From: Cosmin Ratiu <[email protected]> MACsec uses BIT(30) in cqe.ft_metadata as a marker to identify MACsec-decrypted packets. This will conflict with PSP SPI values with bit 30 set, which would falsely trigger mlx5e_macsec_is_rx_flow().
Define a new marker for MACsec in flow_tag and use it in steering rules. The fs_id stays in ft_metadata bits[15:0]. Correct typos of MLX5_MACSEC_RX_METADAT_HANDLE and MLX5_MACEC_RX_FS_ID_MAX while touching this. Delete the METADATA_MARKER macro. Set flow_tag on both with-SCI and without-SCI crypto rules. Signed-off-by: Cosmin Ratiu <[email protected]> Reviewed-by: Dragos Tatulea <[email protected]> Reviewed-by: Carolina Jubran <[email protected]> Signed-off-by: Tariq Toukan <[email protected]> --- .../mellanox/mlx5/core/en_accel/flow_tag.h | 4 +++- .../mellanox/mlx5/core/en_accel/macsec.c | 6 +++--- .../mellanox/mlx5/core/en_accel/macsec.h | 5 ++++- .../ethernet/mellanox/mlx5/core/lib/macsec_fs.c | 17 ++++++++++------- .../ethernet/mellanox/mlx5/core/lib/macsec_fs.h | 9 ++++----- 5 files changed, 24 insertions(+), 17 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h index 8a02e8e9713d..28b4470bc91f 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h @@ -14,14 +14,16 @@ * [23:21] = protocol ID (3 bits): * 0 = none (default) * 1 = IPsec + * 2 = MACsec * 3 = PSP (HW decrypted, PSP header present) - * 2,4-7 = reserved + * 4-7 = reserved * [20:16] = reserved * [15:0] = used by other subsystems (e.g. TC). */ #define MLX5E_ACCEL_FLOW_TAG_PROTO_MASK GENMASK(23, 21) #define MLX5E_ACCEL_FLOW_TAG_PROTO_NONE (0 << 21) #define MLX5E_ACCEL_FLOW_TAG_PROTO_IPSEC (1 << 21) +#define MLX5E_ACCEL_FLOW_TAG_PROTO_MACSEC (2 << 21) #define MLX5E_ACCEL_FLOW_TAG_PROTO_PSP (3 << 21) static inline u32 mlx5e_accel_flow_tag(struct mlx5_cqe64 *cqe) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c index a15a0aff292f..aa7a28954861 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c @@ -752,12 +752,12 @@ static int mlx5e_macsec_add_rxsc(struct macsec_context *ctx) * a non-NULL md_dst with uninitialised contents. */ err = xa_alloc(&macsec->sc_xarray, &sc_xarray_element->fs_id, sc_xarray_element, - XA_LIMIT(1, MLX5_MACEC_RX_FS_ID_MAX), GFP_KERNEL); + XA_LIMIT(1, MLX5_MACSEC_RX_FS_ID_MAX), GFP_KERNEL); if (err) { if (err == -EBUSY) netdev_err(ctx->netdev, "MACsec offload: unable to create entry for RX SC (%d Rx SCs already allocated)\n", - MLX5_MACEC_RX_FS_ID_MAX); + MLX5_MACSEC_RX_FS_ID_MAX); goto destroy_md_dst; } @@ -1724,7 +1724,7 @@ void mlx5e_macsec_offload_handle_rx_skb(struct net_device *netdev, if (!macsec) return; - fs_id = MLX5_MACSEC_RX_METADAT_HANDLE(macsec_meta_data); + fs_id = MLX5_MACSEC_RX_METADATA_HANDLE(macsec_meta_data); rcu_read_lock(); sc_xarray_element = xa_load(&macsec->sc_xarray, fs_id); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.h index 27df72e23106..571624f2db15 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.h @@ -9,6 +9,7 @@ #include <linux/mlx5/driver.h> #include <net/macsec.h> #include <net/dst_metadata.h> +#include "en_accel/flow_tag.h" #include "lib/macsec_fs.h" struct mlx5e_priv; @@ -31,7 +32,9 @@ static inline bool mlx5e_macsec_skb_is_offload(struct sk_buff *skb) static inline bool mlx5e_macsec_is_rx_flow(struct mlx5_cqe64 *cqe) { - return MLX5_MACSEC_METADATA_MARKER(be32_to_cpu(cqe->ft_metadata)); + u32 proto = mlx5e_accel_flow_tag_proto(cqe); + + return proto == MLX5E_ACCEL_FLOW_TAG_PROTO_MACSEC; } void mlx5e_macsec_offload_handle_rx_skb(struct net_device *netdev, struct sk_buff *skb, diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c index efc5167493c1..b8e9021027e9 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c @@ -8,6 +8,7 @@ #include <linux/mlx5/macsec.h> #include "fs_core.h" #include "lib/macsec_fs.h" +#include "en_accel/flow_tag.h" #include "mlx5_core.h" /* MACsec TX flow steering */ @@ -45,9 +46,6 @@ #define MLX5_SECTAG_HEADER_SIZE_WITHOUT_SCI 0x8 #define MLX5_SECTAG_HEADER_SIZE_WITH_SCI (MLX5_SECTAG_HEADER_SIZE_WITHOUT_SCI + MACSEC_SCI_LEN) -/* MACsec fs_id handling for steering */ -#define macsec_fs_set_rx_fs_id(fs_id) ((fs_id) | BIT(30)) - struct mlx5_sectag_header { __be16 ethertype; u8 tci_an; @@ -1757,11 +1755,10 @@ macsec_fs_rx_add_rule(struct mlx5_macsec_fs *macsec_fs, rx_tables = &rx_fs->tables; ft_crypto = &rx_tables->ft_crypto; - /* Set bit[31 - 30] macsec marker - 0x01 */ /* Set bit[15-0] fs id */ MLX5_SET(set_action_in, action, action_type, MLX5_ACTION_TYPE_SET); MLX5_SET(set_action_in, action, field, MLX5_ACTION_IN_FIELD_METADATA_REG_B); - MLX5_SET(set_action_in, action, data, macsec_fs_set_rx_fs_id(fs_id)); + MLX5_SET(set_action_in, action, data, fs_id); MLX5_SET(set_action_in, action, offset, 0); MLX5_SET(set_action_in, action, length, 32); @@ -1778,6 +1775,9 @@ macsec_fs_rx_add_rule(struct mlx5_macsec_fs *macsec_fs, /* Rx crypto table with SCI rule */ macsec_fs_rx_setup_fte(spec, &flow_act, attrs, true); + spec->flow_context.flags |= FLOW_CONTEXT_HAS_TAG; + spec->flow_context.flow_tag = MLX5E_ACCEL_FLOW_TAG_PROTO_MACSEC; + flow_act.modify_hdr = modify_hdr; flow_act.action = MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | MLX5_FLOW_CONTEXT_ACTION_CRYPTO_DECRYPT | @@ -1803,6 +1803,9 @@ macsec_fs_rx_add_rule(struct mlx5_macsec_fs *macsec_fs, macsec_fs_rx_setup_fte(spec, &flow_act, attrs, false); + spec->flow_context.flags |= FLOW_CONTEXT_HAS_TAG; + spec->flow_context.flow_tag = MLX5E_ACCEL_FLOW_TAG_PROTO_MACSEC; + flow_act.modify_hdr = modify_hdr; flow_act.action = MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | MLX5_FLOW_CONTEXT_ACTION_CRYPTO_DECRYPT | @@ -2160,8 +2163,8 @@ static int mlx5_macsec_fs_add_roce_rule_rx(struct mlx5_macsec_fs *macsec_fs, u32 spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS_2; MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, misc_parameters_2.metadata_reg_c_5); - MLX5_SET(fte_match_param, spec->match_value, misc_parameters_2.metadata_reg_c_5, - macsec_fs_set_rx_fs_id(fs_id)); + MLX5_SET(fte_match_param, spec->match_value, + misc_parameters_2.metadata_reg_c_5, fs_id); flow_act.action = MLX5_FLOW_CONTEXT_ACTION_ALLOW; new_rule = mlx5_add_flow_rules(rx_fs->roce.ft_macsec_op_check, spec, &flow_act, NULL, 0); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.h index 15acaff43641..b8b8b412d5c3 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.h @@ -6,11 +6,10 @@ #ifdef CONFIG_MLX5_MACSEC -/* Bit31 - 30: MACsec marker, Bit15-0: MACsec id */ -#define MLX5_MACEC_RX_FS_ID_MAX USHRT_MAX /* Must be power of two */ -#define MLX5_MACSEC_RX_FS_ID_MASK MLX5_MACEC_RX_FS_ID_MAX -#define MLX5_MACSEC_METADATA_MARKER(metadata) ((((metadata) >> 30) & 0x3) == 0x1) -#define MLX5_MACSEC_RX_METADAT_HANDLE(metadata) ((metadata) & MLX5_MACSEC_RX_FS_ID_MASK) +/* MACsec fs_id in ft_metadata bits[15:0] */ +#define MLX5_MACSEC_RX_FS_ID_MAX USHRT_MAX /* Must be power of two */ +#define MLX5_MACSEC_RX_FS_ID_MASK MLX5_MACSEC_RX_FS_ID_MAX +#define MLX5_MACSEC_RX_METADATA_HANDLE(metadata) ((metadata) & MLX5_MACSEC_RX_FS_ID_MASK) /* MACsec TX flow steering */ #define MLX5_ETH_WQE_FT_META_MACSEC_MASK \ -- 2.44.0
