From patchwork Thu Feb 20 21:39:51 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Tariq Toukan X-Patchwork-Id: 13984526 Received: from NAM12-MW2-obe.outbound.protection.outlook.com (mail-mw2nam12on2076.outbound.protection.outlook.com [40.107.244.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B1BAF264F84; Thu, 20 Feb 2025 21:41:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.244.76 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087682; cv=fail; b=fMzdQI2qExgYe0ZWn072ObckntLulVM9akViFFW9exMoBZejMxet4pp/lqiCm0TUvllI06IHTgsTTiGDC+21v6zBTccqAIECzZlweAYO+hu1Gw8J5PwydOghQkdPLRUifnOn9TwiP8XSvPGsCz2qqwZu6sljZXjPdWUpXJPDuYY= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087682; c=relaxed/simple; bh=QyKm1IsKsVCyshqiXw0T6lfCmWfp7Au++5VDUXpgYKU=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Z+vYiFXiEiT42MKUCMDlkFh7C9a411JqxF1hPZSsqBOMSRk+gwQbiwTl9MzTH953jle8YkUNx9wx+oe+5fW7t29Vlv0ey/EIEj+qmsXhNA1WLlJZyAfVS0o4C6iUqNki/HZpF2Ne7uVEiUhcjbc74EPKpfyRQ6np8akxt6Maa8o= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=AAJQBof4; arc=fail smtp.client-ip=40.107.244.76 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="AAJQBof4" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=FF136L48qzCKsnIYkUWcjlC+nUti8rmXWMQKVRLeAaORGN/1eGJjmw1Fa0sZP4ylonI/QG4N+ZOKSq1TKgu12FsnBRgxkRF1ZE80x31bvgKQLLciksN4wXAM7O21mCtMwC3jv2i3W2NFTwKj9HO2ItsKXEW7imPahZX485Fkaza52ezg3HfWhnpCpklrrqllq+vcvodIFT/MDAb3QFatrDzH3JFCdFAEEVooeQVd8D6SOlfd10wMTkFHpvTWe0iv3ciCm1DuNXEbImx6hCLVTeBZDOeQpdOdmg82l/tHe6qFRTf9rHmLDREC+yWBnMvMFnYXp97luw9myumdpPSnPA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=WlB7CJkblbu71GHl37/tYt2PEL3oFAKlAjjQ7yk7se8=; b=JY1GgfH5WBz80xKDiHl+xy6pmlazuIwwIha4yw7kKrYjsbFaA/hj4RGriRutEd6GKRwVIBX6Bj3saco9ZryOhmOrW6MzpYK4W998GGy9r6v2HizQw0XdNxGmfEXhGIbBTAQtvGXUiwleFfjLbjClRpE45I5NYHKRAV1nIPsTaX64QF18Sr9QXArt15pcPYAc4BGOZziqioiGvfKGZft8qbVIunpC0c8N7pkJ7fuoyhuaFR1r9f8TaURtkrMM/37FGYUB5T5nbLgVRjtBQr/6MiQoO1Dsx2UdO2NuPmCWKdWQ+fZNnTpys3AVpfXGnIXHi/5A7aOaOe6bcrmp4hjNUQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=temperror (sender ip is 216.228.118.232) smtp.rcpttodomain=davemloft.net smtp.mailfrom=nvidia.com; dmarc=temperror action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=WlB7CJkblbu71GHl37/tYt2PEL3oFAKlAjjQ7yk7se8=; b=AAJQBof4XJFmXVOunT4lcN3VFR6/PIU8B5Onhk00+oGCLH8W+8SSqJ1apBy0xp/+lsYo1dXXfT3kUZ7hnVzGVeKuxjGgZ8r/n2vvlFjdGAwGyue/pry2oHPt129xacz9Woz5aJ1iWo9KwCT4mC5RTWTdDrXPRflQP76aDscKKIjnVNwK+3Xe1qKZmzKNWeGXP0YZWEeMpFmCL9bachp2bK8rh6KbanA5gfy7aowB18hsAJ62t9mizbqROfCqb3jXcKDnVsliYc8Cf1vsHLporK4nN3PHV2+dYRG4X2R/yQq1BDlaXncX8eaV3vo2f7CUnU70oMbtm41dinxha7m7tg== Received: from SN1PR12CA0065.namprd12.prod.outlook.com (2603:10b6:802:20::36) by IA0PR12MB7773.namprd12.prod.outlook.com (2603:10b6:208:431::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8466.16; Thu, 20 Feb 2025 21:41:04 +0000 Received: from SN1PEPF0002636A.namprd02.prod.outlook.com (2603:10b6:802:20:cafe::8c) by SN1PR12CA0065.outlook.office365.com (2603:10b6:802:20::36) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8466.15 via Frontend Transport; Thu, 20 Feb 2025 21:41:04 +0000 X-MS-Exchange-Authentication-Results: spf=temperror (sender IP is 216.228.118.232) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=temperror action=none header.from=nvidia.com; Received-SPF: TempError (protection.outlook.com: error in processing during lookup of nvidia.com: DNS Timeout) Received: from mail.nvidia.com (216.228.118.232) by SN1PEPF0002636A.mail.protection.outlook.com (10.167.241.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8466.11 via Frontend Transport; Thu, 20 Feb 2025 21:41:02 +0000 Received: from drhqmail203.nvidia.com (10.126.190.182) by mail.nvidia.com (10.127.129.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Thu, 20 Feb 2025 13:40:46 -0800 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail203.nvidia.com (10.126.190.182) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.14; Thu, 20 Feb 2025 13:40:45 -0800 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.1544.14 via Frontend Transport; Thu, 20 Feb 2025 13:40:42 -0800 From: Tariq Toukan To: "David S. Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet , "Andrew Lunn" CC: Gal Pressman , Mark Bloch , "Saeed Mahameed" , Leon Romanovsky , Tariq Toukan , , , , Jianbo Liu , "Leon Romanovsky" , Patrisious Haddad Subject: [PATCH net-next 1/8] net/mlx5e: Add helper function to update IPSec default destination Date: Thu, 20 Feb 2025 23:39:51 +0200 Message-ID: <20250220213959.504304-2-tariqt@nvidia.com> X-Mailer: git-send-email 2.45.0 In-Reply-To: <20250220213959.504304-1-tariqt@nvidia.com> References: <20250220213959.504304-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-rdma@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-NV-OnPremToCloud: AnonymousSubmission X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SN1PEPF0002636A:EE_|IA0PR12MB7773:EE_ X-MS-Office365-Filtering-Correlation-Id: 0bf12087-7687-4ee4-3352-08dd51f745e3 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700013|82310400026|376014|1800799024; X-Microsoft-Antispam-Message-Info: =?utf-8?q?0kPqREEw5J26fMbqkWzf6kifzhbucL4?= =?utf-8?q?Q1EW4cLNcTVPLXzpBPYyAAFkbjQ9EX5y8WE+7zXZCDJKRpWGlerlq+ckIcVci0Y4m?= =?utf-8?q?+5/G+lpEdR3ElSJmLB19bokFiLbYfHfDyh9jFb2dzosB5LGo8QoOQiewFdMCxAfQr?= =?utf-8?q?QBFZ9+GZBjb+Ep6RxmTUeT+5hyZhLcCoIqFfrLIFWTXMGHA4zzGjEDn59XTZUxvob?= =?utf-8?q?IAlzUOnwY3oo6tH6439L3rl+Bhr15qSg6avr8ZwhSpzIKSb73fEE5wb7Nh0+JwRRr?= =?utf-8?q?356Q3S66VXBlEzvrtnzmlFTIsHp/8rcCEo5K3vIvdAzrckmZin4ZTQNMCG1Uu3dtQ?= =?utf-8?q?hvSvNCFqOaO1OPn0SPYslL/tYkPWm/einjDphL/ifJxiX28k1kvyi9DHTwxR3CUhb?= =?utf-8?q?JKLlRO8iuiABiShZZOzOptDRnB/9RAY8tD6ACdEvKjyGGVxMiXZfTPoS3OcViFdWC?= =?utf-8?q?FmubHOdU824dsoYuzk5RM8p96MGSLzcHfr2Iut6pO8KS4S3bSRn2K9Yifd/aINMdH?= =?utf-8?q?MtJGWQ3t4kMqLjC7kGTfl8EgJBPGf4ZW26XFkU7Q7BbybjCnIMvMSnluNMD0M/zIL?= =?utf-8?q?f4wW959805lQQpoju7ZTjnM2GGMLkiq9j0nBngGbFWcYxsvWs7ARx1EBw7ZKTY9PX?= =?utf-8?q?X9y3fQjLuN4+XZC/VhaWW97P+Yb6VXm7a2IL3Tf75/mHTSfcs+8xBHaYYDs42NCik?= =?utf-8?q?F+5LJF2f2H8e7Esn22LmYConHBc1mWiX2ZcRa7aISWxwsSojqKIBxBkYlkJrS6abm?= =?utf-8?q?sSO8OQFTGgJdwtHDGQO83glWVhY23hoVZLgE/DrjsTlie1dpq4zBS7B/Veva9Bdqg?= =?utf-8?q?9a1qZKKkzoIw/zS0AEotLB5yjuzH+9UdDpkNg7c3Jfw5cnvMCRo6ilBDr1ZHvPaC5?= =?utf-8?q?DURCH88761s7zHvlaHVZ89N0Xn4hd8C1SuVW3sVFd/LSiyEicKxuGhJggGXIXBjgU?= =?utf-8?q?l/GFUWn0ofgjhBIKDkw6xUMQvzoHakGcCSvD5QUnaSdoN+7lRBnOKbhCL2ZmLyCmq?= =?utf-8?q?+IEvEcSPhF1ao57u3CYUZURGahPps5bGxlzUcp7v6HiYqc+u5nUBWqdUiDZqYVPBw?= =?utf-8?q?aUSlf04a6ciuOCwjqib416UurCFYFKDj436gv19FtMUnZOFDbhjmUGbkBEMpAm0m/?= =?utf-8?q?tR5vF6Kedksbwvzz0Bxshn6Kbkut26SQ9bgNT1ek2hISRc1aEKe4W7l5g+zBTUfZ5?= =?utf-8?q?Lbtj4rok4jhXOv2y0GgYOPldY/+jeW4gjwb6MwgocNWzhcZDED4It1xwdvxTKtkw2?= =?utf-8?q?72Wt2EqO/0DhDJtwz+OpaPoMsGD2peRGs4HQNUvvkBDxuG0yt9jrXw7uKpcwy+pzn?= =?utf-8?q?Z/nl7HsvAvjR/MTcQ/VrKFMGqnecO3yTrTcRmSg3wtkoDNtd87r9okdeGRCNZEtoL?= =?utf-8?q?Pj9D2EX8Ho06Q+Bc1vEWxgiu6ngEi63WUujOQHeduWlcHA51JtHI4I=3D?= X-Forefront-Antispam-Report: CIP:216.228.118.232;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge1.nvidia.com;CAT:NONE;SFS:(13230040)(36860700013)(82310400026)(376014)(1800799024);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Feb 2025 21:41:02.6361 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 0bf12087-7687-4ee4-3352-08dd51f745e3 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.232];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SN1PEPF0002636A.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA0PR12MB7773 From: Jianbo Liu The default destination of IPSec steering rules for MPV mode will be updated when the master device is brought up or down. Move the common code into the helper function. It’s convenient to update destinations in later patches. Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Reviewed-by: Patrisious Haddad Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c index e7b64679f121..7f82d530d3e1 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c @@ -493,6 +493,14 @@ static int ipsec_miss_create(struct mlx5_core_dev *mdev, return err; } +static void ipsec_rx_update_default_dest(struct mlx5e_ipsec_rx *rx, + struct mlx5_flow_destination *old_dest, + struct mlx5_flow_destination *new_dest) +{ + mlx5_modify_rule_destination(rx->status.rule, new_dest, old_dest); + mlx5_modify_rule_destination(rx->sa.rule, new_dest, old_dest); +} + static void handle_ipsec_rx_bringup(struct mlx5e_ipsec *ipsec, u32 family) { struct mlx5e_ipsec_rx *rx = ipsec_rx(ipsec, family, XFRM_DEV_OFFLOAD_PACKET); @@ -507,8 +515,7 @@ static void handle_ipsec_rx_bringup(struct mlx5e_ipsec *ipsec, u32 family) new_dest.ft = mlx5_ipsec_fs_roce_ft_get(ipsec->roce, family); new_dest.type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; - mlx5_modify_rule_destination(rx->status.rule, &new_dest, &old_dest); - mlx5_modify_rule_destination(rx->sa.rule, &new_dest, &old_dest); + ipsec_rx_update_default_dest(rx, &old_dest, &new_dest); } static void handle_ipsec_rx_cleanup(struct mlx5e_ipsec *ipsec, u32 family) @@ -520,8 +527,7 @@ static void handle_ipsec_rx_cleanup(struct mlx5e_ipsec *ipsec, u32 family) old_dest.type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; new_dest = mlx5_ttc_get_default_dest(mlx5e_fs_get_ttc(ipsec->fs, false), family2tt(family)); - mlx5_modify_rule_destination(rx->sa.rule, &new_dest, &old_dest); - mlx5_modify_rule_destination(rx->status.rule, &new_dest, &old_dest); + ipsec_rx_update_default_dest(rx, &old_dest, &new_dest); mlx5_ipsec_fs_roce_rx_destroy(ipsec->roce, family, ipsec->mdev); } From patchwork Thu Feb 20 21:39:52 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tariq Toukan X-Patchwork-Id: 13984525 Received: from NAM02-DM3-obe.outbound.protection.outlook.com (mail-dm3nam02on2066.outbound.protection.outlook.com [40.107.95.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0C1372641F1; Thu, 20 Feb 2025 21:41:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.95.66 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087679; cv=fail; b=KFYJbSERwsKcUuFvDXki4bVCaWnH+ZLz1llVLA2yuoxB1zvZPS7aiQRcYllt9iksa1LO4SDk11jITPr848LrFoRD+bU9rtzFQg3qSpn3UCswQGA+8+rsw6Aa1ly5iAuzYgxjiQ64iSqydKCndaCFGKqByIKyZdx7jayL/gi1KkQ= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087679; c=relaxed/simple; bh=w5GXFvsEG+Xl6V/ot1j409M1a6O8qxo+HzOGkhryEUI=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=XAN21NI+KrTC1Hu3b36lpJmWwilY2ywI1st+mRvNWCi6OKKl/RpkqMVOaksZFlNvxXd//rzSqcK9OayIN0AbCfI98pMuaTrCbg9Qe5locFY8mD8kiipAN67M9tvrNO/XTHQiZw0JquEssvMKaIXXI1fcSCsdOQc4ouZ3/cZDt7Q= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=BLT/0ViE; arc=fail smtp.client-ip=40.107.95.66 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="BLT/0ViE" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=pKwDS5dITkxlm+qdNjDp6kLgO8cVS5Vi2KVzKYqYcvZJllL3DxthzOmEmcYyrg5hBYq6BDyGlhMLQEZDaYJFiUiRgdvWCr5iWMvFojGJL1ldVa3t2op6XuqzFJy3aDEDNRbB4za2XwnrySiVHNQkDPafynD5E3pU+KwwJ17VDJjZRL3fqgJ4jhjg2317n0p5ZkR56/OouoNYXFrj4b49wyVFAmjbrMInMJOhVJenCFqfAhlwN9rcVy8LLft7PpWj7KI54I42xm5nAOFA9JuGcfgFdd8jcKqPCrPHmW4+S7oDq2PIC2MlyuUxQtFjBoTlJ+YHxMnbivxY4TzZD+LsVg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=+YAicW7d9TXKxSq+M00MoqCRgdl5YteRAJC/2K8OUkI=; b=rEc6ablhr8DQOUmRnG5XObGRgzZsvzalZSAnv5+Y/dVBK1/tdZ/YCgiv4bubrRtfHXgIhivpOIPJnOq0lxEvVWAP7YlWHkkb/vGIkLsldoPXSjc6c72tRTsnl0cPWfwlIIt+rtGYSNx7ymxj1LmjQJdM8J6UIxYdepWo9Yv7XV9J08mgni7gj/UqFfF7TPVTTt00w5iPh7Vy/DUzTml4g/hJ6ahAF5PbiQClqT4dvEgBEZbPPABsDpKb1eqJimsNkF4Tf9S7LxhLpH4SB9RdRYfSyTcHMEuYTz/gRSDAYcwcU6bwJmCMR9GGwFGONBEeBJa8rq8xBUEWp7qasgjoig== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.233) smtp.rcpttodomain=davemloft.net smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+YAicW7d9TXKxSq+M00MoqCRgdl5YteRAJC/2K8OUkI=; b=BLT/0ViE/LbpMSTYrItsuMiSvh2zzSBMjdlLd3jpm8qUepfUP3cqO7onav0baageD+Pp6Us31VMfX2LnPm4QtcgC3GBGVdo/SN0NV9PffaXsKsNRkMK0YZO9+c+fiInzdYi4yk1bn2oB4SlJXK5C5zn5gPBH8lvm+ww8wj4FTyyikgYa97N+CqVvkutqcK70Kp7sJVPPoIog/PaWxoM8eGCd7OdY/pFneWkO5pu5BoGh+k4P2gh/TQTTNxDHxYVXPyrdFL1RTZRQlxsCkCcHUU+71wgXUZ+TaXyxkSzxC3LrXyrEXcv/RuPTThMp1aO3QV6am5++sef7wKaY3nQZiw== Received: from SN4PR0501CA0013.namprd05.prod.outlook.com (2603:10b6:803:40::26) by DM4PR12MB5844.namprd12.prod.outlook.com (2603:10b6:8:67::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8445.19; Thu, 20 Feb 2025 21:41:12 +0000 Received: from SA2PEPF000015C9.namprd03.prod.outlook.com (2603:10b6:803:40:cafe::cd) by SN4PR0501CA0013.outlook.office365.com (2603:10b6:803:40::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8466.16 via Frontend Transport; Thu, 20 Feb 2025 21:41:11 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.233) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.233 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.233; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.233) by SA2PEPF000015C9.mail.protection.outlook.com (10.167.241.199) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8466.11 via Frontend Transport; Thu, 20 Feb 2025 21:41:11 +0000 Received: from drhqmail201.nvidia.com (10.126.190.180) by mail.nvidia.com (10.127.129.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Thu, 20 Feb 2025 13:40:50 -0800 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail201.nvidia.com (10.126.190.180) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.14; Thu, 20 Feb 2025 13:40:49 -0800 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.1544.14 via Frontend Transport; Thu, 20 Feb 2025 13:40:46 -0800 From: Tariq Toukan To: "David S. Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet , "Andrew Lunn" CC: Gal Pressman , Mark Bloch , "Saeed Mahameed" , Leon Romanovsky , Tariq Toukan , , , , Jianbo Liu , "Leon Romanovsky" , Patrisious Haddad Subject: [PATCH net-next 2/8] net/mlx5e: Change the destination of IPSec RX SA miss rule Date: Thu, 20 Feb 2025 23:39:52 +0200 Message-ID: <20250220213959.504304-3-tariqt@nvidia.com> X-Mailer: git-send-email 2.45.0 In-Reply-To: <20250220213959.504304-1-tariqt@nvidia.com> References: <20250220213959.504304-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-rdma@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-NV-OnPremToCloud: AnonymousSubmission X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SA2PEPF000015C9:EE_|DM4PR12MB5844:EE_ X-MS-Office365-Filtering-Correlation-Id: 52af04de-1197-41cc-b8ec-08dd51f74b1d X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|36860700013|376014|1800799024; X-Microsoft-Antispam-Message-Info: JLMrh5B+Tir6U5llH13kM1D7KMe4JkkTNw4f4aOfNaYiu53UyQjOZh25s0z9K8AFxjNhI5PSzn5FsU5ueTpT/xb0tHBuPo+6AeNWi/Q6H+4UUZfNLY7NSVC4wv6RfNq+8clvV2g2hbAppCryCOpnI0iDqwN2Aomoh0QfaTTRNwdZN6qhslpr/UuZzuvqOl/SWyo9fM4rwU3ENjAGCHJKIJFeZDCeScuMeykLImQQbMabCv0819ZZwHBloEz2EI5JIqOzfp45a6XprvisjY8W3sIryxsaBSRgQcRHsCGQGrdcimrtO/zUBtlx1+EqnKDRoPrDOufBRtEaYa3iUf11GwnFU/0wBP4B9FQ7umBPshRSmHJj1rWUqjsvbPRJaJzz3FfirMAnUy1xMmrnJHCt7TIVtMmxF8/+r6PiYtEkTWXjHrDXeV647zD+Pe7l9wnY3s6ceTxJCy9VcMf9Shs3tF0XPCYHLIaQQ3rAJunpNV85ctC+nWl4ahCSfeoE+HNBWTC8GTW+NyvmmwKq9ZIm9ApSjZj7HWM8SIFg4a3E1RyQ7vmW2ZLWe7cEBYzFe/WKSHfIGHo+N5w6IYqFXpgQiEC57evwBR8K85XiGZSL/+yGKa1Os6GMFJjyPrcko0SyjLMXXcLhBijCVYomUcOxFmUwd8nIilvghjZeTHvueNGN1lJKiuM+weP3CgcjrjV4m9wLkPjVFyAnkbDm9zaET+4CrfrwS9gYe87gzYOJlIKSi5te4LqHeV/qXlQlxfmH6Zh84+pTKwt35id5ATZX/dssACmd5qmWo5UEasOxfB1Q9IzJxTKffOzCWOVV34E/RgePJGL2CjONqTCT2yLSiTuj1wTK5RaYhcT7T89quWxzmjkpt/2h3+NTM1hUhn6obX0P2H5Y+wDFOJOkXjwVKer1qh6XbzShlGA5P5FagiSquPPaWELMqbpvX5JN42ZgKODKCuFrNWVvPiRFvPeHS+D/Xr+meVFjweXu/NOFR6y/gGlLRoFMPbhYwkTrNv1RCjq1yONG12fbGWqRC/kb4E17UPpkEKvyCi38ZvPqU+ReQvccYKFKd7xssm4o5pdIrWYeAZD5wLbEpzSlFjMKJR4vFaO31jB/AkD68mpbFsvTeLu3MnscjD2DySWbTZMUhRXaInkzDMNGjA4Mt/K0uvomoNydY+wl9b0nz7NimP7pPdtd2Ko53btzFDBmNBCd/bPnYz96obZowwAxWKODYdTXRzbf1nu5oMbdQxqQYJCP/zn4YWcGskbbEH1o1N6jPq0zfl9IiFhdqi019kq+/c0UwXR0uncEq5ULkjqlHA6v//rgRlrYvNrVkfQCuhEZEvpOoOSLY2LTg1xgu3/24wmLPyG1hzN0mY0R9cjQFnmqtrYdE0/kfXfuJBJlZiS6FPpBfzEOPvaYARgcCWvRGpuhkgNUOgJ+JuEyAGkudvE8BFSEMRyTAiI5rPEn6Iio64kAKvnd0irVDnfhYe3pPede/9VPzPn3k8TH6t8tLek= X-Forefront-Antispam-Report: CIP:216.228.118.233;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge2.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(36860700013)(376014)(1800799024);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Feb 2025 21:41:11.4395 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 52af04de-1197-41cc-b8ec-08dd51f74b1d X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.233];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SA2PEPF000015C9.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR12MB5844 From: Jianbo Liu For eswitch in legacy mode, the packets decrypted in RX SA table will continue to be processed for RoCE. But this is not necessary for the un-decrypted packets, which don't match any decryption rules but hit the miss rule at the end of the table. So, change the destination of miss rule to TTC default one and skip RoCE. For eswitch in switchdev mode, the destination is unchanged. Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Reviewed-by: Patrisious Haddad Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 20 ++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c index 7f82d530d3e1..7c9fdea21366 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c @@ -498,7 +498,6 @@ static void ipsec_rx_update_default_dest(struct mlx5e_ipsec_rx *rx, struct mlx5_flow_destination *new_dest) { mlx5_modify_rule_destination(rx->status.rule, new_dest, old_dest); - mlx5_modify_rule_destination(rx->sa.rule, new_dest, old_dest); } static void handle_ipsec_rx_bringup(struct mlx5e_ipsec *ipsec, u32 family) @@ -658,6 +657,20 @@ static int ipsec_rx_status_pass_dest_get(struct mlx5e_ipsec *ipsec, return 0; } +static void ipsec_rx_sa_miss_dest_get(struct mlx5e_ipsec *ipsec, + struct mlx5e_ipsec_rx *rx, + struct mlx5e_ipsec_rx_create_attr *attr, + struct mlx5_flow_destination *dest, + struct mlx5_flow_destination *miss_dest) +{ + if (rx == ipsec->rx_esw) + *miss_dest = *dest; + else + *miss_dest = + mlx5_ttc_get_default_dest(attr->ttc, + family2tt(attr->family)); +} + static void ipsec_rx_ft_connect(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_rx *rx, struct mlx5e_ipsec_rx_create_attr *attr) @@ -672,8 +685,8 @@ static void ipsec_rx_ft_connect(struct mlx5e_ipsec *ipsec, static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_rx *rx, u32 family) { + struct mlx5_flow_destination dest[2], miss_dest; struct mlx5e_ipsec_rx_create_attr attr; - struct mlx5_flow_destination dest[2]; struct mlx5_flow_table *ft; u32 flags = 0; int err; @@ -709,7 +722,8 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, } rx->ft.sa = ft; - err = ipsec_miss_create(mdev, rx->ft.sa, &rx->sa, dest); + ipsec_rx_sa_miss_dest_get(ipsec, rx, &attr, &dest[0], &miss_dest); + err = ipsec_miss_create(mdev, rx->ft.sa, &rx->sa, &miss_dest); if (err) goto err_fs; From patchwork Thu Feb 20 21:39:53 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tariq Toukan X-Patchwork-Id: 13984528 Received: from NAM10-BN7-obe.outbound.protection.outlook.com (mail-bn7nam10on2046.outbound.protection.outlook.com [40.107.92.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6608426563A; Thu, 20 Feb 2025 21:41:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.92.46 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087686; cv=fail; b=tgVMGz0Lv9qhdwoDgEbwTKpCqfWObfqweegKEmIkjPhfrUG5GvTq+mLE0i3HoK4G0EwGZ7htloknG17UAgp35X16rCiPrU96iEun7qXqOV+tMbaG7mEwA7ycPUFsAl8GYSwxCQiO1FQEbH4QIbK93001bmHgBbiwSA09ScK6d2A= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087686; c=relaxed/simple; bh=erM8CNbM16ycYctp/oRcO9uSbJrwN0zxEcxiqzld5a0=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=mG3t4z4gKPbQR83XCT77VnmgsWpQ8O7x84wj//DykKyj5fgav/AJYFsNhJcw+TmMEgnKZXrUAswn4C9Bm+0UCqqlCFw8D/YNThZjz3IJVirtQ1FElKZFAdua9MTYc3oVVlkxI4Tl1q03kVuZyhgx17wcv40LbSybb0hUKvrNQO0= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=Kn4rR1RJ; arc=fail smtp.client-ip=40.107.92.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="Kn4rR1RJ" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=oaQ6/Tmg8eT6KvKXPnRjxy6b+teffCKnzgmX8s1o71ZeZwLFUrMGG7hGh22sQMMj6eBssWIjgh7hpLV1rKzPeJ/8cArN2wBn5+RG6ayL4bCDo0f8G02puyNUN1uCdxXTidfbj3Og7qO95d0pu5SX+/7ZLhqbRIF47mmRKEuQtuCE7bCYVbOfwIBmdc13OKnJFPq+q8TbYXOyhUk/sAZ4W5gbRfoUiEsu990QO4rHQv7nAUlRLPHAqU5n/y0WQQv0sAr2zsZLv0yGR7xqZdznRUJUGJeyzy2EuJ2sXWQQPih2sLB2NVXo3cUOrZW+ynTDSSiCz+Q8y+qLG+IVxK5s6g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=iJNX69m5adtbcsPQIdOzgJJPAFaEUx/D2C6hJnDShTQ=; b=u0TLmQXrKs+JoAB8TKuV5N33Fyj0bDEhrPeBIEWc3UsSDdSHAxYsHul7urJ3lyh7niQ/nG9xLmy/amuFNZ2jPbjIVGJqr+ZkhWGvrieWYAyh/FHqpkfaPwnMvqMfh51MjlW7UAg9iS5tSh26DG0lhieW3a2T7Jldf20YDOOkMZpTGzV0JbYjkd97OLPiLUoeZ+JP6m8E0XXmU61NZTLdx4gYhHa62xbvHK8aq16gkdYDXZbaqAgKZKrLau46lhp0h4G9nnz8tsQtracuIfUxiChQsSVq1IISSJx5cV9YyywkwiCH86ex0OPCOEqQBPznpVBtq0bBNUjD2cd8G81ybw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.232) smtp.rcpttodomain=davemloft.net smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=iJNX69m5adtbcsPQIdOzgJJPAFaEUx/D2C6hJnDShTQ=; b=Kn4rR1RJ5oDijRlttxmTRH6TCfZlZQU6376uC/UZU1vep5OhKQR23e+8+eiuLQEAV29tmGEe4B1qA7d+S8aLlpVu+Le50P2TuX+fAmagFQC6R73djcQL7FJETuCCSLwkAUXSrHG+mhpAJJ1k+CPLF30LQ7ermRNo2fcbl+zjD11skvAV7TtMr0DAv34VuHKDf5K0mPo5KbubgvsioksC6yf+nBzOrdVjON29bBsEC6r6sCf51bHWtuuvkuXKvFhshfAtHpTewOtFXr0jyvLpA20sk+u7+S7xlfi5m/ZHwKGpKjdMgtl+Ny+2ZIIngafxXAsq5qAplXb+sYAkQT80Cg== Received: from SA1P222CA0047.NAMP222.PROD.OUTLOOK.COM (2603:10b6:806:2d0::20) by DM6PR12MB4252.namprd12.prod.outlook.com (2603:10b6:5:211::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8466.14; Thu, 20 Feb 2025 21:41:12 +0000 Received: from SN1PEPF0002636D.namprd02.prod.outlook.com (2603:10b6:806:2d0:cafe::d0) by SA1P222CA0047.outlook.office365.com (2603:10b6:806:2d0::20) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8466.14 via Frontend Transport; Thu, 20 Feb 2025 21:41:12 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.232) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.232 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.232; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.232) by SN1PEPF0002636D.mail.protection.outlook.com (10.167.241.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8466.11 via Frontend Transport; Thu, 20 Feb 2025 21:41:11 +0000 Received: from drhqmail201.nvidia.com (10.126.190.180) by mail.nvidia.com (10.127.129.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Thu, 20 Feb 2025 13:40:54 -0800 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail201.nvidia.com (10.126.190.180) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.14; Thu, 20 Feb 2025 13:40:53 -0800 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.1544.14 via Frontend Transport; Thu, 20 Feb 2025 13:40:50 -0800 From: Tariq Toukan To: "David S. Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet , "Andrew Lunn" CC: Gal Pressman , Mark Bloch , "Saeed Mahameed" , Leon Romanovsky , Tariq Toukan , , , , Jianbo Liu , "Leon Romanovsky" , Patrisious Haddad Subject: [PATCH net-next 3/8] net/mlx5e: Add correct match to check IPSec syndromes for switchdev mode Date: Thu, 20 Feb 2025 23:39:53 +0200 Message-ID: <20250220213959.504304-4-tariqt@nvidia.com> X-Mailer: git-send-email 2.45.0 In-Reply-To: <20250220213959.504304-1-tariqt@nvidia.com> References: <20250220213959.504304-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-rdma@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-NV-OnPremToCloud: AnonymousSubmission X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SN1PEPF0002636D:EE_|DM6PR12MB4252:EE_ X-MS-Office365-Filtering-Correlation-Id: 34724b51-f1fc-4d65-60e1-08dd51f74b0e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|1800799024|82310400026|36860700013; X-Microsoft-Antispam-Message-Info: SHMwmAWPSBRWkRSvu05Hn9fgJ2e0Dx6z3DQ6Zs/CYi5VXmqvlztAoYW1WaBmJiGPgD2jg+xN6yOP5hquhaCCXwjgzN7643DimCAIzS7uTEaJ/bOUAfXYM4OrcVPQqnBmPy/cJES7vP8GW2kqs4JLplzTfjDUKT5IsN56UUVHsMBu3Gu2J8koIfht5+uQPP6rT6Qwce3OvEuEF4YFO1PneqVaHkHgGaUKQn/yFNuhzZyYbA97ICe3j9U8yjGrBIDbug2o45E8gmVwLdiH8Za0mCtDTOqE2eT7905MVEBuF8uB2LweJuKJu4Fr8wUnLZ0eMslhZm+aDnA3T60sHEkiKGRASHKJ/8+kT6ugVhXCKaFt0WA+gRH0/1v5Czg9nVRGsM7nBbYOHh838ag3obiiGf9CnCgvvgkmIQZmCIDGIlDNylfbU40Ki7mgXc2hmZBaB1WFPngqgrXhJx45KRvTLPQk65HPPLlOsgE4cVAdY5QoRod41eWoR6//MlNRp83I1+tS+3LT9k8SKEU00C1zXbnmgoxnar9KbPRUO4FDjOPKyC0QSvbLkR4MB/jUZ+VSTMnyWwg8tiurbYNFsklqy+sXJXUOssn40S40JO1TzfVwPvBgGB5T+FLzRNJWnz/DRUDc4fPxQwJwkrQd7de17qxhpvcQ3c+IUIYrBge3QY+5kF7/FKsDYIL2s/QzuTXeXBIRhYscnjgz7ngblfJvEzFFdYtbmBUaQ9GAk86/Ksq2LozW6wTItQGwNAe1f+2lNAVyCY97D/YTuxxaSzhSs2J80nYjA6SIQSty8eK7tS4f58O3SBcJi+BPU+PfPxO+5jTFmnRFOGSyYc72MN1GEQtQaL9AXbLA5up8CJOulSIbsFt0C1FxD+DKSqTQXH/MOlBt/0HWzGY1njseA3k85dakJlbsR0ihdMCHQJFAYl9gsNVKEiPshzZ8o3cr212FQkUpKU89OOmZR2siAS5hJ62Jiyl6MKvNZBaJQ+JSXfsDXM0IB6Sck6BTFvx1q+hzuN7fY1/yuNOP1oGtN6PKEiM4ED/uDL9NJUMFeKqBbGDG8VARpmXwlXSEj98Ik5zpBZ+GG7KBEJQN61WuL3/V701c5vmkmaRoSs6roGsICQhTm35yDc1UdTcM7kB5v7WvqCsH9O/yK33EvV/3BmOlHWRY8Nz8PP1bOC+cpMc3m4R7MwEhXvhw0BERmUc0VFAvv/j1YlzltH2a1VFVqgTyTQXZCNB+rPPlOL6s8QCIURF409R8K04FA7pBqkgerUztUw0d8uQYILmDIqqptiagENYN6WMpepbgKmTmhrf1BR9qVgM2pd4Op9fs1NxD1sSlMVS5HYZ9ixU0KOd35rmmhOBgmMhDgUJcyJ29MkMnl0DQDtEzyFLo9SSWEqveMz2sswEfZ30RZusi3/mcvjhFgwlwhRs2owk0SUosVJE5dbQjcQB8ymHGndQfYYnSlYKxiCu8+rqZHr0ILZf9yZtMwEr0O4hQEc5g0uhcuYBb5cQ= X-Forefront-Antispam-Report: CIP:216.228.118.232;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge1.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(1800799024)(82310400026)(36860700013);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Feb 2025 21:41:11.2765 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 34724b51-f1fc-4d65-60e1-08dd51f74b0e X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.232];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SN1PEPF0002636D.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB4252 From: Jianbo Liu In commit dddb49b63d86 ("net/mlx5e: Add IPsec and ASO syndromes check in HW"), IPSec and ASO syndromes checks after decryption for the specified ASO object were added. But they are correct only for eswith in legacy mode. For switchdev mode, metadata register c1 is used to save the mapped id (not ASO object id). So, need to change the match accordingly for the check rules in status table. Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Reviewed-by: Patrisious Haddad Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 28 ++++++++++++++----- .../mellanox/mlx5/core/esw/ipsec_fs.c | 13 +++++++++ .../mellanox/mlx5/core/esw/ipsec_fs.h | 5 ++++ include/linux/mlx5/eswitch.h | 2 ++ 4 files changed, 41 insertions(+), 7 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c index 7c9fdea21366..e1b518aedee8 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c @@ -165,6 +165,25 @@ static void ipsec_rx_status_pass_destroy(struct mlx5e_ipsec *ipsec, #endif } +static void ipsec_rx_rule_add_match_obj(struct mlx5e_ipsec_sa_entry *sa_entry, + struct mlx5e_ipsec_rx *rx, + struct mlx5_flow_spec *spec) +{ + struct mlx5e_ipsec *ipsec = sa_entry->ipsec; + + if (rx == ipsec->rx_esw) { + mlx5_esw_ipsec_rx_rule_add_match_obj(sa_entry, spec); + } else { + MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, + misc_parameters_2.metadata_reg_c_2); + MLX5_SET(fte_match_param, spec->match_value, + misc_parameters_2.metadata_reg_c_2, + sa_entry->ipsec_obj_id | BIT(31)); + + spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS_2; + } +} + static int rx_add_rule_drop_auth_trailer(struct mlx5e_ipsec_sa_entry *sa_entry, struct mlx5e_ipsec_rx *rx) { @@ -200,11 +219,8 @@ static int rx_add_rule_drop_auth_trailer(struct mlx5e_ipsec_sa_entry *sa_entry, MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, misc_parameters_2.ipsec_syndrome); MLX5_SET(fte_match_param, spec->match_value, misc_parameters_2.ipsec_syndrome, 1); - MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, misc_parameters_2.metadata_reg_c_2); - MLX5_SET(fte_match_param, spec->match_value, - misc_parameters_2.metadata_reg_c_2, - sa_entry->ipsec_obj_id | BIT(31)); spec->match_criteria_enable = MLX5_MATCH_MISC_PARAMETERS_2; + ipsec_rx_rule_add_match_obj(sa_entry, rx, spec); rule = mlx5_add_flow_rules(ft, spec, &flow_act, &dest, 1); if (IS_ERR(rule)) { err = PTR_ERR(rule); @@ -281,10 +297,8 @@ static int rx_add_rule_drop_replay(struct mlx5e_ipsec_sa_entry *sa_entry, struct MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, misc_parameters_2.metadata_reg_c_4); MLX5_SET(fte_match_param, spec->match_value, misc_parameters_2.metadata_reg_c_4, 1); - MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, misc_parameters_2.metadata_reg_c_2); - MLX5_SET(fte_match_param, spec->match_value, misc_parameters_2.metadata_reg_c_2, - sa_entry->ipsec_obj_id | BIT(31)); spec->match_criteria_enable = MLX5_MATCH_MISC_PARAMETERS_2; + ipsec_rx_rule_add_match_obj(sa_entry, rx, spec); rule = mlx5_add_flow_rules(ft, spec, &flow_act, &dest, 1); if (IS_ERR(rule)) { err = PTR_ERR(rule); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c index ed977ae75fab..4bba2884c1c0 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c @@ -85,6 +85,19 @@ int mlx5_esw_ipsec_rx_setup_modify_header(struct mlx5e_ipsec_sa_entry *sa_entry, return err; } +void mlx5_esw_ipsec_rx_rule_add_match_obj(struct mlx5e_ipsec_sa_entry *sa_entry, + struct mlx5_flow_spec *spec) +{ + MLX5_SET(fte_match_param, spec->match_criteria, + misc_parameters_2.metadata_reg_c_1, + ESW_IPSEC_RX_MAPPED_ID_MATCH_MASK); + MLX5_SET(fte_match_param, spec->match_value, + misc_parameters_2.metadata_reg_c_1, + sa_entry->rx_mapped_id << ESW_ZONE_ID_BITS); + + spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS_2; +} + void mlx5_esw_ipsec_rx_id_mapping_remove(struct mlx5e_ipsec_sa_entry *sa_entry) { struct mlx5e_ipsec *ipsec = sa_entry->ipsec; diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.h b/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.h index ac9c65b89166..514c15258b1d 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.h @@ -20,6 +20,8 @@ int mlx5_esw_ipsec_rx_ipsec_obj_id_search(struct mlx5e_priv *priv, u32 id, void mlx5_esw_ipsec_tx_create_attr_set(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_tx_create_attr *attr); void mlx5_esw_ipsec_restore_dest_uplink(struct mlx5_core_dev *mdev); +void mlx5_esw_ipsec_rx_rule_add_match_obj(struct mlx5e_ipsec_sa_entry *sa_entry, + struct mlx5_flow_spec *spec); #else static inline void mlx5_esw_ipsec_rx_create_attr_set(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_rx_create_attr *attr) {} @@ -48,5 +50,8 @@ static inline void mlx5_esw_ipsec_tx_create_attr_set(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_tx_create_attr *attr) {} static inline void mlx5_esw_ipsec_restore_dest_uplink(struct mlx5_core_dev *mdev) {} +static inline void +mlx5_esw_ipsec_rx_rule_add_match_obj(struct mlx5e_ipsec_sa_entry *sa_entry, + struct mlx5_flow_spec *spec) {} #endif /* CONFIG_MLX5_ESWITCH */ #endif /* __MLX5_ESW_IPSEC_FS_H__ */ diff --git a/include/linux/mlx5/eswitch.h b/include/linux/mlx5/eswitch.h index df73a2ccc9af..67256e776566 100644 --- a/include/linux/mlx5/eswitch.h +++ b/include/linux/mlx5/eswitch.h @@ -147,6 +147,8 @@ u32 mlx5_eswitch_get_vport_metadata_for_set(struct mlx5_eswitch *esw, /* reuse tun_opts for the mapped ipsec obj id when tun_id is 0 (invalid) */ #define ESW_IPSEC_RX_MAPPED_ID_MASK GENMASK(ESW_TUN_OPTS_BITS - 1, 0) +#define ESW_IPSEC_RX_MAPPED_ID_MATCH_MASK \ + GENMASK(31 - ESW_RESERVED_BITS, ESW_ZONE_ID_BITS) u8 mlx5_eswitch_mode(const struct mlx5_core_dev *dev); u16 mlx5_eswitch_get_total_vports(const struct mlx5_core_dev *dev); From patchwork Thu Feb 20 21:39:54 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Tariq Toukan X-Patchwork-Id: 13984527 Received: from NAM12-DM6-obe.outbound.protection.outlook.com (mail-dm6nam12on2049.outbound.protection.outlook.com [40.107.243.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0A334264F88; Thu, 20 Feb 2025 21:41:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.243.49 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087682; cv=fail; b=i8KDPWDIwdXCh6TCwaUOqFpquT2NIiORrbOLPG48TBsGqk6zmXeS+vqriFumDGbWep/po705/kYr4Hi5sixCYW+HKbmNtZspBD3dfuZGN6hyLT71vXImJ6IDzZp4kyyjUwYjTJCPtM4sDLnNsKQftYaK9eRZj7uey0nQoDeU6T4= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087682; c=relaxed/simple; bh=qxXimiQ39VFhSV56JieSP1/H9C+qj9mTtxvcakLDaDM=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=om6BL0NyfVmtyFyci6Fv4xVWGzwynz53ZtUpP0j7SczF1Jg0BzHM9LvezA59Yu4/rgFtK5mRjdfGdyxBzmkbLO7vf1QJgW4HU/nzsCX2KN+CIx5XOvZjQaescVs7UpBIQacYTIryh5pkrPEf1T6lqlZGgkyXewd1YukRKFNH6yQ= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=L5034mWf; arc=fail smtp.client-ip=40.107.243.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="L5034mWf" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=lcuGofez2Y0IUJ8gGWJSqN2pqMhh20H8NHdZvSvbQ6o+65alKE18dLj9Fu2/txodzr999EVzll3lnQ+YZ8BHaU9NcAfrS1Vf3N5qxAUkbvXhi5htj+2MG2gAfYsewj7CUfSRy19w+/8dzw3uZJH3t/DV/v/N5VzYNm2C3UwMGq3iBV+erMmJa/o3NA0NC55QP7ctUho3tegDaLlZo5OdsaeFOXDfeZzLJzu4sSh3BE2XKrjqkWXVgKAc1dIWHa1j92o0NinJ49hCWCAiVu+jpxraWG/RldCmAWN+ykNVbTucgtEhONFb91huS2IxKiZP/ffBn82sU2iXQWba8DgN/Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=VQsvL7UHaAG4lKwhpm3cx/fEcEH7c+zaTWNBSHmsWjU=; b=bGxP4D3nkEn8cUn6BmcxfZkEiajTw8dcTEnTn1d5U27WcK+/E8OSMp4+lscOFVNM6Od7BZAw3RmokNebpMqZbJPiHPxyQPDlZqHqmSR0TqG7oYsZxEv0V0RI5KfQwY5h+lAZnyjjZfuvILW6SdXCePWmh/cPoIeE/4CXuENGQ5+iaVu7jZ4a1UyJrLDDuUzugpGhtrs6rq9R9SArDUPwqF/0sujqcksvPB1X4/kygaBteLNBjxdoTbu3I3T29KjzwnpBMojXZNKDkwJH96+e1IMjty1hpvODfgFqOPFwEPqzb69UOb0GJYvOr3QEESWZJdTnn6yohroX7ExGuanI6g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.233) smtp.rcpttodomain=davemloft.net smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VQsvL7UHaAG4lKwhpm3cx/fEcEH7c+zaTWNBSHmsWjU=; b=L5034mWfnfUr+ezCQpWt1AW0nw+Kd2MH6d5VcEtY/CxtHmy6spq97sUDQvjiidqniG9unjAfX+CIVevn+DfcCrB6GB0RkhjnzhQWvNfeUJtr7Uhtxu5CR7eQJNx9J+009YYb+DauuuBFvUkuK/rREU62W7244EZAtcwqm+9iO3CtsHyUyXbJLFJ20Q1xzS/acFnJkvA9SAKrx0TXnaK/NKDUbiipmxAQ8uLk6lJkZb8n0ssad0uSmZaKbvhwvkzU9WOAjNyOIL9iUQlYD1nimPuS3TIfP/Y182lr7JljdqPAcrycYo6L8kOHPpFBAma8pVfshww3idR1UUT9CAqpPQ== Received: from SN4PR0501CA0027.namprd05.prod.outlook.com (2603:10b6:803:40::40) by LV2PR12MB5773.namprd12.prod.outlook.com (2603:10b6:408:17b::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8466.16; Thu, 20 Feb 2025 21:41:16 +0000 Received: from SA2PEPF000015C9.namprd03.prod.outlook.com (2603:10b6:803:40:cafe::fb) by SN4PR0501CA0027.outlook.office365.com (2603:10b6:803:40::40) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8466.15 via Frontend Transport; Thu, 20 Feb 2025 21:41:16 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.233) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.233 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.233; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.233) by SA2PEPF000015C9.mail.protection.outlook.com (10.167.241.199) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8466.11 via Frontend Transport; Thu, 20 Feb 2025 21:41:16 +0000 Received: from drhqmail201.nvidia.com (10.126.190.180) by mail.nvidia.com (10.127.129.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Thu, 20 Feb 2025 13:40:57 -0800 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail201.nvidia.com (10.126.190.180) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.14; Thu, 20 Feb 2025 13:40:57 -0800 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.1544.14 via Frontend Transport; Thu, 20 Feb 2025 13:40:54 -0800 From: Tariq Toukan To: "David S. Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet , "Andrew Lunn" CC: Gal Pressman , Mark Bloch , "Saeed Mahameed" , Leon Romanovsky , Tariq Toukan , , , , Jianbo Liu , "Leon Romanovsky" , Patrisious Haddad Subject: [PATCH net-next 4/8] net/mlx5e: Move IPSec policy check after decryption Date: Thu, 20 Feb 2025 23:39:54 +0200 Message-ID: <20250220213959.504304-5-tariqt@nvidia.com> X-Mailer: git-send-email 2.45.0 In-Reply-To: <20250220213959.504304-1-tariqt@nvidia.com> References: <20250220213959.504304-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-rdma@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-NV-OnPremToCloud: AnonymousSubmission X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SA2PEPF000015C9:EE_|LV2PR12MB5773:EE_ X-MS-Office365-Filtering-Correlation-Id: fdbfafb2-6ea6-4904-0ed4-08dd51f74e1b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|1800799024|82310400026|36860700013; X-Microsoft-Antispam-Message-Info: =?utf-8?q?6qKQNqX9GaQpy+3nYLifW963vZI3Zl9?= =?utf-8?q?7nQ5l5IyePfp3KfgP1KMPMznaxm5/VknM9hYH/TSBQ1kJ4iHg2ZaaABEScNh7jdSX?= =?utf-8?q?rx573rkXjdQQw2S82KrJigVukNYdO36wSFM/iJXIMwdj6QJERFSIbceKzYGRxsgCP?= =?utf-8?q?cks1ZHmEqTNaQLBesanzwhJ6Xwb9UK6qEhoT5Xa+wy4Jsebhh1ynZDtBvanpXCUyD?= =?utf-8?q?mWQ0582WDeWMaFtccZTv7KktcuucUzBuCOgcJhS0WRY8Br0CboHoG3bGFPIMblIYH?= =?utf-8?q?s8gEazV3l8ooN7q8xGThlJePC5sOW6xGAu1M9T4F+z/ZuusoGzYp63mrqjb0UfVSC?= =?utf-8?q?LWWn5VBIW89VZxckZMgVkwzNOM1KKYLOVRlYUcgvHhOJ96XDzIRZqtTnce6Y+JLDx?= =?utf-8?q?m8x8/ilmH1gPC/J9MH9670G03yocUM9ToIC1f0K2qKbCq08ckq9KgdVU/loChdF6D?= =?utf-8?q?YR73HwkqJMaD48ObrQFPwLGAi25cnTDcjKNwGjG1NBJo5vGCpJuP8e6Wwpeegm4gd?= =?utf-8?q?MZ8dLlX3+SxGQH5ZKkP4+YMTMnvd8Vhym2Hf4NZtO4W08vIq3TPaMhfJbwvb+WEdT?= =?utf-8?q?wmSBUCq/80iBT0HsmQ7D2yNFyIH/LEnBCYJYiJsaRq4/5T0cXgj+2rjDI8zBiQejy?= =?utf-8?q?IPPklEqyK4y0lgJGYbTccFzqA6waQeVF7RhBfXRiXqDeu8WyLAAwE8fk9zyOisBVU?= =?utf-8?q?Ut4uZEyXWPVwd0t9AhF/VZ4NoM9me/OUvYDSxXeUVSKnrJ27DCkrF1zhHC8F7HBVS?= =?utf-8?q?36GmMm+sA9qH2Sz9a2s5RwDHYTI8oQa6x/IbRg0R62tXWNkdFoRh4VtYlEkWv+/6v?= =?utf-8?q?Sc8EcFfLahLzedSBCdgrQZf9RtqSHvOO63OfBugxCTjBrMhgGNK/PFWp/MXi/COby?= =?utf-8?q?dSq7seNMCz2DotT2kCG53W8WCl57T3g2A3KtAcLmZl7EA78szWtGWtDHnbZZAzAil?= =?utf-8?q?yRuRN2pU1fDkNPxhhIYhniYo3+o2Ak4lN1WABkG6n9KQ0+YDbicT5nIyyL+uJndnQ?= =?utf-8?q?Maj2zHRpDOXB5ihxkHp7qCLIh9br0JDgtuGuBR+qIbqfP9gZevl5YM/iPzuihMe1Z?= =?utf-8?q?lZbXk4Y6ejAGCs/kTPMPPi7sk4Z4NvisI8awdvNCE8mzIbnT+nYKDvFY5yztnFpGZ?= =?utf-8?q?xy3wjRJdEldM+ENF9Q4l9afgQHdnEIMnYB9+e/xPjmkRQxpPr2IS4NUMcuJkWC5vq?= =?utf-8?q?a5aD6vfhrY2Rm0YomLV8t61dSwbxdqZJrdszLCdv7DofT3PCznZZMlP6zwD5yvfRV?= =?utf-8?q?YrM9dILOaYI+BkhoWugKOUnbKD13bNRrayMdq4pLrJmDE/IqNATInHN77iIAfZM/+?= =?utf-8?q?dOhFbJh5lW4/ANohjKSzpvJW0YSi0k1CFyWMSth/VX9nKcXTMEHAjlUIJr7NbCV4f?= =?utf-8?q?LCFgGffIQAK3WDulnFnXATEenjz4XFYfCsvaCAeY2UqLYDN9yd8q/c=3D?= X-Forefront-Antispam-Report: CIP:216.228.118.233;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge2.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(1800799024)(82310400026)(36860700013);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Feb 2025 21:41:16.4396 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: fdbfafb2-6ea6-4904-0ed4-08dd51f74e1b X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.233];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SA2PEPF000015C9.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV2PR12MB5773 From: Jianbo Liu Currently, xfrm policy check is done before decryption in mlx5 driver. If matching any policy, packets are forwarded to xfrm state table for decryption. But this is exact opposite to what software does. For kernel implementation, xfrm decode is unconditionally activated whenever an IPSec packet reaches the input flow if there’s a matching state rule. This patch changes the order, move policy check after decryption. Besides, a miss flow table is added at the end for legacy mode, to make it easier to update the default destination of the steering rules. So ESP packets are firstly forwarded to SA table for decryption, then the result is checked in status table. If the decryption succeeds, packets are forwarded to another table to check xfrm policy rules. When a policy with allow action is matched, if in legacy mode packets are forwarded to miss flow table with one rule to forward them to RoCE tables, if in switchdev mode they are forwarded directly to TC root chain instead. Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Reviewed-by: Patrisious Haddad Signed-off-by: Tariq Toukan --- .../net/ethernet/mellanox/mlx5/core/en/fs.h | 4 +- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 195 +++++++++++++----- .../mellanox/mlx5/core/esw/ipsec_fs.c | 2 +- 3 files changed, 145 insertions(+), 56 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h index 1e8b7d330701..b5c3a2a9d2a5 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h @@ -84,9 +84,9 @@ enum { MLX5E_ARFS_FT_LEVEL = MLX5E_INNER_TTC_FT_LEVEL + 1, #endif #ifdef CONFIG_MLX5_EN_IPSEC - MLX5E_ACCEL_FS_POL_FT_LEVEL = MLX5E_INNER_TTC_FT_LEVEL + 1, - MLX5E_ACCEL_FS_ESP_FT_LEVEL, + MLX5E_ACCEL_FS_ESP_FT_LEVEL = MLX5E_INNER_TTC_FT_LEVEL + 1, MLX5E_ACCEL_FS_ESP_FT_ERR_LEVEL, + MLX5E_ACCEL_FS_POL_FT_LEVEL, MLX5E_ACCEL_FS_ESP_FT_ROCE_LEVEL, #endif }; diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c index e1b518aedee8..3d9d7aa2a06a 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c @@ -45,6 +45,8 @@ struct mlx5e_ipsec_rx { struct mlx5e_ipsec_status_checks status_drops; struct mlx5e_ipsec_fc *fc; struct mlx5_fs_chains *chains; + struct mlx5_flow_table *pol_miss_ft; + struct mlx5_flow_handle *pol_miss_rule; u8 allow_tunnel_mode : 1; }; @@ -156,13 +158,6 @@ static void ipsec_rx_status_pass_destroy(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_rx *rx) { mlx5_del_flow_rules(rx->status.rule); - - if (rx != ipsec->rx_esw) - return; - -#ifdef CONFIG_MLX5_ESWITCH - mlx5_chains_put_table(esw_chains(ipsec->mdev->priv.eswitch), 0, 1, 0); -#endif } static void ipsec_rx_rule_add_match_obj(struct mlx5e_ipsec_sa_entry *sa_entry, @@ -415,7 +410,7 @@ static int ipsec_rx_status_pass_create(struct mlx5e_ipsec *ipsec, if (rx == ipsec->rx_esw) spec->flow_context.flow_source = MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK; spec->match_criteria_enable = MLX5_MATCH_MISC_PARAMETERS_2; - flow_act.flags = FLOW_ACT_NO_APPEND; + flow_act.flags = FLOW_ACT_NO_APPEND | FLOW_ACT_IGNORE_FLOW_LEVEL; flow_act.action = MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | MLX5_FLOW_CONTEXT_ACTION_COUNT; rule = mlx5_add_flow_rules(rx->ft.status, spec, &flow_act, dest, 2); @@ -596,13 +591,8 @@ static void ipsec_rx_ft_disconnect(struct mlx5e_ipsec *ipsec, u32 family) mlx5_ttc_fwd_default_dest(ttc, family2tt(family)); } -static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, - struct mlx5e_ipsec_rx *rx, u32 family) +static void ipsec_rx_policy_destroy(struct mlx5e_ipsec_rx *rx) { - /* disconnect */ - if (rx != ipsec->rx_esw) - ipsec_rx_ft_disconnect(ipsec, family); - if (rx->chains) { ipsec_chains_destroy(rx->chains); } else { @@ -611,6 +601,19 @@ static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, mlx5_destroy_flow_table(rx->ft.pol); } + if (rx->pol_miss_rule) { + mlx5_del_flow_rules(rx->pol_miss_rule); + mlx5_destroy_flow_table(rx->pol_miss_ft); + } +} + +static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, + struct mlx5e_ipsec_rx *rx, u32 family) +{ + /* disconnect */ + if (rx != ipsec->rx_esw) + ipsec_rx_ft_disconnect(ipsec, family); + mlx5_del_flow_rules(rx->sa.rule); mlx5_destroy_flow_group(rx->sa.group); mlx5_destroy_flow_table(rx->ft.sa); @@ -619,7 +622,15 @@ static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, mlx5_ipsec_rx_status_destroy(ipsec, rx); mlx5_destroy_flow_table(rx->ft.status); + ipsec_rx_policy_destroy(rx); + mlx5_ipsec_fs_roce_rx_destroy(ipsec->roce, family, mdev); + +#ifdef CONFIG_MLX5_ESWITCH + if (rx == ipsec->rx_esw) + mlx5_chains_put_table(esw_chains(ipsec->mdev->priv.eswitch), + 0, 1, 0); +#endif } static void ipsec_rx_create_attr_set(struct mlx5e_ipsec *ipsec, @@ -685,6 +696,14 @@ static void ipsec_rx_sa_miss_dest_get(struct mlx5e_ipsec *ipsec, family2tt(attr->family)); } +static void ipsec_rx_default_dest_get(struct mlx5e_ipsec *ipsec, + struct mlx5e_ipsec_rx *rx, + struct mlx5_flow_destination *dest) +{ + dest->type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; + dest->ft = rx->pol_miss_ft; +} + static void ipsec_rx_ft_connect(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_rx *rx, struct mlx5e_ipsec_rx_create_attr *attr) @@ -692,10 +711,105 @@ static void ipsec_rx_ft_connect(struct mlx5e_ipsec *ipsec, struct mlx5_flow_destination dest = {}; dest.type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; - dest.ft = rx->ft.pol; + dest.ft = rx->ft.sa; mlx5_ttc_fwd_dest(attr->ttc, family2tt(attr->family), &dest); } +static int ipsec_rx_chains_create_miss(struct mlx5e_ipsec *ipsec, + struct mlx5e_ipsec_rx *rx, + struct mlx5e_ipsec_rx_create_attr *attr, + struct mlx5_flow_destination *dest) +{ + struct mlx5_flow_table_attr ft_attr = {}; + MLX5_DECLARE_FLOW_ACT(flow_act); + struct mlx5_flow_handle *rule; + struct mlx5_flow_table *ft; + int err; + + if (rx == ipsec->rx_esw) { + /* No need to create miss table for switchdev mode, + * just set it to the root chain table. + */ + rx->pol_miss_ft = dest->ft; + return 0; + } + + ft_attr.max_fte = 1; + ft_attr.autogroup.max_num_groups = 1; + ft_attr.level = attr->pol_level; + ft_attr.prio = attr->prio; + + ft = mlx5_create_auto_grouped_flow_table(attr->ns, &ft_attr); + if (IS_ERR(ft)) + return PTR_ERR(ft); + + rule = mlx5_add_flow_rules(ft, NULL, &flow_act, dest, 1); + if (IS_ERR(rule)) { + err = PTR_ERR(rule); + goto err_rule; + } + + rx->pol_miss_ft = ft; + rx->pol_miss_rule = rule; + + return 0; + +err_rule: + mlx5_destroy_flow_table(ft); + return err; +} + +static int ipsec_rx_policy_create(struct mlx5e_ipsec *ipsec, + struct mlx5e_ipsec_rx *rx, + struct mlx5e_ipsec_rx_create_attr *attr, + struct mlx5_flow_destination *dest) +{ + struct mlx5_flow_destination default_dest; + struct mlx5_core_dev *mdev = ipsec->mdev; + struct mlx5_flow_table *ft; + int err; + + err = ipsec_rx_chains_create_miss(ipsec, rx, attr, dest); + if (err) + return err; + + ipsec_rx_default_dest_get(ipsec, rx, &default_dest); + + if (mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_PRIO) { + rx->chains = ipsec_chains_create(mdev, + default_dest.ft, + attr->chains_ns, + attr->prio, + attr->sa_level, + &rx->ft.pol); + if (IS_ERR(rx->chains)) + err = PTR_ERR(rx->chains); + } else { + ft = ipsec_ft_create(attr->ns, attr->pol_level, + attr->prio, 2, 0); + if (IS_ERR(ft)) { + err = PTR_ERR(ft); + goto err_out; + } + rx->ft.pol = ft; + + err = ipsec_miss_create(mdev, rx->ft.pol, &rx->pol, + &default_dest); + if (err) + mlx5_destroy_flow_table(rx->ft.pol); + } + + if (!err) + return 0; + +err_out: + if (rx->pol_miss_rule) { + mlx5_del_flow_rules(rx->pol_miss_rule); + mlx5_destroy_flow_table(rx->pol_miss_ft); + } + return err; +} + static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_rx *rx, u32 family) { @@ -718,12 +832,6 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, } rx->ft.status = ft; - dest[1].type = MLX5_FLOW_DESTINATION_TYPE_COUNTER; - dest[1].counter = rx->fc->cnt; - err = mlx5_ipsec_rx_status_create(ipsec, rx, dest); - if (err) - goto err_add; - /* Create FT */ if (mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_TUNNEL) rx->allow_tunnel_mode = mlx5_eswitch_block_encap(mdev); @@ -741,51 +849,33 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, if (err) goto err_fs; - if (mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_PRIO) { - rx->chains = ipsec_chains_create(mdev, rx->ft.sa, - attr.chains_ns, - attr.prio, - attr.pol_level, - &rx->ft.pol); - if (IS_ERR(rx->chains)) { - err = PTR_ERR(rx->chains); - goto err_pol_ft; - } - - goto connect; - } + err = ipsec_rx_policy_create(ipsec, rx, &attr, &dest[0]); + if (err) + goto err_policy; - ft = ipsec_ft_create(attr.ns, attr.pol_level, attr.prio, 2, 0); - if (IS_ERR(ft)) { - err = PTR_ERR(ft); - goto err_pol_ft; - } - rx->ft.pol = ft; - memset(dest, 0x00, 2 * sizeof(*dest)); dest[0].type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; - dest[0].ft = rx->ft.sa; - err = ipsec_miss_create(mdev, rx->ft.pol, &rx->pol, dest); + dest[0].ft = rx->ft.pol; + dest[1].type = MLX5_FLOW_DESTINATION_TYPE_COUNTER; + dest[1].counter = rx->fc->cnt; + err = mlx5_ipsec_rx_status_create(ipsec, rx, dest); if (err) - goto err_pol_miss; + goto err_add; -connect: /* connect */ if (rx != ipsec->rx_esw) ipsec_rx_ft_connect(ipsec, rx, &attr); return 0; -err_pol_miss: - mlx5_destroy_flow_table(rx->ft.pol); -err_pol_ft: +err_add: + ipsec_rx_policy_destroy(rx); +err_policy: mlx5_del_flow_rules(rx->sa.rule); mlx5_destroy_flow_group(rx->sa.group); err_fs: mlx5_destroy_flow_table(rx->ft.sa); -err_fs_ft: if (rx->allow_tunnel_mode) mlx5_eswitch_unblock_encap(mdev); - mlx5_ipsec_rx_status_destroy(ipsec, rx); -err_add: +err_fs_ft: mlx5_destroy_flow_table(rx->ft.status); err_fs_ft_status: mlx5_ipsec_fs_roce_rx_destroy(ipsec->roce, family, mdev); @@ -1957,8 +2047,7 @@ static int rx_add_policy(struct mlx5e_ipsec_pol_entry *pol_entry) flow_act.flags |= FLOW_ACT_NO_APPEND; if (rx == ipsec->rx_esw && rx->chains) flow_act.flags |= FLOW_ACT_IGNORE_FLOW_LEVEL; - dest[dstn].type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; - dest[dstn].ft = rx->ft.sa; + ipsec_rx_default_dest_get(ipsec, rx, &dest[dstn]); dstn++; rule = mlx5_add_flow_rules(ft, spec, &flow_act, dest, dstn); if (IS_ERR(rule)) { diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c index 4bba2884c1c0..3cfe743610d3 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c @@ -10,9 +10,9 @@ #endif enum { - MLX5_ESW_IPSEC_RX_POL_FT_LEVEL, MLX5_ESW_IPSEC_RX_ESP_FT_LEVEL, MLX5_ESW_IPSEC_RX_ESP_FT_CHK_LEVEL, + MLX5_ESW_IPSEC_RX_POL_FT_LEVEL, }; enum { From patchwork Thu Feb 20 21:39:55 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tariq Toukan X-Patchwork-Id: 13984530 Received: from NAM12-DM6-obe.outbound.protection.outlook.com (mail-dm6nam12on2058.outbound.protection.outlook.com [40.107.243.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 90BD3267B8D; Thu, 20 Feb 2025 21:41:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.243.58 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087691; cv=fail; b=JD3kqDqg5hY3d24aURKJU7r1yRV70BgVwt2UNMlP8k6lPW2bn0DAeovArJR/qpdNDMx01SNcrnkjp0uWhv2DItN6uc6OzAzn6BvaZzKqaU3h/8qw5rt291K2GJZ+MXKvnflhMUuQrfXlYfNk04ORBGsvZ9OwFFsDNlSKVFOWEP8= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087691; c=relaxed/simple; bh=fQRFQGlFgxzRgj1NLqBUr1WR2Mk0gQG1vX66/J9p+XM=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=qW9naM4U4kXGQ1PS9CXgUSYSnYrdMRiOHd3MJ+0E/Kzyb/fY0W7rc53N/ruEkoT9GV6J85WMnzaJgbEF8ORFL5t6dVHJGAtWNMc0+dOid3vEGBClyWjwELJ7FBFhvwjVKW/l9rdICSEajIo+NBbG406q9QYF8LE4bkG7q27u1mA= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=EpSYhbaO; arc=fail smtp.client-ip=40.107.243.58 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="EpSYhbaO" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=lkkR2QLU83M4W3lNgl2D+HeBbw9MWpFHNeBbfit2MyQ7TaK0XCLoTXFrscvflaqe51G5Y3pUaZUgNktIhse74zOVmLrGxHs9lULA0O0S1ZFqOE4Qjzd2NCD7jbu3NqMe01vQYTwm8zxEImZykNcDKAYv2Q+3S0+ig9XHRL2IeBSLa18PQKBRrLGxf/XwLs0P+jbM3K0s/YFCH0e/MeedokLifJr20YoZyLf4bLVlyolDaXmge0hDCSbYLEymTo2DlMO3fSngdI/EI5uuxH/1/cdulRVh6JC54hIUaljY5Dl9BCk4MVn4lnOSkfkXSpLmS47AKnwrBiUPWlpwoYQSug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=PbrAGEgztVcxgS8g0kg8N4mPo35xvsMsOUvVg8qu2ZA=; b=h8M8UzDSMkhkRfUPsvErNLwwyeX61Ac+7sY+RoS/8n+yY/Mvnl0OXrMnEZDvGXyaatuVpyHCbLKa/KjI7s53QfTxBKa4Wszx6cZG1RodKwEZq4zNPtYuWLZFCxkLDclId5XQ8/WfBde7LmmXax/2eLfXx9L+5ZCMos80OK7NaBFTNcJQ3ELu79yuqSAcr2N4neLNBIC3CXFhAh16v60YHiOmLPJib57ZNaoOMZckVtQdUdcHVxKNkJLIKaWaFgXhWqyuUmLErZgGLPZsYipsh6hfeozLKiP2Jnf6o6TT+MWQEk7t1SEwc/hfxJcF/hNCdyZdvlpu4e4biGqnYqVztA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.232) smtp.rcpttodomain=davemloft.net smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PbrAGEgztVcxgS8g0kg8N4mPo35xvsMsOUvVg8qu2ZA=; b=EpSYhbaOOr9ME4SFl1TIv8SGQHYpOCoXO31XLGe0HJUOuiIh5YjitZ3uWr+1nb+pgiuDZRNZkWMUmhccQ9wfbSANN5B5Rljpjo5jIj3By3FZxVx/OJQLJYEjtO8HqlBS3wzunH0PIHxj/zWMvv3WGnMaNRuXWcJJv5GD0WzLm+F99gBa9DigtaXvcXtZ0oV1WwXh+fqC3TWvNC0v/tGIWMOc/m4e0WvFZNI1zLtPpu0IeOs+dV9/Hg64L0LJs59J4bhpYwkZnRPiUE8VhV55FbsnfV12rhXGnvJ0Cnm973a14RKIFVZ8St0Lvs+/dIIgPaHxuWaEg5JyzJddvLac1g== Received: from SA1P222CA0048.NAMP222.PROD.OUTLOOK.COM (2603:10b6:806:2d0::23) by CY8PR12MB7636.namprd12.prod.outlook.com (2603:10b6:930:9f::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8466.16; Thu, 20 Feb 2025 21:41:16 +0000 Received: from SN1PEPF0002636D.namprd02.prod.outlook.com (2603:10b6:806:2d0:cafe::5f) by SA1P222CA0048.outlook.office365.com (2603:10b6:806:2d0::23) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8466.14 via Frontend Transport; Thu, 20 Feb 2025 21:41:16 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.232) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.232 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.232; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.232) by SN1PEPF0002636D.mail.protection.outlook.com (10.167.241.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8466.11 via Frontend Transport; Thu, 20 Feb 2025 21:41:16 +0000 Received: from drhqmail203.nvidia.com (10.126.190.182) by mail.nvidia.com (10.127.129.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Thu, 20 Feb 2025 13:41:01 -0800 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail203.nvidia.com (10.126.190.182) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.14; Thu, 20 Feb 2025 13:41:01 -0800 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.1544.14 via Frontend Transport; Thu, 20 Feb 2025 13:40:57 -0800 From: Tariq Toukan To: "David S. Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet , "Andrew Lunn" CC: Gal Pressman , Mark Bloch , "Saeed Mahameed" , Leon Romanovsky , Tariq Toukan , , , , Jianbo Liu , "Leon Romanovsky" , Patrisious Haddad Subject: [PATCH net-next 5/8] net/mlx5e: Skip IPSec RX policy check for crypto offload Date: Thu, 20 Feb 2025 23:39:55 +0200 Message-ID: <20250220213959.504304-6-tariqt@nvidia.com> X-Mailer: git-send-email 2.45.0 In-Reply-To: <20250220213959.504304-1-tariqt@nvidia.com> References: <20250220213959.504304-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-rdma@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-NV-OnPremToCloud: AnonymousSubmission X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SN1PEPF0002636D:EE_|CY8PR12MB7636:EE_ X-MS-Office365-Filtering-Correlation-Id: c6d01fe0-c915-4b9c-03ee-08dd51f74dfb X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|82310400026|376014|36860700013; X-Microsoft-Antispam-Message-Info: NM0lTgnSysIYAq+jmYA4+RN6EcA3eriJgsM1491nJ8rU5f537XHcfhhFd6ccftDaqS5nHYhObOVZ9GGsXy/8yx7PzlT+9aV4SqN+J8lrWAqcvYsN6HbOGt6fPZBZQZE0oh/u3zFH1orc8gP2H7AEq8c2flzZZw8p/ctPjGPkccIG3OFJbBlO6DDbACA6C+T33WFp8C3RjR0NRxPmJjjz+vdbBYaIXiQVtQ6O7Tm7zKlsXfhJBMQnsm/NJgK5gGVgSJ/yvSPa8rowzUtenrMbpydRiC3R1LeTNXiwealNnA5XMwABbSYSE11nR6d64/ZwnaGC12O2/K6GXOpm/ZJmmbGE3D17HZZQGaZoeUsxiy/j2CHCkyQI5hZuhgH3k81mbtCX0VatT3g9hhS0d69tQpZCBqq/3Nh3lXu3cI/JQmfcBFZTSiLFomm/ceO/eO9LjBX0nK/yVXYZ56SZXylwIlEopX7IOqmP0TAhIC2qRP+sBh9pd01upXsddkyhy7KPlaO7GtBlo4U5LGeLuz0DZv+RCzUHw5b/KP2kKQby+Dm0umSBZxf3b63vBfpuQaiEWEyIesxkpPdFq5+P3Ox6TLzZVYkZVytrfpKdfM/Ko/3YjjrewP0XQ+YoKdL4CJmnn9RfeMLtlSZwPgE0FZifTzqYapUvrj/JPt+epr9W9r1LITNIHAuo7zAWnrqgdqQozXEs0/nCsSCC/H8a0pRnXZRT6iC/si95N8iMoEpNBtqIvyd7Yzng+NCxkUt27qBztyaob1SGjV1/EgvkomgCzYzcBhvg6sB91DLb5S7vmw54h3FPwGyDbsXo8+9j/37bjpiX39e3ORGhl2KUvrpiUsWBtgddjIyxQ7ejJ8i6v+13zVx3bztKYNc+GzntXtqBqeXJ3vqwizwABYCxISVpKedO2M2L1/8NQb6Gok3Ali6zv1Egh2WQqsE8akwGf+XnqBCgUIGr5GAdHEV/w0p1CONY6SLuNTi9WNY0sLTBLpZ9tQuhOdeEziEboE4yNG5hvudl1hrGVCMGReS4aneHfonRyrX+qoCj4Je5nxlak02Qd4o1POe7zMRJ8o0pycQOrGjUoq7PY02jxU1KQagE/041bnwLXibG/sSBDgRBpXF/gyIPzB5ouahP+RFcbIdHnSBj0WZ5UtL9QWnA0Q/NbExn3igGOO+HfBrcXqlb/bzeHedpOcsOtMHpRNLtAvlkEeeK8pTOSJmdORPRO1ZDTbi9OHamEs7SWwSoOUBnN4HAf8DzTbg0Ajgxhks/HfHMxiB5q+Vgt5RpGnmZQpJKtn1BitXaWOHKuIsVSO+qqUYyNaXLbOSILhaqzClYHkYHI9yFdoojyiuMvARWS3mLIUPgPK9c3Vq43QZ80eKCAaCNotmtqBshdhmbyoZm86uJOa2LJ5TyyRRg9IeSAIG9IsFJe6f6JXiYh36qDbrC5n514EpYtUG2ulZYfCYww8mah0TqKTlzhX8RCcQzA1CfMDGjzWbQVadhnEz2+SNFA1Y= X-Forefront-Antispam-Report: CIP:216.228.118.232;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge1.nvidia.com;CAT:NONE;SFS:(13230040)(1800799024)(82310400026)(376014)(36860700013);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Feb 2025 21:41:16.2296 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: c6d01fe0-c915-4b9c-03ee-08dd51f74dfb X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.232];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SN1PEPF0002636D.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY8PR12MB7636 From: Jianbo Liu For crypto offload, there is no xfrm policy rule offloaded to hardware, so no need to continue with policy check for it. Previously, for crypto offload, the hardware metadata reg c4 is not used and not changed, but set to ASO_OK(0) before decryption to avoid garbage data. Then a default rule is added to check ipsec_syndrome and this register. Packets are forwarded to policy table if succeed, or drop if fails. According to hardware document, this register value could be 0, 1. So a special value (0xAA), which is not used by hardware, is chosen as an indication for crypto offload. It is set to c4 before decryption. Then a default rule, which matches on 0xAA (and ipsec_syndrome on 0), is added, which means packets are done by crypto offload, and sends them to kernel directly, thus skips the policy check. Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Reviewed-by: Patrisious Haddad Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 81 +++++++++++++------ 1 file changed, 56 insertions(+), 25 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c index 3d9d7aa2a06a..e72b365f24be 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c @@ -16,6 +16,14 @@ #define MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_SIZE 16 #define IPSEC_TUNNEL_DEFAULT_TTL 0x40 +enum { + MLX5_IPSEC_ASO_OK, + MLX5_IPSEC_ASO_BAD_REPLY, + + /* For crypto offload, set by driver */ + MLX5_IPSEC_ASO_SW_CRYPTO_OFFLOAD = 0xAA, +}; + struct mlx5e_ipsec_fc { struct mlx5_fc *cnt; struct mlx5_fc *drop; @@ -33,6 +41,8 @@ struct mlx5e_ipsec_tx { }; struct mlx5e_ipsec_status_checks { + struct mlx5_flow_handle *packet_offload_pass_rule; + struct mlx5_flow_handle *crypto_offload_pass_rule; struct mlx5_flow_group *drop_all_group; struct mlx5e_ipsec_drop all; }; @@ -41,8 +51,7 @@ struct mlx5e_ipsec_rx { struct mlx5e_ipsec_ft ft; struct mlx5e_ipsec_miss pol; struct mlx5e_ipsec_miss sa; - struct mlx5e_ipsec_rule status; - struct mlx5e_ipsec_status_checks status_drops; + struct mlx5e_ipsec_status_checks status_checks; struct mlx5e_ipsec_fc *fc; struct mlx5_fs_chains *chains; struct mlx5_flow_table *pol_miss_ft; @@ -149,15 +158,16 @@ static struct mlx5_flow_table *ipsec_ft_create(struct mlx5_flow_namespace *ns, static void ipsec_rx_status_drop_destroy(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_rx *rx) { - mlx5_del_flow_rules(rx->status_drops.all.rule); - mlx5_fc_destroy(ipsec->mdev, rx->status_drops.all.fc); - mlx5_destroy_flow_group(rx->status_drops.drop_all_group); + mlx5_del_flow_rules(rx->status_checks.all.rule); + mlx5_fc_destroy(ipsec->mdev, rx->status_checks.all.fc); + mlx5_destroy_flow_group(rx->status_checks.drop_all_group); } static void ipsec_rx_status_pass_destroy(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_rx *rx) { - mlx5_del_flow_rules(rx->status.rule); + mlx5_del_flow_rules(rx->status_checks.packet_offload_pass_rule); + mlx5_del_flow_rules(rx->status_checks.crypto_offload_pass_rule); } static void ipsec_rx_rule_add_match_obj(struct mlx5e_ipsec_sa_entry *sa_entry, @@ -368,9 +378,9 @@ static int ipsec_rx_status_drop_all_create(struct mlx5e_ipsec *ipsec, goto err_rule; } - rx->status_drops.drop_all_group = g; - rx->status_drops.all.rule = rule; - rx->status_drops.all.fc = flow_counter; + rx->status_checks.drop_all_group = g; + rx->status_checks.all.rule = rule; + rx->status_checks.all.fc = flow_counter; kvfree(flow_group_in); kvfree(spec); @@ -386,9 +396,11 @@ static int ipsec_rx_status_drop_all_create(struct mlx5e_ipsec *ipsec, return err; } -static int ipsec_rx_status_pass_create(struct mlx5e_ipsec *ipsec, - struct mlx5e_ipsec_rx *rx, - struct mlx5_flow_destination *dest) +static struct mlx5_flow_handle * +ipsec_rx_status_pass_create(struct mlx5e_ipsec *ipsec, + struct mlx5e_ipsec_rx *rx, + struct mlx5_flow_destination *dest, + u8 aso_ok) { struct mlx5_flow_act flow_act = {}; struct mlx5_flow_handle *rule; @@ -397,7 +409,7 @@ static int ipsec_rx_status_pass_create(struct mlx5e_ipsec *ipsec, spec = kvzalloc(sizeof(*spec), GFP_KERNEL); if (!spec) - return -ENOMEM; + return ERR_PTR(-ENOMEM); MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, misc_parameters_2.ipsec_syndrome); @@ -406,7 +418,7 @@ static int ipsec_rx_status_pass_create(struct mlx5e_ipsec *ipsec, MLX5_SET(fte_match_param, spec->match_value, misc_parameters_2.ipsec_syndrome, 0); MLX5_SET(fte_match_param, spec->match_value, - misc_parameters_2.metadata_reg_c_4, 0); + misc_parameters_2.metadata_reg_c_4, aso_ok); if (rx == ipsec->rx_esw) spec->flow_context.flow_source = MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK; spec->match_criteria_enable = MLX5_MATCH_MISC_PARAMETERS_2; @@ -421,13 +433,12 @@ static int ipsec_rx_status_pass_create(struct mlx5e_ipsec *ipsec, goto err_rule; } - rx->status.rule = rule; kvfree(spec); - return 0; + return rule; err_rule: kvfree(spec); - return err; + return ERR_PTR(err); } static void mlx5_ipsec_rx_status_destroy(struct mlx5e_ipsec *ipsec, @@ -441,19 +452,38 @@ static int mlx5_ipsec_rx_status_create(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_rx *rx, struct mlx5_flow_destination *dest) { + struct mlx5_flow_destination pol_dest[2]; + struct mlx5_flow_handle *rule; int err; err = ipsec_rx_status_drop_all_create(ipsec, rx); if (err) return err; - err = ipsec_rx_status_pass_create(ipsec, rx, dest); - if (err) - goto err_pass_create; + rule = ipsec_rx_status_pass_create(ipsec, rx, dest, + MLX5_IPSEC_ASO_SW_CRYPTO_OFFLOAD); + if (IS_ERR(rule)) { + err = PTR_ERR(rule); + goto err_crypto_offload_pass_create; + } + rx->status_checks.crypto_offload_pass_rule = rule; + + pol_dest[0].type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; + pol_dest[0].ft = rx->ft.pol; + pol_dest[1] = dest[1]; + rule = ipsec_rx_status_pass_create(ipsec, rx, pol_dest, + MLX5_IPSEC_ASO_OK); + if (IS_ERR(rule)) { + err = PTR_ERR(rule); + goto err_packet_offload_pass_create; + } + rx->status_checks.packet_offload_pass_rule = rule; return 0; -err_pass_create: +err_packet_offload_pass_create: + mlx5_del_flow_rules(rx->status_checks.crypto_offload_pass_rule); +err_crypto_offload_pass_create: ipsec_rx_status_drop_destroy(ipsec, rx); return err; } @@ -506,7 +536,9 @@ static void ipsec_rx_update_default_dest(struct mlx5e_ipsec_rx *rx, struct mlx5_flow_destination *old_dest, struct mlx5_flow_destination *new_dest) { - mlx5_modify_rule_destination(rx->status.rule, new_dest, old_dest); + mlx5_modify_rule_destination(rx->pol_miss_rule, new_dest, old_dest); + mlx5_modify_rule_destination(rx->status_checks.crypto_offload_pass_rule, + new_dest, old_dest); } static void handle_ipsec_rx_bringup(struct mlx5e_ipsec *ipsec, u32 family) @@ -853,8 +885,6 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, if (err) goto err_policy; - dest[0].type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; - dest[0].ft = rx->ft.pol; dest[1].type = MLX5_FLOW_DESTINATION_TYPE_COUNTER; dest[1].counter = rx->fc->cnt; err = mlx5_ipsec_rx_status_create(ipsec, rx, dest); @@ -1464,7 +1494,8 @@ static int setup_modify_header(struct mlx5e_ipsec *ipsec, int type, u32 val, u8 MLX5_ACTION_TYPE_SET); MLX5_SET(set_action_in, action[2], field, MLX5_ACTION_IN_FIELD_METADATA_REG_C_4); - MLX5_SET(set_action_in, action[2], data, 0); + MLX5_SET(set_action_in, action[2], data, + MLX5_IPSEC_ASO_SW_CRYPTO_OFFLOAD); MLX5_SET(set_action_in, action[2], offset, 0); MLX5_SET(set_action_in, action[2], length, 32); } From patchwork Thu Feb 20 21:39:56 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tariq Toukan X-Patchwork-Id: 13984529 Received: from NAM10-DM6-obe.outbound.protection.outlook.com (mail-dm6nam10on2041.outbound.protection.outlook.com [40.107.93.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 361FB267B79; Thu, 20 Feb 2025 21:41:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.93.41 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087689; cv=fail; b=FtihsQ5gwOGLSPAgriYb2t/rTnnJa6aJJUqcH1+67jo5HixxdPrQ7s5ZPfZgB/Tm8QACOj+We9uxv0qJJwLWgYWwG/UcFLxKCe5IolvnR84MTSZhYN06MhaEResV+aPY01fDBrts+pWDAJSNuF/cRPIZKkp49gXVsrSu/ZawrdY= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087689; c=relaxed/simple; bh=XX2xf+1VLHtuVF0/NM3JAK7HJwfZ89qqR/rcLw8MGjg=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=A57g+H+32yuJv05kpgZH8e0NsIfgui1lXa49+F3uSjWo+keXonycQonUIWm/h0GeCrYWrQUuJaes1S81E6bVa1qoEBsXaL+ZJtLQ+obGoUsS0Bj2Jc/pPspMLyvD+uLiY4tLbMvcIZ9EwmhJOUd+ICnUb4c8FsRsdlAaH2B14DM= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=bolb4cda; arc=fail smtp.client-ip=40.107.93.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="bolb4cda" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=IuuQ2o9CU1ZIifXZ2lQWb7Ve+XDzTYlPcj9MJXnK9e1V0dTt6FUdpkDfyYheXjVX+VB3LcrdJk/vejpOSyet4gaK9uok97p6gQVChkmv9uA+4duNCQgVYXmwiPOlWeFwZsXx9xzqsnQhEskBiQdTRXoX01lDVzF0PDTmjbcEQ5cHAC95kZ1gYlbJyj3WlYmwcdCqD4QLkYgYqLrHNUSVRNOW7YMd+pIqj+8jSGPt4QHnVvGs0eOYgljbtwEncKq/PxLvSIEuH/xKppfdtC4G30SILwnaO6rphpsKqBv8VXvfvoInyCkfrf/znJt2cb31hd9O+RyaxiuHHdZSyk7MfA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ERh26vhimYxKe7eWtjVGSOFky40xypk4OlR5S80xU4o=; b=zJhgbVkiVieuYczWXt15AK73mWTO48ICzKEq13yDHPcXB61w6nzQ6QBw2iKYpOr4Hw/LEtcE1LQ8wRqx98UkLPy8ryAr73sy9dWpNglrZz36g3gQAlqDRtSVF/QlmXv/X0ptXy4p0ZC3DCz+28sTq106Jys7oVdHRIIa2hyuawoKf5+ufbGnBLfsBFasJokuSDCFvGGncCKioUTkOvb7uE6o9hThGLmufIxQq2ny5kYCyDAucxKS992huVHFPnKUKgdEe0pMnJU35KLrIU1MJjPexJ58xEirn8q258mOo4O6UXDMQUApFYywlp8QYo7gPLAC8fsRXyT0BPja2klDXA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.233) smtp.rcpttodomain=davemloft.net smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ERh26vhimYxKe7eWtjVGSOFky40xypk4OlR5S80xU4o=; b=bolb4cdaec60rM89c1fRL5yrL0twS10LSJKsbO3ecW0Sy4/GAqouLwVQ9dDlfr4dZzEjmsTSesaO8VdBzqnyicoIvAikbRgiKhcETRUAkp3jQPcfEd0GIB/KeJbb26c5xfzI2cZwOeI8wh+iTWPrnI95L3/IYMZ6R4zOqGP9aYmiNH4Aj49306IHoeWV0Z31ywQBNIbnrz1ReOYGp3lJSpiRIfRoN51Tfn/sZdWVuDHKbN9iehDXkoxvnV+jePqXTawZ56KeGX9Z3WBM2OJ8x1Oj03uEwUcqbe9EvutHK6EbRJoTIi3Hs4f8mjMvWkBT1uRZxgeDUDq/B5UATm3T0Q== Received: from SJ0PR03CA0033.namprd03.prod.outlook.com (2603:10b6:a03:33e::8) by CY5PR12MB6574.namprd12.prod.outlook.com (2603:10b6:930:42::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8466.16; Thu, 20 Feb 2025 21:41:23 +0000 Received: from SA2PEPF000015C7.namprd03.prod.outlook.com (2603:10b6:a03:33e:cafe::3d) by SJ0PR03CA0033.outlook.office365.com (2603:10b6:a03:33e::8) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8466.16 via Frontend Transport; Thu, 20 Feb 2025 21:41:23 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.233) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.233 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.233; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.233) by SA2PEPF000015C7.mail.protection.outlook.com (10.167.241.197) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8466.11 via Frontend Transport; Thu, 20 Feb 2025 21:41:22 +0000 Received: from drhqmail202.nvidia.com (10.126.190.181) by mail.nvidia.com (10.127.129.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Thu, 20 Feb 2025 13:41:05 -0800 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail202.nvidia.com (10.126.190.181) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.14; Thu, 20 Feb 2025 13:41:05 -0800 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.1544.14 via Frontend Transport; Thu, 20 Feb 2025 13:41:01 -0800 From: Tariq Toukan To: "David S. Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet , "Andrew Lunn" CC: Gal Pressman , Mark Bloch , "Saeed Mahameed" , Leon Romanovsky , Tariq Toukan , , , , Jianbo Liu , "Leon Romanovsky" , Patrisious Haddad Subject: [PATCH net-next 6/8] net/mlx5e: Add num_reserved_entries param for ipsec_ft_create() Date: Thu, 20 Feb 2025 23:39:56 +0200 Message-ID: <20250220213959.504304-7-tariqt@nvidia.com> X-Mailer: git-send-email 2.45.0 In-Reply-To: <20250220213959.504304-1-tariqt@nvidia.com> References: <20250220213959.504304-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-rdma@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-NV-OnPremToCloud: AnonymousSubmission X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SA2PEPF000015C7:EE_|CY5PR12MB6574:EE_ X-MS-Office365-Filtering-Correlation-Id: 8e2fe45d-5839-4212-97bd-08dd51f751da X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700013|376014|82310400026|1800799024; X-Microsoft-Antispam-Message-Info: TgA23NzTjpdpZrz19RbwcFY/McrRVspF5F9ahbPZvtrgGkgEOYZaL4wMIh+3hI1934TasXtvSHSaLkEL6yjzCpQ0UAXZxMqje2nL0ZiGuITZBx967/H5ZUa+3/CLghYrqg2yFTapiWMQaH9lwppAHd3GqASymwjjvQAyzrQmaT1yCZzzaC/AG/afVJE2xf5acqs4fu1r4rOIsAfacAdyNBX/+PKJNWHVZZMzBRcmTpVsc8OfwMcRgwiPXAsnd76Ou0z5af8LLeW0MgMkDEPdl8hrpgVd1ksPGzuzjyT9QmpY9l4zhzJ4zykTDUBdIjnzVeklUve8vskMIZsArQIUcfmhZrQc10UsJluOspjYc0DIDdYMNEsWD+R3dPL1UKcJ0mhgaUValroHrQ6mkKaMEehxvKOGv+pfXUaZXEcj32rzrHMywGvaqyjMYCiYXJfmHRJofxzpQbJ47lMwHVPb5BnuFx6tE+GB7FJUgR+6NgghZv+QoJm+AcMPDprq/yOwxsSR8fcLHsuIolPwvB2pTtmbxUR/1hRrndQp/QAavA+kEQaZbeHfF81IPHmgsWgZVTUVsxgGs4Gko0Z3jjcUdQmNeu8h38sP9wO1wzephlmap0cBEZJNy3/Ex1/Y/DjzgFVFhgQ20KTDY2/hghk7LZm/NWPjkNQeZoKD0SeCE7U+bFqie/iCcqRnt/8EUNxFtxCqtEau6YLsWqEQu0EKQZmJuRascVcKLd0UD1P23vdPcc2pZ9u8+lIa64yrY83m+oTwphmEgo+85ZzdD7CtWOho7MgBTuIHdI/CXH9OJG26Kn+TaVOcLlLyXWKxyteV3LX/J4vAIcU38Ny7VkhsLWorTjmZ3skUPxrL0cOweYFfNMQQhCFqSxi6P/AMqLTaGKjG7Ujt6rKJqOFhdfB/RpT8V8/f/RvJIxw83kTUQGPPkCvh6N3W9zANA1qcwY6I3GMI1XMaxnTgfz9wzyESdd3Uv5WCHMl8iN3FEYVm9eZnRVyq4A7qpZrRPPURL+EZ3Pung+LRuuKeElMGUjWGY9PAyMeZ6ij2MIAVh3UTyiB2r4K7n+oJVedKCaJnfZr+Oycm5+XDcfBv/Lx249oHk3Pt8hnqAfSRsrw2Y9us8TawiVeYMZscX5OypmTNWfg1lWIgtkQAy6E+iUkUVqQgdg/YcfzRHqslJwMOvGVZN3BLfHT66TQrpEXJl5Q0WhxUjsa/in/+Qh21flQhhqDynaN6mOHIiw61lThO5J20PTlq/npI2xtlC3N2Pu0o08sLBxS2Rhan3hF8oVKfqUH0+wutAyO0XXLzzN+rJNY9tmDQGhsuKIQ5k6vJkf88Mrf502G8MpJ6tIy+nlep2EhAGqJ/HxWDTuoZesA5sjivtzSePKzULo8H8tncmTBVdh/8/NAaJUHIIwnHu3gEC/tTrC9Kypd5HrBWYv2NRUJG5INuRsYlM6B6WjeAEDqcTyPkFf8KmUWWe6SEpq3nPBNNiM66tiRiLB6uvWr/gFC1swI= X-Forefront-Antispam-Report: CIP:216.228.118.233;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge2.nvidia.com;CAT:NONE;SFS:(13230040)(36860700013)(376014)(82310400026)(1800799024);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Feb 2025 21:41:22.7280 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 8e2fe45d-5839-4212-97bd-08dd51f751da X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.233];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SA2PEPF000015C7.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY5PR12MB6574 From: Jianbo Liu Add parameter for ipsec_ft_create() to pass the number of the reserved entries when creating auto-grouped flow table. It's used to create table with pre-defined group(s) which may have more than one rule. Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Reviewed-by: Patrisious Haddad Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c index e72b365f24be..2ee4c7bfd7e6 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c @@ -141,11 +141,12 @@ static void ipsec_chains_put_table(struct mlx5_fs_chains *chains, u32 prio) static struct mlx5_flow_table *ipsec_ft_create(struct mlx5_flow_namespace *ns, int level, int prio, + int num_reserved_entries, int max_num_groups, u32 flags) { struct mlx5_flow_table_attr ft_attr = {}; - ft_attr.autogroup.num_reserved_entries = 1; + ft_attr.autogroup.num_reserved_entries = num_reserved_entries; ft_attr.autogroup.max_num_groups = max_num_groups; ft_attr.max_fte = NUM_IPSEC_FTE; ft_attr.level = level; @@ -818,7 +819,7 @@ static int ipsec_rx_policy_create(struct mlx5e_ipsec *ipsec, err = PTR_ERR(rx->chains); } else { ft = ipsec_ft_create(attr->ns, attr->pol_level, - attr->prio, 2, 0); + attr->prio, 1, 2, 0); if (IS_ERR(ft)) { err = PTR_ERR(ft); goto err_out; @@ -857,7 +858,7 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, if (err) return err; - ft = ipsec_ft_create(attr.ns, attr.status_level, attr.prio, 3, 0); + ft = ipsec_ft_create(attr.ns, attr.status_level, attr.prio, 1, 3, 0); if (IS_ERR(ft)) { err = PTR_ERR(ft); goto err_fs_ft_status; @@ -869,7 +870,7 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, rx->allow_tunnel_mode = mlx5_eswitch_block_encap(mdev); if (rx->allow_tunnel_mode) flags = MLX5_FLOW_TABLE_TUNNEL_EN_REFORMAT; - ft = ipsec_ft_create(attr.ns, attr.sa_level, attr.prio, 2, flags); + ft = ipsec_ft_create(attr.ns, attr.sa_level, attr.prio, 1, 2, flags); if (IS_ERR(ft)) { err = PTR_ERR(ft); goto err_fs_ft; @@ -1095,7 +1096,7 @@ static int tx_create(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_tx *tx, int err; ipsec_tx_create_attr_set(ipsec, tx, &attr); - ft = ipsec_ft_create(tx->ns, attr.cnt_level, attr.prio, 1, 0); + ft = ipsec_ft_create(tx->ns, attr.cnt_level, attr.prio, 1, 1, 0); if (IS_ERR(ft)) return PTR_ERR(ft); tx->ft.status = ft; @@ -1108,7 +1109,7 @@ static int tx_create(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_tx *tx, tx->allow_tunnel_mode = mlx5_eswitch_block_encap(mdev); if (tx->allow_tunnel_mode) flags = MLX5_FLOW_TABLE_TUNNEL_EN_REFORMAT; - ft = ipsec_ft_create(tx->ns, attr.sa_level, attr.prio, 4, flags); + ft = ipsec_ft_create(tx->ns, attr.sa_level, attr.prio, 1, 4, flags); if (IS_ERR(ft)) { err = PTR_ERR(ft); goto err_sa_ft; @@ -1136,7 +1137,7 @@ static int tx_create(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_tx *tx, goto connect_roce; } - ft = ipsec_ft_create(tx->ns, attr.pol_level, attr.prio, 2, 0); + ft = ipsec_ft_create(tx->ns, attr.pol_level, attr.prio, 1, 2, 0); if (IS_ERR(ft)) { err = PTR_ERR(ft); goto err_pol_ft; From patchwork Thu Feb 20 21:39:57 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tariq Toukan X-Patchwork-Id: 13984531 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (mail-bn8nam12on2055.outbound.protection.outlook.com [40.107.237.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C9718268FDA; Thu, 20 Feb 2025 21:41:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.237.55 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087694; cv=fail; b=Nxk9STaQ/av10RAz4By8g0+sr/UkBUaSBm2YFwLRs1IPLOrzGGvCex9ccXpXgKIVjsxfppvWV0hScHXqz67UhhVsXuJ7NOIM2yj2Ot/QqWIYzc6Z5Qq2FvGuGpxRR1D3vjawaFRb/aRyDVDFj5uh4xtLicoiZ+SjQ+xn8uS7/KE= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087694; c=relaxed/simple; bh=6i7h83kp6WTUIE77LtRFqL3IpVs0+dSt+94JokTJ9do=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=BBI2Kpp0tKyLWuph9Q3cEYIk3WzaWR1nDoNBEP+/U1ZqVTzL9PHEYlpIIZsTomGWmOI6uAOgPZP3sMY9Zh7cvw8sJW/Ff2gFhQhQR7e4E+tEj9+12JOQNq+FmVMgxGB3aO5OO2XPYmdc+bFgAFlFnlw/dbo/76cn2HF9m8nyHOs= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=i6d/Dps4; arc=fail smtp.client-ip=40.107.237.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="i6d/Dps4" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=K4hul8ddw5wAnqYdRWT2wfbzAqv4APhW/N8/OCXurLPPeE7iuAPwNXwEOcpt06onGFL8eB3qukjQtUgWSsHasc4g9tPMTM8Rd5Fc2KZuEATN7QExyXEwt5XA7KO/tj3oOuw61U5pWYQaz3wzJNZisJWRj89wJZaRrKYJ7GxFuLayeoRCnU0gbMvqFfF62PBM6KTGBFw8e4QPtT8Ru6gX6pf+N1i+sIMJYBi1sULrPHwQ38QuBZoX+ktWj6VmlqSelPUzt8jWLcGw3mbN3B0hYm7F6Z+/WpnUO8XfOBu4YujFvZsYwTDs8uDF4P+SxB8LTWZ1GU1igAzMQ0trYxaUfw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=IYXmslkJKvzcnPI8xGD6iggeJRw/HbzJZy/WyASVFso=; b=LrgDd7r+nv/g06tXr7mFL6M/T/Iff3lPXLsArOD3ON8MxM5xP1W4S1ik9qNMS+XohY01uEAF01zueUQQKNxmw7QlHdmuv6DubA95U6Z4cbUixCQVBcWY+TZEf0po4odoK2lAgz3TSAqOT/K3K4ntPrOWbOnB7ExwglKx8OYJ1xHyqmYHbvede3iHDL+EfHEEe/i+zKqKFZOY6tdnli1qZ/UmPzPgmuXJ2pO4TZN92xguqDBGgACVpU+/5g3uiESD+Jf/YwoWE2djb4IJSb11O4UE+ytXW6YGbfNy1XVuDdEV+2VfDRThZY/VULg2cGNqz3cTt8OSQEzuHb79owLVNQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.233) smtp.rcpttodomain=davemloft.net smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IYXmslkJKvzcnPI8xGD6iggeJRw/HbzJZy/WyASVFso=; b=i6d/Dps4yDutQDa3B/qJND5sGdFjPuFbVdAlpkB8GKwsTEdPfQC0IqejS6+qKR6/VrCDA87Tc74Ohw5FGe9m3LwCjOc5iyOTN5tIof8EwIInzo3aIoAd7etrjxE8DViXAkAUVqyXuaWp0E/TqAvSWgWbe8W4tgZNsa0sK5OjBs9iPP9FiaRvMh0yqzYayEKNAUS3vANtfsIAZE25Wj3Fx8CV7IiGKnflOCCAZE1bN6OIpAmeD1TJDVHWBpYsxw98JHI9e3gUaNJd/9dInrZa7lmPbP5kmww75rPoJ3QAYg/QXNy7nYhE7+fwVriGxmJbY3e+tCD0+J+Et8GYBt9FNg== Received: from SN4PR0501CA0012.namprd05.prod.outlook.com (2603:10b6:803:40::25) by PH7PR12MB6810.namprd12.prod.outlook.com (2603:10b6:510:1b4::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8445.19; Thu, 20 Feb 2025 21:41:27 +0000 Received: from SA2PEPF000015C9.namprd03.prod.outlook.com (2603:10b6:803:40:cafe::1e) by SN4PR0501CA0012.outlook.office365.com (2603:10b6:803:40::25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8466.15 via Frontend Transport; Thu, 20 Feb 2025 21:41:26 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.233) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.233 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.233; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.233) by SA2PEPF000015C9.mail.protection.outlook.com (10.167.241.199) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8466.11 via Frontend Transport; Thu, 20 Feb 2025 21:41:26 +0000 Received: from drhqmail202.nvidia.com (10.126.190.181) by mail.nvidia.com (10.127.129.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Thu, 20 Feb 2025 13:41:09 -0800 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail202.nvidia.com (10.126.190.181) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.14; Thu, 20 Feb 2025 13:41:09 -0800 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.1544.14 via Frontend Transport; Thu, 20 Feb 2025 13:41:05 -0800 From: Tariq Toukan To: "David S. Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet , "Andrew Lunn" CC: Gal Pressman , Mark Bloch , "Saeed Mahameed" , Leon Romanovsky , Tariq Toukan , , , , Jianbo Liu , "Leon Romanovsky" , Patrisious Haddad Subject: [PATCH net-next 7/8] net/mlx5e: Add pass flow group for IPSec RX status table Date: Thu, 20 Feb 2025 23:39:57 +0200 Message-ID: <20250220213959.504304-8-tariqt@nvidia.com> X-Mailer: git-send-email 2.45.0 In-Reply-To: <20250220213959.504304-1-tariqt@nvidia.com> References: <20250220213959.504304-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-rdma@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-NV-OnPremToCloud: AnonymousSubmission X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SA2PEPF000015C9:EE_|PH7PR12MB6810:EE_ X-MS-Office365-Filtering-Correlation-Id: fa35dd46-73ce-4651-f36d-08dd51f7544e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700013|82310400026|1800799024|376014; X-Microsoft-Antispam-Message-Info: DKXyg+5TtpIZyXoLletWDm8KDGQewW8pHFg+++dTVRnAvgLEl2R0hSK9tBVa3qDSo0ejGxkqpXwN2APdeWodYzbqtbBRvbN8VLoTywuPNcGKxV+vHnACEf//1y5fCawTZZoBNq9wssyvb/9QUf73pKet+uAohf3imXtMmFy0H36arXsjUfa+Xyw2dJNHnbdeBoo4Y5ww+XepykWUk15KWbScdkjLcz00HJKiagCfCCJDLvt7PvCbBknTh+GpJ9hO7sbxGK5aNjUD+d+tiWkrBshN8MEYlsnN6xQx6hFfywwC3b+/W/7/IvyfO+MayIwYmzrsVnB7Y4w8d7xH/og44GQjp4dTWg6lrYcvf51JQc0kBdFiaRMafD5Ti0PcQP0pYsJquOl0YaEAsRz3W0WFgyzkhVzagfaoSFeAUehTmnbuSqPGuTNm3J7zYBHWu1kkK7WZJ9OI2U+leFVwBbuY7JQPzS4VE07Hip4AaTlzWq1nQZSWvTNZ4FWzIHdZfLJS2vQhTCdbu7tE2zJB+F+htfnivDGiTtN+Gdy0HnvYhX9sb6prTXsS2oH8osCuCgv2lSkhP9JXKH7gyRvj3cbxMt9xlXPdkoZCQQcmJ9A2PeSkO8Fi2xU79DdkqUSMWLSrTuq+mLnm5y5NmjCoTWA+uvclhkRHPE4Jc3diH+J2u+S9FM8ibgfSgd0seexfQrpT7jd04HBxb+AI7iJamJelm7YNTeARzhAVrc2Cw+OC+8QI3tRRc7p6Jx6lYn/yfqvaGxLLcq4GtHE7HvrZJFBZsh2+IQ7LyWxIcVtLGY+O/D7gX4Q3Zh2x1pD0XFXKiDhE27RF3WlnMgzqX0LixDlu5DLE4Axw+klPvkHDviindA3x8bCdgq76Zkg8/eTORk7HqPEEZsZwX4YGHdFDa8K0aKm/8LSNDc3chN42D3ar7DbRVsTUKn7N+9glVarmBItlF+UEU+J1dSC+D+h5vGFWz8UhtQY4DO9ZXrFnu/9T+xt7nUz3Uky3gJ+QrIu71rsejFRxyo04GJwHaW6lU+f6s3ws3SMwZBY/h1LE/su9S80FnvJyl5EF8E17TZnWabSnDceI9wKLxMBbmwGFOJcGGQYFQudkWuxsjC5DTZWb0CnL3lfH4cR6u4QFs++0hOpD9zGjS+s0e7MXdbWZgoEqrRa6qUl+GSZO0OuX6bRmoAiFHxe/5xNl1oN+rpe3rhHWS8mIniwegTvNhVmk5al3/zgJwb5Sdv6utVKEajUmbd6ARzNyZxRZAY5/hBd+JIo+JvN4oLb/77wsM27rG+IO5waXVjn2jforrasaJPHPHYCJiL//U/AdamIeUsHSyV/Cseb74Tiu+rev9ZCiKpV1J11iKaKV1kaa2MSS44HSdguocX3E8nrdEKGtN0uOVvwx0SIQcQgdBcY46EerJjuh9YcBW3qde6Z18ZoR6r10JVyZSQzILHjYz7RCNdnub1yWmaul0rhEHAp/uu9VJP9rwlDyLdKV61DZvwz8oPxfMZA= X-Forefront-Antispam-Report: CIP:216.228.118.233;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge2.nvidia.com;CAT:NONE;SFS:(13230040)(36860700013)(82310400026)(1800799024)(376014);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Feb 2025 21:41:26.8460 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: fa35dd46-73ce-4651-f36d-08dd51f7544e X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.233];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SA2PEPF000015C9.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR12MB6810 From: Jianbo Liu This flow group is added for the pass rules for both crypto offload and packet offload. It is placed at the end of the table, and right before the miss group. There are two entries, and the default pass rules for both offloads are added in this group. Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Reviewed-by: Patrisious Haddad Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 51 ++++++++++++++++++- 1 file changed, 50 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c index 2ee4c7bfd7e6..840d9e0514d3 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c @@ -41,6 +41,7 @@ struct mlx5e_ipsec_tx { }; struct mlx5e_ipsec_status_checks { + struct mlx5_flow_group *pass_group; struct mlx5_flow_handle *packet_offload_pass_rule; struct mlx5_flow_handle *crypto_offload_pass_rule; struct mlx5_flow_group *drop_all_group; @@ -397,6 +398,47 @@ static int ipsec_rx_status_drop_all_create(struct mlx5e_ipsec *ipsec, return err; } +static int ipsec_rx_status_pass_group_create(struct mlx5e_ipsec *ipsec, + struct mlx5e_ipsec_rx *rx) +{ + int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in); + struct mlx5_flow_table *ft = rx->ft.status; + struct mlx5_flow_group *fg; + void *match_criteria; + u32 *flow_group_in; + int err = 0; + + flow_group_in = kvzalloc(inlen, GFP_KERNEL); + if (!flow_group_in) + return -ENOMEM; + + MLX5_SET(create_flow_group_in, flow_group_in, match_criteria_enable, + MLX5_MATCH_MISC_PARAMETERS_2); + match_criteria = MLX5_ADDR_OF(create_flow_group_in, flow_group_in, + match_criteria); + MLX5_SET_TO_ONES(fte_match_param, match_criteria, + misc_parameters_2.ipsec_syndrome); + MLX5_SET_TO_ONES(fte_match_param, match_criteria, + misc_parameters_2.metadata_reg_c_4); + + MLX5_SET(create_flow_group_in, flow_group_in, + start_flow_index, ft->max_fte - 3); + MLX5_SET(create_flow_group_in, flow_group_in, + end_flow_index, ft->max_fte - 2); + + fg = mlx5_create_flow_group(ft, flow_group_in); + if (IS_ERR(fg)) { + err = PTR_ERR(fg); + mlx5_core_warn(ipsec->mdev, + "Failed to create rx status pass flow group, err=%d\n", + err); + } + rx->status_checks.pass_group = fg; + + kvfree(flow_group_in); + return err; +} + static struct mlx5_flow_handle * ipsec_rx_status_pass_create(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_rx *rx, @@ -446,6 +488,7 @@ static void mlx5_ipsec_rx_status_destroy(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_rx *rx) { ipsec_rx_status_pass_destroy(ipsec, rx); + mlx5_destroy_flow_group(rx->status_checks.pass_group); ipsec_rx_status_drop_destroy(ipsec, rx); } @@ -461,6 +504,10 @@ static int mlx5_ipsec_rx_status_create(struct mlx5e_ipsec *ipsec, if (err) return err; + err = ipsec_rx_status_pass_group_create(ipsec, rx); + if (err) + goto err_pass_group_create; + rule = ipsec_rx_status_pass_create(ipsec, rx, dest, MLX5_IPSEC_ASO_SW_CRYPTO_OFFLOAD); if (IS_ERR(rule)) { @@ -485,6 +532,8 @@ static int mlx5_ipsec_rx_status_create(struct mlx5e_ipsec *ipsec, err_packet_offload_pass_create: mlx5_del_flow_rules(rx->status_checks.crypto_offload_pass_rule); err_crypto_offload_pass_create: + mlx5_destroy_flow_group(rx->status_checks.pass_group); +err_pass_group_create: ipsec_rx_status_drop_destroy(ipsec, rx); return err; } @@ -858,7 +907,7 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, if (err) return err; - ft = ipsec_ft_create(attr.ns, attr.status_level, attr.prio, 1, 3, 0); + ft = ipsec_ft_create(attr.ns, attr.status_level, attr.prio, 3, 3, 0); if (IS_ERR(ft)) { err = PTR_ERR(ft); goto err_fs_ft_status; From patchwork Thu Feb 20 21:39:58 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tariq Toukan X-Patchwork-Id: 13984532 Received: from NAM12-MW2-obe.outbound.protection.outlook.com (mail-mw2nam12on2061.outbound.protection.outlook.com [40.107.244.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6BBA726A082; Thu, 20 Feb 2025 21:41:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.244.61 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087700; cv=fail; b=L2pKue4QBFUE3v0g+3ViPe9QeWHlTHw2Z8M1pTbFwocabuCg3ubqWtA0XRyhk+T7c/h6QRRgPY+JceJNYZpefAGG/Dr4FRLeYbelb+HnNQzD7hU9lrVgMsikoUu3rtTSYMUArEzte1HY4HSpwrWugtSPLlcbreT0y5LjEhmyLHk= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740087700; c=relaxed/simple; bh=oDfEFlR3TFO1C7uQOv38aRaUKy6oPAgNlgF9Uqm2bzE=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=kv6Ip3Im2VSwPQoSYQwNlTt6jNDFICv/yo+xxVw9Bpt3k7ycWfZgXnPnXiGGmPhwlpa+zY7mdRD6M+RMOjpFkod1G7A8AaW5ezSs1KV64SgDvDp+u3e8nJcCRCba6h4t6zklnZhqo7VNFpLqzqpWaeeMgHsii7qB44W9jjK5wVs= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=ezhtl7AR; arc=fail smtp.client-ip=40.107.244.61 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="ezhtl7AR" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=h3UFUSKAiZrDb4uGTath60h99gwZ7fwiBLPfIY/z8sJp1F7gS2pZ0nyE/TKWe7IxudxzrvoAYksrLqvzaSfYDlAhblbP2iw3hNwcrH9cL9dgnNojvTCbhDM0HW4HG8/PisWPQS/YBlXZdKKLa63RlGRNb3jVpeuxUr2C6JA2lLJzC1YOJnaIlSKRnFRaU9Pxr4I3ir30qynKeJqv3vaON+A+fCX+45ltMQM96hTTBlJHIiz5uX6I3E29c1Z2DooiKt9A3FdvsxzU5RnkiAqOivPcl9VpobgRV65Jtw/v2N2JO1KvxnvlDZ//rnsqhhl28j8kptnFotKXVNG2HesuWA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=w++5ok4E2Eng93IZMVr6eNhNBwp5lHhpLcA+EAWHTsg=; b=CdxaH2VZ1LctIQO4+0HWectdo3xvSINpjvMAQ83+kAn4QxCwoyPiPjZ3CacLf56ll3UaG+97RdN/HwfvcYvBC7T+bNHy/oOkAtB3F29mn0RgKwws904MLJCAFaIO3+6UydZjLpiA71ZYnljxnvSOx5dOpUZWnsExHX9pGFpSaT3u8OrrR07XB/yLZDREgqu1CabXfekMQM2kynIFiPVqu2hjTCA8iiY/1keulqxsW1D1dlvl8tH5WHjoMUUGBVjvUTF3C3MQTraIvdlKHOGcozuaBv+Su5YGRj/SuQ2dVMozLbe4NjUxwAEpSm25GeqhOhtzZTVQzUpKyKzKa0Cubw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.118.233) smtp.rcpttodomain=davemloft.net smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=w++5ok4E2Eng93IZMVr6eNhNBwp5lHhpLcA+EAWHTsg=; b=ezhtl7ARVIQ2ztuQ6zTp7vZZrPxiHGUozPszsakNFlUZK/q8DS5uqhHV4IIXrT5aTdBFy3AWiCTo3D5zWSXoN5Tny5MAqkMRsz6dPTeLzZTMR2okKOq4p92holEcXvR/qHu4Mki24m7vJrGO7omla/Jh841T2Hfixe98W5m3fgRPU/PxLvSPT3ZJuxxsuQRI+mEvCwc5z4W7wUWaZbX3YkhmCg3ZlimZT/3RteyvvN3h7c2DNHZ03dAgcfpYZo/3uGPLy2Zek3CEnUAECZPxeJNPIUWHTDt9IVYYFfIv7/1OPwBdaP0bxSW6+Dgps3/9nJDhbEeV/3hRKE0BU4GH2g== Received: from SN1PR12CA0074.namprd12.prod.outlook.com (2603:10b6:802:20::45) by SN7PR12MB6715.namprd12.prod.outlook.com (2603:10b6:806:271::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8445.24; Thu, 20 Feb 2025 21:41:30 +0000 Received: from SA2PEPF000015CC.namprd03.prod.outlook.com (2603:10b6:802:20:cafe::d3) by SN1PR12CA0074.outlook.office365.com (2603:10b6:802:20::45) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8466.16 via Frontend Transport; Thu, 20 Feb 2025 21:41:30 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.118.233) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.118.233 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.118.233; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.118.233) by SA2PEPF000015CC.mail.protection.outlook.com (10.167.241.202) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8466.11 via Frontend Transport; Thu, 20 Feb 2025 21:41:30 +0000 Received: from drhqmail203.nvidia.com (10.126.190.182) by mail.nvidia.com (10.127.129.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Thu, 20 Feb 2025 13:41:13 -0800 Received: from drhqmail201.nvidia.com (10.126.190.180) by drhqmail203.nvidia.com (10.126.190.182) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.14; Thu, 20 Feb 2025 13:41:13 -0800 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.126.190.180) with Microsoft SMTP Server id 15.2.1544.14 via Frontend Transport; Thu, 20 Feb 2025 13:41:09 -0800 From: Tariq Toukan To: "David S. Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet , "Andrew Lunn" CC: Gal Pressman , Mark Bloch , "Saeed Mahameed" , Leon Romanovsky , Tariq Toukan , , , , Jianbo Liu , "Leon Romanovsky" , Patrisious Haddad Subject: [PATCH net-next 8/8] net/mlx5e: Support RX xfrm state selector's UPSPEC for packet offload Date: Thu, 20 Feb 2025 23:39:58 +0200 Message-ID: <20250220213959.504304-9-tariqt@nvidia.com> X-Mailer: git-send-email 2.45.0 In-Reply-To: <20250220213959.504304-1-tariqt@nvidia.com> References: <20250220213959.504304-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-rdma@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-NV-OnPremToCloud: AnonymousSubmission X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SA2PEPF000015CC:EE_|SN7PR12MB6715:EE_ X-MS-Office365-Filtering-Correlation-Id: f6534499-ab5a-4db4-944d-08dd51f7563b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|82310400026|36860700013|1800799024; X-Microsoft-Antispam-Message-Info: FaJrzgfzfi74vSyaQNBj5oG8mggKylr/VLJkAwByL1/iZhJdpYZzhF0UoAOCC8/XiR5SI/tYAYS1eCs9jWEynEy7bmpq24oxWBrccvU/VJ5XpEiTeUuPjfD07XKq5Vq13pxdWq1IeI0WFcs1VU9P9T9VHbLHsDxI8D8358HZmxBilg6lJeEyUC9O+CJVL7KkCB4TCAnlsEZd06px0ZPCorqYD/v6GEC/WTrwwM6A/ka+qfRKy5Fu2P9d1HYMKT9JrNiWd07Oja/LobhgNvW0QvvOWnmnFXXby0ytXjD2wk3y2UIH/IfNUfgCxR7JwemUYcfhj05heFYhxPKnv/zZToeNc75wZo8dOoYrLmtAfL7R52EajRE4wQKK10PSXXhSx4e487wmGw8jFCzsNmaNWJ9OGrqakL6T3YbFJOPRldLDkFb1foFodCvHJP05XCeQNSVI09/zgp1CNiRcA2bZvwm61Jn61IfEwpNxz2Z99Q0xir4lFyOw6cVo4gU0sF5B2hdh6Tfjmtk7ztIfUWPMSHO1Jkj3jzRwsZ/g/MZvEttN4bNCRR3XZRxYuRJPYez3YU+DXJuw32lelZkihP397gvn7yKHlmJ2A1TVQoPhgpLMgn72i/loNAQ8AX7i7kcecbTn4ftabV9uFIEd2OS23wRORWRhRQWh08vQfprIeAUkzymGSk7W6yLH9qs3SOKTt0SdNXEas+Wwq63GH774JulV48JqUcyD3wHKEz3XfnO6wlgTV3cJkhpJdczwHytPyKCJuaNIVATxUP1JNR733ZyMHW14dqDv2gAEPUxh8edGa0dcn5iEWrMedex31Ea+9+wcY0rV0KUMtVcVB2amiE8u3T+F33ZATOKibbSvSUBBXe/6r5ZBbrzZrFX8MXHAg5ZkkQ7v2anXj2b0xNPa9SOFEje7I990b8Sx9Q4VN/G4IgYnW48dVFj3dvNAUz0f52YHhBnFv64mLSyjyatq3KRtAPcl2mPPloah9vX01RGa5e3Ovq5Zp9r82pXDuPsEUHiBn+LB6gVn8W4zIxjlNpGjfZNjzLUgnsVVs1wR8aQFlO9IarFNd6oR5MOsxi6+/f5o5mfUJ4BAyQEvnUIq9pAK7SPLT6yozISdYhgpms8LGZTy3u77ZsNGdi8hsJfkFZ0GZgHB4xYJATs/MfUI0nCO9rFHDhP3IT7xDdNmLhycx/EcKSiJoeuvYQgXGl3h5e8L6B+uMF2QYHvs15r8AwvPMnLu4cypNY0EHZpu7LBBYKC/pGTj1dGIbhymWb6msAGSCFCSxtAL6I7C4uJKO7z+8dHjxSXfkVaGkSWmcrojC2P+osMyHkcKmQoI+antXvGCGS7M+PKuPu1wKBgwL3N73LZWqUguyEyDWBxgFRRIstXNglkZiLyyCgtEkir8E2NSZhn6FbpBbVt8MGd496o4VilQtj9l5OsvY6o4KIMzD6mMeClgiv/Glk/ir+x/RzSGg+6cnWopI3dhX+5RPJe3aWlpKmqg6WkeGpeAbfI= X-Forefront-Antispam-Report: CIP:216.228.118.233;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc7edge2.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(82310400026)(36860700013)(1800799024);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Feb 2025 21:41:30.0745 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: f6534499-ab5a-4db4-944d-08dd51f7563b X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.118.233];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SA2PEPF000015CC.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN7PR12MB6715 From: Jianbo Liu Previously, the upper layer matches are added for the decryption rule when xfrm selector's UPSPEC is specified in the command. However, it's impossible as packets are not decrypted, and there is no way to do match on the upper protocol (TCP/UDP) with specific source/destination port. The result is that packets are not decrypted by hardware because of this mismatch. Instead, they are forwarded to kernel, and decryption is done by software. To resolve this issue, this patch adds new table (sa_sel) after status table and before policy table. When UPSPEC's proto is specified in xfrm state's selector, a rule is added in status table to forward the decrypted packets to sa_sel table, where the corresponding rule for selector's UPSPEC is added, and packet's upper headers are checked there. If matched, they will be forward to policy table to do policy check. Otherwise, they are dropped immediately. Besides, add a global count for this kind of packet drop. Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Reviewed-by: Patrisious Haddad Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/ipsec.h | 5 + .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 238 +++++++++++++++++- .../mellanox/mlx5/core/en_accel/ipsec_stats.c | 1 + 3 files changed, 242 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h index 7d943e93cf6d..ad8db9e1fd1d 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h @@ -128,6 +128,7 @@ struct mlx5e_ipsec_hw_stats { u64 ipsec_rx_bytes; u64 ipsec_rx_drop_pkts; u64 ipsec_rx_drop_bytes; + u64 ipsec_rx_drop_mismatch_sa_sel; u64 ipsec_tx_pkts; u64 ipsec_tx_bytes; u64 ipsec_tx_drop_pkts; @@ -184,6 +185,7 @@ struct mlx5e_ipsec_ft { struct mutex mutex; /* Protect changes to this struct */ struct mlx5_flow_table *pol; struct mlx5_flow_table *sa; + struct mlx5_flow_table *sa_sel; struct mlx5_flow_table *status; u32 refcnt; }; @@ -195,6 +197,8 @@ struct mlx5e_ipsec_drop { struct mlx5e_ipsec_rule { struct mlx5_flow_handle *rule; + struct mlx5_flow_handle *status_pass; + struct mlx5_flow_handle *sa_sel; struct mlx5_modify_hdr *modify_hdr; struct mlx5_pkt_reformat *pkt_reformat; struct mlx5_fc *fc; @@ -206,6 +210,7 @@ struct mlx5e_ipsec_rule { struct mlx5e_ipsec_miss { struct mlx5_flow_group *group; struct mlx5_flow_handle *rule; + struct mlx5_fc *fc; }; struct mlx5e_ipsec_tx_create_attr { diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c index 840d9e0514d3..d51ace739637 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c @@ -16,6 +16,8 @@ #define MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_SIZE 16 #define IPSEC_TUNNEL_DEFAULT_TTL 0x40 +#define MLX5_IPSEC_FS_SA_SELECTOR_MAX_NUM_GROUPS 16 + enum { MLX5_IPSEC_ASO_OK, MLX5_IPSEC_ASO_BAD_REPLY, @@ -52,6 +54,7 @@ struct mlx5e_ipsec_rx { struct mlx5e_ipsec_ft ft; struct mlx5e_ipsec_miss pol; struct mlx5e_ipsec_miss sa; + struct mlx5e_ipsec_miss sa_sel; struct mlx5e_ipsec_status_checks status_checks; struct mlx5e_ipsec_fc *fc; struct mlx5_fs_chains *chains; @@ -689,6 +692,16 @@ static void ipsec_rx_policy_destroy(struct mlx5e_ipsec_rx *rx) } } +static void ipsec_rx_sa_selector_destroy(struct mlx5_core_dev *mdev, + struct mlx5e_ipsec_rx *rx) +{ + mlx5_del_flow_rules(rx->sa_sel.rule); + mlx5_fc_destroy(mdev, rx->sa_sel.fc); + rx->sa_sel.fc = NULL; + mlx5_destroy_flow_group(rx->sa_sel.group); + mlx5_destroy_flow_table(rx->ft.sa_sel); +} + static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_rx *rx, u32 family) { @@ -704,6 +717,8 @@ static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, mlx5_ipsec_rx_status_destroy(ipsec, rx); mlx5_destroy_flow_table(rx->ft.status); + ipsec_rx_sa_selector_destroy(mdev, rx); + ipsec_rx_policy_destroy(rx); mlx5_ipsec_fs_roce_rx_destroy(ipsec->roce, family, mdev); @@ -892,6 +907,115 @@ static int ipsec_rx_policy_create(struct mlx5e_ipsec *ipsec, return err; } +static int ipsec_rx_sa_selector_create(struct mlx5e_ipsec *ipsec, + struct mlx5e_ipsec_rx *rx, + struct mlx5e_ipsec_rx_create_attr *attr) +{ + int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in); + struct mlx5_core_dev *mdev = ipsec->mdev; + struct mlx5_flow_act flow_act = {}; + struct mlx5_flow_destination dest; + struct mlx5_flow_handle *rule; + struct mlx5_flow_table *ft; + struct mlx5_flow_group *fg; + u32 *flow_group_in; + struct mlx5_fc *fc; + int err; + + flow_group_in = kvzalloc(inlen, GFP_KERNEL); + if (!flow_group_in) + return -ENOMEM; + + ft = ipsec_ft_create(attr->ns, attr->status_level, attr->prio, 1, + MLX5_IPSEC_FS_SA_SELECTOR_MAX_NUM_GROUPS, 0); + if (IS_ERR(ft)) { + err = PTR_ERR(ft); + mlx5_core_err(mdev, "Failed to create RX SA selector flow table, err=%d\n", + err); + goto err_ft; + } + + MLX5_SET(create_flow_group_in, flow_group_in, start_flow_index, + ft->max_fte - 1); + MLX5_SET(create_flow_group_in, flow_group_in, end_flow_index, + ft->max_fte - 1); + fg = mlx5_create_flow_group(ft, flow_group_in); + if (IS_ERR(fg)) { + err = PTR_ERR(fg); + mlx5_core_err(mdev, "Failed to create RX SA selector miss group, err=%d\n", + err); + goto err_fg; + } + + fc = mlx5_fc_create(mdev, false); + if (IS_ERR(fc)) { + err = PTR_ERR(fc); + mlx5_core_err(mdev, + "Failed to create ipsec RX SA selector miss rule counter, err=%d\n", + err); + goto err_cnt; + } + + dest.type = MLX5_FLOW_DESTINATION_TYPE_COUNTER; + dest.counter = fc; + flow_act.action = + MLX5_FLOW_CONTEXT_ACTION_COUNT | MLX5_FLOW_CONTEXT_ACTION_DROP; + + rule = mlx5_add_flow_rules(ft, NULL, &flow_act, &dest, 1); + if (IS_ERR(rule)) { + err = PTR_ERR(rule); + mlx5_core_err(mdev, "Failed to create RX SA selector miss drop rule, err=%d\n", + err); + goto err_rule; + } + + rx->ft.sa_sel = ft; + rx->sa_sel.group = fg; + rx->sa_sel.fc = fc; + rx->sa_sel.rule = rule; + + kvfree(flow_group_in); + + return 0; + +err_rule: + mlx5_fc_destroy(mdev, fc); +err_cnt: + mlx5_destroy_flow_group(fg); +err_fg: + mlx5_destroy_flow_table(ft); +err_ft: + kvfree(flow_group_in); + return err; +} + +/* The decryption processing is as follows: + * + * +----------+ +-------------+ + * | | | | + * | Kernel <--------------+----------+ policy miss <------------+ + * | | ^ | | ^ + * +----^-----+ | +-------------+ | + * | crypto | + * miss offload ok allow/default + * ^ ^ ^ + * | | packet | + * +----+---------+ +----+-------------+ offload ok +------+---+ + * | | | | (no UPSPEC) | | + * | SA (decrypt) +-----> status +--->------->----+ policy | + * | | | | | | + * +--------------+ ++---------+-------+ +-^----+---+ + * | | | | + * v packet +-->->---+ v + * | offload ok match | + * fails (with UPSPEC) | block + * | | +-------------+-+ | + * v v | | miss v + * drop +---> SA sel +--------->drop + * | | + * +---------------+ + */ + static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_rx *rx, u32 family) { @@ -907,13 +1031,17 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, if (err) return err; - ft = ipsec_ft_create(attr.ns, attr.status_level, attr.prio, 3, 3, 0); + ft = ipsec_ft_create(attr.ns, attr.status_level, attr.prio, 3, 4, 0); if (IS_ERR(ft)) { err = PTR_ERR(ft); goto err_fs_ft_status; } rx->ft.status = ft; + err = ipsec_rx_sa_selector_create(ipsec, rx, &attr); + if (err) + goto err_fs_ft_sa_sel; + /* Create FT */ if (mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_TUNNEL) rx->allow_tunnel_mode = mlx5_eswitch_block_encap(mdev); @@ -956,6 +1084,8 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, if (rx->allow_tunnel_mode) mlx5_eswitch_unblock_encap(mdev); err_fs_ft: + ipsec_rx_sa_selector_destroy(mdev, rx); +err_fs_ft_sa_sel: mlx5_destroy_flow_table(rx->ft.status); err_fs_ft_status: mlx5_ipsec_fs_roce_rx_destroy(ipsec->roce, family, mdev); @@ -1781,6 +1911,85 @@ static int setup_pkt_reformat(struct mlx5e_ipsec *ipsec, return 0; } +static int rx_add_rule_sa_selector(struct mlx5e_ipsec_sa_entry *sa_entry, + struct mlx5e_ipsec_rx *rx, + struct upspec *upspec) +{ + struct mlx5e_ipsec *ipsec = sa_entry->ipsec; + struct mlx5_core_dev *mdev = ipsec->mdev; + struct mlx5_flow_destination dest[2]; + struct mlx5_flow_act flow_act = {}; + struct mlx5_flow_handle *rule; + struct mlx5_flow_spec *spec; + int err = 0; + + spec = kvzalloc(sizeof(*spec), GFP_KERNEL); + if (!spec) + return -ENOMEM; + + MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, + misc_parameters_2.ipsec_syndrome); + MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, + misc_parameters_2.metadata_reg_c_4); + MLX5_SET(fte_match_param, spec->match_value, + misc_parameters_2.ipsec_syndrome, 0); + MLX5_SET(fte_match_param, spec->match_value, + misc_parameters_2.metadata_reg_c_4, 0); + spec->match_criteria_enable = MLX5_MATCH_MISC_PARAMETERS_2; + + ipsec_rx_rule_add_match_obj(sa_entry, rx, spec); + + flow_act.action = MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | + MLX5_FLOW_CONTEXT_ACTION_COUNT; + flow_act.flags = FLOW_ACT_IGNORE_FLOW_LEVEL; + dest[0].type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; + dest[0].ft = rx->ft.sa_sel; + dest[1].type = MLX5_FLOW_DESTINATION_TYPE_COUNTER; + dest[1].counter = rx->fc->cnt; + + rule = mlx5_add_flow_rules(rx->ft.status, spec, &flow_act, dest, 2); + if (IS_ERR(rule)) { + err = PTR_ERR(rule); + mlx5_core_err(mdev, + "Failed to add ipsec rx pass rule, err=%d\n", + err); + goto err_add_status_pass_rule; + } + + sa_entry->ipsec_rule.status_pass = rule; + + MLX5_SET(fte_match_param, spec->match_criteria, + misc_parameters_2.ipsec_syndrome, 0); + MLX5_SET(fte_match_param, spec->match_criteria, + misc_parameters_2.metadata_reg_c_4, 0); + + setup_fte_upper_proto_match(spec, upspec); + + flow_act.action = MLX5_FLOW_CONTEXT_ACTION_FWD_DEST; + dest[0].type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; + dest[0].ft = rx->ft.pol; + + rule = mlx5_add_flow_rules(rx->ft.sa_sel, spec, &flow_act, &dest[0], 1); + if (IS_ERR(rule)) { + err = PTR_ERR(rule); + mlx5_core_err(mdev, + "Failed to add ipsec rx sa selector rule, err=%d\n", + err); + goto err_add_sa_sel_rule; + } + + sa_entry->ipsec_rule.sa_sel = rule; + + kvfree(spec); + return 0; + +err_add_sa_sel_rule: + mlx5_del_flow_rules(sa_entry->ipsec_rule.status_pass); +err_add_status_pass_rule: + kvfree(spec); + return err; +} + static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) { struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs; @@ -1813,7 +2022,6 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) if (!attrs->encap) setup_fte_esp(spec); setup_fte_no_frags(spec); - setup_fte_upper_proto_match(spec, &attrs->upspec); if (!attrs->drop) { if (rx != ipsec->rx_esw) @@ -1861,6 +2069,13 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) mlx5_core_err(mdev, "fail to add RX ipsec rule err=%d\n", err); goto err_add_flow; } + + if (attrs->upspec.proto && attrs->type == XFRM_DEV_OFFLOAD_PACKET) { + err = rx_add_rule_sa_selector(sa_entry, rx, &attrs->upspec); + if (err) + goto err_add_sa_sel; + } + if (attrs->type == XFRM_DEV_OFFLOAD_PACKET) err = rx_add_rule_drop_replay(sa_entry, rx); if (err) @@ -1884,6 +2099,11 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) mlx5_fc_destroy(mdev, sa_entry->ipsec_rule.replay.fc); } err_add_replay: + if (sa_entry->ipsec_rule.sa_sel) { + mlx5_del_flow_rules(sa_entry->ipsec_rule.sa_sel); + mlx5_del_flow_rules(sa_entry->ipsec_rule.status_pass); + } +err_add_sa_sel: mlx5_del_flow_rules(rule); err_add_flow: mlx5_fc_destroy(mdev, counter); @@ -2265,6 +2485,7 @@ void mlx5e_accel_ipsec_fs_read_stats(struct mlx5e_priv *priv, void *ipsec_stats) stats->ipsec_rx_bytes = 0; stats->ipsec_rx_drop_pkts = 0; stats->ipsec_rx_drop_bytes = 0; + stats->ipsec_rx_drop_mismatch_sa_sel = 0; stats->ipsec_tx_pkts = 0; stats->ipsec_tx_bytes = 0; stats->ipsec_tx_drop_pkts = 0; @@ -2274,6 +2495,9 @@ void mlx5e_accel_ipsec_fs_read_stats(struct mlx5e_priv *priv, void *ipsec_stats) mlx5_fc_query(mdev, fc->cnt, &stats->ipsec_rx_pkts, &stats->ipsec_rx_bytes); mlx5_fc_query(mdev, fc->drop, &stats->ipsec_rx_drop_pkts, &stats->ipsec_rx_drop_bytes); + if (ipsec->rx_ipv4->sa_sel.fc) + mlx5_fc_query(mdev, ipsec->rx_ipv4->sa_sel.fc, + &stats->ipsec_rx_drop_mismatch_sa_sel, &bytes); fc = ipsec->tx->fc; mlx5_fc_query(mdev, fc->cnt, &stats->ipsec_tx_pkts, &stats->ipsec_tx_bytes); @@ -2302,6 +2526,11 @@ void mlx5e_accel_ipsec_fs_read_stats(struct mlx5e_priv *priv, void *ipsec_stats) stats->ipsec_tx_drop_pkts += packets; stats->ipsec_tx_drop_bytes += bytes; } + + if (ipsec->rx_esw->sa_sel.fc && + !mlx5_fc_query(mdev, ipsec->rx_esw->sa_sel.fc, + &packets, &bytes)) + stats->ipsec_rx_drop_mismatch_sa_sel += packets; } } @@ -2399,6 +2628,11 @@ void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_ipsec_sa_entry *sa_entry) mlx5_del_flow_rules(ipsec_rule->auth.rule); mlx5_fc_destroy(mdev, ipsec_rule->auth.fc); + if (ipsec_rule->sa_sel) { + mlx5_del_flow_rules(ipsec_rule->sa_sel); + mlx5_del_flow_rules(ipsec_rule->status_pass); + } + if (ipsec_rule->replay.rule) { mlx5_del_flow_rules(ipsec_rule->replay.rule); mlx5_fc_destroy(mdev, ipsec_rule->replay.fc); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_stats.c index 92bf3fa44a3b..93be388068f8 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_stats.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_stats.c @@ -42,6 +42,7 @@ static const struct counter_desc mlx5e_ipsec_hw_stats_desc[] = { { MLX5E_DECLARE_STAT(struct mlx5e_ipsec_hw_stats, ipsec_rx_bytes) }, { MLX5E_DECLARE_STAT(struct mlx5e_ipsec_hw_stats, ipsec_rx_drop_pkts) }, { MLX5E_DECLARE_STAT(struct mlx5e_ipsec_hw_stats, ipsec_rx_drop_bytes) }, + { MLX5E_DECLARE_STAT(struct mlx5e_ipsec_hw_stats, ipsec_rx_drop_mismatch_sa_sel) }, { MLX5E_DECLARE_STAT(struct mlx5e_ipsec_hw_stats, ipsec_tx_pkts) }, { MLX5E_DECLARE_STAT(struct mlx5e_ipsec_hw_stats, ipsec_tx_bytes) }, { MLX5E_DECLARE_STAT(struct mlx5e_ipsec_hw_stats, ipsec_tx_drop_pkts) },