git: fb65357d8707 - main - ipsec_offload: pre-calculate xform_history for recorded accelerated SA

[Konstantin Belousov]

The branch main has been updated by kib:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=fb65357d8707219c98db2216622057133f42fa3d

commit fb65357d8707219c98db2216622057133f42fa3d
Author:     Konstantin Belousov <k...@freebsd.org>
AuthorDate: 2025-07-06 16:54:42 +0000
Commit:     Konstantin Belousov <k...@freebsd.org>
CommitDate: 2025-07-17 09:36:18 +0000

    ipsec_offload: pre-calculate xform_history for recorded accelerated SA
    
    Also provide the helper to fill the xform_history into mtag, provided by
    a driver.
    
    Reviewed by:    Ariel Ehrenberg <aehrenb...@nvidia.com>, slavash
    Sponsored by:   Nvidia networking
---
 sys/netipsec/ipsec_offload.c | 21 +++++++++++++++++++++
 sys/netipsec/ipsec_offload.h |  4 ++++
 2 files changed, 25 insertions(+)

diff --git a/sys/netipsec/ipsec_offload.c b/sys/netipsec/ipsec_offload.c
index 467d5ded1d7a..a2092c91c1aa 100644
--- a/sys/netipsec/ipsec_offload.c
+++ b/sys/netipsec/ipsec_offload.c
@@ -94,6 +94,7 @@ struct ifp_handle_sav {
        size_t hdr_ext_size;
        uint64_t cnt_octets;
        uint64_t cnt_allocs;
+       struct xform_history xfh;
 };
 
 #define        IFP_HS_HANDLED  0x00000001
@@ -412,6 +413,10 @@ ipsec_accel_handle_sav(struct secasvar *sav, struct ifnet 
*ifp,
        ihs->ifdata = priv;
        ihs->flags = flags;
        ihs->hdr_ext_size = esp_hdrsiz(sav);
+       memcpy(&ihs->xfh.dst, &sav->sah->saidx.dst, sizeof(ihs->xfh.dst));
+       ihs->xfh.spi = sav->spi;
+       ihs->xfh.proto = sav->sah->saidx.proto;
+       ihs->xfh.mode = sav->sah->saidx.mode;
        mtx_lock(&ipsec_accel_sav_tmp);
        CK_LIST_FOREACH(i, &sav->accel_ifps, sav_link) {
                if (i->ifp == ifp) {
@@ -1162,4 +1167,20 @@ ipsec_accel_key_setaccelif_impl(struct secasvar *sav)
        return (m);
 }
 
+bool
+ipsec_accel_fill_xh(if_t ifp, uint32_t drv_spi, struct xform_history *xh)
+{
+       struct ifp_handle_sav *i;
+
+       if (drv_spi < IPSEC_ACCEL_DRV_SPI_MIN ||
+           drv_spi > IPSEC_ACCEL_DRV_SPI_MAX)
+               return (false);
+
+       i = DRVSPI_SA_PCTRIE_LOOKUP(&drv_spi_pctrie, drv_spi);
+       if (i == NULL)
+               return (false);
+       memcpy(xh, &i->xfh, sizeof(*xh));
+       return (true);
+}
+
 #endif /* IPSEC_OFFLOAD */
diff --git a/sys/netipsec/ipsec_offload.h b/sys/netipsec/ipsec_offload.h
index 904fe6252396..6e374d721a4f 100644
--- a/sys/netipsec/ipsec_offload.h
+++ b/sys/netipsec/ipsec_offload.h
@@ -180,6 +180,9 @@ bool ipsec_accel_output(struct ifnet *ifp, struct mbuf *m,
     struct inpcb *inp, struct secpolicy *sp, struct secasvar *sav, int af,
     int mtu, int *hwassist);
 void ipsec_accel_forget_sav(struct secasvar *sav);
+struct xform_history;
+bool ipsec_accel_fill_xh(if_t ifp, uint32_t drv_spi,
+    struct xform_history *xh);
 #else
 #define        ipsec_accel_input(a, b, c) (ENXIO)
 #define        ipsec_accel_output(a, b, c, d, e, f, g, h) ({   \
@@ -187,6 +190,7 @@ void ipsec_accel_forget_sav(struct secasvar *sav);
        false;                                          \
 })
 #define        ipsec_accel_forget_sav(a)
+#define        ipsec_accel_fill_xh(a, b, c)    (false)
 #endif
 
 struct ipsec_accel_in_tag *ipsec_accel_input_tag_lookup(const struct mbuf *);