net/mlx5e: Create IPsec policy offload tables

Add empty table to be used for IPsec policy offload.

Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h
index bf2741eb7f9b7527f075ce1388303d1ae358fd89..379c6dc9a3be6bd0fc5026c25161374391874caf 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h
@@ -84,7 +84,8 @@ enum {
        MLX5E_ARFS_FT_LEVEL = MLX5E_INNER_TTC_FT_LEVEL + 1,
 #endif
 #ifdef CONFIG_MLX5_EN_IPSEC
-       MLX5E_ACCEL_FS_ESP_FT_LEVEL = MLX5E_INNER_TTC_FT_LEVEL + 1,
+       MLX5E_ACCEL_FS_POL_FT_LEVEL = MLX5E_INNER_TTC_FT_LEVEL + 1,
+       MLX5E_ACCEL_FS_ESP_FT_LEVEL,
        MLX5E_ACCEL_FS_ESP_FT_ERR_LEVEL,
 #endif
 };

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
index 5bc6f9d1f5a618044e08335fd258515c3ed598ce..a3c7d0f142c02a6cc9d31ff66f5edb822f3ca6c1 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
@@ -11,6 +11,7 @@
 
 struct mlx5e_ipsec_ft {
        struct mutex mutex; /* Protect changes to this struct */
+       struct mlx5_flow_table *pol;
        struct mlx5_flow_table *sa;
        struct mlx5_flow_table *status;
        u32 refcnt;
@@ -23,12 +24,14 @@ struct mlx5e_ipsec_miss {
 
 struct mlx5e_ipsec_rx {
        struct mlx5e_ipsec_ft ft;
+       struct mlx5e_ipsec_miss pol;
        struct mlx5e_ipsec_miss sa;
        struct mlx5e_ipsec_rule status;
 };
 
 struct mlx5e_ipsec_tx {
        struct mlx5e_ipsec_ft ft;
+       struct mlx5e_ipsec_miss pol;
        struct mlx5_flow_namespace *ns;
 };
 
@@ -157,6 +160,10 @@ out:
 
 static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_rx *rx)
 {
+       mlx5_del_flow_rules(rx->pol.rule);
+       mlx5_destroy_flow_group(rx->pol.group);
+       mlx5_destroy_flow_table(rx->ft.pol);
+
        mlx5_del_flow_rules(rx->sa.rule);
        mlx5_destroy_flow_group(rx->sa.group);
        mlx5_destroy_flow_table(rx->ft.sa);
@@ -200,8 +207,27 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,
        if (err)
                goto err_fs;
 
+       ft = ipsec_ft_create(ns, MLX5E_ACCEL_FS_POL_FT_LEVEL, MLX5E_NIC_PRIO,
+                            1);
+       if (IS_ERR(ft)) {
+               err = PTR_ERR(ft);
+               goto err_pol_ft;
+       }
+       rx->ft.pol = ft;
+       memset(&dest, 0x00, sizeof(dest));
+       dest.type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE;
+       dest.ft = rx->ft.sa;
+       err = ipsec_miss_create(mdev, rx->ft.pol, &rx->pol, &dest);
+       if (err)
+               goto err_pol_miss;
+
        return 0;
 
+err_pol_miss:
+       mlx5_destroy_flow_table(rx->ft.pol);
+err_pol_ft:
+       mlx5_del_flow_rules(rx->sa.rule);
+       mlx5_destroy_flow_group(rx->sa.group);
 err_fs:
        mlx5_destroy_flow_table(rx->ft.sa);
 err_fs_ft:
@@ -236,7 +262,7 @@ static struct mlx5e_ipsec_rx *rx_ft_get(struct mlx5_core_dev *mdev,
 
        /* connect */
        dest.type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE;
-       dest.ft = rx->ft.sa;
+       dest.ft = rx->ft.pol;
        mlx5_ttc_fwd_dest(ttc, family2tt(family), &dest);
 
 skip:
@@ -277,14 +303,34 @@ out:
 /* IPsec TX flow steering */
 static int tx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_tx *tx)
 {
+       struct mlx5_flow_destination dest = {};
        struct mlx5_flow_table *ft;
+       int err;
 
-       ft = ipsec_ft_create(tx->ns, 0, 0, 1);
+       ft = ipsec_ft_create(tx->ns, 1, 0, 1);
        if (IS_ERR(ft))
                return PTR_ERR(ft);
 
        tx->ft.sa = ft;
+
+       ft = ipsec_ft_create(tx->ns, 0, 0, 1);
+       if (IS_ERR(ft)) {
+               err = PTR_ERR(ft);
+               goto err_pol_ft;
+       }
+       tx->ft.pol = ft;
+       dest.type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE;
+       dest.ft = tx->ft.sa;
+       err = ipsec_miss_create(mdev, tx->ft.pol, &tx->pol, &dest);
+       if (err)
+               goto err_pol_miss;
        return 0;
+
+err_pol_miss:
+       mlx5_destroy_flow_table(tx->ft.pol);
+err_pol_ft:
+       mlx5_destroy_flow_table(tx->ft.sa);
+       return err;
 }
 
 static struct mlx5e_ipsec_tx *tx_ft_get(struct mlx5_core_dev *mdev,
@@ -318,6 +364,9 @@ static void tx_ft_put(struct mlx5e_ipsec *ipsec)
        if (tx->ft.refcnt)
                goto out;
 
+       mlx5_del_flow_rules(tx->pol.rule);
+       mlx5_destroy_flow_group(tx->pol.group);
+       mlx5_destroy_flow_table(tx->ft.pol);
        mlx5_destroy_flow_table(tx->ft.sa);
 out:
        mutex_unlock(&tx->ft.mutex);

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index d53749248fa09404cc6696213bc770962b83be5c..9995307d374b61533f4d74358a628e8f57530e62 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -111,8 +111,8 @@
 #define ETHTOOL_PRIO_NUM_LEVELS 1
 #define ETHTOOL_NUM_PRIOS 11
 #define ETHTOOL_MIN_LEVEL (KERNEL_MIN_LEVEL + ETHTOOL_NUM_PRIOS)
-/* Promiscuous, Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}} */
-#define KERNEL_NIC_PRIO_NUM_LEVELS 7
+/* Promiscuous, Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy */
+#define KERNEL_NIC_PRIO_NUM_LEVELS 8
 #define KERNEL_NIC_NUM_PRIOS 1
 /* One more level for tc */
 #define KERNEL_MIN_LEVEL (KERNEL_NIC_PRIO_NUM_LEVELS + 1)
@@ -133,7 +133,7 @@
 #define LAG_MIN_LEVEL (OFFLOADS_MIN_LEVEL + KERNEL_RX_MACSEC_MIN_LEVEL + 1)
 
 #define KERNEL_TX_IPSEC_NUM_PRIOS  1
-#define KERNEL_TX_IPSEC_NUM_LEVELS 1
+#define KERNEL_TX_IPSEC_NUM_LEVELS 2
 #define KERNEL_TX_IPSEC_MIN_LEVEL        (KERNEL_TX_IPSEC_NUM_LEVELS)
 
 #define KERNEL_TX_MACSEC_NUM_PRIOS  1