Skip to content

Commit 94af50c

Browse files
PatrisiousHaddadSaeed Mahameed
PatrisiousHaddad
authored and
Saeed Mahameed
committed
net/mlx5e: Unify esw and normal IPsec status table creation/destruction
Change normal IPsec flow to use the same creation/destruction functions for status flow table as that of ESW, which first of all refines the code to have less code duplication. And more importantly, the ESW status table handles IPsec syndrome checks at steering by HW, which is more efficient than the previous behaviour we had where it was copied to WQE meta data and checked by the driver. Fixes: 1762f13 ("net/mlx5e: Support IPsec packet offload for RX in switchdev mode") Signed-off-by: Patrisious Haddad <phaddad@nvidia.com> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
1 parent 3d42c8c commit 94af50c

File tree

3 files changed

+141
-213
lines changed

3 files changed

+141
-213
lines changed

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c

Lines changed: 141 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -128,63 +128,166 @@ static struct mlx5_flow_table *ipsec_ft_create(struct mlx5_flow_namespace *ns,
128128
return mlx5_create_auto_grouped_flow_table(ns, &ft_attr);
129129
}
130130

131-
static int ipsec_status_rule(struct mlx5_core_dev *mdev,
132-
struct mlx5e_ipsec_rx *rx,
133-
struct mlx5_flow_destination *dest)
131+
static void ipsec_rx_status_drop_destroy(struct mlx5e_ipsec *ipsec,
132+
struct mlx5e_ipsec_rx *rx)
134133
{
135-
u8 action[MLX5_UN_SZ_BYTES(set_add_copy_action_in_auto)] = {};
134+
mlx5_del_flow_rules(rx->status_drop.rule);
135+
mlx5_destroy_flow_group(rx->status_drop.group);
136+
mlx5_fc_destroy(ipsec->mdev, rx->status_drop_cnt);
137+
}
138+
139+
static void ipsec_rx_status_pass_destroy(struct mlx5e_ipsec *ipsec,
140+
struct mlx5e_ipsec_rx *rx)
141+
{
142+
mlx5_del_flow_rules(rx->status.rule);
143+
144+
if (rx != ipsec->rx_esw)
145+
return;
146+
147+
#ifdef CONFIG_MLX5_ESWITCH
148+
mlx5_chains_put_table(esw_chains(ipsec->mdev->priv.eswitch), 0, 1, 0);
149+
#endif
150+
}
151+
152+
static int ipsec_rx_status_drop_create(struct mlx5e_ipsec *ipsec,
153+
struct mlx5e_ipsec_rx *rx)
154+
{
155+
int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in);
156+
struct mlx5_flow_table *ft = rx->ft.status;
157+
struct mlx5_core_dev *mdev = ipsec->mdev;
158+
struct mlx5_flow_destination dest = {};
136159
struct mlx5_flow_act flow_act = {};
137-
struct mlx5_modify_hdr *modify_hdr;
138-
struct mlx5_flow_handle *fte;
160+
struct mlx5_flow_handle *rule;
161+
struct mlx5_fc *flow_counter;
139162
struct mlx5_flow_spec *spec;
140-
int err;
163+
struct mlx5_flow_group *g;
164+
u32 *flow_group_in;
165+
int err = 0;
141166

167+
flow_group_in = kvzalloc(inlen, GFP_KERNEL);
142168
spec = kvzalloc(sizeof(*spec), GFP_KERNEL);
143-
if (!spec)
144-
return -ENOMEM;
169+
if (!flow_group_in || !spec) {
170+
err = -ENOMEM;
171+
goto err_out;
172+
}
145173

146-
/* Action to copy 7 bit ipsec_syndrome to regB[24:30] */
147-
MLX5_SET(copy_action_in, action, action_type, MLX5_ACTION_TYPE_COPY);
148-
MLX5_SET(copy_action_in, action, src_field, MLX5_ACTION_IN_FIELD_IPSEC_SYNDROME);
149-
MLX5_SET(copy_action_in, action, src_offset, 0);
150-
MLX5_SET(copy_action_in, action, length, 7);
151-
MLX5_SET(copy_action_in, action, dst_field, MLX5_ACTION_IN_FIELD_METADATA_REG_B);
152-
MLX5_SET(copy_action_in, action, dst_offset, 24);
174+
MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, ft->max_fte - 1);
175+
MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, ft->max_fte - 1);
176+
g = mlx5_create_flow_group(ft, flow_group_in);
177+
if (IS_ERR(g)) {
178+
err = PTR_ERR(g);
179+
mlx5_core_err(mdev,
180+
"Failed to add ipsec rx status drop flow group, err=%d\n", err);
181+
goto err_out;
182+
}
153183

154-
modify_hdr = mlx5_modify_header_alloc(mdev, MLX5_FLOW_NAMESPACE_KERNEL,
155-
1, action);
184+
flow_counter = mlx5_fc_create(mdev, false);
185+
if (IS_ERR(flow_counter)) {
186+
err = PTR_ERR(flow_counter);
187+
mlx5_core_err(mdev,
188+
"Failed to add ipsec rx status drop rule counter, err=%d\n", err);
189+
goto err_cnt;
190+
}
156191

157-
if (IS_ERR(modify_hdr)) {
158-
err = PTR_ERR(modify_hdr);
192+
flow_act.action = MLX5_FLOW_CONTEXT_ACTION_DROP | MLX5_FLOW_CONTEXT_ACTION_COUNT;
193+
dest.type = MLX5_FLOW_DESTINATION_TYPE_COUNTER;
194+
dest.counter_id = mlx5_fc_id(flow_counter);
195+
if (rx == ipsec->rx_esw)
196+
spec->flow_context.flow_source = MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK;
197+
rule = mlx5_add_flow_rules(ft, spec, &flow_act, &dest, 1);
198+
if (IS_ERR(rule)) {
199+
err = PTR_ERR(rule);
159200
mlx5_core_err(mdev,
160-
"fail to alloc ipsec copy modify_header_id err=%d\n", err);
161-
goto out_spec;
201+
"Failed to add ipsec rx status drop rule, err=%d\n", err);
202+
goto err_rule;
162203
}
163204

164-
/* create fte */
165-
flow_act.action = MLX5_FLOW_CONTEXT_ACTION_MOD_HDR |
166-
MLX5_FLOW_CONTEXT_ACTION_FWD_DEST |
205+
rx->status_drop.group = g;
206+
rx->status_drop.rule = rule;
207+
rx->status_drop_cnt = flow_counter;
208+
209+
kvfree(flow_group_in);
210+
kvfree(spec);
211+
return 0;
212+
213+
err_rule:
214+
mlx5_fc_destroy(mdev, flow_counter);
215+
err_cnt:
216+
mlx5_destroy_flow_group(g);
217+
err_out:
218+
kvfree(flow_group_in);
219+
kvfree(spec);
220+
return err;
221+
}
222+
223+
static int ipsec_rx_status_pass_create(struct mlx5e_ipsec *ipsec,
224+
struct mlx5e_ipsec_rx *rx,
225+
struct mlx5_flow_destination *dest)
226+
{
227+
struct mlx5_flow_act flow_act = {};
228+
struct mlx5_flow_handle *rule;
229+
struct mlx5_flow_spec *spec;
230+
int err;
231+
232+
spec = kvzalloc(sizeof(*spec), GFP_KERNEL);
233+
if (!spec)
234+
return -ENOMEM;
235+
236+
MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria,
237+
misc_parameters_2.ipsec_syndrome);
238+
MLX5_SET(fte_match_param, spec->match_value,
239+
misc_parameters_2.ipsec_syndrome, 0);
240+
if (rx == ipsec->rx_esw)
241+
spec->flow_context.flow_source = MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK;
242+
spec->match_criteria_enable = MLX5_MATCH_MISC_PARAMETERS_2;
243+
flow_act.flags = FLOW_ACT_NO_APPEND;
244+
flow_act.action = MLX5_FLOW_CONTEXT_ACTION_FWD_DEST |
167245
MLX5_FLOW_CONTEXT_ACTION_COUNT;
168-
flow_act.modify_hdr = modify_hdr;
169-
fte = mlx5_add_flow_rules(rx->ft.status, spec, &flow_act, dest, 2);
170-
if (IS_ERR(fte)) {
171-
err = PTR_ERR(fte);
172-
mlx5_core_err(mdev, "fail to add ipsec rx err copy rule err=%d\n", err);
173-
goto out;
246+
rule = mlx5_add_flow_rules(rx->ft.status, spec, &flow_act, dest, 2);
247+
if (IS_ERR(rule)) {
248+
err = PTR_ERR(rule);
249+
mlx5_core_warn(ipsec->mdev,
250+
"Failed to add ipsec rx status pass rule, err=%d\n", err);
251+
goto err_rule;
174252
}
175253

254+
rx->status.rule = rule;
176255
kvfree(spec);
177-
rx->status.rule = fte;
178-
rx->status.modify_hdr = modify_hdr;
179256
return 0;
180257

181-
out:
182-
mlx5_modify_header_dealloc(mdev, modify_hdr);
183-
out_spec:
258+
err_rule:
184259
kvfree(spec);
185260
return err;
186261
}
187262

263+
static void mlx5_ipsec_rx_status_destroy(struct mlx5e_ipsec *ipsec,
264+
struct mlx5e_ipsec_rx *rx)
265+
{
266+
ipsec_rx_status_pass_destroy(ipsec, rx);
267+
ipsec_rx_status_drop_destroy(ipsec, rx);
268+
}
269+
270+
static int mlx5_ipsec_rx_status_create(struct mlx5e_ipsec *ipsec,
271+
struct mlx5e_ipsec_rx *rx,
272+
struct mlx5_flow_destination *dest)
273+
{
274+
int err;
275+
276+
err = ipsec_rx_status_drop_create(ipsec, rx);
277+
if (err)
278+
return err;
279+
280+
err = ipsec_rx_status_pass_create(ipsec, rx, dest);
281+
if (err)
282+
goto err_pass_create;
283+
284+
return 0;
285+
286+
err_pass_create:
287+
ipsec_rx_status_drop_destroy(ipsec, rx);
288+
return err;
289+
}
290+
188291
static int ipsec_miss_create(struct mlx5_core_dev *mdev,
189292
struct mlx5_flow_table *ft,
190293
struct mlx5e_ipsec_miss *miss,
@@ -333,12 +436,7 @@ static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,
333436
mlx5_destroy_flow_table(rx->ft.sa);
334437
if (rx->allow_tunnel_mode)
335438
mlx5_eswitch_unblock_encap(mdev);
336-
if (rx == ipsec->rx_esw) {
337-
mlx5_esw_ipsec_rx_status_destroy(ipsec, rx);
338-
} else {
339-
mlx5_del_flow_rules(rx->status.rule);
340-
mlx5_modify_header_dealloc(mdev, rx->status.modify_hdr);
341-
}
439+
mlx5_ipsec_rx_status_destroy(ipsec, rx);
342440
mlx5_destroy_flow_table(rx->ft.status);
343441

344442
mlx5_ipsec_fs_roce_rx_destroy(ipsec->roce, family, mdev);
@@ -428,10 +526,7 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,
428526

429527
dest[1].type = MLX5_FLOW_DESTINATION_TYPE_COUNTER;
430528
dest[1].counter_id = mlx5_fc_id(rx->fc->cnt);
431-
if (rx == ipsec->rx_esw)
432-
err = mlx5_esw_ipsec_rx_status_create(ipsec, rx, dest);
433-
else
434-
err = ipsec_status_rule(mdev, rx, dest);
529+
err = mlx5_ipsec_rx_status_create(ipsec, rx, dest);
435530
if (err)
436531
goto err_add;
437532

‎drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c

Lines changed: 0 additions & 152 deletions
Original file line numberDiff line numberDiff line change
@@ -21,158 +21,6 @@ enum {
2121
MLX5_ESW_IPSEC_TX_ESP_FT_CNT_LEVEL,
2222
};
2323

24-
static void esw_ipsec_rx_status_drop_destroy(struct mlx5e_ipsec *ipsec,
25-
struct mlx5e_ipsec_rx *rx)
26-
{
27-
mlx5_del_flow_rules(rx->status_drop.rule);
28-
mlx5_destroy_flow_group(rx->status_drop.group);
29-
mlx5_fc_destroy(ipsec->mdev, rx->status_drop_cnt);
30-
}
31-
32-
static void esw_ipsec_rx_status_pass_destroy(struct mlx5e_ipsec *ipsec,
33-
struct mlx5e_ipsec_rx *rx)
34-
{
35-
mlx5_del_flow_rules(rx->status.rule);
36-
mlx5_chains_put_table(esw_chains(ipsec->mdev->priv.eswitch), 0, 1, 0);
37-
}
38-
39-
static int esw_ipsec_rx_status_drop_create(struct mlx5e_ipsec *ipsec,
40-
struct mlx5e_ipsec_rx *rx)
41-
{
42-
int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in);
43-
struct mlx5_flow_table *ft = rx->ft.status;
44-
struct mlx5_core_dev *mdev = ipsec->mdev;
45-
struct mlx5_flow_destination dest = {};
46-
struct mlx5_flow_act flow_act = {};
47-
struct mlx5_flow_handle *rule;
48-
struct mlx5_fc *flow_counter;
49-
struct mlx5_flow_spec *spec;
50-
struct mlx5_flow_group *g;
51-
u32 *flow_group_in;
52-
int err = 0;
53-
54-
flow_group_in = kvzalloc(inlen, GFP_KERNEL);
55-
spec = kvzalloc(sizeof(*spec), GFP_KERNEL);
56-
if (!flow_group_in || !spec) {
57-
err = -ENOMEM;
58-
goto err_out;
59-
}
60-
61-
MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, ft->max_fte - 1);
62-
MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, ft->max_fte - 1);
63-
g = mlx5_create_flow_group(ft, flow_group_in);
64-
if (IS_ERR(g)) {
65-
err = PTR_ERR(g);
66-
mlx5_core_err(mdev,
67-
"Failed to add ipsec rx status drop flow group, err=%d\n", err);
68-
goto err_out;
69-
}
70-
71-
flow_counter = mlx5_fc_create(mdev, false);
72-
if (IS_ERR(flow_counter)) {
73-
err = PTR_ERR(flow_counter);
74-
mlx5_core_err(mdev,
75-
"Failed to add ipsec rx status drop rule counter, err=%d\n", err);
76-
goto err_cnt;
77-
}
78-
79-
flow_act.action = MLX5_FLOW_CONTEXT_ACTION_DROP | MLX5_FLOW_CONTEXT_ACTION_COUNT;
80-
dest.type = MLX5_FLOW_DESTINATION_TYPE_COUNTER;
81-
dest.counter_id = mlx5_fc_id(flow_counter);
82-
spec->flow_context.flow_source = MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK;
83-
rule = mlx5_add_flow_rules(ft, spec, &flow_act, &dest, 1);
84-
if (IS_ERR(rule)) {
85-
err = PTR_ERR(rule);
86-
mlx5_core_err(mdev,
87-
"Failed to add ipsec rx status drop rule, err=%d\n", err);
88-
goto err_rule;
89-
}
90-
91-
rx->status_drop.group = g;
92-
rx->status_drop.rule = rule;
93-
rx->status_drop_cnt = flow_counter;
94-
95-
kvfree(flow_group_in);
96-
kvfree(spec);
97-
return 0;
98-
99-
err_rule:
100-
mlx5_fc_destroy(mdev, flow_counter);
101-
err_cnt:
102-
mlx5_destroy_flow_group(g);
103-
err_out:
104-
kvfree(flow_group_in);
105-
kvfree(spec);
106-
return err;
107-
}
108-
109-
static int esw_ipsec_rx_status_pass_create(struct mlx5e_ipsec *ipsec,
110-
struct mlx5e_ipsec_rx *rx,
111-
struct mlx5_flow_destination *dest)
112-
{
113-
struct mlx5_flow_act flow_act = {};
114-
struct mlx5_flow_handle *rule;
115-
struct mlx5_flow_spec *spec;
116-
int err;
117-
118-
spec = kvzalloc(sizeof(*spec), GFP_KERNEL);
119-
if (!spec)
120-
return -ENOMEM;
121-
122-
MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria,
123-
misc_parameters_2.ipsec_syndrome);
124-
MLX5_SET(fte_match_param, spec->match_value,
125-
misc_parameters_2.ipsec_syndrome, 0);
126-
spec->flow_context.flow_source = MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK;
127-
spec->match_criteria_enable = MLX5_MATCH_MISC_PARAMETERS_2;
128-
flow_act.flags = FLOW_ACT_NO_APPEND;
129-
flow_act.action = MLX5_FLOW_CONTEXT_ACTION_FWD_DEST |
130-
MLX5_FLOW_CONTEXT_ACTION_COUNT;
131-
rule = mlx5_add_flow_rules(rx->ft.status, spec, &flow_act, dest, 2);
132-
if (IS_ERR(rule)) {
133-
err = PTR_ERR(rule);
134-
mlx5_core_warn(ipsec->mdev,
135-
"Failed to add ipsec rx status pass rule, err=%d\n", err);
136-
goto err_rule;
137-
}
138-
139-
rx->status.rule = rule;
140-
kvfree(spec);
141-
return 0;
142-
143-
err_rule:
144-
kvfree(spec);
145-
return err;
146-
}
147-
148-
void mlx5_esw_ipsec_rx_status_destroy(struct mlx5e_ipsec *ipsec,
149-
struct mlx5e_ipsec_rx *rx)
150-
{
151-
esw_ipsec_rx_status_pass_destroy(ipsec, rx);
152-
esw_ipsec_rx_status_drop_destroy(ipsec, rx);
153-
}
154-
155-
int mlx5_esw_ipsec_rx_status_create(struct mlx5e_ipsec *ipsec,
156-
struct mlx5e_ipsec_rx *rx,
157-
struct mlx5_flow_destination *dest)
158-
{
159-
int err;
160-
161-
err = esw_ipsec_rx_status_drop_create(ipsec, rx);
162-
if (err)
163-
return err;
164-
165-
err = esw_ipsec_rx_status_pass_create(ipsec, rx, dest);
166-
if (err)
167-
goto err_pass_create;
168-
169-
return 0;
170-
171-
err_pass_create:
172-
esw_ipsec_rx_status_drop_destroy(ipsec, rx);
173-
return err;
174-
}
175-
17624
void mlx5_esw_ipsec_rx_create_attr_set(struct mlx5e_ipsec *ipsec,
17725
struct mlx5e_ipsec_rx_create_attr *attr)
17826
{

0 commit comments

Comments
 (0)