Commit 348ed4b2 authored by Leon Romanovsky's avatar Leon Romanovsky Committed by Jakub Kicinski
Browse files

net/mlx5e: Separate address related variables to be in struct 



Prepare the code to addition of prefix handling logic which is needed
to support matching logic based on source and/or destination network
prefixes.

Signed-off-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Signed-off-by: default avatarTariq Toukan <tariqt@nvidia.com>
Reviewed-by: default avatarMichal Swiatkowski <michal.swiatkowski@linux.intel.com>
Link: https://patch.msgid.link/20250304160620.417580-6-tariqt@nvidia.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 5aa2e6de

drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c

+17 −15
Original line number Diff line number Diff line
@@ -277,12 +277,12 @@ static void mlx5e_ipsec_init_macs(struct mlx5e_ipsec_sa_entry *sa_entry, 
	case XFRM_DEV_OFFLOAD_IN:

		src = attrs->dmac;

		dst = attrs->smac;

		pkey = &attrs->saddr.a4;

		pkey = &attrs->addrs.saddr.a4;

		break;

	case XFRM_DEV_OFFLOAD_OUT:

		src = attrs->smac;

		dst = attrs->dmac;

		pkey = &attrs->daddr.a4;

		pkey = &attrs->addrs.daddr.a4;

		break;

	default:

		return;
@@ -374,9 +374,10 @@ void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry, 
	attrs->spi = be32_to_cpu(x->id.spi);



	/* source , destination ips */

	memcpy(&attrs->saddr, x->props.saddr.a6, sizeof(attrs->saddr));

	memcpy(&attrs->daddr, x->id.daddr.a6, sizeof(attrs->daddr));

	attrs->family = x->props.family;

	memcpy(&attrs->addrs.saddr, x->props.saddr.a6,

	       sizeof(attrs->addrs.saddr));

	memcpy(&attrs->addrs.daddr, x->id.daddr.a6, sizeof(attrs->addrs.daddr));

	attrs->addrs.family = x->props.family;

	attrs->type = x->xso.type;

	attrs->reqid = x->props.reqid;

	attrs->upspec.dport = ntohs(x->sel.dport);
@@ -428,7 +429,8 @@ static int mlx5e_xfrm_validate_state(struct mlx5_core_dev *mdev, 
	}

	if (x->encap) {

		if (!(mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_ESPINUDP)) {

			NL_SET_ERR_MSG_MOD(extack, "Encapsulation is not supported");

			NL_SET_ERR_MSG_MOD(extack,

					   "Encapsulation is not supported");

			return -EINVAL;

		}
@@ -853,13 +855,13 @@ static int mlx5e_ipsec_netevent_event(struct notifier_block *nb, 
	xa_for_each_marked(&ipsec->sadb, idx, sa_entry, MLX5E_IPSEC_TUNNEL_SA) {

		attrs = &sa_entry->attrs;



		if (attrs->family == AF_INET) {

			if (!neigh_key_eq32(n, &attrs->saddr.a4) &&

			    !neigh_key_eq32(n, &attrs->daddr.a4))

		if (attrs->addrs.family == AF_INET) {

			if (!neigh_key_eq32(n, &attrs->addrs.saddr.a4) &&

			    !neigh_key_eq32(n, &attrs->addrs.daddr.a4))

				continue;

		} else {

			if (!neigh_key_eq128(n, &attrs->saddr.a4) &&

			    !neigh_key_eq128(n, &attrs->daddr.a4))

			if (!neigh_key_eq128(n, &attrs->addrs.saddr.a4) &&

			    !neigh_key_eq128(n, &attrs->addrs.daddr.a4))

				continue;

		}
@@ -1035,7 +1037,7 @@ static void mlx5e_xfrm_update_stats(struct xfrm_state *x) 
	 * by removing always available headers.

	 */

	headers = sizeof(struct ethhdr);

	if (sa_entry->attrs.family == AF_INET)

	if (sa_entry->attrs.addrs.family == AF_INET)

		headers += sizeof(struct iphdr);

	else

		headers += sizeof(struct ipv6hdr);
@@ -1116,9 +1118,9 @@ mlx5e_ipsec_build_accel_pol_attrs(struct mlx5e_ipsec_pol_entry *pol_entry, 
	sel = &x->selector;

	memset(attrs, 0, sizeof(*attrs));



	memcpy(&attrs->saddr, sel->saddr.a6, sizeof(attrs->saddr));

	memcpy(&attrs->daddr, sel->daddr.a6, sizeof(attrs->daddr));

	attrs->family = sel->family;

	memcpy(&attrs->addrs.saddr, sel->saddr.a6, sizeof(attrs->addrs.saddr));

	memcpy(&attrs->addrs.daddr, sel->daddr.a6, sizeof(attrs->addrs.daddr));

	attrs->addrs.family = sel->family;

	attrs->dir = x->xdo.dir;

	attrs->action = x->action;

	attrs->type = XFRM_DEV_OFFLOAD_PACKET;

drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h

+9 −17
Original line number Diff line number Diff line
@@ -76,11 +76,7 @@ struct mlx5_replay_esn { 
	u8 trigger : 1;

};



struct mlx5_accel_esp_xfrm_attrs {

	u32   spi;

	u32   mode;

	struct aes_gcm_keymat aes_gcm;



struct mlx5e_ipsec_addr {

	union {

		__be32 a4;

		__be32 a6[4];
@@ -90,13 +86,19 @@ struct mlx5_accel_esp_xfrm_attrs { 
		__be32 a4;

		__be32 a6[4];

	} daddr;

	u8 family;

};



struct mlx5_accel_esp_xfrm_attrs {

	u32   spi;

	u32   mode;

	struct aes_gcm_keymat aes_gcm;

	struct mlx5e_ipsec_addr addrs;

	struct upspec upspec;

	u8 dir : 2;

	u8 type : 2;

	u8 drop : 1;

	u8 encap : 1;

	u8 family;

	struct mlx5_replay_esn replay_esn;

	u32 authsize;

	u32 reqid;
@@ -279,18 +281,8 @@ struct mlx5e_ipsec_sa_entry { 
};



struct mlx5_accel_pol_xfrm_attrs {

	union {

		__be32 a4;

		__be32 a6[4];

	} saddr;



	union {

		__be32 a4;

		__be32 a6[4];

	} daddr;



	struct mlx5e_ipsec_addr addrs;

	struct upspec upspec;

	u8 family;

	u8 action;

	u8 type : 2;

	u8 dir : 2;

drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c

+42 −33
Original line number Diff line number Diff line
@@ -1484,9 +1484,12 @@ static void tx_ft_put_policy(struct mlx5e_ipsec *ipsec, u32 prio, int type) 
	mutex_unlock(&tx->ft.mutex);

}



static void setup_fte_addr4(struct mlx5_flow_spec *spec, __be32 *saddr,

			    __be32 *daddr)

static void setup_fte_addr4(struct mlx5_flow_spec *spec,

			    struct mlx5e_ipsec_addr *addrs)

{

	__be32 *saddr = &addrs->saddr.a4;

	__be32 *daddr = &addrs->daddr.a4;



	if (!*saddr && !*daddr)

		return;
@@ -1510,9 +1513,12 @@ static void setup_fte_addr4(struct mlx5_flow_spec *spec, __be32 *saddr, 
	}

}



static void setup_fte_addr6(struct mlx5_flow_spec *spec, __be32 *saddr,

			    __be32 *daddr)

static void setup_fte_addr6(struct mlx5_flow_spec *spec,

			    struct mlx5e_ipsec_addr *addrs)

{

	__be32 *saddr = addrs->saddr.a6;

	__be32 *daddr = addrs->daddr.a6;



	if (addr6_all_zero(saddr) && addr6_all_zero(daddr))

		return;
@@ -1722,7 +1728,7 @@ setup_pkt_tunnel_reformat(struct mlx5_core_dev *mdev, 
	if (attrs->dir == XFRM_DEV_OFFLOAD_OUT) {

		bfflen += sizeof(*esp_hdr) + 8;



		switch (attrs->family) {

		switch (attrs->addrs.family) {

		case AF_INET:

			bfflen += sizeof(*iphdr);

			break;
@@ -1739,7 +1745,7 @@ setup_pkt_tunnel_reformat(struct mlx5_core_dev *mdev, 
		return -ENOMEM;



	eth_hdr = (struct ethhdr *)reformatbf;

	switch (attrs->family) {

	switch (attrs->addrs.family) {

	case AF_INET:

		eth_hdr->h_proto = htons(ETH_P_IP);

		break;
@@ -1762,11 +1768,11 @@ setup_pkt_tunnel_reformat(struct mlx5_core_dev *mdev, 
		reformat_params->param_0 = attrs->authsize;



		hdr = reformatbf + sizeof(*eth_hdr);

		switch (attrs->family) {

		switch (attrs->addrs.family) {

		case AF_INET:

			iphdr = (struct iphdr *)hdr;

			memcpy(&iphdr->saddr, &attrs->saddr.a4, 4);

			memcpy(&iphdr->daddr, &attrs->daddr.a4, 4);

			memcpy(&iphdr->saddr, &attrs->addrs.saddr.a4, 4);

			memcpy(&iphdr->daddr, &attrs->addrs.daddr.a4, 4);

			iphdr->version = 4;

			iphdr->ihl = 5;

			iphdr->ttl = IPSEC_TUNNEL_DEFAULT_TTL;
@@ -1775,8 +1781,8 @@ setup_pkt_tunnel_reformat(struct mlx5_core_dev *mdev, 
			break;

		case AF_INET6:

			ipv6hdr = (struct ipv6hdr *)hdr;

			memcpy(&ipv6hdr->saddr, &attrs->saddr.a6, 16);

			memcpy(&ipv6hdr->daddr, &attrs->daddr.a6, 16);

			memcpy(&ipv6hdr->saddr, &attrs->addrs.saddr.a6, 16);

			memcpy(&ipv6hdr->daddr, &attrs->addrs.daddr.a6, 16);

			ipv6hdr->nexthdr = IPPROTO_ESP;

			ipv6hdr->version = 6;

			ipv6hdr->hop_limit = IPSEC_TUNNEL_DEFAULT_TTL;
@@ -1810,7 +1816,7 @@ static int get_reformat_type(struct mlx5_accel_esp_xfrm_attrs *attrs) 
			return MLX5_REFORMAT_TYPE_DEL_ESP_TRANSPORT_OVER_UDP;

		return MLX5_REFORMAT_TYPE_DEL_ESP_TRANSPORT;

	case XFRM_DEV_OFFLOAD_OUT:

		if (attrs->family == AF_INET) {

		if (attrs->addrs.family == AF_INET) {

			if (attrs->encap)

				return MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_UDPV4;

			return MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV4;
@@ -2003,7 +2009,7 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) 
	struct mlx5_fc *counter;

	int err = 0;



	rx = rx_ft_get(mdev, ipsec, attrs->family, attrs->type);

	rx = rx_ft_get(mdev, ipsec, attrs->addrs.family, attrs->type);

	if (IS_ERR(rx))

		return PTR_ERR(rx);
@@ -2013,10 +2019,10 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) 
		goto err_alloc;

	}



	if (attrs->family == AF_INET)

		setup_fte_addr4(spec, &attrs->saddr.a4, &attrs->daddr.a4);

	if (attrs->addrs.family == AF_INET)

		setup_fte_addr4(spec, &attrs->addrs);

	else

		setup_fte_addr6(spec, attrs->saddr.a6, attrs->daddr.a6);

		setup_fte_addr6(spec, &attrs->addrs);



	setup_fte_spi(spec, attrs->spi, attrs->encap);

	if (!attrs->encap)
@@ -2116,7 +2122,7 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) 
err_mod_header:

	kvfree(spec);

err_alloc:

	rx_ft_put(ipsec, attrs->family, attrs->type);

	rx_ft_put(ipsec, attrs->addrs.family, attrs->type);

	return err;

}
@@ -2148,10 +2154,10 @@ static int tx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) 


	switch (attrs->type) {

	case XFRM_DEV_OFFLOAD_CRYPTO:

		if (attrs->family == AF_INET)

			setup_fte_addr4(spec, &attrs->saddr.a4, &attrs->daddr.a4);

		if (attrs->addrs.family == AF_INET)

			setup_fte_addr4(spec, &attrs->addrs);

		else

			setup_fte_addr6(spec, attrs->saddr.a6, attrs->daddr.a6);

			setup_fte_addr6(spec, &attrs->addrs);

		setup_fte_spi(spec, attrs->spi, false);

		setup_fte_esp(spec);

		setup_fte_reg_a(spec);
@@ -2235,10 +2241,10 @@ static int tx_add_policy(struct mlx5e_ipsec_pol_entry *pol_entry) 
	}



	tx = ipsec_tx(ipsec, attrs->type);

	if (attrs->family == AF_INET)

		setup_fte_addr4(spec, &attrs->saddr.a4, &attrs->daddr.a4);

	if (attrs->addrs.family == AF_INET)

		setup_fte_addr4(spec, &attrs->addrs);

	else

		setup_fte_addr6(spec, attrs->saddr.a6, attrs->daddr.a6);

		setup_fte_addr6(spec, &attrs->addrs);



	setup_fte_no_frags(spec);

	setup_fte_upper_proto_match(spec, &attrs->upspec);
@@ -2308,12 +2314,12 @@ static int rx_add_policy(struct mlx5e_ipsec_pol_entry *pol_entry) 
	struct mlx5e_ipsec_rx *rx;

	int err, dstn = 0;



	ft = rx_ft_get_policy(mdev, pol_entry->ipsec, attrs->family, attrs->prio,

			      attrs->type);

	ft = rx_ft_get_policy(mdev, pol_entry->ipsec, attrs->addrs.family,

			      attrs->prio, attrs->type);

	if (IS_ERR(ft))

		return PTR_ERR(ft);



	rx = ipsec_rx(pol_entry->ipsec, attrs->family, attrs->type);

	rx = ipsec_rx(pol_entry->ipsec, attrs->addrs.family, attrs->type);



	spec = kvzalloc(sizeof(*spec), GFP_KERNEL);

	if (!spec) {
@@ -2321,10 +2327,10 @@ static int rx_add_policy(struct mlx5e_ipsec_pol_entry *pol_entry) 
		goto err_alloc;

	}



	if (attrs->family == AF_INET)

		setup_fte_addr4(spec, &attrs->saddr.a4, &attrs->daddr.a4);

	if (attrs->addrs.family == AF_INET)

		setup_fte_addr4(spec, &attrs->addrs);

	else

		setup_fte_addr6(spec, attrs->saddr.a6, attrs->daddr.a6);

		setup_fte_addr6(spec, &attrs->addrs);



	setup_fte_no_frags(spec);

	setup_fte_upper_proto_match(spec, &attrs->upspec);
@@ -2364,7 +2370,8 @@ static int rx_add_policy(struct mlx5e_ipsec_pol_entry *pol_entry) 
err_action:

	kvfree(spec);

err_alloc:

	rx_ft_put_policy(pol_entry->ipsec, attrs->family, attrs->prio, attrs->type);

	rx_ft_put_policy(pol_entry->ipsec, attrs->addrs.family, attrs->prio,

			 attrs->type);

	return err;

}
@@ -2638,7 +2645,8 @@ void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_ipsec_sa_entry *sa_entry) 
		mlx5_fc_destroy(mdev, ipsec_rule->replay.fc);

	}

	mlx5_esw_ipsec_rx_id_mapping_remove(sa_entry);

	rx_ft_put(sa_entry->ipsec, sa_entry->attrs.family, sa_entry->attrs.type);

	rx_ft_put(sa_entry->ipsec, sa_entry->attrs.addrs.family,

		  sa_entry->attrs.type);

}



int mlx5e_accel_ipsec_fs_add_pol(struct mlx5e_ipsec_pol_entry *pol_entry)
@@ -2674,7 +2682,8 @@ void mlx5e_accel_ipsec_fs_del_pol(struct mlx5e_ipsec_pol_entry *pol_entry) 
	mlx5e_ipsec_unblock_tc_offload(pol_entry->ipsec->mdev);



	if (pol_entry->attrs.dir == XFRM_DEV_OFFLOAD_IN) {

		rx_ft_put_policy(pol_entry->ipsec, pol_entry->attrs.family,

		rx_ft_put_policy(pol_entry->ipsec,

				 pol_entry->attrs.addrs.family,

				 pol_entry->attrs.prio, pol_entry->attrs.type);

		return;

	}
@@ -2814,7 +2823,7 @@ bool mlx5e_ipsec_fs_tunnel_enabled(struct mlx5e_ipsec_sa_entry *sa_entry) 
	struct mlx5e_ipsec_rx *rx;

	struct mlx5e_ipsec_tx *tx;



	rx = ipsec_rx(sa_entry->ipsec, attrs->family, attrs->type);

	rx = ipsec_rx(sa_entry->ipsec, attrs->addrs.family, attrs->type);

	tx = ipsec_tx(sa_entry->ipsec, attrs->type);

	if (sa_entry->attrs.dir == XFRM_DEV_OFFLOAD_OUT)

		return tx->allow_tunnel_mode;