diff mbox series

[net-next,v1,04/10] net/mlx5e: Prepare IPsec packet reformat code for tunnel mode

Message ID f9e31cf8ff6a60ea4eb714c93e5fad7fbd56b860.1681388425.git.leonro@nvidia.com (mailing list archive)
State Accepted
Commit 6480a3b6c90a8d2b765f802a4f30829bd539599a
Delegated to: Netdev Maintainers
Headers show
Series Support tunnel mode in mlx5 IPsec packet offload | expand

Checks

Context Check Description
netdev/series_format success Posting correctly formatted
netdev/tree_selection success Clearly marked for net-next, async
netdev/fixes_present success Fixes tag not required for -next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 18 this patch: 18
netdev/cc_maintainers warning 2 maintainers not CCed: linux-rdma@vger.kernel.org borisp@nvidia.com
netdev/build_clang success Errors and warnings before: 18 this patch: 18
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 18 this patch: 18
netdev/checkpatch success total: 0 errors, 0 warnings, 0 checks, 122 lines checked
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0

Commit Message

Leon Romanovsky April 13, 2023, 12:29 p.m. UTC 
From: Leon Romanovsky <leonro@nvidia.com>

Refactor setup_pkt_reformat() function to accommodate future extension
to support tunnel mode.

Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 .../mellanox/mlx5/core/en_accel/ipsec.c       |  1 +
 .../mellanox/mlx5/core/en_accel/ipsec.h       |  2 +-
 .../mellanox/mlx5/core/en_accel/ipsec_fs.c    | 81 ++++++++++++++-----
 3 files changed, 63 insertions(+), 21 deletions(-)

Comments

Samudrala, Sridhar April 14, 2023, 10:40 p.m. UTC | #1 
On 4/13/2023 7:29 AM, Leon Romanovsky wrote:
> From: Leon Romanovsky <leonro@nvidia.com>
> 
> Refactor setup_pkt_reformat() function to accommodate future extension
> to support tunnel mode.
> 
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> ---
>   .../mellanox/mlx5/core/en_accel/ipsec.c       |  1 +
>   .../mellanox/mlx5/core/en_accel/ipsec.h       |  2 +-
>   .../mellanox/mlx5/core/en_accel/ipsec_fs.c    | 81 ++++++++++++++-----
>   3 files changed, 63 insertions(+), 21 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> index def01bfde610..359da277c03a 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> @@ -297,6 +297,7 @@ void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry,
>   	attrs->upspec.sport = ntohs(x->sel.sport);
>   	attrs->upspec.sport_mask = ntohs(x->sel.sport_mask);
>   	attrs->upspec.proto = x->sel.proto;
> +	attrs->mode = x->props.mode;
>   
>   	mlx5e_ipsec_init_limits(sa_entry, attrs);
>   }
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
> index bb89e18b17b4..ae525420a492 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
> @@ -77,7 +77,7 @@ struct mlx5_replay_esn {
>   
>   struct mlx5_accel_esp_xfrm_attrs {
>   	u32   spi;
> -	u32   flags;
> +	u32   mode;
>   	struct aes_gcm_keymat aes_gcm;
>   
>   	union {
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
> index 060be020ca64..6a1ed4114054 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
> @@ -10,6 +10,7 @@
>   #include "lib/fs_chains.h"
>   
>   #define NUM_IPSEC_FTE BIT(15)
> +#define MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_SIZE 16
>   
>   struct mlx5e_ipsec_fc {
>   	struct mlx5_fc *cnt;
> @@ -836,40 +837,80 @@ static int setup_modify_header(struct mlx5_core_dev *mdev, u32 val, u8 dir,
>   	return 0;
>   }
>   
> +static int
> +setup_pkt_transport_reformat(struct mlx5_accel_esp_xfrm_attrs *attrs,
> +			     struct mlx5_pkt_reformat_params *reformat_params)
> +{
> +	u8 *reformatbf;
> +	__be32 spi;
> +
> +	switch (attrs->dir) {
> +	case XFRM_DEV_OFFLOAD_IN:
> +		reformat_params->type = MLX5_REFORMAT_TYPE_DEL_ESP_TRANSPORT;
> +		break;
> +	case XFRM_DEV_OFFLOAD_OUT:
> +		if (attrs->family == AF_INET)
> +			reformat_params->type =
> +				MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV4;
> +		else
> +			reformat_params->type =
> +				MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV6;

Is it guaranteed that attrs->family will be either AF_INET or AF_INET6?
Later patches seem to indicate that this may not be true as they use
switch statement and includes default case


> +
> +		reformatbf = kzalloc(MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_SIZE,
> +				     GFP_KERNEL);
> +		if (!reformatbf)
> +			return -ENOMEM;
> +
> +		/* convert to network format */
> +		spi = htonl(attrs->spi);
> +		memcpy(reformatbf, &spi, sizeof(spi));
> +
> +		reformat_params->param_0 = attrs->authsize;
> +		reformat_params->size =
> +			MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_SIZE;
> +		reformat_params->data = reformatbf;
> +		break;
> +	default:
> +		return -EINVAL;
> +	}
> +
> +	return 0;
> +}
> +
>   static int setup_pkt_reformat(struct mlx5_core_dev *mdev,
>   			      struct mlx5_accel_esp_xfrm_attrs *attrs,
>   			      struct mlx5_flow_act *flow_act)
>   {
> -	enum mlx5_flow_namespace_type ns_type = MLX5_FLOW_NAMESPACE_EGRESS;
>   	struct mlx5_pkt_reformat_params reformat_params = {};
>   	struct mlx5_pkt_reformat *pkt_reformat;
> -	u8 reformatbf[16] = {};
> -	__be32 spi;
> +	enum mlx5_flow_namespace_type ns_type;
> +	int ret;
>   
> -	if (attrs->dir == XFRM_DEV_OFFLOAD_IN) {
> -		reformat_params.type = MLX5_REFORMAT_TYPE_DEL_ESP_TRANSPORT;
> +	switch (attrs->dir) {
> +	case XFRM_DEV_OFFLOAD_IN:
>   		ns_type = MLX5_FLOW_NAMESPACE_KERNEL;
> -		goto cmd;
> +		break;
> +	case XFRM_DEV_OFFLOAD_OUT:
> +		ns_type = MLX5_FLOW_NAMESPACE_EGRESS;
> +		break;
> +	default:
> +		return -EINVAL;
>   	}
>   
> -	if (attrs->family == AF_INET)
> -		reformat_params.type =
> -			MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV4;
> -	else
> -		reformat_params.type =
> -			MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV6;

same here

> -
> -	/* convert to network format */
> -	spi = htonl(attrs->spi);
> -	memcpy(reformatbf, &spi, 4);
> +	switch (attrs->mode) {
> +	case XFRM_MODE_TRANSPORT:
> +		ret = setup_pkt_transport_reformat(attrs, &reformat_params);
> +		break;
> +	default:
> +		ret = -EINVAL;
> +	}
>   
> -	reformat_params.param_0 = attrs->authsize;
> -	reformat_params.size = sizeof(reformatbf);
> -	reformat_params.data = &reformatbf;
> +	if (ret)
> +		return ret;
>   
> -cmd:
>   	pkt_reformat =
>   		mlx5_packet_reformat_alloc(mdev, &reformat_params, ns_type);
> +	kfree(reformat_params.data);
>   	if (IS_ERR(pkt_reformat))
>   		return PTR_ERR(pkt_reformat);
>
Leon Romanovsky April 15, 2023, 8:49 a.m. UTC | #2 
On Fri, Apr 14, 2023 at 05:40:40PM -0500, Samudrala, Sridhar wrote:
> 
> 
> On 4/13/2023 7:29 AM, Leon Romanovsky wrote:
> > From: Leon Romanovsky <leonro@nvidia.com>
> > 
> > Refactor setup_pkt_reformat() function to accommodate future extension
> > to support tunnel mode.
> > 
> > Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> > ---
> >   .../mellanox/mlx5/core/en_accel/ipsec.c       |  1 +
> >   .../mellanox/mlx5/core/en_accel/ipsec.h       |  2 +-
> >   .../mellanox/mlx5/core/en_accel/ipsec_fs.c    | 81 ++++++++++++++-----
> >   3 files changed, 63 insertions(+), 21 deletions(-)
> > 
> > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> > index def01bfde610..359da277c03a 100644
> > --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
> > @@ -297,6 +297,7 @@ void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry,
> >   	attrs->upspec.sport = ntohs(x->sel.sport);
> >   	attrs->upspec.sport_mask = ntohs(x->sel.sport_mask);
> >   	attrs->upspec.proto = x->sel.proto;
> > +	attrs->mode = x->props.mode;
> >   	mlx5e_ipsec_init_limits(sa_entry, attrs);
> >   }
> > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
> > index bb89e18b17b4..ae525420a492 100644
> > --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
> > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
> > @@ -77,7 +77,7 @@ struct mlx5_replay_esn {
> >   struct mlx5_accel_esp_xfrm_attrs {
> >   	u32   spi;
> > -	u32   flags;
> > +	u32   mode;
> >   	struct aes_gcm_keymat aes_gcm;
> >   	union {
> > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
> > index 060be020ca64..6a1ed4114054 100644
> > --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
> > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
> > @@ -10,6 +10,7 @@
> >   #include "lib/fs_chains.h"
> >   #define NUM_IPSEC_FTE BIT(15)
> > +#define MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_SIZE 16
> >   struct mlx5e_ipsec_fc {
> >   	struct mlx5_fc *cnt;
> > @@ -836,40 +837,80 @@ static int setup_modify_header(struct mlx5_core_dev *mdev, u32 val, u8 dir,
> >   	return 0;
> >   }
> > +static int
> > +setup_pkt_transport_reformat(struct mlx5_accel_esp_xfrm_attrs *attrs,
> > +			     struct mlx5_pkt_reformat_params *reformat_params)
> > +{
> > +	u8 *reformatbf;
> > +	__be32 spi;
> > +
> > +	switch (attrs->dir) {
> > +	case XFRM_DEV_OFFLOAD_IN:
> > +		reformat_params->type = MLX5_REFORMAT_TYPE_DEL_ESP_TRANSPORT;
> > +		break;
> > +	case XFRM_DEV_OFFLOAD_OUT:
> > +		if (attrs->family == AF_INET)
> > +			reformat_params->type =
> > +				MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV4;
> > +		else
> > +			reformat_params->type =
> > +				MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV6;
> 
> Is it guaranteed that attrs->family will be either AF_INET or AF_INET6?
> Later patches seem to indicate that this may not be true as they use
> switch statement and includes default case

Yes, we have relevant check in mlx5e_xfrm_validate_state():

   380         if (x->props.family != AF_INET &&
   381             x->props.family != AF_INET6) {
   382                 NL_SET_ERR_MSG_MOD(extack, "Only IPv4/6 xfrm states may be offloaded");
   383                 return -EINVAL;
   384         }

> 

<...>

> > -	if (attrs->family == AF_INET)
> > -		reformat_params.type =
> > -			MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV4;
> > -	else
> > -		reformat_params.type =
> > -			MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV6;
> 
> same here

See my answer above.

Thanks
Simon Horman April 17, 2023, 1:32 p.m. UTC | #3 
On Thu, Apr 13, 2023 at 03:29:22PM +0300, Leon Romanovsky wrote:
> From: Leon Romanovsky <leonro@nvidia.com>
> 
> Refactor setup_pkt_reformat() function to accommodate future extension
> to support tunnel mode.
> 
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>

Reviewed-by: Simon Horman <simon.horman@corigine.com>
diff mbox series

Patch

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
index def01bfde610..359da277c03a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
@@ -297,6 +297,7 @@  void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry,
 	attrs->upspec.sport = ntohs(x->sel.sport);
 	attrs->upspec.sport_mask = ntohs(x->sel.sport_mask);
 	attrs->upspec.proto = x->sel.proto;
+	attrs->mode = x->props.mode;
 
 	mlx5e_ipsec_init_limits(sa_entry, attrs);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
index bb89e18b17b4..ae525420a492 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
@@ -77,7 +77,7 @@  struct mlx5_replay_esn {
 
 struct mlx5_accel_esp_xfrm_attrs {
 	u32   spi;
-	u32   flags;
+	u32   mode;
 	struct aes_gcm_keymat aes_gcm;
 
 	union {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
index 060be020ca64..6a1ed4114054 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
@@ -10,6 +10,7 @@ 
 #include "lib/fs_chains.h"
 
 #define NUM_IPSEC_FTE BIT(15)
+#define MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_SIZE 16
 
 struct mlx5e_ipsec_fc {
 	struct mlx5_fc *cnt;
@@ -836,40 +837,80 @@  static int setup_modify_header(struct mlx5_core_dev *mdev, u32 val, u8 dir,
 	return 0;
 }
 
+static int
+setup_pkt_transport_reformat(struct mlx5_accel_esp_xfrm_attrs *attrs,
+			     struct mlx5_pkt_reformat_params *reformat_params)
+{
+	u8 *reformatbf;
+	__be32 spi;
+
+	switch (attrs->dir) {
+	case XFRM_DEV_OFFLOAD_IN:
+		reformat_params->type = MLX5_REFORMAT_TYPE_DEL_ESP_TRANSPORT;
+		break;
+	case XFRM_DEV_OFFLOAD_OUT:
+		if (attrs->family == AF_INET)
+			reformat_params->type =
+				MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV4;
+		else
+			reformat_params->type =
+				MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV6;
+
+		reformatbf = kzalloc(MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_SIZE,
+				     GFP_KERNEL);
+		if (!reformatbf)
+			return -ENOMEM;
+
+		/* convert to network format */
+		spi = htonl(attrs->spi);
+		memcpy(reformatbf, &spi, sizeof(spi));
+
+		reformat_params->param_0 = attrs->authsize;
+		reformat_params->size =
+			MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_SIZE;
+		reformat_params->data = reformatbf;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 static int setup_pkt_reformat(struct mlx5_core_dev *mdev,
 			      struct mlx5_accel_esp_xfrm_attrs *attrs,
 			      struct mlx5_flow_act *flow_act)
 {
-	enum mlx5_flow_namespace_type ns_type = MLX5_FLOW_NAMESPACE_EGRESS;
 	struct mlx5_pkt_reformat_params reformat_params = {};
 	struct mlx5_pkt_reformat *pkt_reformat;
-	u8 reformatbf[16] = {};
-	__be32 spi;
+	enum mlx5_flow_namespace_type ns_type;
+	int ret;
 
-	if (attrs->dir == XFRM_DEV_OFFLOAD_IN) {
-		reformat_params.type = MLX5_REFORMAT_TYPE_DEL_ESP_TRANSPORT;
+	switch (attrs->dir) {
+	case XFRM_DEV_OFFLOAD_IN:
 		ns_type = MLX5_FLOW_NAMESPACE_KERNEL;
-		goto cmd;
+		break;
+	case XFRM_DEV_OFFLOAD_OUT:
+		ns_type = MLX5_FLOW_NAMESPACE_EGRESS;
+		break;
+	default:
+		return -EINVAL;
 	}
 
-	if (attrs->family == AF_INET)
-		reformat_params.type =
-			MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV4;
-	else
-		reformat_params.type =
-			MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV6;
-
-	/* convert to network format */
-	spi = htonl(attrs->spi);
-	memcpy(reformatbf, &spi, 4);
+	switch (attrs->mode) {
+	case XFRM_MODE_TRANSPORT:
+		ret = setup_pkt_transport_reformat(attrs, &reformat_params);
+		break;
+	default:
+		ret = -EINVAL;
+	}
 
-	reformat_params.param_0 = attrs->authsize;
-	reformat_params.size = sizeof(reformatbf);
-	reformat_params.data = &reformatbf;
+	if (ret)
+		return ret;
 
-cmd:
 	pkt_reformat =
 		mlx5_packet_reformat_alloc(mdev, &reformat_params, ns_type);
+	kfree(reformat_params.data);
 	if (IS_ERR(pkt_reformat))
 		return PTR_ERR(pkt_reformat);