Commit ed42b2bc authored by Paolo Abeni's avatar Paolo Abeni
Browse files

Merge branch 'bonding-support-new-xfrm-state-offload-functions' 

Hangbin Liu says:

====================
Bonding: support new xfrm state offload functions

Add 2 new xfrm state offload functions xdo_dev_state_advance_esn and
xdo_dev_state_update_stats for bonding. The xdo_dev_state_free will be
added by Jianbo's patchset [1]. I will add the bonding xfrm policy offload
in future.

v7: no update, just rebase the code.
v6: Use "Return: " based on ./scripts/kernel-doc (Simon Horman)
v5: Rebase to latest net-next, update function doc (Jakub Kicinski)
v4: Ratelimit pr_warn (Sabrina Dubroca)
v3: Re-format bond_ipsec_dev, use slave_warn instead of WARN_ON (Nikolay Aleksandrov)
    Fix bond_ipsec_dev defination, add *. (Simon Horman, kernel test robot)
    Fix "real" typo (kernel test robot)
v2: Add a function to process the common device checking (Nikolay Aleksandrov)
    Remove unused variable (Simon Horman)
v1: lore.kernel.org/netdev/20240816035518.203704-1-liuhangbin@gmail.com
====================

Link: https://patch.msgid.link/20240904003457.3847086-1-liuhangbin@gmail.com


Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parents d2095989 68db604e

drivers/net/bonding/bond_main.c

+87 −13
Original line number Diff line number Diff line
@@ -418,6 +418,41 @@ static int bond_vlan_rx_kill_vid(struct net_device *bond_dev, 
/*---------------------------------- XFRM -----------------------------------*/



#ifdef CONFIG_XFRM_OFFLOAD

/**

 * bond_ipsec_dev - Get active device for IPsec offload

 * @xs: pointer to transformer state struct

 *

 * Context: caller must hold rcu_read_lock.

 *

 * Return: the device for ipsec offload, or NULL if not exist.

 **/

static struct net_device *bond_ipsec_dev(struct xfrm_state *xs)

{

	struct net_device *bond_dev = xs->xso.dev;

	struct bonding *bond;

	struct slave *slave;



	if (!bond_dev)

		return NULL;



	bond = netdev_priv(bond_dev);

	if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP)

		return NULL;



	slave = rcu_dereference(bond->curr_active_slave);

	if (!slave)

		return NULL;



	if (!xs->xso.real_dev)

		return NULL;



	if (xs->xso.real_dev != slave->dev)

		pr_warn_ratelimited("%s: (slave %s): not same with IPsec offload real dev %s\n",

				    bond_dev->name, slave->dev->name, xs->xso.real_dev->name);



	return slave->dev;

}



/**

 * bond_ipsec_add_sa - program device with a security association

 * @xs: pointer to transformer state struct
@@ -640,23 +675,12 @@ static void bond_ipsec_free_sa(struct xfrm_state *xs) 
 **/

static bool bond_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs)

{

	struct net_device *bond_dev = xs->xso.dev;

	struct net_device *real_dev;

	struct slave *curr_active;

	struct bonding *bond;

	bool ok = false;



	bond = netdev_priv(bond_dev);

	rcu_read_lock();

	curr_active = rcu_dereference(bond->curr_active_slave);

	if (!curr_active)

		goto out;

	real_dev = curr_active->dev;



	if (BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP)

		goto out;



	if (!xs->xso.real_dev)

	real_dev = bond_ipsec_dev(xs);

	if (!real_dev)

		goto out;



	if (!real_dev->xfrmdev_ops ||
@@ -670,11 +694,61 @@ static bool bond_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs) 
	return ok;

}



/**

 * bond_advance_esn_state - ESN support for IPSec HW offload

 * @xs: pointer to transformer state struct

 **/

static void bond_advance_esn_state(struct xfrm_state *xs)

{

	struct net_device *real_dev;



	rcu_read_lock();

	real_dev = bond_ipsec_dev(xs);

	if (!real_dev)

		goto out;



	if (!real_dev->xfrmdev_ops ||

	    !real_dev->xfrmdev_ops->xdo_dev_state_advance_esn) {

		pr_warn_ratelimited("%s: %s doesn't support xdo_dev_state_advance_esn\n", __func__, real_dev->name);

		goto out;

	}



	real_dev->xfrmdev_ops->xdo_dev_state_advance_esn(xs);

out:

	rcu_read_unlock();

}



/**

 * bond_xfrm_update_stats - Update xfrm state

 * @xs: pointer to transformer state struct

 **/

static void bond_xfrm_update_stats(struct xfrm_state *xs)

{

	struct net_device *real_dev;



	rcu_read_lock();

	real_dev = bond_ipsec_dev(xs);

	if (!real_dev)

		goto out;



	if (!real_dev->xfrmdev_ops ||

	    !real_dev->xfrmdev_ops->xdo_dev_state_update_stats) {

		pr_warn_ratelimited("%s: %s doesn't support xdo_dev_state_update_stats\n", __func__, real_dev->name);

		goto out;

	}



	real_dev->xfrmdev_ops->xdo_dev_state_update_stats(xs);

out:

	rcu_read_unlock();

}



static const struct xfrmdev_ops bond_xfrmdev_ops = {

	.xdo_dev_state_add = bond_ipsec_add_sa,

	.xdo_dev_state_delete = bond_ipsec_del_sa,

	.xdo_dev_state_free = bond_ipsec_free_sa,

	.xdo_dev_offload_ok = bond_ipsec_offload_ok,

	.xdo_dev_state_advance_esn = bond_advance_esn_state,

	.xdo_dev_state_update_stats = bond_xfrm_update_stats,

};

#endif /* CONFIG_XFRM_OFFLOAD */