Commit cc18f482 authored by Leon Romanovsky's avatar Leon Romanovsky Committed by Steffen Klassert
Browse files

xfrm: provide common xdo_dev_offload_ok callback implementation 



Almost all drivers except bond and nsim had same check if device
can perform XFRM offload on that specific packet. The check was that
packet doesn't have IPv4 options and IPv6 extensions.

In NIC drivers, the IPv4 HELEN comparison was slightly different, but
the intent was to check for the same conditions. So let's chose more
strict variant as a common base.

Reviewed-by: default avatarZhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 49431af6

Documentation/networking/xfrm_device.rst

+2 −1
Original line number Diff line number Diff line
@@ -126,7 +126,8 @@ been setup for offload, it first calls into xdo_dev_offload_ok() with 
the skb and the intended offload state to ask the driver if the offload

will serviceable.  This can check the packet information to be sure the

offload can be supported (e.g. IPv4 or IPv6, no IPv4 options, etc) and

return true of false to signify its support.

return true or false to signify its support. In case driver doesn't implement

this callback, the stack provides reasonable defaults.



Crypto offload mode:

When ready to send, the driver needs to inspect the Tx packet for the

drivers/net/bonding/bond_main.c

+5 −11
Original line number Diff line number Diff line
@@ -673,22 +673,16 @@ static void bond_ipsec_free_sa(struct xfrm_state *xs) 
static bool bond_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs)

{

	struct net_device *real_dev;

	bool ok = false;



	rcu_read_lock();

	real_dev = bond_ipsec_dev(xs);

	if (!real_dev)

		goto out;



	if (!real_dev->xfrmdev_ops ||

	    !real_dev->xfrmdev_ops->xdo_dev_offload_ok ||

	    netif_is_bond_master(real_dev))

		goto out;

	if (!real_dev || netif_is_bond_master(real_dev)) {

		rcu_read_unlock();

		return false;

	}



	ok = real_dev->xfrmdev_ops->xdo_dev_offload_ok(skb, xs);

out:

	rcu_read_unlock();

	return ok;

	return true;

}



/**

drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c

+0 −21
Original line number Diff line number Diff line
@@ -6538,26 +6538,6 @@ static void cxgb4_xfrm_free_state(struct xfrm_state *x) 
	mutex_unlock(&uld_mutex);

}



static bool cxgb4_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *x)

{

	struct adapter *adap = netdev2adap(x->xso.dev);

	bool ret = false;



	if (!mutex_trylock(&uld_mutex)) {

		dev_dbg(adap->pdev_dev,

			"crypto uld critical resource is under use\n");

		return ret;

	}

	if (chcr_offload_state(adap, CXGB4_XFRMDEV_OPS))

		goto out_unlock;



	ret = adap->uld[CXGB4_ULD_IPSEC].xfrmdev_ops->xdo_dev_offload_ok(skb, x);



out_unlock:

	mutex_unlock(&uld_mutex);

	return ret;

}



static void cxgb4_advance_esn_state(struct xfrm_state *x)

{

	struct adapter *adap = netdev2adap(x->xso.dev);
@@ -6583,7 +6563,6 @@ static const struct xfrmdev_ops cxgb4_xfrmdev_ops = { 
	.xdo_dev_state_add      = cxgb4_xfrm_add_state,

	.xdo_dev_state_delete   = cxgb4_xfrm_del_state,

	.xdo_dev_state_free     = cxgb4_xfrm_free_state,

	.xdo_dev_offload_ok     = cxgb4_ipsec_offload_ok,

	.xdo_dev_state_advance_esn = cxgb4_advance_esn_state,

};

drivers/net/ethernet/chelsio/inline_crypto/ch_ipsec/chcr_ipsec.c

+0 −16
Original line number Diff line number Diff line
@@ -71,7 +71,6 @@ 
static LIST_HEAD(uld_ctx_list);

static DEFINE_MUTEX(dev_mutex);



static bool ch_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *x);

static int ch_ipsec_uld_state_change(void *handle, enum cxgb4_state new_state);

static int ch_ipsec_xmit(struct sk_buff *skb, struct net_device *dev);

static void *ch_ipsec_uld_add(const struct cxgb4_lld_info *infop);
@@ -85,7 +84,6 @@ static const struct xfrmdev_ops ch_ipsec_xfrmdev_ops = { 
	.xdo_dev_state_add      = ch_ipsec_xfrm_add_state,

	.xdo_dev_state_delete   = ch_ipsec_xfrm_del_state,

	.xdo_dev_state_free     = ch_ipsec_xfrm_free_state,

	.xdo_dev_offload_ok     = ch_ipsec_offload_ok,

	.xdo_dev_state_advance_esn = ch_ipsec_advance_esn_state,

};
@@ -323,20 +321,6 @@ static void ch_ipsec_xfrm_free_state(struct xfrm_state *x) 
	module_put(THIS_MODULE);

}



static bool ch_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *x)

{

	if (x->props.family == AF_INET) {

		/* Offload with IP options is not supported yet */

		if (ip_hdr(skb)->ihl > 5)

			return false;

	} else {

		/* Offload with IPv6 extension headers is not support yet */

		if (ipv6_ext_hdr(ipv6_hdr(skb)->nexthdr))

			return false;

	}

	return true;

}



static void ch_ipsec_advance_esn_state(struct xfrm_state *x)

{

	/* do nothing */

drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c

+0 −21
Original line number Diff line number Diff line
@@ -817,30 +817,9 @@ static void ixgbe_ipsec_del_sa(struct xfrm_state *xs) 
	}

}



/**

 * ixgbe_ipsec_offload_ok - can this packet use the xfrm hw offload

 * @skb: current data packet

 * @xs: pointer to transformer state struct

 **/

static bool ixgbe_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs)

{

	if (xs->props.family == AF_INET) {

		/* Offload with IPv4 options is not supported yet */

		if (ip_hdr(skb)->ihl != 5)

			return false;

	} else {

		/* Offload with IPv6 extension headers is not support yet */

		if (ipv6_ext_hdr(ipv6_hdr(skb)->nexthdr))

			return false;

	}



	return true;

}



static const struct xfrmdev_ops ixgbe_xfrmdev_ops = {

	.xdo_dev_state_add = ixgbe_ipsec_add_sa,

	.xdo_dev_state_delete = ixgbe_ipsec_del_sa,

	.xdo_dev_offload_ok = ixgbe_ipsec_offload_ok,

};



/**