Commit 021a429b authored by Leon Romanovsky's avatar Leon Romanovsky Committed by Saeed Mahameed

net/mlx5: Don't hide fallback to software IPsec in FS code

The XFRM code performs fallback to software IPsec if .xdo_dev_state_add()
returns -EOPNOTSUPP. This is what mlx5 did very deep in its stack trace,
despite have all the knowledge that IPsec is not going to work in very
early stage.

This is achieved by making sure that priv->ipsec pointer is valid for
fully working and supported hardware crypto IPsec engine.

In case, the hardware IPsec is not supported, the XFRM code will set NULL
to xso->dev and it will prevent from calls to various .xdo_dev_state_*()
callbacks.
Reviewed-by: default avatarRaed Salem <raeds@nvidia.com>
Signed-off-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
parent 9af1968e
...@@ -43,17 +43,7 @@ ...@@ -43,17 +43,7 @@
static struct mlx5e_ipsec_sa_entry *to_ipsec_sa_entry(struct xfrm_state *x) static struct mlx5e_ipsec_sa_entry *to_ipsec_sa_entry(struct xfrm_state *x)
{ {
struct mlx5e_ipsec_sa_entry *sa; return (struct mlx5e_ipsec_sa_entry *)x->xso.offload_handle;
if (!x)
return NULL;
sa = (struct mlx5e_ipsec_sa_entry *)x->xso.offload_handle;
if (!sa)
return NULL;
WARN_ON(sa->x != x);
return sa;
} }
struct xfrm_state *mlx5e_ipsec_sadb_rx_lookup(struct mlx5e_ipsec *ipsec, struct xfrm_state *mlx5e_ipsec_sadb_rx_lookup(struct mlx5e_ipsec *ipsec,
...@@ -306,6 +296,8 @@ static int mlx5e_xfrm_add_state(struct xfrm_state *x) ...@@ -306,6 +296,8 @@ static int mlx5e_xfrm_add_state(struct xfrm_state *x)
int err; int err;
priv = netdev_priv(netdev); priv = netdev_priv(netdev);
if (!priv->ipsec)
return -EOPNOTSUPP;
err = mlx5e_xfrm_validate_state(x); err = mlx5e_xfrm_validate_state(x);
if (err) if (err)
...@@ -375,9 +367,6 @@ static void mlx5e_xfrm_del_state(struct xfrm_state *x) ...@@ -375,9 +367,6 @@ static void mlx5e_xfrm_del_state(struct xfrm_state *x)
{ {
struct mlx5e_ipsec_sa_entry *sa_entry = to_ipsec_sa_entry(x); struct mlx5e_ipsec_sa_entry *sa_entry = to_ipsec_sa_entry(x);
if (!sa_entry)
return;
if (x->xso.flags & XFRM_OFFLOAD_INBOUND) if (x->xso.flags & XFRM_OFFLOAD_INBOUND)
mlx5e_ipsec_sadb_rx_del(sa_entry); mlx5e_ipsec_sadb_rx_del(sa_entry);
} }
...@@ -387,9 +376,6 @@ static void mlx5e_xfrm_free_state(struct xfrm_state *x) ...@@ -387,9 +376,6 @@ static void mlx5e_xfrm_free_state(struct xfrm_state *x)
struct mlx5e_ipsec_sa_entry *sa_entry = to_ipsec_sa_entry(x); struct mlx5e_ipsec_sa_entry *sa_entry = to_ipsec_sa_entry(x);
struct mlx5e_priv *priv = netdev_priv(x->xso.dev); struct mlx5e_priv *priv = netdev_priv(x->xso.dev);
if (!sa_entry)
return;
if (sa_entry->hw_context) { if (sa_entry->hw_context) {
flush_workqueue(sa_entry->ipsec->wq); flush_workqueue(sa_entry->ipsec->wq);
mlx5e_xfrm_fs_del_rule(priv, sa_entry); mlx5e_xfrm_fs_del_rule(priv, sa_entry);
...@@ -402,7 +388,8 @@ static void mlx5e_xfrm_free_state(struct xfrm_state *x) ...@@ -402,7 +388,8 @@ static void mlx5e_xfrm_free_state(struct xfrm_state *x)
int mlx5e_ipsec_init(struct mlx5e_priv *priv) int mlx5e_ipsec_init(struct mlx5e_priv *priv)
{ {
struct mlx5e_ipsec *ipsec = NULL; struct mlx5e_ipsec *ipsec;
int ret;
if (!mlx5_ipsec_device_caps(priv->mdev)) { if (!mlx5_ipsec_device_caps(priv->mdev)) {
netdev_dbg(priv->netdev, "Not an IPSec offload device\n"); netdev_dbg(priv->netdev, "Not an IPSec offload device\n");
...@@ -420,14 +407,23 @@ int mlx5e_ipsec_init(struct mlx5e_priv *priv) ...@@ -420,14 +407,23 @@ int mlx5e_ipsec_init(struct mlx5e_priv *priv)
ipsec->wq = alloc_ordered_workqueue("mlx5e_ipsec: %s", 0, ipsec->wq = alloc_ordered_workqueue("mlx5e_ipsec: %s", 0,
priv->netdev->name); priv->netdev->name);
if (!ipsec->wq) { if (!ipsec->wq) {
kfree(ipsec); ret = -ENOMEM;
return -ENOMEM; goto err_wq;
} }
ret = mlx5e_accel_ipsec_fs_init(ipsec);
if (ret)
goto err_fs_init;
priv->ipsec = ipsec; priv->ipsec = ipsec;
mlx5e_accel_ipsec_fs_init(ipsec);
netdev_dbg(priv->netdev, "IPSec attached to netdevice\n"); netdev_dbg(priv->netdev, "IPSec attached to netdevice\n");
return 0; return 0;
err_fs_init:
destroy_workqueue(ipsec->wq);
err_wq:
kfree(ipsec);
return (ret != -EOPNOTSUPP) ? ret : 0;
} }
void mlx5e_ipsec_cleanup(struct mlx5e_priv *priv) void mlx5e_ipsec_cleanup(struct mlx5e_priv *priv)
...@@ -487,9 +483,6 @@ static void mlx5e_xfrm_advance_esn_state(struct xfrm_state *x) ...@@ -487,9 +483,6 @@ static void mlx5e_xfrm_advance_esn_state(struct xfrm_state *x)
struct mlx5e_ipsec_modify_state_work *modify_work; struct mlx5e_ipsec_modify_state_work *modify_work;
bool need_update; bool need_update;
if (!sa_entry)
return;
need_update = mlx5e_ipsec_update_esn_state(sa_entry); need_update = mlx5e_ipsec_update_esn_state(sa_entry);
if (!need_update) if (!need_update)
return; return;
......
...@@ -605,9 +605,6 @@ int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_priv *priv, ...@@ -605,9 +605,6 @@ int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_priv *priv,
u32 ipsec_obj_id, u32 ipsec_obj_id,
struct mlx5e_ipsec_rule *ipsec_rule) struct mlx5e_ipsec_rule *ipsec_rule)
{ {
if (!priv->ipsec->rx_fs)
return -EOPNOTSUPP;
if (attrs->action == MLX5_ACCEL_ESP_ACTION_DECRYPT) if (attrs->action == MLX5_ACCEL_ESP_ACTION_DECRYPT)
return rx_add_rule(priv, attrs, ipsec_obj_id, ipsec_rule); return rx_add_rule(priv, attrs, ipsec_obj_id, ipsec_rule);
else else
...@@ -618,9 +615,6 @@ void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_priv *priv, ...@@ -618,9 +615,6 @@ void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_priv *priv,
struct mlx5_accel_esp_xfrm_attrs *attrs, struct mlx5_accel_esp_xfrm_attrs *attrs,
struct mlx5e_ipsec_rule *ipsec_rule) struct mlx5e_ipsec_rule *ipsec_rule)
{ {
if (!priv->ipsec->rx_fs)
return;
if (attrs->action == MLX5_ACCEL_ESP_ACTION_DECRYPT) if (attrs->action == MLX5_ACCEL_ESP_ACTION_DECRYPT)
rx_del_rule(priv, attrs, ipsec_rule); rx_del_rule(priv, attrs, ipsec_rule);
else else
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment