Skip to content

Commit

Permalink
net/mlx5e: Remove accesses to priv for low level IPsec FS code
Browse files Browse the repository at this point in the history 
mlx5 priv structure is driver main structure that holds high level data.
That information is not needed for IPsec flow steering logic and the
pointer to mlx5e_priv was not supposed to be passed in the first place.

This change "cleans" the logic to rely on internal to IPsec structures
without touching global mlx5e_priv.

Reviewed-by: Raed Salem <raeds@nvidia.com>
Reviewed-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
  • Loading branch information
Leon Romanovsky authored and Steffen Klassert committed Dec 6, 2022
1 parent fb2caa7 commit c7049ca
Show file tree
Hide file tree
Showing 3 changed files with 56 additions and 59 deletions.
8 changes: 4 additions & 4 deletions drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -306,7 +306,7 @@ static int mlx5e_xfrm_add_state(struct xfrm_state *x)
if (err)
goto err_xfrm;

err = mlx5e_accel_ipsec_fs_add_rule(priv, sa_entry);
err = mlx5e_accel_ipsec_fs_add_rule(sa_entry);
if (err)
goto err_hw_ctx;

Expand All @@ -324,7 +324,7 @@ static int mlx5e_xfrm_add_state(struct xfrm_state *x)
goto out;

err_add_rule:
mlx5e_accel_ipsec_fs_del_rule(priv, sa_entry);
mlx5e_accel_ipsec_fs_del_rule(sa_entry);
err_hw_ctx:
mlx5_ipsec_free_sa_ctx(sa_entry);
err_xfrm:
Expand All @@ -344,10 +344,9 @@ static void mlx5e_xfrm_del_state(struct xfrm_state *x)
static void mlx5e_xfrm_free_state(struct xfrm_state *x)
{
struct mlx5e_ipsec_sa_entry *sa_entry = to_ipsec_sa_entry(x);
struct mlx5e_priv *priv = netdev_priv(x->xso.dev);

cancel_work_sync(&sa_entry->modify_work.work);
mlx5e_accel_ipsec_fs_del_rule(priv, sa_entry);
mlx5e_accel_ipsec_fs_del_rule(sa_entry);
mlx5_ipsec_free_sa_ctx(sa_entry);
kfree(sa_entry);
}
Expand Down Expand Up @@ -378,6 +377,7 @@ void mlx5e_ipsec_init(struct mlx5e_priv *priv)
if (ret)
goto err_fs_init;

ipsec->fs = priv->fs;
priv->ipsec = ipsec;
netdev_dbg(priv->netdev, "IPSec attached to netdevice\n");
return;
Expand Down
7 changes: 3 additions & 4 deletions drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,7 @@ struct mlx5e_ipsec {
spinlock_t sadb_rx_lock; /* Protects sadb_rx */
struct mlx5e_ipsec_sw_stats sw_stats;
struct workqueue_struct *wq;
struct mlx5e_flow_steering *fs;
struct mlx5e_ipsec_rx *rx_ipv4;
struct mlx5e_ipsec_rx *rx_ipv6;
struct mlx5e_ipsec_tx *tx;
Expand Down Expand Up @@ -148,10 +149,8 @@ struct xfrm_state *mlx5e_ipsec_sadb_rx_lookup(struct mlx5e_ipsec *dev,

void mlx5e_accel_ipsec_fs_cleanup(struct mlx5e_ipsec *ipsec);
int mlx5e_accel_ipsec_fs_init(struct mlx5e_ipsec *ipsec);
int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_priv *priv,
struct mlx5e_ipsec_sa_entry *sa_entry);
void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_priv *priv,
struct mlx5e_ipsec_sa_entry *sa_entry);
int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry);
void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_ipsec_sa_entry *sa_entry);

int mlx5_ipsec_create_sa_ctx(struct mlx5e_ipsec_sa_entry *sa_entry);
void mlx5_ipsec_free_sa_ctx(struct mlx5e_ipsec_sa_entry *sa_entry);
Expand Down
100 changes: 49 additions & 51 deletions drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,11 +42,11 @@ static enum mlx5_traffic_types family2tt(u32 family)
return MLX5_TT_IPV6_IPSEC_ESP;
}

static int rx_err_add_rule(struct mlx5e_priv *priv, struct mlx5e_ipsec_rx *rx,
static int rx_err_add_rule(struct mlx5_core_dev *mdev,
struct mlx5e_ipsec_rx *rx,
struct mlx5e_ipsec_rx_err *rx_err)
{
u8 action[MLX5_UN_SZ_BYTES(set_add_copy_action_in_auto)] = {};
struct mlx5_core_dev *mdev = priv->mdev;
struct mlx5_flow_act flow_act = {};
struct mlx5_modify_hdr *modify_hdr;
struct mlx5_flow_handle *fte;
Expand Down Expand Up @@ -99,11 +99,10 @@ static int rx_err_add_rule(struct mlx5e_priv *priv, struct mlx5e_ipsec_rx *rx,
return err;
}

static int rx_fs_create(struct mlx5e_priv *priv, struct mlx5e_ipsec_rx *rx)
static int rx_fs_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_rx *rx)
{
int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in);
struct mlx5_flow_table *ft = rx->ft.sa;
struct mlx5_core_dev *mdev = priv->mdev;
struct mlx5_flow_group *miss_group;
struct mlx5_flow_handle *miss_rule;
MLX5_DECLARE_FLOW_ACT(flow_act);
Expand Down Expand Up @@ -145,22 +144,22 @@ static int rx_fs_create(struct mlx5e_priv *priv, struct mlx5e_ipsec_rx *rx)
return err;
}

static void rx_destroy(struct mlx5e_priv *priv, struct mlx5e_ipsec_rx *rx)
static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_rx *rx)
{
mlx5_del_flow_rules(rx->miss_rule);
mlx5_destroy_flow_group(rx->miss_group);
mlx5_destroy_flow_table(rx->ft.sa);

mlx5_del_flow_rules(rx->rx_err.rule);
mlx5_modify_header_dealloc(priv->mdev, rx->rx_err.copy_modify_hdr);
mlx5_modify_header_dealloc(mdev, rx->rx_err.copy_modify_hdr);
mlx5_destroy_flow_table(rx->rx_err.ft);
}

static int rx_create(struct mlx5e_priv *priv, struct mlx5e_ipsec_rx *rx,
u32 family)
static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,
struct mlx5e_ipsec_rx *rx, u32 family)
{
struct mlx5_flow_namespace *ns = mlx5e_fs_get_ns(priv->fs, false);
struct mlx5_ttc_table *ttc = mlx5e_fs_get_ttc(priv->fs, false);
struct mlx5_flow_namespace *ns = mlx5e_fs_get_ns(ipsec->fs, false);
struct mlx5_ttc_table *ttc = mlx5e_fs_get_ttc(ipsec->fs, false);
struct mlx5_flow_table_attr ft_attr = {};
struct mlx5_flow_table *ft;
int err;
Expand All @@ -176,7 +175,7 @@ static int rx_create(struct mlx5e_priv *priv, struct mlx5e_ipsec_rx *rx,
return PTR_ERR(ft);

rx->rx_err.ft = ft;
err = rx_err_add_rule(priv, rx, &rx->rx_err);
err = rx_err_add_rule(mdev, rx, &rx->rx_err);
if (err)
goto err_add;

Expand All @@ -193,7 +192,7 @@ static int rx_create(struct mlx5e_priv *priv, struct mlx5e_ipsec_rx *rx,
}
rx->ft.sa = ft;

err = rx_fs_create(priv, rx);
err = rx_fs_create(mdev, rx);
if (err)
goto err_fs;

Expand All @@ -203,30 +202,31 @@ static int rx_create(struct mlx5e_priv *priv, struct mlx5e_ipsec_rx *rx,
mlx5_destroy_flow_table(rx->ft.sa);
err_fs_ft:
mlx5_del_flow_rules(rx->rx_err.rule);
mlx5_modify_header_dealloc(priv->mdev, rx->rx_err.copy_modify_hdr);
mlx5_modify_header_dealloc(mdev, rx->rx_err.copy_modify_hdr);
err_add:
mlx5_destroy_flow_table(rx->rx_err.ft);
return err;
}

static struct mlx5e_ipsec_rx *rx_ft_get(struct mlx5e_priv *priv, u32 family)
static struct mlx5e_ipsec_rx *rx_ft_get(struct mlx5_core_dev *mdev,
struct mlx5e_ipsec *ipsec, u32 family)
{
struct mlx5_ttc_table *ttc = mlx5e_fs_get_ttc(priv->fs, false);
struct mlx5_ttc_table *ttc = mlx5e_fs_get_ttc(ipsec->fs, false);
struct mlx5_flow_destination dest = {};
struct mlx5e_ipsec_rx *rx;
int err = 0;

if (family == AF_INET)
rx = priv->ipsec->rx_ipv4;
rx = ipsec->rx_ipv4;
else
rx = priv->ipsec->rx_ipv6;
rx = ipsec->rx_ipv6;

mutex_lock(&rx->ft.mutex);
if (rx->ft.refcnt)
goto skip;

/* create FT */
err = rx_create(priv, rx, family);
err = rx_create(mdev, ipsec, rx, family);
if (err)
goto out;

Expand All @@ -244,15 +244,16 @@ static struct mlx5e_ipsec_rx *rx_ft_get(struct mlx5e_priv *priv, u32 family)
return rx;
}

static void rx_ft_put(struct mlx5e_priv *priv, u32 family)
static void rx_ft_put(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec,
u32 family)
{
struct mlx5_ttc_table *ttc = mlx5e_fs_get_ttc(priv->fs, false);
struct mlx5_ttc_table *ttc = mlx5e_fs_get_ttc(ipsec->fs, false);
struct mlx5e_ipsec_rx *rx;

if (family == AF_INET)
rx = priv->ipsec->rx_ipv4;
rx = ipsec->rx_ipv4;
else
rx = priv->ipsec->rx_ipv6;
rx = ipsec->rx_ipv6;

mutex_lock(&rx->ft.mutex);
rx->ft.refcnt--;
Expand All @@ -263,43 +264,42 @@ static void rx_ft_put(struct mlx5e_priv *priv, u32 family)
mlx5_ttc_fwd_default_dest(ttc, family2tt(family));

/* remove FT */
rx_destroy(priv, rx);
rx_destroy(mdev, rx);

out:
mutex_unlock(&rx->ft.mutex);
}

/* IPsec TX flow steering */
static int tx_create(struct mlx5e_priv *priv)
static int tx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec_tx *tx)
{
struct mlx5_flow_table_attr ft_attr = {};
struct mlx5e_ipsec *ipsec = priv->ipsec;
struct mlx5_core_dev *mdev = priv->mdev;
struct mlx5_flow_table *ft;
int err;

ft_attr.max_fte = NUM_IPSEC_FTE;
ft_attr.autogroup.max_num_groups = 1;
ft = mlx5_create_auto_grouped_flow_table(ipsec->tx->ns, &ft_attr);
ft = mlx5_create_auto_grouped_flow_table(tx->ns, &ft_attr);
if (IS_ERR(ft)) {
err = PTR_ERR(ft);
mlx5_core_err(mdev, "fail to create ipsec tx ft err=%d\n", err);
return err;
}
ipsec->tx->ft.sa = ft;
tx->ft.sa = ft;
return 0;
}

static struct mlx5e_ipsec_tx *tx_ft_get(struct mlx5e_priv *priv)
static struct mlx5e_ipsec_tx *tx_ft_get(struct mlx5_core_dev *mdev,
struct mlx5e_ipsec *ipsec)
{
struct mlx5e_ipsec_tx *tx = priv->ipsec->tx;
struct mlx5e_ipsec_tx *tx = ipsec->tx;
int err = 0;

mutex_lock(&tx->ft.mutex);
if (tx->ft.refcnt)
goto skip;

err = tx_create(priv);
err = tx_create(mdev, tx);
if (err)
goto out;
skip:
Expand All @@ -311,9 +311,9 @@ static struct mlx5e_ipsec_tx *tx_ft_get(struct mlx5e_priv *priv)
return tx;
}

static void tx_ft_put(struct mlx5e_priv *priv)
static void tx_ft_put(struct mlx5e_ipsec *ipsec)
{
struct mlx5e_ipsec_tx *tx = priv->ipsec->tx;
struct mlx5e_ipsec_tx *tx = ipsec->tx;

mutex_lock(&tx->ft.mutex);
tx->ft.refcnt--;
Expand Down Expand Up @@ -382,13 +382,13 @@ static void setup_fte_common(struct mlx5_accel_esp_xfrm_attrs *attrs,
flow_act->flags |= FLOW_ACT_NO_APPEND;
}

static int rx_add_rule(struct mlx5e_priv *priv,
struct mlx5e_ipsec_sa_entry *sa_entry)
static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
{
u8 action[MLX5_UN_SZ_BYTES(set_add_copy_action_in_auto)] = {};
struct mlx5e_ipsec_rule *ipsec_rule = &sa_entry->ipsec_rule;
struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs;
struct mlx5_core_dev *mdev = mlx5e_ipsec_sa2dev(sa_entry);
struct mlx5e_ipsec *ipsec = sa_entry->ipsec;
u32 ipsec_obj_id = sa_entry->ipsec_obj_id;
struct mlx5_modify_hdr *modify_hdr = NULL;
struct mlx5_flow_destination dest = {};
Expand All @@ -398,7 +398,7 @@ static int rx_add_rule(struct mlx5e_priv *priv,
struct mlx5e_ipsec_rx *rx;
int err = 0;

rx = rx_ft_get(priv, attrs->family);
rx = rx_ft_get(mdev, ipsec, attrs->family);
if (IS_ERR(rx))
return PTR_ERR(rx);

Expand All @@ -418,7 +418,7 @@ static int rx_add_rule(struct mlx5e_priv *priv,
MLX5_SET(set_action_in, action, offset, 0);
MLX5_SET(set_action_in, action, length, 32);

modify_hdr = mlx5_modify_header_alloc(priv->mdev, MLX5_FLOW_NAMESPACE_KERNEL,
modify_hdr = mlx5_modify_header_alloc(mdev, MLX5_FLOW_NAMESPACE_KERNEL,
1, action);
if (IS_ERR(modify_hdr)) {
err = PTR_ERR(modify_hdr);
Expand Down Expand Up @@ -447,25 +447,25 @@ static int rx_add_rule(struct mlx5e_priv *priv,

out_err:
if (modify_hdr)
mlx5_modify_header_dealloc(priv->mdev, modify_hdr);
rx_ft_put(priv, attrs->family);
mlx5_modify_header_dealloc(mdev, modify_hdr);
rx_ft_put(mdev, ipsec, attrs->family);

out:
kvfree(spec);
return err;
}

static int tx_add_rule(struct mlx5e_priv *priv,
struct mlx5e_ipsec_sa_entry *sa_entry)
static int tx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
{
struct mlx5_core_dev *mdev = mlx5e_ipsec_sa2dev(sa_entry);
struct mlx5e_ipsec *ipsec = sa_entry->ipsec;
struct mlx5_flow_act flow_act = {};
struct mlx5_flow_handle *rule;
struct mlx5_flow_spec *spec;
struct mlx5e_ipsec_tx *tx;
int err = 0;

tx = tx_ft_get(priv);
tx = tx_ft_get(mdev, ipsec);
if (IS_ERR(tx))
return PTR_ERR(tx);

Expand Down Expand Up @@ -499,34 +499,32 @@ static int tx_add_rule(struct mlx5e_priv *priv,
out:
kvfree(spec);
if (err)
tx_ft_put(priv);
tx_ft_put(ipsec);
return err;
}

int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_priv *priv,
struct mlx5e_ipsec_sa_entry *sa_entry)
int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
{
if (sa_entry->attrs.dir == XFRM_DEV_OFFLOAD_OUT)
return tx_add_rule(priv, sa_entry);
return tx_add_rule(sa_entry);

return rx_add_rule(priv, sa_entry);
return rx_add_rule(sa_entry);
}

void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_priv *priv,
struct mlx5e_ipsec_sa_entry *sa_entry)
void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
{
struct mlx5e_ipsec_rule *ipsec_rule = &sa_entry->ipsec_rule;
struct mlx5_core_dev *mdev = mlx5e_ipsec_sa2dev(sa_entry);

mlx5_del_flow_rules(ipsec_rule->rule);

if (sa_entry->attrs.dir == XFRM_DEV_OFFLOAD_OUT) {
tx_ft_put(priv);
tx_ft_put(sa_entry->ipsec);
return;
}

mlx5_modify_header_dealloc(mdev, ipsec_rule->set_modify_hdr);
rx_ft_put(priv, sa_entry->attrs.family);
rx_ft_put(mdev, sa_entry->ipsec, sa_entry->attrs.family);
}

void mlx5e_accel_ipsec_fs_cleanup(struct mlx5e_ipsec *ipsec)
Expand Down

0 comments on commit c7049ca

Please sign in to comment.