* [PATCH net-next v2 0/3] nfp: IPsec offload support
@ 2022-09-27 10:27 Simon Horman
2022-09-27 10:27 ` [PATCH net-next v2 1/3] nfp: extend capability and control words Simon Horman
` (3 more replies)
0 siblings, 4 replies; 12+ messages in thread
From: Simon Horman @ 2022-09-27 10:27 UTC (permalink / raw)
To: David Miller, Jakub Kicinski, Paolo Abeni
Cc: netdev, oss-drivers, Leon Romanovsky, Huanhuan Wang
Huanhuan Wang says:
this short series is support IPsec offload for the NFP driver.
It covers three enhancements:
1. Patches 1/3:
- Extend the capability word and control word to to support
new features.
2. Patch 2/3:
- Add framework to support IPsec offloading for NFP driver,
but IPsec offload control plane interface xfrm callbacks which
interact with upper layer are not implemented in this patch.
3. Patch 3/3:
- IPsec control plane interface xfrm callbacks are implemented
in this patch.
Changes since v1
* Explicitly return failure when XFRM_STATE_ESN is set
* Fix the issue that AEAD algorithm is not correctly offloaded
Huanhuan Wang (2):
nfp: add framework to support ipsec offloading
nfp: implement xfrm callbacks and expose ipsec offload feature to
upper layer
Yinjun Zhang (1):
nfp: extend capability and control words
drivers/net/ethernet/netronome/Kconfig | 11 +
drivers/net/ethernet/netronome/nfp/Makefile | 6 +
.../ethernet/netronome/nfp/crypto/crypto.h | 35 +
.../net/ethernet/netronome/nfp/crypto/ipsec.c | 774 ++++++++++++++++++
drivers/net/ethernet/netronome/nfp/nfd3/dp.c | 43 +-
.../net/ethernet/netronome/nfp/nfd3/ipsec.c | 19 +
.../net/ethernet/netronome/nfp/nfd3/nfd3.h | 8 +
drivers/net/ethernet/netronome/nfp/nfp_net.h | 11 +
.../ethernet/netronome/nfp/nfp_net_common.c | 17 +-
.../net/ethernet/netronome/nfp/nfp_net_ctrl.h | 22 +-
10 files changed, 934 insertions(+), 12 deletions(-)
create mode 100644 drivers/net/ethernet/netronome/nfp/crypto/ipsec.c
create mode 100644 drivers/net/ethernet/netronome/nfp/nfd3/ipsec.c
--
2.30.2
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH net-next v2 1/3] nfp: extend capability and control words
2022-09-27 10:27 [PATCH net-next v2 0/3] nfp: IPsec offload support Simon Horman
@ 2022-09-27 10:27 ` Simon Horman
2022-09-27 10:27 ` [PATCH net-next v2 2/3] nfp: add framework to support ipsec offloading Simon Horman
` (2 subsequent siblings)
3 siblings, 0 replies; 12+ messages in thread
From: Simon Horman @ 2022-09-27 10:27 UTC (permalink / raw)
To: David Miller, Jakub Kicinski, Paolo Abeni
Cc: netdev, oss-drivers, Leon Romanovsky, Huanhuan Wang
From: Yinjun Zhang <yinjun.zhang@corigine.com>
Currently the 32-bit capability word is almost exhausted, now
allocate some more words to support new features, and control
word is also extended accordingly. Packet-type offloading is
implemented in NIC application firmware, but it's not used in
kernel driver, so reserve this bit here in case it's redefined
for other use.
Signed-off-by: Yinjun Zhang <yinjun.zhang@corigine.com>
Signed-off-by: Simon Horman <simon.horman@corigine.com>
---
drivers/net/ethernet/netronome/nfp/nfp_net.h | 2 ++
.../net/ethernet/netronome/nfp/nfp_net_common.c | 1 +
drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h | 14 +++++++++++---
3 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net.h b/drivers/net/ethernet/netronome/nfp/nfp_net.h
index a101ff30a1ae..0c3e7e2f856d 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net.h
@@ -541,6 +541,7 @@ struct nfp_net_dp {
* @id: vNIC id within the PF (0 for VFs)
* @fw_ver: Firmware version
* @cap: Capabilities advertised by the Firmware
+ * @cap_w1: Extended capabilities word advertised by the Firmware
* @max_mtu: Maximum support MTU advertised by the Firmware
* @rss_hfunc: RSS selected hash function
* @rss_cfg: RSS configuration
@@ -617,6 +618,7 @@ struct nfp_net {
u32 id;
u32 cap;
+ u32 cap_w1;
u32 max_mtu;
u8 rss_hfunc;
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 469c3939c306..7e4424d626a6 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -2456,6 +2456,7 @@ static int nfp_net_read_caps(struct nfp_net *nn)
{
/* Get some of the read-only fields from the BAR */
nn->cap = nn_readl(nn, NFP_NET_CFG_CAP);
+ nn->cap_w1 = nn_readq(nn, NFP_NET_CFG_CAP_WORD1);
nn->max_mtu = nn_readl(nn, NFP_NET_CFG_MAX_MTU);
/* ABI 4.x and ctrl vNIC always use chained metadata, in other cases
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
index 1d53f721a1c8..80346c1c266b 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
@@ -254,10 +254,18 @@
#define NFP_NET_CFG_BPF_CFG_MASK 7ULL
#define NFP_NET_CFG_BPF_ADDR_MASK (~NFP_NET_CFG_BPF_CFG_MASK)
-/* 40B reserved for future use (0x0098 - 0x00c0)
+/* 3 words reserved for extended ctrl words (0x0098 - 0x00a4)
+ * 3 words reserved for extended cap words (0x00a4 - 0x00b0)
+ * Currently only one word is used, can be extended in future.
*/
-#define NFP_NET_CFG_RESERVED 0x0098
-#define NFP_NET_CFG_RESERVED_SZ 0x0028
+#define NFP_NET_CFG_CTRL_WORD1 0x0098
+#define NFP_NET_CFG_CTRL_PKT_TYPE (0x1 << 0) /* Pkttype offload */
+
+#define NFP_NET_CFG_CAP_WORD1 0x00a4
+
+/* 16B reserved for future use (0x00b0 - 0x00c0) */
+#define NFP_NET_CFG_RESERVED 0x00b0
+#define NFP_NET_CFG_RESERVED_SZ 0x0010
/* RSS configuration (0x0100 - 0x01ac):
* Used only when NFP_NET_CFG_CTRL_RSS is enabled
--
2.30.2
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCH net-next v2 2/3] nfp: add framework to support ipsec offloading
2022-09-27 10:27 [PATCH net-next v2 0/3] nfp: IPsec offload support Simon Horman
2022-09-27 10:27 ` [PATCH net-next v2 1/3] nfp: extend capability and control words Simon Horman
@ 2022-09-27 10:27 ` Simon Horman
2022-09-29 8:10 ` Leon Romanovsky
2022-09-27 10:27 ` [PATCH net-next v2 3/3] nfp: implement xfrm callbacks and expose ipsec offload feature to upper layer Simon Horman
2022-09-29 2:42 ` [PATCH net-next v2 0/3] nfp: IPsec offload support Jakub Kicinski
3 siblings, 1 reply; 12+ messages in thread
From: Simon Horman @ 2022-09-27 10:27 UTC (permalink / raw)
To: David Miller, Jakub Kicinski, Paolo Abeni
Cc: netdev, oss-drivers, Leon Romanovsky, Huanhuan Wang
From: Huanhuan Wang <huanhuan.wang@corigine.com>
A new metadata type and config structure are introduced to
interact with firmware to support ipsec offloading. This
feature relies on specific firmware that supports ipsec
encrypt/decrypt by advertising related capability bit.
The xfrm callbacks which interact with upper layer are
implemented in the following patch.
Based on initial work of Norm Bagley <norman.bagley@netronome.com>.
Signed-off-by: Huanhuan Wang <huanhuan.wang@corigine.com>
Signed-off-by: Simon Horman <simon.horman@corigine.com>
---
drivers/net/ethernet/netronome/Kconfig | 11 +
drivers/net/ethernet/netronome/nfp/Makefile | 6 +
.../ethernet/netronome/nfp/crypto/crypto.h | 35 +++
.../net/ethernet/netronome/nfp/crypto/ipsec.c | 216 ++++++++++++++++++
drivers/net/ethernet/netronome/nfp/nfd3/dp.c | 43 +++-
.../net/ethernet/netronome/nfp/nfd3/ipsec.c | 19 ++
.../net/ethernet/netronome/nfp/nfd3/nfd3.h | 8 +
drivers/net/ethernet/netronome/nfp/nfp_net.h | 9 +
.../ethernet/netronome/nfp/nfp_net_common.c | 10 +-
.../net/ethernet/netronome/nfp/nfp_net_ctrl.h | 4 +
10 files changed, 354 insertions(+), 7 deletions(-)
create mode 100644 drivers/net/ethernet/netronome/nfp/crypto/ipsec.c
create mode 100644 drivers/net/ethernet/netronome/nfp/nfd3/ipsec.c
diff --git a/drivers/net/ethernet/netronome/Kconfig b/drivers/net/ethernet/netronome/Kconfig
index 8844d1ac053a..7f669d39e471 100644
--- a/drivers/net/ethernet/netronome/Kconfig
+++ b/drivers/net/ethernet/netronome/Kconfig
@@ -54,6 +54,17 @@ config NFP_APP_ABM_NIC
functionality.
Code will be built into the nfp.ko driver.
+config NFP_NET_IPSEC
+ bool "NFP Ipsec offload support"
+ depends on NFP
+ depends on XFRM_OFFLOAD
+ default y
+ help
+ Enable driver support Ipsec offload on NFP NIC. Say Y, if
+ you are planning to make use of Ipsec offload.
+ NOTE that Ipsec offload on NFP Nic requires specific FW to
+ work.
+
config NFP_DEBUG
bool "Debug support for Netronome(R) NFP4000/NFP6000 NIC drivers"
depends on NFP
diff --git a/drivers/net/ethernet/netronome/nfp/Makefile b/drivers/net/ethernet/netronome/nfp/Makefile
index 9c0861d03634..3d33b2838e0d 100644
--- a/drivers/net/ethernet/netronome/nfp/Makefile
+++ b/drivers/net/ethernet/netronome/nfp/Makefile
@@ -80,4 +80,10 @@ nfp-objs += \
abm/main.o
endif
+ifeq ($(CONFIG_NFP_NET_IPSEC),y)
+nfp-objs += \
+ crypto/ipsec.o \
+ nfd3/ipsec.o
+endif
+
nfp-$(CONFIG_NFP_DEBUG) += nfp_net_debugfs.o
diff --git a/drivers/net/ethernet/netronome/nfp/crypto/crypto.h b/drivers/net/ethernet/netronome/nfp/crypto/crypto.h
index bffe58bb2f27..a27a378e3ebe 100644
--- a/drivers/net/ethernet/netronome/nfp/crypto/crypto.h
+++ b/drivers/net/ethernet/netronome/nfp/crypto/crypto.h
@@ -39,4 +39,39 @@ nfp_net_tls_rx_resync_req(struct net_device *netdev,
}
#endif
+/* Ipsec related structures and functions */
+struct nfp_ipsec_offload {
+ u32 seq_hi;
+ u32 seq_low;
+ u32 handle;
+};
+
+#ifndef CONFIG_NFP_NET_IPSEC
+static inline int nfp_net_ipsec_init(struct nfp_net *nn)
+{
+ return 0;
+}
+
+static inline void nfp_net_ipsec_clean(struct nfp_net *nn)
+{
+}
+
+static inline bool nfp_net_ipsec_tx_prep(struct nfp_net_dp *dp, struct sk_buff *skb,
+ struct nfp_ipsec_offload *offload_info)
+{
+ return false;
+}
+
+static inline int nfp_net_ipsec_rx(struct nfp_meta_parsed *meta, struct sk_buff *skb)
+{
+ return 0;
+}
+#else
+int nfp_net_ipsec_init(struct nfp_net *nn);
+void nfp_net_ipsec_clean(struct nfp_net *nn);
+bool nfp_net_ipsec_tx_prep(struct nfp_net_dp *dp, struct sk_buff *skb,
+ struct nfp_ipsec_offload *offload_info);
+int nfp_net_ipsec_rx(struct nfp_meta_parsed *meta, struct sk_buff *skb);
+#endif
+
#endif
diff --git a/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c b/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c
new file mode 100644
index 000000000000..658fcba8e733
--- /dev/null
+++ b/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c
@@ -0,0 +1,216 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+/* Copyright (C) 2018 Netronome Systems, Inc */
+/* Copyright (C) 2021 Corigine, Inc */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <asm/unaligned.h>
+#include <linux/ktime.h>
+#include <net/xfrm.h>
+
+#include "../nfp_net_ctrl.h"
+#include "../nfp_net.h"
+#include "crypto.h"
+
+#define NFP_NET_IPSEC_MAX_SA_CNT (16 * 1024) /* Firmware support a maximum of 16K sa offload */
+#define OFFLOAD_HANDLE_ERROR 0xffffffff
+
+/* IPSEC_CFG_MSSG_ADD_SA */
+struct nfp_ipsec_cfg_add_sa {
+ u32 ciph_key[8]; /* Cipher Key */
+ union {
+ u32 auth_key[16]; /* Authentication Key */
+ struct nfp_ipsec_aesgcm { /* AES-GCM-ESP fields */
+ u32 salt; /* Initialized with sa */
+ u32 iv[2]; /* Firmware use only */
+ u32 cntr;
+ u32 zeros[4]; /* Init to 0 with sa */
+ u32 len_a[2]; /* Firmware use only */
+ u32 len_c[2];
+ u32 spare0[4];
+ } aesgcm_fields;
+ };
+ struct sa_ctrl_word {
+ uint32_t hash :4; /* From nfp_ipsec_sa_hash_type */
+ uint32_t cimode :4; /* From nfp_ipsec_sa_cipher_mode */
+ uint32_t cipher :4; /* From nfp_ipsec_sa_cipher */
+ uint32_t mode :2; /* From nfp_ipsec_sa_mode */
+ uint32_t proto :2; /* From nfp_ipsec_sa_prot */
+ uint32_t dir :1; /* Sa direction */
+ uint32_t ena_arw:1; /* Anti-Replay Window */
+ uint32_t ext_seq:1; /* 64-bit Sequence Num */
+ uint32_t ext_arw:1; /* 64b Anti-Replay Window */
+ uint32_t spare2 :9; /* Must be set to 0 */
+ uint32_t encap_dsbl:1; /* Encap/decap disable */
+ uint32_t gen_seq:1; /* Firmware Generate Seq */
+ uint32_t spare8 :1; /* Must be set to 0 */
+ } ctrl_word;
+ u32 spi; /* SPI Value */
+ uint32_t pmtu_limit :16; /* PMTU Limit */
+ uint32_t spare3 :1;
+ uint32_t frag_check :1; /* Stateful fragment checking flag */
+ uint32_t bypass_DSCP:1; /* Bypass DSCP Flag */
+ uint32_t df_ctrl :2; /* DF Control bits */
+ uint32_t ipv6 :1; /* Outbound IPv6 addr format */
+ uint32_t udp_enable :1; /* Add/Remove UDP header for NAT */
+ uint32_t tfc_enable :1; /* Traffic Flow Confidentiality */
+ uint32_t spare4 :8;
+ u32 soft_lifetime_byte_count;
+ u32 hard_lifetime_byte_count;
+ u32 src_ip[4]; /* Src IP addr */
+ u32 dst_ip[4]; /* Dst IP addr */
+ uint32_t natt_dst_port :16; /* NAT-T UDP Header dst port */
+ uint32_t natt_src_port :16; /* NAT-T UDP Header src port */
+ u32 soft_lifetime_time_limit;
+ u32 hard_lifetime_time_limit;
+ u32 sa_creation_time_lo_32; /* Ucode fills this in */
+ u32 sa_creation_time_hi_32; /* Ucode fills this in */
+ uint32_t reserved0 :16;
+ uint32_t tfc_padding :16; /* Traffic Flow Confidential Pad */
+};
+
+struct nfp_net_ipsec_sa_data {
+ struct nfp_ipsec_cfg_add_sa nfp_sa;
+ struct xfrm_state *x;
+ int invalidated;
+};
+
+struct nfp_net_ipsec_data {
+ struct nfp_net_ipsec_sa_data sa_entries[NFP_NET_IPSEC_MAX_SA_CNT];
+ unsigned int sa_free_stack[NFP_NET_IPSEC_MAX_SA_CNT];
+ unsigned int sa_free_cnt;
+ struct mutex lock; /* Protects nfp_net_ipsec_data struct */
+};
+
+static int nfp_net_xfrm_add_state(struct xfrm_state *x)
+{
+ return -EOPNOTSUPP;
+}
+
+static void nfp_net_xfrm_del_state(struct xfrm_state *x)
+{
+}
+
+static void nfp_net_xfrm_free_state(struct xfrm_state *x)
+{
+}
+
+static bool nfp_net_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
+{
+ return false;
+}
+
+static const struct xfrmdev_ops nfp_net_ipsec_xfrmdev_ops = {
+ .xdo_dev_state_add = nfp_net_xfrm_add_state,
+ .xdo_dev_state_delete = nfp_net_xfrm_del_state,
+ .xdo_dev_state_free = nfp_net_xfrm_free_state,
+ .xdo_dev_offload_ok = nfp_net_ipsec_offload_ok,
+};
+
+int nfp_net_ipsec_init(struct nfp_net *nn)
+{
+ if (nn->cap_w1 & NFP_NET_CFG_CTRL_IPSEC) {
+ struct nfp_net_ipsec_data *ipd;
+ int i;
+
+ nn->dp.netdev->xfrmdev_ops = &nfp_net_ipsec_xfrmdev_ops;
+
+ ipd = kzalloc(sizeof(*ipd), GFP_KERNEL);
+ if (!ipd)
+ return -ENOMEM;
+
+ for (i = 0; i < NFP_NET_IPSEC_MAX_SA_CNT; i++)
+ ipd->sa_free_stack[i] = NFP_NET_IPSEC_MAX_SA_CNT - i - 1;
+
+ ipd->sa_free_cnt = NFP_NET_IPSEC_MAX_SA_CNT;
+ mutex_init(&ipd->lock);
+ nn->ipsec_data = ipd;
+ }
+
+ return 0;
+}
+
+void nfp_net_ipsec_clean(struct nfp_net *nn)
+{
+ if (!nn->ipsec_data)
+ return;
+
+ mutex_destroy(&nn->ipsec_data->lock);
+ kfree(nn->ipsec_data);
+ nn->ipsec_data = NULL;
+}
+
+bool nfp_net_ipsec_tx_prep(struct nfp_net_dp *dp, struct sk_buff *skb,
+ struct nfp_ipsec_offload *offload_info)
+{
+ struct xfrm_offload *xo = xfrm_offload(skb);
+ struct xfrm_state *x;
+
+ if (!xo)
+ return false;
+
+ x = xfrm_input_state(skb);
+ if (!x)
+ return false;
+
+ if (x->xso.offload_handle == OFFLOAD_HANDLE_ERROR) {
+ nn_dp_warn(dp, "Invalid xfrm offload handle\n");
+ return false;
+ }
+
+ offload_info->seq_hi = xo->seq.hi;
+ offload_info->seq_low = xo->seq.low;
+ offload_info->handle = x->xso.offload_handle;
+
+ return true;
+}
+
+int nfp_net_ipsec_rx(struct nfp_meta_parsed *meta, struct sk_buff *skb)
+{
+ struct nfp_net_ipsec_sa_data *sa_data;
+ struct net_device *netdev = skb->dev;
+ struct nfp_net_ipsec_data *ipd;
+ struct xfrm_offload *xo;
+ struct nfp_net_dp *dp;
+ struct xfrm_state *x;
+ struct sec_path *sp;
+ struct nfp_net *nn;
+ int saidx;
+
+ nn = netdev_priv(netdev);
+ ipd = nn->ipsec_data;
+ dp = &nn->dp;
+
+ if (meta->ipsec_saidx == 0)
+ return 0; /* No offload took place */
+
+ saidx = meta->ipsec_saidx - 1;
+ if (saidx > NFP_NET_IPSEC_MAX_SA_CNT || saidx < 0) {
+ nn_dp_warn(dp, "Invalid SAIDX from NIC %d\n", saidx);
+ return -EINVAL;
+ }
+
+ sa_data = &ipd->sa_entries[saidx];
+ if (!sa_data->x) {
+ nn_dp_warn(dp, "Unused SAIDX from NIC %d\n", saidx);
+ return -EINVAL;
+ }
+
+ x = sa_data->x;
+ xfrm_state_hold(x);
+ sp = secpath_set(skb);
+ if (unlikely(!sp)) {
+ nn_dp_warn(dp, "Failed to alloc secpath for RX offload\n");
+ return -ENOMEM;
+ }
+
+ sp->xvec[sp->len++] = x;
+ sp->olen++;
+ xo = xfrm_offload(skb);
+ xo->flags = CRYPTO_DONE;
+ xo->status = CRYPTO_SUCCESS;
+
+ return 0;
+}
diff --git a/drivers/net/ethernet/netronome/nfp/nfd3/dp.c b/drivers/net/ethernet/netronome/nfp/nfd3/dp.c
index 448c1c1afaee..db53e0392923 100644
--- a/drivers/net/ethernet/netronome/nfp/nfd3/dp.c
+++ b/drivers/net/ethernet/netronome/nfp/nfd3/dp.c
@@ -167,14 +167,18 @@ nfp_nfd3_tx_csum(struct nfp_net_dp *dp, struct nfp_net_r_vector *r_vec,
u64_stats_update_end(&r_vec->tx_sync);
}
-static int nfp_nfd3_prep_tx_meta(struct nfp_net_dp *dp, struct sk_buff *skb, u64 tls_handle)
+static int nfp_nfd3_prep_tx_meta(struct nfp_net_dp *dp, struct sk_buff *skb,
+ u64 tls_handle, bool *ipsec)
{
struct metadata_dst *md_dst = skb_metadata_dst(skb);
+ struct nfp_ipsec_offload offload_info;
unsigned char *data;
bool vlan_insert;
u32 meta_id = 0;
int md_bytes;
+ *ipsec = nfp_net_ipsec_tx_prep(dp, skb, &offload_info);
+
if (unlikely(md_dst || tls_handle)) {
if (unlikely(md_dst && md_dst->type != METADATA_HW_PORT_MUX))
md_dst = NULL;
@@ -182,13 +186,14 @@ static int nfp_nfd3_prep_tx_meta(struct nfp_net_dp *dp, struct sk_buff *skb, u64
vlan_insert = skb_vlan_tag_present(skb) && (dp->ctrl & NFP_NET_CFG_CTRL_TXVLAN_V2);
- if (!(md_dst || tls_handle || vlan_insert))
+ if (!(md_dst || tls_handle || vlan_insert || *ipsec))
return 0;
md_bytes = sizeof(meta_id) +
!!md_dst * NFP_NET_META_PORTID_SIZE +
!!tls_handle * NFP_NET_META_CONN_HANDLE_SIZE +
- vlan_insert * NFP_NET_META_VLAN_SIZE;
+ vlan_insert * NFP_NET_META_VLAN_SIZE +
+ *ipsec * NFP_NET_META_IPSEC_FIELD_SIZE; /* Ipsec has 12-bytes metadata */
if (unlikely(skb_cow_head(skb, md_bytes)))
return -ENOMEM;
@@ -218,6 +223,19 @@ static int nfp_nfd3_prep_tx_meta(struct nfp_net_dp *dp, struct sk_buff *skb, u64
meta_id <<= NFP_NET_META_FIELD_SIZE;
meta_id |= NFP_NET_META_VLAN;
}
+ if (*ipsec) {
+ /* The ipsec has three consecutive 4-bit ipsec Metadate types
+ * so ipsec has three 4-bytes of Metadata
+ */
+ data -= NFP_NET_META_IPSEC_SIZE;
+ put_unaligned_be32(offload_info.seq_hi, data);
+ data -= NFP_NET_META_IPSEC_SIZE;
+ put_unaligned_be32(offload_info.seq_low, data);
+ data -= NFP_NET_META_IPSEC_SIZE;
+ put_unaligned_be32(offload_info.handle - 1, data);
+ meta_id <<= NFP_NET_META_IPSEC_FIELD_SIZE;
+ meta_id |= NFP_NET_META_IPSEC << 8 | NFP_NET_META_IPSEC << 4 | NFP_NET_META_IPSEC;
+ }
data -= sizeof(meta_id);
put_unaligned_be32(meta_id, data);
@@ -246,6 +264,7 @@ netdev_tx_t nfp_nfd3_tx(struct sk_buff *skb, struct net_device *netdev)
dma_addr_t dma_addr;
unsigned int fsize;
u64 tls_handle = 0;
+ bool ipsec = false;
u16 qidx;
dp = &nn->dp;
@@ -273,7 +292,7 @@ netdev_tx_t nfp_nfd3_tx(struct sk_buff *skb, struct net_device *netdev)
return NETDEV_TX_OK;
}
- md_bytes = nfp_nfd3_prep_tx_meta(dp, skb, tls_handle);
+ md_bytes = nfp_nfd3_prep_tx_meta(dp, skb, tls_handle, &ipsec);
if (unlikely(md_bytes < 0))
goto err_flush;
@@ -312,6 +331,8 @@ netdev_tx_t nfp_nfd3_tx(struct sk_buff *skb, struct net_device *netdev)
txd->vlan = cpu_to_le16(skb_vlan_tag_get(skb));
}
+ if (ipsec)
+ nfp_nfd3_ipsec_tx(txd, skb);
/* Gather DMA */
if (nr_frags > 0) {
__le64 second_half;
@@ -764,6 +785,12 @@ nfp_nfd3_parse_meta(struct net_device *netdev, struct nfp_meta_parsed *meta,
return false;
data += sizeof(struct nfp_net_tls_resync_req);
break;
+#ifdef CONFIG_NFP_NET_IPSEC
+ case NFP_NET_META_IPSEC:
+ meta->ipsec_saidx = get_unaligned_be32(data) + 1;
+ data += 4;
+ break;
+#endif
default:
return true;
}
@@ -876,12 +903,11 @@ static int nfp_nfd3_rx(struct nfp_net_rx_ring *rx_ring, int budget)
struct nfp_net_dp *dp = &r_vec->nfp_net->dp;
struct nfp_net_tx_ring *tx_ring;
struct bpf_prog *xdp_prog;
+ int idx, pkts_polled = 0;
bool xdp_tx_cmpl = false;
unsigned int true_bufsz;
struct sk_buff *skb;
- int pkts_polled = 0;
struct xdp_buff xdp;
- int idx;
xdp_prog = READ_ONCE(dp->xdp_prog);
true_bufsz = xdp_prog ? PAGE_SIZE : dp->fl_bufsz;
@@ -1081,6 +1107,11 @@ static int nfp_nfd3_rx(struct nfp_net_rx_ring *rx_ring, int budget)
continue;
}
+ if (unlikely(nfp_net_ipsec_rx(&meta, skb))) {
+ nfp_nfd3_rx_drop(dp, r_vec, rx_ring, NULL, skb);
+ continue;
+ }
+
if (meta_len_xdp)
skb_metadata_set(skb, meta_len_xdp);
diff --git a/drivers/net/ethernet/netronome/nfp/nfd3/ipsec.c b/drivers/net/ethernet/netronome/nfp/nfd3/ipsec.c
new file mode 100644
index 000000000000..f0d74d6b49d0
--- /dev/null
+++ b/drivers/net/ethernet/netronome/nfp/nfd3/ipsec.c
@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+/* Copyright (C) 2018 Netronome Systems, Inc */
+/* Copyright (C) 2021 Corigine, Inc */
+
+#include <net/xfrm.h>
+
+#include "../nfp_net.h"
+#include "nfd3.h"
+
+void nfp_nfd3_ipsec_tx(struct nfp_nfd3_tx_desc *txd, struct sk_buff *skb)
+{
+ struct xfrm_state *x;
+
+ x = xfrm_input_state(skb);
+ if (x->xso.dev && (x->xso.dev->features & NETIF_F_HW_ESP_TX_CSUM)) {
+ txd->flags |= NFD3_DESC_TX_CSUM | NFD3_DESC_TX_IP4_CSUM |
+ NFD3_DESC_TX_TCP_CSUM | NFD3_DESC_TX_UDP_CSUM;
+ }
+}
diff --git a/drivers/net/ethernet/netronome/nfp/nfd3/nfd3.h b/drivers/net/ethernet/netronome/nfp/nfd3/nfd3.h
index 7a0df9e6c3c4..9c1c10dcbaee 100644
--- a/drivers/net/ethernet/netronome/nfp/nfd3/nfd3.h
+++ b/drivers/net/ethernet/netronome/nfp/nfd3/nfd3.h
@@ -103,4 +103,12 @@ void nfp_nfd3_rx_ring_fill_freelist(struct nfp_net_dp *dp,
void nfp_nfd3_xsk_tx_free(struct nfp_nfd3_tx_buf *txbuf);
int nfp_nfd3_xsk_poll(struct napi_struct *napi, int budget);
+#ifndef CONFIG_NFP_NET_IPSEC
+static inline void nfp_nfd3_ipsec_tx(struct nfp_nfd3_tx_desc *txd, struct sk_buff *skb)
+{
+}
+#else
+void nfp_nfd3_ipsec_tx(struct nfp_nfd3_tx_desc *txd, struct sk_buff *skb);
+#endif
+
#endif
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net.h b/drivers/net/ethernet/netronome/nfp/nfp_net.h
index 0c3e7e2f856d..768539f12214 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net.h
@@ -263,6 +263,10 @@ struct nfp_meta_parsed {
u8 tpid;
u16 tci;
} vlan;
+
+#ifdef CONFIG_NFP_NET_IPSEC
+ u32 ipsec_saidx;
+#endif
};
struct nfp_net_rx_hash {
@@ -584,6 +588,7 @@ struct nfp_net_dp {
* @qcp_cfg: Pointer to QCP queue used for configuration notification
* @tx_bar: Pointer to mapped TX queues
* @rx_bar: Pointer to mapped FL/RX queues
+ * @ipsec_data: Ipsec Sa data
* @tlv_caps: Parsed TLV capabilities
* @ktls_tx_conn_cnt: Number of offloaded kTLS TX connections
* @ktls_rx_conn_cnt: Number of offloaded kTLS RX connections
@@ -672,6 +677,10 @@ struct nfp_net {
u8 __iomem *tx_bar;
u8 __iomem *rx_bar;
+#ifdef CONFIG_NFP_NET_IPSEC
+ struct nfp_net_ipsec_data *ipsec_data;
+#endif
+
struct nfp_net_tlv_caps tlv_caps;
unsigned int ktls_tx_conn_cnt;
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 7e4424d626a6..040c0c2aad80 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -2565,9 +2565,13 @@ int nfp_net_init(struct nfp_net *nn)
if (err)
return err;
- err = nfp_net_tls_init(nn);
+ err = nfp_net_ipsec_init(nn);
if (err)
goto err_clean_mbox;
+
+ err = nfp_net_tls_init(nn);
+ if (err)
+ goto err_clean_ipsec;
}
nfp_net_vecs_init(nn);
@@ -2576,6 +2580,9 @@ int nfp_net_init(struct nfp_net *nn)
return 0;
return register_netdev(nn->dp.netdev);
+err_clean_ipsec:
+ nfp_net_ipsec_clean(nn);
+
err_clean_mbox:
nfp_ccm_mbox_clean(nn);
return err;
@@ -2591,6 +2598,7 @@ void nfp_net_clean(struct nfp_net *nn)
return;
unregister_netdev(nn->dp.netdev);
+ nfp_net_ipsec_clean(nn);
nfp_ccm_mbox_clean(nn);
nfp_net_reconfig_wait_posted(nn);
}
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
index 80346c1c266b..fff05496152d 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
@@ -45,6 +45,7 @@
#define NFP_NET_META_CSUM 6 /* checksum complete type */
#define NFP_NET_META_CONN_HANDLE 7
#define NFP_NET_META_RESYNC_INFO 8 /* RX resync info request */
+#define NFP_NET_META_IPSEC 9 /* IPSec SA index for tx and rx */
#define NFP_META_PORT_ID_CTRL ~0U
@@ -52,6 +53,8 @@
#define NFP_NET_META_VLAN_SIZE 4
#define NFP_NET_META_PORTID_SIZE 4
#define NFP_NET_META_CONN_HANDLE_SIZE 8
+#define NFP_NET_META_IPSEC_SIZE 4
+#define NFP_NET_META_IPSEC_FIELD_SIZE 12
/* Hash type pre-pended when a RSS hash was computed */
#define NFP_NET_RSS_NONE 0
#define NFP_NET_RSS_IPV4 1
@@ -260,6 +263,7 @@
*/
#define NFP_NET_CFG_CTRL_WORD1 0x0098
#define NFP_NET_CFG_CTRL_PKT_TYPE (0x1 << 0) /* Pkttype offload */
+#define NFP_NET_CFG_CTRL_IPSEC (0x1 << 1) /* IPSec offload */
#define NFP_NET_CFG_CAP_WORD1 0x00a4
--
2.30.2
^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCH net-next v2 3/3] nfp: implement xfrm callbacks and expose ipsec offload feature to upper layer
2022-09-27 10:27 [PATCH net-next v2 0/3] nfp: IPsec offload support Simon Horman
2022-09-27 10:27 ` [PATCH net-next v2 1/3] nfp: extend capability and control words Simon Horman
2022-09-27 10:27 ` [PATCH net-next v2 2/3] nfp: add framework to support ipsec offloading Simon Horman
@ 2022-09-27 10:27 ` Simon Horman
2022-09-29 8:26 ` Leon Romanovsky
2022-09-29 2:42 ` [PATCH net-next v2 0/3] nfp: IPsec offload support Jakub Kicinski
3 siblings, 1 reply; 12+ messages in thread
From: Simon Horman @ 2022-09-27 10:27 UTC (permalink / raw)
To: David Miller, Jakub Kicinski, Paolo Abeni
Cc: netdev, oss-drivers, Leon Romanovsky, Huanhuan Wang
From: Huanhuan Wang <huanhuan.wang@corigine.com>
Xfrm callbacks are implemented to offload SA info into firmware
by mailbox. It supports 16K SA info in total.
Expose ipsec offload feature to upper layer, this feature will
signal the availability of the offload.
Based on initial work of Norm Bagley <norman.bagley@netronome.com>.
Signed-off-by: Huanhuan Wang <huanhuan.wang@corigine.com>
Signed-off-by: Simon Horman <simon.horman@corigine.com>
---
.../net/ethernet/netronome/nfp/crypto/ipsec.c | 562 +++++++++++++++++-
.../ethernet/netronome/nfp/nfp_net_common.c | 6 +
.../net/ethernet/netronome/nfp/nfp_net_ctrl.h | 4 +-
3 files changed, 568 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c b/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c
index 658fcba8e733..a81e6cde4ea8 100644
--- a/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c
+++ b/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c
@@ -17,6 +17,77 @@
#define NFP_NET_IPSEC_MAX_SA_CNT (16 * 1024) /* Firmware support a maximum of 16K sa offload */
#define OFFLOAD_HANDLE_ERROR 0xffffffff
+/* IPsec config message cmd codes */
+enum nfp_ipsec_cfg_mssg_cmd_codes {
+ NFP_IPSEC_CFG_MSSG_ADD_SA, /* Add a new SA */
+ NFP_IPSEC_CFG_MSSG_INV_SA, /* Invalidate an existing SA */
+ NFP_IPSEC_CFG_MSSG_MODIFY_SA, /* Modify an existing SA */
+ NFP_IPSEC_CFG_MSSG_GET_SA_STATS, /* Report SA counters, flags, etc. */
+ NFP_IPSEC_CFG_MSSG_GET_SEQ_NUMS, /* Allocate sequence numbers */
+ NFP_IPSEC_CFG_MSSG_LAST
+};
+
+/* IPsec config message response codes */
+enum nfp_ipsec_cfg_mssg_rsp_codes {
+ NFP_IPSEC_CFG_MSSG_OK,
+ NFP_IPSEC_CFG_MSSG_FAILED,
+ NFP_IPSEC_CFG_MSSG_SA_VALID,
+ NFP_IPSEC_CFG_MSSG_SA_HASH_ADD_FAILED,
+ NFP_IPSEC_CFG_MSSG_SA_HASH_DEL_FAILED,
+ NFP_IPSEC_CFG_MSSG_SA_INVALID_CMD
+};
+
+/* Protocol */
+enum nfp_ipsec_sa_prot {
+ NFP_IPSEC_PROTOCOL_AH = 0,
+ NFP_IPSEC_PROTOCOL_ESP = 1
+};
+
+/* Mode */
+enum nfp_ipsec_sa_mode {
+ NFP_IPSEC_PROTMODE_TRANSPORT = 0,
+ NFP_IPSEC_PROTMODE_TUNNEL = 1
+};
+
+/* Cipher types */
+enum nfp_ipsec_sa_cipher {
+ NFP_IPSEC_CIPHER_NULL,
+ NFP_IPSEC_CIPHER_3DES,
+ NFP_IPSEC_CIPHER_AES128,
+ NFP_IPSEC_CIPHER_AES192,
+ NFP_IPSEC_CIPHER_AES256,
+ NFP_IPSEC_CIPHER_AES128_NULL,
+ NFP_IPSEC_CIPHER_AES192_NULL,
+ NFP_IPSEC_CIPHER_AES256_NULL,
+ NFP_IPSEC_CIPHER_CHACHA20
+};
+
+/* Cipher modes */
+enum nfp_ipsec_sa_cipher_mode {
+ NFP_IPSEC_CIMODE_ECB,
+ NFP_IPSEC_CIMODE_CBC,
+ NFP_IPSEC_CIMODE_CFB,
+ NFP_IPSEC_CIMODE_OFB,
+ NFP_IPSEC_CIMODE_CTR
+};
+
+/* Hash types */
+enum nfp_ipsec_sa_hash_type {
+ NFP_IPSEC_HASH_NONE,
+ NFP_IPSEC_HASH_MD5_96,
+ NFP_IPSEC_HASH_SHA1_96,
+ NFP_IPSEC_HASH_SHA256_96,
+ NFP_IPSEC_HASH_SHA384_96,
+ NFP_IPSEC_HASH_SHA512_96,
+ NFP_IPSEC_HASH_MD5_128,
+ NFP_IPSEC_HASH_SHA1_80,
+ NFP_IPSEC_HASH_SHA256_128,
+ NFP_IPSEC_HASH_SHA384_192,
+ NFP_IPSEC_HASH_SHA512_256,
+ NFP_IPSEC_HASH_GF128_128,
+ NFP_IPSEC_HASH_POLY1305_128
+};
+
/* IPSEC_CFG_MSSG_ADD_SA */
struct nfp_ipsec_cfg_add_sa {
u32 ciph_key[8]; /* Cipher Key */
@@ -71,6 +142,73 @@ struct nfp_ipsec_cfg_add_sa {
uint32_t tfc_padding :16; /* Traffic Flow Confidential Pad */
};
+/* IPSEC_CFG_MSSG_INV_SA */
+struct nfp_ipsec_cfg_inv_sa {
+ u32 spare6;
+};
+
+/* IPSEC_CFG_MSSG_GET_SA_STATS */
+struct nfp_ipsec_cfg_get_sa_stats {
+ u32 seq_lo; /* Sequence Number (low 32bits) */
+ u32 seq_high; /* Sequence Number (high 32bits) */
+ u32 arw_counter_lo; /* Anti-replay wndw cntr */
+ u32 arw_counter_high; /* Anti-replay wndw cntr */
+ u32 arw_bitmap_lo; /* Anti-replay wndw bitmap */
+ u32 arw_bitmap_high; /* Anti-replay wndw bitmap */
+ uint32_t reserved1:1;
+ uint32_t soft_lifetime_byte_cnt_exceeded :1; /* Soft cnt_exceeded */
+ uint32_t hard_lifetime_byte_cnt_exceeded :1; /* Hard cnt_exceeded */
+ uint32_t soft_lifetime_time_limit_exceeded :1; /* Soft cnt_exceeded */
+ uint32_t hard_lifetime_time_limit_exceeded :1; /* Hard cnt_exceeded */
+ uint32_t spare7:27;
+ u32 lifetime_byte_count;
+ u32 pkt_count;
+ u32 discards_auth; /* Auth failures */
+ u32 discards_unsupported; /* Unsupported crypto mode */
+ u32 discards_alignment; /* Alignment error */
+ u32 discards_hard_bytelimit; /* Byte Count limit */
+ u32 discards_seq_num_wrap; /* Sequ Number wrap */
+ u32 discards_pmtu_limit_exceeded; /* PMTU Limit */
+ u32 discards_arw_old_seq; /* Anti-Replay seq small */
+ u32 discards_arw_replay; /* Anti-Replay seq rcvd */
+ u32 discards_ctrl_word; /* Bad SA Control word */
+ u32 discards_ip_hdr_len; /* Hdr offset from too high */
+ u32 discards_eop_buf; /* No EOP buffer */
+ u32 ipv4_id_counter; /* IPv4 ID field counter */
+ u32 discards_isl_fail; /* Inbound SPD Lookup failure */
+ u32 discards_ext_not_found; /* Ext header end */
+ u32 discards_max_ext_hdrs; /* Max ext header */
+ u32 discards_non_ext_hdrs; /* Non-extension headers */
+ u32 discards_ext_hdr_too_big; /* Ext header chain */
+ u32 discards_hard_timelimit; /* Time Limit */
+};
+
+/* IPSEC_CFG_MSSG_GET_SEQ_NUMS */
+struct ipsec_cfg_get_seq_nums {
+ u32 seq_nums; /* Sequence numbers to allocate */
+ u32 seq_num_low; /* Rtrn start seq num 31:00 */
+ u32 seq_num_hi; /* Rtrn start seq num 63:32 */
+};
+
+/* IPSEC_CFG_MSSG */
+struct nfp_ipsec_cfg_mssg {
+ union {
+ struct{
+ uint32_t cmd:16; /* One of nfp_ipsec_cfg_mssg_cmd_codes */
+ uint32_t rsp:16; /* One of nfp_ipsec_cfg_mssg_rsp_codes */
+ uint32_t sa_idx:16; /* SA table index */
+ uint32_t spare0:16;
+ union {
+ struct nfp_ipsec_cfg_add_sa cfg_add_sa;
+ struct nfp_ipsec_cfg_inv_sa cfg_inv_sa;
+ struct nfp_ipsec_cfg_get_sa_stats cfg_get_stats;
+ struct ipsec_cfg_get_seq_nums cfg_get_seq_nums;
+ };
+ };
+ u32 raw[64];
+ };
+};
+
struct nfp_net_ipsec_sa_data {
struct nfp_ipsec_cfg_add_sa nfp_sa;
struct xfrm_state *x;
@@ -84,22 +222,442 @@ struct nfp_net_ipsec_data {
struct mutex lock; /* Protects nfp_net_ipsec_data struct */
};
+static int nfp_ipsec_cfg_cmd_issue(struct nfp_net *nn, int type, int saidx,
+ struct nfp_ipsec_cfg_mssg *msg)
+{
+ int i, msg_size, ret;
+
+ msg->cmd = type;
+ msg->sa_idx = saidx;
+ msg->rsp = 0;
+ msg_size = ARRAY_SIZE(msg->raw);
+
+ for (i = 0; i < msg_size; i++)
+ nn_writel(nn, NFP_NET_CFG_MBOX_VAL + 4 * i, msg->raw[i]);
+
+ ret = nfp_net_mbox_reconfig(nn, NFP_NET_CFG_MBOX_CMD_IPSEC);
+ if (ret < 0)
+ return ret;
+
+ /* For now we always read the whole message response back */
+ for (i = 0; i < msg_size; i++)
+ msg->raw[i] = nn_readl(nn, NFP_NET_CFG_MBOX_VAL + 4 * i);
+
+ switch (msg->rsp) {
+ case NFP_IPSEC_CFG_MSSG_OK:
+ return 0;
+ case NFP_IPSEC_CFG_MSSG_SA_INVALID_CMD:
+ return -EINVAL;
+ case NFP_IPSEC_CFG_MSSG_SA_VALID:
+ return -EEXIST;
+ case NFP_IPSEC_CFG_MSSG_FAILED:
+ case NFP_IPSEC_CFG_MSSG_SA_HASH_ADD_FAILED:
+ case NFP_IPSEC_CFG_MSSG_SA_HASH_DEL_FAILED:
+ return -EIO;
+ default:
+ return -EDOM;
+ }
+}
+
+static int set_aes_keylen(struct nfp_ipsec_cfg_add_sa *cfg, int alg, int keylen)
+{
+ if (alg == SADB_X_EALG_NULL_AES_GMAC) {
+ if (keylen == 128)
+ cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES128_NULL;
+ else if (keylen == 192)
+ cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES192_NULL;
+ else if (keylen == 256)
+ cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES256_NULL;
+ else
+ return -EINVAL;
+ } else {
+ if (keylen == 128)
+ cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES128;
+ else if (keylen == 192)
+ cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES192;
+ else if (keylen == 256)
+ cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES256;
+ else
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
static int nfp_net_xfrm_add_state(struct xfrm_state *x)
{
- return -EOPNOTSUPP;
+ int i, key_len, trunc_len, err = 0, saidx = -1;
+ struct net_device *netdev = x->xso.dev;
+ struct nfp_net_ipsec_sa_data *sa_data;
+ struct nfp_ipsec_cfg_add_sa *cfg;
+ struct nfp_net_ipsec_data *ipd;
+ struct nfp_ipsec_cfg_mssg msg;
+ struct nfp_net *nn;
+ __be32 *p;
+
+ nn = netdev_priv(netdev);
+ ipd = nn->ipsec_data;
+ cfg = &msg.cfg_add_sa;
+
+ nn_dbg(nn, "XFRM add state!\n");
+ mutex_lock(&ipd->lock);
+
+ if (ipd->sa_free_cnt == 0) {
+ nn_err(nn, "No space for xfrm offload\n");
+ err = -ENOSPC;
+ goto error;
+ }
+
+ saidx = ipd->sa_free_stack[ipd->sa_free_cnt - 1];
+ sa_data = &ipd->sa_entries[saidx];
+ memset(&msg, 0, sizeof(msg));
+
+ /* General */
+ switch (x->props.mode) {
+ case XFRM_MODE_TUNNEL:
+ cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TUNNEL;
+ break;
+ case XFRM_MODE_TRANSPORT:
+ cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TRANSPORT;
+ break;
+ default:
+ nn_err(nn, "Unsupported mode for xfrm offload\n");
+ err = -EINVAL;
+ goto error;
+ }
+
+ switch (x->id.proto) {
+ case IPPROTO_ESP:
+ cfg->ctrl_word.proto = NFP_IPSEC_PROTOCOL_ESP;
+ break;
+ case IPPROTO_AH:
+ cfg->ctrl_word.proto = NFP_IPSEC_PROTOCOL_AH;
+ break;
+ default:
+ nn_err(nn, "Unsupported protocol for xfrm offload\n");
+ err = -EINVAL;
+ goto error;
+ }
+
+ if (x->props.flags & XFRM_STATE_ESN) {
+ nn_err(nn, "Unsupported XFRM_REPLAY_MODE_ESN for xfrm offload\n");
+ err = -EINVAL;
+ goto error;
+ }
+
+ cfg->ctrl_word.ena_arw = 0;
+ cfg->ctrl_word.ext_arw = 0;
+ cfg->spi = ntohl(x->id.spi);
+
+ /* Hash/Authentication */
+ if (x->aalg)
+ trunc_len = x->aalg->alg_trunc_len;
+ else
+ trunc_len = 0;
+
+ switch (x->props.aalgo) {
+ case SADB_AALG_NONE:
+ if (x->aead) {
+ trunc_len = -1;
+ } else {
+ nn_err(nn, "Unsupported authentication algorithm\n");
+ err = -EINVAL;
+ goto error;
+ }
+ break;
+ case SADB_X_AALG_NULL:
+ cfg->ctrl_word.hash = NFP_IPSEC_HASH_NONE;
+ trunc_len = -1;
+ break;
+ case SADB_AALG_MD5HMAC:
+ if (trunc_len == 96)
+ cfg->ctrl_word.hash = NFP_IPSEC_HASH_MD5_96;
+ else if (trunc_len == 128)
+ cfg->ctrl_word.hash = NFP_IPSEC_HASH_MD5_128;
+ else
+ trunc_len = 0;
+ break;
+ case SADB_AALG_SHA1HMAC:
+ if (trunc_len == 96)
+ cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA1_96;
+ else if (trunc_len == 80)
+ cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA1_80;
+ else
+ trunc_len = 0;
+ break;
+ case SADB_X_AALG_SHA2_256HMAC:
+ if (trunc_len == 96)
+ cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA256_96;
+ else if (trunc_len == 128)
+ cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA256_128;
+ else
+ trunc_len = 0;
+ break;
+ case SADB_X_AALG_SHA2_384HMAC:
+ if (trunc_len == 96)
+ cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA384_96;
+ else if (trunc_len == 192)
+ cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA384_192;
+ else
+ trunc_len = 0;
+ break;
+ case SADB_X_AALG_SHA2_512HMAC:
+ if (trunc_len == 96)
+ cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA512_96;
+ else if (trunc_len == 256)
+ cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA512_256;
+ else
+ trunc_len = 0;
+ break;
+ default:
+ nn_err(nn, "Unsupported authentication algorithm\n");
+ err = -EINVAL;
+ goto error;
+ }
+
+ if (!trunc_len) {
+ nn_err(nn, "Unsupported authentication algorithm trunc length\n");
+ err = -EINVAL;
+ goto error;
+ }
+
+ if (x->aalg) {
+ p = (__be32 *)x->aalg->alg_key;
+ key_len = DIV_ROUND_UP(x->aalg->alg_key_len, BITS_PER_BYTE);
+ if (key_len > sizeof(cfg->auth_key)) {
+ nn_err(nn, "Insufficient space for offloaded auth key\n");
+ err = -EINVAL;
+ goto error;
+ }
+ for (i = 0; i < key_len / sizeof(cfg->auth_key[0]) ; i++)
+ cfg->auth_key[i] = ntohl(*p++);
+ }
+ /* Encryption */
+ switch (x->props.ealgo) {
+ case SADB_EALG_NONE:
+ case SADB_EALG_NULL:
+ cfg->ctrl_word.cimode = NFP_IPSEC_CIMODE_CBC;
+ cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_NULL;
+ break;
+ case SADB_EALG_3DESCBC:
+ cfg->ctrl_word.cimode = NFP_IPSEC_CIMODE_CBC;
+ cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_3DES;
+ break;
+ case SADB_X_EALG_AES_GCM_ICV16:
+ case SADB_X_EALG_NULL_AES_GMAC:
+ if (!x->aead) {
+ nn_err(nn, "Invalid AES key data\n");
+ err = -EINVAL;
+ goto error;
+ }
+
+ if (x->aead->alg_icv_len != 128) {
+ nn_err(nn, "ICV must be 128bit with SADB_X_EALG_AES_GCM_ICV16\n");
+ err = -EINVAL;
+ goto error;
+ }
+ cfg->ctrl_word.cimode = NFP_IPSEC_CIMODE_CTR;
+ cfg->ctrl_word.hash = NFP_IPSEC_HASH_GF128_128;
+
+ /* Aead->alg_key_len includes 32-bit salt */
+ if (set_aes_keylen(cfg, x->props.ealgo, x->aead->alg_key_len - 32)) {
+ nn_err(nn, "Unsupported AES key length %d\n", x->aead->alg_key_len);
+ err = -EINVAL;
+ goto error;
+ }
+ break;
+ case SADB_X_EALG_AESCBC:
+ cfg->ctrl_word.cimode = NFP_IPSEC_CIMODE_CBC;
+ if (!x->ealg) {
+ nn_err(nn, "Invalid AES key data\n");
+ err = -EINVAL;
+ goto error;
+ }
+ if (set_aes_keylen(cfg, x->props.ealgo, x->ealg->alg_key_len) < 0) {
+ nn_err(nn, "Unsupported AES key length %d\n", x->ealg->alg_key_len);
+ err = -EINVAL;
+ goto error;
+ }
+ break;
+ default:
+ nn_err(nn, "Unsupported encryption algorithm for offload\n");
+ err = -EINVAL;
+ goto error;
+ }
+
+ if (x->aead) {
+ int salt_len = 4;
+
+ p = (__be32 *)x->aead->alg_key;
+ key_len = DIV_ROUND_UP(x->aead->alg_key_len, BITS_PER_BYTE);
+ key_len -= salt_len;
+
+ if (key_len > sizeof(cfg->ciph_key)) {
+ nn_err(nn, "Insufficient space for offloaded key\n");
+ err = -EINVAL;
+ goto error;
+ }
+
+ for (i = 0; i < key_len / sizeof(cfg->ciph_key[0]) ; i++)
+ cfg->ciph_key[i] = ntohl(*p++);
+
+ /* Load up the salt */
+ for (i = 0; i < salt_len; i++)
+ cfg->auth_key[i] = ntohl(*p++);
+ }
+
+ if (x->ealg) {
+ p = (__be32 *)x->ealg->alg_key;
+ key_len = DIV_ROUND_UP(x->ealg->alg_key_len, BITS_PER_BYTE);
+
+ if (key_len > sizeof(cfg->ciph_key)) {
+ nn_err(nn, "Insufficient space for offloaded key\n");
+ err = -EINVAL;
+ goto error;
+ }
+ for (i = 0; i < key_len / sizeof(cfg->ciph_key[0]) ; i++)
+ cfg->ciph_key[i] = ntohl(*p++);
+ }
+ /* IP related info */
+ switch (x->props.family) {
+ case AF_INET:
+ cfg->ipv6 = 0;
+ cfg->src_ip[0] = ntohl(x->props.saddr.a4);
+ cfg->dst_ip[0] = ntohl(x->id.daddr.a4);
+ break;
+ case AF_INET6:
+ cfg->ipv6 = 1;
+ for (i = 0; i < 4; i++) {
+ cfg->src_ip[i] = ntohl(x->props.saddr.a6[i]);
+ cfg->dst_ip[i] = ntohl(x->id.daddr.a6[i]);
+ }
+ break;
+ default:
+ nn_err(nn, "Unsupported address family\n");
+ err = -EINVAL;
+ goto error;
+ }
+
+ /* Maximum nic ipsec code could handle. Other limits may apply. */
+ cfg->pmtu_limit = 0xffff;
+
+ /* Host will generate the sequence numbers so that if packets get
+ * fragmented in host, sequence numbers will stay in sync.
+ */
+ cfg->ctrl_word.gen_seq = 0;
+
+ cfg->ctrl_word.encap_dsbl = 1;
+
+ /* Sa direction */
+ cfg->ctrl_word.dir = x->xso.dir;
+
+ /* Allocate saidx and commit the Sa */
+ ipd->sa_free_cnt -= 1;
+ sa_data->invalidated = 0;
+ sa_data->x = x;
+ x->xso.offload_handle = saidx + 1;
+ err = nfp_ipsec_cfg_cmd_issue(nn, NFP_IPSEC_CFG_MSSG_ADD_SA, saidx, &msg);
+ if (err) {
+ nn_err(nn, "Failed to issue ipsec command err ret=%d\n", err);
+ goto error;
+ }
+
+ mutex_unlock(&ipd->lock);
+
+ nn_dbg(nn, "Successfully offload saidx %d\n", saidx);
+ return 0;
+error:
+ if (saidx < 0) {
+ ipd->sa_free_stack[ipd->sa_free_cnt] = saidx;
+ ipd->sa_free_cnt++;
+ }
+ mutex_unlock(&ipd->lock);
+ x->xso.offload_handle = OFFLOAD_HANDLE_ERROR;
+ return err;
+}
+
+static void xfrm_invalidate(struct nfp_net *nn, unsigned int saidx, int is_del)
+{
+ struct nfp_net_ipsec_data *ipd = nn->ipsec_data;
+ struct nfp_net_ipsec_sa_data *sa_data;
+ struct nfp_ipsec_cfg_mssg msg;
+ int err;
+
+ sa_data = &ipd->sa_entries[saidx];
+ if (!sa_data->invalidated) {
+ err = nfp_ipsec_cfg_cmd_issue(nn, NFP_IPSEC_CFG_MSSG_INV_SA, saidx, &msg);
+ if (err)
+ nn_warn(nn, "Failed to invalidate SA in hardware\n");
+ sa_data->invalidated = 1;
+ } else if (is_del) {
+ nn_warn(nn, "Unexpected invalidate state for offloaded saidx %d\n", saidx);
+ }
}
static void nfp_net_xfrm_del_state(struct xfrm_state *x)
{
+ struct net_device *netdev = x->xso.dev;
+ struct nfp_net_ipsec_data *ipd;
+ struct nfp_net *nn;
+
+ nn = netdev_priv(netdev);
+ ipd = nn->ipsec_data;
+
+ nn_dbg(nn, "XFRM del state!\n");
+
+ if (x->xso.offload_handle == OFFLOAD_HANDLE_ERROR) {
+ nn_err(nn, "Invalid xfrm offload handle\n");
+ return;
+ }
+
+ mutex_lock(&ipd->lock);
+ xfrm_invalidate(nn, x->xso.offload_handle - 1, 1);
+ mutex_unlock(&ipd->lock);
}
static void nfp_net_xfrm_free_state(struct xfrm_state *x)
{
+ struct net_device *netdev = x->xso.dev;
+ struct nfp_net_ipsec_data *ipd;
+ struct nfp_net *nn;
+ int saidx;
+
+ nn = netdev_priv(netdev);
+ ipd = nn->ipsec_data;
+
+ nn_dbg(nn, "XFRM free state!\n");
+
+ if (x->xso.offload_handle == OFFLOAD_HANDLE_ERROR) {
+ nn_err(nn, "Invalid xfrm offload handle\n");
+ return;
+ }
+
+ mutex_lock(&ipd->lock);
+ saidx = x->xso.offload_handle - 1;
+ xfrm_invalidate(nn, saidx, 0);
+ ipd->sa_entries[saidx].x = NULL;
+ /* Return saidx to free list */
+ ipd->sa_free_stack[ipd->sa_free_cnt] = saidx;
+ ipd->sa_free_cnt++;
+
+ mutex_unlock(&ipd->lock);
}
static bool nfp_net_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
{
- return false;
+ if (x->props.family == AF_INET) {
+ /* Offload with IPv4 options is not supported yet */
+ if (ip_hdr(skb)->ihl != 5)
+ return false;
+ } else if (x->props.family == AF_INET6) {
+ /* Offload with IPv6 extension headers is not support yet */
+ if (ipv6_ext_hdr(ipv6_hdr(skb)->nexthdr))
+ return false;
+ } else {
+ return false;
+ }
+
+ return true;
}
static const struct xfrmdev_ops nfp_net_ipsec_xfrmdev_ops = {
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 040c0c2aad80..0e48e2887278 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -2375,6 +2375,12 @@ static void nfp_net_netdev_init(struct nfp_net *nn)
}
if (nn->cap & NFP_NET_CFG_CTRL_RSS_ANY)
netdev->hw_features |= NETIF_F_RXHASH;
+
+#ifdef CONFIG_NFP_NET_IPSEC
+ if (nn->cap_w1 & NFP_NET_CFG_CTRL_IPSEC)
+ netdev->hw_features |= NETIF_F_HW_ESP | NETIF_F_HW_ESP_TX_CSUM;
+#endif
+
if (nn->cap & NFP_NET_CFG_CTRL_VXLAN) {
if (nn->cap & NFP_NET_CFG_CTRL_LSO) {
netdev->hw_features |= NETIF_F_GSO_UDP_TUNNEL |
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
index fff05496152d..b7e62d1186ca 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
@@ -399,14 +399,14 @@
*/
#define NFP_NET_CFG_MBOX_BASE 0x1800
#define NFP_NET_CFG_MBOX_VAL_MAX_SZ 0x1F8
-
+#define NFP_NET_CFG_MBOX_VAL 0x1808
#define NFP_NET_CFG_MBOX_SIMPLE_CMD 0x0
#define NFP_NET_CFG_MBOX_SIMPLE_RET 0x4
#define NFP_NET_CFG_MBOX_SIMPLE_VAL 0x8
#define NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_ADD 1
#define NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_KILL 2
-
+#define NFP_NET_CFG_MBOX_CMD_IPSEC 3
#define NFP_NET_CFG_MBOX_CMD_PCI_DSCP_PRIOMAP_SET 5
#define NFP_NET_CFG_MBOX_CMD_TLV_CMSG 6
--
2.30.2
^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v2 0/3] nfp: IPsec offload support
2022-09-27 10:27 [PATCH net-next v2 0/3] nfp: IPsec offload support Simon Horman
` (2 preceding siblings ...)
2022-09-27 10:27 ` [PATCH net-next v2 3/3] nfp: implement xfrm callbacks and expose ipsec offload feature to upper layer Simon Horman
@ 2022-09-29 2:42 ` Jakub Kicinski
2022-09-29 8:48 ` Simon Horman
3 siblings, 1 reply; 12+ messages in thread
From: Jakub Kicinski @ 2022-09-29 2:42 UTC (permalink / raw)
To: Simon Horman
Cc: David Miller, Paolo Abeni, netdev, oss-drivers, Leon Romanovsky,
Huanhuan Wang
On Tue, 27 Sep 2022 12:27:04 +0200 Simon Horman wrote:
> this short series is support IPsec offload for the NFP driver.
>
> It covers three enhancements:
>
> 1. Patches 1/3:
> - Extend the capability word and control word to to support
> new features.
>
> 2. Patch 2/3:
> - Add framework to support IPsec offloading for NFP driver,
> but IPsec offload control plane interface xfrm callbacks which
> interact with upper layer are not implemented in this patch.
>
> 3. Patch 3/3:
> - IPsec control plane interface xfrm callbacks are implemented
> in this patch.
Should this not CC Steffen?
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v2 2/3] nfp: add framework to support ipsec offloading
2022-09-27 10:27 ` [PATCH net-next v2 2/3] nfp: add framework to support ipsec offloading Simon Horman
@ 2022-09-29 8:10 ` Leon Romanovsky
[not found] ` <20221010070512.GA21559@nj-rack01-04.nji.corigine.com>
0 siblings, 1 reply; 12+ messages in thread
From: Leon Romanovsky @ 2022-09-29 8:10 UTC (permalink / raw)
To: Simon Horman
Cc: David Miller, Jakub Kicinski, Paolo Abeni, netdev, oss-drivers,
Huanhuan Wang
On Tue, Sep 27, 2022 at 12:27:06PM +0200, Simon Horman wrote:
> From: Huanhuan Wang <huanhuan.wang@corigine.com>
>
> A new metadata type and config structure are introduced to
> interact with firmware to support ipsec offloading. This
> feature relies on specific firmware that supports ipsec
> encrypt/decrypt by advertising related capability bit.
>
> The xfrm callbacks which interact with upper layer are
> implemented in the following patch.
>
> Based on initial work of Norm Bagley <norman.bagley@netronome.com>.
>
> Signed-off-by: Huanhuan Wang <huanhuan.wang@corigine.com>
> Signed-off-by: Simon Horman <simon.horman@corigine.com>
> ---
> drivers/net/ethernet/netronome/Kconfig | 11 +
> drivers/net/ethernet/netronome/nfp/Makefile | 6 +
> .../ethernet/netronome/nfp/crypto/crypto.h | 35 +++
> .../net/ethernet/netronome/nfp/crypto/ipsec.c | 216 ++++++++++++++++++
> drivers/net/ethernet/netronome/nfp/nfd3/dp.c | 43 +++-
> .../net/ethernet/netronome/nfp/nfd3/ipsec.c | 19 ++
> .../net/ethernet/netronome/nfp/nfd3/nfd3.h | 8 +
> drivers/net/ethernet/netronome/nfp/nfp_net.h | 9 +
> .../ethernet/netronome/nfp/nfp_net_common.c | 10 +-
> .../net/ethernet/netronome/nfp/nfp_net_ctrl.h | 4 +
> 10 files changed, 354 insertions(+), 7 deletions(-)
> create mode 100644 drivers/net/ethernet/netronome/nfp/crypto/ipsec.c
> create mode 100644 drivers/net/ethernet/netronome/nfp/nfd3/ipsec.c
>
> diff --git a/drivers/net/ethernet/netronome/Kconfig b/drivers/net/ethernet/netronome/Kconfig
> index 8844d1ac053a..7f669d39e471 100644
> --- a/drivers/net/ethernet/netronome/Kconfig
> +++ b/drivers/net/ethernet/netronome/Kconfig
> @@ -54,6 +54,17 @@ config NFP_APP_ABM_NIC
> functionality.
> Code will be built into the nfp.ko driver.
>
> +config NFP_NET_IPSEC
> + bool "NFP Ipsec offload support"
You are adding "IPsec crypto offload", please be specific in all places.
> + depends on NFP
> + depends on XFRM_OFFLOAD
> + default y
> + help
> + Enable driver support Ipsec offload on NFP NIC. Say Y, if
> + you are planning to make use of Ipsec offload.
> + NOTE that Ipsec offload on NFP Nic requires specific FW to
> + work.
> +
> config NFP_DEBUG
> bool "Debug support for Netronome(R) NFP4000/NFP6000 NIC drivers"
> depends on NFP
> diff --git a/drivers/net/ethernet/netronome/nfp/Makefile b/drivers/net/ethernet/netronome/nfp/Makefile
> index 9c0861d03634..3d33b2838e0d 100644
> --- a/drivers/net/ethernet/netronome/nfp/Makefile
> +++ b/drivers/net/ethernet/netronome/nfp/Makefile
> @@ -80,4 +80,10 @@ nfp-objs += \
> abm/main.o
> endif
>
> +ifeq ($(CONFIG_NFP_NET_IPSEC),y)
Just curious, why ifeq and not nfp-$(...) format?
> +nfp-objs += \
> + crypto/ipsec.o \
> + nfd3/ipsec.o
> +endif
> +
> nfp-$(CONFIG_NFP_DEBUG) += nfp_net_debugfs.o
> diff --git a/drivers/net/ethernet/netronome/nfp/crypto/crypto.h b/drivers/net/ethernet/netronome/nfp/crypto/crypto.h
> index bffe58bb2f27..a27a378e3ebe 100644
> --- a/drivers/net/ethernet/netronome/nfp/crypto/crypto.h
> +++ b/drivers/net/ethernet/netronome/nfp/crypto/crypto.h
> @@ -39,4 +39,39 @@ nfp_net_tls_rx_resync_req(struct net_device *netdev,
> }
> #endif
>
> +/* Ipsec related structures and functions */
> +struct nfp_ipsec_offload {
> + u32 seq_hi;
> + u32 seq_low;
> + u32 handle;
> +};
> +
> +#ifndef CONFIG_NFP_NET_IPSEC
> +static inline int nfp_net_ipsec_init(struct nfp_net *nn)
> +{
> + return 0;
> +}
> +
> +static inline void nfp_net_ipsec_clean(struct nfp_net *nn)
> +{
> +}
> +
> +static inline bool nfp_net_ipsec_tx_prep(struct nfp_net_dp *dp, struct sk_buff *skb,
> + struct nfp_ipsec_offload *offload_info)
> +{
> + return false;
> +}
> +
> +static inline int nfp_net_ipsec_rx(struct nfp_meta_parsed *meta, struct sk_buff *skb)
> +{
> + return 0;
> +}
> +#else
> +int nfp_net_ipsec_init(struct nfp_net *nn);
> +void nfp_net_ipsec_clean(struct nfp_net *nn);
> +bool nfp_net_ipsec_tx_prep(struct nfp_net_dp *dp, struct sk_buff *skb,
> + struct nfp_ipsec_offload *offload_info);
> +int nfp_net_ipsec_rx(struct nfp_meta_parsed *meta, struct sk_buff *skb);
> +#endif
> +
> #endif
> diff --git a/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c b/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c
> new file mode 100644
> index 000000000000..658fcba8e733
> --- /dev/null
> +++ b/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c
> @@ -0,0 +1,216 @@
> +// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
> +/* Copyright (C) 2018 Netronome Systems, Inc */
> +/* Copyright (C) 2021 Corigine, Inc */
> +
> +#include <linux/module.h>
> +#include <linux/kernel.h>
> +#include <linux/init.h>
> +#include <linux/netdevice.h>
> +#include <asm/unaligned.h>
> +#include <linux/ktime.h>
> +#include <net/xfrm.h>
> +
> +#include "../nfp_net_ctrl.h"
> +#include "../nfp_net.h"
> +#include "crypto.h"
> +
> +#define NFP_NET_IPSEC_MAX_SA_CNT (16 * 1024) /* Firmware support a maximum of 16K sa offload */
> +#define OFFLOAD_HANDLE_ERROR 0xffffffff
You don't set this define in this patch, so why can't 0 be non-valid?
> +
> +/* IPSEC_CFG_MSSG_ADD_SA */
> +struct nfp_ipsec_cfg_add_sa {
> + u32 ciph_key[8]; /* Cipher Key */
> + union {
> + u32 auth_key[16]; /* Authentication Key */
> + struct nfp_ipsec_aesgcm { /* AES-GCM-ESP fields */
> + u32 salt; /* Initialized with sa */
> + u32 iv[2]; /* Firmware use only */
> + u32 cntr;
> + u32 zeros[4]; /* Init to 0 with sa */
> + u32 len_a[2]; /* Firmware use only */
> + u32 len_c[2];
> + u32 spare0[4];
> + } aesgcm_fields;
> + };
> + struct sa_ctrl_word {
> + uint32_t hash :4; /* From nfp_ipsec_sa_hash_type */
> + uint32_t cimode :4; /* From nfp_ipsec_sa_cipher_mode */
> + uint32_t cipher :4; /* From nfp_ipsec_sa_cipher */
> + uint32_t mode :2; /* From nfp_ipsec_sa_mode */
> + uint32_t proto :2; /* From nfp_ipsec_sa_prot */
> + uint32_t dir :1; /* Sa direction */
> + uint32_t ena_arw:1; /* Anti-Replay Window */
> + uint32_t ext_seq:1; /* 64-bit Sequence Num */
> + uint32_t ext_arw:1; /* 64b Anti-Replay Window */
> + uint32_t spare2 :9; /* Must be set to 0 */
> + uint32_t encap_dsbl:1; /* Encap/decap disable */
> + uint32_t gen_seq:1; /* Firmware Generate Seq */
> + uint32_t spare8 :1; /* Must be set to 0 */
> + } ctrl_word;
> + u32 spi; /* SPI Value */
> + uint32_t pmtu_limit :16; /* PMTU Limit */
> + uint32_t spare3 :1;
> + uint32_t frag_check :1; /* Stateful fragment checking flag */
> + uint32_t bypass_DSCP:1; /* Bypass DSCP Flag */
> + uint32_t df_ctrl :2; /* DF Control bits */
> + uint32_t ipv6 :1; /* Outbound IPv6 addr format */
> + uint32_t udp_enable :1; /* Add/Remove UDP header for NAT */
> + uint32_t tfc_enable :1; /* Traffic Flow Confidentiality */
> + uint32_t spare4 :8;
> + u32 soft_lifetime_byte_count;
> + u32 hard_lifetime_byte_count;
> + u32 src_ip[4]; /* Src IP addr */
> + u32 dst_ip[4]; /* Dst IP addr */
> + uint32_t natt_dst_port :16; /* NAT-T UDP Header dst port */
> + uint32_t natt_src_port :16; /* NAT-T UDP Header src port */
> + u32 soft_lifetime_time_limit;
> + u32 hard_lifetime_time_limit;
> + u32 sa_creation_time_lo_32; /* Ucode fills this in */
> + u32 sa_creation_time_hi_32; /* Ucode fills this in */
> + uint32_t reserved0 :16;
> + uint32_t tfc_padding :16; /* Traffic Flow Confidential Pad */
> +};
> +
> +struct nfp_net_ipsec_sa_data {
> + struct nfp_ipsec_cfg_add_sa nfp_sa;
> + struct xfrm_state *x;
> + int invalidated;
> +};
> +
> +struct nfp_net_ipsec_data {
> + struct nfp_net_ipsec_sa_data sa_entries[NFP_NET_IPSEC_MAX_SA_CNT];
> + unsigned int sa_free_stack[NFP_NET_IPSEC_MAX_SA_CNT];
> + unsigned int sa_free_cnt;
I don't see in this patch what are you doing with this free_stack array,
but whole nfp_net_ipsec_data is more than 32Kb of arrays.
> + struct mutex lock; /* Protects nfp_net_ipsec_data struct */
> +};
> +
> +static int nfp_net_xfrm_add_state(struct xfrm_state *x)
> +{
> + return -EOPNOTSUPP;
> +}
> +
> +static void nfp_net_xfrm_del_state(struct xfrm_state *x)
> +{
> +}
> +
> +static void nfp_net_xfrm_free_state(struct xfrm_state *x)
> +{
> +}
> +
> +static bool nfp_net_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
> +{
> + return false;
> +}
> +
> +static const struct xfrmdev_ops nfp_net_ipsec_xfrmdev_ops = {
> + .xdo_dev_state_add = nfp_net_xfrm_add_state,
> + .xdo_dev_state_delete = nfp_net_xfrm_del_state,
> + .xdo_dev_state_free = nfp_net_xfrm_free_state,
> + .xdo_dev_offload_ok = nfp_net_ipsec_offload_ok,
> +};
> +
> +int nfp_net_ipsec_init(struct nfp_net *nn)
> +{
> + if (nn->cap_w1 & NFP_NET_CFG_CTRL_IPSEC) {
Success oriented flow, please
If (...)
return 0;
....
> + struct nfp_net_ipsec_data *ipd;
> + int i;
> +
> + nn->dp.netdev->xfrmdev_ops = &nfp_net_ipsec_xfrmdev_ops;
You set ops before nn->ipsec_data which requires from you always check
the validity of nn->ipsec_data in xfrm calls.
Please set it when this init can't fail and remove checks in your xfrm
callbacks, because XFRM will call for already initialized nfp ipsec
core.
> +
> + ipd = kzalloc(sizeof(*ipd), GFP_KERNEL);
> + if (!ipd)
> + return -ENOMEM;
> +
> + for (i = 0; i < NFP_NET_IPSEC_MAX_SA_CNT; i++)
> + ipd->sa_free_stack[i] = NFP_NET_IPSEC_MAX_SA_CNT - i - 1;
> +
> + ipd->sa_free_cnt = NFP_NET_IPSEC_MAX_SA_CNT;
> + mutex_init(&ipd->lock);
> + nn->ipsec_data = ipd;
> + }
> +
> + return 0;
> +}
> +
> +void nfp_net_ipsec_clean(struct nfp_net *nn)
> +{
> + if (!nn->ipsec_data)
> + return;
> +
> + mutex_destroy(&nn->ipsec_data->lock);
> + kfree(nn->ipsec_data);
> + nn->ipsec_data = NULL;
Can you call again to nfp_net_ipsec_clean() after this line?
If not, please remove NULL assignment. It hides bugs.
> +}
> +
> +bool nfp_net_ipsec_tx_prep(struct nfp_net_dp *dp, struct sk_buff *skb,
> + struct nfp_ipsec_offload *offload_info)
> +{
> + struct xfrm_offload *xo = xfrm_offload(skb);
> + struct xfrm_state *x;
> +
> + if (!xo)
> + return false;
How is it possible in offload path?
Why do all drivers check sec_path length and not xo?
> +
> + x = xfrm_input_state(skb);
> + if (!x)
> + return false;
> +
> + if (x->xso.offload_handle == OFFLOAD_HANDLE_ERROR) {
> + nn_dp_warn(dp, "Invalid xfrm offload handle\n");
> + return false;
> + }
> +
> + offload_info->seq_hi = xo->seq.hi;
> + offload_info->seq_low = xo->seq.low;
> + offload_info->handle = x->xso.offload_handle;
> +
> + return true;
> +}
> +
> +int nfp_net_ipsec_rx(struct nfp_meta_parsed *meta, struct sk_buff *skb)
> +{
> + struct nfp_net_ipsec_sa_data *sa_data;
> + struct net_device *netdev = skb->dev;
> + struct nfp_net_ipsec_data *ipd;
> + struct xfrm_offload *xo;
> + struct nfp_net_dp *dp;
> + struct xfrm_state *x;
> + struct sec_path *sp;
> + struct nfp_net *nn;
> + int saidx;
> +
> + nn = netdev_priv(netdev);
> + ipd = nn->ipsec_data;
> + dp = &nn->dp;
> +
> + if (meta->ipsec_saidx == 0)
> + return 0; /* No offload took place */
> +
> + saidx = meta->ipsec_saidx - 1;
> + if (saidx > NFP_NET_IPSEC_MAX_SA_CNT || saidx < 0) {
> + nn_dp_warn(dp, "Invalid SAIDX from NIC %d\n", saidx);
No prints in data path that can be triggered from the network, please.
> + return -EINVAL;
> + }
> +
> + sa_data = &ipd->sa_entries[saidx];
> + if (!sa_data->x) {
> + nn_dp_warn(dp, "Unused SAIDX from NIC %d\n", saidx);
> + return -EINVAL;
> + }
> +
> + x = sa_data->x;
> + xfrm_state_hold(x);
You should call to xfrm_state_hold() after secpath_set(), because in
failure of latter you will leak reference to state.
> + sp = secpath_set(skb);
> + if (unlikely(!sp)) {
> + nn_dp_warn(dp, "Failed to alloc secpath for RX offload\n");
> + return -ENOMEM;
> + }
> +
> + sp->xvec[sp->len++] = x;
> + sp->olen++;
> + xo = xfrm_offload(skb);
> + xo->flags = CRYPTO_DONE;
> + xo->status = CRYPTO_SUCCESS;
> +
> + return 0;
> +}
> diff --git a/drivers/net/ethernet/netronome/nfp/nfd3/dp.c b/drivers/net/ethernet/netronome/nfp/nfd3/dp.c
> index 448c1c1afaee..db53e0392923 100644
> --- a/drivers/net/ethernet/netronome/nfp/nfd3/dp.c
> +++ b/drivers/net/ethernet/netronome/nfp/nfd3/dp.c
> @@ -167,14 +167,18 @@ nfp_nfd3_tx_csum(struct nfp_net_dp *dp, struct nfp_net_r_vector *r_vec,
> u64_stats_update_end(&r_vec->tx_sync);
> }
>
> -static int nfp_nfd3_prep_tx_meta(struct nfp_net_dp *dp, struct sk_buff *skb, u64 tls_handle)
> +static int nfp_nfd3_prep_tx_meta(struct nfp_net_dp *dp, struct sk_buff *skb,
> + u64 tls_handle, bool *ipsec)
> {
> struct metadata_dst *md_dst = skb_metadata_dst(skb);
> + struct nfp_ipsec_offload offload_info;
> unsigned char *data;
> bool vlan_insert;
> u32 meta_id = 0;
> int md_bytes;
>
> + *ipsec = nfp_net_ipsec_tx_prep(dp, skb, &offload_info);
> +
> if (unlikely(md_dst || tls_handle)) {
> if (unlikely(md_dst && md_dst->type != METADATA_HW_PORT_MUX))
> md_dst = NULL;
> @@ -182,13 +186,14 @@ static int nfp_nfd3_prep_tx_meta(struct nfp_net_dp *dp, struct sk_buff *skb, u64
>
> vlan_insert = skb_vlan_tag_present(skb) && (dp->ctrl & NFP_NET_CFG_CTRL_TXVLAN_V2);
>
> - if (!(md_dst || tls_handle || vlan_insert))
> + if (!(md_dst || tls_handle || vlan_insert || *ipsec))
> return 0;
>
> md_bytes = sizeof(meta_id) +
> !!md_dst * NFP_NET_META_PORTID_SIZE +
> !!tls_handle * NFP_NET_META_CONN_HANDLE_SIZE +
> - vlan_insert * NFP_NET_META_VLAN_SIZE;
> + vlan_insert * NFP_NET_META_VLAN_SIZE +
> + *ipsec * NFP_NET_META_IPSEC_FIELD_SIZE; /* Ipsec has 12-bytes metadata */
>
> if (unlikely(skb_cow_head(skb, md_bytes)))
> return -ENOMEM;
> @@ -218,6 +223,19 @@ static int nfp_nfd3_prep_tx_meta(struct nfp_net_dp *dp, struct sk_buff *skb, u64
> meta_id <<= NFP_NET_META_FIELD_SIZE;
> meta_id |= NFP_NET_META_VLAN;
> }
> + if (*ipsec) {
> + /* The ipsec has three consecutive 4-bit ipsec Metadate types
> + * so ipsec has three 4-bytes of Metadata
> + */
> + data -= NFP_NET_META_IPSEC_SIZE;
> + put_unaligned_be32(offload_info.seq_hi, data);
> + data -= NFP_NET_META_IPSEC_SIZE;
> + put_unaligned_be32(offload_info.seq_low, data);
> + data -= NFP_NET_META_IPSEC_SIZE;
> + put_unaligned_be32(offload_info.handle - 1, data);
> + meta_id <<= NFP_NET_META_IPSEC_FIELD_SIZE;
> + meta_id |= NFP_NET_META_IPSEC << 8 | NFP_NET_META_IPSEC << 4 | NFP_NET_META_IPSEC;
> + }
>
> data -= sizeof(meta_id);
> put_unaligned_be32(meta_id, data);
> @@ -246,6 +264,7 @@ netdev_tx_t nfp_nfd3_tx(struct sk_buff *skb, struct net_device *netdev)
> dma_addr_t dma_addr;
> unsigned int fsize;
> u64 tls_handle = 0;
> + bool ipsec = false;
> u16 qidx;
>
> dp = &nn->dp;
> @@ -273,7 +292,7 @@ netdev_tx_t nfp_nfd3_tx(struct sk_buff *skb, struct net_device *netdev)
> return NETDEV_TX_OK;
> }
>
> - md_bytes = nfp_nfd3_prep_tx_meta(dp, skb, tls_handle);
> + md_bytes = nfp_nfd3_prep_tx_meta(dp, skb, tls_handle, &ipsec);
> if (unlikely(md_bytes < 0))
> goto err_flush;
>
> @@ -312,6 +331,8 @@ netdev_tx_t nfp_nfd3_tx(struct sk_buff *skb, struct net_device *netdev)
> txd->vlan = cpu_to_le16(skb_vlan_tag_get(skb));
> }
>
> + if (ipsec)
> + nfp_nfd3_ipsec_tx(txd, skb);
> /* Gather DMA */
> if (nr_frags > 0) {
> __le64 second_half;
> @@ -764,6 +785,12 @@ nfp_nfd3_parse_meta(struct net_device *netdev, struct nfp_meta_parsed *meta,
> return false;
> data += sizeof(struct nfp_net_tls_resync_req);
> break;
> +#ifdef CONFIG_NFP_NET_IPSEC
> + case NFP_NET_META_IPSEC:
> + meta->ipsec_saidx = get_unaligned_be32(data) + 1;
> + data += 4;
> + break;
> +#endif
> default:
> return true;
> }
> @@ -876,12 +903,11 @@ static int nfp_nfd3_rx(struct nfp_net_rx_ring *rx_ring, int budget)
> struct nfp_net_dp *dp = &r_vec->nfp_net->dp;
> struct nfp_net_tx_ring *tx_ring;
> struct bpf_prog *xdp_prog;
> + int idx, pkts_polled = 0;
> bool xdp_tx_cmpl = false;
> unsigned int true_bufsz;
> struct sk_buff *skb;
> - int pkts_polled = 0;
> struct xdp_buff xdp;
> - int idx;
>
> xdp_prog = READ_ONCE(dp->xdp_prog);
> true_bufsz = xdp_prog ? PAGE_SIZE : dp->fl_bufsz;
> @@ -1081,6 +1107,11 @@ static int nfp_nfd3_rx(struct nfp_net_rx_ring *rx_ring, int budget)
> continue;
> }
>
> + if (unlikely(nfp_net_ipsec_rx(&meta, skb))) {
> + nfp_nfd3_rx_drop(dp, r_vec, rx_ring, NULL, skb);
Silent drop without any user visible counters, ok.
> + continue;
> + }
> +
> if (meta_len_xdp)
> skb_metadata_set(skb, meta_len_xdp);
>
> diff --git a/drivers/net/ethernet/netronome/nfp/nfd3/ipsec.c b/drivers/net/ethernet/netronome/nfp/nfd3/ipsec.c
> new file mode 100644
> index 000000000000..f0d74d6b49d0
> --- /dev/null
> +++ b/drivers/net/ethernet/netronome/nfp/nfd3/ipsec.c
> @@ -0,0 +1,19 @@
> +// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
> +/* Copyright (C) 2018 Netronome Systems, Inc */
> +/* Copyright (C) 2021 Corigine, Inc */
> +
> +#include <net/xfrm.h>
> +
> +#include "../nfp_net.h"
> +#include "nfd3.h"
> +
> +void nfp_nfd3_ipsec_tx(struct nfp_nfd3_tx_desc *txd, struct sk_buff *skb)
> +{
> + struct xfrm_state *x;
> +
> + x = xfrm_input_state(skb);
> + if (x->xso.dev && (x->xso.dev->features & NETIF_F_HW_ESP_TX_CSUM)) {
> + txd->flags |= NFD3_DESC_TX_CSUM | NFD3_DESC_TX_IP4_CSUM |
> + NFD3_DESC_TX_TCP_CSUM | NFD3_DESC_TX_UDP_CSUM;
> + }
> +}
> diff --git a/drivers/net/ethernet/netronome/nfp/nfd3/nfd3.h b/drivers/net/ethernet/netronome/nfp/nfd3/nfd3.h
> index 7a0df9e6c3c4..9c1c10dcbaee 100644
> --- a/drivers/net/ethernet/netronome/nfp/nfd3/nfd3.h
> +++ b/drivers/net/ethernet/netronome/nfp/nfd3/nfd3.h
> @@ -103,4 +103,12 @@ void nfp_nfd3_rx_ring_fill_freelist(struct nfp_net_dp *dp,
> void nfp_nfd3_xsk_tx_free(struct nfp_nfd3_tx_buf *txbuf);
> int nfp_nfd3_xsk_poll(struct napi_struct *napi, int budget);
>
> +#ifndef CONFIG_NFP_NET_IPSEC
> +static inline void nfp_nfd3_ipsec_tx(struct nfp_nfd3_tx_desc *txd, struct sk_buff *skb)
> +{
> +}
> +#else
> +void nfp_nfd3_ipsec_tx(struct nfp_nfd3_tx_desc *txd, struct sk_buff *skb);
> +#endif
> +
> #endif
> diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net.h b/drivers/net/ethernet/netronome/nfp/nfp_net.h
> index 0c3e7e2f856d..768539f12214 100644
> --- a/drivers/net/ethernet/netronome/nfp/nfp_net.h
> +++ b/drivers/net/ethernet/netronome/nfp/nfp_net.h
> @@ -263,6 +263,10 @@ struct nfp_meta_parsed {
> u8 tpid;
> u16 tci;
> } vlan;
> +
> +#ifdef CONFIG_NFP_NET_IPSEC
> + u32 ipsec_saidx;
> +#endif
> };
>
> struct nfp_net_rx_hash {
> @@ -584,6 +588,7 @@ struct nfp_net_dp {
> * @qcp_cfg: Pointer to QCP queue used for configuration notification
> * @tx_bar: Pointer to mapped TX queues
> * @rx_bar: Pointer to mapped FL/RX queues
> + * @ipsec_data: Ipsec Sa data
> * @tlv_caps: Parsed TLV capabilities
> * @ktls_tx_conn_cnt: Number of offloaded kTLS TX connections
> * @ktls_rx_conn_cnt: Number of offloaded kTLS RX connections
> @@ -672,6 +677,10 @@ struct nfp_net {
> u8 __iomem *tx_bar;
> u8 __iomem *rx_bar;
>
> +#ifdef CONFIG_NFP_NET_IPSEC
> + struct nfp_net_ipsec_data *ipsec_data;
> +#endif
> +
> struct nfp_net_tlv_caps tlv_caps;
>
> unsigned int ktls_tx_conn_cnt;
> diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
> index 7e4424d626a6..040c0c2aad80 100644
> --- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
> +++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
> @@ -2565,9 +2565,13 @@ int nfp_net_init(struct nfp_net *nn)
> if (err)
> return err;
>
> - err = nfp_net_tls_init(nn);
> + err = nfp_net_ipsec_init(nn);
> if (err)
> goto err_clean_mbox;
> +
> + err = nfp_net_tls_init(nn);
> + if (err)
> + goto err_clean_ipsec;
> }
>
> nfp_net_vecs_init(nn);
> @@ -2576,6 +2580,9 @@ int nfp_net_init(struct nfp_net *nn)
> return 0;
> return register_netdev(nn->dp.netdev);
>
> +err_clean_ipsec:
> + nfp_net_ipsec_clean(nn);
> +
> err_clean_mbox:
> nfp_ccm_mbox_clean(nn);
> return err;
> @@ -2591,6 +2598,7 @@ void nfp_net_clean(struct nfp_net *nn)
> return;
>
> unregister_netdev(nn->dp.netdev);
> + nfp_net_ipsec_clean(nn);
> nfp_ccm_mbox_clean(nn);
> nfp_net_reconfig_wait_posted(nn);
> }
> diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
> index 80346c1c266b..fff05496152d 100644
> --- a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
> +++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
> @@ -45,6 +45,7 @@
> #define NFP_NET_META_CSUM 6 /* checksum complete type */
> #define NFP_NET_META_CONN_HANDLE 7
> #define NFP_NET_META_RESYNC_INFO 8 /* RX resync info request */
> +#define NFP_NET_META_IPSEC 9 /* IPSec SA index for tx and rx */
>
> #define NFP_META_PORT_ID_CTRL ~0U
>
> @@ -52,6 +53,8 @@
> #define NFP_NET_META_VLAN_SIZE 4
> #define NFP_NET_META_PORTID_SIZE 4
> #define NFP_NET_META_CONN_HANDLE_SIZE 8
> +#define NFP_NET_META_IPSEC_SIZE 4
> +#define NFP_NET_META_IPSEC_FIELD_SIZE 12
> /* Hash type pre-pended when a RSS hash was computed */
> #define NFP_NET_RSS_NONE 0
> #define NFP_NET_RSS_IPV4 1
> @@ -260,6 +263,7 @@
> */
> #define NFP_NET_CFG_CTRL_WORD1 0x0098
> #define NFP_NET_CFG_CTRL_PKT_TYPE (0x1 << 0) /* Pkttype offload */
> +#define NFP_NET_CFG_CTRL_IPSEC (0x1 << 1) /* IPSec offload */
>
> #define NFP_NET_CFG_CAP_WORD1 0x00a4
>
> --
> 2.30.2
>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v2 3/3] nfp: implement xfrm callbacks and expose ipsec offload feature to upper layer
2022-09-27 10:27 ` [PATCH net-next v2 3/3] nfp: implement xfrm callbacks and expose ipsec offload feature to upper layer Simon Horman
@ 2022-09-29 8:26 ` Leon Romanovsky
2022-10-10 7:14 ` Yinjun Zhang
0 siblings, 1 reply; 12+ messages in thread
From: Leon Romanovsky @ 2022-09-29 8:26 UTC (permalink / raw)
To: Simon Horman
Cc: David Miller, Jakub Kicinski, Paolo Abeni, netdev, oss-drivers,
Huanhuan Wang
On Tue, Sep 27, 2022 at 12:27:07PM +0200, Simon Horman wrote:
> From: Huanhuan Wang <huanhuan.wang@corigine.com>
>
> Xfrm callbacks are implemented to offload SA info into firmware
> by mailbox. It supports 16K SA info in total.
>
> Expose ipsec offload feature to upper layer, this feature will
> signal the availability of the offload.
>
> Based on initial work of Norm Bagley <norman.bagley@netronome.com>.
>
> Signed-off-by: Huanhuan Wang <huanhuan.wang@corigine.com>
> Signed-off-by: Simon Horman <simon.horman@corigine.com>
> ---
> .../net/ethernet/netronome/nfp/crypto/ipsec.c | 562 +++++++++++++++++-
> .../ethernet/netronome/nfp/nfp_net_common.c | 6 +
> .../net/ethernet/netronome/nfp/nfp_net_ctrl.h | 4 +-
> 3 files changed, 568 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c b/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c
> index 658fcba8e733..a81e6cde4ea8 100644
> --- a/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c
> +++ b/drivers/net/ethernet/netronome/nfp/crypto/ipsec.c
> @@ -17,6 +17,77 @@
> #define NFP_NET_IPSEC_MAX_SA_CNT (16 * 1024) /* Firmware support a maximum of 16K sa offload */
> #define OFFLOAD_HANDLE_ERROR 0xffffffff
>
> +/* IPsec config message cmd codes */
> +enum nfp_ipsec_cfg_mssg_cmd_codes {
> + NFP_IPSEC_CFG_MSSG_ADD_SA, /* Add a new SA */
> + NFP_IPSEC_CFG_MSSG_INV_SA, /* Invalidate an existing SA */
> + NFP_IPSEC_CFG_MSSG_MODIFY_SA, /* Modify an existing SA */
> + NFP_IPSEC_CFG_MSSG_GET_SA_STATS, /* Report SA counters, flags, etc. */
> + NFP_IPSEC_CFG_MSSG_GET_SEQ_NUMS, /* Allocate sequence numbers */
> + NFP_IPSEC_CFG_MSSG_LAST
> +};
> +
> +/* IPsec config message response codes */
> +enum nfp_ipsec_cfg_mssg_rsp_codes {
> + NFP_IPSEC_CFG_MSSG_OK,
> + NFP_IPSEC_CFG_MSSG_FAILED,
> + NFP_IPSEC_CFG_MSSG_SA_VALID,
> + NFP_IPSEC_CFG_MSSG_SA_HASH_ADD_FAILED,
> + NFP_IPSEC_CFG_MSSG_SA_HASH_DEL_FAILED,
> + NFP_IPSEC_CFG_MSSG_SA_INVALID_CMD
> +};
> +
> +/* Protocol */
> +enum nfp_ipsec_sa_prot {
> + NFP_IPSEC_PROTOCOL_AH = 0,
> + NFP_IPSEC_PROTOCOL_ESP = 1
> +};
> +
> +/* Mode */
> +enum nfp_ipsec_sa_mode {
> + NFP_IPSEC_PROTMODE_TRANSPORT = 0,
> + NFP_IPSEC_PROTMODE_TUNNEL = 1
> +};
> +
> +/* Cipher types */
> +enum nfp_ipsec_sa_cipher {
> + NFP_IPSEC_CIPHER_NULL,
> + NFP_IPSEC_CIPHER_3DES,
> + NFP_IPSEC_CIPHER_AES128,
> + NFP_IPSEC_CIPHER_AES192,
> + NFP_IPSEC_CIPHER_AES256,
> + NFP_IPSEC_CIPHER_AES128_NULL,
> + NFP_IPSEC_CIPHER_AES192_NULL,
> + NFP_IPSEC_CIPHER_AES256_NULL,
> + NFP_IPSEC_CIPHER_CHACHA20
> +};
> +
> +/* Cipher modes */
> +enum nfp_ipsec_sa_cipher_mode {
> + NFP_IPSEC_CIMODE_ECB,
> + NFP_IPSEC_CIMODE_CBC,
> + NFP_IPSEC_CIMODE_CFB,
> + NFP_IPSEC_CIMODE_OFB,
> + NFP_IPSEC_CIMODE_CTR
> +};
> +
> +/* Hash types */
> +enum nfp_ipsec_sa_hash_type {
> + NFP_IPSEC_HASH_NONE,
> + NFP_IPSEC_HASH_MD5_96,
> + NFP_IPSEC_HASH_SHA1_96,
> + NFP_IPSEC_HASH_SHA256_96,
> + NFP_IPSEC_HASH_SHA384_96,
> + NFP_IPSEC_HASH_SHA512_96,
> + NFP_IPSEC_HASH_MD5_128,
> + NFP_IPSEC_HASH_SHA1_80,
> + NFP_IPSEC_HASH_SHA256_128,
> + NFP_IPSEC_HASH_SHA384_192,
> + NFP_IPSEC_HASH_SHA512_256,
> + NFP_IPSEC_HASH_GF128_128,
> + NFP_IPSEC_HASH_POLY1305_128
> +};
> +
> /* IPSEC_CFG_MSSG_ADD_SA */
> struct nfp_ipsec_cfg_add_sa {
> u32 ciph_key[8]; /* Cipher Key */
> @@ -71,6 +142,73 @@ struct nfp_ipsec_cfg_add_sa {
> uint32_t tfc_padding :16; /* Traffic Flow Confidential Pad */
> };
>
> +/* IPSEC_CFG_MSSG_INV_SA */
> +struct nfp_ipsec_cfg_inv_sa {
> + u32 spare6;
> +};
> +
> +/* IPSEC_CFG_MSSG_GET_SA_STATS */
> +struct nfp_ipsec_cfg_get_sa_stats {
> + u32 seq_lo; /* Sequence Number (low 32bits) */
> + u32 seq_high; /* Sequence Number (high 32bits) */
> + u32 arw_counter_lo; /* Anti-replay wndw cntr */
> + u32 arw_counter_high; /* Anti-replay wndw cntr */
> + u32 arw_bitmap_lo; /* Anti-replay wndw bitmap */
> + u32 arw_bitmap_high; /* Anti-replay wndw bitmap */
> + uint32_t reserved1:1;
> + uint32_t soft_lifetime_byte_cnt_exceeded :1; /* Soft cnt_exceeded */
> + uint32_t hard_lifetime_byte_cnt_exceeded :1; /* Hard cnt_exceeded */
> + uint32_t soft_lifetime_time_limit_exceeded :1; /* Soft cnt_exceeded */
> + uint32_t hard_lifetime_time_limit_exceeded :1; /* Hard cnt_exceeded */
> + uint32_t spare7:27;
> + u32 lifetime_byte_count;
> + u32 pkt_count;
> + u32 discards_auth; /* Auth failures */
> + u32 discards_unsupported; /* Unsupported crypto mode */
> + u32 discards_alignment; /* Alignment error */
> + u32 discards_hard_bytelimit; /* Byte Count limit */
> + u32 discards_seq_num_wrap; /* Sequ Number wrap */
> + u32 discards_pmtu_limit_exceeded; /* PMTU Limit */
> + u32 discards_arw_old_seq; /* Anti-Replay seq small */
> + u32 discards_arw_replay; /* Anti-Replay seq rcvd */
> + u32 discards_ctrl_word; /* Bad SA Control word */
> + u32 discards_ip_hdr_len; /* Hdr offset from too high */
> + u32 discards_eop_buf; /* No EOP buffer */
> + u32 ipv4_id_counter; /* IPv4 ID field counter */
> + u32 discards_isl_fail; /* Inbound SPD Lookup failure */
> + u32 discards_ext_not_found; /* Ext header end */
> + u32 discards_max_ext_hdrs; /* Max ext header */
> + u32 discards_non_ext_hdrs; /* Non-extension headers */
> + u32 discards_ext_hdr_too_big; /* Ext header chain */
> + u32 discards_hard_timelimit; /* Time Limit */
> +};
> +
> +/* IPSEC_CFG_MSSG_GET_SEQ_NUMS */
> +struct ipsec_cfg_get_seq_nums {
> + u32 seq_nums; /* Sequence numbers to allocate */
> + u32 seq_num_low; /* Rtrn start seq num 31:00 */
> + u32 seq_num_hi; /* Rtrn start seq num 63:32 */
> +};
> +
> +/* IPSEC_CFG_MSSG */
> +struct nfp_ipsec_cfg_mssg {
> + union {
> + struct{
> + uint32_t cmd:16; /* One of nfp_ipsec_cfg_mssg_cmd_codes */
> + uint32_t rsp:16; /* One of nfp_ipsec_cfg_mssg_rsp_codes */
> + uint32_t sa_idx:16; /* SA table index */
> + uint32_t spare0:16;
> + union {
> + struct nfp_ipsec_cfg_add_sa cfg_add_sa;
> + struct nfp_ipsec_cfg_inv_sa cfg_inv_sa;
> + struct nfp_ipsec_cfg_get_sa_stats cfg_get_stats;
> + struct ipsec_cfg_get_seq_nums cfg_get_seq_nums;
> + };
> + };
> + u32 raw[64];
> + };
> +};
> +
> struct nfp_net_ipsec_sa_data {
> struct nfp_ipsec_cfg_add_sa nfp_sa;
> struct xfrm_state *x;
> @@ -84,22 +222,442 @@ struct nfp_net_ipsec_data {
> struct mutex lock; /* Protects nfp_net_ipsec_data struct */
> };
>
> +static int nfp_ipsec_cfg_cmd_issue(struct nfp_net *nn, int type, int saidx,
> + struct nfp_ipsec_cfg_mssg *msg)
> +{
> + int i, msg_size, ret;
> +
> + msg->cmd = type;
> + msg->sa_idx = saidx;
> + msg->rsp = 0;
> + msg_size = ARRAY_SIZE(msg->raw);
> +
> + for (i = 0; i < msg_size; i++)
> + nn_writel(nn, NFP_NET_CFG_MBOX_VAL + 4 * i, msg->raw[i]);
> +
> + ret = nfp_net_mbox_reconfig(nn, NFP_NET_CFG_MBOX_CMD_IPSEC);
> + if (ret < 0)
> + return ret;
> +
> + /* For now we always read the whole message response back */
> + for (i = 0; i < msg_size; i++)
> + msg->raw[i] = nn_readl(nn, NFP_NET_CFG_MBOX_VAL + 4 * i);
> +
> + switch (msg->rsp) {
> + case NFP_IPSEC_CFG_MSSG_OK:
> + return 0;
> + case NFP_IPSEC_CFG_MSSG_SA_INVALID_CMD:
> + return -EINVAL;
> + case NFP_IPSEC_CFG_MSSG_SA_VALID:
> + return -EEXIST;
> + case NFP_IPSEC_CFG_MSSG_FAILED:
> + case NFP_IPSEC_CFG_MSSG_SA_HASH_ADD_FAILED:
> + case NFP_IPSEC_CFG_MSSG_SA_HASH_DEL_FAILED:
> + return -EIO;
> + default:
> + return -EDOM;
> + }
> +}
> +
> +static int set_aes_keylen(struct nfp_ipsec_cfg_add_sa *cfg, int alg, int keylen)
> +{
> + if (alg == SADB_X_EALG_NULL_AES_GMAC) {
> + if (keylen == 128)
> + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES128_NULL;
> + else if (keylen == 192)
> + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES192_NULL;
> + else if (keylen == 256)
> + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES256_NULL;
> + else
> + return -EINVAL;
> + } else {
> + if (keylen == 128)
> + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES128;
> + else if (keylen == 192)
> + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES192;
> + else if (keylen == 256)
> + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_AES256;
> + else
> + return -EINVAL;
> + }
> +
> + return 0;
> +}
> +
> static int nfp_net_xfrm_add_state(struct xfrm_state *x)
> {
> - return -EOPNOTSUPP;
> + int i, key_len, trunc_len, err = 0, saidx = -1;
> + struct net_device *netdev = x->xso.dev;
> + struct nfp_net_ipsec_sa_data *sa_data;
> + struct nfp_ipsec_cfg_add_sa *cfg;
> + struct nfp_net_ipsec_data *ipd;
> + struct nfp_ipsec_cfg_mssg msg;
struct nfp_ipsec_cfg_mssg msg = {};
and memset below will be redundant.
> + struct nfp_net *nn;
> + __be32 *p;
> +
> + nn = netdev_priv(netdev);
> + ipd = nn->ipsec_data;
> + cfg = &msg.cfg_add_sa;
> +
> + nn_dbg(nn, "XFRM add state!\n");
ftrace can give it, you don't need add prints for functions entry/exit.
> + mutex_lock(&ipd->lock);
> +
> + if (ipd->sa_free_cnt == 0) {
> + nn_err(nn, "No space for xfrm offload\n");
> + err = -ENOSPC;
Why don't you return EOPNOTSUPP?
> + goto error;
> + }
> +
> + saidx = ipd->sa_free_stack[ipd->sa_free_cnt - 1];
> + sa_data = &ipd->sa_entries[saidx];
> + memset(&msg, 0, sizeof(msg));
Redundant.
> +
> + /* General */
> + switch (x->props.mode) {
> + case XFRM_MODE_TUNNEL:
> + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TUNNEL;
> + break;
> + case XFRM_MODE_TRANSPORT:
> + cfg->ctrl_word.mode = NFP_IPSEC_PROTMODE_TRANSPORT;
> + break;
> + default:
> + nn_err(nn, "Unsupported mode for xfrm offload\n");
> + err = -EINVAL;
> + goto error;
> + }
> +
> + switch (x->id.proto) {
> + case IPPROTO_ESP:
> + cfg->ctrl_word.proto = NFP_IPSEC_PROTOCOL_ESP;
> + break;
> + case IPPROTO_AH:
> + cfg->ctrl_word.proto = NFP_IPSEC_PROTOCOL_AH;
> + break;
> + default:
> + nn_err(nn, "Unsupported protocol for xfrm offload\n");
> + err = -EINVAL;
> + goto error;
> + }
> +
> + if (x->props.flags & XFRM_STATE_ESN) {
> + nn_err(nn, "Unsupported XFRM_REPLAY_MODE_ESN for xfrm offload\n");
> + err = -EINVAL;
> + goto error;
> + }
> +
> + cfg->ctrl_word.ena_arw = 0;
> + cfg->ctrl_word.ext_arw = 0;
> + cfg->spi = ntohl(x->id.spi);
> +
> + /* Hash/Authentication */
> + if (x->aalg)
> + trunc_len = x->aalg->alg_trunc_len;
> + else
> + trunc_len = 0;
> +
> + switch (x->props.aalgo) {
> + case SADB_AALG_NONE:
> + if (x->aead) {
> + trunc_len = -1;
> + } else {
> + nn_err(nn, "Unsupported authentication algorithm\n");
> + err = -EINVAL;
> + goto error;
> + }
> + break;
> + case SADB_X_AALG_NULL:
> + cfg->ctrl_word.hash = NFP_IPSEC_HASH_NONE;
> + trunc_len = -1;
> + break;
> + case SADB_AALG_MD5HMAC:
> + if (trunc_len == 96)
> + cfg->ctrl_word.hash = NFP_IPSEC_HASH_MD5_96;
> + else if (trunc_len == 128)
> + cfg->ctrl_word.hash = NFP_IPSEC_HASH_MD5_128;
> + else
> + trunc_len = 0;
> + break;
> + case SADB_AALG_SHA1HMAC:
> + if (trunc_len == 96)
> + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA1_96;
> + else if (trunc_len == 80)
> + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA1_80;
> + else
> + trunc_len = 0;
> + break;
> + case SADB_X_AALG_SHA2_256HMAC:
> + if (trunc_len == 96)
> + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA256_96;
> + else if (trunc_len == 128)
> + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA256_128;
> + else
> + trunc_len = 0;
> + break;
> + case SADB_X_AALG_SHA2_384HMAC:
> + if (trunc_len == 96)
> + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA384_96;
> + else if (trunc_len == 192)
> + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA384_192;
> + else
> + trunc_len = 0;
> + break;
> + case SADB_X_AALG_SHA2_512HMAC:
> + if (trunc_len == 96)
> + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA512_96;
> + else if (trunc_len == 256)
> + cfg->ctrl_word.hash = NFP_IPSEC_HASH_SHA512_256;
> + else
> + trunc_len = 0;
> + break;
> + default:
> + nn_err(nn, "Unsupported authentication algorithm\n");
> + err = -EINVAL;
> + goto error;
> + }
> +
> + if (!trunc_len) {
> + nn_err(nn, "Unsupported authentication algorithm trunc length\n");
> + err = -EINVAL;
> + goto error;
> + }
> +
> + if (x->aalg) {
> + p = (__be32 *)x->aalg->alg_key;
> + key_len = DIV_ROUND_UP(x->aalg->alg_key_len, BITS_PER_BYTE);
> + if (key_len > sizeof(cfg->auth_key)) {
> + nn_err(nn, "Insufficient space for offloaded auth key\n");
> + err = -EINVAL;
> + goto error;
> + }
> + for (i = 0; i < key_len / sizeof(cfg->auth_key[0]) ; i++)
> + cfg->auth_key[i] = ntohl(*p++);
> + }
> + /* Encryption */
> + switch (x->props.ealgo) {
> + case SADB_EALG_NONE:
> + case SADB_EALG_NULL:
> + cfg->ctrl_word.cimode = NFP_IPSEC_CIMODE_CBC;
> + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_NULL;
> + break;
> + case SADB_EALG_3DESCBC:
> + cfg->ctrl_word.cimode = NFP_IPSEC_CIMODE_CBC;
> + cfg->ctrl_word.cipher = NFP_IPSEC_CIPHER_3DES;
> + break;
> + case SADB_X_EALG_AES_GCM_ICV16:
> + case SADB_X_EALG_NULL_AES_GMAC:
> + if (!x->aead) {
> + nn_err(nn, "Invalid AES key data\n");
> + err = -EINVAL;
> + goto error;
> + }
> +
> + if (x->aead->alg_icv_len != 128) {
> + nn_err(nn, "ICV must be 128bit with SADB_X_EALG_AES_GCM_ICV16\n");
> + err = -EINVAL;
> + goto error;
> + }
> + cfg->ctrl_word.cimode = NFP_IPSEC_CIMODE_CTR;
> + cfg->ctrl_word.hash = NFP_IPSEC_HASH_GF128_128;
> +
> + /* Aead->alg_key_len includes 32-bit salt */
> + if (set_aes_keylen(cfg, x->props.ealgo, x->aead->alg_key_len - 32)) {
> + nn_err(nn, "Unsupported AES key length %d\n", x->aead->alg_key_len);
> + err = -EINVAL;
> + goto error;
> + }
> + break;
> + case SADB_X_EALG_AESCBC:
> + cfg->ctrl_word.cimode = NFP_IPSEC_CIMODE_CBC;
> + if (!x->ealg) {
> + nn_err(nn, "Invalid AES key data\n");
> + err = -EINVAL;
> + goto error;
> + }
> + if (set_aes_keylen(cfg, x->props.ealgo, x->ealg->alg_key_len) < 0) {
> + nn_err(nn, "Unsupported AES key length %d\n", x->ealg->alg_key_len);
> + err = -EINVAL;
> + goto error;
> + }
> + break;
> + default:
> + nn_err(nn, "Unsupported encryption algorithm for offload\n");
> + err = -EINVAL;
> + goto error;
> + }
> +
> + if (x->aead) {
> + int salt_len = 4;
> +
> + p = (__be32 *)x->aead->alg_key;
> + key_len = DIV_ROUND_UP(x->aead->alg_key_len, BITS_PER_BYTE);
> + key_len -= salt_len;
> +
> + if (key_len > sizeof(cfg->ciph_key)) {
> + nn_err(nn, "Insufficient space for offloaded key\n");
> + err = -EINVAL;
> + goto error;
> + }
> +
> + for (i = 0; i < key_len / sizeof(cfg->ciph_key[0]) ; i++)
> + cfg->ciph_key[i] = ntohl(*p++);
> +
> + /* Load up the salt */
> + for (i = 0; i < salt_len; i++)
> + cfg->auth_key[i] = ntohl(*p++);
> + }
> +
> + if (x->ealg) {
> + p = (__be32 *)x->ealg->alg_key;
> + key_len = DIV_ROUND_UP(x->ealg->alg_key_len, BITS_PER_BYTE);
> +
> + if (key_len > sizeof(cfg->ciph_key)) {
> + nn_err(nn, "Insufficient space for offloaded key\n");
> + err = -EINVAL;
> + goto error;
> + }
> + for (i = 0; i < key_len / sizeof(cfg->ciph_key[0]) ; i++)
> + cfg->ciph_key[i] = ntohl(*p++);
> + }
> + /* IP related info */
> + switch (x->props.family) {
> + case AF_INET:
> + cfg->ipv6 = 0;
> + cfg->src_ip[0] = ntohl(x->props.saddr.a4);
> + cfg->dst_ip[0] = ntohl(x->id.daddr.a4);
> + break;
> + case AF_INET6:
> + cfg->ipv6 = 1;
> + for (i = 0; i < 4; i++) {
> + cfg->src_ip[i] = ntohl(x->props.saddr.a6[i]);
> + cfg->dst_ip[i] = ntohl(x->id.daddr.a6[i]);
> + }
> + break;
> + default:
> + nn_err(nn, "Unsupported address family\n");
> + err = -EINVAL;
> + goto error;
> + }
> +
> + /* Maximum nic ipsec code could handle. Other limits may apply. */
> + cfg->pmtu_limit = 0xffff;
> +
> + /* Host will generate the sequence numbers so that if packets get
> + * fragmented in host, sequence numbers will stay in sync.
> + */
> + cfg->ctrl_word.gen_seq = 0;
> +
> + cfg->ctrl_word.encap_dsbl = 1;
> +
> + /* Sa direction */
> + cfg->ctrl_word.dir = x->xso.dir;
> +
> + /* Allocate saidx and commit the Sa */
> + ipd->sa_free_cnt -= 1;
> + sa_data->invalidated = 0;
> + sa_data->x = x;
> + x->xso.offload_handle = saidx + 1;
> + err = nfp_ipsec_cfg_cmd_issue(nn, NFP_IPSEC_CFG_MSSG_ADD_SA, saidx, &msg);
> + if (err) {
> + nn_err(nn, "Failed to issue ipsec command err ret=%d\n", err);
> + goto error;
> + }
> +
> + mutex_unlock(&ipd->lock);
> +
> + nn_dbg(nn, "Successfully offload saidx %d\n", saidx);
> + return 0;
> +error:
> + if (saidx < 0) {
> + ipd->sa_free_stack[ipd->sa_free_cnt] = saidx;
> + ipd->sa_free_cnt++;
> + }
> + mutex_unlock(&ipd->lock);
> + x->xso.offload_handle = OFFLOAD_HANDLE_ERROR;
If everything is wired correctly, XFRM core won't never call to driver
with invalid state.
The failure here means that state is not crypto offloaded.
> + return err;
> +}
> +
> +static void xfrm_invalidate(struct nfp_net *nn, unsigned int saidx, int is_del)
> +{
> + struct nfp_net_ipsec_data *ipd = nn->ipsec_data;
> + struct nfp_net_ipsec_sa_data *sa_data;
> + struct nfp_ipsec_cfg_mssg msg;
> + int err;
> +
> + sa_data = &ipd->sa_entries[saidx];
> + if (!sa_data->invalidated) {
> + err = nfp_ipsec_cfg_cmd_issue(nn, NFP_IPSEC_CFG_MSSG_INV_SA, saidx, &msg);
> + if (err)
> + nn_warn(nn, "Failed to invalidate SA in hardware\n");
> + sa_data->invalidated = 1;
> + } else if (is_del) {
> + nn_warn(nn, "Unexpected invalidate state for offloaded saidx %d\n", saidx);
You definitely need to clean all these not-possible flows.
> + }
> }
>
> static void nfp_net_xfrm_del_state(struct xfrm_state *x)
> {
> + struct net_device *netdev = x->xso.dev;
> + struct nfp_net_ipsec_data *ipd;
> + struct nfp_net *nn;
> +
> + nn = netdev_priv(netdev);
> + ipd = nn->ipsec_data;
> +
> + nn_dbg(nn, "XFRM del state!\n");
> +
> + if (x->xso.offload_handle == OFFLOAD_HANDLE_ERROR) {
> + nn_err(nn, "Invalid xfrm offload handle\n");
> + return;
> + }
> +
> + mutex_lock(&ipd->lock);
> + xfrm_invalidate(nn, x->xso.offload_handle - 1, 1);
> + mutex_unlock(&ipd->lock);
> }
>
> static void nfp_net_xfrm_free_state(struct xfrm_state *x)
> {
> + struct net_device *netdev = x->xso.dev;
> + struct nfp_net_ipsec_data *ipd;
> + struct nfp_net *nn;
> + int saidx;
> +
> + nn = netdev_priv(netdev);
> + ipd = nn->ipsec_data;
> +
> + nn_dbg(nn, "XFRM free state!\n");
> +
> + if (x->xso.offload_handle == OFFLOAD_HANDLE_ERROR) {
> + nn_err(nn, "Invalid xfrm offload handle\n");
> + return;
> + }
> +
> + mutex_lock(&ipd->lock);
> + saidx = x->xso.offload_handle - 1;
> + xfrm_invalidate(nn, saidx, 0);
> + ipd->sa_entries[saidx].x = NULL;
> + /* Return saidx to free list */
> + ipd->sa_free_stack[ipd->sa_free_cnt] = saidx;
> + ipd->sa_free_cnt++;
> +
> + mutex_unlock(&ipd->lock);
> }
>
> static bool nfp_net_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
> {
> - return false;
> + if (x->props.family == AF_INET) {
> + /* Offload with IPv4 options is not supported yet */
> + if (ip_hdr(skb)->ihl != 5)
> + return false;
> + } else if (x->props.family == AF_INET6) {
> + /* Offload with IPv6 extension headers is not support yet */
> + if (ipv6_ext_hdr(ipv6_hdr(skb)->nexthdr))
> + return false;
> + } else {
> + return false;
> + }
> +
> + return true;
This return is unreachable.
> }
>
> static const struct xfrmdev_ops nfp_net_ipsec_xfrmdev_ops = {
> diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
> index 040c0c2aad80..0e48e2887278 100644
> --- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
> +++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
> @@ -2375,6 +2375,12 @@ static void nfp_net_netdev_init(struct nfp_net *nn)
> }
> if (nn->cap & NFP_NET_CFG_CTRL_RSS_ANY)
> netdev->hw_features |= NETIF_F_RXHASH;
> +
> +#ifdef CONFIG_NFP_NET_IPSEC
> + if (nn->cap_w1 & NFP_NET_CFG_CTRL_IPSEC)
> + netdev->hw_features |= NETIF_F_HW_ESP | NETIF_F_HW_ESP_TX_CSUM;
> +#endif
> +
> if (nn->cap & NFP_NET_CFG_CTRL_VXLAN) {
> if (nn->cap & NFP_NET_CFG_CTRL_LSO) {
> netdev->hw_features |= NETIF_F_GSO_UDP_TUNNEL |
> diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
> index fff05496152d..b7e62d1186ca 100644
> --- a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
> +++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
> @@ -399,14 +399,14 @@
> */
> #define NFP_NET_CFG_MBOX_BASE 0x1800
> #define NFP_NET_CFG_MBOX_VAL_MAX_SZ 0x1F8
> -
> +#define NFP_NET_CFG_MBOX_VAL 0x1808
> #define NFP_NET_CFG_MBOX_SIMPLE_CMD 0x0
> #define NFP_NET_CFG_MBOX_SIMPLE_RET 0x4
> #define NFP_NET_CFG_MBOX_SIMPLE_VAL 0x8
>
> #define NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_ADD 1
> #define NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_KILL 2
> -
> +#define NFP_NET_CFG_MBOX_CMD_IPSEC 3
> #define NFP_NET_CFG_MBOX_CMD_PCI_DSCP_PRIOMAP_SET 5
> #define NFP_NET_CFG_MBOX_CMD_TLV_CMSG 6
>
> --
> 2.30.2
>
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v2 0/3] nfp: IPsec offload support
2022-09-29 2:42 ` [PATCH net-next v2 0/3] nfp: IPsec offload support Jakub Kicinski
@ 2022-09-29 8:48 ` Simon Horman
0 siblings, 0 replies; 12+ messages in thread
From: Simon Horman @ 2022-09-29 8:48 UTC (permalink / raw)
To: Jakub Kicinski
Cc: David Miller, Paolo Abeni, netdev, oss-drivers, Leon Romanovsky,
Huanhuan Wang
On Wed, Sep 28, 2022 at 07:42:20PM -0700, Jakub Kicinski wrote:
> On Tue, 27 Sep 2022 12:27:04 +0200 Simon Horman wrote:
> > this short series is support IPsec offload for the NFP driver.
> >
> > It covers three enhancements:
> >
> > 1. Patches 1/3:
> > - Extend the capability word and control word to to support
> > new features.
> >
> > 2. Patch 2/3:
> > - Add framework to support IPsec offloading for NFP driver,
> > but IPsec offload control plane interface xfrm callbacks which
> > interact with upper layer are not implemented in this patch.
> >
> > 3. Patch 3/3:
> > - IPsec control plane interface xfrm callbacks are implemented
> > in this patch.
>
> Should this not CC Steffen?
Thanks Jakub,
in light of this and Leon's review, we'll plan to post a v3.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v2 3/3] nfp: implement xfrm callbacks and expose ipsec offload feature to upper layer
2022-09-29 8:26 ` Leon Romanovsky
@ 2022-10-10 7:14 ` Yinjun Zhang
2022-10-11 8:36 ` Leon Romanovsky
0 siblings, 1 reply; 12+ messages in thread
From: Yinjun Zhang @ 2022-10-10 7:14 UTC (permalink / raw)
To: Leon Romanovsky
Cc: Simon Horman, David Miller, Jakub Kicinski, Paolo Abeni, netdev,
oss-drivers, Huanhuan Wang, chengtian.liu
On Thu, Sep 29, 2022 at 11:26:24AM +0300, Leon Romanovsky wrote:
> On Tue, Sep 27, 2022 at 12:27:07PM +0200, Simon Horman wrote:
>
> > + mutex_lock(&ipd->lock);
> > +
> > + if (ipd->sa_free_cnt == 0) {
> > + nn_err(nn, "No space for xfrm offload\n");
> > + err = -ENOSPC;
>
> Why don't you return EOPNOTSUPP?
>
Here means no available sa. I think ENOSPC is more appropriate than
EOPNOTSUPP, and it looks like xfrm will fall back to software mode
when driver returns EOPNOTSUPP.
> > +static void xfrm_invalidate(struct nfp_net *nn, unsigned int saidx, int is_del)
> > +{
> > + struct nfp_net_ipsec_data *ipd = nn->ipsec_data;
> > + struct nfp_net_ipsec_sa_data *sa_data;
> > + struct nfp_ipsec_cfg_mssg msg;
> > + int err;
> > +
> > + sa_data = &ipd->sa_entries[saidx];
> > + if (!sa_data->invalidated) {
> > + err = nfp_ipsec_cfg_cmd_issue(nn, NFP_IPSEC_CFG_MSSG_INV_SA, saidx, &msg);
> > + if (err)
> > + nn_warn(nn, "Failed to invalidate SA in hardware\n");
> > + sa_data->invalidated = 1;
> > + } else if (is_del) {
> > + nn_warn(nn, "Unexpected invalidate state for offloaded saidx %d\n", saidx);
>
> You definitely need to clean all these not-possible flows.
>
Do you mean clean those sa entries? We clean them by invalidating them.
You can see `xfrm_invalidate` is called in `nfp_net_xfrm_del_state`.
> > + }
> > }
> >
> > static void nfp_net_xfrm_del_state(struct xfrm_state *x)
> > {
> > + struct net_device *netdev = x->xso.dev;
> > + struct nfp_net_ipsec_data *ipd;
> > + struct nfp_net *nn;
> > +
> > + nn = netdev_priv(netdev);
> > + ipd = nn->ipsec_data;
> > +
> > + nn_dbg(nn, "XFRM del state!\n");
> > +
> > + if (x->xso.offload_handle == OFFLOAD_HANDLE_ERROR) {
> > + nn_err(nn, "Invalid xfrm offload handle\n");
> > + return;
> > + }
> > +
> > + mutex_lock(&ipd->lock);
> > + xfrm_invalidate(nn, x->xso.offload_handle - 1, 1);
> > + mutex_unlock(&ipd->lock);
> > }
> >
> > static void nfp_net_xfrm_free_state(struct xfrm_state *x)
> > {
> > + struct net_device *netdev = x->xso.dev;
> > + struct nfp_net_ipsec_data *ipd;
> > + struct nfp_net *nn;
> > + int saidx;
> > +
> > + nn = netdev_priv(netdev);
> > + ipd = nn->ipsec_data;
> > +
> > + nn_dbg(nn, "XFRM free state!\n");
> > +
> > + if (x->xso.offload_handle == OFFLOAD_HANDLE_ERROR) {
> > + nn_err(nn, "Invalid xfrm offload handle\n");
> > + return;
> > + }
> > +
> > + mutex_lock(&ipd->lock);
> > + saidx = x->xso.offload_handle - 1;
> > + xfrm_invalidate(nn, saidx, 0);
> > + ipd->sa_entries[saidx].x = NULL;
> > + /* Return saidx to free list */
> > + ipd->sa_free_stack[ipd->sa_free_cnt] = saidx;
> > + ipd->sa_free_cnt++;
> > +
> > + mutex_unlock(&ipd->lock);
> > }
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v2 3/3] nfp: implement xfrm callbacks and expose ipsec offload feature to upper layer
2022-10-10 7:14 ` Yinjun Zhang
@ 2022-10-11 8:36 ` Leon Romanovsky
0 siblings, 0 replies; 12+ messages in thread
From: Leon Romanovsky @ 2022-10-11 8:36 UTC (permalink / raw)
To: Yinjun Zhang
Cc: Simon Horman, David Miller, Jakub Kicinski, Paolo Abeni, netdev,
oss-drivers, Huanhuan Wang, chengtian.liu
On Mon, Oct 10, 2022 at 03:14:34PM +0800, Yinjun Zhang wrote:
> On Thu, Sep 29, 2022 at 11:26:24AM +0300, Leon Romanovsky wrote:
> > On Tue, Sep 27, 2022 at 12:27:07PM +0200, Simon Horman wrote:
> >
> > > + mutex_lock(&ipd->lock);
> > > +
> > > + if (ipd->sa_free_cnt == 0) {
> > > + nn_err(nn, "No space for xfrm offload\n");
> > > + err = -ENOSPC;
> >
> > Why don't you return EOPNOTSUPP?
> >
>
> Here means no available sa. I think ENOSPC is more appropriate than
> EOPNOTSUPP, and it looks like xfrm will fall back to software mode
> when driver returns EOPNOTSUPP.
Yes, and it is exactly what is expected. If device for some reason
doesn't support crypto offload, SW path should be taken instead.
>
> > > +static void xfrm_invalidate(struct nfp_net *nn, unsigned int saidx, int is_del)
> > > +{
> > > + struct nfp_net_ipsec_data *ipd = nn->ipsec_data;
> > > + struct nfp_net_ipsec_sa_data *sa_data;
> > > + struct nfp_ipsec_cfg_mssg msg;
> > > + int err;
> > > +
> > > + sa_data = &ipd->sa_entries[saidx];
> > > + if (!sa_data->invalidated) {
> > > + err = nfp_ipsec_cfg_cmd_issue(nn, NFP_IPSEC_CFG_MSSG_INV_SA, saidx, &msg);
> > > + if (err)
> > > + nn_warn(nn, "Failed to invalidate SA in hardware\n");
> > > + sa_data->invalidated = 1;
> > > + } else if (is_del) {
> > > + nn_warn(nn, "Unexpected invalidate state for offloaded saidx %d\n", saidx);
> >
> > You definitely need to clean all these not-possible flows.
> >
>
> Do you mean clean those sa entries? We clean them by invalidating them.
> You can see `xfrm_invalidate` is called in `nfp_net_xfrm_del_state`.
No, I means that you can't call to invalidate with "Unexpected ..." state.
You should ensure that free/invalidate/e.t.c logic operates on valid SAs
only.
Thanks
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v2 2/3] nfp: add framework to support ipsec offloading
[not found] ` <20221010070512.GA21559@nj-rack01-04.nji.corigine.com>
@ 2022-10-11 8:41 ` Leon Romanovsky
2022-10-13 8:21 ` Yinjun Zhang
0 siblings, 1 reply; 12+ messages in thread
From: Leon Romanovsky @ 2022-10-11 8:41 UTC (permalink / raw)
To: Yinjun Zhang; +Cc: chengtian.liu,
On Mon, Oct 10, 2022 at 03:05:12PM +0800, Yinjun Zhang wrote:
> Thanks for your comments and sorry for the late reply.
>
> On Thu, Sep 29, 2022 at 11:10:12AM +0300, Leon Romanovsky wrote:
> > On Tue, Sep 27, 2022 at 12:27:06PM +0200, Simon Horman wrote:
> > > +struct nfp_net_ipsec_data {
> > > + struct nfp_net_ipsec_sa_data sa_entries[NFP_NET_IPSEC_MAX_SA_CNT];
> > > + unsigned int sa_free_stack[NFP_NET_IPSEC_MAX_SA_CNT];
> > > + unsigned int sa_free_cnt;
> >
> > I don't see in this patch what are you doing with this free_stack array,
> > but whole nfp_net_ipsec_data is more than 32Kb of arrays.
> >
>
> `sa_free_stack` is used to maintain the used/available sa entries, which
> is initialized in `nfp_net_ipsec_init`.
> Yes, it's indeed a big array, and we're going to use pointer instead of array
> here.
Why do you want to use array and not Xarray?
>
> > > +bool nfp_net_ipsec_tx_prep(struct nfp_net_dp *dp, struct sk_buff *skb,
> > > + struct nfp_ipsec_offload *offload_info)
> > > +{
> > > + struct xfrm_offload *xo = xfrm_offload(skb);
> > > + struct xfrm_state *x;
> > > +
> > > + if (!xo)
> > > + return false;
> >
> > How is it possible in offload path?
> > Why do all drivers check sec_path length and not xo?
> >
>
> `tx_prep` is called in the tx datapath, we use `xo` to check if the
> packet needs offload-encrypto or not.
You didn't answer on any of my questions above.
How is it possible in offload path?
Why do all drivers check sec_path length and not xo?
>
> > > +int nfp_net_ipsec_rx(struct nfp_meta_parsed *meta, struct sk_buff *skb)
> > > +{
> > > + struct nfp_net_ipsec_sa_data *sa_data;
> > > + struct net_device *netdev = skb->dev;
> > > + struct nfp_net_ipsec_data *ipd;
> > > + struct xfrm_offload *xo;
> > > + struct nfp_net_dp *dp;
> > > + struct xfrm_state *x;
> > > + struct sec_path *sp;
> > > + struct nfp_net *nn;
> > > + int saidx;
> > > +
> > > + nn = netdev_priv(netdev);
> > > + ipd = nn->ipsec_data;
> > > + dp = &nn->dp;
> > > +
> > > + if (meta->ipsec_saidx == 0)
> > > + return 0; /* No offload took place */
> > > +
> > > + saidx = meta->ipsec_saidx - 1;
> > > + if (saidx > NFP_NET_IPSEC_MAX_SA_CNT || saidx < 0) {
> > > + nn_dp_warn(dp, "Invalid SAIDX from NIC %d\n", saidx);
> >
> > No prints in data path that can be triggered from the network, please.
> >
>
> It's a ratelimit print, and it means severe error happens, probably
> unrecoverable, when running into this path.
The main part of the sentence is "... can be triggered from the network ..."
Thanks
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH net-next v2 2/3] nfp: add framework to support ipsec offloading
2022-10-11 8:41 ` Leon Romanovsky
@ 2022-10-13 8:21 ` Yinjun Zhang
0 siblings, 0 replies; 12+ messages in thread
From: Yinjun Zhang @ 2022-10-13 8:21 UTC (permalink / raw)
To: Leon Romanovsky; +Cc: chengtian.liu,
On Tue, Oct 11, 2022 at 11:41:47AM +0300, Leon Romanovsky wrote:
> >
> > `sa_free_stack` is used to maintain the used/available sa entries, which
> > is initialized in `nfp_net_ipsec_init`.
> > Yes, it's indeed a big array, and we're going to use pointer instead of array
> > here.
>
> Why do you want to use array and not Xarray?
>
We'll try that. Thanks.
> >
> > > > +bool nfp_net_ipsec_tx_prep(struct nfp_net_dp *dp, struct sk_buff *skb,
> > > > + struct nfp_ipsec_offload *offload_info)
> > > > +{
> > > > + struct xfrm_offload *xo = xfrm_offload(skb);
> > > > + struct xfrm_state *x;
> > > > +
> > > > + if (!xo)
> > > > + return false;
> > >
> > > How is it possible in offload path?
> > > Why do all drivers check sec_path length and not xo?
> > >
> >
> > `tx_prep` is called in the tx datapath, we use `xo` to check if the
> > packet needs offload-encrypto or not.
>
> You didn't answer on any of my questions above.
>
> How is it possible in offload path?
> Why do all drivers check sec_path length and not xo?
>
It's not a offload-only path, but a normal tx data path. Only if xo is
not NULL, we're going to do crypto-offload. Not every transimitted
packet needs crypto, right?
We're going to move this check to its parent function to avoid
unnecessary jump when it's not a to-crypto packet.
> >
> > > > + saidx = meta->ipsec_saidx - 1;
> > > > + if (saidx > NFP_NET_IPSEC_MAX_SA_CNT || saidx < 0) {
> > > > + nn_dp_warn(dp, "Invalid SAIDX from NIC %d\n", saidx);
> > >
> > > No prints in data path that can be triggered from the network, please.
> > >
> >
> > It's a ratelimit print, and it means severe error happens, probably
> > unrecoverable, when running into this path.
>
> The main part of the sentence is "... can be triggered from the network ..."
OK, we'll remove this print, and maybe introduce some error counters instead in
following patch series.
>
> Thanks
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2022-10-13 8:22 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-09-27 10:27 [PATCH net-next v2 0/3] nfp: IPsec offload support Simon Horman
2022-09-27 10:27 ` [PATCH net-next v2 1/3] nfp: extend capability and control words Simon Horman
2022-09-27 10:27 ` [PATCH net-next v2 2/3] nfp: add framework to support ipsec offloading Simon Horman
2022-09-29 8:10 ` Leon Romanovsky
[not found] ` <20221010070512.GA21559@nj-rack01-04.nji.corigine.com>
2022-10-11 8:41 ` Leon Romanovsky
2022-10-13 8:21 ` Yinjun Zhang
2022-09-27 10:27 ` [PATCH net-next v2 3/3] nfp: implement xfrm callbacks and expose ipsec offload feature to upper layer Simon Horman
2022-09-29 8:26 ` Leon Romanovsky
2022-10-10 7:14 ` Yinjun Zhang
2022-10-11 8:36 ` Leon Romanovsky
2022-09-29 2:42 ` [PATCH net-next v2 0/3] nfp: IPsec offload support Jakub Kicinski
2022-09-29 8:48 ` Simon Horman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).