Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 23f30c41 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'mlx5-TLS-TX-HW-offload-support' 

Tariq Toukan says:

====================
mlx5 TLS TX HW offload support

This series from Eran and me, adds TLS TX HW offload support to
the mlx5 driver.

This offloads the kTLS encryption process from kernel to the
Mellanox NIC, saving CPU cycles and improving utilization.

Upon a new TLS connection request, driver is responsible to create
a dedicated HW context and configure it according to the crypto info,
so HW can do the encryption itself.

When the HW context gets out-of-sync (i.e. due to packets retransmission),
driver is responsible for the re-sync process.
This is done by posting special resync descriptors to the HW.

Feature is supported on Mellanox Connect-X 6DX, and newer.
Series was tested on SimX simulator.

Series generated against net-next commit [1], with Saeed's request pulled [2]:

[1] c4cde580 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
[2] git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux.git

 tags/mlx5-updates-2019-07-04-v2

Changes from last pull request:
Fixed comments from Jakub:
Patch 4:
- Replace zero  memset with a call to memzero_explicit().
Patch 11:
- Fix stats counters names.
- Drop TLS SKB with non-matching netdev.
====================

Acked-by: default avatarJakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 61c2491d d2ead1f3

drivers/net/ethernet/mellanox/mlx5/core/Kconfig

+43 −9
Original line number Diff line number Diff line
@@ -97,26 +97,60 @@ config MLX5_CORE_IPOIB 
	---help---

	  MLX5 IPoIB offloads & acceleration support.



config MLX5_FPGA_IPSEC

	bool "Mellanox Technologies IPsec Innova support"

	depends on MLX5_CORE

	depends on MLX5_FPGA

	default n

	help

	Build IPsec support for the Innova family of network cards by Mellanox

	Technologies. Innova network cards are comprised of a ConnectX chip

	and an FPGA chip on one board. If you select this option, the

	mlx5_core driver will include the Innova FPGA core and allow building

	sandbox-specific client drivers.



config MLX5_EN_IPSEC

	bool "IPSec XFRM cryptography-offload accelaration"

	depends on MLX5_ACCEL

	depends on MLX5_CORE_EN

	depends on XFRM_OFFLOAD

	depends on INET_ESP_OFFLOAD || INET6_ESP_OFFLOAD

	depends on MLX5_FPGA_IPSEC

	default n

	---help---

	help

	  Build support for IPsec cryptography-offload accelaration in the NIC.

	  Note: Support for hardware with this capability needs to be selected

	  for this option to become available.



config MLX5_EN_TLS

	bool "TLS cryptography-offload accelaration"

config MLX5_FPGA_TLS

	bool "Mellanox Technologies TLS Innova support"

	depends on TLS_DEVICE

	depends on TLS=y || MLX5_CORE=m

	depends on MLX5_FPGA

	default n

	help

	Build TLS support for the Innova family of network cards by Mellanox

	Technologies. Innova network cards are comprised of a ConnectX chip

	and an FPGA chip on one board. If you select this option, the

	mlx5_core driver will include the Innova FPGA core and allow building

	sandbox-specific client drivers.



config MLX5_TLS

	bool "Mellanox Technologies TLS Connect-X support"

	depends on MLX5_CORE_EN

	depends on TLS_DEVICE

	depends on TLS=y || MLX5_CORE=m

	depends on MLX5_ACCEL

	select MLX5_ACCEL

	default n

	---help---

	help

	Build TLS support for the Connect-X family of network cards by Mellanox

	Technologies.



config MLX5_EN_TLS

	bool "TLS cryptography-offload accelaration"

	depends on MLX5_CORE_EN

	depends on MLX5_FPGA_TLS || MLX5_TLS

	default y

	help

	Build support for TLS cryptography-offload accelaration in the NIC.

	Note: Support for hardware with this capability needs to be selected

	for this option to become available.

drivers/net/ethernet/mellanox/mlx5/core/Makefile

+6 −4
Original line number Diff line number Diff line
@@ -53,12 +53,14 @@ mlx5_core-$(CONFIG_MLX5_CORE_IPOIB) += ipoib/ipoib.o ipoib/ethtool.o ipoib/ipoib 
#

# Accelerations & FPGA

#

mlx5_core-$(CONFIG_MLX5_ACCEL) += accel/ipsec.o accel/tls.o

mlx5_core-$(CONFIG_MLX5_FPGA_IPSEC) += fpga/ipsec.o

mlx5_core-$(CONFIG_MLX5_FPGA_TLS)   += fpga/tls.o

mlx5_core-$(CONFIG_MLX5_ACCEL)      += lib/crypto.o accel/tls.o accel/ipsec.o



mlx5_core-$(CONFIG_MLX5_FPGA) += fpga/cmd.o fpga/core.o fpga/conn.o fpga/sdk.o \

				 fpga/ipsec.o fpga/tls.o

mlx5_core-$(CONFIG_MLX5_FPGA) += fpga/cmd.o fpga/core.o fpga/conn.o fpga/sdk.o



mlx5_core-$(CONFIG_MLX5_EN_IPSEC) += en_accel/ipsec.o en_accel/ipsec_rxtx.o \

				     en_accel/ipsec_stats.o



mlx5_core-$(CONFIG_MLX5_EN_TLS) += en_accel/tls.o en_accel/tls_rxtx.o en_accel/tls_stats.o
 
mlx5_core-$(CONFIG_MLX5_EN_TLS) += en_accel/tls.o en_accel/tls_rxtx.o en_accel/tls_stats.o \

				   en_accel/ktls.o en_accel/ktls_tx.o

drivers/net/ethernet/mellanox/mlx5/core/accel/ipsec.c

+9 −0
Original line number Diff line number Diff line
@@ -31,6 +31,8 @@ 
 *

 */



#ifdef CONFIG_MLX5_FPGA_IPSEC



#include <linux/mlx5/device.h>



#include "accel/ipsec.h"
@@ -74,6 +76,11 @@ int mlx5_accel_ipsec_init(struct mlx5_core_dev *mdev) 
	return mlx5_fpga_ipsec_init(mdev);

}



void mlx5_accel_ipsec_build_fs_cmds(void)

{

	mlx5_fpga_ipsec_build_fs_cmds();

}



void mlx5_accel_ipsec_cleanup(struct mlx5_core_dev *mdev)

{

	mlx5_fpga_ipsec_cleanup(mdev);
@@ -107,3 +114,5 @@ int mlx5_accel_esp_modify_xfrm(struct mlx5_accel_esp_xfrm *xfrm, 
	return mlx5_fpga_esp_modify_xfrm(xfrm, attrs);

}

EXPORT_SYMBOL_GPL(mlx5_accel_esp_modify_xfrm);



#endif

drivers/net/ethernet/mellanox/mlx5/core/accel/ipsec.h

+6 −1
Original line number Diff line number Diff line
@@ -37,7 +37,7 @@ 
#include <linux/mlx5/driver.h>

#include <linux/mlx5/accel.h>



#ifdef CONFIG_MLX5_ACCEL

#ifdef CONFIG_MLX5_FPGA_IPSEC



#define MLX5_IPSEC_DEV(mdev) (mlx5_accel_ipsec_device_caps(mdev) & \

			      MLX5_ACCEL_IPSEC_CAP_DEVICE)
@@ -54,6 +54,7 @@ void *mlx5_accel_esp_create_hw_context(struct mlx5_core_dev *mdev, 
void mlx5_accel_esp_free_hw_context(void *context);



int mlx5_accel_ipsec_init(struct mlx5_core_dev *mdev);

void mlx5_accel_ipsec_build_fs_cmds(void);

void mlx5_accel_ipsec_cleanup(struct mlx5_core_dev *mdev);



#else
@@ -79,6 +80,10 @@ static inline int mlx5_accel_ipsec_init(struct mlx5_core_dev *mdev) 
	return 0;

}



static inline void mlx5_accel_ipsec_build_fs_cmds(void)

{

}



static inline void mlx5_accel_ipsec_cleanup(struct mlx5_core_dev *mdev)

{

}

drivers/net/ethernet/mellanox/mlx5/core/accel/tls.c

+44 −1
Original line number Diff line number Diff line
@@ -35,6 +35,9 @@ 


#include "accel/tls.h"

#include "mlx5_core.h"

#include "lib/mlx5.h"



#ifdef CONFIG_MLX5_FPGA_TLS

#include "fpga/tls.h"



int mlx5_accel_tls_add_flow(struct mlx5_core_dev *mdev, void *flow,
@@ -61,7 +64,8 @@ int mlx5_accel_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq, 


bool mlx5_accel_is_tls_device(struct mlx5_core_dev *mdev)

{

	return mlx5_fpga_is_tls_device(mdev);

	return mlx5_fpga_is_tls_device(mdev) ||

		mlx5_accel_is_ktls_device(mdev);

}



u32 mlx5_accel_tls_device_caps(struct mlx5_core_dev *mdev)
@@ -78,3 +82,42 @@ void mlx5_accel_tls_cleanup(struct mlx5_core_dev *mdev) 
{

	mlx5_fpga_tls_cleanup(mdev);

}

#endif



#ifdef CONFIG_MLX5_TLS

int mlx5_ktls_create_key(struct mlx5_core_dev *mdev,

			 struct tls_crypto_info *crypto_info,

			 u32 *p_key_id)

{

	u32 sz_bytes;

	void *key;



	switch (crypto_info->cipher_type) {

	case TLS_CIPHER_AES_GCM_128: {

		struct tls12_crypto_info_aes_gcm_128 *info =

			(struct tls12_crypto_info_aes_gcm_128 *)crypto_info;



		key      = info->key;

		sz_bytes = sizeof(info->key);

		break;

	}

	case TLS_CIPHER_AES_GCM_256: {

		struct tls12_crypto_info_aes_gcm_256 *info =

			(struct tls12_crypto_info_aes_gcm_256 *)crypto_info;



		key      = info->key;

		sz_bytes = sizeof(info->key);

		break;

	}

	default:

		return -EINVAL;

	}



	return mlx5_create_encryption_key(mdev, key, sz_bytes, p_key_id);

}



void mlx5_ktls_destroy_key(struct mlx5_core_dev *mdev, u32 key_id)

{

	mlx5_destroy_encryption_key(mdev, key_id);

}

#endif