diff mbox series

[mlx5-next,09/14] net/mlx5: Configure MACsec steering for egress RoCEv2 traffic

Message ID 4e114bd19fe2cd8732c0efffa2f0f90d1dc5ec44.1691403485.git.leon@kernel.org (mailing list archive)
State Superseded
Delegated to: Netdev Maintainers
Headers show
Series mlx5 MACsec RoCEv2 support | expand

Checks

Context Check Description
netdev/series_format success Posting correctly formatted
netdev/tree_selection success Guessed tree name to be net-next, async
netdev/fixes_present success Fixes tag not required for -next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit fail Errors and warnings before: 1331 this patch: 20
netdev/cc_maintainers success CCed 10 of 10 maintainers
netdev/build_clang fail Errors and warnings before: 1353 this patch: 21
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn fail Errors and warnings before: 1354 this patch: 20
netdev/checkpatch warning WARNING: line length of 99 exceeds 80 columns
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0

Commit Message

Leon Romanovsky Aug. 7, 2023, 10:44 a.m. UTC 
From: Patrisious Haddad <phaddad@nvidia.com>

Add steering table in RDMA_TX domain, to forward MACsec traffic
to MACsec crypto table in NIC domain.
The tables are created in a lazy manner when the first TX SA is
being created, and destroyed upon the destruction of the last SA.

Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 .../mellanox/mlx5/core/lib/macsec_fs.c        | 46 ++++++++++++++++++-
 1 file changed, 45 insertions(+), 1 deletion(-)

Comments

Simon Horman Aug. 8, 2023, 3:18 p.m. UTC | #1 
On Mon, Aug 07, 2023 at 01:44:18PM +0300, Leon Romanovsky wrote:
> From: Patrisious Haddad <phaddad@nvidia.com>
> 
> Add steering table in RDMA_TX domain, to forward MACsec traffic
> to MACsec crypto table in NIC domain.
> The tables are created in a lazy manner when the first TX SA is
> being created, and destroyed upon the destruction of the last SA.
> 
> Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> ---
>  .../mellanox/mlx5/core/lib/macsec_fs.c        | 46 ++++++++++++++++++-
>  1 file changed, 45 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c
> index d39ca7c66542..15e7ea3ed79f 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c
> @@ -95,6 +95,8 @@ struct mlx5_macsec_tx {
>  	struct ida tx_halloc;
>  
>  	struct mlx5_macsec_tables tables;
> +
> +	struct mlx5_flow_table *ft_rdma_tx;
>  };
>  
>  struct mlx5_macsec_rx_rule {
> @@ -173,6 +175,9 @@ static void macsec_fs_tx_destroy(struct mlx5_macsec_fs *macsec_fs)
>  	struct mlx5_macsec_tx *tx_fs = macsec_fs->tx_fs;
>  	struct mlx5_macsec_tables *tx_tables;
>  
> +	if (mlx5_is_macsec_roce_supported(macsec_fs->mdev))
> +		mlx5_destroy_flow_table(tx_fs->ft_rdma_tx);

Hi Patrisious and Leon,

mlx5_is_macsec_roce_supported() is used here, but it doesn't seem
to be added until a later in this series.

...
Leon Romanovsky Aug. 8, 2023, 5:41 p.m. UTC | #2 
On Tue, Aug 08, 2023 at 05:18:03PM +0200, Simon Horman wrote:
> On Mon, Aug 07, 2023 at 01:44:18PM +0300, Leon Romanovsky wrote:
> > From: Patrisious Haddad <phaddad@nvidia.com>
> > 
> > Add steering table in RDMA_TX domain, to forward MACsec traffic
> > to MACsec crypto table in NIC domain.
> > The tables are created in a lazy manner when the first TX SA is
> > being created, and destroyed upon the destruction of the last SA.
> > 
> > Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
> > Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> > ---
> >  .../mellanox/mlx5/core/lib/macsec_fs.c        | 46 ++++++++++++++++++-
> >  1 file changed, 45 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c
> > index d39ca7c66542..15e7ea3ed79f 100644
> > --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c
> > +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c
> > @@ -95,6 +95,8 @@ struct mlx5_macsec_tx {
> >  	struct ida tx_halloc;
> >  
> >  	struct mlx5_macsec_tables tables;
> > +
> > +	struct mlx5_flow_table *ft_rdma_tx;
> >  };
> >  
> >  struct mlx5_macsec_rx_rule {
> > @@ -173,6 +175,9 @@ static void macsec_fs_tx_destroy(struct mlx5_macsec_fs *macsec_fs)
> >  	struct mlx5_macsec_tx *tx_fs = macsec_fs->tx_fs;
> >  	struct mlx5_macsec_tables *tx_tables;
> >  
> > +	if (mlx5_is_macsec_roce_supported(macsec_fs->mdev))
> > +		mlx5_destroy_flow_table(tx_fs->ft_rdma_tx);
> 
> Hi Patrisious and Leon,
> 
> mlx5_is_macsec_roce_supported() is used here, but it doesn't seem
> to be added until a later in this series.

It is my fault, I reordered patches prior to submission and didn't
compile them separately.

Thanks

> 
> ...
diff mbox series

Patch

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c
index d39ca7c66542..15e7ea3ed79f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c
@@ -95,6 +95,8 @@  struct mlx5_macsec_tx {
 	struct ida tx_halloc;
 
 	struct mlx5_macsec_tables tables;
+
+	struct mlx5_flow_table *ft_rdma_tx;
 };
 
 struct mlx5_macsec_rx_rule {
@@ -173,6 +175,9 @@  static void macsec_fs_tx_destroy(struct mlx5_macsec_fs *macsec_fs)
 	struct mlx5_macsec_tx *tx_fs = macsec_fs->tx_fs;
 	struct mlx5_macsec_tables *tx_tables;
 
+	if (mlx5_is_macsec_roce_supported(macsec_fs->mdev))
+		mlx5_destroy_flow_table(tx_fs->ft_rdma_tx);
+
 	tx_tables = &tx_fs->tables;
 
 	/* Tx check table */
@@ -301,6 +306,39 @@  static struct mlx5_flow_table
 	return fdb;
 }
 
+enum {
+	RDMA_TX_MACSEC_LEVEL = 0,
+};
+
+static int macsec_fs_tx_roce_create(struct mlx5_macsec_fs *macsec_fs)
+{
+	struct mlx5_macsec_tx *tx_fs = macsec_fs->tx_fs;
+	struct mlx5_core_dev *mdev = macsec_fs->mdev;
+	struct mlx5_flow_namespace *ns;
+	struct mlx5_flow_table *ft;
+	int err;
+
+	if (!mlx5_is_macsec_roce_supported(mdev)) {
+		mlx5_core_dbg(mdev, "Failed to init RoCE MACsec, capabilities not supported\n");
+		return 0;
+	}
+
+	ns = mlx5_get_flow_namespace(mdev, MLX5_FLOW_NAMESPACE_RDMA_TX_MACSEC);
+	if (!ns)
+		return -ENOMEM;
+
+	/* Tx RoCE crypto table  */
+	ft = macsec_fs_auto_group_table_create(ns, 0, RDMA_TX_MACSEC_LEVEL, CRYPTO_NUM_MAXSEC_FTE);
+	if (IS_ERR(ft)) {
+		err = PTR_ERR(ft);
+		mlx5_core_err(mdev, "Failed to create MACsec RoCE Tx crypto table err(%d)\n", err);
+		return err;
+	}
+	tx_fs->ft_rdma_tx = ft;
+
+	return 0;
+}
+
 static int macsec_fs_tx_create(struct mlx5_macsec_fs *macsec_fs)
 {
 	int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in);
@@ -443,7 +481,13 @@  static int macsec_fs_tx_create(struct mlx5_macsec_fs *macsec_fs)
 	}
 	tx_fs->check_rule = rule;
 
-	goto out_flow_group;
+	err = macsec_fs_tx_roce_create(macsec_fs);
+	if (err)
+		goto err;
+
+	kvfree(flow_group_in);
+	kvfree(spec);
+	return 0;
 
 err:
 	macsec_fs_tx_destroy(macsec_fs);