multiple levels of structs.
Reviewed-by Raed Salem <[email protected]>
Reviewed-by Saeed Mahameed <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- .../mellanox/mlx5/core/en_accel/ipsec.h | 7 +- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 277 ++++++++---------- 2 files changed, 130 insertions(+), 154 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +4 -3
@@ -94,7 +94,7 @@ struct mlx5e_ipsec_sw_stats {atomic64_t ipsec_tx_drop_trailer; }; -struct mlx5e_accel_fs_esp ; +struct mlx5e_ipsec_rx ;struct mlx5e_ipsec_tx ;struct mlx5e_ipsec {
@@ -103,8 +103,9 @@ struct mlx5e_ipsec {spinlock_t sadb_rx_lock;/* Protects sadb_rx */ struct mlx5e_ipsec_sw_stats sw_stats;struct workqueue_struct *wq; -struct mlx5e_accel_fs_esp *rx_fs; -struct mlx5e_ipsec_tx *tx_fs; +struct mlx5e_ipsec_rx *rx_ipv4; +struct mlx5e_ipsec_rx *rx_ipv6; +struct mlx5e_ipsec_tx *tx; };struct mlx5e_ipsec_esn_state {
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +126 -151
506 lines not on this page · raw message
Signature · 1 line
2.38.1
PATCH 7/16 net/mlx5e: Use mlx5 print routines for low level IPsec code
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Low level mlx5 code needs to use mlx5_core print routines and not netdev ones, as the failures are relevant to the HW itself and not to its netdev.
This change allows us to remove access to mlx5 priv structure, which holds high level driver data that isn't needed for mlx5 IPsec code.
Reviewed-by Saeed Mahameed <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 26 ++++++++++--------- 1 file changed, 14 insertions(+), 12 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +14 -12
@@ -70,8 +70,8 @@ static int rx_err_add_rule(struct mlx5e_priv *priv, struct mlx5e_ipsec_rx *rx,if (IS_ERR (modify_hdr)) { err =PTR_ERR (modify_hdr); -netdev_err (priv->netdev, -"fail to alloc ipsec copy modify_header_id err=%d\n" , err); +mlx5_core_err (mdev, +"fail to alloc ipsec copy modify_header_id err=%d\n" , err); goto out_spec; }
@@ -83,7 +83,7 @@ static int rx_err_add_rule(struct mlx5e_priv *priv, struct mlx5e_ipsec_rx *rx, &rx->default_dest, 1);if (IS_ERR (fte)) { err =PTR_ERR (fte); -netdev_err (priv->netdev,"fail to add ipsec rx err copy rule err=%d\n" , err); +mlx5_core_err (mdev,"fail to add ipsec rx err copy rule err=%d\n" , err); goto out; }
@@ -103,6 +103,7 @@ static int rx_fs_create(struct mlx5e_priv *priv, struct mlx5e_ipsec_rx *rx) {int inlen =MLX5_ST_SZ_BYTES (create_flow_group_in);struct mlx5_flow_table *ft = rx->ft.sa; +struct mlx5_core_dev *mdev = priv->mdev;struct mlx5_flow_group *miss_group;struct mlx5_flow_handle *miss_rule;MLX5_DECLARE_FLOW_ACT (flow_act);
@@ -123,7 +124,7 @@ static int rx_fs_create(struct mlx5e_priv *priv, struct mlx5e_ipsec_rx *rx) miss_group =mlx5_create_flow_group (ft, flow_group_in);if (IS_ERR (miss_group)) { err =PTR_ERR (miss_group); -netdev_err (priv->netdev,"fail to create ipsec rx miss_group err=%d\n" , err); +mlx5_core_err (mdev,"fail to create ipsec rx miss_group err=%d\n" , err); goto out; } rx->miss_group = miss_group;
@@ -134,7 +135,7 @@ static int rx_fs_create(struct mlx5e_priv *priv, struct mlx5e_ipsec_rx *rx)if (IS_ERR (miss_rule)) {mlx5_destroy_flow_group (rx->miss_group); err =PTR_ERR (miss_rule); -netdev_err (priv->netdev,"fail to create ipsec rx miss_rule err=%d\n" , err); +mlx5_core_err (mdev,"fail to create ipsec rx miss_rule err=%d\n" , err); goto out; } rx->miss_rule = miss_rule;
@@ -273,6 +274,7 @@ static int tx_create(struct mlx5e_priv *priv) {struct mlx5_flow_table_attr ft_attr = {};struct mlx5e_ipsec *ipsec = priv->ipsec; +struct mlx5_core_dev *mdev = priv->mdev;struct mlx5_flow_table *ft;int err;
@@ -281,7 +283,7 @@ static int tx_create(struct mlx5e_priv *priv) ft =mlx5_create_auto_grouped_flow_table (ipsec->tx->ns, &ft_attr);if (IS_ERR (ft)) { err =PTR_ERR (ft); -netdev_err (priv->netdev,"fail to create ipsec tx ft err=%d\n" , err); +mlx5_core_err (mdev,"fail to create ipsec tx ft err=%d\n" , err);return err; } ipsec->tx->ft.sa = ft;
@@ -386,6 +388,7 @@ static int rx_add_rule(struct mlx5e_priv *priv,u8 action[MLX5_UN_SZ_BYTES (set_add_copy_action_in_auto)] = {};struct mlx5e_ipsec_rule *ipsec_rule = &sa_entry->ipsec_rule;struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs; +struct mlx5_core_dev *mdev =mlx5e_ipsec_sa2dev (sa_entry);u32 ipsec_obj_id = sa_entry->ipsec_obj_id;struct mlx5_modify_hdr *modify_hdr =NULL ;struct mlx5_flow_destination dest = {};
@@ -419,8 +422,8 @@ static int rx_add_rule(struct mlx5e_priv *priv, 1, action);if (IS_ERR (modify_hdr)) { err =PTR_ERR (modify_hdr); -netdev_err (priv->netdev, -"fail to alloc ipsec set modify_header_id err=%d\n" , err); +mlx5_core_err (mdev, +"fail to alloc ipsec set modify_header_id err=%d\n" , err); modify_hdr =NULL ; goto out_err; }
@@ -434,8 +437,7 @@ static int rx_add_rule(struct mlx5e_priv *priv, rule =mlx5_add_flow_rules (rx->ft.sa, spec, &flow_act, &dest,1 );if (IS_ERR (rule)) { err =PTR_ERR (rule); -netdev_err (priv->netdev,"fail to add RX ipsec rule err=%d\n" , - err); +mlx5_core_err (mdev,"fail to add RX ipsec rule err=%d\n" , err); goto out_err; }
@@ -456,6 +458,7 @@ static int rx_add_rule(struct mlx5e_priv *priv,static int tx_add_rule (struct mlx5e_priv *priv,struct mlx5e_ipsec_sa_entry *sa_entry) { +struct mlx5_core_dev *mdev =mlx5e_ipsec_sa2dev (sa_entry);struct mlx5_flow_act flow_act = {};struct mlx5_flow_handle *rule;struct mlx5_flow_spec *spec;
@@ -487,8 +490,7 @@ static int tx_add_rule(struct mlx5e_priv *priv, rule =mlx5_add_flow_rules (tx->ft.sa, spec, &flow_act,NULL ,0 );if (IS_ERR (rule)) { err =PTR_ERR (rule); -netdev_err (priv->netdev,"fail to add TX ipsec rule err=%d\n" , - err); +mlx5_core_err (mdev,"fail to add TX ipsec rule err=%d\n" , err); goto out; }
Signature · 1 line
2.38.1
PATCH 8/16 net/mlx5e: Remove accesses to priv for low level IPsec FS code
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
mlx5 priv structure is driver main structure that holds high level data. That information is not needed for IPsec flow steering logic and the pointer to mlx5e_priv was not supposed to be passed in the first place.
This change "cleans" the logic to rely on internal to IPsec structures without touching global mlx5e_priv.
Reviewed-by Raed Salem <[email protected]>
Reviewed-by Saeed Mahameed <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- .../mellanox/mlx5/core/en_accel/ipsec.c | 8 +- .../mellanox/mlx5/core/en_accel/ipsec.h | 7 +- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 100 +++++++++--------- 3 files changed, 56 insertions(+), 59 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +4 -4
@@ -306,7 +306,7 @@ static int mlx5e_xfrm_add_state(struct xfrm_state *x)if (err) goto err_xfrm; - err =mlx5e_accel_ipsec_fs_add_rule (priv, sa_entry); + err =mlx5e_accel_ipsec_fs_add_rule (sa_entry);if (err) goto err_hw_ctx;
@@ -324,7 +324,7 @@ static int mlx5e_xfrm_add_state(struct xfrm_state *x) goto out; err_add_rule: -mlx5e_accel_ipsec_fs_del_rule (priv, sa_entry); +mlx5e_accel_ipsec_fs_del_rule (sa_entry); err_hw_ctx:mlx5_ipsec_free_sa_ctx (sa_entry); err_xfrm:
@@ -344,10 +344,9 @@ static void mlx5e_xfrm_del_state(struct xfrm_state *x)static void mlx5e_xfrm_free_state (struct xfrm_state *x) {struct mlx5e_ipsec_sa_entry *sa_entry =to_ipsec_sa_entry (x); -struct mlx5e_priv *priv =netdev_priv (x->xso.dev);cancel_work_sync (&sa_entry->modify_work.work); -mlx5e_accel_ipsec_fs_del_rule (priv, sa_entry); +mlx5e_accel_ipsec_fs_del_rule (sa_entry);mlx5_ipsec_free_sa_ctx (sa_entry);kfree (sa_entry); }
@@ -378,6 +377,7 @@ void mlx5e_ipsec_init(struct mlx5e_priv *priv)if (ret) goto err_fs_init; + ipsec->fs = priv->fs; priv->ipsec = ipsec;netdev_dbg (priv->netdev,"IPSec attached to netdevice\n" );return ;
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +3 -4
@@ -103,6 +103,7 @@ struct mlx5e_ipsec {spinlock_t sadb_rx_lock;/* Protects sadb_rx */ struct mlx5e_ipsec_sw_stats sw_stats;struct workqueue_struct *wq; +struct mlx5e_flow_steering *fs;struct mlx5e_ipsec_rx *rx_ipv4;struct mlx5e_ipsec_rx *rx_ipv6;struct mlx5e_ipsec_tx *tx;
@@ -148,10 +149,8 @@ struct xfrm_state *mlx5e_ipsec_sadb_rx_lookup(struct mlx5e_ipsec *dev,void mlx5e_accel_ipsec_fs_cleanup (struct mlx5e_ipsec *ipsec);int mlx5e_accel_ipsec_fs_init (struct mlx5e_ipsec *ipsec); -int mlx5e_accel_ipsec_fs_add_rule (struct mlx5e_priv *priv, -struct mlx5e_ipsec_sa_entry *sa_entry); -void mlx5e_accel_ipsec_fs_del_rule (struct mlx5e_priv *priv, -struct mlx5e_ipsec_sa_entry *sa_entry); +int mlx5e_accel_ipsec_fs_add_rule (struct mlx5e_ipsec_sa_entry *sa_entry); +void mlx5e_accel_ipsec_fs_del_rule (struct mlx5e_ipsec_sa_entry *sa_entry);int mlx5_ipsec_create_sa_ctx (struct mlx5e_ipsec_sa_entry *sa_entry);void mlx5_ipsec_free_sa_ctx (struct mlx5e_ipsec_sa_entry *sa_entry);
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +49 -51
289 lines not on this page · raw message
Signature · 1 line
2.38.1
PATCH 9/16 net/mlx5e: Create Advanced Steering Operation object for IPsec
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Setup the ASO (Advanced Steering Operation) object that is needed for IPsec to interact with SW stack about various fast changing
events: replay window, lifetime limits, e.t.c
Reviewed-by Raed Salem <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + .../mellanox/mlx5/core/en_accel/ipsec.c | 12 +++++ .../mellanox/mlx5/core/en_accel/ipsec.h | 13 +++++ .../mlx5/core/en_accel/ipsec_offload.c | 54 +++++++++++++++++++ 4 files changed, 80 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en.h +1 -0
@@ -1245,4 +1245,5 @@ int mlx5e_set_vf_rate(struct net_device *dev, int vf, int min_tx_rate, int max_tint mlx5e_get_vf_config (struct net_device *dev,int vf,struct ifla_vf_info *ivi);int mlx5e_get_vf_stats (struct net_device *dev,int vf,struct ifla_vf_stats *vf_stats);#endif +int mlx5e_create_mkey (struct mlx5_core_dev *mdev,u32 pdn,u32 *mkey);#endif /* __MLX5_EN_H__ */
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +12 -0
@@ -373,6 +373,13 @@ void mlx5e_ipsec_init(struct mlx5e_priv *priv)if (!ipsec->wq) goto err_wq; +if (mlx5_ipsec_device_caps (priv->mdev) & +MLX5_IPSEC_CAP_PACKET_OFFLOAD ) { + ret =mlx5e_ipsec_aso_init (ipsec); +if (ret) + goto err_aso; + } + ret =mlx5e_accel_ipsec_fs_init (ipsec);if (ret) goto err_fs_init;
@@ -383,6 +390,9 @@ void mlx5e_ipsec_init(struct mlx5e_priv *priv)return ; err_fs_init: +if (mlx5_ipsec_device_caps (priv->mdev) &MLX5_IPSEC_CAP_PACKET_OFFLOAD ) +mlx5e_ipsec_aso_cleanup (ipsec); +err_aso:destroy_workqueue (ipsec->wq); err_wq:kfree (ipsec);
@@ -398,6 +408,8 @@ void mlx5e_ipsec_cleanup(struct mlx5e_priv *priv)return ;mlx5e_accel_ipsec_fs_cleanup (ipsec); +if (mlx5_ipsec_device_caps (priv->mdev) &MLX5_IPSEC_CAP_PACKET_OFFLOAD ) +mlx5e_ipsec_aso_cleanup (ipsec);destroy_workqueue (ipsec->wq);kfree (ipsec); priv->ipsec =NULL ;
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +13 -0
@@ -39,6 +39,7 @@#include <linux/mlx5/device.h> #include <net/xfrm.h> #include <linux/idr.h> +#include "lib/aso.h" #define MLX5E_IPSEC_SADB_RX_BITS 10#define MLX5E_IPSEC_ESN_SCOPE_MID 0x80000000L
@@ -97,6 +98,14 @@ struct mlx5e_ipsec_sw_stats {struct mlx5e_ipsec_rx ;struct mlx5e_ipsec_tx ; +struct mlx5e_ipsec_aso { +u8 ctx[MLX5_ST_SZ_BYTES (ipsec_aso)]; +dma_addr_t dma_addr; +struct mlx5_aso *aso; +u32 pdn; +u32 mkey; +}; +struct mlx5e_ipsec {struct mlx5_core_dev *mdev; DECLARE_HASHTABLE(sadb_rx, MLX5E_IPSEC_SADB_RX_BITS);
@@ -107,6 +116,7 @@ struct mlx5e_ipsec {struct mlx5e_ipsec_rx *rx_ipv4;struct mlx5e_ipsec_rx *rx_ipv6;struct mlx5e_ipsec_tx *tx; +struct mlx5e_ipsec_aso *aso; };struct mlx5e_ipsec_esn_state {
@@ -160,6 +170,9 @@ u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev);void mlx5_accel_esp_modify_xfrm (struct mlx5e_ipsec_sa_entry *sa_entry,const struct mlx5_accel_esp_xfrm_attrs *attrs); +int mlx5e_ipsec_aso_init (struct mlx5e_ipsec *ipsec); +void mlx5e_ipsec_aso_cleanup (struct mlx5e_ipsec *ipsec); +static inline struct mlx5_core_dev *mlx5e_ipsec_sa2dev (struct mlx5e_ipsec_sa_entry *sa_entry) {
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c +54 -0
63 lines not on this page · raw message
Signature · 1 line
2.38.1
PATCH 10/16 net/mlx5e: Create hardware IPsec packet offload objects
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Create initial hardware IPsec packet offload object and connect it to advanced steering operation (ASO) context and queue, so the data path can communicate with the stack.
Reviewed-by Raed Salem <[email protected]>
Reviewed-by Saeed Mahameed <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- .../mellanox/mlx5/core/en_accel/ipsec.c | 1 + .../mellanox/mlx5/core/en_accel/ipsec.h | 3 +- .../mlx5/core/en_accel/ipsec_offload.c | 37 +++++++++++++++++++ 3 files changed, 39 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +1 -0
@@ -176,6 +176,7 @@ mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry,memcpy (&attrs->saddr, x->props.saddr.a6,sizeof (attrs->saddr));memcpy (&attrs->daddr, x->id.daddr.a6,sizeof (attrs->daddr)); attrs->family = x->props.family; + attrs->type = x->xso.type; }static inline int mlx5e_xfrm_validate_state (struct xfrm_state *x)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +1 -2
@@ -73,6 +73,7 @@ struct mlx5_accel_esp_xfrm_attrs { u8 dir : 2; u8 esn_overlap : 1; u8 esn_trigger : 1; + u8 type : 2;u8 family;u32 replay_window; };
@@ -102,8 +103,6 @@ struct mlx5e_ipsec_aso {u8 ctx[MLX5_ST_SZ_BYTES (ipsec_aso)];dma_addr_t dma_addr;struct mlx5_aso *aso; -u32 pdn; -u32 mkey; };struct mlx5e_ipsec {
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c +37 -0
@@ -53,6 +53,38 @@ u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev) }EXPORT_SYMBOL_GPL (mlx5_ipsec_device_caps); +static void mlx5e_ipsec_packet_setup (void *obj,u32 pdn, +struct mlx5_accel_esp_xfrm_attrs *attrs) +{ +void *aso_ctx; + + aso_ctx =MLX5_ADDR_OF (ipsec_obj, obj, ipsec_aso); +if (attrs->esn_trigger) { +MLX5_SET (ipsec_aso, aso_ctx, esn_event_arm,1 ); + +if (attrs->dir ==XFRM_DEV_OFFLOAD_IN ) { +MLX5_SET (ipsec_aso, aso_ctx, window_sz, + attrs->replay_window /64 ); +MLX5_SET (ipsec_aso, aso_ctx, mode, +MLX5_IPSEC_ASO_REPLAY_PROTECTION ); + } + } + +/* ASO context */ +MLX5_SET (ipsec_obj, obj, ipsec_aso_access_pd, pdn); +MLX5_SET (ipsec_obj, obj, full_offload,1 ); +MLX5_SET (ipsec_aso, aso_ctx, valid,1 ); +/* MLX5_IPSEC_ASO_REG_C_4_5 is type C register that is used +* in flow steering to perform matching against. Please be +* aware that this register was chosen arbitrary and can't +* be used in other places as long as IPsec packet offload +* active. +*/ +MLX5_SET (ipsec_obj, obj, aso_return_reg,MLX5_IPSEC_ASO_REG_C_4_5 ); +if (attrs->dir ==XFRM_DEV_OFFLOAD_OUT ) +MLX5_SET (ipsec_aso, aso_ctx, mode,MLX5_IPSEC_ASO_INC_SN ); +} +static int mlx5_create_ipsec_obj (struct mlx5e_ipsec_sa_entry *sa_entry) {struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs;
@@ -61,6 +93,7 @@ static int mlx5_create_ipsec_obj(struct mlx5e_ipsec_sa_entry *sa_entry)u32 out[MLX5_ST_SZ_DW (general_obj_out_cmd_hdr)];u32 in[MLX5_ST_SZ_DW (create_ipsec_obj_in)] = {};void *obj, *salt_p, *salt_iv_p; +struct mlx5e_hw_objs *res;int err; obj =MLX5_ADDR_OF (create_ipsec_obj_in, in, ipsec_object);
@@ -87,6 +120,10 @@ static int mlx5_create_ipsec_obj(struct mlx5e_ipsec_sa_entry *sa_entry)MLX5_SET (general_obj_in_cmd_hdr, in, obj_type,MLX5_GENERAL_OBJECT_TYPES_IPSEC ); + res = &mdev->mlx5e_res.hw_objs; +if (attrs->type ==XFRM_DEV_OFFLOAD_PACKET ) +mlx5e_ipsec_packet_setup (obj, res->pdn, attrs); + err =mlx5_cmd_exec (mdev, in,sizeof (in), out,sizeof (out));if (!err) sa_entry->ipsec_obj_id =
Signature · 1 line
2.38.1
PATCH 11/16 net/mlx5e: Move IPsec flow table creation to separate function
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Even now, to support IPsec crypto, the RX and TX paths use same logic to create flow tables. In the following patches, we will add more tables to support IPsec packet offload. So reuse existing code and rewrite it to support IPsec packet offload from the beginning.
Reviewed-by Raed Salem <[email protected]>
Reviewed-by Saeed Mahameed <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 45 ++++++++++--------- 1 file changed, 23 insertions(+), 22 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +23 -22
@@ -42,6 +42,21 @@ static enum mlx5_traffic_types family2tt(u32 family)return MLX5_TT_IPV6_IPSEC_ESP ; } +static struct mlx5_flow_table *ipsec_ft_create (struct mlx5_flow_namespace *ns, +int level,int prio, +int max_num_groups) +{ +struct mlx5_flow_table_attr ft_attr = {}; + + ft_attr.autogroup.num_reserved_entries =1 ; + ft_attr.autogroup.max_num_groups = max_num_groups; + ft_attr.max_fte =NUM_IPSEC_FTE ; + ft_attr.level = level; + ft_attr.prio = prio; + +return mlx5_create_auto_grouped_flow_table (ns, &ft_attr); +} +static int rx_err_add_rule (struct mlx5_core_dev *mdev,struct mlx5e_ipsec_rx *rx,struct mlx5e_ipsec_rx_err *rx_err)
@@ -160,17 +175,13 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, {struct mlx5_flow_namespace *ns =mlx5e_fs_get_ns (ipsec->fs, false);struct mlx5_ttc_table *ttc =mlx5e_fs_get_ttc (ipsec->fs, false); -struct mlx5_flow_table_attr ft_attr = {};struct mlx5_flow_table *ft;int err; rx->default_dest =mlx5_ttc_get_default_dest (ttc,family2tt (family)); - ft_attr.max_fte =1 ; - ft_attr.autogroup.max_num_groups =1 ; - ft_attr.level =MLX5E_ACCEL_FS_ESP_FT_ERR_LEVEL ; - ft_attr.prio =MLX5E_NIC_PRIO ; - ft =mlx5_create_auto_grouped_flow_table (ns, &ft_attr); + ft =ipsec_ft_create (ns,MLX5E_ACCEL_FS_ESP_FT_ERR_LEVEL , +MLX5E_NIC_PRIO ,1 );if (IS_ERR (ft))return PTR_ERR (ft);
@@ -180,12 +191,8 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, goto err_add;/* Create FT */ - ft_attr.max_fte =NUM_IPSEC_FTE ; - ft_attr.level =MLX5E_ACCEL_FS_ESP_FT_LEVEL ; - ft_attr.prio =MLX5E_NIC_PRIO ; - ft_attr.autogroup.num_reserved_entries =1 ; - ft_attr.autogroup.max_num_groups =1 ; - ft =mlx5_create_auto_grouped_flow_table (ns, &ft_attr); + ft =ipsec_ft_create (ns,MLX5E_ACCEL_FS_ESP_FT_LEVEL ,MLX5E_NIC_PRIO , +1 );if (IS_ERR (ft)) { err =PTR_ERR (ft); goto err_fs_ft;
@@ -273,18 +280,12 @@ static void rx_ft_put(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,/* IPsec TX flow steering */ static int tx_create (struct mlx5_core_dev *mdev,struct mlx5e_ipsec_tx *tx) { -struct mlx5_flow_table_attr ft_attr = {};struct mlx5_flow_table *ft; -int err; - ft_attr.max_fte =NUM_IPSEC_FTE ; - ft_attr.autogroup.max_num_groups =1 ; - ft =mlx5_create_auto_grouped_flow_table (tx->ns, &ft_attr); -if (IS_ERR (ft)) { - err =PTR_ERR (ft); -mlx5_core_err (mdev,"fail to create ipsec tx ft err=%d\n" , err); -return err; - } + ft =ipsec_ft_create (tx->ns,0 ,0 ,1 ); +if (IS_ERR (ft)) +return PTR_ERR (ft); + tx->ft.sa = ft;return 0 ; }
Signature · 1 line
2.38.1
PATCH 12/16 net/mlx5e: Refactor FTE setup code to be more clear
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
The policy offload logic needs to set flow steering rule that match on saddr and daddr too, so factor out this code to separate functions, together with code alignment to netdev coding pattern of relying on family type.
As part of this change, let's separate more logic from setup_fte_common to make sure that the function names describe that is done in the function better than general *common* name.
Reviewed-by Raed Salem <[email protected]>
Reviewed-by Saeed Mahameed <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 139 +++++++++++------- 1 file changed, 85 insertions(+), 54 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +85 -54
@@ -326,61 +326,78 @@ static void tx_ft_put(struct mlx5e_ipsec *ipsec)mutex_unlock (&tx->ft.mutex); } -static void setup_fte_common (struct mlx5_accel_esp_xfrm_attrs *attrs, -u32 ipsec_obj_id, -struct mlx5_flow_spec *spec, -struct mlx5_flow_act *flow_act) +static void setup_fte_addr4 (struct mlx5_flow_spec *spec,__be32 *saddr, +__be32 *daddr) { -u8 ip_version = (attrs->family ==AF_INET ) ?4 :6 ; + spec->match_criteria_enable |=MLX5_MATCH_OUTER_HEADERS ; - spec->match_criteria_enable =MLX5_MATCH_OUTER_HEADERS |MLX5_MATCH_MISC_PARAMETERS ; - -/* ip_version */ MLX5_SET_TO_ONES (fte_match_param, spec->match_criteria, outer_headers.ip_version); -MLX5_SET (fte_match_param, spec->match_value, outer_headers.ip_version, ip_version); +MLX5_SET (fte_match_param, spec->match_value, outer_headers.ip_version,4 ); + +memcpy (MLX5_ADDR_OF (fte_match_param, spec->match_value, + outer_headers.src_ipv4_src_ipv6.ipv4_layout.ipv4), saddr,4 ); +memcpy (MLX5_ADDR_OF (fte_match_param, spec->match_value, + outer_headers.dst_ipv4_dst_ipv6.ipv4_layout.ipv4), daddr,4 ); +MLX5_SET_TO_ONES (fte_match_param, spec->match_criteria, + outer_headers.src_ipv4_src_ipv6.ipv4_layout.ipv4); +MLX5_SET_TO_ONES (fte_match_param, spec->match_criteria, + outer_headers.dst_ipv4_dst_ipv6.ipv4_layout.ipv4); +} -/* Non fragmented */ -MLX5_SET_TO_ONES (fte_match_param, spec->match_criteria, outer_headers.frag); -MLX5_SET (fte_match_param, spec->match_value, outer_headers.frag,0 ); +static void setup_fte_addr6 (struct mlx5_flow_spec *spec,__be32 *saddr, +__be32 *daddr) +{ + spec->match_criteria_enable |=MLX5_MATCH_OUTER_HEADERS ; + +MLX5_SET_TO_ONES (fte_match_param, spec->match_criteria, outer_headers.ip_version); +MLX5_SET (fte_match_param, spec->match_value, outer_headers.ip_version,6 ); + +memcpy (MLX5_ADDR_OF (fte_match_param, spec->match_value, + outer_headers.src_ipv4_src_ipv6.ipv6_layout.ipv6), saddr,16 ); +memcpy (MLX5_ADDR_OF (fte_match_param, spec->match_value, + outer_headers.dst_ipv4_dst_ipv6.ipv6_layout.ipv6), daddr,16 ); +memset (MLX5_ADDR_OF (fte_match_param, spec->match_criteria, + outer_headers.src_ipv4_src_ipv6.ipv6_layout.ipv6),0xff ,16 ); +memset (MLX5_ADDR_OF (fte_match_param, spec->match_criteria, + outer_headers.dst_ipv4_dst_ipv6.ipv6_layout.ipv6),0xff ,16 ); +} +static void setup_fte_esp (struct mlx5_flow_spec *spec) +{/* ESP header */ + spec->match_criteria_enable |=MLX5_MATCH_MISC_PARAMETERS ; +MLX5_SET_TO_ONES (fte_match_param, spec->match_criteria, outer_headers.ip_protocol);MLX5_SET (fte_match_param, spec->match_value, outer_headers.ip_protocol,IPPROTO_ESP ); +} +static void setup_fte_spi (struct mlx5_flow_spec *spec,u32 spi) +{/* SPI number */ + spec->match_criteria_enable |=MLX5_MATCH_MISC_PARAMETERS ; +MLX5_SET_TO_ONES (fte_match_param, spec->match_criteria, misc_parameters.outer_esp_spi); -MLX5_SET (fte_match_param, spec->match_value, - misc_parameters.outer_esp_spi, attrs->spi); - -if (ip_version ==4 ) { -memcpy (MLX5_ADDR_OF (fte_match_param, spec->match_value, - outer_headers.src_ipv4_src_ipv6.ipv4_layout.ipv4), - &attrs->saddr.a4,4 ); -memcpy (MLX5_ADDR_OF (fte_match_param, spec->match_value, - outer_headers.dst_ipv4_dst_ipv6.ipv4_layout.ipv4), - &attrs->daddr.a4,4 ); -MLX5_SET_TO_ONES (fte_match_param, spec->match_criteria, - outer_headers.src_ipv4_src_ipv6.ipv4_layout.ipv4); -MLX5_SET_TO_ONES (fte_match_param, spec->match_criteria, - outer_headers.dst_ipv4_dst_ipv6.ipv4_layout.ipv4); - }else { -memcpy (MLX5_ADDR_OF (fte_match_param, spec->match_value, - outer_headers.src_ipv4_src_ipv6.ipv6_layout.ipv6), - &attrs->saddr.a6,16 ); -memcpy (MLX5_ADDR_OF (fte_match_param, spec->match_value, - outer_headers.dst_ipv4_dst_ipv6.ipv6_layout.ipv6), - &attrs->daddr.a6,16 ); -memset (MLX5_ADDR_OF (fte_match_param, spec->match_criteria, - outer_headers.src_ipv4_src_ipv6.ipv6_layout.ipv6), -0xff ,16 ); -memset (MLX5_ADDR_OF (fte_match_param, spec->match_criteria, - outer_headers.dst_ipv4_dst_ipv6.ipv6_layout.ipv6), -0xff ,16 ); - } +MLX5_SET (fte_match_param, spec->match_value, misc_parameters.outer_esp_spi, spi); +} - flow_act->crypto.type =MLX5_FLOW_CONTEXT_ENCRYPT_DECRYPT_TYPE_IPSEC ; - flow_act->crypto.obj_id = ipsec_obj_id; - flow_act->flags |=FLOW_ACT_NO_APPEND ; +static void setup_fte_no_frags (struct mlx5_flow_spec *spec) +{ +/* Non fragmented */ + spec->match_criteria_enable |=MLX5_MATCH_OUTER_HEADERS ; + +MLX5_SET_TO_ONES (fte_match_param, spec->match_criteria, outer_headers.frag); +MLX5_SET (fte_match_param, spec->match_value, outer_headers.frag,0 ); +} + +static void setup_fte_reg_a (struct mlx5_flow_spec *spec) +{ +/* Add IPsec indicator in metadata_reg_a */ + spec->match_criteria_enable |=MLX5_MATCH_MISC_PARAMETERS_2 ; + +MLX5_SET (fte_match_param, spec->match_criteria, + misc_parameters_2.metadata_reg_a,MLX5_ETH_WQE_FT_META_IPSEC ); +MLX5_SET (fte_match_param, spec->match_value, + misc_parameters_2.metadata_reg_a,MLX5_ETH_WQE_FT_META_IPSEC ); }static int rx_add_rule (struct mlx5e_ipsec_sa_entry *sa_entry)
@@ -390,7 +407,6 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs;struct mlx5_core_dev *mdev =mlx5e_ipsec_sa2dev (sa_entry);struct mlx5e_ipsec *ipsec = sa_entry->ipsec; -u32 ipsec_obj_id = sa_entry->ipsec_obj_id;struct mlx5_modify_hdr *modify_hdr =NULL ;struct mlx5_flow_destination dest = {};struct mlx5_flow_act flow_act = {};
@@ -409,13 +425,21 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) goto out_err; } -setup_fte_common (attrs, ipsec_obj_id, spec, &flow_act); +if (attrs->family ==AF_INET ) +setup_fte_addr4 (spec, &attrs->saddr.a4, &attrs->daddr.a4); +else +setup_fte_addr6 (spec, attrs->saddr.a6, attrs->daddr.a6); + +setup_fte_spi (spec, attrs->spi); +setup_fte_esp (spec); +setup_fte_no_frags (spec);/* Set bit[31] ipsec marker */ /* Set bit[23-0] ipsec_obj_id */ MLX5_SET (set_action_in, action, action_type,MLX5_ACTION_TYPE_SET );MLX5_SET (set_action_in, action, field,MLX5_ACTION_IN_FIELD_METADATA_REG_B ); -MLX5_SET (set_action_in, action, data, (ipsec_obj_id |BIT (31 ))); +MLX5_SET (set_action_in, action, data, + (sa_entry->ipsec_obj_id |BIT (31 )));MLX5_SET (set_action_in, action, offset,0 );MLX5_SET (set_action_in, action, length,32 );
@@ -429,6 +453,9 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) goto out_err; } + flow_act.crypto.type =MLX5_FLOW_CONTEXT_ENCRYPT_DECRYPT_TYPE_IPSEC ; + flow_act.crypto.obj_id = sa_entry->ipsec_obj_id; + flow_act.flags |=FLOW_ACT_NO_APPEND ; flow_act.action =MLX5_FLOW_CONTEXT_ACTION_FWD_DEST |MLX5_FLOW_CONTEXT_ACTION_CRYPTO_DECRYPT |MLX5_FLOW_CONTEXT_ACTION_MOD_HDR ;
@@ -458,6 +485,7 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)static int tx_add_rule (struct mlx5e_ipsec_sa_entry *sa_entry) { +struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs;struct mlx5_core_dev *mdev =mlx5e_ipsec_sa2dev (sa_entry);struct mlx5e_ipsec *ipsec = sa_entry->ipsec;struct mlx5_flow_act flow_act = {};
@@ -476,16 +504,19 @@ static int tx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) goto out; } -setup_fte_common (&sa_entry->attrs, sa_entry->ipsec_obj_id, spec, - &flow_act); +if (attrs->family ==AF_INET ) +setup_fte_addr4 (spec, &attrs->saddr.a4, &attrs->daddr.a4); +else +setup_fte_addr6 (spec, attrs->saddr.a6, attrs->daddr.a6); -/* Add IPsec indicator in metadata_reg_a */ - spec->match_criteria_enable |=MLX5_MATCH_MISC_PARAMETERS_2 ; -MLX5_SET (fte_match_param, spec->match_criteria, misc_parameters_2.metadata_reg_a, -MLX5_ETH_WQE_FT_META_IPSEC ); -MLX5_SET (fte_match_param, spec->match_value, misc_parameters_2.metadata_reg_a, -MLX5_ETH_WQE_FT_META_IPSEC ); +setup_fte_spi (spec, attrs->spi); +setup_fte_esp (spec); +setup_fte_no_frags (spec); +setup_fte_reg_a (spec); + flow_act.crypto.type =MLX5_FLOW_CONTEXT_ENCRYPT_DECRYPT_TYPE_IPSEC ; + flow_act.crypto.obj_id = sa_entry->ipsec_obj_id; + flow_act.flags |=FLOW_ACT_NO_APPEND ; flow_act.action =MLX5_FLOW_CONTEXT_ACTION_ALLOW |MLX5_FLOW_CONTEXT_ACTION_CRYPTO_ENCRYPT ; rule =mlx5_add_flow_rules (tx->ft.sa, spec, &flow_act,NULL ,0 );
Signature · 1 line
2.38.1
PATCH 13/16 net/mlx5e: Flatten the IPsec RX add rule path
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Rewrote the IPsec RX add rule path to be less convoluted and don't rely on pre-initialized variables. The code now has clean linear flow with clean separation between error and success paths.
Reviewed-by Raed Salem <[email protected]>
Reviewed-by Saeed Mahameed <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- .../mellanox/mlx5/core/en_accel/ipsec.h | 2 +- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 88 +++++++++++-------- 2 files changed, 53 insertions(+), 37 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +1 -1
@@ -126,7 +126,7 @@ struct mlx5e_ipsec_esn_state {struct mlx5e_ipsec_rule {struct mlx5_flow_handle *rule; -struct mlx5_modify_hdr *set_modify_hdr; +struct mlx5_modify_hdr *modify_hdr; };struct mlx5e_ipsec_modify_state_work {
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +52 -36
138 lines not on this page · raw message
Signature · 1 line
2.38.1
PATCH 14/16 net/mlx5e: Make clear what IPsec rx_err does
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Reuse existing struct what holds all information about modify header pointer and rule. This helps to reduce ambiguity from the name _err_ that doesn't describe the real purpose of that flow table, rule and function - to copy status result from HW to the stack.
Reviewed-by Saeed Mahameed <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 38 ++++++++----------- 1 file changed, 16 insertions(+), 22 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +16 -22
@@ -9,15 +9,10 @@#define NUM_IPSEC_FTE BIT(15) -struct mlx5e_ipsec_rx_err { -struct mlx5_flow_table *ft; -struct mlx5_flow_handle *rule; -struct mlx5_modify_hdr *copy_modify_hdr; -}; -struct mlx5e_ipsec_ft {struct mutex mutex;/* Protect changes to this struct */ struct mlx5_flow_table *sa; +struct mlx5_flow_table *status;u32 refcnt; };
@@ -26,7 +21,7 @@ struct mlx5e_ipsec_rx {struct mlx5_flow_group *miss_group;struct mlx5_flow_handle *miss_rule;struct mlx5_flow_destination default_dest; -struct mlx5e_ipsec_rx_err rx_err; +struct mlx5e_ipsec_rule status; };struct mlx5e_ipsec_tx {
@@ -57,9 +52,8 @@ static struct mlx5_flow_table *ipsec_ft_create(struct mlx5_flow_namespace *ns,return mlx5_create_auto_grouped_flow_table (ns, &ft_attr); } -static int rx_err_add_rule (struct mlx5_core_dev *mdev, -struct mlx5e_ipsec_rx *rx, -struct mlx5e_ipsec_rx_err *rx_err) +static int ipsec_status_rule (struct mlx5_core_dev *mdev, +struct mlx5e_ipsec_rx *rx) {u8 action[MLX5_UN_SZ_BYTES (set_add_copy_action_in_auto)] = {};struct mlx5_flow_act flow_act = {};
@@ -94,7 +88,7 @@ static int rx_err_add_rule(struct mlx5_core_dev *mdev, flow_act.action =MLX5_FLOW_CONTEXT_ACTION_MOD_HDR |MLX5_FLOW_CONTEXT_ACTION_FWD_DEST ; flow_act.modify_hdr = modify_hdr; - fte =mlx5_add_flow_rules (rx_err->ft, spec, &flow_act, + fte =mlx5_add_flow_rules (rx->ft.status, spec, &flow_act, &rx->default_dest,1 );if (IS_ERR (fte)) { err =PTR_ERR (fte);
@@ -103,8 +97,8 @@ static int rx_err_add_rule(struct mlx5_core_dev *mdev, }kvfree (spec); - rx_err->rule = fte; - rx_err->copy_modify_hdr = modify_hdr; + rx->status.rule = fte; + rx->status.modify_hdr = modify_hdr;return 0 ; out:
@@ -165,9 +159,9 @@ static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_rx *rx)mlx5_destroy_flow_group (rx->miss_group);mlx5_destroy_flow_table (rx->ft.sa); -mlx5_del_flow_rules (rx->rx_err.rule); -mlx5_modify_header_dealloc (mdev, rx->rx_err.copy_modify_hdr); -mlx5_destroy_flow_table (rx->rx_err.ft); +mlx5_del_flow_rules (rx->status.rule); +mlx5_modify_header_dealloc (mdev, rx->status.modify_hdr); +mlx5_destroy_flow_table (rx->ft.status); } static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,
@@ -185,8 +179,8 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,if (IS_ERR (ft))return PTR_ERR (ft); - rx->rx_err.ft = ft; - err =rx_err_add_rule (mdev, rx, &rx->rx_err); + rx->ft.status = ft; + err =ipsec_status_rule (mdev, rx);if (err) goto err_add;
@@ -208,10 +202,10 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, err_fs:mlx5_destroy_flow_table (rx->ft.sa); err_fs_ft: -mlx5_del_flow_rules (rx->rx_err.rule); -mlx5_modify_header_dealloc (mdev, rx->rx_err.copy_modify_hdr); +mlx5_del_flow_rules (rx->status.rule); +mlx5_modify_header_dealloc (mdev, rx->status.modify_hdr); err_add: -mlx5_destroy_flow_table (rx->rx_err.ft); +mlx5_destroy_flow_table (rx->ft.status);return err; }
@@ -477,7 +471,7 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) flow_act.action |=MLX5_FLOW_CONTEXT_ACTION_FWD_DEST |MLX5_FLOW_CONTEXT_ACTION_CRYPTO_DECRYPT ; dest.type =MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE ; - dest.ft = rx->rx_err.ft; + dest.ft = rx->ft.status; rule =mlx5_add_flow_rules (rx->ft.sa, spec, &flow_act, &dest,1 );if (IS_ERR (rule)) { err =PTR_ERR (rule);
Signature · 1 line
2.38.1
PATCH 15/16 net/mlx5e: Group IPsec miss handles into separate struct
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Move miss handles into dedicated struct, so we can reuse it in next patch when creating IPsec policy flow table.
Reviewed-by Raed Salem <[email protected]>
Reviewed-by Saeed Mahameed <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +11 -7
@@ -16,10 +16,14 @@ struct mlx5e_ipsec_ft {u32 refcnt; }; +struct mlx5e_ipsec_miss { +struct mlx5_flow_group *group; +struct mlx5_flow_handle *rule; +}; +struct mlx5e_ipsec_rx {struct mlx5e_ipsec_ft ft; -struct mlx5_flow_group *miss_group; -struct mlx5_flow_handle *miss_rule; +struct mlx5e_ipsec_miss sa;struct mlx5_flow_destination default_dest;struct mlx5e_ipsec_rule status; };
@@ -135,18 +139,18 @@ static int rx_fs_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_rx *rx)mlx5_core_err (mdev,"fail to create ipsec rx miss_group err=%d\n" , err); goto out; } - rx->miss_group = miss_group; + rx->sa.group = miss_group;/* Create miss rule */ miss_rule =mlx5_add_flow_rules (ft, spec, &flow_act, &rx->default_dest,1 );if (IS_ERR (miss_rule)) { -mlx5_destroy_flow_group (rx->miss_group); +mlx5_destroy_flow_group (rx->sa.group); err =PTR_ERR (miss_rule);mlx5_core_err (mdev,"fail to create ipsec rx miss_rule err=%d\n" , err); goto out; } - rx->miss_rule = miss_rule; + rx->sa.rule = miss_rule; out:kvfree (flow_group_in);kvfree (spec);
@@ -155,8 +159,8 @@ static int rx_fs_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_rx *rx)static void rx_destroy (struct mlx5_core_dev *mdev,struct mlx5e_ipsec_rx *rx) { -mlx5_del_flow_rules (rx->miss_rule); -mlx5_destroy_flow_group (rx->miss_group); +mlx5_del_flow_rules (rx->sa.rule); +mlx5_destroy_flow_group (rx->sa.group);mlx5_destroy_flow_table (rx->ft.sa);mlx5_del_flow_rules (rx->status.rule);
Signature · 1 line
2.38.1
PATCH 16/16 net/mlx5e: Generalize creation of default IPsec miss group and rule
In reply to Leon RomanovskyFrom: Leon Romanovsky <[email protected]>
Create general function that sets miss group and rule to forward all not-matched traffic to the next table.
Reviewed-by Raed Salem <[email protected]>
Reviewed-by Saeed Mahameed <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
--- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 47 +++++++++---------- 1 file changed, 23 insertions(+), 24 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +23 -24
@@ -24,7 +24,6 @@ struct mlx5e_ipsec_miss {struct mlx5e_ipsec_rx {struct mlx5e_ipsec_ft ft;struct mlx5e_ipsec_miss sa; -struct mlx5_flow_destination default_dest;struct mlx5e_ipsec_rule status; };
@@ -57,7 +56,8 @@ static struct mlx5_flow_table *ipsec_ft_create(struct mlx5_flow_namespace *ns, }static int ipsec_status_rule (struct mlx5_core_dev *mdev, -struct mlx5e_ipsec_rx *rx) +struct mlx5e_ipsec_rx *rx, +struct mlx5_flow_destination *dest) {u8 action[MLX5_UN_SZ_BYTES (set_add_copy_action_in_auto)] = {};struct mlx5_flow_act flow_act = {};
@@ -92,8 +92,7 @@ static int ipsec_status_rule(struct mlx5_core_dev *mdev, flow_act.action =MLX5_FLOW_CONTEXT_ACTION_MOD_HDR |MLX5_FLOW_CONTEXT_ACTION_FWD_DEST ; flow_act.modify_hdr = modify_hdr; - fte =mlx5_add_flow_rules (rx->ft.status, spec, &flow_act, - &rx->default_dest,1 ); + fte =mlx5_add_flow_rules (rx->ft.status, spec, &flow_act, dest,1 );if (IS_ERR (fte)) { err =PTR_ERR (fte);mlx5_core_err (mdev,"fail to add ipsec rx err copy rule err=%d\n" , err);
@@ -112,12 +111,12 @@ static int ipsec_status_rule(struct mlx5_core_dev *mdev,return err; } -static int rx_fs_create (struct mlx5_core_dev *mdev,struct mlx5e_ipsec_rx *rx) +static int ipsec_miss_create (struct mlx5_core_dev *mdev, +struct mlx5_flow_table *ft, +struct mlx5e_ipsec_miss *miss, +struct mlx5_flow_destination *dest) {int inlen =MLX5_ST_SZ_BYTES (create_flow_group_in); -struct mlx5_flow_table *ft = rx->ft.sa; -struct mlx5_flow_group *miss_group; -struct mlx5_flow_handle *miss_rule;MLX5_DECLARE_FLOW_ACT (flow_act);struct mlx5_flow_spec *spec;u32 *flow_group_in;
@@ -133,24 +132,23 @@ static int rx_fs_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_rx *rx)/* Create miss_group */ MLX5_SET (create_flow_group_in, flow_group_in, start_flow_index, ft->max_fte -1 );MLX5_SET (create_flow_group_in, flow_group_in, end_flow_index, ft->max_fte -1 ); - miss_group =mlx5_create_flow_group (ft, flow_group_in); -if (IS_ERR (miss_group)) { - err =PTR_ERR (miss_group); -mlx5_core_err (mdev,"fail to create ipsec rx miss_group err=%d\n" , err); + miss->group =mlx5_create_flow_group (ft, flow_group_in); +if (IS_ERR (miss->group)) { + err =PTR_ERR (miss->group); +mlx5_core_err (mdev,"fail to create IPsec miss_group err=%d\n" , + err); goto out; } - rx->sa.group = miss_group;/* Create miss rule */ - miss_rule = -mlx5_add_flow_rules (ft, spec, &flow_act, &rx->default_dest,1 ); -if (IS_ERR (miss_rule)) { -mlx5_destroy_flow_group (rx->sa.group); - err =PTR_ERR (miss_rule); -mlx5_core_err (mdev,"fail to create ipsec rx miss_rule err=%d\n" , err); + miss->rule =mlx5_add_flow_rules (ft, spec, &flow_act, dest,1 ); +if (IS_ERR (miss->rule)) { +mlx5_destroy_flow_group (miss->group); + err =PTR_ERR (miss->rule); +mlx5_core_err (mdev,"fail to create IPsec miss_rule err=%d\n" , + err); goto out; } - rx->sa.rule = miss_rule; out:kvfree (flow_group_in);kvfree (spec);
@@ -173,18 +171,19 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, {struct mlx5_flow_namespace *ns =mlx5e_fs_get_ns (ipsec->fs, false);struct mlx5_ttc_table *ttc =mlx5e_fs_get_ttc (ipsec->fs, false); +struct mlx5_flow_destination dest;struct mlx5_flow_table *ft;int err; - rx->default_dest =mlx5_ttc_get_default_dest (ttc,family2tt (family)); - ft =ipsec_ft_create (ns,MLX5E_ACCEL_FS_ESP_FT_ERR_LEVEL ,MLX5E_NIC_PRIO ,1 );if (IS_ERR (ft))return PTR_ERR (ft); rx->ft.status = ft; - err =ipsec_status_rule (mdev, rx); + + dest =mlx5_ttc_get_default_dest (ttc,family2tt (family)); + err =ipsec_status_rule (mdev, rx, &dest);if (err) goto err_add;
@@ -197,7 +196,7 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, } rx->ft.sa = ft; - err =rx_fs_create (mdev, rx); + err =ipsec_miss_create (mdev, rx->ft.sa, &rx->sa, &dest);if (err) goto err_fs;
Signature · 1 line
2.38.1
Quoted 23 lines · Leon Romanovsky
From: Leon Romanovsky <[email protected]>
Hi,
This series follows previously sent "Extend XFRM core to allow packet offload configuration" series [1].
It is first part with refactoring to mlx5 allow us natively extend mlx5 IPsec logic to support both crypto and packet offloads.
Thanks
[1] https://lore.kernel.org/all/[email protected]
Leon Romanovsky (16):
net/mlx5: Return ready to use ASO WQE
net/mlx5: Add HW definitions for IPsec packet offload net/mlx5e: Advertise IPsec packet offload support net/mlx5e: Store replay window in XFRM attributes net/mlx5e: Remove extra layers of defines
net/mlx5e: Create symmetric IPsec RX and TX flow steering structs net/mlx5e: Use mlx5 print routines for low level IPsec code net/mlx5e: Remove accesses to priv for low level IPsec FS code
Quoted 8 lines
net/mlx5e: Create Advanced Steering Operation object for IPsec net/mlx5e: Create hardware IPsec packet offload objects net/mlx5e: Move IPsec flow table creation to separate function net/mlx5e: Refactor FTE setup code to be more clear net/mlx5e: Flatten the IPsec RX add rule path
net/mlx5e: Make clear what IPsecrx_errdoes
net/mlx5e: Group IPsec miss handles into separate struct net/mlx5e: Generalize creation of default IPsec miss group and rule
Series applied, thanks Leon!