History

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2022-05-13 1) Cleanups for the code behind the XFRM offload API. This is a preparation for the extension of the API for policy offload. From Leon Romanovsky. * 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next: xfrm: drop not needed flags variable in XFRM offload struct net/mlx5e: Use XFRM state direction instead of flags netdevsim: rely on XFRM state direction instead of flags ixgbe: propagate XFRM offload state direction instead of flags xfrm: store and rely on direction to construct offload flags xfrm: rename xfrm_state_offload struct to allow reuse xfrm: delete not used number of external headers xfrm: free not used XFRM_ESP_NO_TRAILER flag ====================

Jakub Kicinski committed 4 years ago

Commit 2c5f1532 parents f9a210c 0f9008e12 files · +40 −47Browse files

Unified · Split

12 files
  1. drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +4 −5
  2. drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.h +1 −1
  3. drivers/net/ethernet/intel/ixgbevf/ipsec.c +3 −3
  4. drivers/net/ethernet/intel/ixgbevf/ipsec.h +1 −1
  5. drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +5 −5
  6. drivers/net/netdevsim/ipsec.c +1 −1
  7. include/net/xfrm.h +12 −8
  8. net/ipv4/esp4.c +0 −6
  9. net/ipv6/esp6.c +0 −6
  10. net/xfrm/xfrm_device.c +8 −7
  11. net/xfrm/xfrm_state.c +2 −2
  12. net/xfrm/xfrm_user.c +3 −2
drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c+4−5
@@ -585,7 +585,7 @@ static int ixgbe_ipsec_add_sa(struct xfrm_state *xs) · 584 unmodified lines
585585 return -EINVAL;
586586 }
587587
588− if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) {
588+ if (xs->xso.dir == XFRM_DEV_OFFLOAD_IN) {
589589 struct rx_sa rsa;
590590
591591 if (xs->calg) {
@@ -757,7 +757,7 @@ static void ixgbe_ipsec_del_sa(struct xfrm_state *xs) · 165 unmodified lines
757757 u32 zerobuf[4] = {0, 0, 0, 0};
758758 u16 sa_idx;
759759
760− if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) {
760+ if (xs->xso.dir == XFRM_DEV_OFFLOAD_IN) {
761761 struct rx_sa *rsa;
762762 u8 ipi;
763763
@@ -903,8 +903,7 @@ int ixgbe_ipsec_vf_add_sa(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf) · 139 unmodified lines
903903 /* Tx IPsec offload doesn't seem to work on this
904904 * device, so block these requests for now.
905905 */
906− sam->flags = sam->flags & ~XFRM_OFFLOAD_IPV6;
907− if (sam->flags != XFRM_OFFLOAD_INBOUND) {
906+ if (sam->dir != XFRM_DEV_OFFLOAD_IN) {
908907 err = -EOPNOTSUPP;
909908 goto err_out;
910909 }
@@ -915,7 +914,7 @@ int ixgbe_ipsec_vf_add_sa(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf) · 4 unmodified lines
915914 goto err_out;
916915 }
917916
918− xs->xso.flags = sam->flags;
917+ xs->xso.dir = sam->dir;
919918 xs->id.spi = sam->spi;
920919 xs->id.proto = sam->proto;
921920 xs->props.family = sam->family;
drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.h+1−1
@@ -74,7 +74,7 @@ struct ixgbe_ipsec { · 73 unmodified lines
7474
7575 struct sa_mbx_msg {
7676 __be32 spi;
77− u8 flags;
77+ u8 dir;
7878 u8 proto;
7979 u16 family;
8080 __be32 addr[4];
drivers/net/ethernet/intel/ixgbevf/ipsec.c+3−3
@@ -25,7 +25,7 @@ static int ixgbevf_ipsec_set_pf_sa(struct ixgbevf_adapter *adapter, · 24 unmodified lines
2525
2626 /* send the important bits to the PF */
2727 sam = (struct sa_mbx_msg *)(&msgbuf[1]);
28− sam->flags = xs->xso.flags;
28+ sam->dir = xs->xso.dir;
2929 sam->spi = xs->id.spi;
3030 sam->proto = xs->id.proto;
3131 sam->family = xs->props.family;
@@ -280,7 +280,7 @@ static int ixgbevf_ipsec_add_sa(struct xfrm_state *xs) · 248 unmodified lines
280280 return -EINVAL;
281281 }
282282
283− if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) {
283+ if (xs->xso.dir == XFRM_DEV_OFFLOAD_IN) {
284284 struct rx_sa rsa;
285285
286286 if (xs->calg) {
@@ -394,7 +394,7 @@ static void ixgbevf_ipsec_del_sa(struct xfrm_state *xs) · 107 unmodified lines
394394 adapter = netdev_priv(dev);
395395 ipsec = adapter->ipsec;
396396
397− if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) {
397+ if (xs->xso.dir == XFRM_DEV_OFFLOAD_IN) {
398398 sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_RX_INDEX;
399399
400400 if (!ipsec->rx_tbl[sa_idx].used) {
drivers/net/ethernet/intel/ixgbevf/ipsec.h+1−1
@@ -57,7 +57,7 @@ struct ixgbevf_ipsec { · 56 unmodified lines
5757
5858 struct sa_mbx_msg {
5959 __be32 spi;
60− u8 flags;
60+ u8 dir;
6161 u8 proto;
6262 u16 family;
6363 __be32 addr[4];
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c+5−5
@@ -172,9 +172,9 @@ mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry, · 171 unmodified lines
172172 }
173173
174174 /* action */
175− attrs->action = (!(x->xso.flags & XFRM_OFFLOAD_INBOUND)) ?
176− MLX5_ACCEL_ESP_ACTION_ENCRYPT :
177− MLX5_ACCEL_ESP_ACTION_DECRYPT;
175+ attrs->action = (x->xso.dir == XFRM_DEV_OFFLOAD_OUT) ?
176+ MLX5_ACCEL_ESP_ACTION_ENCRYPT :
177+ MLX5_ACCEL_ESP_ACTION_DECRYPT;
178178 /* flags */
179179 attrs->flags |= (x->props.mode == XFRM_MODE_TRANSPORT) ?
180180 MLX5_ACCEL_ESP_FLAGS_TRANSPORT :
@@ -306,7 +306,7 @@ static int mlx5e_xfrm_add_state(struct xfrm_state *x) · 125 unmodified lines
306306 if (err)
307307 goto err_hw_ctx;
308308
309− if (x->xso.flags & XFRM_OFFLOAD_INBOUND) {
309+ if (x->xso.dir == XFRM_DEV_OFFLOAD_IN) {
310310 err = mlx5e_ipsec_sadb_rx_add(sa_entry);
311311 if (err)
312312 goto err_add_rule;
@@ -333,7 +333,7 @@ static void mlx5e_xfrm_del_state(struct xfrm_state *x) · 20 unmodified lines
333333 {
334334 struct mlx5e_ipsec_sa_entry *sa_entry = to_ipsec_sa_entry(x);
335335
336− if (x->xso.flags & XFRM_OFFLOAD_INBOUND)
336+ if (x->xso.dir == XFRM_DEV_OFFLOAD_IN)
337337 mlx5e_ipsec_sadb_rx_del(sa_entry);
338338 }
339339
drivers/net/netdevsim/ipsec.c+1−1
@@ -171,7 +171,7 @@ static int nsim_ipsec_add_sa(struct xfrm_state *xs) · 170 unmodified lines
171171 return ret;
172172 }
173173
174− if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) {
174+ if (xs->xso.dir == XFRM_DEV_OFFLOAD_IN) {
175175 sa.rx = true;
176176
177177 if (xs->props.family == AF_INET6)
include/net/xfrm.h+12−8
@@ -126,13 +126,17 @@ struct xfrm_state_walk { · 125 unmodified lines
126126 struct xfrm_address_filter *filter;
127127 };
128128
129−struct xfrm_state_offload {
129+enum {
130+ XFRM_DEV_OFFLOAD_IN = 1,
131+ XFRM_DEV_OFFLOAD_OUT,
132+};
133+
134+struct xfrm_dev_offload {
130135 struct net_device *dev;
131136 netdevice_tracker dev_tracker;
132137 struct net_device *real_dev;
133138 unsigned long offload_handle;
134− unsigned int num_exthdrs;
135− u8 flags;
139+ u8 dir : 2;
136140 };
137141
138142 struct xfrm_mode {
@@ -247,7 +251,7 @@ struct xfrm_state { · 108 unmodified lines
247251 struct xfrm_lifetime_cur curlft;
248252 struct hrtimer mtimer;
249253
250− struct xfrm_state_offload xso;
254+ struct xfrm_dev_offload xso;
251255
252256 /* used to fix curlft->add_time when changing date */
253257 long saved_tmo;
@@ -1006,7 +1010,7 @@ struct xfrm_offload { · 752 unmodified lines
10061010 #define CRYPTO_FALLBACK 8
10071011 #define XFRM_GSO_SEGMENT 16
10081012 #define XFRM_GRO 32
1009−#define XFRM_ESP_NO_TRAILER 64
1013+/* 64 is free */
10101014 #define XFRM_DEV_RESUME 128
10111015 #define XFRM_XMIT 256
10121016
@@ -1866,7 +1870,7 @@ bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x); · 853 unmodified lines
18661870
18671871 static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
18681872 {
1869− struct xfrm_state_offload *xso = &x->xso;
1873+ struct xfrm_dev_offload *xso = &x->xso;
18701874
18711875 if (xso->dev && xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn)
18721876 xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn(x);
@@ -1892,7 +1896,7 @@ static inline bool xfrm_dst_offload_ok(struct dst_entry *dst) · 19 unmodified lines
18921896
18931897 static inline void xfrm_dev_state_delete(struct xfrm_state *x)
18941898 {
1895− struct xfrm_state_offload *xso = &x->xso;
1899+ struct xfrm_dev_offload *xso = &x->xso;
18961900
18971901 if (xso->dev)
18981902 xso->dev->xfrmdev_ops->xdo_dev_state_delete(x);
@@ -1900,7 +1904,7 @@ static inline void xfrm_dev_state_delete(struct xfrm_state *x) · 1 unmodified line
19001904
19011905 static inline void xfrm_dev_state_free(struct xfrm_state *x)
19021906 {
1903− struct xfrm_state_offload *xso = &x->xso;
1907+ struct xfrm_dev_offload *xso = &x->xso;
19041908 struct net_device *dev = xso->dev;
19051909
19061910 if (dev && dev->xfrmdev_ops) {
net/ipv4/esp4.c+0−6
@@ -705,7 +705,6 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb) · 704 unmodified lines
705705 static inline int esp_remove_trailer(struct sk_buff *skb)
706706 {
707707 struct xfrm_state *x = xfrm_input_state(skb);
708− struct xfrm_offload *xo = xfrm_offload(skb);
709708 struct crypto_aead *aead = x->data;
710709 int alen, hlen, elen;
711710 int padlen, trimlen;
@@ -717,11 +716,6 @@ static inline int esp_remove_trailer(struct sk_buff *skb) · 5 unmodified lines
717716 hlen = sizeof(struct ip_esp_hdr) + crypto_aead_ivsize(aead);
718717 elen = skb->len - hlen;
719718
720− if (xo && (xo->flags & XFRM_ESP_NO_TRAILER)) {
721− ret = xo->proto;
722− goto out;
723− }
724−
725719 if (skb_copy_bits(skb, skb->len - alen - 2, nexthdr, 2))
726720 BUG();
727721
net/ipv6/esp6.c+0−6
@@ -741,7 +741,6 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb) · 740 unmodified lines
741741 static inline int esp_remove_trailer(struct sk_buff *skb)
742742 {
743743 struct xfrm_state *x = xfrm_input_state(skb);
744− struct xfrm_offload *xo = xfrm_offload(skb);
745744 struct crypto_aead *aead = x->data;
746745 int alen, hlen, elen;
747746 int padlen, trimlen;
@@ -753,11 +752,6 @@ static inline int esp_remove_trailer(struct sk_buff *skb) · 5 unmodified lines
753752 hlen = sizeof(struct ip_esp_hdr) + crypto_aead_ivsize(aead);
754753 elen = skb->len - hlen;
755754
756− if (xo && (xo->flags & XFRM_ESP_NO_TRAILER)) {
757− ret = xo->proto;
758− goto out;
759− }
760−
761755 ret = skb_copy_bits(skb, skb->len - alen - 2, nexthdr, 2);
762756 BUG_ON(ret);
763757
net/xfrm/xfrm_device.c+8−7
@@ -117,7 +117,7 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featur · 116 unmodified lines
117117
118118 sp = skb_sec_path(skb);
119119 x = sp->xvec[sp->len - 1];
120− if (xo->flags & XFRM_GRO || x->xso.flags & XFRM_OFFLOAD_INBOUND)
120+ if (xo->flags & XFRM_GRO || x->xso.dir == XFRM_DEV_OFFLOAD_IN)
121121 return skb;
122122
123123 /* This skb was already validated on the upper/virtual dev */
@@ -212,7 +212,7 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, · 88 unmodified lines
212212 int err;
213213 struct dst_entry *dst;
214214 struct net_device *dev;
215− struct xfrm_state_offload *xso = &x->xso;
215+ struct xfrm_dev_offload *xso = &x->xso;
216216 xfrm_address_t *saddr;
217217 xfrm_address_t *daddr;
218218
@@ -264,15 +264,16 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, · 45 unmodified lines
264264 xso->dev = dev;
265265 netdev_tracker_alloc(dev, &xso->dev_tracker, GFP_ATOMIC);
266266 xso->real_dev = dev;
267− xso->num_exthdrs = 1;
268− /* Don't forward bit that is not implemented */
269− xso->flags = xuo->flags & ~XFRM_OFFLOAD_IPV6;
267+
268+ if (xuo->flags & XFRM_OFFLOAD_INBOUND)
269+ xso->dir = XFRM_DEV_OFFLOAD_IN;
270+ else
271+ xso->dir = XFRM_DEV_OFFLOAD_OUT;
270272
271273 err = dev->xfrmdev_ops->xdo_dev_state_add(x);
272274 if (err) {
273− xso->num_exthdrs = 0;
274− xso->flags = 0;
275275 xso->dev = NULL;
276+ xso->dir = 0;
276277 xso->real_dev = NULL;
277278 dev_put_track(dev, &xso->dev_tracker);
278279
net/xfrm/xfrm_state.c+2−2
@@ -751,7 +751,7 @@ xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool · 750 unmodified lines
751751
752752 for (i = 0; i <= net->xfrm.state_hmask; i++) {
753753 struct xfrm_state *x;
754− struct xfrm_state_offload *xso;
754+ struct xfrm_dev_offload *xso;
755755
756756 hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
757757 xso = &x->xso;
@@ -835,7 +835,7 @@ int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_vali · 77 unmodified lines
835835 err = -ESRCH;
836836 for (i = 0; i <= net->xfrm.state_hmask; i++) {
837837 struct xfrm_state *x;
838− struct xfrm_state_offload *xso;
838+ struct xfrm_dev_offload *xso;
839839 restart:
840840 hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
841841 xso = &x->xso;
net/xfrm/xfrm_user.c+3−2
@@ -840,7 +840,7 @@ static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb) · 839 unmodified lines
840840 return 0;
841841 }
842842
843−static int copy_user_offload(struct xfrm_state_offload *xso, struct sk_buff *skb)
843+static int copy_user_offload(struct xfrm_dev_offload *xso, struct sk_buff *skb)
844844 {
845845 struct xfrm_user_offload *xuo;
846846 struct nlattr *attr;
@@ -852,7 +852,8 @@ static int copy_user_offload(struct xfrm_state_offload *xso, struct sk_buff *skb · 5 unmodified lines
852852 xuo = nla_data(attr);
853853 memset(xuo, 0, sizeof(*xuo));
854854 xuo->ifindex = xso->dev->ifindex;
855− xuo->flags = xso->flags;
855+ if (xso->dir == XFRM_DEV_OFFLOAD_IN)
856+ xuo->flags = XFRM_OFFLOAD_INBOUND;
856857
857858 return 0;
858859 }

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t