From nobody Fri Sep 25 22:19:10 2026 Received: from SJ2PR03CU001.outbound.protection.outlook.com (mail-westusazon11012004.outbound.protection.outlook.com [52.101.43.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 53E7F38F633; Tue, 8 Sep 2026 06:53:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.43.4 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850435; cv=fail; b=mVv1JEmgL1KgJjoICLrs4MOzDtg3mHVNFxVc7lByh8JW4frCrbMN8aWm/yqpvUQZ1BVbzx1g5Kvyjg74PaJTLXOyD0wECSFVZ7ME/WIpoWoJ1cHhTGf61U4RzFUQxb/zdyr/JsvdTw52A+UMRAI2BZxMRTYPWN20fRJjxomt4V0= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850435; c=relaxed/simple; bh=X5id81YrAB66AKAm8ZY4Zducf0tjLGs2uNTvRIGfyaI=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=BhbS/oHWP+Ku7lcb1Mt4Qu2RWLV3zOWpWc+98rfc29x0HqnmKrPzd16HANvkjf5wITuME17ERWlH29t2+V+tsg+t8yzvvADop2Cu3hCrC9KXcGRkcvjz9rYZNtULllqORjQWkRCpGjsajHI9i8SL/uc5jnqJns4+dZ8/FLYTHrI= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=HPKzhcfX; arc=fail smtp.client-ip=52.101.43.4 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="HPKzhcfX" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=x34jrQusxvqkLVpXVNCt+RScVGaCR/mqJhFej3dIqt0Cs4fH+Hxu3HJOZZP4Z/D1Ve/lFq5LJTjCfphRm6L0TPFY6c/e6p9fXi6y6e+C6ZtfdEuJnBNb01DmM5yG1NO422Ket0Y+EP+NdWnzIvYOXpccTdtU/ukVeJ6EuFPs8uNBe6UnVQ7Q7X9KFwMLRr7NM/lXU2QhCpvqv1eXKWlznvGGUgaoHcDv/6jhLJ0+a7UwCVZJPgUd6CDrCqerN4AIuTO4d31+lI8gwmZiirKR8njC3eelC+IZyXRADq0pw3GzowbAh0ncMUElXNeIN5kOsnX+csBYMWmAOyJBhLBScw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=DEnOODsUXFEHOVGRyiR5UCHrLtKI05wWoyYhios6ydM=; b=gjz4gGdl22A2a8JsMVI1zPpxziZFZg2YUYypt8w4y9YWZtXpb7H9VdEg4W3M7FT508dvAlMeDRy3uPUoXyj31E8OW50HJXPjkz+Unyq4yuIQ0WVDKi9Ub8HRk7tuf3wogATk16gUFRhEx9ZA7ietzlzE41gYG94iyfWFHKJevEP38LG0KarLtrXnUX9dDdAGFfid/gltdGObHy2ARCVXXhxJ8gIQjgcyVWAmKyNbZSEZ+ScO+b4JQRElQQzvzo2LH4MDauGTbqcX15X9LQK8uZy6thgMqQzUnV3BHyzQlOzevh75T+xfzyuQp5zwuwe5mERZRAMZ2sEMSzTP7jHbzg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DEnOODsUXFEHOVGRyiR5UCHrLtKI05wWoyYhios6ydM=; b=HPKzhcfX7hmOl31C1/2TOks3xvbWF6uLv4icLEkFPs29rZ+uQxkZPXqwSHPPFZKLFc7hET1AWG5Qh+yQ09AhJJd/ETah/pkVtXFBtEPevAh9kQUzyVIpluG56kMGOuqe08RLrhSnFfPOkr/xMqdj8tIv5WDULkEEGAZ2g7Hbk4FcZH1Rb6iZQENJAaN7T357QAZUMPGAiHmjt5XYba4sTxJceSkE1eZ2MEnQngEIdtZmev1uLfnzD02GtkpA5Clxl/F2tm5ERokapHaeWsjr4zxwsBiimHrre/nrwOs2zuNcd/FPjvuc4NdvNu23lQPquCs24UmiKpk2e8Yw+//VqA== Received: from CH2PR17CA0022.namprd17.prod.outlook.com (2603:10b6:610:53::32) by DS7PR12MB5911.namprd12.prod.outlook.com (2603:10b6:8:7c::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Tue, 8 Sep 2026 06:53:45 +0000 Received: from BL6PEPF00022572.namprd02.prod.outlook.com (2603:10b6:610:53:cafe::42) by CH2PR17CA0022.outlook.office365.com (2603:10b6:610:53::32) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.15 via Frontend Transport; Tue, 8 Sep 2026 06:53:45 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by BL6PEPF00022572.mail.protection.outlook.com (10.167.249.40) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Tue, 8 Sep 2026 06:53:44 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:53:27 -0700 Received: from rnnvmail203.nvidia.com (10.129.68.9) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:53:27 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.9) with Microsoft SMTP Server id 15.2.2562.46 via Frontend Transport; Mon, 7 Sep 2026 23:53:19 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Bobby Eshleman , Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Doruk Tan Ozturk , Dragos Tatulea , Gal Pressman , Jianbo Liu , Kees Cook , Leon Romanovsky , open list , , , Mark Bloch , Petr Machata , Raed Salem , Rahul Rameshbabu , Saeed Mahameed , Shuah Khan , Shuah Khan , Simon Horman , Tariq Toukan , Willem de Bruijn , Willem de Bruijn Subject: [PATCH net-next V4 01/14] net/mlx5e: Generalize TC <-> IPsec mutual exclusion Date: Tue, 8 Sep 2026 09:52:31 +0300 Message-ID: <20260908065244.3799142-2-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260908065244.3799142-1-tariqt@nvidia.com> References: <20260908065244.3799142-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL6PEPF00022572:EE_|DS7PR12MB5911:EE_ X-MS-Office365-Filtering-Correlation-Id: fd8709d1-5747-4642-16a0-08df0d75ed06 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|82310400026|7416014|36860700016|1800799024|376014|10067099003|6133799003|3023799007|18002099003|22082099003|56012099006|11063799006; X-Microsoft-Antispam-Message-Info: rc+/xJZirDZ3VvsOtfyatZ7pG/eHWN+RtQY0OEbiPBHUudE88nG+4rrw5wbmFtzPrevNwjHB959k77fxCohWVHuxLGMOHfo4+c5ciluJFGc0k4NWzUpYgF5LxKppg8/MlIPjdU6GXcT0+SJK45FXMJLBrBdCgSNtApAYPX7704IuiQwOOuLAJmL0CTeniMz+V3kgBO7BrExO40NjjBgdjDSvExyUq/n0AvfIFgreqa0zm/HCeHEihZZ6pjMOf0VwqbyAauA+gGWDJPuUz0ZbzeVHGMHgeSOaJPPo7sOshQQ0ZTtFN7uTXxdvqvLqQ7JnjBJa1//4LLCzYDBTd9wZ+SHyA1UWzQkuHfkEyhUX9wQ9rUquWIjqJKZBwxo9MwWB8frg0vQ+hcaX7T5WIpkTbtpM+2bwlvslxLKTG8+0r9bMk9m9kOrdRhh31IZqWFsjuJqqvcxX51uo941q1W18JH6Jf/ky5u1hl+9AbB9v5MF4MIykrh3YnqNReXi0IIl3YOC0xALBOt3eQu9MM+ledSumOuAXppAFu+W2aAxCKAy3bZ0pCTOTW3jxFg2aBDhcmhDjj+7omXcHsagFfCfhgXoH0TbwP1NR3scouQJDyaJjEbgfueyehQwbIW78Ljv+XMYpIqM3oNMu8n9RmBhgtmKRuce8MF1CLOKIOrd+YRwJF/qGM9pL77R8wwmlWOaqv04MVMNkkD7WiQsfACFdlQ== X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(23010399003)(82310400026)(7416014)(36860700016)(1800799024)(376014)(10067099003)(6133799003)(3023799007)(18002099003)(22082099003)(56012099006)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 6e478pYWkgaW4ijP9ycIBkNsvA289jboHjq4aCu6Eqj9f+O31rIJDNbXQRJjlpT0RYvmHcapUNWG8Hdv8b80EK5UqM2ZnB1Ta94IQTPibjw3/qzFGD5OneuSVTSAqa0uptra9EP/qLMAnAs2psGb7IqAEJiffa/WqM+0Ae4HlEyeIYkyMzgoCj/u8AQlgD+Ep47bqvgxOD+ELbwjmtaaOYActd+IjbD1qV0QoepKyMvsl8Jtt+NYBU9ZC0DwMZOWEKLpcIz3O6E07i0yau1giuZt4mvyIay+Oc1iEYxtnIk4biaI1E16uWfSq4WMpWIN0GvDNoPMUZmF/NMHw+FVJrDWuLjG6q7lexgkW3gbQDXkLWBYDviAJRZOpVFG3A9pmBEqewhBP3u1mS7wkTfMGb0wDjEqP3TJ4ETIhSTMDZE6Ao7YENk6tnJK/FkxSTGD X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2026 06:53:44.6906 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: fd8709d1-5747-4642-16a0-08df0d75ed06 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL6PEPF00022572.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR12MB5911 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu There is a mechanism to mutually exclude TC offload and IPsec offload from the same interface (commit [1]) due to ordering issues between SW and HW paths. TC offload makes use of flow_tag to carry the tc mark (even when 0). Upcoming changes to accel protocols will make use of flow_tag to carry the protocol marker. As the flow_tag cannot be partially modified by a steering rule, the last rule setting the flow_tag will overwrite any previous ones. This means that TC offload cannot be active at the same time with any of the currently implemented accel protocols (IPsec, MACsec, PSP). Generalize the TC <-> IPsec mutual exclusion mechanism to be usable by more accel protocols: - move the existing mlx5e_ipsec_{,un}block_tc_offload functions to en_accel.h, rename them to mlx5e_accel_{,un}block_tc_offload. - rename the mdev counter from num_block_ipsec to num_accel. - rename is_tc_ipsec_order_check_needed -> is_tc_accel_check_needed and make it not bail out when IPsec isn't configured. - replace the conditional use of the esw write lock as a protection for incrementing the counter with a new mutex. The esw might not be available, and it wasn't used correctly on the decrement path anyway, allowing races to happen. Using a dedicated mutex for these counters makes it clear and avoids races. - add underflow warnings for the two counters to catch future miscounting bugs. - move counters and the new lock into a dedicated struct in mlx5_core_dev named 'offload_block'. Now offload_block.num_tc means the number of tc blocks due to accel rules and ofload_block.num_accel means the number of accel blocks due to tc rules. [1] commit c8e350e62fc5 ("net/mlx5e: Make TC and IPsec offloads mutually exclusive on a netdev") Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/en_accel.h | 22 ++++++++ .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 54 +++---------------- .../net/ethernet/mellanox/mlx5/core/en_tc.c | 46 +++++++++------- .../net/ethernet/mellanox/mlx5/core/eswitch.c | 12 ----- .../net/ethernet/mellanox/mlx5/core/eswitch.h | 1 - .../net/ethernet/mellanox/mlx5/core/main.c | 3 ++ include/linux/mlx5/driver.h | 7 ++- 7 files changed, 64 insertions(+), 81 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h b/= drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h index 3f212e46fc2f..8a2ea7616440 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h @@ -218,6 +218,28 @@ static inline void mlx5e_accel_tx_finish(struct mlx5e_= txqsq *sq, #endif } =20 +static inline int mlx5e_accel_block_tc_offload(struct mlx5_core_dev *mdev) +{ + int ret =3D 0; + + mutex_lock(&mdev->offload_block.lock); + if (mdev->offload_block.num_accel) + ret =3D -EBUSY; + else + mdev->offload_block.num_tc++; + mutex_unlock(&mdev->offload_block.lock); + + return ret; +} + +static inline void mlx5e_accel_unblock_tc_offload(struct mlx5_core_dev *md= ev) +{ + mutex_lock(&mdev->offload_block.lock); + if (!WARN_ON_ONCE(!mdev->offload_block.num_tc)) + mdev->offload_block.num_tc--; + mutex_unlock(&mdev->offload_block.lock); +} + static inline int mlx5e_accel_init_rx(struct mlx5e_priv *priv) { return mlx5e_ktls_init_rx(priv); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/= drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c index 329608c59313..74e0aa5b6133 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c @@ -4,6 +4,7 @@ #include #include "en.h" #include "en/fs.h" +#include "en_accel/en_accel.h" #include "eswitch.h" #include "ipsec.h" #include "fs_core.h" @@ -2574,53 +2575,12 @@ void mlx5e_accel_ipsec_fs_read_stats(struct mlx5e_p= riv *priv, void *ipsec_stats) } } =20 -#ifdef CONFIG_MLX5_ESWITCH -static int mlx5e_ipsec_block_tc_offload(struct mlx5_core_dev *mdev) -{ - struct mlx5_eswitch *esw =3D mdev->priv.eswitch; - int err =3D 0; - - if (esw) { - err =3D mlx5_esw_lock(esw); - if (err) - return err; - } - - if (mdev->num_block_ipsec) { - err =3D -EBUSY; - goto unlock; - } - - mdev->num_block_tc++; - -unlock: - if (esw) - mlx5_esw_unlock(esw); - - return err; -} -#else -static int mlx5e_ipsec_block_tc_offload(struct mlx5_core_dev *mdev) -{ - if (mdev->num_block_ipsec) - return -EBUSY; - - mdev->num_block_tc++; - return 0; -} -#endif - -static void mlx5e_ipsec_unblock_tc_offload(struct mlx5_core_dev *mdev) -{ - mdev->num_block_tc--; -} - int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) { int err; =20 if (sa_entry->attrs.type =3D=3D XFRM_DEV_OFFLOAD_PACKET) { - err =3D mlx5e_ipsec_block_tc_offload(sa_entry->ipsec->mdev); + err =3D mlx5e_accel_block_tc_offload(sa_entry->ipsec->mdev); if (err) return err; } @@ -2637,7 +2597,7 @@ int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_ipsec_= sa_entry *sa_entry) =20 err_out: if (sa_entry->attrs.type =3D=3D XFRM_DEV_OFFLOAD_PACKET) - mlx5e_ipsec_unblock_tc_offload(sa_entry->ipsec->mdev); + mlx5e_accel_unblock_tc_offload(sa_entry->ipsec->mdev); return err; } =20 @@ -2652,7 +2612,7 @@ void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_ipsec= _sa_entry *sa_entry) mlx5_packet_reformat_dealloc(mdev, ipsec_rule->pkt_reformat); =20 if (sa_entry->attrs.type =3D=3D XFRM_DEV_OFFLOAD_PACKET) - mlx5e_ipsec_unblock_tc_offload(mdev); + mlx5e_accel_unblock_tc_offload(mdev); =20 if (sa_entry->attrs.dir =3D=3D XFRM_DEV_OFFLOAD_OUT) { tx_ft_put(sa_entry->ipsec, sa_entry->attrs.type); @@ -2686,7 +2646,7 @@ int mlx5e_accel_ipsec_fs_add_pol(struct mlx5e_ipsec_p= ol_entry *pol_entry) { int err; =20 - err =3D mlx5e_ipsec_block_tc_offload(pol_entry->ipsec->mdev); + err =3D mlx5e_accel_block_tc_offload(pol_entry->ipsec->mdev); if (err) return err; =20 @@ -2701,7 +2661,7 @@ int mlx5e_accel_ipsec_fs_add_pol(struct mlx5e_ipsec_p= ol_entry *pol_entry) return 0; =20 err_out: - mlx5e_ipsec_unblock_tc_offload(pol_entry->ipsec->mdev); + mlx5e_accel_unblock_tc_offload(pol_entry->ipsec->mdev); return err; } =20 @@ -2712,7 +2672,7 @@ void mlx5e_accel_ipsec_fs_del_pol(struct mlx5e_ipsec_= pol_entry *pol_entry) =20 mlx5_del_flow_rules(ipsec_rule->rule); =20 - mlx5e_ipsec_unblock_tc_offload(pol_entry->ipsec->mdev); + mlx5e_accel_unblock_tc_offload(pol_entry->ipsec->mdev); =20 if (pol_entry->attrs.dir =3D=3D XFRM_DEV_OFFLOAD_IN) { rx_ft_put_policy(pol_entry->ipsec, diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/= ethernet/mellanox/mlx5/core/en_tc.c index b290beb4369a..05c703795df4 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c @@ -4813,14 +4813,14 @@ static bool is_flow_rule_duplicate_allowed(struct n= et_device *dev, return netif_is_lag_port(dev) && rpriv && rpriv->rep->vport !=3D MLX5_VPO= RT_UPLINK; } =20 -/* As IPsec and TC order is not aligned between software and hardware-offl= oad, - * either IPsec offload or TC offload, not both, is allowed for a specific= interface. +/* TC offload and accel protocols can overwrite each other's flow_tag with + * steering rules and they cannot simultaneously operate on the same inter= face. + * Additionally, as IPsec and TC order is not aligned between software and + * hardware-offload, only one is allowed for a specific interface. */ -static bool is_tc_ipsec_order_check_needed(struct net_device *filter, stru= ct mlx5e_priv *priv) +static bool is_tc_accel_check_needed(struct net_device *filter, + struct mlx5e_priv *priv) { - if (!IS_ENABLED(CONFIG_MLX5_EN_IPSEC)) - return false; - if (filter !=3D priv->netdev) return false; =20 @@ -4830,27 +4830,35 @@ static bool is_tc_ipsec_order_check_needed(struct n= et_device *filter, struct mlx return true; } =20 -static int mlx5e_tc_block_ipsec_offload(struct net_device *filter, struct = mlx5e_priv *priv) +static int mlx5e_tc_block_accel_offload(struct net_device *filter, + struct mlx5e_priv *priv) { struct mlx5_core_dev *mdev =3D priv->mdev; + int ret =3D 0; =20 - if (!is_tc_ipsec_order_check_needed(filter, priv)) + if (!is_tc_accel_check_needed(filter, priv)) return 0; =20 - if (mdev->num_block_tc) - return -EBUSY; - - mdev->num_block_ipsec++; + mutex_lock(&mdev->offload_block.lock); + if (mdev->offload_block.num_tc) + ret =3D -EBUSY; + else + mdev->offload_block.num_accel++; + mutex_unlock(&mdev->offload_block.lock); =20 - return 0; + return ret; } =20 -static void mlx5e_tc_unblock_ipsec_offload(struct net_device *filter, stru= ct mlx5e_priv *priv) +static void mlx5e_tc_unblock_accel_offload(struct net_device *filter, + struct mlx5e_priv *priv) { - if (!is_tc_ipsec_order_check_needed(filter, priv)) + if (!is_tc_accel_check_needed(filter, priv)) return; =20 - priv->mdev->num_block_ipsec--; + mutex_lock(&priv->mdev->offload_block.lock); + if (!WARN_ON_ONCE(!priv->mdev->offload_block.num_accel)) + priv->mdev->offload_block.num_accel--; + mutex_unlock(&priv->mdev->offload_block.lock); } =20 int mlx5e_configure_flower(struct net_device *dev, struct mlx5e_priv *priv, @@ -4865,7 +4873,7 @@ int mlx5e_configure_flower(struct net_device *dev, st= ruct mlx5e_priv *priv, if (!mlx5_esw_hold(priv->mdev)) return -EBUSY; =20 - err =3D mlx5e_tc_block_ipsec_offload(dev, priv); + err =3D mlx5e_tc_block_accel_offload(dev, priv); if (err) goto esw_release; =20 @@ -4914,7 +4922,7 @@ int mlx5e_configure_flower(struct net_device *dev, st= ruct mlx5e_priv *priv, err_free: mlx5e_flow_put(priv, flow); out: - mlx5e_tc_unblock_ipsec_offload(dev, priv); + mlx5e_tc_unblock_accel_offload(dev, priv); mlx5_esw_put(priv->mdev); esw_release: mlx5_esw_release(priv->mdev); @@ -4957,7 +4965,7 @@ int mlx5e_delete_flower(struct net_device *dev, struc= t mlx5e_priv *priv, trace_mlx5e_delete_flower(f); mlx5e_flow_put(priv, flow); =20 - mlx5e_tc_unblock_ipsec_offload(dev, priv); + mlx5e_tc_unblock_accel_offload(dev, priv); mlx5_esw_put(priv->mdev); return 0; =20 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/ne= t/ethernet/mellanox/mlx5/core/eswitch.c index b6e2c153b4f7..8b36a96522ab 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c @@ -3022,18 +3022,6 @@ int mlx5_esw_try_lock(struct mlx5_eswitch *esw) return esw->mode; } =20 -int mlx5_esw_lock(struct mlx5_eswitch *esw) -{ - down_write(&esw->mode_lock); - - if (esw->eswitch_operation_in_progress) { - up_write(&esw->mode_lock); - return -EBUSY; - } - - return 0; -} - /** * mlx5_esw_unlock() - Release write lock on esw mode lock * @esw: eswitch device. diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/ne= t/ethernet/mellanox/mlx5/core/eswitch.h index c655f6e8da1c..33355a97226a 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h @@ -946,7 +946,6 @@ void mlx5_esw_release(struct mlx5_core_dev *dev); void mlx5_esw_get(struct mlx5_core_dev *dev); void mlx5_esw_put(struct mlx5_core_dev *dev); int mlx5_esw_try_lock(struct mlx5_eswitch *esw); -int mlx5_esw_lock(struct mlx5_eswitch *esw); void mlx5_esw_unlock(struct mlx5_eswitch *esw); =20 void esw_vport_change_handle_locked(struct mlx5_vport *vport); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/e= thernet/mellanox/mlx5/core/main.c index 5f28d906c35b..46b34c80c458 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/main.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c @@ -1810,6 +1810,7 @@ int mlx5_mdev_init(struct mlx5_core_dev *dev, int pro= file_idx) lockdep_register_key(&dev->lock_key); mutex_init(&dev->intf_state_mutex); lockdep_set_class(&dev->intf_state_mutex, &dev->lock_key); + mutex_init(&dev->offload_block.lock); mutex_init(&dev->mlx5e_res.uplink_netdev_lock); mutex_init(&dev->wc_state_lock); =20 @@ -1901,6 +1902,7 @@ int mlx5_mdev_init(struct mlx5_core_dev *dev, int pro= file_idx) mutex_destroy(&priv->alloc_mutex); mutex_destroy(&priv->bfregs.wc_head.lock); mutex_destroy(&priv->bfregs.reg_head.lock); + mutex_destroy(&dev->offload_block.lock); mutex_destroy(&dev->intf_state_mutex); lockdep_unregister_key(&dev->lock_key); return err; @@ -1928,6 +1930,7 @@ void mlx5_mdev_uninit(struct mlx5_core_dev *dev) mutex_destroy(&priv->bfregs.reg_head.lock); mutex_destroy(&dev->wc_state_lock); mutex_destroy(&dev->mlx5e_res.uplink_netdev_lock); + mutex_destroy(&dev->offload_block.lock); mutex_destroy(&dev->intf_state_mutex); lockdep_unregister_key(&dev->lock_key); } diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h index 83d0a83bbfbc..3bdb0c5a87ac 100644 --- a/include/linux/mlx5/driver.h +++ b/include/linux/mlx5/driver.h @@ -788,8 +788,11 @@ struct mlx5_core_dev { u32 vsc_addr; struct mlx5_hv_vhca *hv_vhca; struct mlx5_hwmon *hwmon; - u64 num_block_tc; - u64 num_block_ipsec; + struct { + struct mutex lock; + u64 num_tc; + u64 num_accel; + } offload_block; #ifdef CONFIG_MLX5_MACSEC struct mlx5_macsec_fs *macsec_fs; /* MACsec notifier chain to sync MACsec core and IB database */ --=20 2.44.0 From nobody Fri Sep 25 22:19:10 2026 Received: from BL2PR02CU003.outbound.protection.outlook.com (mail-eastusazon11011024.outbound.protection.outlook.com [52.101.52.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C87D138DC56; Tue, 8 Sep 2026 06:53:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.52.24 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850437; cv=fail; b=leFBl3hVsWJ7ogBxNPpnyCTDPbWjIeYY5d5E4yXyI8g5uvkI1KRAPRa1IheVIXaclKn/KxlXQ7wPO2BCxbrTxokImgYp+bjHnrSZOsGaV0mBhE5cVSsYbaODVyYY6RJDlFwOnIIHZlwfKUhhzbosxkY0N/DZeklQGzjOMrqo3mA= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850437; c=relaxed/simple; bh=T5S3PBu1Bpy9aokSxvCp/IKhfwHjN55HKb6GFxN5AJk=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=OAW2GKfgY4qo4d/XnTB33mZCxwI7Wp7Vtj3bSQ5kuiNXnJGcaVFcGEMRPzq8JKzRuFO6nXLVXgk4/tfVUo5JGPZyT45POcvOHWtJX0bmVALkMk5Ax5vu3L6uWrdOz0mnKHU4r8RO5YVTS+p0R9pcqFWFJHZeNcB/PQW6XeDz3eU= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=ggZaCb7A; arc=fail smtp.client-ip=52.101.52.24 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="ggZaCb7A" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=AATTnJyUldNfqY1APN1kHhbEuXtGGBRpwDqPoiU13OpX6Ndvm2x7A2yzpV9BJml2iHZy571zxsxutNdBBLrVt/h+hYoz9mNjbJ2vQ56nli9VS1f1loaL8geHf/dUG4Q+4F07I3uw6VIaj8ZOE0MYU0OwQ2V8Q8sdC1lbX2i4XesdPjZkOVwasvTU2pPVjI0enhW4ECVSJaFGgzTRDV8RPPVIEGnbpcmszk3NjFXCaIkXwswCDR+6NVfqB6hWY7jWWbaY1Z8BN64H33551ZoYdm0l7ISJXgbpHE68tqbq/u7MlEhbsLjnDyYjqsuHDA1B40lYkVYG1grBczN4Bn+/xw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=VQwrEY0lVKouYPaSnkQLMapmOKzsb4BwniugkL3XInI=; b=K/PpOgVtI4UPjNCJEeMZQgihAMZBS/7YceK8Ldz7s3Ar58L9tFEVotjE6h0B9H6UB6m5vVtKqRvNIDg8PcO0CBb8Y1PoJjgC/5XhY79Woh+nwydXR05/mnpaPn8si9kIsQfJzHncUP0MIgvsKx06G1fHSM4y9Pj9mge3FbrH7e094TBiItc8aHaB4VwxWOCXsk+vSwiLGWOWi/rvfPBHSeXg1Wk6z+mir59pbLueAWSaIiGowKOuYmbXLjrHtPdSXJxuvg7X4pnHn18YnHwAla9RZ096YozLF23N/adMTgH6d+pdsw9eb1GR47xLTZppT7aB+uRMBSf1ss1AD/Ki8Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VQwrEY0lVKouYPaSnkQLMapmOKzsb4BwniugkL3XInI=; b=ggZaCb7AQ4SEllRMjt73vvJR9jLr4LZpWBfPkRlm8/KKpod+sNOI09yfc23diLgwaHGCISy/4NEcGs76jolG1pgqEThEdp4eCMQIK6+M+uGgmZzu1oVmW+MwXf0lv+B7/mzBDxrIoo1dzwsvTmnii1Uee0xz87f0BaevEHShy++PDAtu8U9IZEpUa0jUMieWcogRLTp/FLFp3sQNRnDYtv0ccRDssuEyHBaAOHxQZhNy2Q8k31iqOGl8AaL6i5Vbs0sjro4XsZkHUXAoANx+iwKN8EBGbz0ZMniXtVgi4+wbCiIlNu+Oq1qRTplMKd8vuYc9wxgb7lASpAM66ctUew== Received: from BN9PR03CA0524.namprd03.prod.outlook.com (2603:10b6:408:131::19) by SJ2PR12MB9237.namprd12.prod.outlook.com (2603:10b6:a03:554::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.10; Tue, 8 Sep 2026 06:53:50 +0000 Received: from BN7PEPF000000AA.namprd05.prod.outlook.com (2603:10b6:408:131:cafe::4f) by BN9PR03CA0524.outlook.office365.com (2603:10b6:408:131::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.15 via Frontend Transport; Tue, 8 Sep 2026 06:53:50 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by BN7PEPF000000AA.mail.protection.outlook.com (10.167.245.234) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Tue, 8 Sep 2026 06:53:49 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:53:36 -0700 Received: from rnnvmail203.nvidia.com (10.129.68.9) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:53:35 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.9) with Microsoft SMTP Server id 15.2.2562.46 via Frontend Transport; Mon, 7 Sep 2026 23:53:28 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Bobby Eshleman , Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Doruk Tan Ozturk , Dragos Tatulea , Gal Pressman , Jianbo Liu , Kees Cook , Leon Romanovsky , open list , , , Mark Bloch , Petr Machata , Raed Salem , Rahul Rameshbabu , Saeed Mahameed , Shuah Khan , Shuah Khan , Simon Horman , Tariq Toukan , Willem de Bruijn , Willem de Bruijn Subject: [PATCH net-next V4 02/14] net/mlx5e: ipsec: Block TC offload when IPsec is enabled Date: Tue, 8 Sep 2026 09:52:32 +0300 Message-ID: <20260908065244.3799142-3-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260908065244.3799142-1-tariqt@nvidia.com> References: <20260908065244.3799142-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PEPF000000AA:EE_|SJ2PR12MB9237:EE_ X-MS-Office365-Filtering-Correlation-Id: 4a761c45-ac74-4b5e-e9ad-08df0d75eff6 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|1800799024|23010399003|376014|7416014|36860700016|10067099003|22082099003|18002099003|11063799006|56012099006; X-Microsoft-Antispam-Message-Info: ew+quQ46nsyO4XgBVoBvYTTAzZ6jz7eJioRxuVxoDCyE8xvPPkPAzGvn3vcg5s3mSXxrhrb7ks1lA6uuSjjP1ececZ8xU5tzjLjCvCdfUuLT5D4eJA2B1/AEi3vKL+P8Zuj/Vhg0LzHDeBdM9dj7btYu6TKyZ5kL9dPVkCf/x9JOwuUlrmpRLRvZgywgyTtePJknYt+DL2PyslGLAtPgYd50+1Hh1yHwE3YPJ/Im2Umjk8X82IzjFPwRqHMS3L51/a5BxhvRS2hss2XV+oXeAu62arEwXykouIEoESyusAVMpyM3DS9Z6D+JyKXWJWvWhv4SBveOl86PDG5u5wwl6Yt9lGOrIy8+8toqtX4ggupVBDz7ddaTOIXk+5Qrq/9rYZBwi0p5GecP8MNxOcMSVeyDIOcIxX+SH555tJ3S6QVpg9ueMqRdRldkjRm0CimoUqLPmHh2HzBXZFm/PCSWs5JmWaeA+tk0bUZZv3of6OTeHcEkZuBmLkWgyNnO/4Dg5Cw0Lh+MRTJhYEEHRTVkU12Xq3e2TfJT6Vn/SEUrxJBhbJo3dI3lYYqXRJ8OO3MUejtDJBp8FpKnSh1qeBXdX7M6nNempORsXlWhv+XNV/4Gb0n0VPFmQyscbSn70nfEFd2xDJYUEN1FefG8HzJn1caGL03yKMtageCPvpjDqetvIjVaHuNFCAgpA0uTo+ED3ibiDPrazjGekRMwAqhvdw== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(1800799024)(23010399003)(376014)(7416014)(36860700016)(10067099003)(22082099003)(18002099003)(11063799006)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: fh2YLHUuLbzufdeiqHtblvMPPNwL+/V0CCo8qXiawWlsbQ089tLL6D0fptwX+qBejYhxB5Bt9kgIo/JZtgDCYAhGhju/ebeT3Ugt1P6FsEUy6xUxR8BmWKeWKcM0ZkThV0jLXsowTdOk9409JEr3ee+cqeBCBa7MfGnc9f/Ub4Y8Lf8gY4EW+FPy4uLXGv3kSisWLuxqP5E2ekgu5PqCvf3CpPmm6JsuQkQEgrzScguFItGHgRiAYgyPgGguMsqjqg7ukR7cgbC6DGfdw1DHQSUvo6Wr0r0dorN82XSZfwDf8lV0Mmx1kJzEZ0xHtmfxJyqHY3mb+QdJjLUhIzt5smKOiWfmtyBuqm/1wB+41A8DLyUA1cyOD/0/2Ah6eViKwLPCm9bVtKbdh4RqPp3v+JdDcfvu8HVPpNNikrH/Kz5nPslZsRxhObhS7fzXl4Fu X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2026 06:53:49.6354 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 4a761c45-ac74-4b5e-e9ad-08df0d75eff6 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BN7PEPF000000AA.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR12MB9237 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu Currently the mutual exclusion mechanism is only used in packet offload mode. But with the upcoming changes to flow_tag, all RX IPsec flows need to block TC offload, so do that with the help of a small helper. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/= drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c index 74e0aa5b6133..f236672d3a2a 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c @@ -2575,11 +2575,18 @@ void mlx5e_accel_ipsec_fs_read_stats(struct mlx5e_p= riv *priv, void *ipsec_stats) } } =20 +static bool accel_ipsec_should_block_tc(struct mlx5e_ipsec_sa_entry *sa_en= try) +{ + return sa_entry->attrs.type =3D=3D XFRM_DEV_OFFLOAD_PACKET || + sa_entry->attrs.dir =3D=3D XFRM_DEV_OFFLOAD_IN; +} + int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry) { + bool block_tc =3D accel_ipsec_should_block_tc(sa_entry); int err; =20 - if (sa_entry->attrs.type =3D=3D XFRM_DEV_OFFLOAD_PACKET) { + if (block_tc) { err =3D mlx5e_accel_block_tc_offload(sa_entry->ipsec->mdev); if (err) return err; @@ -2596,7 +2603,7 @@ int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_ipsec_= sa_entry *sa_entry) return 0; =20 err_out: - if (sa_entry->attrs.type =3D=3D XFRM_DEV_OFFLOAD_PACKET) + if (block_tc) mlx5e_accel_unblock_tc_offload(sa_entry->ipsec->mdev); return err; } @@ -2611,7 +2618,7 @@ void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_ipsec= _sa_entry *sa_entry) if (ipsec_rule->pkt_reformat) mlx5_packet_reformat_dealloc(mdev, ipsec_rule->pkt_reformat); =20 - if (sa_entry->attrs.type =3D=3D XFRM_DEV_OFFLOAD_PACKET) + if (accel_ipsec_should_block_tc(sa_entry)) mlx5e_accel_unblock_tc_offload(mdev); =20 if (sa_entry->attrs.dir =3D=3D XFRM_DEV_OFFLOAD_OUT) { --=20 2.44.0 From nobody Fri Sep 25 22:19:10 2026 Received: from BYAPR05CU005.outbound.protection.outlook.com (mail-westusazon11010033.outbound.protection.outlook.com [52.101.85.33]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1605138F938; Tue, 8 Sep 2026 06:54:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.85.33 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850446; cv=fail; b=o/Q0HnNBhJjvOIDHQAF6rFGE/hDXO0ccEYtMXKCZBTHFCz5rw6N/Cafmmcrcwl4nn5j8wtAQw8D5gMgEmWqOAmu7KVQsltcMo2QW9/eeMov4M1imo36VNQwjxK6CjZm2AZ3hFwbRV4ercsfW6wiWmwkyzIX1aGD8OpKw8nzyTCA= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850446; c=relaxed/simple; bh=iqjSEvvhYRQuJhUWRecF/67q8wladK+EYFXmXG8fMK8=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=mjO4wDudsapPs0/y0ufXBXCC3QxzTXbw2Zo4IZA2Ot7Gbm9R73cQDuhM6X+nFQTKt65o4Sw/QF2p9ogHGUHc9KajdS/58B7+DZRu6VmJu6QEjk25wpkK1xqsEwgoigrwnsQsHSO897Oqw938ssRtPuIi5TtbvGYGGl0KkByNYCU= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=tz48Gbln; arc=fail smtp.client-ip=52.101.85.33 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="tz48Gbln" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=eWurmlJGzorUipt6ceLfOB8gNN/RrATGWqYo9FHYbhRdmqJd3bPOuTyBmwZffDTs6AKp7KdUSdRmx2fKwBPOQ4cTEJ7wue1iM/2QShpKYYfYfe85y4is7F2uo9beRs0NQkXXIjuS2pVMoUZ/qWl3VVxcNEO2pu5LawO2KBO5TXQuj1UO4Zk7rkX6uKpDcmFKm/JZI7/WTawhOM8S0d7WirpnDXUcJSXYijKERBtWioYtYdP5fOAeEr4/2gWBmczlVyhGIcE5m5OAs/w8AmrbxbR/dzTkBTTdVHg3T13zc93NFroTpzMl6EOFEDbHQzoxFVivnI/f+1r82y53WtxQ3Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=zhL7clVwrzojO7vicEjP9ZbfyKXmx8cmdGKqAHizwzI=; b=QeK/XkL01aiXAvYyq8xuUQxsKGQUXNDmYzxRyaMF/zIU8jEelhvqpGU71/qkI3iLxx4Evofd5dONfP3QU2V6pqb4pqPxWaMHWbeE9YhOkgzrO5hFTZkIpljNxgemIxAdKi6xpWvNqC0e+s2c+jrCsPSgqodaQMYjsarsWRL5akAcjdroVH21H9QWp80YRKUTxngx2cqDPxYz7ZepcJnS9GDf6IY7INPUJtTrB9+lJ9d6o9zOfThiR85Nq8NP98Cf/qqASjZ6rrpddE0e+CZ4o1S5lVMqLUFYusxVdmes1KVCuMPG3FnqiDd/JlF9lRL/P9J0u4g4Ndo/KZNX5skD/w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=zhL7clVwrzojO7vicEjP9ZbfyKXmx8cmdGKqAHizwzI=; b=tz48GblnV/nGygRJj8i0yl/MV+nW6WHtaoLDEtnGY+ucj6MEi84IofgTFLal5jr8leOISr/pfeQXH2A5OmQFa+Q3GKVtcKAZ3REFz/a70afgRlMo2IWBECzv+4StKo+1ZOFn5/hRSgI6JCmIAre78t5bKVkG811rhazHu5RdWIz7vPv2ldtzZzcEQMxF2Qy9YufwAg2FUcEdlpGlPf+vRzyPXLIqURuX0E+Lb2W+/qOjpeTHW8ye1KdfLD0QUAxK26rvUX+D1R6yCE0OxAICGE2pQZ19VzgeP8RGBQFPL3WSLY4gwJzitmd+SbdpfDbc6jDNpOZf6AQ//MiuHPM/5A== Received: from MN0PR05CA0021.namprd05.prod.outlook.com (2603:10b6:208:52c::16) by PH6PR12MB366721.namprd12.prod.outlook.com (2603:10b6:510:3de::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Tue, 8 Sep 2026 06:54:02 +0000 Received: from BL6PEPF00022571.namprd02.prod.outlook.com (2603:10b6:208:52c:cafe::32) by MN0PR05CA0021.outlook.office365.com (2603:10b6:208:52c::16) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.406.7 via Frontend Transport; Tue, 8 Sep 2026 06:54:01 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by BL6PEPF00022571.mail.protection.outlook.com (10.167.249.39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Tue, 8 Sep 2026 06:54:01 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:53:44 -0700 Received: from rnnvmail203.nvidia.com (10.129.68.9) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:53:43 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.9) with Microsoft SMTP Server id 15.2.2562.46 via Frontend Transport; Mon, 7 Sep 2026 23:53:36 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Bobby Eshleman , Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Doruk Tan Ozturk , Dragos Tatulea , Gal Pressman , Jianbo Liu , Kees Cook , Leon Romanovsky , open list , , , Mark Bloch , Petr Machata , Raed Salem , Rahul Rameshbabu , Saeed Mahameed , Shuah Khan , Shuah Khan , Simon Horman , Tariq Toukan , Willem de Bruijn , Willem de Bruijn Subject: [PATCH net-next V4 03/14] net/mlx5e: psp: Block TC offload when PSP is enabled Date: Tue, 8 Sep 2026 09:52:33 +0300 Message-ID: <20260908065244.3799142-4-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260908065244.3799142-1-tariqt@nvidia.com> References: <20260908065244.3799142-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL6PEPF00022571:EE_|PH6PR12MB366721:EE_ X-MS-Office365-Filtering-Correlation-Id: 969cf2f5-f9bc-490f-c442-08df0d75f6cf X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|82310400026|36860700016|7416014|376014|11063799006|56012099006|3023799007|10067099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: 2UPTthDuWDmvRoxHvePQrOw8MuFLsYQ+Hk/fCQd5N5l9fplnBnx7iu7Iqy7c/B4CcDJMUyjfy4NuvLLlUuTlXUG1q69CQ1aayu+e1KzlegWdJLDqw/ToW6PjoC89wqHiEFRoPLOk1szCUCuAEOub5gzQ/nsB/9q/p33WkkNi+QFxj1z4lExczmrX7wGCU+PyD/48qx2/cyjjCtgQXmNYp6TLkNqSV3uMPSi4GEP/IPei/vGUMswwhXcY8Jf+npUuieTsLEAfKX5NDX3bOricuLscNJUvgk3wzK5pq/wrPQG1/1h1On5kmZzZrRqeJu5++4quMiYYmIDbqb0deuSe1ui7kdugnDMDrZevDAbWe5IrkzMbPhV2PBQOstXE9iIIx1TN6sx0iVVwnbHSxNQ9iwOmRaEVTbVB8Yu1DvyK16rsmopQY/n2kopF8oy43DokPGz3hqZFnn9L27LUWY52YITwbeIKdBCkGrBvJy3TSqgwQUkk9emhLcMK8eFo4q6/4R2fykEes4W9mxlyKdfG0V/5h5+qMTsW3iakVcuZbpDHZJjzut9AL0yOnZtbmcL1ezzZdmNeQKk740MeTVX03vJfvN+2Sk6njpmruPyYmzCAICvQ6kNcnlV3P92WE6RvLPUTaRY9kP05Lp9tRlDKq7e6frjMgSSiMuw4IO/syiYnXQkY/uPaWly1RvsktnVF+h2ow6IKRpW2Mv3r3eAd+w== X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(82310400026)(36860700016)(7416014)(376014)(11063799006)(56012099006)(3023799007)(10067099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: U8ObDX6IylYKCAEW/7JchhQQbjuSvRMutzGO+4VTcJvfZUXqs9HduwfuN/QszoV4UZUGrlFI+c3Rj0R9fpC9OtjdCgR28BH1VfyodbMhjNkSfFOii4PFz3DjtQwwMNPjSy0M/65LcPBwyQqmsWJ3ESLxzLVKeMSbN96pfAp1vlk5/BuczZrSy2f3mtwKX6dmvKh8HBWKnO4JKiqSS762gupo6vc9o7R9hqHNCbheFtxg5S5hc/EejJTwMH5mJcY/vtax6RK2z8+7+8tj0sedXsJQZq0IhF+Felw+ILyXasanqdpESjKdt2OUaxytdBYs2/WWvHvjia8RmsMbG7gzaTDwDVu4qHWG5I1ulzcAkoj7c2lZ83Zp032xF9Q3xDcZMDXfHSgVZ9eBPy+8ElbPlOQ7H191SsqhSnqCu8EyhLmRripImKSL6SAaNiGTYJ2d X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2026 06:54:01.1178 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 969cf2f5-f9bc-490f-c442-08df0d75f6cf X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL6PEPF00022571.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH6PR12MB366721 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu Make use of the mutual exclusion mechanism from the previous patch to make sure only PSP or TC offload is active on a device. Later in the series, the PSP protocol marker will move to the flow_tag, which is also used by TC offload. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../net/ethernet/mellanox/mlx5/core/en_accel/psp.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c b/drive= rs/net/ethernet/mellanox/mlx5/core/en_accel/psp.c index 73b232379263..6cc4b9d54f6e 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c @@ -6,6 +6,7 @@ #include "mlx5_core.h" #include "psp.h" #include "lib/crypto.h" +#include "en_accel/en_accel.h" #include "en_accel/psp.h" #include "fs_core.h" =20 @@ -526,6 +527,7 @@ accel_psp_fs_rx_decrypt_ft_create(struct mlx5e_psp_fs *= fs, static void accel_psp_fs_rx_destroy(struct mlx5e_psp_fs *fs) { struct mlx5_ttc_table *ttc =3D mlx5e_fs_get_ttc(fs->fs, false); + bool tc_blocked =3D fs->rx.ft; int i; =20 /* disconnect */ @@ -535,6 +537,8 @@ static void accel_psp_fs_rx_destroy(struct mlx5e_psp_fs= *fs) } accel_psp_fs_rx_check_ft_destroy(&fs->check); accel_psp_fs_rx_ft_destroy(&fs->rx); + if (tc_blocked) + mlx5e_accel_unblock_tc_offload(fs->mdev); } =20 static int accel_psp_fs_rx_create(struct mlx5e_psp_fs *fs, @@ -543,10 +547,16 @@ static int accel_psp_fs_rx_create(struct mlx5e_psp_fs= *fs, struct mlx5_ttc_table *ttc =3D mlx5e_fs_get_ttc(fs->fs, false); int i, err; =20 + err =3D mlx5e_accel_block_tc_offload(fs->mdev); + if (err) { + NL_SET_ERR_MSG(extack, "TC offload active, cannot enable PSP"); + return err; + } + err =3D accel_psp_fs_rx_ft_create(fs, &fs->rx); if (err) { NL_SET_ERR_MSG(extack, "Failed creating RX steering table"); - return err; + goto err_unblock_tc; } =20 err =3D accel_psp_fs_rx_check_ft_create(fs, &fs->check); @@ -583,6 +593,8 @@ static int accel_psp_fs_rx_create(struct mlx5e_psp_fs *= fs, accel_psp_fs_rx_check_ft_destroy(&fs->check); err_ft: accel_psp_fs_rx_ft_destroy(&fs->rx); +err_unblock_tc: + mlx5e_accel_unblock_tc_offload(fs->mdev); return err; } =20 --=20 2.44.0 From nobody Fri Sep 25 22:19:10 2026 Received: from CH4PR04CU002.outbound.protection.outlook.com (mail-northcentralusazon11013005.outbound.protection.outlook.com [40.107.201.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7397F390231; Tue, 8 Sep 2026 06:54:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.201.5 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850456; cv=fail; b=Uk41KGl4oyK708dqYRcS8nNYb63d648MT0W0OoY8XKgmA6eXNm7ujeR96wneRGxVyWm2+35P/onY/Uw8l40KgG4RRMiyj6lEdID+wm9QXr7eSIEQH7Y+3doyC/A+/vqfwxvawEDfgLv5GNhgpjzI8sEVweZRhDF/WyYgvDLaxZI= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850456; c=relaxed/simple; bh=c/cDvudEfAtWLHMJxyIeXmIQUonuz+wLS1vdDZHwKUI=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ON8b6cW2UI50znKZv5CWudaxAGYcIxMvHfssSNtmFC6Z/cLiY8rJQ+tBzROyfruQzYFHtKDVonltn8XMdJR38wO04j6H7tXXqY2cz5j+/lj5v7D8zNguzkDg0qPJ9WEodMx1waIjovNiNYf5KDZ7W1CYHv72ovJWdFolzqciJHs= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=JKbmPaCu; arc=fail smtp.client-ip=40.107.201.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="JKbmPaCu" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=S5WBOwwnx8gjumuVQiQ6TUwOGh5TwhixlzCFdvuJGFc2iXY49cFYKdBarIV88ZotZhLLGkA0ubnEn9mDkapur6tLVD6luqYJpwr4QxYe8AhYuhBqpeUhwNAAqml6vvdNxUYB2U2y/fxK+982Dhn+sQx6PMIJ1I9O1HDTVKNKEIzQqXMWFxSOWMvfgYTvKoa7qv4MlgixiCcnXSMlUSMXhNK667+uq8Ttbch1a2fs1Wb5oa9RdtxsNGGq391sh1wnadYD4y4CJQxxKV4OZBuJRpVUCMtB8V48JLovS+2fAvD5YhlpmBS7FGrCZammmQDqKj+eIic8C6UGWlwvi8lq8Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BhkbsKVRuq9xnJ7k97WJKvOK842GuAnnaGf4ZS2tjTw=; b=IGABCYyJx1lD3ayxwyjDDDOyev3Esy8FC0+6ILYMaorhgmMe8S4No5UTFZ2KKL2BIyO/r0MaewagswC/QHI80Ttgrmh3CwTFDwji2Qkz64jXQXTO/byWcJixmAVqOTXMerzPvoDNyV7vbEqOy27HJDU1yje9DKkpzr0mul3eMRkyrh0i4JM2TJCChEuwsbOqvLn8Ifr0CA7IWZ4FiEgheqOmwCl6T/bDhCQFlgr+pReKrpc89vlIzaBpj3/dBv7Cxngs8U85eJKXcJd8nkZfVAo8PVFJ40Pcjf7CvyzmCp2/H1iYiTXFhbVk56qGtWyKn9naiC+3ErrPNa2RTmVdIQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BhkbsKVRuq9xnJ7k97WJKvOK842GuAnnaGf4ZS2tjTw=; b=JKbmPaCuRBvIaV98b1wlGqga1945IfNSUlxkZD2e4zpsmhsQx6RLwidllhsVcekSytpBD9GoN7vyntS+m/sgc0Luf273T++UY/VHPWuRu/i5aKXq0SL36+YCFOwDpmopx/7AyMl2XKJhsFsFYuDUS8fWT3NIMzinzhpOZTSFUBwh6GxAGq4Vv6K0OjFAtJizYmpw0K1dx5Zfm0cny7bZvqa51CnZWn3+QrosTf7REWELUhNATnErs3bGcxEhjy8QrDHpTbrPWAkKlDhlTzUugNsaXhd7u/fX5z6UUglhfgzL2xPIWsohmvViYJ3eQPrOKFplkAVI7L8Dz9TEDh49Kg== Received: from BN0PR04CA0005.namprd04.prod.outlook.com (2603:10b6:408:ee::10) by PH0PR12MB5647.namprd12.prod.outlook.com (2603:10b6:510:144::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Tue, 8 Sep 2026 06:54:07 +0000 Received: from BN7PEPF000000A8.namprd05.prod.outlook.com (2603:10b6:408:ee:cafe::28) by BN0PR04CA0005.outlook.office365.com (2603:10b6:408:ee::10) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.15 via Frontend Transport; Tue, 8 Sep 2026 06:54:07 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by BN7PEPF000000A8.mail.protection.outlook.com (10.167.245.232) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Tue, 8 Sep 2026 06:54:06 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:53:52 -0700 Received: from rnnvmail203.nvidia.com (10.129.68.9) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:53:51 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.9) with Microsoft SMTP Server id 15.2.2562.46 via Frontend Transport; Mon, 7 Sep 2026 23:53:44 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Bobby Eshleman , Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Doruk Tan Ozturk , Dragos Tatulea , Gal Pressman , Jianbo Liu , Kees Cook , Leon Romanovsky , open list , , , Mark Bloch , Petr Machata , Raed Salem , Rahul Rameshbabu , Saeed Mahameed , Shuah Khan , Shuah Khan , Simon Horman , Tariq Toukan , Willem de Bruijn , Willem de Bruijn Subject: [PATCH net-next V4 04/14] net/mlx5e: macsec: Block TC offload when MACsec is enabled Date: Tue, 8 Sep 2026 09:52:34 +0300 Message-ID: <20260908065244.3799142-5-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260908065244.3799142-1-tariqt@nvidia.com> References: <20260908065244.3799142-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PEPF000000A8:EE_|PH0PR12MB5647:EE_ X-MS-Office365-Filtering-Correlation-Id: b6121cca-5d5a-46aa-ad59-08df0d75fa22 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700016|7416014|376014|23010399003|1800799024|82310400026|3023799007|10067099003|11063799006|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: zdpDYWsBIZ34fMche1UK8uaLDsTEn+fzazYd3O6x1F2ZkKdCIYpgpM7FCMLTYE3Hgt3RXAJl/LJzuZ3aqbqL4NuiQwUBFzxFDAFEF75a2XnII9lZ+sPiPdxh+3Yn1xPgSwtYJpTABc2e71U5Pcm0yrMXt3BORiozB8dskvmlIQpwNRPy1Xu1GUJJHXEfC+trI0sy6Cq1E3znj+BRHPdCKt0tC5IxvIL/q0RKUD8+rdnQ/OtB9rkrJU/wfrQQRlAMrrbZLUxuLcbvAZOA7n8hLKOLESdXpZjedSjOaBskx+wZplX7joRit74Bz253gLeMp9fuhbB95c3y+Tl45FsxzhGNV9Xe9cB3pdHFUZRg/pEWgPaWbSuEKVk6xStJNJloBrV7F5lVgIb0fHEPL6kxRjmPQrPo66AWUKFl2kiHRM7r4iMihMW0yjyyaylzYi/zGBayAnsxHb0hbu+MX8zUU+yRrHg6Dox9aS015syWGrSzPYxjxfVzMgKpsrr0J3JKuZOyHS1pNbdLUZzn6K2yEhmMaf5BQhwF4xzG9mEbmt5J1fJTcS+FI2PerDFNeeD5+AvoPGBLn9X18+vqPkEQtXMrHS7lxx2SuJBowKj8e+VuTXdSUOD6Kb2MHRg3FB3G1eK5U7v1cJgkVF5EMr1XQlFWi8lRM6zJbJHx6LwRYpG7No+vtcQPqqSjag3z9HgUMyWBqCwFvPkEFlN6N15tnA== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(36860700016)(7416014)(376014)(23010399003)(1800799024)(82310400026)(3023799007)(10067099003)(11063799006)(22082099003)(18002099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: EoUasMKioRHlhMwUxX3RZ5amCcMMwqUGf+QcvDX++AUlOzjU416gtTyoOAam1s4MZJoT0PsGt7GXX2XeS1ZNUzavVMl6Z8UO3a4JnlvcbZOR+EQXWIPBeZEB3QdUZthg9P0niS5bs4J/mSb7doSWhFCB+bmvgfnLTXURo4w/8hHUVCk3ADA3ruqVuFMkxPPVTiY34SlUaCtWcPaF9kGYGsgI9oNO5w7CGId2NMhk2Nzkyhb8yf+1ATuunge+RkOJ5QBnHVHlWxfWJqeLyvSEaAq9DsxGmEc83fQfZ9Ns+VxNewZS1iXNmzhqv1OcD8WJrPN/0xnjkP94gQwBE5sRwxZ3jqvVP9aR2LCFoyhE/3gWxHAwdbwyW2o0SIxPXH6cLqgmALkkFqaSJHSqwTkgNGsKt2IRJhydVHTDBz6Vd8QVY0KAvIkUabeZyskxWmm+ X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2026 06:54:06.6960 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: b6121cca-5d5a-46aa-ad59-08df0d75fa22 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BN7PEPF000000A8.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR12MB5647 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu The MACsec protocol marker will soon move to flow_tag and that will make TC offload unusable at the same time as MACsec on the same device. This patch makes use of the mutual exclusion mechanism to make sure that TC and MACsec cannot be both active at the same time. One extra bit of logic is in macsec_upd_secy_hw_address(), where existing macsec rules are drained then readded. During the two loops it's possible a mistimed TC filter add to throw a wrench into things and prevent the 2nd loop from adding anything, since accel rules are now blocked. Fix that by keeping a best-effort TC block across the entire operation. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/macsec.c | 28 +++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/dr= ivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c index daff53ba7d09..a15a0aff292f 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c @@ -10,6 +10,7 @@ #include "en.h" #include "lib/aso.h" #include "lib/crypto.h" +#include "en_accel/en_accel.h" #include "en_accel/macsec.h" =20 #define MLX5_MACSEC_EPN_SCOPE_MID 0x80000000L @@ -324,6 +325,8 @@ static void mlx5e_macsec_cleanup_sa_fs(struct mlx5e_mac= sec *macsec, mlx5_macsec_fs_del_rule(macsec->mdev->macsec_fs, sa->macsec_rule, action,= netdev, fs_id); sa->macsec_rule =3D NULL; + if (!is_tx) + mlx5e_accel_unblock_tc_offload(macsec->mdev); } =20 static void mlx5e_macsec_cleanup_sa(struct mlx5e_macsec *macsec, @@ -343,6 +346,7 @@ static int mlx5e_macsec_init_sa_fs(struct macsec_contex= t *ctx, const struct macsec_tx_sc *tx_sc =3D &ctx->secy->tx_sc; struct mlx5_macsec_rule_attrs rule_attrs; union mlx5_macsec_rule *macsec_rule; + int err =3D 0; =20 if (is_tx && tx_sc->encoding_sa !=3D sa->assoc_num) return 0; @@ -353,13 +357,26 @@ static int mlx5e_macsec_init_sa_fs(struct macsec_cont= ext *ctx, rule_attrs.action =3D (is_tx) ? MLX5_ACCEL_MACSEC_ACTION_ENCRYPT : MLX5_ACCEL_MACSEC_ACTION_DECRYPT; =20 + if (!is_tx) { + err =3D mlx5e_accel_block_tc_offload(priv->mdev); + if (err) + return err; + } + macsec_rule =3D mlx5_macsec_fs_add_rule(macsec_fs, ctx, &rule_attrs, fs_i= d); - if (!macsec_rule) - return -ENOMEM; + if (!macsec_rule) { + err =3D -ENOMEM; + goto out_unblock_tc; + } =20 sa->macsec_rule =3D macsec_rule; =20 return 0; + +out_unblock_tc: + if (!is_tx) + mlx5e_accel_unblock_tc_offload(priv->mdev); + return err; } =20 static int mlx5e_macsec_init_sa(struct macsec_context *ctx, @@ -1137,7 +1154,12 @@ static int macsec_upd_secy_hw_address(struct macsec_= context *ctx, struct mlx5e_macsec_sa *rx_sa; struct list_head *list; int i, err =3D 0; + bool block_tc; =20 + /* Best-effort TC block across the operation, to prevent a mistimed TC + * filter add from preventing the 2nd loop from happening. + */ + block_tc =3D mlx5e_accel_block_tc_offload(priv->mdev) =3D=3D 0; =20 list =3D &macsec_device->macsec_rx_sc_list_head; list_for_each_entry_safe(rx_sc, tmp, list, rx_sc_list_element) { @@ -1168,6 +1190,8 @@ static int macsec_upd_secy_hw_address(struct macsec_c= ontext *ctx, =20 memcpy(macsec_device->dev_addr, dev->dev_addr, dev->addr_len); out: + if (block_tc) + mlx5e_accel_unblock_tc_offload(priv->mdev); return err; } =20 --=20 2.44.0 From nobody Fri Sep 25 22:19:10 2026 Received: from BL0PR03CU003.outbound.protection.outlook.com (mail-eastusazon11012042.outbound.protection.outlook.com [52.101.53.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E13C2392836; Tue, 8 Sep 2026 06:54:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.53.42 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850467; cv=fail; b=auc9B4o3gcX9K2aFAhd7Lpotcmkf7fQzP7Kcg1GQOYTHRNyeqddvcO17moOKL/Iq+NjJDdA4aRYdtfNJ2tdmIRZoPjUQYh01iLWskR0h5A46hhVbaAXcQeos19xoHwBDUDJa9zWcQysGtDkObH/shIRlIAo9umxhxJH7FEKyJLM= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850467; c=relaxed/simple; bh=vwovS+TgiBV6rgX8sNDHyVwltNTXDnaIle5J2GIO2lE=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Yq20UGcW7MXrIN7HGGQTcXqfs5Vr5vwEvcO0cHB3A/TMY9R5hkVg0YYP8iduGpJE304BUsDQna4gO85dP/Ccf4u0q4lMg14SNkeZ0ut9jc1F6ejBSiIfKopKVaHXncom4Az5Xb5fOJ9K5e2+MPDKDR800ky3IL/N78rIr3SiLv8= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=gEhKqbWN; arc=fail smtp.client-ip=52.101.53.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="gEhKqbWN" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=DSNUKwY8CX6I0lmcDS3LIWewzkz+BD900CAEZkYNYvBXdbeMmjiuPCeoQM/NMpoLhcV0k1YM0A1gE5NeCpuQZmWzt1p+UBTIiL9AUzSLBig31eTckd7gcev3pwylP0zJqNY2JzfvlyDzgJEE3luj6Tbkylu0qjz5RBjb3OV4xamuy7JG2Ask4lnfAHjkY09477k0KXwvYyPGQiSNue/Yl7wbZZPIUDCdv0lL56xnZeAD3jyGKp068DFi7TUqocz/2+hy0CmpECQbRL6rIseRZXOMHf9hjrMtZ0x6DS1J5tmxp8SU3qGap9nEW2BGPtx9sRKsn1UDezbIDLT5bYRs3g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5o082VsyGAhcEQvMLuK0jjE5g04Cwr5kfYV//Z6U7bc=; b=yDXK/I7h2yMpICnzGwPPquhxlFl7WIemuehWtZEp3vfyu/aN4WrPNg2VlrgodhmsTpG3yXXwzsXa+vFPhYit4yYYUrwREvQ0mSYSCOlnGcDa3mHtJ9IHOliOGBtitO8CHMoW2NC6aWTd2q10FC5zJutwLsdJu9NRkUfNZpOEYfukppNYwlSJ7qn8Ch/Cr6zLsst9XMAzT9UcJ5D/Kkk8usrkTOWxMGsuOChK+VVc/actcTDyF1/rNh/mfVesb3tXdmO/grodVTejK91iOe+yrPHv72JF54rNtadTUGx4tY3mzFtiK5hG6kHgNQtsGa3kvWIfwc4js0TsJY25GvMSyA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5o082VsyGAhcEQvMLuK0jjE5g04Cwr5kfYV//Z6U7bc=; b=gEhKqbWNAZdZWEZRF8gc/2bmqwaGsOl7Qt8xpCggGk+6nj6ihvpxxDTeCbkbF/OsoN32GhJqjnpK5m2KFHtu1eHpUPtufr3cZUxgb02DeUnEFGRB2XYi+JZFSxFTq8PJA1CnXAL7xwB9uyOJhRfsoR0z3PSVzjPMGg5gYyMo4aRYl4zfDGTtz8lWk6lJxK7X9iVBhAsnkRtvA72qGbAoChKf8vchi5rOl8AGTtiEA6MeWm1J1chgflwAgVFIe/YtpGdLII0k6j3O8NryBs6lYuQvhgHkCYEaNOZVrrx8rfcfFn2sdlV/eDzKDm2M+odYSqmLeqIK6XV8OxX7mnzNXw== Received: from CH2PR17CA0006.namprd17.prod.outlook.com (2603:10b6:610:53::16) by DM6PR12MB4220.namprd12.prod.outlook.com (2603:10b6:5:21d::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Tue, 8 Sep 2026 06:54:17 +0000 Received: from BL6PEPF00022572.namprd02.prod.outlook.com (2603:10b6:610:53:cafe::9) by CH2PR17CA0006.outlook.office365.com (2603:10b6:610:53::16) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.15 via Frontend Transport; Tue, 8 Sep 2026 06:54:17 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by BL6PEPF00022572.mail.protection.outlook.com (10.167.249.40) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Tue, 8 Sep 2026 06:54:17 +0000 Received: from rnnvmail203.nvidia.com (10.129.68.9) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:54:00 -0700 Received: from rnnvmail203.nvidia.com (10.129.68.9) by rnnvmail203.nvidia.com (10.129.68.9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:53:59 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.9) with Microsoft SMTP Server id 15.2.2562.46 via Frontend Transport; Mon, 7 Sep 2026 23:53:52 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Bobby Eshleman , Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Doruk Tan Ozturk , Dragos Tatulea , Gal Pressman , Jianbo Liu , Kees Cook , Leon Romanovsky , open list , , , Mark Bloch , Petr Machata , Raed Salem , Rahul Rameshbabu , Saeed Mahameed , Shuah Khan , Shuah Khan , Simon Horman , Tariq Toukan , Willem de Bruijn , Willem de Bruijn Subject: [PATCH net-next V4 05/14] net/mlx5e: psp: Move RX marker from ft_metadata to flow_tag Date: Tue, 8 Sep 2026 09:52:35 +0300 Message-ID: <20260908065244.3799142-6-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260908065244.3799142-1-tariqt@nvidia.com> References: <20260908065244.3799142-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL6PEPF00022572:EE_|DM6PR12MB4220:EE_ X-MS-Office365-Filtering-Correlation-Id: f1b1d629-dc9a-4f25-0a68-08df0d760093 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|82310400026|36860700016|7416014|1800799024|376014|10067099003|3023799007|22082099003|18002099003|11063799006|56012099006; X-Microsoft-Antispam-Message-Info: kMRjm+AKez1i54RdS1iqJcjPsBAdFXKzuW2s7tH12AdPjooqu2mZ3CdzFiFyAXakS4C5ksVTgVQoi4ZnvDFySaqgj5ExjLb+vihlfgviqVS2Thb+P5xlkiodEI3xHzY3kRK5q+rzgZmgpNCGUWhPL9ahbmGT1DZv1WrseOws+5C04/P+0nzBLUsyvmy0A/UOIr49v1gn+DBsnXvGGRQInqLXXYvLoNKjS3UJT+CS7fhBaUODfDgJcdQ7F53kZs1RaSAZeOplZFmmwrWKtDGxaPNPYEqjz0JX3Fr9mDDM2jHXm/1IcSJbL8lCRWPPkk/LQNGsKfmHEm6tbvynHiQmx5YAIWgTGscUSv01blrbf66ShaMsteY+ft1iUlGcn4GZv1sHhQGLKE0RTGFwFBCiVww+XZGLMcBmpCHngYLm9V2Meih42fryDwmQm3RCH/metXua3x34hEkSt9JYL4ln9uG6JyB7hEZKVM3L6ozQuwTpRXlE+1lQO45q4rIoNBNAklHUAU9UM/Ygos2reSPR4h70B3brlxEFgCbZBTxMVWvoz4CjTws8aNVKZhidNA/A4bt/cv0PCpGIIcqbtOQ1aL4rGqINyS/DHRHMmd5sVysTztfLt0vECFMHJF5TKEB5X8hn4KFH2iFmQg67duDMndiIz4metNRllsGsFD7Y36MpMN1vTjrr1c+Tr5/OnYiWVfHsIKTTpA+wuxBrNSOz7w== X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(23010399003)(82310400026)(36860700016)(7416014)(1800799024)(376014)(10067099003)(3023799007)(22082099003)(18002099003)(11063799006)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: cSAEVSWDzAh/IzLaikaLBu7v1aaTEN03waaoQopKNFYhM72si4ifi9j9M8Diz94SqnRhlKbTj0bF+idFcpuvPs/RwFplGQnHKBh/hTF5DxfF2Gr7QseFKhxzdCjqDPZ97uTdso4m8tsSaatcmfbyw7s3y4ZsHYXGGsfeKAk+4PkLfhTFNwTg3mOHcGlRaSojTeojItNz3U9/V53NVB+k8Uj8kGszqnFXCtgGht2E1xoXcTaJrfDH8Nh+Mxrmg7MggBOdCqWFUvzV0f9eeUcd23HYAXtTmvYsVrpbUhtxjc6d8OcyX5qBkbOAfVu34TUgR2vifrVuLJEtGVisKdlzgcjcOoIs9Xq/IP2G5TQm16jXtUVS1DjV7+DskOkPQfV9aigvypzVdqHyB7A++EdgsWadYf2Sm1AVNfJuDit0AIN6qmxuNJjNXR3mE9EYCDZe X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2026 06:54:17.4917 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: f1b1d629-dc9a-4f25-0a68-08df0d760093 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL6PEPF00022572.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB4220 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu Move PSP RX marker from ft_metadata (set via modify_hdr action) to flow_tag (set via flow_context). This frees ft_metadata for storing SPI for future decapsulated PSP packets. All mlx5e accel protos have to move to avoid misinterpreting packets with high bits of ft_metadata as IPsec or Macsec. This patch is the first step, defining a new header, bit layout and macros. Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/flow_tag.h | 41 +++++++++++++++++++ .../mellanox/mlx5/core/en_accel/psp.c | 36 ++++------------ .../mellanox/mlx5/core/en_accel/psp_rxtx.h | 10 ++--- 3 files changed, 55 insertions(+), 32 deletions(-) create mode 100644 drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_t= ag.h diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h b/= drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h new file mode 100644 index 000000000000..b6fcd4b63031 --- /dev/null +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h @@ -0,0 +1,41 @@ +/* SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB */ +/* Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserve= d. */ + +#ifndef __MLX5E_FLOW_TAG_H__ +#define __MLX5E_FLOW_TAG_H__ + +#include +#include +#include +#include +#include + +/* Unified accel flow_tag layout in CQE sop_drop_qpn [23:0]: + * + * [23:21] =3D protocol ID (3 bits): + * 0 =3D none (default) + * 3 =3D PSP (HW decrypted, PSP header present) + * 1,2,4-7 =3D reserved + * [20:16] =3D reserved + * [15:0] =3D used by other subsystems (e.g. TC). + */ +#define MLX5E_ACCEL_FLOW_TAG_MASK GENMASK(23, 0) +#define MLX5E_ACCEL_FLOW_TAG_PROTO_MASK GENMASK(23, 21) + +enum { + MLX5E_ACCEL_FLOW_TAG_PROTO_NONE =3D 0, + MLX5E_ACCEL_FLOW_TAG_PROTO_PSP =3D 3, +}; + +static inline u32 mlx5e_accel_flow_tag(struct mlx5_cqe64 *cqe) +{ + return be32_to_cpu(cqe->sop_drop_qpn) & MLX5E_ACCEL_FLOW_TAG_MASK; +} + +static inline u32 mlx5e_accel_flow_tag_proto(struct mlx5_cqe64 *cqe) +{ + return FIELD_GET(MLX5E_ACCEL_FLOW_TAG_PROTO_MASK, + mlx5e_accel_flow_tag(cqe)); +} + +#endif /* __MLX5E_FLOW_TAG_H__ */ diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c b/drive= rs/net/ethernet/mellanox/mlx5/core/en_accel/psp.c index 6cc4b9d54f6e..20d7f14fb4ac 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c @@ -8,6 +8,7 @@ #include "lib/crypto.h" #include "en_accel/en_accel.h" #include "en_accel/psp.h" +#include "en_accel/psp_rxtx.h" #include "fs_core.h" =20 enum accel_fs_psp_type { @@ -42,7 +43,6 @@ struct mlx5e_psp_rx_decrypt_table { struct mlx5_flow_table *ft; struct mlx5_flow_group *miss_group; struct mlx5_flow_handle *miss_rule; - struct mlx5_modify_hdr *rx_modify_hdr; struct mlx5_flow_handle *rule; }; =20 @@ -408,10 +408,6 @@ accel_psp_fs_rx_decrypt_ft_destroy(struct mlx5e_psp_fs= *fs, struct mlx5e_psp_rx_decrypt_table *decrypt) { accel_psp_fs_del_flow_rule(&decrypt->rule); - if (decrypt->rx_modify_hdr) { - mlx5_modify_header_dealloc(fs->mdev, decrypt->rx_modify_hdr); - decrypt->rx_modify_hdr =3D NULL; - } accel_psp_fs_del_flow_rule(&decrypt->miss_rule); accel_psp_fs_destroy_flow_group(&decrypt->miss_group); accel_psp_fs_destroy_ft(&decrypt->ft); @@ -431,8 +427,6 @@ accel_psp_fs_rx_decrypt_ft_create(struct mlx5e_psp_fs *= fs, struct mlx5e_psp_rx_decrypt_table *decrypt, struct mlx5_flow_destination *default_dest) { - u8 action[MLX5_UN_SZ_BYTES(set_add_copy_action_in_auto)] =3D {}; - struct mlx5_modify_hdr *modify_hdr =3D NULL; struct mlx5_flow_table_attr ft_attr =3D {}; struct mlx5_flow_destination dest =3D {}; struct mlx5_core_dev *mdev =3D fs->mdev; @@ -482,28 +476,16 @@ accel_psp_fs_rx_decrypt_ft_create(struct mlx5e_psp_fs= *fs, =20 /* Add PSP RX decrypt rule */ setup_fte_udp_psp(spec, PSP_DEFAULT_UDP_PORT); - flow_act.crypto.type =3D MLX5_FLOW_CONTEXT_ENCRYPT_DECRYPT_TYPE_PSP; - /* Set bit[31, 30] PSP marker */ -#define MLX5E_PSP_MARKER_BIT (BIT(30) | BIT(31)) - MLX5_SET(set_action_in, action, action_type, MLX5_ACTION_TYPE_SET); - MLX5_SET(set_action_in, action, field, MLX5_ACTION_IN_FIELD_METADATA_REG_= B); - MLX5_SET(set_action_in, action, data, MLX5E_PSP_MARKER_BIT); - MLX5_SET(set_action_in, action, offset, 0); - MLX5_SET(set_action_in, action, length, 32); - - modify_hdr =3D mlx5_modify_header_alloc(mdev, MLX5_FLOW_NAMESPACE_KERNEL,= 1, action); - if (IS_ERR(modify_hdr)) { - err =3D PTR_ERR(modify_hdr); - mlx5_core_err(mdev, "fail to alloc psp set modify_header_id err=3D%d\n",= err); - modify_hdr =3D NULL; - goto out_err; - } - decrypt->rx_modify_hdr =3D modify_hdr; =20 + /* Set PSP marker via flow_tag */ + spec->flow_context.flags =3D FLOW_CONTEXT_HAS_TAG; + spec->flow_context.flow_tag =3D + FIELD_PREP(MLX5E_ACCEL_FLOW_TAG_PROTO_MASK, + MLX5E_ACCEL_FLOW_TAG_PROTO_PSP); + + flow_act.crypto.type =3D MLX5_FLOW_CONTEXT_ENCRYPT_DECRYPT_TYPE_PSP; flow_act.action =3D MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | - MLX5_FLOW_CONTEXT_ACTION_CRYPTO_DECRYPT | - MLX5_FLOW_CONTEXT_ACTION_MOD_HDR; - flow_act.modify_hdr =3D modify_hdr; + MLX5_FLOW_CONTEXT_ACTION_CRYPTO_DECRYPT; dest.type =3D MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; dest.ft =3D fs->check.ft; rule =3D mlx5_add_flow_rules(decrypt->ft, spec, &flow_act, &dest, 1); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.h b/= drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.h index 2b080c39cc37..a26faf7cfc27 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.h @@ -9,10 +9,7 @@ #include #include "en.h" #include "en/txrx.h" - -/* Bit30: PSP marker, Bit22-0: PSP obj id */ -#define MLX5_PSP_METADATA_MARKER(metadata) ((((metadata) >> 30) & 0x3) = =3D=3D 0x3) -#define MLX5_PSP_METADATA_HANDLE(metadata) ((metadata) & GENMASK(22, 0)) +#include "en_accel/flow_tag.h" =20 struct mlx5e_accel_tx_psp_state { u32 tailen; @@ -82,7 +79,10 @@ static inline unsigned int mlx5e_psp_tx_ids_len(struct m= lx5e_accel_tx_psp_state =20 static inline bool mlx5e_psp_is_rx_flow(struct mlx5_cqe64 *cqe) { - return MLX5_PSP_METADATA_MARKER(be32_to_cpu(cqe->ft_metadata)); + u32 proto =3D mlx5e_accel_flow_tag_proto(cqe); + + return proto =3D=3D MLX5E_ACCEL_FLOW_TAG_PROTO_PSP; + } =20 bool mlx5e_psp_offload_handle_rx_skb(struct net_device *netdev, struct sk_= buff *skb, --=20 2.44.0 From nobody Fri Sep 25 22:19:10 2026 Received: from CY7PR03CU001.outbound.protection.outlook.com (mail-westcentralusazon11010042.outbound.protection.outlook.com [40.93.198.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 18FFC39E18F; Tue, 8 Sep 2026 06:54:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.198.42 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850472; cv=fail; b=aQxhbDKtx8pqVw8KJcRBxHCG/VfjVB5rwKRpFq1PNiBUrmXzVzv3ulw7HSIXtsK0JPJiac6mqocapmceoBPuTuZhJST1DJziYWaJAc3F/jpRtjhookInqqSMupoGQCzY07dhBvryJjfWS6Eah1UiUlm2TQsC/y96WJUlQQ9jCdM= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850472; c=relaxed/simple; bh=ZZXRwYS6bZyHOQy+nsmwjRrtbx98v/a1RCbqvjjI4Qo=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=mU1G2r73zDHDZNH9HVEZ/6dNF235dtmd5lwvhkZvf7a/xC2VSSwfCDqYgVlSMF1B9LlZohDNrlVPSdpwV2XKLNt4VHDULlZeL7XbH+mxRC98oDTp7Mjs/6HO7KGyklcxDtqgVKVsLHJEN3dRQlBpWv9KTZMJULoMny7XPkcM2GY= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=BNXSEFhv; arc=fail smtp.client-ip=40.93.198.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="BNXSEFhv" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=d8SZj+uvDgeMGYbqxmf9/EggZ9wRWLKOXy8ePhOiTjg+s8adPwiz7rToNKgEjHl9+XFbdhMIdRcm41Bgx/Aps7d9sJ458pmAoh7NFRn8+jLgBHBeqzLyH6Exdxq6XJdNPHMZHcW9LHffvQXBF9ElJi+1qW4RDlQnjcmQpgJ+lvJeiXEaue8+cATgOmRm5jrMfV0JVureA1UJ4LO+YZXErgY9p9mz8a2LqxEnb6wHbjmxx4dOS/zGz6ryEM6GZYxGLdsm7u60uUjaL6nurM4sWCtP+Bn1Ui1leHdFivjL2EcjLqXQw5GMTaAkGylcMKBZrgzPxqT2wS/mj5HKJMYeKg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=oU55x6T/u5LwmzEXsivx1jBvw3YYRc1+hfmP07ZVkwQ=; b=fnXeLicjGQJRm2y5zXh0KzEYXjNAQXJoUFhCMtq6waa+I1xj3YDP/YW4GhiJ1hD220MWYkubs2GZXSu7slfIBm58B9qTVTLL97sKj/syYd2yQbufDfko4REM2WlAkv3W69D/4hEhObEqp6fD1HnmLJtDv1opK3mZe4Ax97DLEBAs3dPCTALHzNIq5sjPdny6ZLqkZU+Jmyp26E8CCqG3eqUCEkZo0gYMtTeJ0rGsoSp0lrIiEFfyIeP0lAkb8BVDi0CMY/jm0yQ2vi8tTSfUBHDDnXypf4klQkvmLdiggfJVL4laVmiziNv16CC/RSrdUbXPgz41eabdqVvT0J1cXA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=oU55x6T/u5LwmzEXsivx1jBvw3YYRc1+hfmP07ZVkwQ=; b=BNXSEFhvA9C5rnEC1ZpgUUXYNYO8J0UoxtmWP6WFGoW7hS0Z3yUW17rs+HpRTP9KqvkxlF4nHa8hwqwRZruds6ztGeau72HvqkOzPX1J2E6l9OJIMVo5QkoGCWOwkOpHoazLwILYlpDmK/Mw4o0Ff7VDewVOle/7SAEs4rzr8QshDxT17EXcHKSkZKFx3cekkq+f+xfUBRS8lPeOSn+3FUq6Zb4iVm3YkLxp6fzVh0qXZfak1YplC2dQP8sG9p2D2Daj+3+2UeFvAw6WFa7fzLXmR8Qst9G7hkIIj9YKuw5p0f+w5gXL70zaSP2QVa/hXSqUfDePh9N908dDXkvUHw== Received: from BN9PR03CA0593.namprd03.prod.outlook.com (2603:10b6:408:10d::28) by BY5PR12MB4292.namprd12.prod.outlook.com (2603:10b6:a03:212::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Tue, 8 Sep 2026 06:54:25 +0000 Received: from BN7PEPF000000A4.namprd05.prod.outlook.com (2603:10b6:408:10d:cafe::a) by BN9PR03CA0593.outlook.office365.com (2603:10b6:408:10d::28) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.15 via Frontend Transport; Tue, 8 Sep 2026 06:54:25 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by BN7PEPF000000A4.mail.protection.outlook.com (10.167.245.228) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Tue, 8 Sep 2026 06:54:24 +0000 Received: from rnnvmail202.nvidia.com (10.129.68.7) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:54:08 -0700 Received: from rnnvmail203.nvidia.com (10.129.68.9) by rnnvmail202.nvidia.com (10.129.68.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:54:07 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.9) with Microsoft SMTP Server id 15.2.2562.46 via Frontend Transport; Mon, 7 Sep 2026 23:54:00 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Bobby Eshleman , Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Doruk Tan Ozturk , Dragos Tatulea , Gal Pressman , Jianbo Liu , Kees Cook , Leon Romanovsky , open list , , , Mark Bloch , Petr Machata , Raed Salem , Rahul Rameshbabu , Saeed Mahameed , Shuah Khan , Shuah Khan , Simon Horman , Tariq Toukan , Willem de Bruijn , Willem de Bruijn Subject: [PATCH net-next V4 06/14] net/mlx5e: ipsec: Move RX marker from ft_metadata to flow_tag Date: Tue, 8 Sep 2026 09:52:36 +0300 Message-ID: <20260908065244.3799142-7-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260908065244.3799142-1-tariqt@nvidia.com> References: <20260908065244.3799142-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PEPF000000A4:EE_|BY5PR12MB4292:EE_ X-MS-Office365-Filtering-Correlation-Id: c803559d-b9f1-465f-f7b3-08df0d760502 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|7416014|376014|1800799024|23010399003|82310400026|36860700016|6133799003|3023799007|10067099003|56012099006|11063799006|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: +yWdILxx3xkvAZmZJAJa12ChHbIgLgTraqhHS+JSLxATxNlLIe5BFBRyZWL0KLsakg33fDn/JANTSPc336/txPJkIb2VBtuwh33oFbsnGzLhbFKitbViLFNV4qTES1etaGde/h6Tsx6onDLeyBF+oZvjkyvZpGzPh/naxnlaxyMki/5D+iDCuioME/rEH7yLtFrVlSYBdj2v2epKWRw0vcwpc12HA7D/xhjVuUaHzlt1b9KwD/9jGud7mrdiKcAfh4WYYUF7tDC7/Kvm66mWxTdKlt2cRN1tlgphcw7Y92Lphj3cdja+56C6783IFRSCjzg9H4fxPJ29bWadJSDDTpmRcTNVB6vEFhw5hosBumkF6ijIzLdFHIuofJHzOuXuo/elAEVWVmSKYhwoKVgqZDIdRpdUTnZk4NOFyXN4aSq/CVl2GkgmOmefRCExLHLL80dnoC9wbw8NMdOZ2732le+rdMleV+Sop7LUgV2J2vv4znW9i6VWP7EgwXALNRHFV2CwjHimFnBvrtbP3CzxflmI7mxDfrRFxAHznA1wzyCkkRicyLC1VqrQUxv2aDncEkaNCvo5mVS04g6pkyNQgF7vEe1ReLM544/84Ronig7XUzpr/+3O9k8qVPwIaol2qNcFx62EA6lyL+btoewIafRYRcLtUZxsrGTU6FJTl/sdI5LGiK/avKKpTmVZGxXk+KW7a16IwGEhL7Bco1EdPA== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(7416014)(376014)(1800799024)(23010399003)(82310400026)(36860700016)(6133799003)(3023799007)(10067099003)(56012099006)(11063799006)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: tZaerSNLoBCitrwJ+TjFdiMbOSoSt/Q5DPJaZVRs/gbi2vxTkYUZVD/bORlaCSs0yISljBjxNxzPvfaGWt10r5utrKE/B2XGMl8gjIsSEAKG0vkO8iD/3BbGL5Jt+fdVUE1+4K31WOYK/pL1y0BkSeQ4MHgaTYcoF7H/RYo2g4W9g1MfUHoh2A/2PYi5uZfoTanUhQOTpQfC2g41q5mbYRSMywRGx8FQIFCA4OxqObquuK/n4zORKMi3Bielvk2cp9MJVi3NYZW0HWQL0bqxYU6bJz2NyBHHC/P44d4tigLTIJg8V0NrKRAQMFzl/sao8+42NJMdJjdj/fI50ZwT2mOLVJPxxEmGMjuI4q4C+OY+CR1ANkz9eA0VSJ+BP10kSkbj4dNzp/j6ABwZXJTXnwqPLrSE/owUs7AKoIGGU1Z56bIK/50lzrzj+3fokkya X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2026 06:54:24.9481 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: c803559d-b9f1-465f-f7b3-08df0d760502 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BN7PEPF000000A4.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR12MB4292 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu IPsec used BIT(31) in cqe.ft_metadata as a marker for ingress IPsec-decrypted packets. This will conflict with PSP which stores SPI in ft_metadata - an SPI with bit 31 set would falsely trigger mlx5_ipsec_is_rx_flow(). Define a new marker for IPsec in flow_tag and use it in steering rules. The obj_id stays in ft_metadata bits[23:0]. Remove the unused MARKER and SYNDROM (sic) macros. This is only done for IPsec NIC RX flows. The esw path uses a different mechanism and is unaffected: RX handling in mlx5e_rep_tc_receive() makes use of a few bits in ft_metadata to detect and hand off IPsec packets to mlx5e_ipsec_offload_handle_rx_skb(). An additional complication is that mlx5e_cqe_regb_chain() used the high order bits of ft_metadata to differentiate between TC chains and protocol markers. With the IPSec marker moving to flow_tag, this would falsely trigger mlx5e_cqe_regb_chain() to believe the chain is set, when in fact, ft_metadata is something completely different. Solve that by requiring that the new flow_tag proto is NONE, since only those packets can carry a chain id in ft_metadata. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../ethernet/mellanox/mlx5/core/en_accel/flow_tag.h | 4 +++- .../ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c | 11 +++++++++-- .../ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h | 8 ++++---- drivers/net/ethernet/mellanox/mlx5/core/en_tc.h | 7 +++++-- 4 files changed, 21 insertions(+), 9 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h b/= drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h index b6fcd4b63031..cf30096d6a37 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h @@ -14,8 +14,9 @@ * * [23:21] =3D protocol ID (3 bits): * 0 =3D none (default) + * 1 =3D IPsec * 3 =3D PSP (HW decrypted, PSP header present) - * 1,2,4-7 =3D reserved + * 2,4-7 =3D reserved * [20:16] =3D reserved * [15:0] =3D used by other subsystems (e.g. TC). */ @@ -24,6 +25,7 @@ =20 enum { MLX5E_ACCEL_FLOW_TAG_PROTO_NONE =3D 0, + MLX5E_ACCEL_FLOW_TAG_PROTO_IPSEC =3D 1, MLX5E_ACCEL_FLOW_TAG_PROTO_PSP =3D 3, }; =20 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/= drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c index f236672d3a2a..5565c385258c 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c @@ -5,6 +5,7 @@ #include "en.h" #include "en/fs.h" #include "en_accel/en_accel.h" +#include "en_accel/flow_tag.h" #include "eswitch.h" #include "ipsec.h" #include "fs_core.h" @@ -190,7 +191,7 @@ static void ipsec_rx_rule_add_match_obj(struct mlx5e_ip= sec_sa_entry *sa_entry, misc_parameters_2.metadata_reg_c_2); MLX5_SET(fte_match_param, spec->match_value, misc_parameters_2.metadata_reg_c_2, - sa_entry->ipsec_obj_id | BIT(31)); + sa_entry->ipsec_obj_id); =20 spec->match_criteria_enable |=3D MLX5_MATCH_MISC_PARAMETERS_2; } @@ -2066,7 +2067,7 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *s= a_entry) if (!attrs->drop) { if (rx !=3D ipsec->rx_esw) err =3D setup_modify_header(ipsec, attrs->type, - sa_entry->ipsec_obj_id | BIT(31), + sa_entry->ipsec_obj_id, XFRM_DEV_OFFLOAD_IN, &flow_act); else err =3D mlx5_esw_ipsec_rx_setup_modify_header(sa_entry, &flow_act); @@ -2099,6 +2100,12 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *= sa_entry) flow_act.action |=3D MLX5_FLOW_CONTEXT_ACTION_DROP; else flow_act.action |=3D MLX5_FLOW_CONTEXT_ACTION_FWD_DEST; + if (!attrs->drop && rx !=3D ipsec->rx_esw) { + spec->flow_context.flags |=3D FLOW_CONTEXT_HAS_TAG; + spec->flow_context.flow_tag =3D + FIELD_PREP(MLX5E_ACCEL_FLOW_TAG_PROTO_MASK, + MLX5E_ACCEL_FLOW_TAG_PROTO_IPSEC); + } dest[0].type =3D MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; dest[0].ft =3D rx->ft.status; dest[1].type =3D MLX5_FLOW_DESTINATION_TYPE_COUNTER; diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h = b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h index 45b0d19e735c..57aabd5e61ec 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.h @@ -38,10 +38,9 @@ #include #include "en.h" #include "en/txrx.h" +#include "en_accel/flow_tag.h" =20 -/* Bit31: IPsec marker, Bit30: reserved, Bit29-24: IPsec syndrome, Bit23-0= : IPsec obj id */ -#define MLX5_IPSEC_METADATA_MARKER(metadata) ((((metadata) >> 30) & 0x3) = =3D=3D 0x2) -#define MLX5_IPSEC_METADATA_SYNDROM(metadata) (((metadata) >> 24) & GENMAS= K(5, 0)) +/* IPsec obj id in ft_metadata bits[23:0] */ #define MLX5_IPSEC_METADATA_HANDLE(metadata) ((metadata) & GENMASK(23, 0)) =20 struct mlx5e_accel_tx_ipsec_state { @@ -74,7 +73,8 @@ static inline unsigned int mlx5e_ipsec_tx_ids_len(struct = mlx5e_accel_tx_ipsec_st =20 static inline bool mlx5_ipsec_is_rx_flow(struct mlx5_cqe64 *cqe) { - return MLX5_IPSEC_METADATA_MARKER(be32_to_cpu(cqe->ft_metadata)); + return mlx5e_accel_flow_tag_proto(cqe) =3D=3D + MLX5E_ACCEL_FLOW_TAG_PROTO_IPSEC; } =20 static inline bool mlx5e_ipsec_eseg_meta(struct mlx5_wqe_eth_seg *eseg) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.h b/drivers/net/= ethernet/mellanox/mlx5/core/en_tc.h index e1b8cb78369f..53b6043e33d2 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.h @@ -36,6 +36,7 @@ #include #include "en.h" #include "eswitch.h" +#include "en_accel/flow_tag.h" #include "en/tc_ct.h" #include "en/tc_tun.h" #include "en/tc/int_port.h" @@ -370,11 +371,13 @@ struct mlx5e_tc_table *mlx5e_tc_table_alloc(void); void mlx5e_tc_table_free(struct mlx5e_tc_table *tc); static inline bool mlx5e_cqe_regb_chain(struct mlx5_cqe64 *cqe) { - u32 chain, reg_b; + u32 flow_tag, reg_b, chain; =20 + flow_tag =3D mlx5e_accel_flow_tag_proto(cqe); reg_b =3D be32_to_cpu(cqe->ft_metadata); =20 - if (reg_b >> (MLX5E_TC_TABLE_CHAIN_TAG_BITS + ESW_ZONE_ID_BITS)) + if (flow_tag !=3D MLX5E_ACCEL_FLOW_TAG_PROTO_NONE || + (reg_b >> (MLX5E_TC_TABLE_CHAIN_TAG_BITS + ESW_ZONE_ID_BITS))) return false; =20 chain =3D reg_b & MLX5E_TC_TABLE_CHAIN_TAG_MASK; --=20 2.44.0 From nobody Fri Sep 25 22:19:10 2026 Received: from CH5PR02CU005.outbound.protection.outlook.com (mail-northcentralusazon11012061.outbound.protection.outlook.com [40.107.200.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 31ADE3A0B05; Tue, 8 Sep 2026 06:54:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.200.61 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850485; cv=fail; b=Td9cUbyRHt46XtsHfzxuVon/cVqFdDlVbbH1mQJ6YU0zDZmCEGhgabWp687J/Ao0VV+RUQS20tSkjzDPNtjNUR6pPAkO+/K0rCrh/xsR8XPMKRA0IGkRdgbb20fVv4dbWTxdEvnybIUe8XKDwsnfDD/in4bjUMz5Wj70elYTx/A= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850485; c=relaxed/simple; bh=UAcf2Sp4bZGuR4voxBYWCZ7aSPtjmV8LsbRea21XIPQ=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Vfs0GJVskSetU1tSAhocGMzTiLC2eJRN5NX4YEOqupKf9LGOfrwMLAmswPpYAibciu+I+8af9j0G2Gw999fk71zVUV5+4BvrAs6R4mPS2OLYczSOPyNo3q1/QwMF6ut4eappu9Wp8mnBFs6cGvE2uZvJt59oOGI91Cusdh1PW2k= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=n/QXsppi; arc=fail smtp.client-ip=40.107.200.61 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="n/QXsppi" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=VlmMpji7HwSPpqM9+KAzkvYgV27HxlE8CQ7OU1R4alIKeJGgcrFFvf77nVgvgndttmqZrUO55eXz+FK8u9eFUIu4bX3REs5RHGT9K3Ivhj2xTcwqYD2LOBh3DP8bnWRw7czZg31tnzq7rtjTozS+63WOj1/9NP3XTU3pn0ZYxFJ6vdt+uT4RZ1Zfn91OwaGky+UzT/3jXk/1tZDE2cuEApNu0jBf0dJqXj+JTOKKhGx/z7Egq2jKTf7yPhTuLjpnGsYo09wBGJBhqYRwzpNfpHscYDCOxO9/0KcXjP9duAxttj0KnOOe+iRyfX1sYP0tHGZOApyEDHTNtGCb/pzZmg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=awB08ujN2Eh2PXUry1zqLh4LRGZam5mF9r0x1nWvuv4=; b=FAufHSzT5JWmTn1T2gufhmmFkZnQltskzMSGqNyTpB6x4pzR/KzLbreIQSvWTC0oSdp8ZBz3EYFUdrl938EFtDTqCdt2J89NJbE3a0QUomkq2BVpz1im2iVRKodacvby3FZqcYy+c807aR+eGsnEP1bFydhAUfkA2BosBk2ZcRgPhCOrgE88WgJaCpb0HUE1NHyQtAxBcAclbysaRvjSmd4clH2CEpltO6y2lNnITC4+RfQg5G4dUABOma9T9FQc/7QA/Z4LZuWyx1IwbuOKk+M2AFOq8a2TJvcScu0mQ14K0MjykzBhfGCuKLgbA9Ny7WufBWzVeeQV6vW5NOinng== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=awB08ujN2Eh2PXUry1zqLh4LRGZam5mF9r0x1nWvuv4=; b=n/QXsppiOJVqsL9H1lx4BjGI7CJ571QaiYv43NF6z+4yclVB6OhSEeDiJrUWeHZ/LCtiZGRCY6d0+jhz9l88aRrVOxiYQM62yccdOhpaTy3Z0kkZ+7z4XPIenPlC8CvR7SIrZf6RKo/XI2Mf9SXnY6H9hN1mHB+SBTkmgoJjFdEb4vjMEK2pOc+paTMF6J05/XG6xD51+R8RKk5eQUNKcHFkqVhXlWOiIwco566CaR5mhNYpEdDJDUrCk408FE06zKVOPyEoCl9z8X3O42hu48wiYMC7e0movPFtH0Lw3Ti8atyifmjL993TV3wpZ8rne3F3NJ1IXWln85/9hTPnGg== Received: from CH0PR13CA0039.namprd13.prod.outlook.com (2603:10b6:610:b2::14) by DS0PR12MB8575.namprd12.prod.outlook.com (2603:10b6:8:164::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Tue, 8 Sep 2026 06:54:36 +0000 Received: from BL6PEPF00022573.namprd02.prod.outlook.com (2603:10b6:610:b2:cafe::31) by CH0PR13CA0039.outlook.office365.com (2603:10b6:610:b2::14) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.406.6 via Frontend Transport; Tue, 8 Sep 2026 06:54:36 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by BL6PEPF00022573.mail.protection.outlook.com (10.167.249.41) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Tue, 8 Sep 2026 06:54:35 +0000 Received: from rnnvmail204.nvidia.com (10.129.68.6) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:54:16 -0700 Received: from rnnvmail203.nvidia.com (10.129.68.9) by rnnvmail204.nvidia.com (10.129.68.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:54:15 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.9) with Microsoft SMTP Server id 15.2.2562.46 via Frontend Transport; Mon, 7 Sep 2026 23:54:08 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Bobby Eshleman , Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Doruk Tan Ozturk , Dragos Tatulea , Gal Pressman , Jianbo Liu , Kees Cook , Leon Romanovsky , open list , , , Mark Bloch , Petr Machata , Raed Salem , Rahul Rameshbabu , Saeed Mahameed , Shuah Khan , Shuah Khan , Simon Horman , Tariq Toukan , Willem de Bruijn , Willem de Bruijn Subject: [PATCH net-next V4 07/14] net/mlx5e: macsec: Move RX marker from ft_metadata to flow_tag Date: Tue, 8 Sep 2026 09:52:37 +0300 Message-ID: <20260908065244.3799142-8-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260908065244.3799142-1-tariqt@nvidia.com> References: <20260908065244.3799142-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL6PEPF00022573:EE_|DS0PR12MB8575:EE_ X-MS-Office365-Filtering-Correlation-Id: 18197623-9314-42b6-86ec-08df0d760b99 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|82310400026|36860700016|23010399003|1800799024|6133799003|10067099003|56012099006|11063799006|22082099003|18002099003|3023799007; X-Microsoft-Antispam-Message-Info: 1VezsNlmm7o5GYUShZL1PNkrSl6BWtYWdEQtpZyJcjTQjgR2UP8UR0sLEkrYMzuyrW0vcnpaMKTkVZCQGD7fFgkO79ei16HkPTWSoMuGuefVwEnCVyJwSxQxLRggE0iWjILdRToJlQbIEj0YmCk1Qkw0X7Snd9KAcQoEcFQIagkjfIkRBd9vrjIEPzzeW8j1+KCFFGLhSngrGjhInssVaOvPjJHM/6pzHPvJO1liZ90uXyck9Qh5weOw20ARns1oHIDBhShstwLDGc21HOVnccDhOmNVCYTTbBkJIZGgR72442fCQf5xaAw6ZQUJFY0J8P0AurkKMsBx4RdDzCUEGCgASB8OlUY2ECrsbh8kalnsyHybrEQh0GWW3odjxcbPaHgiSogwUBYmxzmukZCm/uczs7ozDwkAtwLV2Z1zDgcblX/pn5KjlvKs97OSTuYcGVLRwcz4xNbJ8fUvAmCqMlYDDQiG/HxJYN6wdyd6kK9mmi2Zs3K7fU7pK0pmMrptt32nVG61gS1/ttXnF/cmh0yG9Qw0i0pq1zbQKnR95+y2X/u3b4wP9Jw7c1zeV5azj2FMduN+bTAlnVyAhBzeAH9PLuX1pQQSLKu4JO+muHwurh1qFUZpmB4ABi7XczTvgS6HTwmTFLRz9WxXm39XtLD/jCHWWx+nptCGKGUwGRW8JMccPhXLpxseKIaQWDhZDHCI6o3pPNBkyyQOdV5cgw== X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(7416014)(82310400026)(36860700016)(23010399003)(1800799024)(6133799003)(10067099003)(56012099006)(11063799006)(22082099003)(18002099003)(3023799007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 0pF2nqhokCUUxu6zdwGChPpeeBuLeJUtRbrVphgsF0Bh1wQCRTDACQvQN+RTCZ8C72s5jNO9OpHtyJtt65NpuNtv1xov9nlFuEgng7pNkrOebAZ4pZHWXN/Q2A25r0xJKPmQrFZpU0CKq8EHikqIMCqb4gptdmLOl3B27uh2rJ7u3hxLhe9O6RfH8DM43NvfQU2v7puR9KbM0/tM+JRiLPT/tXIkDbdxMr8xmpfBEeZVAO4hWAhN5V3H9P1+nvb2N9gBH/b2qFRV1Xp5bvfcCqs9xeoUvVuhWn0DBiYklq+RanBiZXbbHlVhNaoSgz1s0tjHnOkdskcp2JYW3g4WIRwv00Ri8AGXXI68mLfAYCcjrJt2VO8s2GzAahJuWvVokvgGfD74/LCU/dglMHwdGMfPG9q2xjEheolfM7mVrV6zBC/mM5RnfRR36X1IsgGX X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2026 06:54:35.9979 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 18197623-9314-42b6-86ec-08df0d760b99 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BL6PEPF00022573.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR12MB8575 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu MACsec uses BIT(30) in cqe.ft_metadata as a marker to identify MACsec-decrypted packets. This will conflict with PSP SPI values with bit 30 set, which would falsely trigger mlx5e_macsec_is_rx_flow(). Define a new marker for MACsec in flow_tag and use it in steering rules. The fs_id stays in ft_metadata bits[15:0]. Correct typos of MLX5_MACSEC_RX_METADAT_HANDLE and MLX5_MACEC_RX_FS_ID_MAX while touching this. Delete the METADATA_MARKER macro. Set flow_tag on both with-SCI and without-SCI crypto rules. Signed-off-by: Cosmin Ratiu Reviewed-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/flow_tag.h | 4 +++- .../mellanox/mlx5/core/en_accel/macsec.c | 6 +++--- .../mellanox/mlx5/core/en_accel/macsec.h | 4 +++- .../mellanox/mlx5/core/lib/macsec_fs.c | 21 ++++++++++++------- .../mellanox/mlx5/core/lib/macsec_fs.h | 9 ++++---- 5 files changed, 27 insertions(+), 17 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h b/= drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h index cf30096d6a37..1b6b0b3de738 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h @@ -15,8 +15,9 @@ * [23:21] =3D protocol ID (3 bits): * 0 =3D none (default) * 1 =3D IPsec + * 2 =3D MACsec * 3 =3D PSP (HW decrypted, PSP header present) - * 2,4-7 =3D reserved + * 4-7 =3D reserved * [20:16] =3D reserved * [15:0] =3D used by other subsystems (e.g. TC). */ @@ -26,6 +27,7 @@ enum { MLX5E_ACCEL_FLOW_TAG_PROTO_NONE =3D 0, MLX5E_ACCEL_FLOW_TAG_PROTO_IPSEC =3D 1, + MLX5E_ACCEL_FLOW_TAG_PROTO_MACSEC =3D 2, MLX5E_ACCEL_FLOW_TAG_PROTO_PSP =3D 3, }; =20 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/dr= ivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c index a15a0aff292f..aa7a28954861 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c @@ -752,12 +752,12 @@ static int mlx5e_macsec_add_rxsc(struct macsec_contex= t *ctx) * a non-NULL md_dst with uninitialised contents. */ err =3D xa_alloc(&macsec->sc_xarray, &sc_xarray_element->fs_id, sc_xarray= _element, - XA_LIMIT(1, MLX5_MACEC_RX_FS_ID_MAX), GFP_KERNEL); + XA_LIMIT(1, MLX5_MACSEC_RX_FS_ID_MAX), GFP_KERNEL); if (err) { if (err =3D=3D -EBUSY) netdev_err(ctx->netdev, "MACsec offload: unable to create entry for RX SC (%d Rx SCs alread= y allocated)\n", - MLX5_MACEC_RX_FS_ID_MAX); + MLX5_MACSEC_RX_FS_ID_MAX); goto destroy_md_dst; } =20 @@ -1724,7 +1724,7 @@ void mlx5e_macsec_offload_handle_rx_skb(struct net_de= vice *netdev, if (!macsec) return; =20 - fs_id =3D MLX5_MACSEC_RX_METADAT_HANDLE(macsec_meta_data); + fs_id =3D MLX5_MACSEC_RX_METADATA_HANDLE(macsec_meta_data); =20 rcu_read_lock(); sc_xarray_element =3D xa_load(&macsec->sc_xarray, fs_id); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.h b/dr= ivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.h index 27df72e23106..2066cb573f68 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.h @@ -9,6 +9,7 @@ #include #include #include +#include "en_accel/flow_tag.h" #include "lib/macsec_fs.h" =20 struct mlx5e_priv; @@ -31,7 +32,8 @@ static inline bool mlx5e_macsec_skb_is_offload(struct sk_= buff *skb) =20 static inline bool mlx5e_macsec_is_rx_flow(struct mlx5_cqe64 *cqe) { - return MLX5_MACSEC_METADATA_MARKER(be32_to_cpu(cqe->ft_metadata)); + return mlx5e_accel_flow_tag_proto(cqe) =3D=3D + MLX5E_ACCEL_FLOW_TAG_PROTO_MACSEC; } =20 void mlx5e_macsec_offload_handle_rx_skb(struct net_device *netdev, struct = sk_buff *skb, diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c b/driv= ers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c index efc5167493c1..4ca3a6ded284 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c @@ -8,6 +8,7 @@ #include #include "fs_core.h" #include "lib/macsec_fs.h" +#include "en_accel/flow_tag.h" #include "mlx5_core.h" =20 /* MACsec TX flow steering */ @@ -45,9 +46,6 @@ #define MLX5_SECTAG_HEADER_SIZE_WITHOUT_SCI 0x8 #define MLX5_SECTAG_HEADER_SIZE_WITH_SCI (MLX5_SECTAG_HEADER_SIZE_WITHOUT_= SCI + MACSEC_SCI_LEN) =20 -/* MACsec fs_id handling for steering */ -#define macsec_fs_set_rx_fs_id(fs_id) ((fs_id) | BIT(30)) - struct mlx5_sectag_header { __be16 ethertype; u8 tci_an; @@ -1757,11 +1755,10 @@ macsec_fs_rx_add_rule(struct mlx5_macsec_fs *macsec= _fs, rx_tables =3D &rx_fs->tables; ft_crypto =3D &rx_tables->ft_crypto; =20 - /* Set bit[31 - 30] macsec marker - 0x01 */ /* Set bit[15-0] fs id */ MLX5_SET(set_action_in, action, action_type, MLX5_ACTION_TYPE_SET); MLX5_SET(set_action_in, action, field, MLX5_ACTION_IN_FIELD_METADATA_REG_= B); - MLX5_SET(set_action_in, action, data, macsec_fs_set_rx_fs_id(fs_id)); + MLX5_SET(set_action_in, action, data, fs_id); MLX5_SET(set_action_in, action, offset, 0); MLX5_SET(set_action_in, action, length, 32); =20 @@ -1778,6 +1775,11 @@ macsec_fs_rx_add_rule(struct mlx5_macsec_fs *macsec_= fs, /* Rx crypto table with SCI rule */ macsec_fs_rx_setup_fte(spec, &flow_act, attrs, true); =20 + spec->flow_context.flags |=3D FLOW_CONTEXT_HAS_TAG; + spec->flow_context.flow_tag =3D + FIELD_PREP(MLX5E_ACCEL_FLOW_TAG_PROTO_MASK, + MLX5E_ACCEL_FLOW_TAG_PROTO_MACSEC); + flow_act.modify_hdr =3D modify_hdr; flow_act.action =3D MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | MLX5_FLOW_CONTEXT_ACTION_CRYPTO_DECRYPT | @@ -1803,6 +1805,11 @@ macsec_fs_rx_add_rule(struct mlx5_macsec_fs *macsec_= fs, =20 macsec_fs_rx_setup_fte(spec, &flow_act, attrs, false); =20 + spec->flow_context.flags |=3D FLOW_CONTEXT_HAS_TAG; + spec->flow_context.flow_tag =3D + FIELD_PREP(MLX5E_ACCEL_FLOW_TAG_PROTO_MASK, + MLX5E_ACCEL_FLOW_TAG_PROTO_MACSEC); + flow_act.modify_hdr =3D modify_hdr; flow_act.action =3D MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | MLX5_FLOW_CONTEXT_ACTION_CRYPTO_DECRYPT | @@ -2160,8 +2167,8 @@ static int mlx5_macsec_fs_add_roce_rule_rx(struct mlx= 5_macsec_fs *macsec_fs, u32 =20 spec->match_criteria_enable |=3D MLX5_MATCH_MISC_PARAMETERS_2; MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, misc_parameters_2= .metadata_reg_c_5); - MLX5_SET(fte_match_param, spec->match_value, misc_parameters_2.metadata_r= eg_c_5, - macsec_fs_set_rx_fs_id(fs_id)); + MLX5_SET(fte_match_param, spec->match_value, + misc_parameters_2.metadata_reg_c_5, fs_id); flow_act.action =3D MLX5_FLOW_CONTEXT_ACTION_ALLOW; new_rule =3D mlx5_add_flow_rules(rx_fs->roce.ft_macsec_op_check, spec, &f= low_act, NULL, 0); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.h b/driv= ers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.h index 15acaff43641..b8b8b412d5c3 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.h @@ -6,11 +6,10 @@ =20 #ifdef CONFIG_MLX5_MACSEC =20 -/* Bit31 - 30: MACsec marker, Bit15-0: MACsec id */ -#define MLX5_MACEC_RX_FS_ID_MAX USHRT_MAX /* Must be power of two */ -#define MLX5_MACSEC_RX_FS_ID_MASK MLX5_MACEC_RX_FS_ID_MAX -#define MLX5_MACSEC_METADATA_MARKER(metadata) ((((metadata) >> 30) & 0x3)= =3D=3D 0x1) -#define MLX5_MACSEC_RX_METADAT_HANDLE(metadata) ((metadata) & MLX5_MACSEC= _RX_FS_ID_MASK) +/* MACsec fs_id in ft_metadata bits[15:0] */ +#define MLX5_MACSEC_RX_FS_ID_MAX USHRT_MAX /* Must be power of two */ +#define MLX5_MACSEC_RX_FS_ID_MASK MLX5_MACSEC_RX_FS_ID_MAX +#define MLX5_MACSEC_RX_METADATA_HANDLE(metadata) ((metadata) & MLX5_MACSE= C_RX_FS_ID_MASK) =20 /* MACsec TX flow steering */ #define MLX5_ETH_WQE_FT_META_MACSEC_MASK \ --=20 2.44.0 From nobody Fri Sep 25 22:19:10 2026 Received: from BL2PR02CU003.outbound.protection.outlook.com (mail-eastusazon11011012.outbound.protection.outlook.com [52.101.52.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A963B3A453A; Tue, 8 Sep 2026 06:54:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.52.12 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850490; cv=fail; b=romBfH4c+GxrCBY4HN4XIfUzPJhSs7CJSSEcoB0xDB1TnyaLlhAbsOikf3TejdUvZsHbkHsbJpSPUX3ZYxJ2D0YdwfR3QE2xXxefg6gnnipUYWE6fxedaQ4px7LF9/QrZ/DwoZjemBBfNwUN+tJXp294ChvvGFNLM9LrHWkf0no= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850490; c=relaxed/simple; bh=A/szplpPqm0nvWIsOJw8IpyWltDrgFT+LD5XLPvLB/M=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=qUpiHt3+WL8ULT4ZDsSuFXl/SUVGadcSigW/da04KiRTgnUyGt/DsCimuiOyOG5fOZMEOSntbX6hvlh/D9WmORph3un2DqhhN2Afi7HsyHw1nPGgfXEfJDxnu9abgCx87w9HMHUtW7hLY2w3/abz+/uMMd6Qnccu5uwCH0qhFn4= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=XMv/qls+; arc=fail smtp.client-ip=52.101.52.12 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="XMv/qls+" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=uU90XLlx8wjuvH2EsTGsufIOT77KwTF/JAU99HO3begwfcoqEKzi3iSPmPlzGQDaaqhSSK8gioYGtjOpfHcZyX2XJuOhaKbJtm20U2glWgNM9zNXnl0RLR17U1SRHS258nhVdBCmMqgBdt5exTTOZlL9jj28Moln8iAGqRF/OpkmYI39yNWA0YbeUk16p0R8AaxCkdB76rMdTKj7enu88GCwtS8+s0Xf5bbzUXpdBQnBcc8PlDa8Gbgb+3wxq4S3XL6DR4LxGeIoeLhmEPp4jujpLVvyRTnCMopo8/KqNGKn/RkL3sZaRrIH6LlZfQWU90Sd3pJ5aSzpAEVdPfCNpg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=DY7rV8h96DGanbcJNYhajvNjphdvow00YP7emQ77ftQ=; b=DwHxt7meYWqGMUYBzc1KDHSEkDciRfYnlLrdKch66CHBW8Q8OeswnmArHbs1nOkCruNDEdwbUHCfhdAhbS7bIpwWyET8lvooYLcFMyiiAKrt7HaYP/X3eKFT1bB4BqGq44oSq5Vc2tPKwBTO7ABlmSL88q9IMtmSMuByL6TpLNJkvSMofho/xqaKLJT3VhD8tM7neYNfteFWBn+OGD3cnBowgWSq2fvqmNHszPdmV0tM3ehDGbZEiFHUEGMK1MUBVyIFZUUz9hYYKqS0Rm85D2D6byKIW1Qj+/eZ2BJ8We0XkVb6zZeuue4a89p6L79qogqf9ocR53mAKr3BXme+/Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DY7rV8h96DGanbcJNYhajvNjphdvow00YP7emQ77ftQ=; b=XMv/qls+dIiu3Miw+MqQMU9DaRa/dsSpTPAmK/qmqk6h2Nidgm02jjlWeZ6uuG5Y4Ng2wKBgEUrBiKe/CtgzgZpGht+0m+N84lIPet7PHVstPkZDPEBeiOTWdMZWJVsWcxxjnr1kf27b5meBj7f4z7KcS2Hnut4xuQerqzWsTHAGDaHlLCO1SGK8jhsv/2Ct2uLzowEXC1fRgUBY+oXlk0uoX1bDuaq2yPypbQz6JXRnYlr1IzNEUJQx3CTQhisXaDQw8oQfLtLQtuOR2yv6Ecn3jHm6lBftqQPHgHOGizTfAq8GqdaOzMaXm9admtUVs4HYkjxD3anIegLIgsQ/Zw== Received: from BN8PR04CA0045.namprd04.prod.outlook.com (2603:10b6:408:d4::19) by DM4PR12MB7669.namprd12.prod.outlook.com (2603:10b6:8:106::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.7; Tue, 8 Sep 2026 06:54:41 +0000 Received: from BN7PEPF000000AB.namprd05.prod.outlook.com (2603:10b6:408:d4:cafe::8d) by BN8PR04CA0045.outlook.office365.com (2603:10b6:408:d4::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.15 via Frontend Transport; Tue, 8 Sep 2026 06:54:41 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by BN7PEPF000000AB.mail.protection.outlook.com (10.167.245.235) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Tue, 8 Sep 2026 06:54:40 +0000 Received: from rnnvmail201.nvidia.com (10.129.68.8) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:54:24 -0700 Received: from rnnvmail203.nvidia.com (10.129.68.9) by rnnvmail201.nvidia.com (10.129.68.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:54:23 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.9) with Microsoft SMTP Server id 15.2.2562.46 via Frontend Transport; Mon, 7 Sep 2026 23:54:16 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Bobby Eshleman , Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Doruk Tan Ozturk , Dragos Tatulea , Gal Pressman , Jianbo Liu , Kees Cook , Leon Romanovsky , open list , , , Mark Bloch , Petr Machata , Raed Salem , Rahul Rameshbabu , Saeed Mahameed , Shuah Khan , Shuah Khan , Simon Horman , Tariq Toukan , Willem de Bruijn , Willem de Bruijn Subject: [PATCH net-next V4 08/14] net/mlx5e: psp: Handle HW-decapsulated RX PSP packets Date: Tue, 8 Sep 2026 09:52:38 +0300 Message-ID: <20260908065244.3799142-9-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260908065244.3799142-1-tariqt@nvidia.com> References: <20260908065244.3799142-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PEPF000000AB:EE_|DM4PR12MB7669:EE_ X-MS-Office365-Filtering-Correlation-Id: e255f266-b71c-4d34-4683-08df0d760e92 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|36860700016|23010399003|376014|7416014|1800799024|18002099003|22082099003|11063799006|56012099006|10067099003; X-Microsoft-Antispam-Message-Info: PRwYFu5UF89JzQYrGBxb6AJqZEtLHFyhkREYCo85PybRuUbg9byLKnGTUJI/OhNOjbv0/6/LM5bapJWiMJQOkV2brVAtsTxoibnxajWz/dl1zLEi70oMzoTLU67/hmyUyGAvHbXGFsPETwe0rHqQDfrRxKd+j+cOY0AdfhDBdN3OLUoTHiw4oyyiiteK7/+xGa+yoNS/aUkJdpAPled6Utiw1aOL0i9kcQWPdAVAJ9LymOI9UJVI+HPghcoAoRvdWunL2GXFOxfnGDTpTwVM1uXgpodv/UBMCsH3O7dGI1MtarDHMJKeAYZLoYSqptdC2eri24MZqB7s2HW8V1DQoPq5jYoiIIj7TjGp7eOo8f/Ons8B9FzUr7W16c9vCse7WrHXY2IsDIbU+vsctCQwZG1Mg+3b4lutyB222WmyeSqMM1YT/T0lcaxLBAm0ZKA1veBaNgVAKPjQsdI2w5o60J8nIZPLzojbNFd2qXhR+zTeIca+dsZKHfZHEr2wCEr/j308kRv20fjcb61tX3p8zOMY3ZklZ/g4s9uM5KpIuoOpRJN7ycUCHYfZLf4gUXzjpLvvzl7noGAgoRMqscifYv1ssi9+YS3Bg5EMqBew8SPCCBo38KOBsEixjw4pJH4vVAa/jpgRuwRxF+p3ZzcbPnufqLfIM8BFs3EXvO8tz/1WSQQDOvcm/D3h3kNsm16cLzOznCA8Vtm9uatPFQEVQg== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(36860700016)(23010399003)(376014)(7416014)(1800799024)(18002099003)(22082099003)(11063799006)(56012099006)(10067099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 7/B7KqByNsvL4Ddfcre5MODJL7HAkMGoRsq/YaxfjIZgtJq8NAjm68ytJUajyPLhr8gaTM6NZ1Kcot6WTJxoVbQPF+bwPaizW4PwiBpJFo1wy1jzi8ajbgB9pnboo6C3YWBUZ80dfXApc+AnQoIuqtVz1X5cA2+G9hFmHnJ4nkdUU7CY5Lab2nC6CElvd1fySdCgczv8yPx0COjs7pIwLu9YDGPYLMeOBvsUDI6wSO0pi+1s86mefqULVWPiIe5CCWqsLxTtjPhKVjWymI+DP2U10j8dvsZLXV3WFUiQsUNkRa3Axts8Kr6aKLzvRAslRSv0nOlLcN87TV9S57xAfOtIlXh6smpHELG6BzX7Nx8/NijQLNbNnPW78TswFOUAdvOfLyEG+hMt/iZIIJd0UElc3RRISpn79Cfr9sVuDoRu3tqJ93dmrFOW6xEK4Xgl X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2026 06:54:40.9825 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: e255f266-b71c-4d34-4683-08df0d760e92 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BN7PEPF000000AB.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR12MB7669 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu mlx5e_psp_offload_handle_rx_skb() handles RX PSP packets. Add an additional flow tag marker and helpers for decapsulated PSP packets and extend the handler to construct the PSP skb extension from the CQE fields (SPI in ft_metadata and PSP version in flow_tag). Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/flow_tag.h | 8 +++-- .../mellanox/mlx5/core/en_accel/psp_rxtx.c | 21 +++++++++-- .../mellanox/mlx5/core/en_accel/psp_rxtx.h | 36 ++++++++++++++++++- 3 files changed, 59 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h b/= drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h index 1b6b0b3de738..cd10a74e2b27 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/flow_tag.h @@ -17,18 +17,22 @@ * 1 =3D IPsec * 2 =3D MACsec * 3 =3D PSP (HW decrypted, PSP header present) - * 4-7 =3D reserved - * [20:16] =3D reserved + * 4 =3D PSP decap (HW decrypted & decapsulated) + * 5-7 =3D reserved + * [20:17] =3D PSP version (4 bits, valid when proto =3D=3D PSP decap) + * 16 =3D reserved * [15:0] =3D used by other subsystems (e.g. TC). */ #define MLX5E_ACCEL_FLOW_TAG_MASK GENMASK(23, 0) #define MLX5E_ACCEL_FLOW_TAG_PROTO_MASK GENMASK(23, 21) +#define MLX5E_ACCEL_FLOW_TAG_PSP_VER_MASK GENMASK(20, 17) =20 enum { MLX5E_ACCEL_FLOW_TAG_PROTO_NONE =3D 0, MLX5E_ACCEL_FLOW_TAG_PROTO_IPSEC =3D 1, MLX5E_ACCEL_FLOW_TAG_PROTO_MACSEC =3D 2, MLX5E_ACCEL_FLOW_TAG_PROTO_PSP =3D 3, + MLX5E_ACCEL_FLOW_TAG_PROTO_PSP_DECAP =3D 4, }; =20 static inline u32 mlx5e_accel_flow_tag(struct mlx5_cqe64 *cqe) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.c b/= drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.c index 348fd7a96261..2beffee14278 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.c @@ -118,10 +118,25 @@ bool mlx5e_psp_offload_handle_rx_skb(struct net_devic= e *netdev, struct sk_buff * { struct mlx5e_priv *priv =3D netdev_priv(netdev); u16 dev_id =3D priv->psp->psd->id; - bool strip_icv =3D true; - u8 generation =3D 0; + struct psp_skb_ext *pse; + + if (mlx5e_psp_is_decap(cqe)) { + /* UDP + PSP headers and PSP trailer removed by HW. + * Construct the PSP extension from CQE metadata. + */ + pse =3D skb_ext_add(skb, SKB_EXT_PSP); + if (unlikely(!pse)) + goto drop; + + pse->spi =3D mlx5e_psp_get_spi(cqe); + pse->version =3D mlx5e_psp_get_version(cqe); + pse->dev_id =3D dev_id; + pse->generation =3D 0; + skb->decrypted =3D 1; + return false; + } =20 - if (psp_dev_rcv(skb, dev_id, generation, strip_icv)) + if (psp_dev_rcv(skb, dev_id, 0, true)) goto drop; =20 skb->decrypted =3D 1; diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.h b/= drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.h index a26faf7cfc27..32a8330027c0 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp_rxtx.h @@ -81,10 +81,29 @@ static inline bool mlx5e_psp_is_rx_flow(struct mlx5_cqe= 64 *cqe) { u32 proto =3D mlx5e_accel_flow_tag_proto(cqe); =20 - return proto =3D=3D MLX5E_ACCEL_FLOW_TAG_PROTO_PSP; + return proto =3D=3D MLX5E_ACCEL_FLOW_TAG_PROTO_PSP || + proto =3D=3D MLX5E_ACCEL_FLOW_TAG_PROTO_PSP_DECAP; =20 } =20 +static inline bool mlx5e_psp_is_decap(struct mlx5_cqe64 *cqe) +{ + u32 proto =3D mlx5e_accel_flow_tag_proto(cqe); + + return proto =3D=3D MLX5E_ACCEL_FLOW_TAG_PROTO_PSP_DECAP; +} + +static inline u8 mlx5e_psp_get_version(struct mlx5_cqe64 *cqe) +{ + return FIELD_GET(MLX5E_ACCEL_FLOW_TAG_PSP_VER_MASK, + mlx5e_accel_flow_tag(cqe)); +} + +static inline __be32 mlx5e_psp_get_spi(struct mlx5_cqe64 *cqe) +{ + return cqe->ft_metadata; +} + bool mlx5e_psp_offload_handle_rx_skb(struct net_device *netdev, struct sk_= buff *skb, struct mlx5_cqe64 *cqe); #else @@ -110,6 +129,21 @@ static inline bool mlx5e_psp_is_rx_flow(struct mlx5_cq= e64 *cqe) return false; } =20 +static inline bool mlx5e_psp_is_decap(struct mlx5_cqe64 *cqe) +{ + return false; +} + +static inline u8 mlx5e_psp_get_version(struct mlx5_cqe64 *cqe) +{ + return 0; +} + +static inline __be32 mlx5e_psp_get_spi(struct mlx5_cqe64 *cqe) +{ + return 0; +} + static inline bool mlx5e_psp_offload_handle_rx_skb(struct net_device *netd= ev, struct sk_buff *skb, struct mlx5_cqe64 *cqe) --=20 2.44.0 From nobody Fri Sep 25 22:19:10 2026 Received: from CO1PR03CU002.outbound.protection.outlook.com (mail-westus2azon11010066.outbound.protection.outlook.com [52.101.46.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5669738D3F7; Tue, 8 Sep 2026 06:54:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.46.66 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850495; cv=fail; b=nlyhIsMQfWrm4zGK7pGPXennQ6AE0YRux8L/dS9PbYcs92+djNy/OvMzqJXMQQfQVWsnVOqGf0MB7aUZh4EXBVzIKzde2rMaDzd1ziegVEDmMMh36WpgiBxBSdUNClR6GsWkqWE5Wh9YJvkO5KcwUg8EhCa2Fl6QQMsD54zp/qw= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850495; c=relaxed/simple; bh=tUrlq+M/IVVTKN3Pi2xZdUHQPr/sRdSUKD0f/gYUkME=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=P1j9SdJ9AJ/jC4OrMjJeF6baJz6tD76hQtOEgnj1PeQKWcdDrZXxpyDjxaNf70ZVV0ZBENQZXSQ9g0uNQn+INI/BVNM0AU7FwFig6qsYh7XRiG3VbZ4eBKFaqkl6ETLuYfbZWi4c4xwy/dt4h5EvKe6iZ3gOIOjeFcDOv0BLxZY= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=jMNhhtgL; arc=fail smtp.client-ip=52.101.46.66 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="jMNhhtgL" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=mqI1N8JUlqIGKADbkR19BX6X+zmttNurgA8gJ269hMPNw6dNju+ZHX10v7GY1KN7eAmTTOq0wnefYCBnMpKV9c4dgQYU8pteOPmuXlkZJpfhvZJPx22yXchchoKd/o5HjeHFt+kaVhACib8KFQi70avBEURtErC6FQcK2ptAC6mxrAFqSZ6bW3A6Bm+gjuANUUtyQ7pjl0/o+ls9eib4LeQ5UHb3PyEWP4GpAOVW+Fs9ie/CoacumfDYOPzq8mTl6Sgog8WSiVFcSzGLL4LM/D/5V+/5LMXejBLSHQXUreQV1tt12tduo9j0FOF7y6oaRL8HlhRKeIbymZ1FZmsjVA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=d5RqwQlvkzja2c186lE6lx5Eb5SMKewXulB72chfcLs=; b=JLa3SLWhogLrRt6NLYqdZBJ6MuEbXu/CAsE7L84QIy7kGuDOMluMww/jT1WBqo5JPHfYfsKPywyPgLj/C4JC3HBrtjYYGo3CDhXY9QW/a13VhUAAKDyoqZqRLcSqZcZLjEdvdJ10apaBC1N0W9bPnYO9Lpq1MO1RjV8V+2D71+UVUqN0OSRjUd+XiQjw47nSS3XhL1aKssXuYs8Bm00nUxDm8vfwAZpUF6lE/kmFWYWRDjUbUBLlaqYpgLiBcqEdLBPX/0goPEuXLWwz+5PdSUSJMz/iuJZqVIyonRsTQ/JUgMMQBpk4ZpIfJnXlqvTxGI8zPC/JV/2zV7NIWzoXJg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=d5RqwQlvkzja2c186lE6lx5Eb5SMKewXulB72chfcLs=; b=jMNhhtgLcz5aqGXF1BHhWPWugNWJCtA7KI6NkjmFp6GbZffS3HpRIly7dj05I4xZxL0DbvqaWYzdQu0a+brCOsEKIU0Uubx3B3QiDsBPbPO8u2WFWQVwdsY6uOHSID0wDmR/62C4JE2k0DuGKwi+gTnPCRtpmYQBSvT4H0iVBR+QRiLzghaQq9YLYkWPydKMNqrE+kE7Dk0X96FBfCVsN6A8cjtJf9MTlmOjHe2+wxVM6+npsF0noqhPutxGcebLupcAiCzlww/OynPZ7HgOaY5aKRI2woBcvrQG5JoRndTLRbur4+tfu4os9iuWFNqYppfcOM3tM3K2qRO3+BWBCQ== Received: from BN8PR04CA0051.namprd04.prod.outlook.com (2603:10b6:408:d4::25) by DS3PR12MB999218.namprd12.prod.outlook.com (2603:10b6:8:38e::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.7; Tue, 8 Sep 2026 06:54:46 +0000 Received: from BN7PEPF000000AB.namprd05.prod.outlook.com (2603:10b6:408:d4:cafe::81) by BN8PR04CA0051.outlook.office365.com (2603:10b6:408:d4::25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.15 via Frontend Transport; Tue, 8 Sep 2026 06:54:46 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by BN7PEPF000000AB.mail.protection.outlook.com (10.167.245.235) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Tue, 8 Sep 2026 06:54:46 +0000 Received: from rnnvmail204.nvidia.com (10.129.68.6) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:54:32 -0700 Received: from rnnvmail203.nvidia.com (10.129.68.9) by rnnvmail204.nvidia.com (10.129.68.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:54:31 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.9) with Microsoft SMTP Server id 15.2.2562.46 via Frontend Transport; Mon, 7 Sep 2026 23:54:24 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Bobby Eshleman , Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Doruk Tan Ozturk , Dragos Tatulea , Gal Pressman , Jianbo Liu , Kees Cook , Leon Romanovsky , open list , , , Mark Bloch , Petr Machata , Raed Salem , Rahul Rameshbabu , Saeed Mahameed , Shuah Khan , Shuah Khan , Simon Horman , Tariq Toukan , Willem de Bruijn , Willem de Bruijn Subject: [PATCH net-next V4 09/14] net/mlx5e: psp: Add an rx_decap steering table Date: Tue, 8 Sep 2026 09:52:39 +0300 Message-ID: <20260908065244.3799142-10-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260908065244.3799142-1-tariqt@nvidia.com> References: <20260908065244.3799142-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PEPF000000AB:EE_|DS3PR12MB999218:EE_ X-MS-Office365-Filtering-Correlation-Id: 033ab5e0-a987-4bfb-919f-08df0d7611d9 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|36860700016|23010399003|376014|7416014|1800799024|6133799003|18002099003|22082099003|3023799007|5023799004|11063799006|56012099006|10067099003; X-Microsoft-Antispam-Message-Info: rzKMHwOsUytF0DVdxGu3voTpdlf8ljXb1TTkmTZ70Ro2bisoiijuSL5nxHTfeQQoPydIlmyMD4l8bJ5+W7pBjJuexQV/SnJgNtG9EP+QRvBHCUBdaDy7GSaQpldNWtDsf5jxD7BkOfP441U0XW2VDXpvW2DbIsRtiyP2mYOpw4TWrXWk//+MWr5MiuTqkeN3Bm1g43epPQXegtt8+jpkzo9+ccHkR8PxB1HLMxqFqPhxdLNN07TR+8JfFvihiHYCFCfCL94cFTDvpZrCcYxWn27oHDbcLlCZxn2TetfY75A0FOqdMvwfzgi67UokTT78hK3MM9lEP/1CiEDrct8ZhLFVPbueQkoBBqqCKoR9ArKz/ZZ+JxlgDmkGXzDXvZJFx7pRQISo5SyP/GzyoC6RF8l8hC1FQxn9/AYuEuKKR7McfevuqniXPjOCmUvGwtcsAWV7HZGhph2Lysd+Q4u40Sa89keBLq8qKjPME3yzDgJlYbNCoVdw55dvakkYR6Sel45D4euiFJIZN9+2ECzijtKJeSAQqWrSQAhSivCqVm5Din6Ngg/kWVCVNAHA0xKrkM3/QAHPItNyiRGuNtI8ul5P+YmMr1r9moSAz9zg5YM9J+lENZP5Ro3/cALuMBtf5Q6BdShYchAzV6qyRK1LvjkW5t35O25idBiFr1vdTCogBiVtiK4kUL0dEj+9pUB80aQex+4rAj3eSz7c+QElMg== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(36860700016)(23010399003)(376014)(7416014)(1800799024)(6133799003)(18002099003)(22082099003)(3023799007)(5023799004)(11063799006)(56012099006)(10067099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: j5xME6HREQoTwoZFjlko2pp9NtWph7nRysiEJ3sYBb6dd0PPey3rVMa+xpzEK9jYmAROfK9Z/ZuYhoo/d9o71Yq12V5AOD/beKs9M15Nld6pVpnfyzyWetkHE2W8rwTyKEbRdQLwgsZ7IAp4VI6oAKZNJRQBtUb0qcbxevQM5yMXnbczLQed+pdBT2IadRAnYV0sjDsYKtJ9xXEalVyVuphuEYLfkeqCMO1mzjeU21JCsMZUclAuxHxdVFlloxSjFwGAxlb3hKuD8w0UMpoNax9JsbDWR/GOn+8f1lpk8LzFcuZuM0BmJqBoexsXZhw6ir88Ff1PGjPwPlZvKwuDzzokxUznUOyv6rGVAA5D/nv1TnFJr8HahFe37r9KtfuicEp5iwUQYCrnN+WmHel+s9G1GAk5JteRxdRtjjudoFHbgdqQotv41lp+dvPa/psQ X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2026 06:54:46.4903 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 033ab5e0-a987-4bfb-919f-08df0d7611d9 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BN7PEPF000000AB.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS3PR12MB999218 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu Introduce an additional steering table for PSP transport mode decapsulation, containing: - one rule per supported PSP version which does: - transport mode decap (removes UDP+PSP headers and PSP trailer) - recomputes iph->tot_len - recomputes IP checksum - reparses packet headers - copy SPI into reg_b (which ends up as cqe.ft_metadata) - set a decap marker and the PSP version in the flow_tag, so the RX handler can make sense of the packet - default drop rule for unsupported PSP versions (per PSP spec). Packets are forwarded to the previously added rx table, where: - one rule forwards UDP traffic to the UDP default destination. - default rule forwards traffic to the TTC table. The reason is to avoid steering loops. If packets were to be injected into the TTC directly after rx_decap, it may be possible to create a steering loop with RX packets of the form IP|UDP|PSP|UDP|PSP... The rx flow table guarantees that packets go through PSP steering at most once. The steering mode is saved in a new field 'fs.decap_enabled'. Updating the mode is done through accel_psp_fs_rx_reconfigure(), which creates the decap steering table if needed and possible. It then uses an atomic rule update to redirect traffic to the new table. This is now invoked with decap_wanted =3D=3D false. The intention is for failures creating the new table to not block feature reconfig/PSP toggling. Decap table creation and traffic redirection failures therefore result in a warning that PSP HW GRO will not work. Nothing happens on older HW/FW without the ability to decapsulate PSP transport. An upcoming patch will add dynamic reconfiguration of PSP steering based on HW GRO. Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../net/ethernet/mellanox/mlx5/core/en/fs.h | 1 + .../mellanox/mlx5/core/en_accel/psp.c | 249 +++++++++++++++++- 2 files changed, 248 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/= ethernet/mellanox/mlx5/core/en/fs.h index 4973fb473ff0..a802f80d90be 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h @@ -98,6 +98,7 @@ enum { #if defined(CONFIG_MLX5_EN_PSP) MLX5E_ACCEL_FS_PSP_FT_LEVEL =3D MLX5E_INNER_TTC_FT_LEVEL + 1, MLX5E_ACCEL_FS_PSP_ERR_FT_LEVEL, + MLX5E_ACCEL_FS_PSP_DECAP_FT_LEVEL, MLX5E_ACCEL_FS_PSP_RX_FT_LEVEL, #endif }; diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c b/drive= rs/net/ethernet/mellanox/mlx5/core/en_accel/psp.c index 20d7f14fb4ac..84133cbf8689 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c @@ -23,6 +23,13 @@ enum accel_psp_syndrome { PSP_BAD_TRAILER, }; =20 +static const u8 psp_supported_versions[] =3D { + PSP_VERSION_HDR0_AES_GCM_128, + PSP_VERSION_HDR0_AES_GCM_256, +}; + +#define MLX5E_PSP_NUM_SUPPORTED_VERSIONS ARRAY_SIZE(psp_supported_versions) + struct mlx5e_psp_tx_table { struct mlx5_flow_namespace *ns; struct mlx5_flow_table *ft; @@ -43,6 +50,7 @@ struct mlx5e_psp_rx_decrypt_table { struct mlx5_flow_table *ft; struct mlx5_flow_group *miss_group; struct mlx5_flow_handle *miss_rule; + struct mlx5_modify_hdr *modify_hdr; struct mlx5_flow_handle *rule; }; =20 @@ -53,6 +61,15 @@ struct mlx5e_psp_rx_table { struct mlx5_flow_handle *udp_rules[ACCEL_FS_PSP_NUM_TYPES]; }; =20 +struct mlx5e_psp_rx_decap_table { + struct mlx5_flow_table *ft; + struct mlx5_flow_group *drop_group; + struct mlx5_modify_hdr *modify_hdr; + struct mlx5_pkt_reformat *reformat; + struct mlx5_flow_handle *rule[MLX5E_PSP_NUM_SUPPORTED_VERSIONS]; + struct mlx5_flow_handle *unsupported_rule; +}; + struct mlx5e_psp_fs { struct mlx5_core_dev *mdev; struct mlx5_fc *tx_counter; @@ -64,9 +81,14 @@ struct mlx5e_psp_fs { struct mlx5_fc *rx_auth_fail_counter; struct mlx5_fc *rx_err_counter; struct mlx5_fc *rx_bad_counter; + /* When set, steering is configured to decapsulate PSP (remove UDP+PSP + * headers and PSP trailer) and hand off the SPI in cqe.ft_metadata. + */ + bool decap_enabled; =20 struct mlx5e_psp_rx_decrypt_table decrypt[ACCEL_FS_PSP_NUM_TYPES]; struct mlx5e_psp_rx_check_table check; + struct mlx5e_psp_rx_decap_table decap; struct mlx5e_psp_rx_table rx; }; =20 @@ -111,6 +133,15 @@ static void accel_psp_fs_del_flow_rule(struct mlx5_flo= w_handle **rule) } } =20 +static void accel_psp_fs_dealloc_modify_hdr(struct mlx5_core_dev *dev, + struct mlx5_modify_hdr **modhdr) +{ + if (*modhdr) { + mlx5_modify_header_dealloc(dev, *modhdr); + *modhdr =3D NULL; + } +} + static int accel_psp_fs_create_miss_group(struct mlx5_flow_table *ft, struct mlx5_flow_group **group) { @@ -403,11 +434,164 @@ int accel_psp_fs_rx_check_ft_create(struct mlx5e_psp= _fs *fs, return err; } =20 +static +void accel_psp_fs_rx_decap_ft_destroy(struct mlx5e_psp_fs *fs, + struct mlx5e_psp_rx_decap_table *decap) +{ + int i; + + accel_psp_fs_del_flow_rule(&decap->unsupported_rule); + for (i =3D 0; i < MLX5E_PSP_NUM_SUPPORTED_VERSIONS; i++) + accel_psp_fs_del_flow_rule(&decap->rule[i]); + if (decap->reformat) { + mlx5_packet_reformat_dealloc(fs->mdev, decap->reformat); + decap->reformat =3D NULL; + } + accel_psp_fs_dealloc_modify_hdr(fs->mdev, &decap->modify_hdr); + accel_psp_fs_destroy_flow_group(&decap->drop_group); + accel_psp_fs_destroy_ft(&decap->ft); + fs->decap_enabled =3D false; +} + +static void setup_fte_psp_version(struct mlx5_flow_spec *spec, u8 version) +{ + void *misc_params_6; + + memset(spec, 0, sizeof(*spec)); + spec->match_criteria_enable |=3D MLX5_MATCH_MISC_PARAMETERS_6; + misc_params_6 =3D MLX5_ADDR_OF(fte_match_param, spec->match_criteria, + misc_parameters_6); + MLX5_SET_TO_ONES(fte_match_set_misc6, misc_params_6, psp_version); + misc_params_6 =3D MLX5_ADDR_OF(fte_match_param, spec->match_value, + misc_parameters_6); + MLX5_SET(fte_match_set_misc6, misc_params_6, psp_version, version); +} + +static +int accel_psp_fs_rx_decap_ft_create(struct mlx5e_psp_fs *fs, + struct mlx5e_psp_rx_decap_table *decap) +{ + u8 action[MLX5_UN_SZ_BYTES(set_add_copy_action_in_auto)] =3D {}; + struct mlx5_pkt_reformat_params reformat_params =3D {}; + struct mlx5_flow_table_attr ft_attr =3D {}; + struct mlx5_flow_destination dest =3D {}; + struct mlx5_core_dev *mdev =3D fs->mdev; + struct mlx5_pkt_reformat *reformat; + struct mlx5_modify_hdr *modify_hdr; + struct mlx5_flow_handle *rule; + struct mlx5_flow_spec *spec; + int i, err =3D 0; + + spec =3D kvzalloc_obj(*spec); + if (!spec) + return -ENOMEM; + + /* Create FT */ + ft_attr.max_fte =3D 1 + MLX5E_PSP_NUM_SUPPORTED_VERSIONS; + ft_attr.level =3D MLX5E_ACCEL_FS_PSP_DECAP_FT_LEVEL; + ft_attr.prio =3D MLX5E_NIC_PRIO; + ft_attr.autogroup.num_reserved_entries =3D 1; + err =3D accel_psp_fs_create_ft(fs, &ft_attr, &decap->ft); + if (err) { + mlx5_core_err(mdev, "fail to create psp decap rx ft err=3D%d\n", + err); + goto out_spec; + } + + /* Create drop group */ + err =3D accel_psp_fs_create_miss_group(decap->ft, &decap->drop_group); + if (err) { + mlx5_core_err(mdev, + "fail to create psp decap rx drop_group err=3D%d\n", + err); + goto out_err; + } + + /* Add default drop rule */ + err =3D accel_psp_add_drop_rule(decap->ft, NULL, fs->rx_bad_counter, + &decap->unsupported_rule); + if (err) { + mlx5_core_err(mdev, + "fail to create psp decap unsupported versions drop rule err=3D%d= \n", + err); + goto out_err; + } + + /* modify_hdr: copy SPI from REG_C_0 to REG_B */ + MLX5_SET(copy_action_in, action, action_type, MLX5_ACTION_TYPE_COPY); + MLX5_SET(copy_action_in, action, src_field, + MLX5_ACTION_IN_FIELD_METADATA_REG_C_0); + MLX5_SET(copy_action_in, action, src_offset, 0); + MLX5_SET(copy_action_in, action, length, 0); /* 0 =3D 32 bits */ + MLX5_SET(copy_action_in, action, dst_field, + MLX5_ACTION_IN_FIELD_METADATA_REG_B); + MLX5_SET(copy_action_in, action, dst_offset, 0); + + modify_hdr =3D mlx5_modify_header_alloc(mdev, MLX5_FLOW_NAMESPACE_KERNEL, + 1, action); + if (IS_ERR(modify_hdr)) { + err =3D PTR_ERR(modify_hdr); + goto out_err; + } + decap->modify_hdr =3D modify_hdr; + + /* pkt_reformat: decap PSP transport */ + reformat_params.type =3D MLX5_REFORMAT_TYPE_REMOVE_PSP_TRANSPORT; + reformat =3D mlx5_packet_reformat_alloc(mdev, &reformat_params, + MLX5_FLOW_NAMESPACE_KERNEL); + if (IS_ERR(reformat)) { + err =3D PTR_ERR(reformat); + goto out_err; + } + decap->reformat =3D reformat; + + for (i =3D 0; i < MLX5E_PSP_NUM_SUPPORTED_VERSIONS; i++) { + u8 version =3D psp_supported_versions[i]; + struct mlx5_flow_act flow_act =3D {}; + + /* match(version) =3D> decap, copy SPI, fwd to rx FT */ + setup_fte_psp_version(spec, version); + + /* + * Override the flow tag set in the decrypt table with + * the decap PSP marker and version. + */ + spec->flow_context.flags =3D FLOW_CONTEXT_HAS_TAG; + spec->flow_context.flow_tag =3D + FIELD_PREP(MLX5E_ACCEL_FLOW_TAG_PROTO_MASK, + MLX5E_ACCEL_FLOW_TAG_PROTO_PSP_DECAP) | + FIELD_PREP(MLX5E_ACCEL_FLOW_TAG_PSP_VER_MASK, version); + + flow_act.action =3D MLX5_FLOW_CONTEXT_ACTION_PACKET_REFORMAT | + MLX5_FLOW_CONTEXT_ACTION_MOD_HDR | + MLX5_FLOW_CONTEXT_ACTION_FWD_DEST; + flow_act.pkt_reformat =3D reformat; + flow_act.modify_hdr =3D modify_hdr; + dest.type =3D MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; + dest.ft =3D fs->rx.ft; + + rule =3D mlx5_add_flow_rules(decap->ft, spec, &flow_act, &dest, 1); + if (IS_ERR(rule)) { + err =3D PTR_ERR(rule); + goto out_err; + } + decap->rule[i] =3D rule; + } + goto out_spec; + +out_err: + accel_psp_fs_rx_decap_ft_destroy(fs, decap); +out_spec: + kvfree(spec); + return err; +} + static void accel_psp_fs_rx_decrypt_ft_destroy(struct mlx5e_psp_fs *fs, struct mlx5e_psp_rx_decrypt_table *decrypt) { accel_psp_fs_del_flow_rule(&decrypt->rule); + accel_psp_fs_dealloc_modify_hdr(fs->mdev, &decrypt->modify_hdr); accel_psp_fs_del_flow_rule(&decrypt->miss_rule); accel_psp_fs_destroy_flow_group(&decrypt->miss_group); accel_psp_fs_destroy_ft(&decrypt->ft); @@ -427,10 +611,12 @@ accel_psp_fs_rx_decrypt_ft_create(struct mlx5e_psp_fs= *fs, struct mlx5e_psp_rx_decrypt_table *decrypt, struct mlx5_flow_destination *default_dest) { + u8 action[MLX5_UN_SZ_BYTES(set_add_copy_action_in_auto)] =3D {}; struct mlx5_flow_table_attr ft_attr =3D {}; struct mlx5_flow_destination dest =3D {}; struct mlx5_core_dev *mdev =3D fs->mdev; MLX5_DECLARE_FLOW_ACT(flow_act); + struct mlx5_modify_hdr *modhdr; struct mlx5_flow_handle *rule; struct mlx5_flow_spec *spec; int err =3D 0; @@ -474,6 +660,24 @@ accel_psp_fs_rx_decrypt_ft_create(struct mlx5e_psp_fs = *fs, } decrypt->miss_rule =3D rule; =20 + /* Create modify_hdr to copy SPI to REG_C_0 */ + MLX5_SET(copy_action_in, action, action_type, MLX5_ACTION_TYPE_COPY); + MLX5_SET(copy_action_in, action, src_field, + MLX5_ACTION_IN_FIELD_PSP_HEADER_1); + MLX5_SET(copy_action_in, action, src_offset, 0); + MLX5_SET(copy_action_in, action, length, 0); /* 0 =3D 32 bits */ + MLX5_SET(copy_action_in, action, dst_field, + MLX5_ACTION_IN_FIELD_METADATA_REG_C_0); + MLX5_SET(copy_action_in, action, dst_offset, 0); + + modhdr =3D mlx5_modify_header_alloc(mdev, MLX5_FLOW_NAMESPACE_KERNEL, 1, + action); + if (IS_ERR(modhdr)) { + err =3D PTR_ERR(modhdr); + goto out_err; + } + decrypt->modify_hdr =3D modhdr; + /* Add PSP RX decrypt rule */ setup_fte_udp_psp(spec, PSP_DEFAULT_UDP_PORT); =20 @@ -484,8 +688,10 @@ accel_psp_fs_rx_decrypt_ft_create(struct mlx5e_psp_fs = *fs, MLX5E_ACCEL_FLOW_TAG_PROTO_PSP); =20 flow_act.crypto.type =3D MLX5_FLOW_CONTEXT_ENCRYPT_DECRYPT_TYPE_PSP; - flow_act.action =3D MLX5_FLOW_CONTEXT_ACTION_FWD_DEST | - MLX5_FLOW_CONTEXT_ACTION_CRYPTO_DECRYPT; + flow_act.action =3D MLX5_FLOW_CONTEXT_ACTION_CRYPTO_DECRYPT | + MLX5_FLOW_CONTEXT_ACTION_MOD_HDR | + MLX5_FLOW_CONTEXT_ACTION_FWD_DEST; + flow_act.modify_hdr =3D modhdr; dest.type =3D MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; dest.ft =3D fs->check.ft; rule =3D mlx5_add_flow_rules(decrypt->ft, spec, &flow_act, &dest, 1); @@ -506,6 +712,42 @@ accel_psp_fs_rx_decrypt_ft_create(struct mlx5e_psp_fs = *fs, return err; } =20 +static void accel_psp_fs_rx_reconfigure(struct mlx5e_psp_fs *fs, + bool decap_wanted) +{ + bool decap_supported =3D + MLX5_CAP_FLOWTABLE(fs->mdev, + flow_table_properties_nic_receive.reformat_del_psp_transport); + bool decap_enable =3D decap_wanted && decap_supported; + struct mlx5_flow_destination dest =3D {}; + int err; + + if (decap_enable =3D=3D fs->decap_enabled) + return; + + /* Create the decap table if needed. */ + if (decap_enable && !fs->decap.ft) { + err =3D accel_psp_fs_rx_decap_ft_create(fs, &fs->decap); + if (err) + goto out_err; + } + + /* Redirect traffic to the correct table. */ + dest.type =3D MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; + dest.ft =3D decap_enable ? fs->decap.ft : fs->rx.ft; + err =3D mlx5_modify_rule_destination(fs->check.rule, &dest, NULL); + if (err) + goto out_err; + + fs->decap_enabled =3D decap_enable; + return; + +out_err: + mlx5_core_warn(fs->mdev, + "Failed to create/modify PSP decapsulation rules (err %d), HW GRO= for PSP unavailable\n", + err); +} + static void accel_psp_fs_rx_destroy(struct mlx5e_psp_fs *fs) { struct mlx5_ttc_table *ttc =3D mlx5e_fs_get_ttc(fs->fs, false); @@ -518,6 +760,7 @@ static void accel_psp_fs_rx_destroy(struct mlx5e_psp_fs= *fs) accel_psp_fs_rx_decrypt_ft_destroy(fs, &fs->decrypt[i]); } accel_psp_fs_rx_check_ft_destroy(&fs->check); + accel_psp_fs_rx_decap_ft_destroy(fs, &fs->decap); accel_psp_fs_rx_ft_destroy(&fs->rx); if (tc_blocked) mlx5e_accel_unblock_tc_offload(fs->mdev); @@ -565,6 +808,8 @@ static int accel_psp_fs_rx_create(struct mlx5e_psp_fs *= fs, mlx5_ttc_fwd_dest(ttc, fs_psp2tt(i), &dest); } =20 + accel_psp_fs_rx_reconfigure(fs, false); + return 0; =20 err_decrypt_ft: --=20 2.44.0 From nobody Fri Sep 25 22:19:10 2026 Received: from BYAPR05CU005.outbound.protection.outlook.com (mail-westusazon11010061.outbound.protection.outlook.com [52.101.85.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 683A433E37A; Tue, 8 Sep 2026 06:55:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.85.61 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850502; cv=fail; b=UQ/qlHpAUDSt/VrGSiEE2r9Q024SLiurnA1ImbKMUnipuoVMmhlorxl1vzgtw1krAvwfR3o8B4nxguP8ZPEDfNrh2YXDjOawoO+enSnfoJizV+AKYQWYT7yEjeMg81dhZaPSbOxwoc/SnrVGNLaokFfgGnn2ULrjOvToKXORwFU= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850502; c=relaxed/simple; bh=NzTLbaGwjlLNgf7VDf3kebNHEoWB/e8QSAM6oi8hDcU=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ihk5WgNL4lKtMjadwgjb7nsiHh2tu5e/NoH2Qbosa4V41xl40gfYHwPCiSmdvGNov57oW5yEGmuKGIV+GvqThPh3s90L5LauFxDNdlowY3UloEfA45MPz3OR8jy+LFJvHj+sCnfU7dIomG2+y9vLhsJC+wVt1Ma43yy9x6cydyE= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=RyGDhPnB; arc=fail smtp.client-ip=52.101.85.61 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="RyGDhPnB" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=wT67FJQe8II0uIimXh6HcHMEN+4hraUOsxwQNs8LT+idJxgffA+XGd1K7UUiNip1sjb6N+wH3jR8y5SpBHYaFr32EX6MG2ZhFFgR37O0fesmQ65KSdeY/uFjwXl5KNbZ8GNoxx81t2nG/Dq47poYoKl4gn5uQdbfC5XcHza1yUleh43+f+Q+n9w3o+plbFn0+Lpyk/v6ZUgbTQBOkEVL6jFn+IxZ6SZjoPaY/hlroA36AldyLkLfZAqlqVukzB3xpdXolqwtzrp5D11Y7cZJ9eCb2Wz5lB/kfbU6/3BPYeXbm9gTfgeMpL1nCLb2jenQujzr3ZdeZzgEnq3QIuStEA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Ck2c5iiKlvN1GAg0xM1wL/AEaNa4YEx948jp7xz8p44=; b=uwnMjOos09j5nox609k0r/54LIY+nYM0761pNVl4GQ5c9bQKBAcou66BSR+F4powOJpO+E18qJjgFF0JySZYlMs/sSgSz3AWsL9uz0sTtpZwle6zCB6cACCKe23UJ4h0Afz87qGGWF9PLy+9lGy0NHSFX+pHvputODejKCzxZhMSFk6ISkPWce14RcmU5XIlfcc7VHkaCGl6JHNXzOonPgHecju231kf6S0CzcujTVXKCRKtdNLhOIRZm3eAdks6dCJQGs/3hswCPmHOuqdFtn+YcBjTnZeonygT4yWge+KHpfulM70HRf9/IfUVnM078Gf9vAln0L0XMlc5x3bo6g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Ck2c5iiKlvN1GAg0xM1wL/AEaNa4YEx948jp7xz8p44=; b=RyGDhPnBQI4gtpLk4NpeffTBPc0cyoeP4xKsYU/QitKumQqvFVTO5Sb1yJIBGqrUsb7JCxnctW4bDJs/+OuMHMTQN4iBv96ptqL1iWLOl9C0ocq05QpNd7XCtrSMwfhCy87eecYOII+NQ+SCuUEpoaDQvnRD5uwXBT719qVdi3NNJSXObN8FbulGrMiDRYHU2ZLM5vcTNfbzqZhYaAvdFopEQD8WtmdqvMFJvqRd0zRDeXbvlqko0QNvOrXVTllCx8I4Jbm6sZ6ORcOLoobCuC+k5Ou08QApkVoc74iN8impb/qgtIvQlCtc4r/ve+Be+/B8KA7s4iTkClaXynafqQ== Received: from BN0PR04CA0071.namprd04.prod.outlook.com (2603:10b6:408:ea::16) by CYYPR12MB8853.namprd12.prod.outlook.com (2603:10b6:930:cb::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.6; Tue, 8 Sep 2026 06:54:55 +0000 Received: from BN7PEPF000000A6.namprd05.prod.outlook.com (2603:10b6:408:ea:cafe::3c) by BN0PR04CA0071.outlook.office365.com (2603:10b6:408:ea::16) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.15 via Frontend Transport; Tue, 8 Sep 2026 06:54:55 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by BN7PEPF000000A6.mail.protection.outlook.com (10.167.245.230) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Tue, 8 Sep 2026 06:54:54 +0000 Received: from rnnvmail204.nvidia.com (10.129.68.6) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:54:40 -0700 Received: from rnnvmail203.nvidia.com (10.129.68.9) by rnnvmail204.nvidia.com (10.129.68.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:54:39 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.9) with Microsoft SMTP Server id 15.2.2562.46 via Frontend Transport; Mon, 7 Sep 2026 23:54:32 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Bobby Eshleman , Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Doruk Tan Ozturk , Dragos Tatulea , Gal Pressman , Jianbo Liu , Kees Cook , Leon Romanovsky , open list , , , Mark Bloch , Petr Machata , Raed Salem , Rahul Rameshbabu , Saeed Mahameed , Shuah Khan , Shuah Khan , Simon Horman , Tariq Toukan , Willem de Bruijn , Willem de Bruijn Subject: [PATCH net-next V4 10/14] net/mlx5e: shampo: Flush session on PSP mismatch Date: Tue, 8 Sep 2026 09:52:40 +0300 Message-ID: <20260908065244.3799142-11-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260908065244.3799142-1-tariqt@nvidia.com> References: <20260908065244.3799142-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PEPF000000A6:EE_|CYYPR12MB8853:EE_ X-MS-Office365-Filtering-Correlation-Id: bf0015ce-797e-4cbc-5c3b-08df0d7616da X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|82310400026|23010399003|1800799024|36860700016|3023799007|10067099003|11063799006|56012099006|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: /pMeSNxL9umJf3OwojjQX4Dszxf9PU5/FB7SMcQ19yeCdgWh8ImYDIrhPIkcKvlZLjIQAhuhFrzWfMCuRbsQMJjT77Gm60SFxvkgTX5Y//xCkt8ZfZpIemd9NYow9KNEqlxBDfb2OIhnSd2VlLNctjte63l0/n0E23Jt4dBbKSk+HLVQf0+HXzHOBNuZFjQG4lht6KvprOZLVJpk8uFe+aEGkHKE89bvdoNxqpmUHVeurgjsZgPV2Aq9q2nD5U3BJproXcYwQqIphukoSKcBl8sLghg4gGbx/cGMi0Mphc06b6bSqUrsouXV1MXJ58/z3HSoo44yS4rY+j8mE2Ctaq0qD02Q85KWEO2LXhLlN7BgHn21R/zN+BVDs7r1sbgLTMz+jwMqOxo4HmKY6eNziKLtN8kJUjpUbpdcV8JRmefIjvcLLpHimG92f3ZYD2QH8Xz7T3VfvAxBgd0ioxE9Pe9T4Kw4o6Lmrq+HYo1x2S/25svXuDVF4RIfGseX6Yk2npnM5/dT3mLzhdeMsMeWIJCzSt/FR5XZLAEsZFtMUzEk7fyxNDLHmW2dN2RuB27QCSIoPGYjJGhinqKLmtpgX6WYOY/vFMyRTlwwmkUGmA80dkitpAyl7njrFI0hHl+MOOb5enJyzV8aYRO0doBET5YTta5xTtkZN0FEzC3LQ6/bvR7iwqOJGMgQqYYjNizEQE4QcN8vCClkXtzF7wuN9g== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(7416014)(82310400026)(23010399003)(1800799024)(36860700016)(3023799007)(10067099003)(11063799006)(56012099006)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: PyUFGWWSRSivQhAshBH+1SOmvtKwaMYvTwqP70OFxmNePSY6jWTj7Rp2mzz0qCR6i9zKmb55n+xL7Z2UFEAuxbbfvZLdTpI9tOi7w1GKJn8Si5/yXwUvsew/TOvxLl11SyYp4FG/vU4h0P337MRDXg+Hj0tTcWK74h54O81SFWLjZowG82oE8Qjg6oIa8NuM4IZ0fY90AhvSX/DpqwYwZdzb3mF/SUl3WMO8+3ef3gfLpp8vL4q4P+baEWGq68Wo0qVAY1YxsuBUy83hMrSIo8PRYc/ylZZQpzyF4wMi1ILJxnODPDzelpRrHqPqu7a3JlbAI2rfDUzevr7KNaPjoljJIvufnphl4xJvT7tf1FQsmVHOHdkuj7CvLp8lnpK8rrhMw/dt9D9cX3tltTFS1l9z0DrC7w/rPXpI90zTp8I7uasOFUSc3gr09bs8KAK3 X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2026 06:54:54.8618 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: bf0015ce-797e-4cbc-5c3b-08df0d7616da X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BN7PEPF000000A6.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CYYPR12MB8853 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu Flush SHAMPO session on PSP status change (no PSP -> PSP or vice-versa) or on SPI/version mismatch. HW aggregates by 5-tuple but is unaware of PSP fields, so sessions must be terminated when security parameters change to avoid mixing packets from different PSP associations. The session is also forcefully flushed if non-decapsulated packets are received. This could happen if, for example, the decap table could not be created so HW GRO is active but there's no decapsulation. Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../net/ethernet/mellanox/mlx5/core/en_rx.c | 32 +++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/= ethernet/mellanox/mlx5/core/en_rx.c index e3f915beebe1..9eb11be7abe0 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c @@ -2224,6 +2224,33 @@ static bool mlx5e_hw_gro_skb_has_enough_space(struct= sk_buff *skb, return page_size * nr_frags + data_bcnt <=3D GRO_LEGACY_MAX_SIZE; } =20 +static bool mlx5e_hw_gro_psp_match(struct sk_buff *skb, struct mlx5_cqe64 = *cqe) +{ +#ifdef CONFIG_MLX5_EN_PSP + struct psp_skb_ext *pse =3D skb_ext_find(skb, SKB_EXT_PSP); + bool is_psp =3D mlx5e_psp_is_rx_flow(cqe); + + if (likely(!is_psp && !pse)) + return true; + + /* No match on PSP status change (no crypto -> crypto or vice-versa). */ + if (unlikely(is_psp !=3D !!pse)) + return false; + + /* SPI and version are only available in CQE metadata for decap flows. + * Non-decap PSP cannot be matched here, force a flush. + */ + if (unlikely(!mlx5e_psp_is_decap(cqe))) + return false; + + /* No match on security parameters change. */ + return pse->spi =3D=3D mlx5e_psp_get_spi(cqe) && + pse->version =3D=3D mlx5e_psp_get_version(cqe); +#else + return true; +#endif +} + static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct mlx5e_rq *rq, struct m= lx5_cqe64 *cqe) { u16 data_bcnt =3D mpwrq_get_cqe_byte_cnt(cqe) - cqe->shampo.header_size; @@ -2266,8 +2293,9 @@ static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct m= lx5e_rq *rq, struct mlx5_cq } =20 if (*skb && - !(match && mlx5e_hw_gro_skb_has_enough_space(*skb, data_bcnt, - page_size))) { + !(match && + mlx5e_hw_gro_skb_has_enough_space(*skb, data_bcnt, page_size) && + mlx5e_hw_gro_psp_match(*skb, cqe))) { match =3D false; mlx5e_shampo_flush_skb(rq, cqe, match); } --=20 2.44.0 From nobody Fri Sep 25 22:19:10 2026 Received: from DM5PR21CU001.outbound.protection.outlook.com (mail-centralusazon11011010.outbound.protection.outlook.com [52.101.62.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E59522E719B; Tue, 8 Sep 2026 06:55:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.62.10 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850509; cv=fail; b=lBPS3kzgA8JP1ys+Kmsl0K4umjXrYTOFrfdy2uyzaT/SbFFtDUl7nqxwqlfjyDmXsflC8xCCOIvq0IP0K/b2h+mF6TYz0ZntF0DHb4ItldIHBMYF0ScG8Vrret0FMxKNlWoDfzMyYi7m3ne5f79tCRcfizPh4CeB3AscVe2kIno= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850509; c=relaxed/simple; bh=CX9T/Lo5qcKEw2zNVpisTUWqU6m0Jrx383ZmHgJbGOU=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=fTiFeqWqxUiw5ND9LjEpF0YzyxbyfoakpddDywNflXoHqXshokBsTBXDIPQsjPpkjL0qImVGXVDPgAWSK/ODVTs9Xp3weYMqAKf9sd9pBsWgkDhgQ2dKvO0+95ldqCcx3Ue62H2GIyTmAPLyOGkcel4dx57tU/4kQqaIFxdKDtY= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=nzrmqVnG; arc=fail smtp.client-ip=52.101.62.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="nzrmqVnG" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=D9sEt7f/p8Wbgv4lgZy+lkKu403k15gvLsCT0Np10ogorVPuHXPaEDo0ED69fYWLn5oygXOIFq4Gc1QBeNRE5ZBPQ86NYvoYiM066AfZs3uVREwLUVZidvXPLeXITYXKux7Qajzw/+EjuGtlsrdPDB/Hk71i+0+lAerjaLY0cliBmvSficktuSOOLNoELCK+LFqQFlfJ4lRI25e3rKtvKvze26S+9e50R4cWQggC2l+wBzE0+B3FGoZ7Gz+ixWseddAMdQy/wVUlCmQNEBLy+90oxCMCuav2Hhnmk04giRM3GjUgB1eggFw2Afq8+OLIu4J4vqmfrx8oevdbh8tDjg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=iNSZKl+BLCp9hJ2K3pSkvo2oJbNQ3+Kaj3aeUNoBIqc=; b=ksAc4mEu4ZPZVBo/tnMvWE0NslmcegkpxPVNbPp6ON4ck/Mc/TOSOq5yp3rs8XKYJkcorZHdiS+VFnDySsZgKq7e7a6LclyiqjYvtldb4AWjzMbLGMtYDTe6qcdiwas//AZ50zhhDnAx7gLTd2Zb76inne5PZQ8/axNZeODKhdURDIMUZw6tS0QiHi+hJqK/Y6e1jUfZy+emISY1PijR+GJigQSaK6oQ6sIZNtq6FHWKThdQvLHZpCyeYZqA4Xdsry/kFHMYZUbiydvzbWyJbH98fWYyumppvFyQCfTw8Wrs1PqjS0OOlOga8k+XrrXP15ekNF3aFsAjgSbz8H323A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=iNSZKl+BLCp9hJ2K3pSkvo2oJbNQ3+Kaj3aeUNoBIqc=; b=nzrmqVnGKZ/e638kr1NEj2nes0bUzPdI1TRH0QFPpLsBtskolN6xCG9+i4B7324BtiftsBDbV0beoaEt93RHr4VyJIvmgpqw4sodOl1IMpeRQF40ewEYYfLsrl+rBs9/IBVLudru3wMXf0y+vQPdwRqC2kWHiEkI0lslH6WowS7SRZ7/r65mZ2DefoOYHs2jSsO+GERRBJyesVfh9apeMvA3HfJZxgiDeoblA8823BBcaYUUIfPP8sDYHEwccirCtRZEUtcMbgQInXO90LUF3WG2ByrPaJEpHvQI2rmA6YiD9Gvs+Ok2cZtBxS3YGJxnbCqwQcpyEra9svj6aqXpdg== Received: from BN8PR04CA0062.namprd04.prod.outlook.com (2603:10b6:408:d4::36) by PH8PR12MB7206.namprd12.prod.outlook.com (2603:10b6:510:226::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.14; Tue, 8 Sep 2026 06:55:02 +0000 Received: from BN7PEPF000000AB.namprd05.prod.outlook.com (2603:10b6:408:d4:cafe::7e) by BN8PR04CA0062.outlook.office365.com (2603:10b6:408:d4::36) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.406.7 via Frontend Transport; Tue, 8 Sep 2026 06:55:02 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by BN7PEPF000000AB.mail.protection.outlook.com (10.167.245.235) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Tue, 8 Sep 2026 06:55:02 +0000 Received: from rnnvmail203.nvidia.com (10.129.68.9) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:54:48 -0700 Received: from rnnvmail203.nvidia.com (10.129.68.9) by rnnvmail203.nvidia.com (10.129.68.9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:54:48 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.9) with Microsoft SMTP Server id 15.2.2562.46 via Frontend Transport; Mon, 7 Sep 2026 23:54:40 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Bobby Eshleman , Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Doruk Tan Ozturk , Dragos Tatulea , Gal Pressman , Jianbo Liu , Kees Cook , Leon Romanovsky , open list , , , Mark Bloch , Petr Machata , Raed Salem , Rahul Rameshbabu , Saeed Mahameed , Shuah Khan , Shuah Khan , Simon Horman , Tariq Toukan , Willem de Bruijn , Willem de Bruijn Subject: [PATCH net-next V4 11/14] net/mlx5e: psp: Dynamically reconfigure based on SHAMPO mode Date: Tue, 8 Sep 2026 09:52:41 +0300 Message-ID: <20260908065244.3799142-12-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260908065244.3799142-1-tariqt@nvidia.com> References: <20260908065244.3799142-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PEPF000000AB:EE_|PH8PR12MB7206:EE_ X-MS-Office365-Filtering-Correlation-Id: aa2693ec-9d01-4585-a719-08df0d761b7c X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|36860700016|7416014|82310400026|1800799024|376014|10067099003|18002099003|22082099003|11063799006|56012099006; X-Microsoft-Antispam-Message-Info: LB9RMwsa9Gx2TGAn0YjYC6SV0zGhvAzUsJhm6LsQuiHw2wd0+KiVF6vpl8XRNwTGgR6+M3RJnzDd+oBWCqXacQe2t0yHDZxN1J53GJcqjISazgBD8UE50AQygVE1F8JFXqvA5zkAF39PpFyJcUxEB8JNz/Mj3HJPiiQhudZMxHwKSSp6vgvgwS011byKLU9nW3uPTTD5RkKQorbDtqON2IgO0fbI4l51T23BpIhl07lKUkfRvmhYSIsuOI9X2EnVj5c675yZohZ7/hCdn/PtiBrYoGmlJJuyG2sobjCWBsU6vOyzw2fSeiu9vZSra+9yzkYv7VDkrMNX6fzg+6xp0kH47tfmUfkdvhe9mOc7AMDLPylf6fCIToihR0n/Pnea0e3TfyopluaPVa8DM7EFQ+6wbpKggkpu891ts4NQcC3voGPkDNJ2ffX9h/iGkT4ibfvIgI8EHw6SAdvSc7HGQcgvKtmYBDOxgaK7dX3LGQu2oS0s4dmgTjD7JCtmk8LdniVJ7mG+S7F+jJfuRBJncvIJpq4VRtNMjgDHjJj6HyiSqwUhPyFos2YkkE+zueYcrtJxDvAQ+O0pTnvGhKjHyYzvVSguXZ5KANRiDV35QGHpXnJddk5JJrdgMILTY3y8BGXut5T6DleSXcYTip45WvVs6GyRq5VVeEzvo1jj8UwbkatJGDBYdTbmV9MPYk5nMDK4P4O68f1ugs7M7195jA== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(23010399003)(36860700016)(7416014)(82310400026)(1800799024)(376014)(10067099003)(18002099003)(22082099003)(11063799006)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: PQRZ36m0LiuxhOHDUX2B1RX4z1Q9GplYHWLdck4+Xpb//muol/JuHVSeizfy10r/8ULYcJ/Z+FHOn+cOOtyY2nUgecsYIIfadKPxEM0IEmxyFCbmVsbKhSEgbRq4A4GNjUhuPmoxfpAqa17XmT6kfx6afRteG++uOVtsrjpbDm+qTyaPf5ymvkmiacvZ2w5Fb2BAnYuvJtgbSJL7GbgMayF1TPFfZ2+CpFQ/EOGV8Ygk+0dhTDQ3awIj3ppk3nA7ge3sFq59qjDMw/ZhxTI+DAt+Z2ygXMoVj5KAE5usp6UfrtINomx0Dwi8uTCSRrR5A+XG50q/rnWEsuxzPVHJD4iJyOIq1oykU6xJh/wQ0UwuPoZlFCY+3QDLIj7R3ABdJZnljxizZuWkhNE+lJ3n0pqhBR6+yckK+0+WAxwlpYl02qsfZIwb0MV1K0VbdzD4 X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2026 06:55:02.6363 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: aa2693ec-9d01-4585-a719-08df0d761b7c X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BN7PEPF000000AB.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH8PR12MB7206 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu Add an mlx5e_update_nic_rx() -> mlx5e_psp_update_rx() hook. This allows PSP steering to reconfigure when netdev features change. When this signal is received, toggle PSP between standard and decap modes when SHAMPO mode changes, optionally creating the decap steering table. The toggling of traffic is atomic (a single steering rule update), so no packets should get eaten/lost. It is probable though that the rxhash will change, and decapsulated packets will be received by a different core than before. Established PSP connections receiving traffic might experience reordering/retransmits as a result. Also enable decap when configuring the device if the mode indicates it. Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan --- .../mellanox/mlx5/core/en_accel/en_accel.h | 5 ++++ .../mellanox/mlx5/core/en_accel/psp.c | 23 +++++++++++++++++-- .../mellanox/mlx5/core/en_accel/psp.h | 2 ++ .../net/ethernet/mellanox/mlx5/core/en_main.c | 10 +++++++- 4 files changed, 37 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h b/= drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h index 8a2ea7616440..98709d48b801 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/en_accel.h @@ -251,6 +251,11 @@ static inline void mlx5e_accel_cleanup_rx(struct mlx5e= _priv *priv) mlx5_accel_psp_fs_cleanup_rx_tables(priv); } =20 +static inline void mlx5e_accel_update_rx(struct mlx5e_priv *priv) +{ + mlx5e_psp_update_rx(priv); +} + static inline int mlx5e_accel_init_tx(struct mlx5e_priv *priv) { return mlx5e_ktls_init_tx(priv); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c b/drive= rs/net/ethernet/mellanox/mlx5/core/en_accel/psp.c index 84133cbf8689..c40d2ddf6af2 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.c @@ -92,6 +92,12 @@ struct mlx5e_psp_fs { struct mlx5e_psp_rx_table rx; }; =20 +static bool shampo_enabled(struct mlx5e_priv *priv) +{ + return priv->channels.params.packet_merge.type =3D=3D + MLX5E_PACKET_MERGE_SHAMPO; +} + /* PSP RX flow steering */ static enum mlx5_traffic_types fs_psp2tt(enum accel_fs_psp_type i) { @@ -767,6 +773,7 @@ static void accel_psp_fs_rx_destroy(struct mlx5e_psp_fs= *fs) } =20 static int accel_psp_fs_rx_create(struct mlx5e_psp_fs *fs, + bool decap_enable, struct netlink_ext_ack *extack) { struct mlx5_ttc_table *ttc =3D mlx5e_fs_get_ttc(fs->fs, false); @@ -808,7 +815,7 @@ static int accel_psp_fs_rx_create(struct mlx5e_psp_fs *= fs, mlx5_ttc_fwd_dest(ttc, fs_psp2tt(i), &dest); } =20 - accel_psp_fs_rx_reconfigure(fs, false); + accel_psp_fs_rx_reconfigure(fs, decap_enable); =20 return 0; =20 @@ -1078,7 +1085,8 @@ static int accel_psp_fs_create(struct mlx5e_priv *pri= v, { int err; =20 - err =3D accel_psp_fs_rx_create(priv->psp->fs, extack); + err =3D accel_psp_fs_rx_create(priv->psp->fs, shampo_enabled(priv), + extack); if (err) return err; =20 @@ -1355,3 +1363,14 @@ void mlx5e_psp_cleanup(struct mlx5e_priv *priv) priv->psp =3D NULL; kfree(psp); } + +void mlx5e_psp_update_rx(struct mlx5e_priv *priv) +{ + struct mlx5e_psp *psp =3D priv->psp; + + netdev_assert_locked(priv->netdev); + if (!psp || !psp->fs->check.ft) + return; + + accel_psp_fs_rx_reconfigure(psp->fs, shampo_enabled(priv)); +} diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.h b/drive= rs/net/ethernet/mellanox/mlx5/core/en_accel/psp.h index 3f441e7dd55a..43571a039ea6 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/psp.h @@ -49,6 +49,7 @@ int mlx5e_psp_register(struct mlx5e_priv *priv); void mlx5e_psp_unregister(struct mlx5e_priv *priv); int mlx5e_psp_init(struct mlx5e_priv *priv); void mlx5e_psp_cleanup(struct mlx5e_priv *priv); +void mlx5e_psp_update_rx(struct mlx5e_priv *priv); #else static inline void mlx5_accel_psp_fs_cleanup_rx_tables(struct mlx5e_priv *= priv) { } static inline void mlx5_accel_psp_fs_cleanup_tx_tables(struct mlx5e_priv *= priv) { } @@ -61,5 +62,6 @@ static inline int mlx5e_psp_register(struct mlx5e_priv *p= riv) { return 0; } static inline void mlx5e_psp_unregister(struct mlx5e_priv *priv) { } static inline int mlx5e_psp_init(struct mlx5e_priv *priv) { return 0; } static inline void mlx5e_psp_cleanup(struct mlx5e_priv *priv) { } +static inline void mlx5e_psp_update_rx(struct mlx5e_priv *priv) { } #endif /* CONFIG_MLX5_EN_PSP */ #endif /* __MLX5E_ACCEL_PSP_H__ */ diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/ne= t/ethernet/mellanox/mlx5/core/en_main.c index fc110a7d16e8..b5449d849838 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c @@ -6288,7 +6288,15 @@ static void mlx5e_nic_disable(struct mlx5e_priv *pri= v) =20 static int mlx5e_update_nic_rx(struct mlx5e_priv *priv) { - return mlx5e_refresh_tirs(priv->mdev, false, false); + int err; + + err =3D mlx5e_refresh_tirs(priv->mdev, false, false); + if (err) + return err; + + mlx5e_accel_update_rx(priv); + + return 0; } =20 static const struct mlx5e_profile mlx5e_nic_profile =3D { --=20 2.44.0 From nobody Fri Sep 25 22:19:10 2026 Received: from CH4PR04CU002.outbound.protection.outlook.com (mail-northcentralusazon11013049.outbound.protection.outlook.com [40.107.201.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 13F5F38DC64; Tue, 8 Sep 2026 06:55:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.201.49 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850521; cv=fail; b=IgWzeVgqddn9cqOX0eJl9YfjPq61KSRvH8Jkv1hdPAf3JLFeVH42HbtsY7n9mfVLJ/3PrKpSiDDv79qOzj1INI8LY/qI1vOfmpr858obAhJ+uKGrH2kB72DVJlHFK0d0H5KtX6WqQhpIY1Xp6Pq5ss1ENbREbYbemhBUMRw1ha0= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850521; c=relaxed/simple; bh=//XTi84jj8Qk/LFagutunU7kh5JOdVQ+pKUMU5hBUGI=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=W6rHPS63yPrt2wVQLN8wQhu3cdWHtuRHOPj0DAdM8Z2O65AeoPePQap0P65dnmPhbjxKeIOnVvh1yhonJ7Y5PjhezyF6mKHs3Sjt6idwQoDKn4rT43zx68LERRqz4aM1oayRUqBDSxK3qqeH4Xv72bRO3ECSB5DJZ2vlnN7iSQo= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=RyqO0WXk; arc=fail smtp.client-ip=40.107.201.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="RyqO0WXk" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=PhC0MYGE/I87gIFgjsV9UtPk1JzmoVGf2BOMwOI5XJnKQVaFOaod/QUPVGyBbfOKik+gL4kCUujUGryWO9Kx5WVFooPEL1GYbqOA8S3YduE4RG69l8o35wqpuRhfW/mWJG075ZwXyGZ9jFXieRE5bWgi0E05hZQ//xTFH/ttwaoLBd90JvjUa6mETaaEvq3lDfu02WHS2UDYbFffyqTiHUAfsjmvflNoV5XbBVjP3JygOF0kBmJdpWDPyPukHb6/JkGhEXGoGTWF62TP/c25KikxZ+m/EBvL3zIHJkeG00LP6eQKyc1OA78MKiWBCZilczhjrmlmoswnSQOEM24TTA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=UZnhXXFCkGDujobVeixBCUOTW7Zd1VeEGHLjX9fsERc=; b=xebyzkgAP/OHMAmRIclS/sJa94djPRNJY0M7XFAbMWasoWjI6/ZuyFEypmwJmzXyUTyfVVan+p1YhPzN5u3Pv3w4JR4ZmLcrzUhQdPJ7vlCYmDVwD6lhAI7OYaR06tXSssY1RprjF5MS3CA7baGVcTPLzk5qNyHLlabESAsNeF1+3a+5Fzd0yTfFBWW4x9p+dvGAeDsx+h2J8yDgkKWDv+3UshYaRgaoMvJ3l5WCfvCRyujSyZXNxW7W1yQll4fVbEWZqvmVC/OgcBH+l3q1dOwkwfQYzetLRE6tDBtB4fmKRI3K/eMVSAS8v64pV23a9Xqp31LTgo56qJJCtnWI4A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UZnhXXFCkGDujobVeixBCUOTW7Zd1VeEGHLjX9fsERc=; b=RyqO0WXkKP2Og5xb7fl0uyYP49IeHWKq+SqjRsfju95J/3gGadHnUFISplo/EEf9pBaNYn7u413zL6kPGgi0h36oPTL261JJaaCG7IJTlp3iJcjNSSGJ4Q7wdC2hn1nbuuell+i4V8L24EBuBCdLrUrKETHpZTQDDTm6haw9RGgr7wEISobxlW5eVJ/K90mM/ZqWpp4UxQadUVlewoML60I3ni5U+BPM559TtfR/bi/mduyDzhHwlcqAKrlfNy2h1IzeNQ36InQPrPVKA/Ze7EpbeskvkJzbiLLHccSnKl/9v4IOjDq2rLYj/FPWyFmpXKnIdu1EzZXDlZg2vxNDig== Received: from BN9PR03CA0437.namprd03.prod.outlook.com (2603:10b6:408:113::22) by SJ2PR12MB8737.namprd12.prod.outlook.com (2603:10b6:a03:545::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.7; Tue, 8 Sep 2026 06:55:13 +0000 Received: from BN1PEPF0000468E.namprd05.prod.outlook.com (2603:10b6:408:113:cafe::1a) by BN9PR03CA0437.outlook.office365.com (2603:10b6:408:113::22) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.15 via Frontend Transport; Tue, 8 Sep 2026 06:55:12 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by BN1PEPF0000468E.mail.protection.outlook.com (10.167.243.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Tue, 8 Sep 2026 06:55:12 +0000 Received: from rnnvmail203.nvidia.com (10.129.68.9) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:54:56 -0700 Received: from rnnvmail203.nvidia.com (10.129.68.9) by rnnvmail203.nvidia.com (10.129.68.9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:54:56 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.9) with Microsoft SMTP Server id 15.2.2562.46 via Frontend Transport; Mon, 7 Sep 2026 23:54:48 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Bobby Eshleman , Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Doruk Tan Ozturk , Dragos Tatulea , Gal Pressman , Jianbo Liu , Kees Cook , Leon Romanovsky , open list , , , Mark Bloch , Petr Machata , Raed Salem , Rahul Rameshbabu , Saeed Mahameed , Shuah Khan , Shuah Khan , Simon Horman , Tariq Toukan , Willem de Bruijn , Willem de Bruijn Subject: [PATCH net-next V4 12/14] selftests: drv-net: psp: Extract shared helpers into psp_lib.py Date: Tue, 8 Sep 2026 09:52:42 +0300 Message-ID: <20260908065244.3799142-13-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260908065244.3799142-1-tariqt@nvidia.com> References: <20260908065244.3799142-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN1PEPF0000468E:EE_|SJ2PR12MB8737:EE_ X-MS-Office365-Filtering-Correlation-Id: 0ed02a7e-288b-4761-a639-08df0d762166 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|82310400026|1800799024|376014|7416014|36860700016|6133799003|11063799006|5023799004|56012099006|10067099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: i43m891qHpnecrYk5myFhYlaRcBDReuROMpNQ9ZL3KkxDOEG3E93Bx8IaX3fhAEfHdP32X5OaZOIxbx1+aOTgQL/8nYgTmgxOkMAZFJ5R2B4gI1Ek1KFY2OQZvuNk477FCtKqh3TQFfrfIjNyMrINFe49C2qkSF3TehMktCFEtcCSPUV7UbmONDxc1ROkuvGcW9jIzlGGevu/QXhSQ8/S9Wzn7Sf/aQ41V/r/OzP8uisOPMbCl+efPADzxpzfh75k6vdMj9rE1JFYxVQLuIKHkWlFR1RvA/8BDdKI6l5Dd+ny0FnkK3lURzfy8+x2fVTVERm7qCH2G7NtbWAOS5Z6+D6t6c9G7Imc5XIgkV7nA98alzCZxQImMZ/LQI+bU4zVqh1BBEt6e1XaqY/n2jStN7qg3Mi/xClr9yrkHSC6zcATbMztXG24t73CQjGbxP0/MzfafG9+BW8dUGt61iuhnguAcOaCd0ukWe6pmeti5YiKcaXY0eQHla6avciC8uyOIeVz+wCG/ZyArcoW8WooEcA3BaLccw8jq9I+fxqK7oEgS+WGO5h2rL0Q7Hg+dA/qC3L9GoZ7QBBU0fdG34xgxFRvvL6MJ1QU+ZE3QgqQHIN/xPNbBE6QU6aeWuTqFm/6EW/Q2e+29tkc/UCo6Se5LKqSh/Wng/nZQd8K57cugMrH1niVSlQ2yt4O3Koyx3nM0DzW6yKTOZkWToAre2mbA== X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(23010399003)(82310400026)(1800799024)(376014)(7416014)(36860700016)(6133799003)(11063799006)(5023799004)(56012099006)(10067099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 1zA1Q4s0dPPD7XlPFDuXMPZoTnHe23S7tocsA598sC2bOGdfNoowhTa8D70sNvstZVY6+8IjJShpEsK7kmsz4oI+8o97Y1gpo1mDtCGQipYCgaQsgjZSPnFKvBdjwdu25no3QdMzotys2DSqtPBCuLMOb9n2FAcrllB2XIACHwMMB8EWcXfGlOBRcNIeDrRRgaN+Z8mGACaksJl9VeecA9EtxmRHoSXsTfdKTHXi4emLw3WPmzoKxIwTyLZbsTJyfjicc9IYhyzIXddZ0ieYgi1QdvA9STI2PI+aVfiMeIfU7IW7y7QC3ub9+D8yrUXx70ByLViuu9S+9tAD9ZsUTWkX22J8f/3bdK9x82egN06YENwrgZNfcGH+bIzildxFNNBiyBuJryscJoA+UVDRofvbDPIEDDtFI/RxlOsAcajneND9q59zUiE/wAm0FAzP X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2026 06:55:12.5649 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 0ed02a7e-288b-4761-a639-08df0d762166 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BN1PEPF0000468E.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR12MB8737 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu Put init_psp_dev() and the logic for requiring a psp version into a shared lib, since they will soon be used by a second test file. No functional change for psp.py. Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Daniel Zahka --- tools/testing/selftests/drivers/net/Makefile | 1 + tools/testing/selftests/drivers/net/psp.py | 77 ++++++------------- .../testing/selftests/drivers/net/psp_lib.py | 57 ++++++++++++++ 3 files changed, 82 insertions(+), 53 deletions(-) create mode 100644 tools/testing/selftests/drivers/net/psp_lib.py diff --git a/tools/testing/selftests/drivers/net/Makefile b/tools/testing/s= elftests/drivers/net/Makefile index 1f21e17d8c22..8cea66fa323c 100644 --- a/tools/testing/selftests/drivers/net/Makefile +++ b/tools/testing/selftests/drivers/net/Makefile @@ -32,6 +32,7 @@ TEST_PROGS :=3D \ =20 TEST_FILES :=3D \ gro_lib.py \ + psp_lib.py \ # end of TEST_FILES =20 # YNL files, must be before "include ..lib.mk" diff --git a/tools/testing/selftests/drivers/net/psp.py b/tools/testing/sel= ftests/drivers/net/psp.py index 315648a770d0..47983fb8c7c2 100755 --- a/tools/testing/selftests/drivers/net/psp.py +++ b/tools/testing/selftests/drivers/net/psp.py @@ -11,6 +11,8 @@ import struct import termios import time =20 +from psp_lib import init_psp_dev, require_version + from lib.py import defer from lib.py import ksft_run, ksft_exit, ksft_pr from lib.py import ksft_true, ksft_eq, ksft_ne, ksft_gt, ksft_raises @@ -122,34 +124,13 @@ def _get_stat(cfg, key): # Test case boiler plate # =20 -def _init_psp_dev(cfg, use_psp_ifindex=3DFalse): - if not hasattr(cfg, 'psp_dev_id'): - # Figure out which local device we are testing against - # For NetDrvContEnv: use psp_ifindex instead of ifindex - target_ifindex =3D cfg.psp_ifindex if use_psp_ifindex else cfg.ifi= ndex - for dev in cfg.pspnl.dev_get({}, dump=3DTrue): - if dev['ifindex'] =3D=3D target_ifindex: - cfg.psp_info =3D dev - cfg.psp_dev_id =3D cfg.psp_info['id'] - break - else: - raise KsftSkipEx("No PSP devices found") - - # Enable PSP if necessary - cap =3D cfg.psp_info['psp-versions-cap'] - ena =3D cfg.psp_info['psp-versions-ena'] - if cap !=3D ena: - cfg.pspnl.dev_set({'id': cfg.psp_dev_id, 'psp-versions-ena': cap}) - defer(cfg.pspnl.dev_set, {'id': cfg.psp_dev_id, - 'psp-versions-ena': ena }) - # # Test cases # =20 def dev_list_devices(cfg): """ Dump all devices """ - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 devices =3D cfg.pspnl.dev_get({}, dump=3DTrue) =20 @@ -161,7 +142,7 @@ def dev_list_devices(cfg): =20 def dev_get_device(cfg): """ Get the device we intend to use """ - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 dev =3D cfg.pspnl.dev_get({'id': cfg.psp_dev_id}) ksft_eq(dev['id'], cfg.psp_dev_id) @@ -180,7 +161,7 @@ def dev_get_device_bad(cfg): =20 def dev_rotate(cfg): """ Test key rotation """ - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 prev_rotations =3D _get_stat(cfg, 'key-rotations') =20 @@ -195,7 +176,7 @@ def dev_rotate(cfg): =20 def dev_rotate_spi(cfg): """ Test key rotation and SPI check """ - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 top_a =3D top_b =3D 0 with socket.socket(socket.AF_INET6, socket.SOCK_STREAM) as s: @@ -217,7 +198,7 @@ def dev_rotate_spi(cfg): =20 def assoc_basic(cfg): """ Test creating associations """ - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 with socket.socket(socket.AF_INET6, socket.SOCK_STREAM) as s: assoc =3D cfg.pspnl.rx_assoc({"version": 0, @@ -237,7 +218,7 @@ def assoc_basic(cfg): =20 def assoc_bad_dev(cfg): """ Test creating associations with bad device ID """ - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 with socket.socket(socket.AF_INET6, socket.SOCK_STREAM) as s: with ksft_raises(NlError) as cm: @@ -249,7 +230,7 @@ def assoc_bad_dev(cfg): =20 def assoc_sk_only_conn(cfg): """ Test creating associations based on socket """ - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 with _make_clr_conn(cfg) as s: assoc =3D cfg.pspnl.rx_assoc({"version": 0, @@ -263,7 +244,7 @@ def assoc_sk_only_conn(cfg): =20 def assoc_sk_only_mismatch(cfg): """ Test creating associations based on socket (dev mismatch) """ - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 with _make_clr_conn(cfg) as s: with ksft_raises(NlError) as cm: @@ -278,7 +259,7 @@ def assoc_sk_only_mismatch(cfg): =20 def assoc_sk_only_mismatch_tx(cfg): """ Test creating associations based on socket (dev mismatch) """ - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 with _make_clr_conn(cfg) as s: with ksft_raises(NlError) as cm: @@ -296,7 +277,7 @@ def assoc_sk_only_mismatch_tx(cfg): =20 def assoc_sk_only_unconn(cfg): """ Test creating associations based on socket (unconnected, should fa= il) """ - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 with socket.socket(socket.AF_INET6, socket.SOCK_STREAM) as s: with ksft_raises(NlError) as cm: @@ -309,7 +290,7 @@ def assoc_sk_only_unconn(cfg): =20 def assoc_version_mismatch(cfg): """ Test creating associations where Rx and Tx PSP versions do not mat= ch """ - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 versions =3D list(cfg.psp_info['psp-versions-cap']) if len(versions) < 2: @@ -335,7 +316,7 @@ def assoc_version_mismatch(cfg): =20 def assoc_twice(cfg): """ Test reusing Tx assoc for two sockets """ - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 def rx_assoc_check(s): assoc =3D cfg.pspnl.rx_assoc({"version": 0, @@ -369,19 +350,9 @@ def assoc_twice(cfg): =20 def _data_basic_send(cfg, version, ipver): """ Test basic data send """ - _init_psp_dev(cfg) - - # Version 0 is required by spec, don't let it skip - if version: - name =3D cfg.pspnl.consts["version"].entries_by_val[version].name - if name not in cfg.psp_info['psp-versions-cap']: - with socket.socket(socket.AF_INET6, socket.SOCK_STREAM) as s: - with ksft_raises(NlError) as cm: - cfg.pspnl.rx_assoc({"version": version, - "dev-id": cfg.psp_dev_id, - "sock-fd": s.fileno()}) - ksft_eq(cm.exception.nl_msg.error, -errno.EOPNOTSUPP) - raise KsftSkipEx("PSP version not supported", name) + init_psp_dev(cfg) + + require_version(cfg, version) =20 s =3D _make_psp_conn(cfg, version, ipver) =20 @@ -418,7 +389,7 @@ def __bad_xfer_do(cfg, s, tx, version=3D'hdr0-aes-gcm-1= 28'): =20 def data_send_bad_key(cfg): """ Test send data with bad key """ - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 s =3D _make_psp_conn(cfg) =20 @@ -433,7 +404,7 @@ def data_send_bad_key(cfg): =20 def data_send_disconnect(cfg): """ Test socket close after sending data """ - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 with _make_psp_conn(cfg) as s: assoc =3D cfg.pspnl.rx_assoc({"version": 0, @@ -451,7 +422,7 @@ def data_send_disconnect(cfg): =20 =20 def _data_mss_adjust(cfg, ipver): - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 # First figure out what the MSS would be without any adjustments s =3D _make_clr_conn(cfg, ipver) @@ -491,7 +462,7 @@ def _data_mss_adjust(cfg, ipver): =20 def data_stale_key(cfg): """ Test send on a double-rotated key """ - _init_psp_dev(cfg) + init_psp_dev(cfg) =20 prev_stale =3D _get_stat(cfg, 'stale-events') s =3D _make_psp_conn(cfg) @@ -766,7 +737,7 @@ def _psp_dev_get_check_netkit_psp_assoc(cfg): =20 def _dev_assoc_no_nsid(cfg): """ Test dev-assoc and dev-disassoc without nsid attribute """ - _init_psp_dev(cfg, True) + init_psp_dev(cfg, True) =20 # Associate without nsid - should look up ifindex in caller's netns cfg.pspnl.dev_assoc({'id': cfg.psp_dev_id, @@ -800,7 +771,7 @@ def _psp_dev_assoc_cleanup_on_netkit_del(cfg): Creates a disposable netkit pair for this test to avoid destroying the shared environment. """ - _init_psp_dev(cfg, True) + init_psp_dev(cfg, True) defer(delattr, cfg, 'psp_dev_id') defer(delattr, cfg, 'psp_info') =20 @@ -877,7 +848,7 @@ def _try_disassoc(cfg, psp_dev_id, ifindex, nsid=3DNone= ): =20 def _assoc_nk_guest(cfg): """Associate nk_guest with PSP device and register cleanup via defer()= .""" - _init_psp_dev(cfg, True) + init_psp_dev(cfg, True) =20 cfg.pspnl.dev_assoc({'id': cfg.psp_dev_id, 'ifindex': cfg.nk_guest_ifindex, diff --git a/tools/testing/selftests/drivers/net/psp_lib.py b/tools/testing= /selftests/drivers/net/psp_lib.py new file mode 100644 index 000000000000..d450db81cfc2 --- /dev/null +++ b/tools/testing/selftests/drivers/net/psp_lib.py @@ -0,0 +1,57 @@ +# SPDX-License-Identifier: GPL-2.0 + +"""Shared helpers for the PSP selftests.""" + +import errno +import socket + +from lib.py import defer +from lib.py import ksft_eq, ksft_raises +from lib.py import KsftSkipEx +from lib.py import NlError + + +def require_version(cfg, version): + """Skip unless the device supports a PSP version. + + Version 0 is required by the spec, so it never skips. Before + skipping, check that the kernel rejects the unsupported version + properly - this is the only coverage that path gets. + """ + if not version: + return + + name =3D cfg.pspnl.consts["version"].entries_by_val[version].name + if name in cfg.psp_info['psp-versions-cap']: + return + + with socket.socket(socket.AF_INET6, socket.SOCK_STREAM) as s: + with ksft_raises(NlError) as cm: + cfg.pspnl.rx_assoc({"version": version, + "dev-id": cfg.psp_dev_id, + "sock-fd": s.fileno()}) + ksft_eq(cm.exception.nl_msg.error, -errno.EOPNOTSUPP) + raise KsftSkipEx("PSP version not supported", name) + + +def init_psp_dev(cfg, use_psp_ifindex=3DFalse): + """Find the PSP device under test and enable all supported versions.""" + if not hasattr(cfg, 'psp_dev_id'): + # Figure out which local device we are testing against + # For NetDrvContEnv: use psp_ifindex instead of ifindex + target_ifindex =3D cfg.psp_ifindex if use_psp_ifindex else cfg.ifi= ndex + for dev in cfg.pspnl.dev_get({}, dump=3DTrue): + if dev['ifindex'] =3D=3D target_ifindex: + cfg.psp_info =3D dev + cfg.psp_dev_id =3D cfg.psp_info['id'] + break + else: + raise KsftSkipEx("No PSP devices found") + + # Enable PSP if necessary + cap =3D cfg.psp_info['psp-versions-cap'] + ena =3D cfg.psp_info['psp-versions-ena'] + if cap !=3D ena: + cfg.pspnl.dev_set({'id': cfg.psp_dev_id, 'psp-versions-ena': cap}) + defer(cfg.pspnl.dev_set, {'id': cfg.psp_dev_id, + 'psp-versions-ena': ena}) --=20 2.44.0 From nobody Fri Sep 25 22:19:10 2026 Received: from CO1PR03CU002.outbound.protection.outlook.com (mail-westus2azon11010005.outbound.protection.outlook.com [52.101.46.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 22346390224; Tue, 8 Sep 2026 06:55:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.46.5 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850531; cv=fail; b=se4sJAsdyz4TvjPFShds7BdE23+P6A0wXLDCzBMgjoF//ClK3qK7bw7hp3eQ3+aPzs+n9hs8WHFApUfsmuvdSK4DAiuzta9fQn1Hwk5/H1B4GYP7xCFlVBjKOJs6Ez06Q0QmJ5zi5d43P0ZHsVod+/GF7qxlEJ8aTAjgZTkEnaE= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850531; c=relaxed/simple; bh=CMyfEO/++CD4A88mduhgFwp/4Len/6V4ZTcUVjrBugs=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ml50KhOs2y+gk30S66oYKdIGZX9KiSli2c3BJI77yZ3NiO/H5oOYNaSANX74DsnpIxual0ObomWaQHl6d87m18td3OM6/slsEFk438QIZD46e8fILKkOIX4SgJYTo7F1mr7YAZIoQGIMA3Zj5VQV5e48HT3bOyL+zNKFLSvnUmM= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=glXXU5mi; arc=fail smtp.client-ip=52.101.46.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="glXXU5mi" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=oCJChLN5/YbhoE6oUYbEGL0OX2VL0tLUR2U9gBzoC/18dKDPE2d6nF1WfRG+VTw41IKOJQfQ0Bh9DRQWwVkF2nR9PeHom+awNAlY4JPTAcj4RnLyuyxxb+jpgxlR9vG9XJTVyaBMX2wsRrb7ZzDYDvUkJworisglW6EMoscNzKlKJkgPlap7lG/M4yNm5qqF6qZlRx7IbLsi3uNo+6auo2Ml9iDiVpbP5jEjnmb/Tm2iewNu1xWUy0eICYomrFlZ9LD6boL+9r48UhewyQbq7y38ob9ABDLBdD3TkqZsTf19Y2Odt6I6LhXTwOiPmyTX3EKwSICXaBVrjFlxnlWiAA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=QMn5gTgyF8d6SXWPoP5CQXPefkWyE1bxmUviSu1419A=; b=gPQn4CmrFBMwh7LUHQg+tbZeM9nweXaXNSaZsM/g+rCXN+kP2PbbAVgiQv7OB42r8+EH5VuFq96D5UHP0SPEjDtjkRGUhzibW6CwZ0ig58Cx8L79wKj9JKFMZTArhVgZwtXshoK8pJPFrOf0TOAIB/86POQOwof8NrIYpGcZwMFqOs9XiolnZvky+RiHoFXARPjQDo+TORj2DTJ39Qjk5ICCccPAkn22WStfm1avdcaufNDk1J0KOKl1hZFmM55Jm9lFk0TItXHVcF+OeRNV++OP7+hbJ9wbX4nLLHNUfj7sQ+sQCvIzcx2dwGHCunU7erq2sweGfAgLfM0U93f/6A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QMn5gTgyF8d6SXWPoP5CQXPefkWyE1bxmUviSu1419A=; b=glXXU5miMA8U4o47nrQyGhMPs8D8IPxbL9m6L9zNjeCe4l1nqp2ObEiR/jQVGXPaK0A8GxYj49xIXSTK7A/evAvFmqPtgxjRnaZBlYBmdm+b4SLjaZIsTc3IydDWsXAauKqI5MKdVrW69SLQr1mDL3JudN8GzdLCkdN6bWapGFuW3F1zf1uUqmenytLakHJ1fCVwKF6lIia3rX/xwx9VEIURom7Z1JGN4mphw3DpiC7G2ddH5arVwo47lZOUjm93BR0WShIDJldKhqj1IHJ3Rm4rHzF9QSwFJL6jnynYiJFli7laajWNQBwm5OqwTjmLwMQrtIAPgEGALlqrz+dU9w== Received: from BN0PR04CA0085.namprd04.prod.outlook.com (2603:10b6:408:ea::30) by SJ0PR12MB6830.namprd12.prod.outlook.com (2603:10b6:a03:47c::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Tue, 8 Sep 2026 06:55:21 +0000 Received: from BN7PEPF000000A6.namprd05.prod.outlook.com (2603:10b6:408:ea:cafe::a5) by BN0PR04CA0085.outlook.office365.com (2603:10b6:408:ea::30) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.15 via Frontend Transport; Tue, 8 Sep 2026 06:55:20 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by BN7PEPF000000A6.mail.protection.outlook.com (10.167.245.230) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Tue, 8 Sep 2026 06:55:20 +0000 Received: from rnnvmail204.nvidia.com (10.129.68.6) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:55:04 -0700 Received: from rnnvmail203.nvidia.com (10.129.68.9) by rnnvmail204.nvidia.com (10.129.68.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:55:04 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.9) with Microsoft SMTP Server id 15.2.2562.46 via Frontend Transport; Mon, 7 Sep 2026 23:54:56 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Bobby Eshleman , Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Doruk Tan Ozturk , Dragos Tatulea , Gal Pressman , Jianbo Liu , Kees Cook , Leon Romanovsky , open list , , , Mark Bloch , Petr Machata , Raed Salem , Rahul Rameshbabu , Saeed Mahameed , Shuah Khan , Shuah Khan , Simon Horman , Tariq Toukan , Willem de Bruijn , Willem de Bruijn Subject: [PATCH net-next V4 13/14] selftests: net: gro: Add PSP encapsulation and encryption Date: Tue, 8 Sep 2026 09:52:43 +0300 Message-ID: <20260908065244.3799142-14-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260908065244.3799142-1-tariqt@nvidia.com> References: <20260908065244.3799142-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PEPF000000A6:EE_|SJ0PR12MB6830:EE_ X-MS-Office365-Filtering-Correlation-Id: af0fe762-aa01-4fed-a38b-08df0d76262e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|1800799024|36860700016|7416014|376014|23010399003|6133799003|3023799007|10067099003|11063799006|56012099006|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: F/8/IjTB+ka1RzVGJf2zUVVt8gs55Q1jaxOWAuYrTPadq4xstPw6EzbjJpFvj3BpQN2aE5OZKTCw5P3JKVkVHoUJfy4E8fux1qj/5sbUGo1gfkPQ1aDudAPTZiFfgxUbb1MLKXQFdc9LKU/Yy5nRuJ+Xt1Zm+kxxQ8Cnk7dSdmdt2Fduw2nEonPpklZW+9fqYHTIJEfEX3+UghcvEDgnp7CPG2PBlSdt4jzMXQlvdl7e+7AIs4VuLl9wo/Kpn7BXxxH8F/2DVrkIc6L/jV1epGRmYXq7sayvx46eD3SH0mE9K+PxnFHd1xVsg1RUCFH/Bxn80OZohKSf23ShI4TKOR4qN+v0Ub+KiexmmA5VlCQDvyXs5HavuEB8CaKf0/V0DswXYMnPJ29/Sl/C3NT6uWstrMwpOKYYZKJY+GrpXG6ZzfTJfysw+qjtOS0+EO+sGM9YfD+o2BgJrYjDiifL69oPYNiQOeUBGeyJhTQrdXqKZMXsoUi9CAI0Urdd4oI+D6MFipTFAvZX6LkKeTaESNceEH9HrsY6rjaXeUAezr7XBf2qhI+HwmEeWqrOGk56jZA+3FqB/2Je+d+xZ/L66cqODrxNkqh1pMUUZXqVKsHzr0e5WQUMBljVL0cVXH1baMql5/tTNYAw3qwNNKqqiwPEwKd36RmrzCHT7lgVcKHPYo0Ee+S7b5SPwJa8HJ7j9WSLrOMkXyR/KpXkvRe1ag== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(1800799024)(36860700016)(7416014)(376014)(23010399003)(6133799003)(3023799007)(10067099003)(11063799006)(56012099006)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Ov3lkt2xX6iGmsdXHPeFpq6sMUj7fG1bSX4hFKgJ6Dm12yDo2yoWAiOnwAoKXy2WmaoG1DwzuCZkXk+/AwuLEHmb70T7F8kKXZlK2PnM3xPUbpT1l/mh6qXHm6tmoapoK/njRYdFeEBtZkXZFA2DKg2qMSiptcOVr7mQSBuwwq3vHciDBUtzoGia+Fn1wYBKAaFELo5cVgTCMDYB67Rn0ltLrXP5KoyjH0NrN9p+JKboMhcWb8WR5THLLkObN3xRThoLHpqpAPl/63cL+DcohHgBHpbVqFnYqoZdau1XtGmr+jeGFzM18wOslxxSIsrVWAP/ATOJly2gwSQPCbcVw2i83Rr54BJ9V2JuzTlxIib9JT+SQHdp7UCHPcNoHmqJ2jVjKxOMbbzxIPIjNn6qetguqFN0T3F6WzxI2U5ZQnNT7E+7NkRMJxucT7+nq9Ac X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2026 06:55:20.6007 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: af0fe762-aa01-4fed-a38b-08df0d76262e X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BN7PEPF000000A6.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR12MB6830 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu Add a PSP mode which wraps every transmitted frame in PSP transport mode and encrypts them in SW with the help of OpenSSL. The receiving NIC decrypts and decapsulates, so the frames seen on the receiver on its AF_PACKET socket are identical to the non-PSP ones and every geometry assertion in this file applies unchanged. Sender packet construction is unchanged, PSP uses a different buffer to avoid double encryption. A few PSP-only cases are added: psp_spi_diff, psp_ver_diff, psp_mixed, to cover coalescing scenarios which only exist for PSP. OpenSSL is optional and scoped to this binary: gro is deployed by several suites, so a missing libcrypto costs only the PSP mode. Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Daniel Zahka --- tools/testing/selftests/net/lib/Makefile | 16 ++ tools/testing/selftests/net/lib/gro.c | 337 ++++++++++++++++++++++- 2 files changed, 351 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/net/lib/Makefile b/tools/testing/selft= ests/net/lib/Makefile index ff83603397d0..ce67e8d3e4f6 100644 --- a/tools/testing/selftests/net/lib/Makefile +++ b/tools/testing/selftests/net/lib/Makefile @@ -22,4 +22,20 @@ TEST_INCLUDES :=3D $(wildcard py/*.py sh/*.sh) =20 include ../../lib.mk =20 +# gro optionally needs OpenSSL for PSP. +PKG_CONFIG ?=3D pkg-config +LIBCRYPTO_CFLAGS :=3D $(shell $(PKG_CONFIG) --cflags libcrypto 2>/dev/null) +LIBCRYPTO_LIBS :=3D $(shell $(PKG_CONFIG) --libs libcrypto 2>/dev/null || \ + echo -lcrypto) +HAVE_OPENSSL :=3D $(shell echo 'int main(void) { return 0; }' | \ + $(CC) -x c - -include openssl/evp.h $(LIBCRYPTO_CFLAGS) \ + $(LIBCRYPTO_LIBS) -o /dev/null >/dev/null 2>&1 && echo 1) + +ifeq ($(HAVE_OPENSSL),1) +$(OUTPUT)/gro: CFLAGS +=3D -DHAVE_OPENSSL $(LIBCRYPTO_CFLAGS) +$(OUTPUT)/gro: LDLIBS +=3D $(LIBCRYPTO_LIBS) +else +$(warning libcrypto not found, gro will be built without PSP support) +endif + include ../bpf.mk diff --git a/tools/testing/selftests/net/lib/gro.c b/tools/testing/selftest= s/net/lib/gro.c index 7a333155de1a..fe4a4c0e17ae 100644 --- a/tools/testing/selftests/net/lib/gro.c +++ b/tools/testing/selftests/net/lib/gro.c @@ -64,6 +64,7 @@ #define _GNU_SOURCE =20 #include +#include #include #include #include @@ -79,14 +80,22 @@ #include #include #include +#include #include #include #include #include +#include #include #include #include =20 +#include + +#ifdef HAVE_OPENSSL +#include +#endif + #include "kselftest.h" #include "ksft.h" =20 @@ -110,6 +119,38 @@ =20 #define EXIT_OVER_COALESCE 42 =20 +/* PSP transport mode encapsulation, as built by the sender: + * + * [eth][IP][UDP dport=3D1000][PSP hdr][encrypted L4][ICV] + * + * Can't use the kernel-only include/net/psp/types.h header, so copy the + * encoding here. + */ +struct psphdr { + uint8_t nexthdr; + uint8_t hdrlen; + uint8_t crypt_offset; + uint8_t verfl; + uint32_t spi; /* big endian */ + uint64_t iv; /* big endian */ +} __packed; + +#define PSP_UDP_PORT 1000 +#define PSP_UDP_LEN sizeof(struct udphdr) +#define PSP_HDR_LEN sizeof(struct psphdr) +#define PSP_ICV_LEN 16 +/* total frame growth: the inserted headers plus the trailing ICV */ +#define PSP_ENCAP_LEN (PSP_UDP_LEN + PSP_HDR_LEN + PSP_ICV_LEN) +#define PSP_HDRLEN_NOOPT 1 /* (1 + 1) * 8 =3D=3D PSP_HDR_LEN */ +#define PSP_VERFL_ONE 0x01 +#define PSP_VERFL_VER_SHIFT 2 +#define PSP_MAX_ASSOC 2 +#define PSP_KEY_LEN_MAX 32 + +enum { + OPT_PSP_ASSOC =3D 256, +}; + #define ipv6_optlen(p) (((p)->hdrlen+1) << 3) /* calculate IPv6 extension= header len */ #define BUILD_BUG_ON(condition) ((void)sizeof(char[1 - 2*!!(condition)])) =20 @@ -143,6 +184,9 @@ static bool pppoe; static uint64_t txtime_ns; static int num_flows =3D 4; static bool order_check; +static bool psp_enabled; +static int psp_idx; +static int psp_num_assoc; =20 #define CAPACITY_PAYLOAD_LEN 200 =20 @@ -158,7 +202,8 @@ static int max_payload(void) =20 static int calc_mss(void) { - return ASSUMED_MTU - (total_hdr_len - ETH_HLEN); + return ASSUMED_MTU - (total_hdr_len - ETH_HLEN) - + (psp_enabled ? PSP_ENCAP_LEN : 0); } =20 static int num_large_pkt(void) @@ -384,6 +429,215 @@ static void fill_transportlayer(void *buf, int seq_of= fset, int ack_offset, tcph->check =3D tcp_checksum(tcph, payload_len); } =20 +#ifdef HAVE_OPENSSL + +struct psp_assoc { + uint32_t spi; + uint8_t key[PSP_KEY_LEN_MAX]; + int keylen; + int version; + EVP_CIPHER_CTX *ctx; +}; + +static struct psp_assoc psp_assocs[PSP_MAX_ASSOC]; +static uint64_t psp_next_iv =3D 1; + +static char psp_scratch[L2_HLEN_MAX + IP_MAXPACKET + PSP_ENCAP_LEN]; + +static int psp_key_len(int version) +{ + switch (version) { + case PSP_VERSION_HDR0_AES_GCM_128: + case PSP_VERSION_HDR0_AES_GMAC_128: + return 16; + case PSP_VERSION_HDR0_AES_GCM_256: + case PSP_VERSION_HDR0_AES_GMAC_256: + return 32; + default: + error(1, 0, "psp: unknown version %d", version); + return 0; + } +} + +static bool psp_version_is_gmac(int version) +{ + return version =3D=3D PSP_VERSION_HDR0_AES_GMAC_128 || + version =3D=3D PSP_VERSION_HDR0_AES_GMAC_256; +} + +/* Parses one --psp-assoc "version,spi,key". + * The SPI and key (both hex) is a PSP RX assoc from the device under test. + */ +static void psp_parse_assoc(char *arg) +{ + char *ver_s, *spi_s, *key_s, *end; + const EVP_CIPHER *cipher; + struct psp_assoc *assoc; + unsigned long val; + size_t len, i; + + if (psp_num_assoc =3D=3D PSP_MAX_ASSOC) + error(1, 0, "psp: at most %d associations", PSP_MAX_ASSOC); + assoc =3D &psp_assocs[psp_num_assoc]; + + ver_s =3D strtok(arg, ","); + spi_s =3D strtok(NULL, ","); + key_s =3D strtok(NULL, ","); + if (!ver_s || !spi_s || !key_s || strtok(NULL, ",")) + error(1, 0, "psp: --psp-assoc wants version,spi,key"); + + errno =3D 0; + val =3D strtoul(ver_s, &end, 10); + if (errno || end =3D=3D ver_s || *end || + val > PSP_VERSION_HDR0_AES_GMAC_256) + error(1, 0, "psp: bad version '%s'", ver_s); + assoc->version =3D val; + + errno =3D 0; + val =3D strtoul(spi_s, &end, 16); + if (errno || end =3D=3D spi_s || *end || val > 0xffffffffUL) + error(1, 0, "psp: bad SPI '%s'", spi_s); + assoc->spi =3D val; + + len =3D strlen(key_s); + if (len !=3D (size_t)psp_key_len(assoc->version) * 2 || + strspn(key_s, "0123456789abcdefABCDEF") !=3D len) + error(1, 0, "psp: version %d needs a %d byte key, got '%s'", + assoc->version, psp_key_len(assoc->version), key_s); + + assoc->keylen =3D len / 2; + for (i =3D 0; i < len; i +=3D 2) { + unsigned int byte; + + if (sscanf(key_s + i, "%2x", &byte) !=3D 1) + error(1, 0, "psp: bad key '%s'", key_s); + assoc->key[i / 2] =3D byte; + } + + cipher =3D assoc->keylen =3D=3D 16 ? EVP_aes_128_gcm() : EVP_aes_256_gcm(= ); + assoc->ctx =3D EVP_CIPHER_CTX_new(); + if (!assoc->ctx) + error(1, 0, "psp: EVP_CIPHER_CTX_new"); + if (EVP_EncryptInit_ex(assoc->ctx, cipher, NULL, assoc->key, + NULL) !=3D 1) + error(1, 0, "psp: EVP_EncryptInit_ex key"); + psp_num_assoc++; + psp_enabled =3D true; +} + +static void psp_crypt(struct psp_assoc *assoc, const uint8_t *nonce, + const uint8_t *aad, int aad_len, + uint8_t *data, int data_len, uint8_t *icv) +{ + uint8_t *crypt_data =3D psp_version_is_gmac(assoc->version) ? NULL : data; + EVP_CIPHER_CTX *ctx =3D assoc->ctx; + int outl; + + if (EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, nonce) !=3D 1) + error(1, 0, "psp: EVP_EncryptInit_ex nonce"); + if (EVP_EncryptUpdate(ctx, NULL, &outl, aad, aad_len) !=3D 1) + error(1, 0, "psp: EVP_EncryptUpdate aad"); + if (EVP_EncryptUpdate(ctx, crypt_data, &outl, data, data_len) !=3D 1) + error(1, 0, "psp: EVP_EncryptUpdate data"); + if (EVP_EncryptFinal_ex(ctx, icv, &outl) !=3D 1) + error(1, 0, "psp: EVP_EncryptFinal_ex"); + if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, PSP_ICV_LEN, + icv) !=3D 1) + error(1, 0, "psp: EVP_CTRL_GCM_GET_TAG"); +} + +/* Encapsulates & encrypts @pkt with PSP transport mode into psp_scratch. + * Returns the scratch buffer and updates *@lenp. + */ +static char *psp_encapsulate(const char *pkt, int *lenp) +{ + struct psp_assoc *assoc =3D &psp_assocs[psp_idx]; + int ip_hlen, l4_off, l4_len, aad_len; + struct psphdr *psph; + struct udphdr *udph; + __be16 sport, dport; + uint8_t *data, *icv; + int len =3D *lenp; + uint8_t nexthdr; + + if (len + PSP_ENCAP_LEN > (int)sizeof(psp_scratch)) + error(1, 0, "psp: %d byte frame does not fit", len); + + memcpy(psp_scratch, pkt, len); + + if (proto =3D=3D PF_INET) { + struct iphdr *iph =3D (struct iphdr *)(psp_scratch + ETH_HLEN); + + ip_hlen =3D iph->ihl * 4; + nexthdr =3D iph->protocol; + } else { + struct ipv6hdr *ip6h =3D + (struct ipv6hdr *)(psp_scratch + ETH_HLEN); + + ip_hlen =3D sizeof(*ip6h); + nexthdr =3D ip6h->nexthdr; + } + + l4_off =3D ETH_HLEN + ip_hlen; + l4_len =3D len - l4_off; + if (l4_len < 4) + error(1, 0, "psp: no room for an L4 header"); + + sport =3D *(__be16 *)(psp_scratch + l4_off); + dport =3D *(__be16 *)(psp_scratch + l4_off + sizeof(sport)); + + memmove(psp_scratch + l4_off + PSP_UDP_LEN + PSP_HDR_LEN, + psp_scratch + l4_off, l4_len); + + udph =3D (struct udphdr *)(psp_scratch + l4_off); + udph->source =3D sport ^ dport; + udph->dest =3D htons(PSP_UDP_PORT); + udph->len =3D htons(PSP_UDP_LEN + PSP_HDR_LEN + l4_len + PSP_ICV_LEN); + udph->check =3D 0; + + psph =3D (struct psphdr *)(udph + 1); + psph->nexthdr =3D nexthdr; + psph->hdrlen =3D PSP_HDRLEN_NOOPT; + psph->crypt_offset =3D 0; /* Matches the kernel. */ + psph->verfl =3D (assoc->version << PSP_VERFL_VER_SHIFT) | PSP_VERFL_ONE; + psph->spi =3D htonl(assoc->spi); + psph->iv =3D htobe64(psp_next_iv++); + + data =3D (uint8_t *)psph + PSP_HDR_LEN; + icv =3D (uint8_t *)psph + PSP_HDR_LEN + l4_len; + aad_len =3D PSP_HDR_LEN; + + /* The GCM nonce is wire (spi, iv), which are contiguous. */ + psp_crypt(assoc, + (const uint8_t *)psph + offsetof(struct psphdr, spi), + (const uint8_t *)psph, aad_len, data, l4_len, icv); + + if (proto =3D=3D PF_INET) { + struct iphdr *iph =3D (struct iphdr *)(psp_scratch + ETH_HLEN); + + iph->tot_len =3D htons(ntohs(iph->tot_len) + PSP_ENCAP_LEN); + iph->protocol =3D IPPROTO_UDP; + iph->check =3D 0; + iph->check =3D checksum_fold(iph, ip_hlen, 0); + } else { + struct ipv6hdr *ip6h =3D + (struct ipv6hdr *)(psp_scratch + ETH_HLEN); + + ip6h->payload_len =3D + htons(ntohs(ip6h->payload_len) + PSP_ENCAP_LEN); + ip6h->nexthdr =3D IPPROTO_UDP; + } + + *lenp =3D len + PSP_ENCAP_LEN; + return psp_scratch; +} +#else +static void psp_parse_assoc(char *arg) +{ + error(1, 0, "gro was built without OpenSSL, PSP is not available"); +} +#endif /* HAVE_OPENSSL */ + static void write_packet(int fd, char *buf, int len, struct sockaddr_ll *d= addr) { char control[CMSG_SPACE(sizeof(uint64_t))]; @@ -392,6 +646,11 @@ static void write_packet(int fd, char *buf, int len, s= truct sockaddr_ll *daddr) struct cmsghdr *cm; int ret =3D -1; =20 +#ifdef HAVE_OPENSSL + if (psp_enabled) + buf =3D psp_encapsulate(buf, &len); +#endif + iov.iov_base =3D buf; iov.iov_len =3D len; =20 @@ -572,6 +831,10 @@ static void send_large(int fd, struct sockaddr_ll *dad= dr, int remainder) const int mss =3D calc_mss(); int i; =20 + if (num_pkt > MAX_LARGE_PKT_CNT) + error(1, 0, "too many large packets: %d > %zu", num_pkt, + (size_t)MAX_LARGE_PKT_CNT); + for (i =3D 0; i < num_pkt; i++) create_packet(pkts[i], i * mss, 0, mss, 0); create_packet(last, num_pkt * mss, 0, remainder, 0); @@ -1111,6 +1374,39 @@ static void send_changed_pppoe_sid(int fd, struct so= ckaddr_ll *daddr) write_packet(fd, buf, pkt_size, daddr); } =20 +/* PSP packets don't coalesce across SPIs or versions. */ +static void send_psp_assoc_switch(int fd, struct sockaddr_ll *daddr) +{ + static char buf[MAX_HDR_LEN + PAYLOAD_LEN]; + int pkt_size =3D total_hdr_len + PAYLOAD_LEN; + + if (psp_num_assoc < 2) + error(1, 0, "%s needs two PSP associations", testname); + + create_packet(buf, 0, 0, PAYLOAD_LEN, 0); + write_packet(fd, buf, pkt_size, daddr); + + create_packet(buf, PAYLOAD_LEN, 0, PAYLOAD_LEN, 0); + psp_idx =3D 1; + write_packet(fd, buf, pkt_size, daddr); + psp_idx =3D 0; +} + +/* A PSP packet and a cleartext packet of the same flow don't coalesce. */ +static void send_psp_mixed(int fd, struct sockaddr_ll *daddr) +{ + static char buf[MAX_HDR_LEN + PAYLOAD_LEN]; + int pkt_size =3D total_hdr_len + PAYLOAD_LEN; + + create_packet(buf, 0, 0, PAYLOAD_LEN, 0); + write_packet(fd, buf, pkt_size, daddr); + + create_packet(buf, PAYLOAD_LEN, 0, PAYLOAD_LEN, 0); + psp_enabled =3D false; + write_packet(fd, buf, pkt_size, daddr); + psp_enabled =3D true; +} + static void bind_packetsocket(int fd) { struct sockaddr_ll daddr =3D {}; @@ -1559,6 +1855,16 @@ static void gro_sender(void) usleep(fin_delay_us); write_packet(txfd, fin_pkt, total_hdr_len, &daddr); =20 + /* PSP sub-tests */ + } else if (strcmp(testname, "psp_spi_diff") =3D=3D 0 || + strcmp(testname, "psp_ver_diff") =3D=3D 0) { + send_psp_assoc_switch(txfd, &daddr); + usleep(fin_delay_us); + write_packet(txfd, fin_pkt, total_hdr_len, &daddr); + } else if (strcmp(testname, "psp_mixed") =3D=3D 0) { + send_psp_mixed(txfd, &daddr); + usleep(fin_delay_us); + write_packet(txfd, fin_pkt, total_hdr_len, &daddr); } else { error(1, 0, "Unknown testcase: %s", testname); } @@ -1782,6 +2088,22 @@ static void gro_receiver(void) printf("different PPPoE session ID doesn't coalesce: "); check_recv_pkts(rxfd, correct_payload, 2); =20 + /* PSP sub-tests */ + } else if (strcmp(testname, "psp_spi_diff") =3D=3D 0) { + correct_payload[0] =3D PAYLOAD_LEN; + correct_payload[1] =3D PAYLOAD_LEN; + printf("different PSP SPI doesn't coalesce: "); + check_recv_pkts(rxfd, correct_payload, 2); + } else if (strcmp(testname, "psp_ver_diff") =3D=3D 0) { + correct_payload[0] =3D PAYLOAD_LEN; + correct_payload[1] =3D PAYLOAD_LEN; + printf("different PSP version doesn't coalesce: "); + check_recv_pkts(rxfd, correct_payload, 2); + } else if (strcmp(testname, "psp_mixed") =3D=3D 0) { + correct_payload[0] =3D PAYLOAD_LEN; + correct_payload[1] =3D PAYLOAD_LEN; + printf("PSP and cleartext don't coalesce: "); + check_recv_pkts(rxfd, correct_payload, 2); } else { error(1, 0, "Test case error: unknown testname %s", testname); } @@ -1802,6 +2124,7 @@ static void parse_args(int argc, char **argv) { "ip6ip6", no_argument, NULL, 'E' }, { "pppoev4", no_argument, NULL, 'p' }, { "pppoev6", no_argument, NULL, 'P' }, + { "psp-assoc", required_argument, NULL, OPT_PSP_ASSOC }, { "num-flows", required_argument, NULL, 'n' }, { "rx", no_argument, NULL, 'r' }, { "saddr", required_argument, NULL, 's' }, @@ -1813,8 +2136,12 @@ static void parse_args(int argc, char **argv) }; int c; =20 - while ((c =3D getopt_long(argc, argv, "46d:D:eEi:n:pPrs:S:t:ov", opts, NU= LL)) !=3D -1) { + while ((c =3D getopt_long(argc, argv, "46d:D:eEi:n:pPrs:S:t:ov", + opts, NULL)) !=3D -1) { switch (c) { + case OPT_PSP_ASSOC: + psp_parse_assoc(optarg); + break; case '4': proto =3D PF_INET; ethhdr_proto =3D htons(ETH_P_IP); @@ -1904,6 +2231,12 @@ int main(int argc, char **argv) error(1, 0, "Protocol family is not ipv4 or ipv6"); } =20 + if (psp_enabled && (ipip || ip6ip6 || pppoe)) + error(1, 0, "--psp-assoc doesn't support ipip/ip6ip6/PPPoE"); + + if (!strncmp(testname, "psp_", 4) && !psp_enabled) + error(1, 0, "test %s requires --psp-assoc", testname); + read_MAC(src_mac, smac); read_MAC(dst_mac, dmac); =20 --=20 2.44.0 From nobody Fri Sep 25 22:19:10 2026 Received: from CO1PR03CU002.outbound.protection.outlook.com (mail-westus2azon11010050.outbound.protection.outlook.com [52.101.46.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ED0843A0B3B; Tue, 8 Sep 2026 06:55:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.46.50 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850537; cv=fail; b=bm8q/6RwzflOlsTmo/bgjkbL8458XcwGLduRHUvsVzarpQOMrsolRRkgddsvtfFEy5XLgzx7aVE0iB0VRbAVlGaOT+A0YXHAp96Avye2+xhVcv5xAib40FaZfkjsau6qgOq9WHSlK4QkBxzIcOlic5c7zUaifwLvrDR/uRhOehA= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788850537; c=relaxed/simple; bh=iF96JdLWujOkuBsKtX/ea7pKnCZf08RRzTn1wqij5ww=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=rywVIPlMN58GWmk9SxJrTip6/LM3ioOKgdTtAzsMFY8dVe152tLOJIsxBIjU/ImmqK65i2GWQkUpzitsYtlm2FURtlp8Z9iApGXHvon49v4S9Cl2xG7Aa9c/sBNBbBdwklt4KELxlDBg9lv/TztNPzZWhQ4V6RNsL+z4t/nDySU= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=YAExET/j; arc=fail smtp.client-ip=52.101.46.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="YAExET/j" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=jMXdr9zhYS8FOAM9AT1vu0nrEFKmTXYnbjd7BJqamrheZR+jSOSp+X4wjIxSDfKboawXP8m1poakNm6jk2ak6z+dyx9Q4Oo2lc6eCqSWgEXyGxoOC5z2bIJ/aHkIkq1Kg9nekpCYTS2zxnkT/4PTmPZswUZVBOoC7QsJuLMdGjbJJhnnO3TvQCCPNIl1m9psqBF4RBj3IHaW/XM/IEaBwgwPbmCAYYD1iC1cBMB8rvNSnarEkKsDYFnr10S8K1+qFfUxvoAf5Bnv4XyJ29IUgo+ZEyNyUwJ0LgDR97ulZv4ffq+6XW8i4GB3h/Aodyu9y57dhD4aD3sAWOeEdsYQkQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=gnzSzms0oM+0R0eSPIXHaC3vuWCVPAeDHMnoKRlM7H4=; b=e80M/GuaCT5tkkqeMyNHzxvj2QaJiZ/YaXB0505XPP/do0HUbpMOFvw8xg51J2lMFbqdcoAAJRKr6qv+MgdYuR1kur0IAOtCU/IhUuoQl2XUE4+Ivc22HAW3WPMR1HvTrQS8mRld9qOvjFjkc/ra5pUllKiGIDvucaHY9JKl5Dv01sDkJWAHxDKpr4OVSDX9RcWpttXOBj01fNKrZdjDNt5ZJQcRWHtIL9vXgK6NsKSk63Ukwkt0bq3Lv697YrbzSakKO3BN0MMSJXV+HisbwO0u0+kZf70Jh+hTHiO7Z62w29u/QwYlfhy0lWelRHOQBILvi8ssNS0HDDcPSalLIQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=lunn.ch smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gnzSzms0oM+0R0eSPIXHaC3vuWCVPAeDHMnoKRlM7H4=; b=YAExET/j8+J3nE+SgAnxQuHW1RXJBTZyT5xdSurnFXB6HKIwNyt3NylhjZfep6RGZW5XY7ln7XWurv9luXTkkA9g727/FRkaU4HZx3nVxNgqkJ9Ps4kB5ssrfIBE2Pfh1CcrxXGkKWt4+9WI7jzIyW4Q0qik9Kp7gO6TV4dmdN4wZFMyyUDfVVIubVQDMVpCtwLs2mh1+Fbjx9JMmJpNtPylHWjWCMnhtrtAoWOd+QTKyexaiEy8AuJUUf1IlPVBSCF27z7alxZGVaBx1X7mePjQxmDU6gXvAlMb6ZaD3VCtI03Y9aUFDVpcPlYp0huSClFXqCcoCcOJtUxMKt/RKA== Received: from BN8PR04CA0050.namprd04.prod.outlook.com (2603:10b6:408:d4::24) by DS0PR12MB7607.namprd12.prod.outlook.com (2603:10b6:8:13f::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.13; Tue, 8 Sep 2026 06:55:28 +0000 Received: from BN7PEPF000000AB.namprd05.prod.outlook.com (2603:10b6:408:d4:cafe::13) by BN8PR04CA0050.outlook.office365.com (2603:10b6:408:d4::24) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.382.15 via Frontend Transport; Tue, 8 Sep 2026 06:55:27 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by BN7PEPF000000AB.mail.protection.outlook.com (10.167.245.235) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.406.5 via Frontend Transport; Tue, 8 Sep 2026 06:55:27 +0000 Received: from rnnvmail205.nvidia.com (10.129.68.10) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:55:12 -0700 Received: from rnnvmail203.nvidia.com (10.129.68.9) by rnnvmail205.nvidia.com (10.129.68.10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.46; Mon, 7 Sep 2026 23:55:12 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.9) with Microsoft SMTP Server id 15.2.2562.46 via Frontend Transport; Mon, 7 Sep 2026 23:55:04 -0700 From: Tariq Toukan To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , Paolo Abeni , Sabrina Dubroca CC: Bobby Eshleman , Boris Pismenny , Carolina Jubran , Cosmin Ratiu , Daniel Zahka , Doruk Tan Ozturk , Dragos Tatulea , Gal Pressman , Jianbo Liu , Kees Cook , Leon Romanovsky , open list , , , Mark Bloch , Petr Machata , Raed Salem , Rahul Rameshbabu , Saeed Mahameed , Shuah Khan , Shuah Khan , Simon Horman , Tariq Toukan , Willem de Bruijn , Willem de Bruijn Subject: [PATCH net-next V4 14/14] selftests: drv-net: Add PSP HW GRO conformance tests Date: Tue, 8 Sep 2026 09:52:44 +0300 Message-ID: <20260908065244.3799142-15-tariqt@nvidia.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20260908065244.3799142-1-tariqt@nvidia.com> References: <20260908065244.3799142-1-tariqt@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: ExternallySecured X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BN7PEPF000000AB:EE_|DS0PR12MB7607:EE_ X-MS-Office365-Filtering-Correlation-Id: a274e3ec-20a0-41d8-205d-08df0d762a72 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|36860700016|1800799024|23010399003|376014|7416014|10067099003|56012099006|11063799006|6133799003|3023799007|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: b5+dydtyB4a5eCgW5XmMqpuL1Z+x4XP2vyCLRh3AjwoATpU8VDZiX7bOlonmEu4jJV4DMSPmcK4jGzKd2KF/RRdFdokvlssSdurCkC6aTo4Jli0+Jx3Y9PutZFuOls1C34LA5W3u/x9P1AsFTMnZHNejwc7XENKh58sqgzGsaBdfYrbJvuvFieWtn9OZwy9ZZK+04QldmLeDe+WiYz+sFTt21Dv9NrZvD4Up3lNaKi39VDQxJrajCu7cKi07+olL5LqC9Old+DAEEeICZcIhOiAt1rq3ykw2x1tsaggdTJssnZY9QZJor98ggaiOvfSHkjx0TWgd5thF1fucGAgynodYpK4F3WOHq7QGudNVJYNK7KMO/mfC06mJ2+YL6t8QGav14MuVgL5df4jfKdVRxXR+/9RIrrvCqnwAaZh/XyJgQjmtHpeOIcj6fPcV4v1rdsNZsQ/ODQok+5O8JwEa+oagg8o3SCl4BU9Ks8aGxneGviQaegX7728RiXn4bbIchLWWKI3ceAF9vWYQdT448xSHjIoi/OwIcr9BE1g/JQ4MlCwuVUcxqUaZqw15LKjUkU2ltcnLGEq8SKF2/DTuQwISmWcoHJJWLJtkwVZ7LtFRFNhZwOttm8C6gycBdccjTGnlkRY+ooceBIkqtGtGUfFvl/j2bjdFkB7TuWgG2CNKzMz3KQ00AyTAaosnLsGXdfbbK2mCk0XFuzC/adNBhw== X-Forefront-Antispam-Report: CIP:216.228.117.161;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge2.nvidia.com;CAT:NONE;SFS:(13230040)(82310400026)(36860700016)(1800799024)(23010399003)(376014)(7416014)(10067099003)(56012099006)(11063799006)(6133799003)(3023799007)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: FmmC4YM5QNRO+RYrcjjE2xkB3LPM5EmGuOkRroougjgRp+f6LLOOTxTv+BeJYJXnMTtN6TqASru3jnHlp2jXTS0ZAK2/OzzU5pqYe3u0PF/IRR/Bydj19G5XDAG97NRjbUKeEnTeQFbECEY1AB1VZFxNIJipHIDo+5GWIUysu9wDNIBbXADglxs8rJFoxEr0ckUZYj2yInDElTHdOYobWnsLOLhAjsq84xFKVYk8dP8NTxUX2y2e/VxVxf5BvDqlmA6F+iPkevPD4Y9IaTZ3iENyNlzbWRuueGq025tmZ4lhtbaAwrwuaFqnrAP1hTxRShO7luR1jwKecH1hLlvMpBgNj3DQFQzVLDztCzMdayJ7Jkiacw7KXKvbh86yeYRGBg1JFYznngPOgPOjN66xWXeQiyv6k5VRcD9BcdYtHgyE/kE1HPaUHFm8SPy0vQJI X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Sep 2026 06:55:27.7459 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: a274e3ec-20a0-41d8-205d-08df0d762a72 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: BN7PEPF000000AB.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR12MB7607 Content-Type: text/plain; charset="utf-8" From: Cosmin Ratiu Add PSP conformance tests using the same gro helper binary as other gro tests , but in --psp mode. SPIs are procured by psp_gro.py from a real PSP device and handed off to the gro sender & receiver. The sender crafts and encrypts packets in software, the receiver relies fully on the HW to decrypt, decapsulate and do HW GRO. Because the NIC decrypts and decapsulates before the frames reach the receiver AF_PACKET tap, the gro receiver sees the plain frames and the assertions remain exactly the same as other gro tests. So these tests verify, at length, that the device does PSP HW-GRO the same way as plain TCP. Additional PSP-specific tests are defined to check that GRO doesn't merge packets across PSP versions, SPIs, encryption-status, etc. Some gro tests are not included because they don't work: - ip_csum: the checksum is recomputed by psp_dev_rcv(). - tcp_csum: packets are marked with CHECKSUM_UNNECESSARY. - ip_frag4/ip_frag6: PSP is incompatible with IP fragmentation. - IPv6 extension header tests: PSP doesn't deal with IPv6 ext headers. Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Daniel Zahka --- .../testing/selftests/drivers/net/gro_lib.py | 15 +- .../testing/selftests/drivers/net/hw/Makefile | 17 ++ tools/testing/selftests/drivers/net/hw/config | 1 + .../selftests/drivers/net/hw/psp_gro.py | 157 ++++++++++++++++++ 4 files changed, 186 insertions(+), 4 deletions(-) create mode 100755 tools/testing/selftests/drivers/net/hw/psp_gro.py diff --git a/tools/testing/selftests/drivers/net/gro_lib.py b/tools/testing= /selftests/drivers/net/gro_lib.py index 45ded8477a50..8edae7d736a9 100644 --- a/tools/testing/selftests/drivers/net/gro_lib.py +++ b/tools/testing/selftests/drivers/net/gro_lib.py @@ -189,7 +189,8 @@ def _setup_queue_count(cfg, num_queues): =20 =20 def _run_gro_bin(cfg, test_name, protocol=3DNone, num_flows=3DNone, - order_check=3DFalse, verbose=3DFalse, fail=3DFalse): + order_check=3DFalse, verbose=3DFalse, fail=3DFalse, + common_args=3DNone): """Run gro binary with given test and return the process result.""" if not hasattr(cfg, "bin_remote"): cfg.bin_local =3D cfg.net_lib_dir / "gro" @@ -217,6 +218,8 @@ def _run_gro_bin(cfg, test_name, protocol=3DNone, num_f= lows=3DNone, base_args.append("--order-check") if verbose: base_args.append("--verbose") + if common_args: + base_args +=3D common_args =20 args =3D " ".join(base_args) =20 @@ -341,8 +344,11 @@ def _gro_variants(): yield protocol, test_name =20 =20 -def run_test(cfg, mode, protocol, test_name): - """Run a single GRO test with retries.""" +def run_test(cfg, mode, protocol, test_name, common_args=3DNone): + """Run a single GRO test with retries. + + common_args are extra arguments passed to both gro sender and receiver. + """ =20 ipver =3D "6" if protocol[-1] =3D=3D "6" else "4" cfg.require_ipver(ipver) @@ -356,7 +362,8 @@ def run_test(cfg, mode, protocol, test_name): for attempt in range(max_retries): fail_now =3D attempt >=3D max_retries - 1 rx_proc =3D _run_gro_bin(cfg, test_name, protocol=3Dprotocol, - verbose=3DTrue, fail=3Dfail_now) + verbose=3DTrue, fail=3Dfail_now, + common_args=3Dcommon_args) =20 if rx_proc.ret =3D=3D 0: return diff --git a/tools/testing/selftests/drivers/net/hw/Makefile b/tools/testin= g/selftests/drivers/net/hw/Makefile index 6105be8e590f..daa7e52f236e 100644 --- a/tools/testing/selftests/drivers/net/hw/Makefile +++ b/tools/testing/selftests/drivers/net/hw/Makefile @@ -13,6 +13,20 @@ else $(warning excluding iouring tests, liburing not installed or too old) endif =20 +# psp_gro.py uses the gro binary in PSP mode, which requires OpenSSL. +PKG_CONFIG ?=3D pkg-config +HAVE_OPENSSL :=3D $(shell echo 'int main(void) { return 0; }' | \ + $(CC) -x c - -include openssl/evp.h \ + $(shell $(PKG_CONFIG) --cflags --libs libcrypto 2>/dev/null \ + || echo -lcrypto) \ + -o /dev/null >/dev/null 2>&1 && echo 1) + +ifeq ($(HAVE_OPENSSL),1) +COND_PROGS +=3D psp_gro.py +else +$(warning excluding PSP GRO tests, libcrypto not installed) +endif + TEST_GEN_FILES :=3D \ $(COND_GEN_FILES) \ # end of TEST_GEN_FILES @@ -40,6 +54,7 @@ TEST_PROGS =3D \ nk_qlease.py \ ntuple.py \ pp_alloc_fail.py \ + $(COND_PROGS) \ rss_api.py \ rss_ctx.py \ rss_drv.py \ @@ -64,6 +79,8 @@ TEST_FILES :=3D \ =20 TEST_INCLUDES :=3D \ $(wildcard lib/py/*.py ../lib/py/*.py) \ + ../gro_lib.py \ + ../psp_lib.py \ ../../../net/lib.sh \ ../../../net/forwarding/ipip_lib.sh \ ../../../net/forwarding/lib.sh \ diff --git a/tools/testing/selftests/drivers/net/hw/config b/tools/testing/= selftests/drivers/net/hw/config index d89a9ba17655..060ed1423bf3 100644 --- a/tools/testing/selftests/drivers/net/hw/config +++ b/tools/testing/selftests/drivers/net/hw/config @@ -8,6 +8,7 @@ CONFIG_INET6_ESP=3Dy CONFIG_INET6_ESP_OFFLOAD=3Dy CONFIG_INET_ESP=3Dy CONFIG_INET_ESP_OFFLOAD=3Dy +CONFIG_INET_PSP=3Dy CONFIG_IO_URING=3Dy CONFIG_IPV6=3Dy CONFIG_IPV6_GRE=3Dy diff --git a/tools/testing/selftests/drivers/net/hw/psp_gro.py b/tools/test= ing/selftests/drivers/net/hw/psp_gro.py new file mode 100755 index 000000000000..3a069c944ae1 --- /dev/null +++ b/tools/testing/selftests/drivers/net/hw/psp_gro.py @@ -0,0 +1,157 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: GPL-2.0 + +""" +PSP HW GRO conformance tests. + +This reuses the gro binary in --psp mode: +The sender crafts encapsulated & SW-encrypted PSP packets with receiver's = PSP +rx-assoc, and the receiver's device decrypts and decapsulates the packets +before an AF_PACKET tap gets to analyze them. + +All GRO conformance tests which could run with PSP are included. +""" + +import socket + +from lib.py import ksft_run, ksft_exit +from lib.py import ksft_variants, KsftNamedVariant +from lib.py import KsftSkipEx +from lib.py import NetDrvEpEnv, PSPFamily +from lib.py import defer + +# The helpers live next to their other users, gro_*.py and psp.py. Importi= ng +# lib.py above puts the selftests root on sys.path, which is what makes th= ese +# two resolve, so they have to stay after it - pylint wants the opposite. +# pylint: disable=3Dwrong-import-order,import-error +from drivers.net.gro_lib import run_test +from drivers.net.psp_lib import init_psp_dev, require_version +# pylint: enable=3Dwrong-import-order,import-error + + +# Tests for both IP versions, a subset of gro tests. Missing: +# - tcp_csum: PSP packets are validated by HW (with the ICV) and marked wi= th +# CHECKSUM_UNNECESSARY. +_COMMON =3D ["data_same", "data_lrg_sml", "data_sml_lrg", "data_lrg_1byte", + "data_burst", + "ack", + "flags_psh", "flags_syn", "flags_rst", "flags_urg", "flags_cwr", + "tcp_seq", "tcp_ts", "tcp_opt", + "ip_ecn", "ip_tos", + "large_max", "large_rem", +] + +# Tests specific to IPv4, a subset of gro tests. Missing: +# - ip_csum: psp_dev_rcv() recomputes the IP checksum. +# - ip_frag4: PSP is incompatible with IP fragmentation. +_V4 =3D ["ip_ttl", "ip_opt", + "ip_id_df1_inc", "ip_id_df1_fixed", + "ip_id_df0_inc", "ip_id_df0_fixed", + "ip_id_df1_inc_fixed", "ip_id_df1_fixed_inc", +] + +# No IPv6-only tests: +# - ip_frag6: PSP doesn't support fragmentation +# - ip_v6ext_same, ip_v6ext_diff: PSP doesn't support IPv6 ext headers. + + +def _psp_variants(): + for ver in range(4): + for proto in ["ipv4", "ipv6"]: + for test_name in _COMMON + (_V4 if proto =3D=3D "ipv4" else []= ): + yield KsftNamedVariant(f"v{ver}_{proto}_{test_name}", + ver, proto, test_name) + + +def _ip_variants(): + """IPv4/IPv6.""" + for proto in ("ipv4", "ipv6"): + yield KsftNamedVariant(proto, proto) + + +def _psp_assoc(cfg, version=3D0): + # This socket receives no traffic, exists solely to own the rx assoc. + s =3D socket.socket(socket.AF_INET6, socket.SOCK_STREAM) + defer(s.close) + return cfg.pspnl.rx_assoc({"version": version, "dev-id": cfg.psp_dev_i= d, + "sock-fd": s.fileno()})['rx-key'] + + +def _setup(cfg, version): + """Enables PSP on the device under test.""" + init_psp_dev(cfg) + require_version(cfg, version) + + +def _psp_args(cfg, versions): + """Produces PSP associations as gro binary --psp-assoc arguments.""" + keys =3D [_psp_assoc(cfg, ver) for ver in versions] + return [f"--psp-assoc {ver},{key['spi']:x},{key['key'].hex()}" + for ver, key in zip(versions, keys)] + + +def _run(cfg, test_name, protocol, versions): + """Sets up, associates and runs one gro test case under PSP + HW GRO."= "" + _setup(cfg, max(versions)) + + run_test(cfg, "hw", protocol, test_name, + common_args=3D_psp_args(cfg, versions)) + + +@ksft_variants(_psp_variants()) +def test_psp_gro(cfg, version, protocol, test_name): + """Runs one gro conformance case with PSP encapsulation.""" + _run(cfg, test_name, protocol, [version]) + + +# PSP-specific GRO tests + +@ksft_variants(_ip_variants()) +def test_psp_spi_diff(cfg, protocol): + """Frames from two different SPIs must not coalesce.""" + _run(cfg, "psp_spi_diff", protocol, [0, 0]) + + +@ksft_variants(_ip_variants()) +def test_psp_ver_diff(cfg, protocol): + """Frames from two different PSP versions must not coalesce.""" + init_psp_dev(cfg) + if len(cfg.psp_info['psp-versions-cap']) < 2: + raise KsftSkipEx("Device supports a single PSP version") + + _run(cfg, "psp_ver_diff", protocol, [0, 1]) + + +@ksft_variants(_ip_variants()) +def test_psp_mixed(cfg, protocol): + """A PSP frame must not coalesce with a clear text one.""" + _run(cfg, "psp_mixed", protocol, [0]) + + +@ksft_variants(_ip_variants()) +def test_psp_after_reconfig(cfg, protocol): + """Verifies that decap still works after PSP off + on.""" + _setup(cfg, 0) + + cap =3D cfg.psp_info['psp-versions-cap'] + cfg.pspnl.dev_set({'id': cfg.psp_dev_id, 'psp-versions-ena': []}) + cfg.pspnl.dev_set({'id': cfg.psp_dev_id, 'psp-versions-ena': cap}) + + run_test(cfg, "hw", protocol, "data_same", + common_args=3D_psp_args(cfg, [0])) + + +def main() -> None: + """ Ksft boiler plate main """ + + with NetDrvEpEnv(__file__, nsim_test=3DFalse) as cfg: + cfg.pspnl =3D PSPFamily() + + ksft_run(cases=3D[test_psp_gro, test_psp_spi_diff, test_psp_ver_di= ff, + test_psp_mixed, test_psp_after_reconfig], + args=3D(cfg, )) + ksft_exit() + + +if __name__ =3D=3D "__main__": + main() --=20 2.44.0