From: Cosmin Ratiu <[email protected]> The MACsec protocol marker will soon move to flow_tag and that will make TC offload unusable at the same time as MACsec on the same device.
This patch makes use of the mutual exclusion mechanism to make sure that TC and MACsec cannot be both active at the same time. One extra bit of logic is in macsec_upd_secy_hw_address(), where existing macsec rules are drained then readded. During the two loops it's possible a mistimed TC filter add to throw a wrench into things and prevent the 2nd loop from adding anything, since accel rules are now blocked. Fix that by keeping a best-effort TC block across the entire operation. Signed-off-by: Cosmin Ratiu <[email protected]> Reviewed-by: Dragos Tatulea <[email protected]> Reviewed-by: Carolina Jubran <[email protected]> Signed-off-by: Tariq Toukan <[email protected]> --- .../mellanox/mlx5/core/en_accel/macsec.c | 28 +++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c index daff53ba7d09..a15a0aff292f 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c @@ -10,6 +10,7 @@ #include "en.h" #include "lib/aso.h" #include "lib/crypto.h" +#include "en_accel/en_accel.h" #include "en_accel/macsec.h" #define MLX5_MACSEC_EPN_SCOPE_MID 0x80000000L @@ -324,6 +325,8 @@ static void mlx5e_macsec_cleanup_sa_fs(struct mlx5e_macsec *macsec, mlx5_macsec_fs_del_rule(macsec->mdev->macsec_fs, sa->macsec_rule, action, netdev, fs_id); sa->macsec_rule = NULL; + if (!is_tx) + mlx5e_accel_unblock_tc_offload(macsec->mdev); } static void mlx5e_macsec_cleanup_sa(struct mlx5e_macsec *macsec, @@ -343,6 +346,7 @@ static int mlx5e_macsec_init_sa_fs(struct macsec_context *ctx, const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc; struct mlx5_macsec_rule_attrs rule_attrs; union mlx5_macsec_rule *macsec_rule; + int err = 0; if (is_tx && tx_sc->encoding_sa != sa->assoc_num) return 0; @@ -353,13 +357,26 @@ static int mlx5e_macsec_init_sa_fs(struct macsec_context *ctx, rule_attrs.action = (is_tx) ? MLX5_ACCEL_MACSEC_ACTION_ENCRYPT : MLX5_ACCEL_MACSEC_ACTION_DECRYPT; + if (!is_tx) { + err = mlx5e_accel_block_tc_offload(priv->mdev); + if (err) + return err; + } + macsec_rule = mlx5_macsec_fs_add_rule(macsec_fs, ctx, &rule_attrs, fs_id); - if (!macsec_rule) - return -ENOMEM; + if (!macsec_rule) { + err = -ENOMEM; + goto out_unblock_tc; + } sa->macsec_rule = macsec_rule; return 0; + +out_unblock_tc: + if (!is_tx) + mlx5e_accel_unblock_tc_offload(priv->mdev); + return err; } static int mlx5e_macsec_init_sa(struct macsec_context *ctx, @@ -1137,7 +1154,12 @@ static int macsec_upd_secy_hw_address(struct macsec_context *ctx, struct mlx5e_macsec_sa *rx_sa; struct list_head *list; int i, err = 0; + bool block_tc; + /* Best-effort TC block across the operation, to prevent a mistimed TC + * filter add from preventing the 2nd loop from happening. + */ + block_tc = mlx5e_accel_block_tc_offload(priv->mdev) == 0; list = &macsec_device->macsec_rx_sc_list_head; list_for_each_entry_safe(rx_sc, tmp, list, rx_sc_list_element) { @@ -1168,6 +1190,8 @@ static int macsec_upd_secy_hw_address(struct macsec_context *ctx, memcpy(macsec_device->dev_addr, dev->dev_addr, dev->addr_len); out: + if (block_tc) + mlx5e_accel_unblock_tc_offload(priv->mdev); return err; } -- 2.44.0
