| Message ID | 20221101110248.423966-4-simon.horman@corigine.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | nfp: IPsec offload support | expand |
On Tue, Nov 01, 2022 at 12:02:48PM +0100, Simon Horman wrote: > From: Huanhuan Wang <huanhuan.wang@corigine.com> > > Xfrm callbacks are implemented to offload SA info into firmware > by mailbox. It supports 16K SA info in total. > > Expose ipsec offload feature to upper layer, this feature will > signal the availability of the offload. > > Based on initial work of Norm Bagley <norman.bagley@netronome.com>. > > Signed-off-by: Huanhuan Wang <huanhuan.wang@corigine.com> > Reviewed-by: Louis Peens <louis.peens@corigine.com> > Signed-off-by: Simon Horman <simon.horman@corigine.com> > --- > .../net/ethernet/netronome/nfp/crypto/ipsec.c | 532 +++++++++++++++++- > .../ethernet/netronome/nfp/nfp_net_common.c | 6 + > .../net/ethernet/netronome/nfp/nfp_net_ctrl.h | 4 +- > 3 files changed, 538 insertions(+), 4 deletions(-) <...> > static int nfp_net_xfrm_add_state(struct xfrm_state *x) > { > - return -EOPNOTSUPP; > + struct net_device *netdev = x->xso.dev; > + struct nfp_ipsec_cfg_mssg msg = {0}; I think that I already wrote it {0} -> {}; > + int i, key_len, trunc_len, err = 0; > + struct nfp_ipsec_cfg_add_sa *cfg; > + struct nfp_net *nn; > + unsigned int saidx; > + __be32 *p; <...> > + if (trunc_len == 96) > + cfg->ctrl_word.hash = NFP_IPSEC_HASH_MD5_96; > + else if (trunc_len == 128) > + cfg->ctrl_word.hash = NFP_IPSEC_HASH_MD5_128; > + else > + trunc_len = 0; IMHO, this is better to write as switch-case in separate function. > + break; > + case SADB_AALG_SHA1HMAC: > + if (trunc_len == 96) > + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA1_96; > + else if (trunc_len == 80) > + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA1_80; > + else > + trunc_len = 0; > + break; Ditto. > + case SADB_X_AALG_SHA2_256HMAC: > + if (trunc_len == 96) > + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA256_96; > + else if (trunc_len == 128) > + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA256_128; > + else > + trunc_len = 0; > + break; > + case SADB_X_AALG_SHA2_384HMAC: > + if (trunc_len == 96) > + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA384_96; > + else if (trunc_len == 192) > + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA384_192; > + else > + trunc_len = 0; > + break; > + case SADB_X_AALG_SHA2_512HMAC: > + if (trunc_len == 96) > + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA512_96; > + else if (trunc_len == 256) > + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA512_256; > + else > + trunc_len = 0; > + break; > + default: > + nn_err(nn, "Unsupported authentication algorithm\n"); > + return -EINVAL; > + } > + > + if (!trunc_len) { > + nn_err(nn, "Unsupported authentication algorithm trunc length\n"); > + return -EINVAL; > + } > + > + if (x->aalg) { > + p = (__be32 *)x->aalg->alg_key; > + key_len = DIV_ROUND_UP(x->aalg->alg_key_len, BITS_PER_BYTE); > + if (key_len > sizeof(cfg->auth_key)) { > + nn_err(nn, "Insufficient space for offloaded auth key\n"); > + return -EINVAL; > + } > + for (i = 0; i < key_len / sizeof(cfg->auth_key[0]) ; i++) > + cfg->auth_key[i] = ntohl(*p++); I wonder if you can't declare p as u32 and use memcpy here instead of u32->__be32->u32 conversions. Thanks
On Tue, Nov 01, 2022 at 12:02:48PM +0100, Simon Horman wrote: > From: Huanhuan Wang <huanhuan.wang@corigine.com> > > Xfrm callbacks are implemented to offload SA info into firmware > by mailbox. It supports 16K SA info in total. > > Expose ipsec offload feature to upper layer, this feature will > signal the availability of the offload. > > Based on initial work of Norm Bagley <norman.bagley@netronome.com>. > > Signed-off-by: Huanhuan Wang <huanhuan.wang@corigine.com> > Reviewed-by: Louis Peens <louis.peens@corigine.com> > Signed-off-by: Simon Horman <simon.horman@corigine.com> > --- > .../net/ethernet/netronome/nfp/crypto/ipsec.c | 532 +++++++++++++++++- > .../ethernet/netronome/nfp/nfp_net_common.c | 6 + > .../net/ethernet/netronome/nfp/nfp_net_ctrl.h | 4 +- > 3 files changed, 538 insertions(+), 4 deletions(-) > > diff --git a/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c b/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c > index 11575a9cb3b0..664a36be60e7 100644 > --- a/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c > +++ b/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c > @@ -16,18 +16,546 @@ <...> > +/* IPSEC_CFG_MSSG_ADD_SA */ > +struct nfp_ipsec_cfg_add_sa { > + u32 ciph_key[8]; /* Cipher Key */ > + union { > + u32 auth_key[16]; /* Authentication Key */ > + struct nfp_ipsec_aesgcm { /* AES-GCM-ESP fields */ > + u32 salt; /* Initialized with SA */ > + u32 iv[2]; /* Firmware use only */ > + u32 cntr; > + u32 zeros[4]; /* Init to 0 with SA */ > + u32 len_a[2]; /* Firmware use only */ > + u32 len_c[2]; > + u32 spare0[4]; > + } aesgcm_fields; > + }; > + struct sa_ctrl_word { > + uint32_t hash :4; /* From nfp_ipsec_sa_hash_type */ > + uint32_t cimode :4; /* From nfp_ipsec_sa_cipher_mode */ > + uint32_t cipher :4; /* From nfp_ipsec_sa_cipher */ > + uint32_t mode :2; /* From nfp_ipsec_sa_mode */ > + uint32_t proto :2; /* From nfp_ipsec_sa_prot */ > + uint32_t dir :1; /* SA direction */ > + uint32_t ena_arw:1; /* Anti-Replay Window */ > + uint32_t ext_seq:1; /* 64-bit Sequence Num */ > + uint32_t ext_arw:1; /* 64b Anti-Replay Window */ > + uint32_t spare2 :9; /* Must be set to 0 */ > + uint32_t encap_dsbl:1; /* Encap/Decap disable */ > + uint32_t gen_seq:1; /* Firmware Generate Seq */ > + uint32_t spare8 :1; /* Must be set to 0 */ > + } ctrl_word; > + u32 spi; /* SPI Value */ > + uint32_t pmtu_limit :16; /* PMTU Limit */ > + uint32_t spare3 :1; > + uint32_t frag_check :1; /* Stateful fragment checking flag */ > + uint32_t bypass_DSCP:1; /* Bypass DSCP Flag */ > + uint32_t df_ctrl :2; /* DF Control bits */ > + uint32_t ipv6 :1; /* Outbound IPv6 addr format */ > + uint32_t udp_enable :1; /* Add/Remove UDP header for NAT */ > + uint32_t tfc_enable :1; /* Traffic Flow Confidentiality */ > + uint32_t spare4 :8; > + u32 soft_lifetime_byte_count; > + u32 hard_lifetime_byte_count; These fields are not relevant for IPsec crypto offload. I would be more than happy to see only used fields here. > + u32 src_ip[4]; /* Src IP addr */ > + u32 dst_ip[4]; /* Dst IP addr */ > + uint32_t natt_dst_port :16; /* NAT-T UDP Header dst port */ > + uint32_t natt_src_port :16; /* NAT-T UDP Header src port */ > + u32 soft_lifetime_time_limit; > + u32 hard_lifetime_time_limit; > + u32 sa_creation_time_lo_32; /* Ucode fills this in */ > + u32 sa_creation_time_hi_32; /* Ucode fills this in */ > + uint32_t reserved0 :16; > + uint32_t tfc_padding :16; /* Traffic Flow Confidential Pad */ > +}; > + > +/* IPSEC_CFG_MSSG_INV_SA */ > +struct nfp_ipsec_cfg_inv_sa { > + u32 spare6; > +}; > + > +/* IPSEC_CFG_MSSG_GET_SA_STATS */ > +struct nfp_ipsec_cfg_get_sa_stats { > + u32 seq_lo; /* Sequence Number (low 32bits) */ > + u32 seq_high; /* Sequence Number (high 32bits) */ > + u32 arw_counter_lo; /* Anti-replay wndw cntr */ > + u32 arw_counter_high; /* Anti-replay wndw cntr */ > + u32 arw_bitmap_lo; /* Anti-replay wndw bitmap */ > + u32 arw_bitmap_high; /* Anti-replay wndw bitmap */ > + uint32_t reserved1:1; > + uint32_t soft_lifetime_byte_cnt_exceeded :1; /* Soft cnt_exceeded */ > + uint32_t hard_lifetime_byte_cnt_exceeded :1; /* Hard cnt_exceeded */ > + uint32_t soft_lifetime_time_limit_exceeded :1; /* Soft cnt_exceeded */ > + uint32_t hard_lifetime_time_limit_exceeded :1; /* Hard cnt_exceeded */ Not relevant for crypto. > + uint32_t spare7:27; > + u32 lifetime_byte_count; Ditto > + u32 pkt_count; > + u32 discards_auth; /* Auth failures */ > + u32 discards_unsupported; /* Unsupported crypto mode */ > + u32 discards_alignment; /* Alignment error */ > + u32 discards_hard_bytelimit; /* Byte Count limit */ > + u32 discards_seq_num_wrap; /* Sequ Number wrap */ > + u32 discards_pmtu_limit_exceeded; /* PMTU Limit */ > + u32 discards_arw_old_seq; /* Anti-Replay seq small */ > + u32 discards_arw_replay; /* Anti-Replay seq rcvd */ > + u32 discards_ctrl_word; /* Bad SA Control word */ > + u32 discards_ip_hdr_len; /* Hdr offset from too high */ > + u32 discards_eop_buf; /* No EOP buffer */ > + u32 ipv4_id_counter; /* IPv4 ID field counter */ > + u32 discards_isl_fail; /* Inbound SPD Lookup failure */ > + u32 discards_ext_not_found; /* Ext header end */ > + u32 discards_max_ext_hdrs; /* Max ext header */ > + u32 discards_non_ext_hdrs; /* Non-extension headers */ > + u32 discards_ext_hdr_too_big; /* Ext header chain */ > + u32 discards_hard_timelimit; /* Time Limit */ > +}; <...> > +static int nfp_ipsec_cfg_cmd_issue(struct nfp_net *nn, int type, int saidx, > + struct nfp_ipsec_cfg_mssg *msg) > +{ > + int i, msg_size, ret; > + > + msg->cmd = type; > + msg->sa_idx = saidx; > + msg->rsp = 0; > + msg_size = ARRAY_SIZE(msg->raw); > + > + for (i = 0; i < msg_size; i++) > + nn_writel(nn, NFP_NET_CFG_MBOX_VAL + 4 * i, msg->raw[i]); > + > + ret = nfp_net_mbox_reconfig(nn, NFP_NET_CFG_MBOX_CMD_IPSEC); > + if (ret < 0) > + return ret; > + > + /* For now we always read the whole message response back */ > + for (i = 0; i < msg_size; i++) > + msg->raw[i] = nn_readl(nn, NFP_NET_CFG_MBOX_VAL + 4 * i); > + > + switch (msg->rsp) { > + case NFP_IPSEC_CFG_MSSG_OK: > + return 0; > + case NFP_IPSEC_CFG_MSSG_SA_INVALID_CMD: > + return -EINVAL; > + case NFP_IPSEC_CFG_MSSG_SA_VALID: > + return -EEXIST; > + case NFP_IPSEC_CFG_MSSG_FAILED: > + case NFP_IPSEC_CFG_MSSG_SA_HASH_ADD_FAILED: > + case NFP_IPSEC_CFG_MSSG_SA_HASH_DEL_FAILED: > + return -EIO; > + default: > + return -EDOM; Let's not bring cool error numbers when they don't need to be such. It is -EINVAL here. > + } > +} > + > +static int set_aes_keylen(struct nfp_ipsec_cfg_add_sa *cfg, int alg, int keylen) > +{ > + if (alg == SADB_X_EALG_NULL_AES_GMAC) { > + if (keylen == 128) > + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES128_NULL; > + else if (keylen == 192) > + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES192_NULL; > + else if (keylen == 256) > + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES256_NULL; > + else > + return -EINVAL; Place "return 0;" here and get rid of "else". > + } else { > + if (keylen == 128) > + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES128; > + else if (keylen == 192) > + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES192; > + else if (keylen == 256) > + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES256; > + else > + return -EINVAL; > + } > + > + return 0; > +} > + > static int nfp_net_xfrm_add_state(struct xfrm_state *x) > { > - return -EOPNOTSUPP; > + struct net_device *netdev = x->xso.dev; > + struct nfp_ipsec_cfg_mssg msg = {0}; > + int i, key_len, trunc_len, err = 0; > + struct nfp_ipsec_cfg_add_sa *cfg; > + struct nfp_net *nn; > + unsigned int saidx; > + __be32 *p; > + > + nn = netdev_priv(netdev); > + cfg = &msg.cfg_add_sa; > + > + /* General */ > + switch (x->props.mode) { > + case XFRM_MODE_TUNNEL: > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TUNNEL; > + break; > + case XFRM_MODE_TRANSPORT: > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TRANSPORT; > + break; Why is it important for IPsec crypto? The HW logic must be the same for all modes. There are no differences between transport and tunnel. > + default: > + nn_err(nn, "Unsupported mode for xfrm offload\n"); There are no other modes. > + return -EINVAL; > + } > + > + switch (x->id.proto) { > + case IPPROTO_ESP: > + cfg->ctrl_word.proto = NFP_IPSEC_PROTOCOL_ESP; > + break; > + case IPPROTO_AH: > + cfg->ctrl_word.proto = NFP_IPSEC_PROTOCOL_AH; > + break; > + default: > + nn_err(nn, "Unsupported protocol for xfrm offload\n"); > + return -EINVAL; > + } <...> > + err = xa_alloc(&nn->xa_ipsec, &saidx, x, > + XA_LIMIT(0, NFP_NET_IPSEC_MAX_SA_CNT - 1), GFP_KERNEL); Create XArray with XA_FLAGS_ALLOC1, it will cause to xarray skip 0. See DEFINE_XARRAY_ALLOC1() for more info. > + if (err < 0) { > + nn_err(nn, "Unable to get sa_data number for IPsec\n"); > + return err; > + } > + > + /* Allocate saidx and commit the SA */ > + err = nfp_ipsec_cfg_cmd_issue(nn, NFP_IPSEC_CFG_MSSG_ADD_SA, saidx, &msg); > + if (err) { > + xa_erase(&nn->xa_ipsec, saidx); > + nn_err(nn, "Failed to issue IPsec command err ret=%d\n", err); > + return err; > + } > + > + /* 0 is invalid offload_handle for kernel */ > + x->xso.offload_handle = saidx + 1; If you create XArray as I said above, you won't need to add +1. > + return 0; > } <...> > static bool nfp_net_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *x) > { > - return false; > + if (x->props.family == AF_INET) { > + /* Offload with IPv4 options is not supported yet */ > + if (ip_hdr(skb)->ihl != 5) > + return false; return here and remove "else" from all places. > + } else { > + /* Offload with IPv6 extension headers is not support yet */ > + if (ipv6_ext_hdr(ipv6_hdr(skb)->nexthdr)) > + return false; > + } > + > + return true; > } Thanks
On Mon, 7 Nov 2022 08:14:12 +0200, Leon Romanovsky wrote: <...> > > + struct sa_ctrl_word { > > + uint32_t hash :4; /* From nfp_ipsec_sa_hash_type */ > > + uint32_t cimode :4; /* From nfp_ipsec_sa_cipher_mode */ > > + uint32_t cipher :4; /* From nfp_ipsec_sa_cipher */ > > + uint32_t mode :2; /* From nfp_ipsec_sa_mode */ > > + uint32_t proto :2; /* From nfp_ipsec_sa_prot */ > > + uint32_t dir :1; /* SA direction */ > > + uint32_t ena_arw:1; /* Anti-Replay Window */ > > + uint32_t ext_seq:1; /* 64-bit Sequence Num */ > > + uint32_t ext_arw:1; /* 64b Anti-Replay Window */ > > + uint32_t spare2 :9; /* Must be set to 0 */ > > + uint32_t encap_dsbl:1; /* Encap/Decap disable */ > > + uint32_t gen_seq:1; /* Firmware Generate Seq */ > > + uint32_t spare8 :1; /* Must be set to 0 */ > > + } ctrl_word; > > + u32 spi; /* SPI Value */ > > + uint32_t pmtu_limit :16; /* PMTU Limit */ > > + uint32_t spare3 :1; > > + uint32_t frag_check :1; /* Stateful fragment checking flag */ > > + uint32_t bypass_DSCP:1; /* Bypass DSCP Flag */ > > + uint32_t df_ctrl :2; /* DF Control bits */ > > + uint32_t ipv6 :1; /* Outbound IPv6 addr format */ > > + uint32_t udp_enable :1; /* Add/Remove UDP header for NAT */ > > + uint32_t tfc_enable :1; /* Traffic Flow Confidentiality */ > > + uint32_t spare4 :8; > > + u32 soft_lifetime_byte_count; > > + u32 hard_lifetime_byte_count; > > These fields are not relevant for IPsec crypto offload. I would be more > than happy to see only used fields here. They are not used currently in kernel indeed. However the HW is not designed for crypto-offloading only, not for kernel only, some extensive features are supported. So they're reserved here. <...> > > + > > + /* General */ > > + switch (x->props.mode) { > > + case XFRM_MODE_TUNNEL: > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TUNNEL; > > + break; > > + case XFRM_MODE_TRANSPORT: > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TRANSPORT; > > + break; > > Why is it important for IPsec crypto? The HW logic must be the same for > all modes. There are no differences between transport and tunnel. As I mentioned above, it's differentiated in HW to support more features. > > > + default: > > + nn_err(nn, "Unsupported mode for xfrm offload\n"); > > There are no other modes. > <...> > > > + err = xa_alloc(&nn->xa_ipsec, &saidx, x, > > + XA_LIMIT(0, NFP_NET_IPSEC_MAX_SA_CNT - 1), > GFP_KERNEL); > > Create XArray with XA_FLAGS_ALLOC1, it will cause to xarray skip 0. > See DEFINE_XARRAY_ALLOC1() for more info. Actually 0 is a valid SA id in HW/driver, we don't want to skip 0. > > > > + if (err < 0) { > > + nn_err(nn, "Unable to get sa_data number for IPsec\n"); > > + return err; > > + } > > + > > + /* Allocate saidx and commit the SA */ > > + err = nfp_ipsec_cfg_cmd_issue(nn, NFP_IPSEC_CFG_MSSG_ADD_SA, > saidx, &msg); > > + if (err) { > > + xa_erase(&nn->xa_ipsec, saidx); > > + nn_err(nn, "Failed to issue IPsec command err ret=%d\n", > err); > > + return err; > > + } > > + > > + /* 0 is invalid offload_handle for kernel */ > > + x->xso.offload_handle = saidx + 1; > > If you create XArray as I said above, you won't need to add +1. >
On Sun, 6 Nov 2022 21:48:10 +0200, Leon Romanovsky wrote: <...> > > + if (x->aalg) { > > + p = (__be32 *)x->aalg->alg_key; > > + key_len = DIV_ROUND_UP(x->aalg->alg_key_len, > BITS_PER_BYTE); > > + if (key_len > sizeof(cfg->auth_key)) { > > + nn_err(nn, "Insufficient space for offloaded auth > key\n"); > > + return -EINVAL; > > + } > > + for (i = 0; i < key_len / sizeof(cfg->auth_key[0]) ; i++) > > + cfg->auth_key[i] = ntohl(*p++); > > I wonder if you can't declare p as u32 and use memcpy here instead of > u32->__be32->u32 conversions. The BE/LE process is necessary as HW requires it, we'll use get_ unaligned_be32 instead to make it simpler. > > Thanks
On Mon, Nov 07, 2022 at 09:46:46AM +0000, Yinjun Zhang wrote: > On Mon, 7 Nov 2022 08:14:12 +0200, Leon Romanovsky wrote: > <...> > > > + struct sa_ctrl_word { > > > + uint32_t hash :4; /* From nfp_ipsec_sa_hash_type */ > > > + uint32_t cimode :4; /* From nfp_ipsec_sa_cipher_mode */ > > > + uint32_t cipher :4; /* From nfp_ipsec_sa_cipher */ > > > + uint32_t mode :2; /* From nfp_ipsec_sa_mode */ > > > + uint32_t proto :2; /* From nfp_ipsec_sa_prot */ > > > + uint32_t dir :1; /* SA direction */ > > > + uint32_t ena_arw:1; /* Anti-Replay Window */ > > > + uint32_t ext_seq:1; /* 64-bit Sequence Num */ > > > + uint32_t ext_arw:1; /* 64b Anti-Replay Window */ > > > + uint32_t spare2 :9; /* Must be set to 0 */ > > > + uint32_t encap_dsbl:1; /* Encap/Decap disable */ > > > + uint32_t gen_seq:1; /* Firmware Generate Seq */ > > > + uint32_t spare8 :1; /* Must be set to 0 */ > > > + } ctrl_word; > > > + u32 spi; /* SPI Value */ > > > + uint32_t pmtu_limit :16; /* PMTU Limit */ > > > + uint32_t spare3 :1; > > > + uint32_t frag_check :1; /* Stateful fragment checking flag */ > > > + uint32_t bypass_DSCP:1; /* Bypass DSCP Flag */ > > > + uint32_t df_ctrl :2; /* DF Control bits */ > > > + uint32_t ipv6 :1; /* Outbound IPv6 addr format */ > > > + uint32_t udp_enable :1; /* Add/Remove UDP header for NAT */ > > > + uint32_t tfc_enable :1; /* Traffic Flow Confidentiality */ > > > + uint32_t spare4 :8; > > > + u32 soft_lifetime_byte_count; > > > + u32 hard_lifetime_byte_count; > > > > These fields are not relevant for IPsec crypto offload. I would be more > > than happy to see only used fields here. > > They are not used currently in kernel indeed. However the HW is not designed for > crypto-offloading only, not for kernel only, some extensive features are supported. > So they're reserved here. So mark them as reserved. If it is not supported by kernel, it shouldn't be in the kernel. > > <...> > > > + > > > + /* General */ > > > + switch (x->props.mode) { > > > + case XFRM_MODE_TUNNEL: > > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TUNNEL; > > > + break; > > > + case XFRM_MODE_TRANSPORT: > > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TRANSPORT; > > > + break; > > > > Why is it important for IPsec crypto? The HW logic must be the same for > > all modes. There are no differences between transport and tunnel. > > As I mentioned above, it's differentiated in HW to support more features. You are adding crypto offload, so please don't try to sneak "more" features. > > > > > > + default: > > > + nn_err(nn, "Unsupported mode for xfrm offload\n"); > > > > There are no other modes. > > > > <...> > > > > > + err = xa_alloc(&nn->xa_ipsec, &saidx, x, > > > + XA_LIMIT(0, NFP_NET_IPSEC_MAX_SA_CNT - 1), > > GFP_KERNEL); > > > > Create XArray with XA_FLAGS_ALLOC1, it will cause to xarray skip 0. > > See DEFINE_XARRAY_ALLOC1() for more info. > > Actually 0 is a valid SA id in HW/driver, we don't want to skip 0. NP, thanks
On Mon, 7 Nov 2022 14:40:53 +0200, Leon Romanovsky wrote: > On Mon, Nov 07, 2022 at 09:46:46AM +0000, Yinjun Zhang wrote: > > On Mon, 7 Nov 2022 08:14:12 +0200, Leon Romanovsky wrote: > > <...> > > > > + > > > > + /* General */ > > > > + switch (x->props.mode) { > > > > + case XFRM_MODE_TUNNEL: > > > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TUNNEL; > > > > + break; > > > > + case XFRM_MODE_TRANSPORT: > > > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TRANSPORT; > > > > + break; > > > > > > Why is it important for IPsec crypto? The HW logic must be the same for > > > all modes. There are no differences between transport and tunnel. > > > > As I mentioned above, it's differentiated in HW to support more features. > > You are adding crypto offload, so please don't try to sneak "more" features. > No sneaking, just have to conform to the design of HW, so that things are not messed up.
On Tue, Nov 08, 2022 at 01:28:20AM +0000, Yinjun Zhang wrote: > On Mon, 7 Nov 2022 14:40:53 +0200, Leon Romanovsky wrote: > > On Mon, Nov 07, 2022 at 09:46:46AM +0000, Yinjun Zhang wrote: > > > On Mon, 7 Nov 2022 08:14:12 +0200, Leon Romanovsky wrote: > > > <...> > > > > > + > > > > > + /* General */ > > > > > + switch (x->props.mode) { > > > > > + case XFRM_MODE_TUNNEL: > > > > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TUNNEL; > > > > > + break; > > > > > + case XFRM_MODE_TRANSPORT: > > > > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TRANSPORT; > > > > > + break; > > > > > > > > Why is it important for IPsec crypto? The HW logic must be the same for > > > > all modes. There are no differences between transport and tunnel. > > > > > > As I mentioned above, it's differentiated in HW to support more features. > > > > You are adding crypto offload, so please don't try to sneak "more" features. > > > > No sneaking, just have to conform to the design of HW, so that things are not > messed up. So what is the answer to my question above "Why is it important for IPsec crypto?"? Thanks
On Tue, 8 Nov 2022 20:42:59 +0200, Leon Romanovsky wrote: > On Tue, Nov 08, 2022 at 01:28:20AM +0000, Yinjun Zhang wrote: > > On Mon, 7 Nov 2022 14:40:53 +0200, Leon Romanovsky wrote: > > > On Mon, Nov 07, 2022 at 09:46:46AM +0000, Yinjun Zhang wrote: > > > > On Mon, 7 Nov 2022 08:14:12 +0200, Leon Romanovsky wrote: > > > > <...> > > > > > > + > > > > > > + /* General */ > > > > > > + switch (x->props.mode) { > > > > > > + case XFRM_MODE_TUNNEL: > > > > > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TUNNEL; > > > > > > + break; > > > > > > + case XFRM_MODE_TRANSPORT: > > > > > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TRANSPORT; > > > > > > + break; > > > > > > > > > > Why is it important for IPsec crypto? The HW logic must be the same for > > > > > all modes. There are no differences between transport and tunnel. > > > > > > > > As I mentioned above, it's differentiated in HW to support more features. > > > > > > You are adding crypto offload, so please don't try to sneak "more" features. > > > > > > > No sneaking, just have to conform to the design of HW, so that things are not > > messed up. > > So what is the answer to my question above "Why is it important for IPsec crypto?"? It indeed doesn't affect the functionality with crypto-only while no protocol involved, just some statistics is related since different modes go into different paths in HW. > > Thanks
On Mon, 7 Nov 2022 08:14:12 +0200, Leon Romanovsky wrote: > On Tue, Nov 01, 2022 at 12:02:48PM +0100, Simon Horman wrote: <...> > > + > > + /* General */ > > + switch (x->props.mode) { > > + case XFRM_MODE_TUNNEL: > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TUNNEL; > > + break; > > + case XFRM_MODE_TRANSPORT: > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TRANSPORT; > > + break; > > + default: > > + nn_err(nn, "Unsupported mode for xfrm offload\n"); > > There are no other modes. Sorry this comment was neglected, but I have to say this is a good practice to avoid newly introduced mode in future sneaking into HW while it's not supported.
On Wed, Nov 09, 2022 at 06:58:44AM +0000, Yinjun Zhang wrote: > On Mon, 7 Nov 2022 08:14:12 +0200, Leon Romanovsky wrote: > > On Tue, Nov 01, 2022 at 12:02:48PM +0100, Simon Horman wrote: > <...> > > > + > > > + /* General */ > > > + switch (x->props.mode) { > > > + case XFRM_MODE_TUNNEL: > > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TUNNEL; > > > + break; > > > + case XFRM_MODE_TRANSPORT: > > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TRANSPORT; > > > + break; > > > + default: > > > + nn_err(nn, "Unsupported mode for xfrm offload\n"); > > > > There are no other modes. > > Sorry this comment was neglected, but I have to say this is a good practice to avoid > newly introduced mode in future sneaking into HW while it's not supported. There is a subtitle difference between not-existent flows and not-supported ones. Good practice is to rely on upper level API to do the right thing from the beginning. Thanks
On Wed, 9 Nov 2022 10:26:14 +0200, Leon Romanovsky wrote: > On Wed, Nov 09, 2022 at 06:58:44AM +0000, Yinjun Zhang wrote: > > On Mon, 7 Nov 2022 08:14:12 +0200, Leon Romanovsky wrote: > > > On Tue, Nov 01, 2022 at 12:02:48PM +0100, Simon Horman wrote: > > <...> > > > > + > > > > + /* General */ > > > > + switch (x->props.mode) { > > > > + case XFRM_MODE_TUNNEL: > > > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TUNNEL; > > > > + break; > > > > + case XFRM_MODE_TRANSPORT: > > > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TRANSPORT; > > > > + break; > > > > + default: > > > > + nn_err(nn, "Unsupported mode for xfrm offload\n"); > > > > > > There are no other modes. > > > > Sorry this comment was neglected, but I have to say this is a good practice to avoid > > newly introduced mode in future sneaking into HW while it's not supported. > > There is a subtitle difference between not-existent flows and > not-supported ones. Good practice is to rely on upper level API to do > the right thing from the beginning. I don't see any restriction in upper level API that other modes cannot be offloaded, would you please double check it? > > Thanks
On Wed, Nov 09, 2022 at 12:09:17PM +0000, Yinjun Zhang wrote: > On Wed, 9 Nov 2022 10:26:14 +0200, Leon Romanovsky wrote: > > On Wed, Nov 09, 2022 at 06:58:44AM +0000, Yinjun Zhang wrote: > > > On Mon, 7 Nov 2022 08:14:12 +0200, Leon Romanovsky wrote: > > > > On Tue, Nov 01, 2022 at 12:02:48PM +0100, Simon Horman wrote: > > > <...> > > > > > + > > > > > + /* General */ > > > > > + switch (x->props.mode) { > > > > > + case XFRM_MODE_TUNNEL: > > > > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TUNNEL; > > > > > + break; > > > > > + case XFRM_MODE_TRANSPORT: > > > > > + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TRANSPORT; > > > > > + break; > > > > > + default: > > > > > + nn_err(nn, "Unsupported mode for xfrm offload\n"); > > > > > > > > There are no other modes. > > > > > > Sorry this comment was neglected, but I have to say this is a good practice to avoid > > > newly introduced mode in future sneaking into HW while it's not supported. > > > > There is a subtitle difference between not-existent flows and > > not-supported ones. Good practice is to rely on upper level API to do > > the right thing from the beginning. > > I don't see any restriction in upper level API that other modes cannot be offloaded, > would you please double check it? Fair enough, let's keep it as is for now. I'll fix XFRM in parallel to your submission. Thanks > > > > > Thanks
diff --git a/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c b/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c index 11575a9cb3b0..664a36be60e7 100644 --- a/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c +++ b/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c @@ -16,18 +16,546 @@ #define NFP_NET_IPSEC_MAX_SA_CNT (16 * 1024) /* Firmware support a maximum of 16K SA offload */ +/* IPsec config message cmd codes */ +enum nfp_ipsec_cfg_mssg_cmd_codes { + NFP_IPSEC_CFG_MSSG_ADD_SA, /* Add a new SA */ + NFP_IPSEC_CFG_MSSG_INV_SA, /* Invalidate an existing SA */ + NFP_IPSEC_CFG_MSSG_MODIFY_SA, /* Modify an existing SA */ + NFP_IPSEC_CFG_MSSG_GET_SA_STATS, /* Report SA counters, flags, etc. */ + NFP_IPSEC_CFG_MSSG_GET_SEQ_NUMS, /* Allocate sequence numbers */ + NFP_IPSEC_CFG_MSSG_LAST +}; + +/* IPsec config message response codes */ +enum nfp_ipsec_cfg_mssg_rsp_codes { + NFP_IPSEC_CFG_MSSG_OK, + NFP_IPSEC_CFG_MSSG_FAILED, + NFP_IPSEC_CFG_MSSG_SA_VALID, + NFP_IPSEC_CFG_MSSG_SA_HASH_ADD_FAILED, + NFP_IPSEC_CFG_MSSG_SA_HASH_DEL_FAILED, + NFP_IPSEC_CFG_MSSG_SA_INVALID_CMD +}; + +/* Protocol */ +enum nfp_ipsec_sa_prot { + NFP_IPSEC_PROTOCOL_AH = 0, + NFP_IPSEC_PROTOCOL_ESP = 1 +}; + +/* Mode */ +enum nfp_ipsec_sa_mode { + NFP_IPSEC_PROTMODE_TRANSPORT = 0, + NFP_IPSEC_PROTMODE_TUNNEL = 1 +}; + +/* Cipher types */ +enum nfp_ipsec_sa_cipher { + NFP_IPSEC_CIPHER_NULL, + NFP_IPSEC_CIPHER_3DES, + NFP_IPSEC_CIPHER_AES128, + NFP_IPSEC_CIPHER_AES192, + NFP_IPSEC_CIPHER_AES256, + NFP_IPSEC_CIPHER_AES128_NULL, + NFP_IPSEC_CIPHER_AES192_NULL, + NFP_IPSEC_CIPHER_AES256_NULL, + NFP_IPSEC_CIPHER_CHACHA20 +}; + +/* Cipher modes */ +enum nfp_ipsec_sa_cipher_mode { + NFP_IPSEC_CIMODE_ECB, + NFP_IPSEC_CIMODE_CBC, + NFP_IPSEC_CIMODE_CFB, + NFP_IPSEC_CIMODE_OFB, + NFP_IPSEC_CIMODE_CTR +}; + +/* Hash types */ +enum nfp_ipsec_sa_hash_type { + NFP_IPSEC_HASH_NONE, + NFP_IPSEC_HASH_MD5_96, + NFP_IPSEC_HASH_SHA1_96, + NFP_IPSEC_HASH_SHA256_96, + NFP_IPSEC_HASH_SHA384_96, + NFP_IPSEC_HASH_SHA512_96, + NFP_IPSEC_HASH_MD5_128, + NFP_IPSEC_HASH_SHA1_80, + NFP_IPSEC_HASH_SHA256_128, + NFP_IPSEC_HASH_SHA384_192, + NFP_IPSEC_HASH_SHA512_256, + NFP_IPSEC_HASH_GF128_128, + NFP_IPSEC_HASH_POLY1305_128 +}; + +/* IPSEC_CFG_MSSG_ADD_SA */ +struct nfp_ipsec_cfg_add_sa { + u32 ciph_key[8]; /* Cipher Key */ + union { + u32 auth_key[16]; /* Authentication Key */ + struct nfp_ipsec_aesgcm { /* AES-GCM-ESP fields */ + u32 salt; /* Initialized with SA */ + u32 iv[2]; /* Firmware use only */ + u32 cntr; + u32 zeros[4]; /* Init to 0 with SA */ + u32 len_a[2]; /* Firmware use only */ + u32 len_c[2]; + u32 spare0[4]; + } aesgcm_fields; + }; + struct sa_ctrl_word { + uint32_t hash :4; /* From nfp_ipsec_sa_hash_type */ + uint32_t cimode :4; /* From nfp_ipsec_sa_cipher_mode */ + uint32_t cipher :4; /* From nfp_ipsec_sa_cipher */ + uint32_t mode :2; /* From nfp_ipsec_sa_mode */ + uint32_t proto :2; /* From nfp_ipsec_sa_prot */ + uint32_t dir :1; /* SA direction */ + uint32_t ena_arw:1; /* Anti-Replay Window */ + uint32_t ext_seq:1; /* 64-bit Sequence Num */ + uint32_t ext_arw:1; /* 64b Anti-Replay Window */ + uint32_t spare2 :9; /* Must be set to 0 */ + uint32_t encap_dsbl:1; /* Encap/Decap disable */ + uint32_t gen_seq:1; /* Firmware Generate Seq */ + uint32_t spare8 :1; /* Must be set to 0 */ + } ctrl_word; + u32 spi; /* SPI Value */ + uint32_t pmtu_limit :16; /* PMTU Limit */ + uint32_t spare3 :1; + uint32_t frag_check :1; /* Stateful fragment checking flag */ + uint32_t bypass_DSCP:1; /* Bypass DSCP Flag */ + uint32_t df_ctrl :2; /* DF Control bits */ + uint32_t ipv6 :1; /* Outbound IPv6 addr format */ + uint32_t udp_enable :1; /* Add/Remove UDP header for NAT */ + uint32_t tfc_enable :1; /* Traffic Flow Confidentiality */ + uint32_t spare4 :8; + u32 soft_lifetime_byte_count; + u32 hard_lifetime_byte_count; + u32 src_ip[4]; /* Src IP addr */ + u32 dst_ip[4]; /* Dst IP addr */ + uint32_t natt_dst_port :16; /* NAT-T UDP Header dst port */ + uint32_t natt_src_port :16; /* NAT-T UDP Header src port */ + u32 soft_lifetime_time_limit; + u32 hard_lifetime_time_limit; + u32 sa_creation_time_lo_32; /* Ucode fills this in */ + u32 sa_creation_time_hi_32; /* Ucode fills this in */ + uint32_t reserved0 :16; + uint32_t tfc_padding :16; /* Traffic Flow Confidential Pad */ +}; + +/* IPSEC_CFG_MSSG_INV_SA */ +struct nfp_ipsec_cfg_inv_sa { + u32 spare6; +}; + +/* IPSEC_CFG_MSSG_GET_SA_STATS */ +struct nfp_ipsec_cfg_get_sa_stats { + u32 seq_lo; /* Sequence Number (low 32bits) */ + u32 seq_high; /* Sequence Number (high 32bits) */ + u32 arw_counter_lo; /* Anti-replay wndw cntr */ + u32 arw_counter_high; /* Anti-replay wndw cntr */ + u32 arw_bitmap_lo; /* Anti-replay wndw bitmap */ + u32 arw_bitmap_high; /* Anti-replay wndw bitmap */ + uint32_t reserved1:1; + uint32_t soft_lifetime_byte_cnt_exceeded :1; /* Soft cnt_exceeded */ + uint32_t hard_lifetime_byte_cnt_exceeded :1; /* Hard cnt_exceeded */ + uint32_t soft_lifetime_time_limit_exceeded :1; /* Soft cnt_exceeded */ + uint32_t hard_lifetime_time_limit_exceeded :1; /* Hard cnt_exceeded */ + uint32_t spare7:27; + u32 lifetime_byte_count; + u32 pkt_count; + u32 discards_auth; /* Auth failures */ + u32 discards_unsupported; /* Unsupported crypto mode */ + u32 discards_alignment; /* Alignment error */ + u32 discards_hard_bytelimit; /* Byte Count limit */ + u32 discards_seq_num_wrap; /* Sequ Number wrap */ + u32 discards_pmtu_limit_exceeded; /* PMTU Limit */ + u32 discards_arw_old_seq; /* Anti-Replay seq small */ + u32 discards_arw_replay; /* Anti-Replay seq rcvd */ + u32 discards_ctrl_word; /* Bad SA Control word */ + u32 discards_ip_hdr_len; /* Hdr offset from too high */ + u32 discards_eop_buf; /* No EOP buffer */ + u32 ipv4_id_counter; /* IPv4 ID field counter */ + u32 discards_isl_fail; /* Inbound SPD Lookup failure */ + u32 discards_ext_not_found; /* Ext header end */ + u32 discards_max_ext_hdrs; /* Max ext header */ + u32 discards_non_ext_hdrs; /* Non-extension headers */ + u32 discards_ext_hdr_too_big; /* Ext header chain */ + u32 discards_hard_timelimit; /* Time Limit */ +}; + +/* IPSEC_CFG_MSSG_GET_SEQ_NUMS */ +struct ipsec_cfg_get_seq_nums { + u32 seq_nums; /* Sequence numbers to allocate */ + u32 seq_num_low; /* Rtrn start seq num 31:00 */ + u32 seq_num_hi; /* Rtrn start seq num 63:32 */ +}; + +/* IPSEC_CFG_MSSG */ +struct nfp_ipsec_cfg_mssg { + union { + struct{ + uint32_t cmd:16; /* One of nfp_ipsec_cfg_mssg_cmd_codes */ + uint32_t rsp:16; /* One of nfp_ipsec_cfg_mssg_rsp_codes */ + uint32_t sa_idx:16; /* SA table index */ + uint32_t spare0:16; + union { + struct nfp_ipsec_cfg_add_sa cfg_add_sa; + struct nfp_ipsec_cfg_inv_sa cfg_inv_sa; + struct nfp_ipsec_cfg_get_sa_stats cfg_get_stats; + struct ipsec_cfg_get_seq_nums cfg_get_seq_nums; + }; + }; + u32 raw[64]; + }; +}; + +static int nfp_ipsec_cfg_cmd_issue(struct nfp_net *nn, int type, int saidx, + struct nfp_ipsec_cfg_mssg *msg) +{ + int i, msg_size, ret; + + msg->cmd = type; + msg->sa_idx = saidx; + msg->rsp = 0; + msg_size = ARRAY_SIZE(msg->raw); + + for (i = 0; i < msg_size; i++) + nn_writel(nn, NFP_NET_CFG_MBOX_VAL + 4 * i, msg->raw[i]); + + ret = nfp_net_mbox_reconfig(nn, NFP_NET_CFG_MBOX_CMD_IPSEC); + if (ret < 0) + return ret; + + /* For now we always read the whole message response back */ + for (i = 0; i < msg_size; i++) + msg->raw[i] = nn_readl(nn, NFP_NET_CFG_MBOX_VAL + 4 * i); + + switch (msg->rsp) { + case NFP_IPSEC_CFG_MSSG_OK: + return 0; + case NFP_IPSEC_CFG_MSSG_SA_INVALID_CMD: + return -EINVAL; + case NFP_IPSEC_CFG_MSSG_SA_VALID: + return -EEXIST; + case NFP_IPSEC_CFG_MSSG_FAILED: + case NFP_IPSEC_CFG_MSSG_SA_HASH_ADD_FAILED: + case NFP_IPSEC_CFG_MSSG_SA_HASH_DEL_FAILED: + return -EIO; + default: + return -EDOM; + } +} + +static int set_aes_keylen(struct nfp_ipsec_cfg_add_sa *cfg, int alg, int keylen) +{ + if (alg == SADB_X_EALG_NULL_AES_GMAC) { + if (keylen == 128) + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES128_NULL; + else if (keylen == 192) + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES192_NULL; + else if (keylen == 256) + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES256_NULL; + else + return -EINVAL; + } else { + if (keylen == 128) + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES128; + else if (keylen == 192) + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES192; + else if (keylen == 256) + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES256; + else + return -EINVAL; + } + + return 0; +} + static int nfp_net_xfrm_add_state(struct xfrm_state *x) { - return -EOPNOTSUPP; + struct net_device *netdev = x->xso.dev; + struct nfp_ipsec_cfg_mssg msg = {0}; + int i, key_len, trunc_len, err = 0; + struct nfp_ipsec_cfg_add_sa *cfg; + struct nfp_net *nn; + unsigned int saidx; + __be32 *p; + + nn = netdev_priv(netdev); + cfg = &msg.cfg_add_sa; + + /* General */ + switch (x->props.mode) { + case XFRM_MODE_TUNNEL: + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TUNNEL; + break; + case XFRM_MODE_TRANSPORT: + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TRANSPORT; + break; + default: + nn_err(nn, "Unsupported mode for xfrm offload\n"); + return -EINVAL; + } + + switch (x->id.proto) { + case IPPROTO_ESP: + cfg->ctrl_word.proto = NFP_IPSEC_PROTOCOL_ESP; + break; + case IPPROTO_AH: + cfg->ctrl_word.proto = NFP_IPSEC_PROTOCOL_AH; + break; + default: + nn_err(nn, "Unsupported protocol for xfrm offload\n"); + return -EINVAL; + } + + if (x->props.flags & XFRM_STATE_ESN) { + nn_err(nn, "Unsupported XFRM_REPLAY_MODE_ESN for xfrm offload\n"); + return -EINVAL; + } + + cfg->ctrl_word.ena_arw = 0; + cfg->ctrl_word.ext_arw = 0; + cfg->spi = ntohl(x->id.spi); + + /* Hash/Authentication */ + if (x->aalg) + trunc_len = x->aalg->alg_trunc_len; + else + trunc_len = 0; + + switch (x->props.aalgo) { + case SADB_AALG_NONE: + if (x->aead) { + trunc_len = -1; + } else { + nn_err(nn, "Unsupported authentication algorithm\n"); + return -EINVAL; + } + break; + case SADB_X_AALG_NULL: + cfg->ctrl_word.hash = NFP_IPSEC_HASH_NONE; + trunc_len = -1; + break; + case SADB_AALG_MD5HMAC: + if (trunc_len == 96) + cfg->ctrl_word.hash = NFP_IPSEC_HASH_MD5_96; + else if (trunc_len == 128) + cfg->ctrl_word.hash = NFP_IPSEC_HASH_MD5_128; + else + trunc_len = 0; + break; + case SADB_AALG_SHA1HMAC: + if (trunc_len == 96) + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA1_96; + else if (trunc_len == 80) + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA1_80; + else + trunc_len = 0; + break; + case SADB_X_AALG_SHA2_256HMAC: + if (trunc_len == 96) + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA256_96; + else if (trunc_len == 128) + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA256_128; + else + trunc_len = 0; + break; + case SADB_X_AALG_SHA2_384HMAC: + if (trunc_len == 96) + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA384_96; + else if (trunc_len == 192) + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA384_192; + else + trunc_len = 0; + break; + case SADB_X_AALG_SHA2_512HMAC: + if (trunc_len == 96) + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA512_96; + else if (trunc_len == 256) + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA512_256; + else + trunc_len = 0; + break; + default: + nn_err(nn, "Unsupported authentication algorithm\n"); + return -EINVAL; + } + + if (!trunc_len) { + nn_err(nn, "Unsupported authentication algorithm trunc length\n"); + return -EINVAL; + } + + if (x->aalg) { + p = (__be32 *)x->aalg->alg_key; + key_len = DIV_ROUND_UP(x->aalg->alg_key_len, BITS_PER_BYTE); + if (key_len > sizeof(cfg->auth_key)) { + nn_err(nn, "Insufficient space for offloaded auth key\n"); + return -EINVAL; + } + for (i = 0; i < key_len / sizeof(cfg->auth_key[0]) ; i++) + cfg->auth_key[i] = ntohl(*p++); + } + /* Encryption */ + switch (x->props.ealgo) { + case SADB_EALG_NONE: + case SADB_EALG_NULL: + cfg->ctrl_word.cimode = NFP_IPSEC_CIMODE_CBC; + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_NULL; + break; + case SADB_EALG_3DESCBC: + cfg->ctrl_word.cimode = NFP_IPSEC_CIMODE_CBC; + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_3DES; + break; + case SADB_X_EALG_AES_GCM_ICV16: + case SADB_X_EALG_NULL_AES_GMAC: + if (!x->aead) { + nn_err(nn, "Invalid AES key data\n"); + return -EINVAL; + } + + if (x->aead->alg_icv_len != 128) { + nn_err(nn, "ICV must be 128bit with SADB_X_EALG_AES_GCM_ICV16\n"); + return -EINVAL; + } + cfg->ctrl_word.cimode = NFP_IPSEC_CIMODE_CTR; + cfg->ctrl_word.hash = NFP_IPSEC_HASH_GF128_128; + + /* Aead->alg_key_len includes 32-bit salt */ + if (set_aes_keylen(cfg, x->props.ealgo, x->aead->alg_key_len - 32)) { + nn_err(nn, "Unsupported AES key length %d\n", x->aead->alg_key_len); + return -EINVAL; + } + break; + case SADB_X_EALG_AESCBC: + cfg->ctrl_word.cimode = NFP_IPSEC_CIMODE_CBC; + if (!x->ealg) { + nn_err(nn, "Invalid AES key data\n"); + return -EINVAL; + } + if (set_aes_keylen(cfg, x->props.ealgo, x->ealg->alg_key_len) < 0) { + nn_err(nn, "Unsupported AES key length %d\n", x->ealg->alg_key_len); + return -EINVAL; + } + break; + default: + nn_err(nn, "Unsupported encryption algorithm for offload\n"); + return -EINVAL; + } + + if (x->aead) { + int salt_len = 4; + + p = (__be32 *)x->aead->alg_key; + key_len = DIV_ROUND_UP(x->aead->alg_key_len, BITS_PER_BYTE); + key_len -= salt_len; + + if (key_len > sizeof(cfg->ciph_key)) { + nn_err(nn, "aead: Insufficient space for offloaded key\n"); + return -EINVAL; + } + + for (i = 0; i < key_len / sizeof(cfg->ciph_key[0]) ; i++) + cfg->ciph_key[i] = ntohl(*p++); + + /* Load up the salt */ + for (i = 0; i < salt_len; i++) + cfg->auth_key[i] = ntohl(*p++); + } + + if (x->ealg) { + p = (__be32 *)x->ealg->alg_key; + key_len = DIV_ROUND_UP(x->ealg->alg_key_len, BITS_PER_BYTE); + + if (key_len > sizeof(cfg->ciph_key)) { + nn_err(nn, "ealg: Insufficient space for offloaded key\n"); + return -EINVAL; + } + for (i = 0; i < key_len / sizeof(cfg->ciph_key[0]) ; i++) + cfg->ciph_key[i] = ntohl(*p++); + } + /* IP related info */ + switch (x->props.family) { + case AF_INET: + cfg->ipv6 = 0; + cfg->src_ip[0] = ntohl(x->props.saddr.a4); + cfg->dst_ip[0] = ntohl(x->id.daddr.a4); + break; + case AF_INET6: + cfg->ipv6 = 1; + for (i = 0; i < 4; i++) { + cfg->src_ip[i] = ntohl(x->props.saddr.a6[i]); + cfg->dst_ip[i] = ntohl(x->id.daddr.a6[i]); + } + break; + default: + nn_err(nn, "Unsupported address family\n"); + return -EINVAL; + } + + /* Maximum nic IPsec code could handle. Other limits may apply. */ + cfg->pmtu_limit = 0xffff; + + /* Host will generate the sequence numbers so that if packets get + * fragmented in host, sequence numbers will stay in sync. + */ + cfg->ctrl_word.gen_seq = 0; + + cfg->ctrl_word.encap_dsbl = 1; + + /* SA direction */ + cfg->ctrl_word.dir = x->xso.dir; + + /* Find unused SA data*/ + err = xa_alloc(&nn->xa_ipsec, &saidx, x, + XA_LIMIT(0, NFP_NET_IPSEC_MAX_SA_CNT - 1), GFP_KERNEL); + if (err < 0) { + nn_err(nn, "Unable to get sa_data number for IPsec\n"); + return err; + } + + /* Allocate saidx and commit the SA */ + err = nfp_ipsec_cfg_cmd_issue(nn, NFP_IPSEC_CFG_MSSG_ADD_SA, saidx, &msg); + if (err) { + xa_erase(&nn->xa_ipsec, saidx); + nn_err(nn, "Failed to issue IPsec command err ret=%d\n", err); + return err; + } + + /* 0 is invalid offload_handle for kernel */ + x->xso.offload_handle = saidx + 1; + return 0; } static void nfp_net_xfrm_del_state(struct xfrm_state *x) { + struct net_device *netdev = x->xso.dev; + struct nfp_ipsec_cfg_mssg msg; + struct nfp_net *nn; + int err; + + nn = netdev_priv(netdev); + err = nfp_ipsec_cfg_cmd_issue(nn, NFP_IPSEC_CFG_MSSG_INV_SA, + x->xso.offload_handle - 1, &msg); + if (err) + nn_warn(nn, "Failed to invalidate SA in hardware\n"); + + xa_erase(&nn->xa_ipsec, x->xso.offload_handle - 1); } static bool nfp_net_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *x) { - return false; + if (x->props.family == AF_INET) { + /* Offload with IPv4 options is not supported yet */ + if (ip_hdr(skb)->ihl != 5) + return false; + } else { + /* Offload with IPv6 extension headers is not support yet */ + if (ipv6_ext_hdr(ipv6_hdr(skb)->nexthdr)) + return false; + } + + return true; } static const struct xfrmdev_ops nfp_net_ipsec_xfrmdev_ops = { diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c index 8e9b34b133f4..e83f58590248 100644 --- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c +++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c @@ -2373,6 +2373,12 @@ static void nfp_net_netdev_init(struct nfp_net *nn) } if (nn->cap & NFP_NET_CFG_CTRL_RSS_ANY) netdev->hw_features |= NETIF_F_RXHASH; + +#ifdef CONFIG_NFP_NET_IPSEC + if (nn->cap_w1 & NFP_NET_CFG_CTRL_IPSEC) + netdev->hw_features |= NETIF_F_HW_ESP | NETIF_F_HW_ESP_TX_CSUM; +#endif + if (nn->cap & NFP_NET_CFG_CTRL_VXLAN) { if (nn->cap & NFP_NET_CFG_CTRL_LSO) { netdev->hw_features |= NETIF_F_GSO_UDP_TUNNEL | diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h index 8f75efd9e463..cc11b3dc1252 100644 --- a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h +++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h @@ -402,14 +402,14 @@ */ #define NFP_NET_CFG_MBOX_BASE 0x1800 #define NFP_NET_CFG_MBOX_VAL_MAX_SZ 0x1F8 - +#define NFP_NET_CFG_MBOX_VAL 0x1808 #define NFP_NET_CFG_MBOX_SIMPLE_CMD 0x0 #define NFP_NET_CFG_MBOX_SIMPLE_RET 0x4 #define NFP_NET_CFG_MBOX_SIMPLE_VAL 0x8 #define NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_ADD 1 #define NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_KILL 2 - +#define NFP_NET_CFG_MBOX_CMD_IPSEC 3 #define NFP_NET_CFG_MBOX_CMD_PCI_DSCP_PRIOMAP_SET 5 #define NFP_NET_CFG_MBOX_CMD_TLV_CMSG 6