Commit bebb23e6 authored by Ilan Tayari's avatar Ilan Tayari Committed by Saeed Mahameed
Browse files

net/mlx5: Accel, Add IPSec acceleration interface 



Add routines for manipulating the hardware IPSec SA database (SADB).

In Innova IPSec, a Security Association (SA) is added or deleted
via a command message over the SBU connection.
The HW then sends a response message over the same connection.

Add implementation for Innova IPSec (FPGA-based) hardware.

These routines will be used by the IPSec offload support in a later patch
However they may also be used by others such as RDMA and RoCE IPSec.

mlx5/accel is a middle acceleration layer to allow mlx5e and other ULPs
to work directly with mlx5_core rather than Innova FPGA or other mlx5
acceleration providers.

In this patchset we add Innova IPSec support and mlx5/accel delegates
IPSec offloads to Innova routines.

In the future, when IPSec/TLS or any other acceleration gets integrated
into ConnectX chip, mlx5/accel layer will provide the integrated
acceleration, rather than the Innova one.

Signed-off-by: default avatarIlan Tayari <ilant@mellanox.com>
Signed-off-by: default avatarBoris Pismenny <borisp@mellanox.com>
Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
parent a9956d35

drivers/net/ethernet/mellanox/mlx5/core/Kconfig

+4 −0
Original line number Diff line number Diff line
@@ -11,9 +11,13 @@ config MLX5_CORE 
	  Core driver for low level functionality of the ConnectX-4 and

	  Connect-IB cards by Mellanox Technologies.



config MLX5_ACCEL

	bool



config MLX5_FPGA

        bool "Mellanox Technologies Innova support"

        depends on MLX5_CORE

	select MLX5_ACCEL

        ---help---

          Build support for the Innova family of network cards by Mellanox

          Technologies. Innova network cards are comprised of a ConnectX chip

drivers/net/ethernet/mellanox/mlx5/core/Makefile

+4 −1
Original line number Diff line number Diff line
@@ -6,7 +6,10 @@ mlx5_core-y := main.o cmd.o debugfs.o fw.o eq.o uar.o pagealloc.o \ 
		mad.o transobj.o vport.o sriov.o fs_cmd.o fs_core.o \

		fs_counters.o rl.o lag.o dev.o lib/gid.o



mlx5_core-$(CONFIG_MLX5_FPGA) += fpga/cmd.o fpga/core.o fpga/conn.o fpga/sdk.o

mlx5_core-$(CONFIG_MLX5_ACCEL) += accel/ipsec.o



mlx5_core-$(CONFIG_MLX5_FPGA) += fpga/cmd.o fpga/core.o fpga/conn.o fpga/sdk.o \

		fpga/ipsec.o



mlx5_core-$(CONFIG_MLX5_CORE_EN) += wq.o eswitch.o eswitch_offloads.o \

		en_main.o en_common.o en_fs.o en_ethtool.o en_tx.o \

drivers/net/ethernet/mellanox/mlx5/core/accel/ipsec.c

0 → 100644
+78 −0
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2017 Mellanox Technologies. All rights reserved.

 *

 * This software is available to you under a choice of one of two

 * licenses.  You may choose to be licensed under the terms of the GNU

 * General Public License (GPL) Version 2, available from the file

 * COPYING in the main directory of this source tree, or the

 * OpenIB.org BSD license below:

 *

 *     Redistribution and use in source and binary forms, with or

 *     without modification, are permitted provided that the following

 *     conditions are met:

 *

 *      - Redistributions of source code must retain the above

 *        copyright notice, this list of conditions and the following

 *        disclaimer.

 *

 *      - Redistributions in binary form must reproduce the above

 *        copyright notice, this list of conditions and the following

 *        disclaimer in the documentation and/or other materials

 *        provided with the distribution.

 *

 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,

 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS

 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

 * SOFTWARE.

 *

 */



#include <linux/mlx5/device.h>



#include "accel/ipsec.h"

#include "mlx5_core.h"

#include "fpga/ipsec.h"



void *mlx5_accel_ipsec_sa_cmd_exec(struct mlx5_core_dev *mdev,

				   struct mlx5_accel_ipsec_sa *cmd)

{

	if (!MLX5_IPSEC_DEV(mdev))

		return ERR_PTR(-EOPNOTSUPP);



	return mlx5_fpga_ipsec_sa_cmd_exec(mdev, cmd);

}



int mlx5_accel_ipsec_sa_cmd_wait(void *ctx)

{

	return mlx5_fpga_ipsec_sa_cmd_wait(ctx);

}



u32 mlx5_accel_ipsec_device_caps(struct mlx5_core_dev *mdev)

{

	return mlx5_fpga_ipsec_device_caps(mdev);

}



unsigned int mlx5_accel_ipsec_counters_count(struct mlx5_core_dev *mdev)

{

	return mlx5_fpga_ipsec_counters_count(mdev);

}



int mlx5_accel_ipsec_counters_read(struct mlx5_core_dev *mdev, u64 *counters,

				   unsigned int count)

{

	return mlx5_fpga_ipsec_counters_read(mdev, counters, count);

}



int mlx5_accel_ipsec_init(struct mlx5_core_dev *mdev)

{

	return mlx5_fpga_ipsec_init(mdev);

}



void mlx5_accel_ipsec_cleanup(struct mlx5_core_dev *mdev)

{

	mlx5_fpga_ipsec_cleanup(mdev);

}

drivers/net/ethernet/mellanox/mlx5/core/accel/ipsec.h

0 → 100644
+138 −0
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2017 Mellanox Technologies. All rights reserved.

 *

 * This software is available to you under a choice of one of two

 * licenses.  You may choose to be licensed under the terms of the GNU

 * General Public License (GPL) Version 2, available from the file

 * COPYING in the main directory of this source tree, or the

 * OpenIB.org BSD license below:

 *

 *     Redistribution and use in source and binary forms, with or

 *     without modification, are permitted provided that the following

 *     conditions are met:

 *

 *      - Redistributions of source code must retain the above

 *        copyright notice, this list of conditions and the following

 *        disclaimer.

 *

 *      - Redistributions in binary form must reproduce the above

 *        copyright notice, this list of conditions and the following

 *        disclaimer in the documentation and/or other materials

 *        provided with the distribution.

 *

 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,

 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS

 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN

 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE

 * SOFTWARE.

 *

 */



#ifndef __MLX5_ACCEL_IPSEC_H__

#define __MLX5_ACCEL_IPSEC_H__



#ifdef CONFIG_MLX5_ACCEL



#include <linux/mlx5/driver.h>



enum {

	MLX5_ACCEL_IPSEC_DEVICE = BIT(1),

	MLX5_ACCEL_IPSEC_IPV6 = BIT(2),

	MLX5_ACCEL_IPSEC_ESP = BIT(3),

	MLX5_ACCEL_IPSEC_LSO = BIT(4),

};



#define MLX5_IPSEC_SADB_IP_AH       BIT(7)

#define MLX5_IPSEC_SADB_IP_ESP      BIT(6)

#define MLX5_IPSEC_SADB_SA_VALID    BIT(5)

#define MLX5_IPSEC_SADB_SPI_EN      BIT(4)

#define MLX5_IPSEC_SADB_DIR_SX      BIT(3)

#define MLX5_IPSEC_SADB_IPV6        BIT(2)



enum {

	MLX5_IPSEC_CMD_ADD_SA = 0,

	MLX5_IPSEC_CMD_DEL_SA = 1,

};



enum mlx5_accel_ipsec_enc_mode {

	MLX5_IPSEC_SADB_MODE_NONE = 0,

	MLX5_IPSEC_SADB_MODE_AES_GCM_128_AUTH_128 = 1,

	MLX5_IPSEC_SADB_MODE_AES_GCM_256_AUTH_128 = 3,

};



#define MLX5_IPSEC_DEV(mdev) (mlx5_accel_ipsec_device_caps(mdev) & \

			      MLX5_ACCEL_IPSEC_DEVICE)



struct mlx5_accel_ipsec_sa {

	__be32 cmd;

	u8 key_enc[32];

	u8 key_auth[32];

	__be32 sip[4];

	__be32 dip[4];

	union {

		struct {

			__be32 reserved;

			u8 salt_iv[8];

			__be32 salt;

		} __packed gcm;

		struct {

			u8 salt[16];

		} __packed cbc;

	};

	__be32 spi;

	__be32 sw_sa_handle;

	__be16 tfclen;

	u8 enc_mode;

	u8 sip_masklen;

	u8 dip_masklen;

	u8 flags;

	u8 reserved[2];

} __packed;



/**

 * mlx5_accel_ipsec_sa_cmd_exec - Execute an IPSec SADB command

 * @mdev: mlx5 device

 * @cmd: command to execute

 * May be called from atomic context. Returns context pointer, or error

 * Caller must eventually call mlx5_accel_ipsec_sa_cmd_wait from non-atomic

 * context, to cleanup the context pointer

 */

void *mlx5_accel_ipsec_sa_cmd_exec(struct mlx5_core_dev *mdev,

				   struct mlx5_accel_ipsec_sa *cmd);



/**

 * mlx5_accel_ipsec_sa_cmd_wait - Wait for command execution completion

 * @context: Context pointer returned from call to mlx5_accel_ipsec_sa_cmd_exec

 * Sleeps (killable) until command execution is complete.

 * Returns the command result, or -EINTR if killed

 */

int mlx5_accel_ipsec_sa_cmd_wait(void *context);



u32 mlx5_accel_ipsec_device_caps(struct mlx5_core_dev *mdev);



unsigned int mlx5_accel_ipsec_counters_count(struct mlx5_core_dev *mdev);

int mlx5_accel_ipsec_counters_read(struct mlx5_core_dev *mdev, u64 *counters,

				   unsigned int count);



int mlx5_accel_ipsec_init(struct mlx5_core_dev *mdev);

void mlx5_accel_ipsec_cleanup(struct mlx5_core_dev *mdev);



#else



#define MLX5_IPSEC_DEV(mdev) false



static inline int mlx5_accel_ipsec_init(struct mlx5_core_dev *mdev)

{

	return 0;

}



static inline void mlx5_accel_ipsec_cleanup(struct mlx5_core_dev *mdev)

{

}



#endif



#endif	/* __MLX5_ACCEL_IPSEC_H__ */

drivers/net/ethernet/mellanox/mlx5/core/fpga/core.h

+2 −0
Original line number Diff line number Diff line
@@ -51,6 +51,8 @@ struct mlx5_fpga_device { 
		struct mlx5_core_mkey mkey;

		struct mlx5_uars_page *uar;

	} conn_res;



	struct mlx5_fpga_ipsec *ipsec;

};



#define mlx5_fpga_dbg(__adev, format, ...) \

CRA Git | Maintained and supported by SUSTech CRA and CCSE