Skip to content

Commit 8995776

Browse files
MarkZhang81rleon
MarkZhang81
authored and
rleon
committed
net/mlx5: Configure IPsec steering for ingress RoCEv2 traffic
Add steering tables/rules to check if the decrypted traffic is RoCEv2, if so then forward it to RDMA_RX domain. Signed-off-by: Mark Zhang <[email protected]> Signed-off-by: Patrisious Haddad <[email protected]> Reviewed-by: Leon Romanovsky <[email protected]> Reviewed-by: Raed Salem <[email protected]> Signed-off-by: Saeed Mahameed <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]>
1 parent f91ddd3 commit 8995776

File tree

8 files changed

+317
-8
lines changed

8 files changed

+317
-8
lines changed

‎drivers/net/ethernet/mellanox/mlx5/core/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ mlx5_core-$(CONFIG_MLX5_EN_MACSEC) += en_accel/macsec.o en_accel/macsec_fs.o \
9797

9898
mlx5_core-$(CONFIG_MLX5_EN_IPSEC) += en_accel/ipsec.o en_accel/ipsec_rxtx.o \
9999
en_accel/ipsec_stats.o en_accel/ipsec_fs.o \
100-
en_accel/ipsec_offload.o
100+
en_accel/ipsec_offload.o lib/ipsec_fs_roce.o
101101

102102
mlx5_core-$(CONFIG_MLX5_EN_TLS) += en_accel/ktls_stats.o \
103103
en_accel/fs_tcp.o en_accel/ktls.o en_accel/ktls_txrx.o \

‎drivers/net/ethernet/mellanox/mlx5/core/en/fs.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ enum {
8787
MLX5E_ACCEL_FS_POL_FT_LEVEL = MLX5E_INNER_TTC_FT_LEVEL + 1,
8888
MLX5E_ACCEL_FS_ESP_FT_LEVEL,
8989
MLX5E_ACCEL_FS_ESP_FT_ERR_LEVEL,
90+
MLX5E_ACCEL_FS_ESP_FT_ROCE_LEVEL,
9091
#endif
9192
};
9293

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@ enum mlx5_ipsec_cap {
8484
MLX5_IPSEC_CAP_CRYPTO = 1 << 0,
8585
MLX5_IPSEC_CAP_ESN = 1 << 1,
8686
MLX5_IPSEC_CAP_PACKET_OFFLOAD = 1 << 2,
87+
MLX5_IPSEC_CAP_ROCE = 1 << 3,
8788
};
8889

8990
struct mlx5e_priv;
@@ -141,6 +142,7 @@ struct mlx5e_ipsec {
141142
struct mlx5e_ipsec_tx *tx;
142143
struct mlx5e_ipsec_aso *aso;
143144
struct notifier_block nb;
145+
struct mlx5_ipsec_fs *roce;
144146
};
145147

146148
struct mlx5e_ipsec_esn_state {

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c

Lines changed: 35 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
#include "en/fs.h"
77
#include "ipsec.h"
88
#include "fs_core.h"
9+
#include "lib/ipsec_fs_roce.h"
910

1011
#define NUM_IPSEC_FTE BIT(15)
1112

@@ -166,7 +167,8 @@ static int ipsec_miss_create(struct mlx5_core_dev *mdev,
166167
return err;
167168
}
168169

169-
static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_rx *rx)
170+
static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,
171+
struct mlx5e_ipsec_rx *rx, u32 family)
170172
{
171173
mlx5_del_flow_rules(rx->pol.rule);
172174
mlx5_destroy_flow_group(rx->pol.group);
@@ -179,25 +181,44 @@ static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_rx *rx)
179181
mlx5_del_flow_rules(rx->status.rule);
180182
mlx5_modify_header_dealloc(mdev, rx->status.modify_hdr);
181183
mlx5_destroy_flow_table(rx->ft.status);
184+
185+
mlx5_ipsec_fs_roce_rx_destroy(ipsec->roce, family);
182186
}
183187

184188
static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,
185189
struct mlx5e_ipsec_rx *rx, u32 family)
186190
{
187191
struct mlx5_flow_namespace *ns = mlx5e_fs_get_ns(ipsec->fs, false);
188192
struct mlx5_ttc_table *ttc = mlx5e_fs_get_ttc(ipsec->fs, false);
193+
struct mlx5_flow_destination default_dest;
189194
struct mlx5_flow_destination dest[2];
190195
struct mlx5_flow_table *ft;
191196
int err;
192197

198+
default_dest = mlx5_ttc_get_default_dest(ttc, family2tt(family));
199+
err = mlx5_ipsec_fs_roce_rx_create(mdev, ipsec->roce, ns, &default_dest,
200+
family, MLX5E_ACCEL_FS_ESP_FT_ROCE_LEVEL,
201+
MLX5E_NIC_PRIO);
202+
if (err)
203+
return err;
204+
193205
ft = ipsec_ft_create(ns, MLX5E_ACCEL_FS_ESP_FT_ERR_LEVEL,
194206
MLX5E_NIC_PRIO, 1);
195-
if (IS_ERR(ft))
196-
return PTR_ERR(ft);
207+
if (IS_ERR(ft)) {
208+
err = PTR_ERR(ft);
209+
goto err_fs_ft_status;
210+
}
197211

198212
rx->ft.status = ft;
199213

200-
dest[0] = mlx5_ttc_get_default_dest(ttc, family2tt(family));
214+
ft = mlx5_ipsec_fs_roce_ft_get(ipsec->roce, family);
215+
if (ft) {
216+
dest[0].type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE;
217+
dest[0].ft = ft;
218+
} else {
219+
dest[0] = default_dest;
220+
}
221+
201222
dest[1].type = MLX5_FLOW_DESTINATION_TYPE_COUNTER;
202223
dest[1].counter_id = mlx5_fc_id(rx->fc->cnt);
203224
err = ipsec_status_rule(mdev, rx, dest);
@@ -245,6 +266,8 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,
245266
mlx5_modify_header_dealloc(mdev, rx->status.modify_hdr);
246267
err_add:
247268
mlx5_destroy_flow_table(rx->ft.status);
269+
err_fs_ft_status:
270+
mlx5_ipsec_fs_roce_rx_destroy(ipsec->roce, family);
248271
return err;
249272
}
250273

@@ -304,7 +327,7 @@ static void rx_ft_put(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,
304327
mlx5_ttc_fwd_default_dest(ttc, family2tt(family));
305328

306329
/* remove FT */
307-
rx_destroy(mdev, rx);
330+
rx_destroy(mdev, ipsec, rx, family);
308331

309332
out:
310333
mutex_unlock(&rx->ft.mutex);
@@ -1008,6 +1031,9 @@ void mlx5e_accel_ipsec_fs_cleanup(struct mlx5e_ipsec *ipsec)
10081031
if (!ipsec->tx)
10091032
return;
10101033

1034+
if (mlx5_ipsec_device_caps(ipsec->mdev) & MLX5_IPSEC_CAP_ROCE)
1035+
mlx5_ipsec_fs_roce_cleanup(ipsec->roce);
1036+
10111037
ipsec_fs_destroy_counters(ipsec);
10121038
mutex_destroy(&ipsec->tx->ft.mutex);
10131039
WARN_ON(ipsec->tx->ft.refcnt);
@@ -1024,6 +1050,7 @@ void mlx5e_accel_ipsec_fs_cleanup(struct mlx5e_ipsec *ipsec)
10241050

10251051
int mlx5e_accel_ipsec_fs_init(struct mlx5e_ipsec *ipsec)
10261052
{
1053+
struct mlx5_core_dev *mdev = ipsec->mdev;
10271054
struct mlx5_flow_namespace *ns;
10281055
int err = -ENOMEM;
10291056

@@ -1053,6 +1080,9 @@ int mlx5e_accel_ipsec_fs_init(struct mlx5e_ipsec *ipsec)
10531080
mutex_init(&ipsec->rx_ipv6->ft.mutex);
10541081
ipsec->tx->ns = ns;
10551082

1083+
if (mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_ROCE)
1084+
ipsec->roce = mlx5_ipsec_fs_roce_init(mdev);
1085+
10561086
return 0;
10571087

10581088
err_counters:

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,10 @@ u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev)
4242
MLX5_CAP_FLOWTABLE_NIC_RX(mdev, decap))
4343
caps |= MLX5_IPSEC_CAP_PACKET_OFFLOAD;
4444

45+
if (mlx5_get_roce_state(mdev) &&
46+
(MLX5_CAP_GEN_2(mdev, flow_table_type_2_type) & MLX5_FT_NIC_RX_2_NIC_RX_RDMA))
47+
caps |= MLX5_IPSEC_CAP_ROCE;
48+
4549
if (!caps)
4650
return 0;
4751

‎drivers/net/ethernet/mellanox/mlx5/core/fs_core.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -111,8 +111,10 @@
111111
#define ETHTOOL_PRIO_NUM_LEVELS 1
112112
#define ETHTOOL_NUM_PRIOS 11
113113
#define ETHTOOL_MIN_LEVEL (KERNEL_MIN_LEVEL + ETHTOOL_NUM_PRIOS)
114-
/* Promiscuous, Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy */
115-
#define KERNEL_NIC_PRIO_NUM_LEVELS 8
114+
/* Promiscuous, Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy,
115+
* IPsec RoCE policy
116+
*/
117+
#define KERNEL_NIC_PRIO_NUM_LEVELS 9
116118
#define KERNEL_NIC_NUM_PRIOS 1
117119
/* One more level for tc */
118120
#define KERNEL_MIN_LEVEL (KERNEL_NIC_PRIO_NUM_LEVELS + 1)

0 commit comments

Comments
 (0)