Skip to content

Commit 84cb1b5

Browse files
kuba-mookuba-moo
committed
Leon Romanovsky says: ==================== mlx5-next changes Following previous conversations [1] and our clear commitment to do the TC work [2], please pull mlx5-next shared branch, which includes low-level steering logic to allow RoCEv2 traffic to be encrypted/ decrypted through IPsec. [1] https://lore.kernel.org/all/[email protected]/ [2] https://lore.kernel.org/all/[email protected]/ * 'mlx5-next' of https://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: Configure IPsec steering for egress RoCEv2 traffic net/mlx5: Configure IPsec steering for ingress RoCEv2 traffic net/mlx5: Add IPSec priorities in RDMA namespaces net/mlx5: Implement new destination type TABLE_TYPE net/mlx5: Introduce new destination type TABLE_TYPE ==================== Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
2 parents ca0df43 + 22551e7 commit 84cb1b5

File tree

12 files changed

+511
-15
lines changed

12 files changed

+511
-15
lines changed

‎drivers/net/ethernet/mellanox/mlx5/core/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ mlx5_core-$(CONFIG_MLX5_EN_MACSEC) += en_accel/macsec.o en_accel/macsec_fs.o \
9797

9898
mlx5_core-$(CONFIG_MLX5_EN_IPSEC) += en_accel/ipsec.o en_accel/ipsec_rxtx.o \
9999
en_accel/ipsec_stats.o en_accel/ipsec_fs.o \
100-
en_accel/ipsec_offload.o
100+
en_accel/ipsec_offload.o lib/ipsec_fs_roce.o
101101

102102
mlx5_core-$(CONFIG_MLX5_EN_TLS) += en_accel/ktls_stats.o \
103103
en_accel/fs_tcp.o en_accel/ktls.o en_accel/ktls_txrx.o \

‎drivers/net/ethernet/mellanox/mlx5/core/diag/fs_tracepoint.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -275,6 +275,10 @@ const char *parse_fs_dst(struct trace_seq *p,
275275
fs_dest_range_field_to_str(dst->range.field),
276276
dst->range.min, dst->range.max);
277277
break;
278+
case MLX5_FLOW_DESTINATION_TYPE_TABLE_TYPE:
279+
trace_seq_printf(p, "flow_table_type=%u id:%u\n", dst->ft->type,
280+
dst->ft->id);
281+
break;
278282
case MLX5_FLOW_DESTINATION_TYPE_NONE:
279283
trace_seq_printf(p, "none\n");
280284
break;

‎drivers/net/ethernet/mellanox/mlx5/core/en/fs.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ enum {
8787
MLX5E_ACCEL_FS_POL_FT_LEVEL = MLX5E_INNER_TTC_FT_LEVEL + 1,
8888
MLX5E_ACCEL_FS_ESP_FT_LEVEL,
8989
MLX5E_ACCEL_FS_ESP_FT_ERR_LEVEL,
90+
MLX5E_ACCEL_FS_ESP_FT_ROCE_LEVEL,
9091
#endif
9192
};
9293

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ enum mlx5_ipsec_cap {
9393
MLX5_IPSEC_CAP_CRYPTO = 1 << 0,
9494
MLX5_IPSEC_CAP_ESN = 1 << 1,
9595
MLX5_IPSEC_CAP_PACKET_OFFLOAD = 1 << 2,
96+
MLX5_IPSEC_CAP_ROCE = 1 << 3,
9697
};
9798

9899
struct mlx5e_priv;
@@ -147,6 +148,7 @@ struct mlx5e_ipsec {
147148
struct mlx5e_ipsec_tx *tx;
148149
struct mlx5e_ipsec_aso *aso;
149150
struct notifier_block nb;
151+
struct mlx5_ipsec_fs *roce;
150152
};
151153

152154
struct mlx5e_ipsec_esn_state {

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c

Lines changed: 47 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
#include "en/fs.h"
77
#include "ipsec.h"
88
#include "fs_core.h"
9+
#include "lib/ipsec_fs_roce.h"
910

1011
#define NUM_IPSEC_FTE BIT(15)
1112

@@ -166,7 +167,8 @@ static int ipsec_miss_create(struct mlx5_core_dev *mdev,
166167
return err;
167168
}
168169

169-
static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_rx *rx)
170+
static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,
171+
struct mlx5e_ipsec_rx *rx, u32 family)
170172
{
171173
mlx5_del_flow_rules(rx->pol.rule);
172174
mlx5_destroy_flow_group(rx->pol.group);
@@ -179,25 +181,44 @@ static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_rx *rx)
179181
mlx5_del_flow_rules(rx->status.rule);
180182
mlx5_modify_header_dealloc(mdev, rx->status.modify_hdr);
181183
mlx5_destroy_flow_table(rx->ft.status);
184+
185+
mlx5_ipsec_fs_roce_rx_destroy(ipsec->roce, family);
182186
}
183187

184188
static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,
185189
struct mlx5e_ipsec_rx *rx, u32 family)
186190
{
187191
struct mlx5_flow_namespace *ns = mlx5e_fs_get_ns(ipsec->fs, false);
188192
struct mlx5_ttc_table *ttc = mlx5e_fs_get_ttc(ipsec->fs, false);
193+
struct mlx5_flow_destination default_dest;
189194
struct mlx5_flow_destination dest[2];
190195
struct mlx5_flow_table *ft;
191196
int err;
192197

198+
default_dest = mlx5_ttc_get_default_dest(ttc, family2tt(family));
199+
err = mlx5_ipsec_fs_roce_rx_create(mdev, ipsec->roce, ns, &default_dest,
200+
family, MLX5E_ACCEL_FS_ESP_FT_ROCE_LEVEL,
201+
MLX5E_NIC_PRIO);
202+
if (err)
203+
return err;
204+
193205
ft = ipsec_ft_create(ns, MLX5E_ACCEL_FS_ESP_FT_ERR_LEVEL,
194206
MLX5E_NIC_PRIO, 1);
195-
if (IS_ERR(ft))
196-
return PTR_ERR(ft);
207+
if (IS_ERR(ft)) {
208+
err = PTR_ERR(ft);
209+
goto err_fs_ft_status;
210+
}
197211

198212
rx->ft.status = ft;
199213

200-
dest[0] = mlx5_ttc_get_default_dest(ttc, family2tt(family));
214+
ft = mlx5_ipsec_fs_roce_ft_get(ipsec->roce, family);
215+
if (ft) {
216+
dest[0].type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE;
217+
dest[0].ft = ft;
218+
} else {
219+
dest[0] = default_dest;
220+
}
221+
201222
dest[1].type = MLX5_FLOW_DESTINATION_TYPE_COUNTER;
202223
dest[1].counter_id = mlx5_fc_id(rx->fc->cnt);
203224
err = ipsec_status_rule(mdev, rx, dest);
@@ -245,6 +266,8 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,
245266
mlx5_modify_header_dealloc(mdev, rx->status.modify_hdr);
246267
err_add:
247268
mlx5_destroy_flow_table(rx->ft.status);
269+
err_fs_ft_status:
270+
mlx5_ipsec_fs_roce_rx_destroy(ipsec->roce, family);
248271
return err;
249272
}
250273

@@ -304,14 +327,15 @@ static void rx_ft_put(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,
304327
mlx5_ttc_fwd_default_dest(ttc, family2tt(family));
305328

306329
/* remove FT */
307-
rx_destroy(mdev, rx);
330+
rx_destroy(mdev, ipsec, rx, family);
308331

309332
out:
310333
mutex_unlock(&rx->ft.mutex);
311334
}
312335

313336
/* IPsec TX flow steering */
314-
static int tx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_tx *tx)
337+
static int tx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_tx *tx,
338+
struct mlx5_ipsec_fs *roce)
315339
{
316340
struct mlx5_flow_destination dest = {};
317341
struct mlx5_flow_table *ft;
@@ -334,8 +358,15 @@ static int tx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_tx *tx)
334358
err = ipsec_miss_create(mdev, tx->ft.pol, &tx->pol, &dest);
335359
if (err)
336360
goto err_pol_miss;
361+
362+
err = mlx5_ipsec_fs_roce_tx_create(mdev, roce, tx->ft.pol);
363+
if (err)
364+
goto err_roce;
337365
return 0;
338366

367+
err_roce:
368+
mlx5_del_flow_rules(tx->pol.rule);
369+
mlx5_destroy_flow_group(tx->pol.group);
339370
err_pol_miss:
340371
mlx5_destroy_flow_table(tx->ft.pol);
341372
err_pol_ft:
@@ -353,9 +384,10 @@ static struct mlx5e_ipsec_tx *tx_ft_get(struct mlx5_core_dev *mdev,
353384
if (tx->ft.refcnt)
354385
goto skip;
355386

356-
err = tx_create(mdev, tx);
387+
err = tx_create(mdev, tx, ipsec->roce);
357388
if (err)
358389
goto out;
390+
359391
skip:
360392
tx->ft.refcnt++;
361393
out:
@@ -374,6 +406,7 @@ static void tx_ft_put(struct mlx5e_ipsec *ipsec)
374406
if (tx->ft.refcnt)
375407
goto out;
376408

409+
mlx5_ipsec_fs_roce_tx_destroy(ipsec->roce);
377410
mlx5_del_flow_rules(tx->pol.rule);
378411
mlx5_destroy_flow_group(tx->pol.group);
379412
mlx5_destroy_flow_table(tx->ft.pol);
@@ -1031,6 +1064,9 @@ void mlx5e_accel_ipsec_fs_cleanup(struct mlx5e_ipsec *ipsec)
10311064
if (!ipsec->tx)
10321065
return;
10331066

1067+
if (mlx5_ipsec_device_caps(ipsec->mdev) & MLX5_IPSEC_CAP_ROCE)
1068+
mlx5_ipsec_fs_roce_cleanup(ipsec->roce);
1069+
10341070
ipsec_fs_destroy_counters(ipsec);
10351071
mutex_destroy(&ipsec->tx->ft.mutex);
10361072
WARN_ON(ipsec->tx->ft.refcnt);
@@ -1047,6 +1083,7 @@ void mlx5e_accel_ipsec_fs_cleanup(struct mlx5e_ipsec *ipsec)
10471083

10481084
int mlx5e_accel_ipsec_fs_init(struct mlx5e_ipsec *ipsec)
10491085
{
1086+
struct mlx5_core_dev *mdev = ipsec->mdev;
10501087
struct mlx5_flow_namespace *ns;
10511088
int err = -ENOMEM;
10521089

@@ -1076,6 +1113,9 @@ int mlx5e_accel_ipsec_fs_init(struct mlx5e_ipsec *ipsec)
10761113
mutex_init(&ipsec->rx_ipv6->ft.mutex);
10771114
ipsec->tx->ns = ns;
10781115

1116+
if (mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_ROCE)
1117+
ipsec->roce = mlx5_ipsec_fs_roce_init(mdev);
1118+
10791119
return 0;
10801120

10811121
err_counters:

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,11 @@ u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev)
4242
MLX5_CAP_FLOWTABLE_NIC_RX(mdev, decap))
4343
caps |= MLX5_IPSEC_CAP_PACKET_OFFLOAD;
4444

45+
if (mlx5_get_roce_state(mdev) &&
46+
MLX5_CAP_GEN_2(mdev, flow_table_type_2_type) & MLX5_FT_NIC_RX_2_NIC_RX_RDMA &&
47+
MLX5_CAP_GEN_2(mdev, flow_table_type_2_type) & MLX5_FT_NIC_TX_RDMA_2_NIC_TX)
48+
caps |= MLX5_IPSEC_CAP_ROCE;
49+
4550
if (!caps)
4651
return 0;
4752

‎drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -646,6 +646,12 @@ static int mlx5_cmd_set_fte(struct mlx5_core_dev *dev,
646646
id = dst->dest_attr.sampler_id;
647647
ifc_type = MLX5_IFC_FLOW_DESTINATION_TYPE_FLOW_SAMPLER;
648648
break;
649+
case MLX5_FLOW_DESTINATION_TYPE_TABLE_TYPE:
650+
MLX5_SET(dest_format_struct, in_dests,
651+
destination_table_type, dst->dest_attr.ft->type);
652+
id = dst->dest_attr.ft->id;
653+
ifc_type = MLX5_IFC_FLOW_DESTINATION_TYPE_TABLE_TYPE;
654+
break;
649655
default:
650656
id = dst->dest_attr.tir_num;
651657
ifc_type = MLX5_IFC_FLOW_DESTINATION_TYPE_TIR;

‎drivers/net/ethernet/mellanox/mlx5/core/fs_core.c

Lines changed: 39 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -113,8 +113,10 @@
113113
#define ETHTOOL_PRIO_NUM_LEVELS 1
114114
#define ETHTOOL_NUM_PRIOS 11
115115
#define ETHTOOL_MIN_LEVEL (KERNEL_MIN_LEVEL + ETHTOOL_NUM_PRIOS)
116-
/* Promiscuous, Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy */
117-
#define KERNEL_NIC_PRIO_NUM_LEVELS 8
116+
/* Promiscuous, Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy,
117+
* IPsec RoCE policy
118+
*/
119+
#define KERNEL_NIC_PRIO_NUM_LEVELS 9
118120
#define KERNEL_NIC_NUM_PRIOS 1
119121
/* One more level for tc */
120122
#define KERNEL_MIN_LEVEL (KERNEL_NIC_PRIO_NUM_LEVELS + 1)
@@ -221,19 +223,30 @@ static struct init_tree_node egress_root_fs = {
221223
};
222224

223225
enum {
226+
RDMA_RX_IPSEC_PRIO,
224227
RDMA_RX_COUNTERS_PRIO,
225228
RDMA_RX_BYPASS_PRIO,
226229
RDMA_RX_KERNEL_PRIO,
227230
};
228231

232+
#define RDMA_RX_IPSEC_NUM_PRIOS 1
233+
#define RDMA_RX_IPSEC_NUM_LEVELS 2
234+
#define RDMA_RX_IPSEC_MIN_LEVEL (RDMA_RX_IPSEC_NUM_LEVELS)
235+
229236
#define RDMA_RX_BYPASS_MIN_LEVEL MLX5_BY_PASS_NUM_REGULAR_PRIOS
230237
#define RDMA_RX_KERNEL_MIN_LEVEL (RDMA_RX_BYPASS_MIN_LEVEL + 1)
231238
#define RDMA_RX_COUNTERS_MIN_LEVEL (RDMA_RX_KERNEL_MIN_LEVEL + 2)
232239

233240
static struct init_tree_node rdma_rx_root_fs = {
234241
.type = FS_TYPE_NAMESPACE,
235-
.ar_size = 3,
242+
.ar_size = 4,
236243
.children = (struct init_tree_node[]) {
244+
[RDMA_RX_IPSEC_PRIO] =
245+
ADD_PRIO(0, RDMA_RX_IPSEC_MIN_LEVEL, 0,
246+
FS_CHAINING_CAPS,
247+
ADD_NS(MLX5_FLOW_TABLE_MISS_ACTION_DEF,
248+
ADD_MULTIPLE_PRIO(RDMA_RX_IPSEC_NUM_PRIOS,
249+
RDMA_RX_IPSEC_NUM_LEVELS))),
237250
[RDMA_RX_COUNTERS_PRIO] =
238251
ADD_PRIO(0, RDMA_RX_COUNTERS_MIN_LEVEL, 0,
239252
FS_CHAINING_CAPS,
@@ -256,22 +269,34 @@ static struct init_tree_node rdma_rx_root_fs = {
256269

257270
enum {
258271
RDMA_TX_COUNTERS_PRIO,
272+
RDMA_TX_IPSEC_PRIO,
259273
RDMA_TX_BYPASS_PRIO,
260274
};
261275

262276
#define RDMA_TX_BYPASS_MIN_LEVEL MLX5_BY_PASS_NUM_PRIOS
263277
#define RDMA_TX_COUNTERS_MIN_LEVEL (RDMA_TX_BYPASS_MIN_LEVEL + 1)
264278

279+
#define RDMA_TX_IPSEC_NUM_PRIOS 1
280+
#define RDMA_TX_IPSEC_PRIO_NUM_LEVELS 1
281+
#define RDMA_TX_IPSEC_MIN_LEVEL (RDMA_TX_COUNTERS_MIN_LEVEL + RDMA_TX_IPSEC_NUM_PRIOS)
282+
265283
static struct init_tree_node rdma_tx_root_fs = {
266284
.type = FS_TYPE_NAMESPACE,
267-
.ar_size = 2,
285+
.ar_size = 3,
268286
.children = (struct init_tree_node[]) {
269287
[RDMA_TX_COUNTERS_PRIO] =
270288
ADD_PRIO(0, RDMA_TX_COUNTERS_MIN_LEVEL, 0,
271289
FS_CHAINING_CAPS,
272290
ADD_NS(MLX5_FLOW_TABLE_MISS_ACTION_DEF,
273291
ADD_MULTIPLE_PRIO(MLX5_RDMA_TX_NUM_COUNTERS_PRIOS,
274292
RDMA_TX_COUNTERS_PRIO_NUM_LEVELS))),
293+
[RDMA_TX_IPSEC_PRIO] =
294+
ADD_PRIO(0, RDMA_TX_IPSEC_MIN_LEVEL, 0,
295+
FS_CHAINING_CAPS,
296+
ADD_NS(MLX5_FLOW_TABLE_MISS_ACTION_DEF,
297+
ADD_MULTIPLE_PRIO(RDMA_TX_IPSEC_NUM_PRIOS,
298+
RDMA_TX_IPSEC_PRIO_NUM_LEVELS))),
299+
275300
[RDMA_TX_BYPASS_PRIO] =
276301
ADD_PRIO(0, RDMA_TX_BYPASS_MIN_LEVEL, 0,
277302
FS_CHAINING_CAPS_RDMA_TX,
@@ -451,7 +476,8 @@ static bool is_fwd_dest_type(enum mlx5_flow_destination_type type)
451476
type == MLX5_FLOW_DESTINATION_TYPE_VPORT ||
452477
type == MLX5_FLOW_DESTINATION_TYPE_FLOW_SAMPLER ||
453478
type == MLX5_FLOW_DESTINATION_TYPE_TIR ||
454-
type == MLX5_FLOW_DESTINATION_TYPE_RANGE;
479+
type == MLX5_FLOW_DESTINATION_TYPE_RANGE ||
480+
type == MLX5_FLOW_DESTINATION_TYPE_TABLE_TYPE;
455481
}
456482

457483
static bool check_valid_spec(const struct mlx5_flow_spec *spec)
@@ -2368,6 +2394,14 @@ struct mlx5_flow_namespace *mlx5_get_flow_namespace(struct mlx5_core_dev *dev,
23682394
root_ns = steering->rdma_tx_root_ns;
23692395
prio = RDMA_TX_COUNTERS_PRIO;
23702396
break;
2397+
case MLX5_FLOW_NAMESPACE_RDMA_RX_IPSEC:
2398+
root_ns = steering->rdma_rx_root_ns;
2399+
prio = RDMA_RX_IPSEC_PRIO;
2400+
break;
2401+
case MLX5_FLOW_NAMESPACE_RDMA_TX_IPSEC:
2402+
root_ns = steering->rdma_tx_root_ns;
2403+
prio = RDMA_TX_IPSEC_PRIO;
2404+
break;
23712405
default: /* Must be NIC RX */
23722406
WARN_ON(!is_nic_rx_ns(type));
23732407
root_ns = steering->root_ns;

0 commit comments

Comments
 (0)