- 16 Jul, 2020 40 commits
-
-
Raed Salem authored
Synchronize offloading device ESN with xfrm received SN by updating an existing IPsec HW context with the new SN. Signed-off-by:
Raed Salem <raeds@mellanox.com> Reviewed-by:
Boris Pismenny <borisp@mellanox.com> Signed-off-by:
Saeed Mahameed <saeedm@mellanox.com>
-
Raed Salem authored
On receive flow inspect received packets for IPsec offload indication using the cqe, for IPsec offloaded packets propagate offload status and stack handle to stack for further processing. Supported statuses: - Offload ok. - Authentication failure. - Bad trailer indication. Connect-X IPsec does not use mlx5e_ipsec_handle_rx_cqe. For RX only offload, we see the BW gain. Below is the iperf3 performance report on two server of 24 cores Intel(R) Xeon(R) CPU E5-2620 v3 @ 2.40GHz with ConnectX6-DX. We use one thread per IPsec tunnel. --------------------------------------------------------------------- Mode | Num tunnel | BW | Send CPU util | Recv CPU util | | (Gbps) | (Average %) | (Average %) --------------------------------------------------------------------- Cryto offload | 1 | 4.6 | 4.2 | 14.5 --------------------------------------------------------------------- Cryto offload | 24 | 38 | 73 | 63 --------------------------------------------------------------------- Non-offload | 1 | 4 | 4 | 13 --------------------------------------------------------------------- Non-offload | 24 | 23 | 52 | 67 Signed-off-by:Tariq Toukan <tariqt@mellanox.com> Signed-off-by:
-
Huy Nguyen authored
Introduce decrypt FT, the RX error FT and the default rules. The IPsec RX decrypt flow table is pointed by the TTC (Traffic Type Classifier) ESP steering rules. The decrypt flow table has two flow groups. The first flow group keeps the decrypt steering rule programmed via the "ip xfrm s" interface. The second flow group has a default rule to forward all non-offloaded ESP packet to the TTC ESP default RSS TIR. The RX error flow table is the destination of the decrypt steering rules in the IPsec RX decrypt flow table. It has a fixed rule with single copy action that copies ipsec_syndrome to metadata_regB[0:6]. The IPsec syndrome is used to filter out non-ipsec packet and to return the IPsec crypto offload status in Rx flow. The destination of RX error flow table is the TTC ESP default RSS TIR. All the FTs (decrypt FT and error FT) are created only when IPsec SAs are added. If there is no IPsec SAs, the FTs are removed. Signed-off-by:
Huy Nguyen <huyn@mellanox.com> Reviewed-by:
-
Huy Nguyen authored
Add FTE actions IPsec ENCRYPT/DECRYPT Add ipsec_obj_id field in FTE Add new action field MLX5_ACTION_IN_FIELD_IPSEC_SYNDROME Signed-off-by:
-
Raed Salem authored
This patch adds support for Connect-X IPsec crypto offload by implementing the IPsec acceleration layer needed routines, which delegates IPsec offloads to Connect-X routines. In Connect-X IPsec, a Security Association (SA) is added or deleted via allocating a HW context of an encryption/decryption key and a HW context of a matching SA (IPsec object). The Security Policy (SP) is added or deleted by creating matching Tx/Rx steering rules whith an action of encryption/decryption respectively, executed using the previously allocated SA HW context. When new xfrm state (SA) is added: - Use a separate crypto key HW context. - Create a separate IPsec context in HW to inlcude the SA properties: - aes-gcm salt. - ICV properties (ICV length, implicit IV). - on supported devices also update ESN. - associate the allocated crypto key with this IPsec context. Introduce a new compilation flag MLX5_IPSEC for it. Downstream patches will implement the Rx,Tx steering and will add the update esn. Signed-off-by:
-
Raed Salem authored
This to set the base for downstream patches to support the new IPsec implementation of the Connect-X family. Following modifications made: - Remove accel layer dependency from MLX5_FPGA_IPSEC. - Introduce accel_ipsec_ops, each IPsec device will have to support these ops. Signed-off-by:
-
Parav Pandit authored
Currently only ECPF allows enabling eswitch when SR-IOV is disabled. Enable PF also to enable eswitch when SR-IOV is disabled. Load VF vports when eswitch is already enabled. Signed-off-by:
Parav Pandit <parav@mellanox.com> Reviewed-by:
Roi Dayan <roid@mellanox.com> Signed-off-by:
-
Parav Pandit authored
for non ECPF eswitch manager function, vports are already enabled/disabled when eswitch is enabled/disabled respectively. Simplify function change handler for such eswitch manager function. Therefore, ECPF is the only one which remains PF/VF function change handler. Signed-off-by:
-
Tariq Toukan authored
TLS runs only over Eth, and the Eth driver is the only user of the core TLS functionality. There is no meaning of having the core functionality without the usage in Eth driver. Hence, let both TLS core implementations depend on MLX5_CORE_EN, and select MLX5_EN_TLS. Signed-off-by:
-
Saeed Mahameed authored
mlx5e_accel_sk_get_rxq is only used in ktls_rx.c file which already depends on XPS to be compiled, move it from the generic en_accel.h header to be local in ktls_rx.c, to fix the below build break In file included from ../drivers/net/ethernet/mellanox/mlx5/core/en_main.c:49:0: ../drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h: In function ‘mlx5e_accel_sk_get_rxq’: ../drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h:153:12: error: implicit declaration of function ‘sk_rx_queue_get’ ... int rxq = sk_rx_queue_get(sk); ^~~~~~~~~~~~~~~ Fixes: 1182f365 ("net/mlx5e: kTLS, Add kTLS RX HW offload support") Signed-off-by:Randy Dunlap <rdunlap@infradead.org>
-
Parav Pandit authored
Cited commit in fixes tag missed to set the switch id of the PF and VF ports. Due to this flow cannot be offloaded, a simple command like below fails to offload with below error. tc filter add dev ens2f0np0 parent ffff: prio 1 flower \ dst_mac 00:00:00:00:00:00/00:00:00:00:00:00 skip_sw \ action mirred egress redirect dev ens2f0np0pf0vf0 Error: mlx5_core: devices are not on same switch HW, can't offload forwarding. Hence, fix it by setting switch id for each PF and VF representors port as before the cited commit. Fixes: 71ad8d55 ("devlink: Replace devlink_port_attrs_set parameters with a struct") Signed-off-by:
-
Vladimir Oltean authored
Having the users of MSCC_OCELOT_SWITCH_LIB depend on REGMAP_MMIO was a bad idea, since that symbol is not user-selectable. So we should have kept a 'select REGMAP_MMIO'. When we do that, we run into 2 more problems: - By depending on GENERIC_PHY, we are causing a recursive dependency. But it looks like GENERIC_PHY has no other dependencies, and other drivers select it, so we can select it too: drivers/of/Kconfig:69:error: recursive dependency detected! drivers/of/Kconfig:69: symbol OF_IRQ depends on IRQ_DOMAIN kernel/irq/Kconfig:68: symbol IRQ_DOMAIN is selected by REGMAP drivers/base/regmap/Kconfig:7: symbol REGMAP default is visible depending on REGMAP_MMIO drivers/base/regmap/Kconfig:39: symbol REGMAP_MMIO is selected by MSCC_OCELOT_SWITCH_LIB drivers/net/ethernet/mscc/Kconfig:15: symbol MSCC_OCELOT_SWITCH_LIB is selected by MSCC_OCELOT_SWITCH drivers/net/ethernet/mscc/Kconfig:22: symbol MSCC_OCELOT_SWITCH depends on GENERIC_PHY drivers/phy/Kconfig:8: symbol GENERIC_PHY is selected by PHY_BCM_NS_USB3 drivers/phy/broadcom/Kconfig:41: symbol PHY_BCM_NS_USB3 depends on MDIO_BUS drivers/net/phy/Kconfig:13: symbol MDIO_BUS depends on MDIO_DEVICE drivers/net/phy/Kconfig:6: symbol MDIO_DEVICE is selected by PHYLIB drivers/net/phy/Kconfig:254: symbol PHYLIB is selected by ARC_EMAC_CORE drivers/net/ethernet/arc/Kconfig:19: symbol ARC_EMAC_CORE is selected by ARC_EMAC drivers/net/ethernet/arc/Kconfig:25: symbol ARC_EMAC depends on OF_IRQ - By depending on PHYLIB, we are causing a recursive dependency. PHYLIB only has a single dependency, "depends on NETDEVICES", which we are already depending on, so we can again hack our way into conformance by turning the PHYLIB dependency into a select. drivers/of/Kconfig:69:error: recursive dependency detected! drivers/of/Kconfig:69: symbol OF_IRQ depends on IRQ_DOMAIN kernel/irq/Kconfig:68: symbol IRQ_DOMAIN is selected by REGMAP drivers/base/regmap/Kconfig:7: symbol REGMAP default is visible depending on REGMAP_MMIO drivers/base/regmap/Kconfig:39: symbol REGMAP_MMIO is selected by MSCC_OCELOT_SWITCH_LIB drivers/net/ethernet/mscc/Kconfig:15: symbol MSCC_OCELOT_SWITCH_LIB is selected by MSCC_OCELOT_SWITCH drivers/net/ethernet/mscc/Kconfig:22: symbol MSCC_OCELOT_SWITCH depends on PHYLIB drivers/net/phy/Kconfig:254: symbol PHYLIB is selected by ARC_EMAC_CORE drivers/net/ethernet/arc/Kconfig:19: symbol ARC_EMAC_CORE is selected by ARC_EMAC drivers/net/ethernet/arc/Kconfig:25: symbol ARC_EMAC depends on OF_IRQ Fixes: f4d0323b ("net: mscc: ocelot: convert MSCC_OCELOT_SWITCH into a library") Signed-off-by:
Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by:
Jakub Kicinski <kuba@kernel.org>
-
John Ogness authored
A busy-wait loop is used to implement waiting for bits to be copied from the skb to the kernel buffer before retiring a block. This is a problem on PREEMPT_RT because the copying task could be preempted by the busy-waiting task and thus live lock in the busy-wait loop. Replace the busy-wait logic with an rwlock_t. This provides lockdep coverage and makes the code RT ready. Signed-off-by:
John Ogness <john.ogness@linutronix.de> Signed-off-by:
-
Jakub Kicinski authored
Sergey Organov says: ==================== net: fec: a few improvements This is a collection of simple improvements that reduce and/or simplify code. They got developed out of attempt to use DP83640 PTP PHY connected to built-in FEC (that has its own PTP support) of the iMX 6SX micro-controller. The primary bug-fix was now submitted separately, and this is the rest of the changes. NOTE: the patches are developed and tested on 4.9.146, and rebased on top of recent 'net-next/master', where, besides visual inspection, I only tested that they do compile. ==================== Signed-off-by: -
Sergey Organov authored
No need to use snprintf() on a constant string, nor using magic constant in the fixed code was a good idea. Signed-off-by:
Sergey Organov <sorganov@gmail.com> Acked-by:
Fugang Duan <fugang.duan@nxp.com> Signed-off-by:
-
Sergey Organov authored
Code of the form "if(x) x = 0" replaced with "x = 0". Code of the form "if(x == a) x = a" removed. Signed-off-by:
-
Sergey Organov authored
Initializing with 0 makes it much easier to identify time stamps from otherwise uninitialized clock. Initialization of PTP clock with current kernel time makes little sense as PTP time scale differs from UTC time scale that kernel time represents. It only leads to confusion when no actual PTP initialization happens, as these time scales differ in a small integer number of seconds (37 at the time of writing.) Signed-off-by:
-
Sergey Organov authored
PPS feature could be useful even when hardware time stamping of network packets is not in use, so remove offending check for this condition from fec_ptp_enable_pps(). Signed-off-by:
-
Randy Dunlap authored
Drop the doubled word "by" in a comment. Signed-off-by:
-
Randy Dunlap authored
Drop doubled words in several comments. Signed-off-by:
-
Randy Dunlap authored
Drop doubled word "the" in a comment. Signed-off-by:
-
Randy Dunlap authored
Drop doubled word "to" in a comment. Signed-off-by:
-
Randy Dunlap authored
Drop doubled words "or" and "the" in several comments. Signed-off-by:
-
Randy Dunlap authored
Drop doubled word "not" in a comment. Signed-off-by:
-
Randy Dunlap authored
Drop doubled words in two comments. Fix a spello/typo. Signed-off-by:
-
Randy Dunlap authored
Drop doubled words in several comments. Signed-off-by:
-
Randy Dunlap authored
Drop doubled word "the" in two comments. Signed-off-by:
-
Kieran Bingham authored
The word 'descriptor' is misspelled throughout the tree. Fix it up accordingly: decriptor -> descriptor Signed-off-by:Kieran Bingham <kieran.bingham+renesas@ideasonboard.com> Signed-off-by:
-
Jakub Kicinski authored
Ido Schimmel says: ==================== mlxsw: Offload tc police action This patch set adds support for tc police action in mlxsw. Patches #1-#2 add defines for policer bandwidth limits and resource identifiers (e.g., maximum number of policers). Patch #3 adds a common policer core in mlxsw. Currently it is only used by the policy engine, but future patch sets will use it for trap policers and storm control policers. The common core allows us to share common logic between all policer types and abstract certain details from the various users in mlxsw. Patch #4 exposes the maximum number of supported policers and their current usage to user space via devlink-resource. This provides better visibility and also used for selftests purposes. Patches #5-#7 gradually add support for tc police action in the policy engine by calling into previously mentioned policer core. Patch #8 adds a generic selftest for tc-police that can be used with veth pairs or physical loopbacks. Patches #9-#11 add mlxsw-specific selftests. ==================== Signed-off-by: -
Ido Schimmel authored
Test that policers shared by different tc filters are correctly reference counted by observing policers' occupancy via devlink-resource. Signed-off-by:
Ido Schimmel <idosch@mellanox.com> Reviewed-by:
Petr Machata <petrm@mellanox.com> Signed-off-by:
-
Ido Schimmel authored
Query the maximum number of supported policers using devlink-resource and test that this number can be reached by configuring tc filters with police action. Test that an error is returned in case the maximum number is exceeded. Signed-off-by:
-
Ido Schimmel authored
Test that upper and lower limits on rate and burst size imposed by the device are rejected by the kernel. Signed-off-by:
-
Ido Schimmel authored
Test tc-police action in various scenarios such as Rx policing, Tx policing, shared policer and police piped to mirred. The test passes with both veth pairs and loopbacked ports. # ./tc_police.sh TEST: police on rx [ OK ] TEST: police on tx [ OK ] TEST: police with shared policer - rx [ OK ] TEST: police with shared policer - tx [ OK ] TEST: police rx and mirror [ OK ] TEST: police tx and mirror [ OK ] Signed-off-by:
-
Ido Schimmel authored
Offload action police when used with a flower classifier. The number of dropped packets is read from the policer and reported to tc. Signed-off-by:
Jiri Pirko <jiri@mellanox.com> Reviewed-by:
-
Ido Schimmel authored
Add core functionality required to support police action in the policy engine. The utilized hardware policers are stored in a hash table keyed by the flow action index. This allows to support policer sharing between multiple ACL rules. Signed-off-by:
-
Ido Schimmel authored
In the policy engine, each ACL rule points to an action block where the ACL actions are stored. Each action block consists of one or more action sets. Each action set holds one or more individual actions, up to a maximum queried from the device. For example: Action set #1 Action set #2 +----------+ +--------------+ +--------------+ | ACL rule +----------> Action #1 | +-----> Action #4 | +----------+ +--------------+ | +--------------+ | Action #2 | | | Action #5 | +--------------+ | +--------------+ | Action #3 +------+ | | +--------------+ +--------------+ <---------+ Action block +-----------------> The hardware has a limitation that prevents a policing action (MLXSW_AFA_POLCNT_CODE when used with a policer, not a counter) from being configured in the same action set with a trap action (i.e., MLXSW_AFA_TRAP_CODE or MLXSW_AFA_TRAPWU_CODE). Note that the latter used to implement multiple actions: 'trap', 'mirred', 'drop'. Work around this limitation by teaching mlxsw_afa_block_append_action() to create a new action set not only when there is no more room left in the current set, but also when there is a conflict between previously mentioned actions. Signed-off-by: -
Ido Schimmel authored
Expose via devlink-resource the maximum number of single-rate policers and their current occupancy. Example: $ devlink resource show pci/0000:01:00.0 ... name global_policers size 1000 unit entry dpipe_tables none resources: name single_rate_policers size 968 occ 0 unit entry dpipe_tables none Signed-off-by: -
Ido Schimmel authored
Add common code to handle all policer-related functionality in mlxsw. Currently, only policer for policy engines are supported, but it in the future more policer families will be added such as CPU (trap) policers and storm control policers. The API allows different modules to add / delete policers and read their drop counter. Signed-off-by:
-
Ido Schimmel authored
Add a resource identifier for maximum global policers so that it could be later used to query the information from firmware. Signed-off-by:
-
Ido Schimmel authored
Add policer bandwidth limits for both rate and burst size so that they could be enforced by a later patch. Signed-off-by:
-
