Skip to content

Commit 5a6cddb

Browse files
raed-salemrleon
raed-salem
authored and
rleon
committed
net/mlx5e: Update IPsec per SA packets/bytes count
Providing per SA packets/bytes statistics mandates creating unique counter per SA flow for Rx/Tx, whenever offloaded SA statistics is desired query the specific SA counter to provide the stack with the needed data. Signed-off-by: Raed Salem <raeds@nvidia.com> Link: https://lore.kernel.org/r/7d5ce20ac495f3054afb633128700e7b7eeeb3cd.1678714336.git.leon@kernel.org Signed-off-by: Leon Romanovsky <leon@kernel.org>
1 parent d0c19a3 commit 5a6cddb

File tree

4 files changed

+42
-41
lines changed

4 files changed

+42
-41
lines changed

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c‎

Lines changed: 7 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -495,24 +495,18 @@ static void mlx5e_xfrm_advance_esn_state(struct xfrm_state *x)
495495
static void mlx5e_xfrm_update_curlft(struct xfrm_state *x)
496496
{
497497
struct mlx5e_ipsec_sa_entry *sa_entry = to_ipsec_sa_entry(x);
498-
int err;
498+
struct mlx5e_ipsec_rule *ipsec_rule = &sa_entry->ipsec_rule;
499+
u64 packets, bytes, lastuse;
499500

500-
lockdep_assert_held(&x->lock);
501+
lockdep_assert(lockdep_is_held(&x->lock) ||
502+
lockdep_is_held(&dev_net(x->xso.real_dev)->xfrm.xfrm_cfg_mutex));
501503

502504
if (x->xso.flags & XFRM_DEV_OFFLOAD_FLAG_ACQ)
503505
return;
504506

505-
if (sa_entry->attrs.soft_packet_limit == XFRM_INF)
506-
/* Limits are not configured, as soft limit
507-
* must be lowever than hard limit.
508-
*/
509-
return;
510-
511-
err = mlx5e_ipsec_aso_query(sa_entry, NULL);
512-
if (err)
513-
return;
514-
515-
mlx5e_ipsec_aso_update_curlft(sa_entry, &x->curlft.packets);
507+
mlx5_fc_query_cached(ipsec_rule->fc, &bytes, &packets, &lastuse);
508+
x->curlft.packets += packets;
509+
x->curlft.bytes += bytes;
516510
}
517511

518512
static int mlx5e_xfrm_validate_policy(struct mlx5_core_dev *mdev,

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,7 @@ struct mlx5e_ipsec_rule {
162162
struct mlx5_flow_handle *rule;
163163
struct mlx5_modify_hdr *modify_hdr;
164164
struct mlx5_pkt_reformat *pkt_reformat;
165+
struct mlx5_fc *fc;
165166
};
166167

167168
struct mlx5e_ipsec_modify_state_work {
@@ -235,9 +236,6 @@ void mlx5e_ipsec_aso_cleanup(struct mlx5e_ipsec *ipsec);
235236

236237
int mlx5e_ipsec_aso_query(struct mlx5e_ipsec_sa_entry *sa_entry,
237238
struct mlx5_wqe_aso_ctrl_seg *data);
238-
void mlx5e_ipsec_aso_update_curlft(struct mlx5e_ipsec_sa_entry *sa_entry,
239-
u64 *packets);
240-
241239
void mlx5e_accel_ipsec_fs_read_stats(struct mlx5e_priv *priv,
242240
void *ipsec_stats);
243241

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c‎

Lines changed: 34 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -876,11 +876,12 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
876876
struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs;
877877
struct mlx5_core_dev *mdev = mlx5e_ipsec_sa2dev(sa_entry);
878878
struct mlx5e_ipsec *ipsec = sa_entry->ipsec;
879-
struct mlx5_flow_destination dest = {};
879+
struct mlx5_flow_destination dest[2];
880880
struct mlx5_flow_act flow_act = {};
881881
struct mlx5_flow_handle *rule;
882882
struct mlx5_flow_spec *spec;
883883
struct mlx5e_ipsec_rx *rx;
884+
struct mlx5_fc *counter;
884885
int err;
885886

886887
rx = rx_ft_get(mdev, ipsec, attrs->family);
@@ -917,14 +918,22 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
917918
break;
918919
}
919920

921+
counter = mlx5_fc_create(mdev, true);
922+
if (IS_ERR(counter)) {
923+
err = PTR_ERR(counter);
924+
goto err_add_cnt;
925+
}
920926
flow_act.crypto.type = MLX5_FLOW_CONTEXT_ENCRYPT_DECRYPT_TYPE_IPSEC;
921927
flow_act.crypto.obj_id = sa_entry->ipsec_obj_id;
922928
flow_act.flags |= FLOW_ACT_NO_APPEND;
923929
flow_act.action |= MLX5_FLOW_CONTEXT_ACTION_FWD_DEST |
924-
MLX5_FLOW_CONTEXT_ACTION_CRYPTO_DECRYPT;
925-
dest.type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE;
926-
dest.ft = rx->ft.status;
927-
rule = mlx5_add_flow_rules(rx->ft.sa, spec, &flow_act, &dest, 1);
930+
MLX5_FLOW_CONTEXT_ACTION_CRYPTO_DECRYPT |
931+
MLX5_FLOW_CONTEXT_ACTION_COUNT;
932+
dest[0].type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE;
933+
dest[0].ft = rx->ft.status;
934+
dest[1].type = MLX5_FLOW_DESTINATION_TYPE_COUNTER;
935+
dest[1].counter_id = mlx5_fc_id(counter);
936+
rule = mlx5_add_flow_rules(rx->ft.sa, spec, &flow_act, dest, 2);
928937
if (IS_ERR(rule)) {
929938
err = PTR_ERR(rule);
930939
mlx5_core_err(mdev, "fail to add RX ipsec rule err=%d\n", err);
@@ -934,10 +943,13 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
934943

935944
sa_entry->ipsec_rule.rule = rule;
936945
sa_entry->ipsec_rule.modify_hdr = flow_act.modify_hdr;
946+
sa_entry->ipsec_rule.fc = counter;
937947
sa_entry->ipsec_rule.pkt_reformat = flow_act.pkt_reformat;
938948
return 0;
939949

940950
err_add_flow:
951+
mlx5_fc_destroy(mdev, counter);
952+
err_add_cnt:
941953
if (flow_act.pkt_reformat)
942954
mlx5_packet_reformat_dealloc(mdev, flow_act.pkt_reformat);
943955
err_pkt_reformat:
@@ -954,11 +966,12 @@ static int tx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
954966
struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs;
955967
struct mlx5_core_dev *mdev = mlx5e_ipsec_sa2dev(sa_entry);
956968
struct mlx5e_ipsec *ipsec = sa_entry->ipsec;
957-
struct mlx5_flow_destination dest = {};
969+
struct mlx5_flow_destination dest[2];
958970
struct mlx5_flow_act flow_act = {};
959971
struct mlx5_flow_handle *rule;
960972
struct mlx5_flow_spec *spec;
961973
struct mlx5e_ipsec_tx *tx;
974+
struct mlx5_fc *counter;
962975
int err;
963976

964977
tx = tx_ft_get(mdev, ipsec);
@@ -996,15 +1009,23 @@ static int tx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
9961009
break;
9971010
}
9981011

1012+
counter = mlx5_fc_create(mdev, true);
1013+
if (IS_ERR(counter)) {
1014+
err = PTR_ERR(counter);
1015+
goto err_add_cnt;
1016+
}
1017+
9991018
flow_act.crypto.type = MLX5_FLOW_CONTEXT_ENCRYPT_DECRYPT_TYPE_IPSEC;
10001019
flow_act.crypto.obj_id = sa_entry->ipsec_obj_id;
10011020
flow_act.flags |= FLOW_ACT_NO_APPEND;
10021021
flow_act.action |= MLX5_FLOW_CONTEXT_ACTION_FWD_DEST |
10031022
MLX5_FLOW_CONTEXT_ACTION_CRYPTO_ENCRYPT |
10041023
MLX5_FLOW_CONTEXT_ACTION_COUNT;
1005-
dest.ft = tx->ft.status;
1006-
dest.type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE;
1007-
rule = mlx5_add_flow_rules(tx->ft.sa, spec, &flow_act, &dest, 1);
1024+
dest[0].ft = tx->ft.status;
1025+
dest[0].type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE;
1026+
dest[1].type = MLX5_FLOW_DESTINATION_TYPE_COUNTER;
1027+
dest[1].counter_id = mlx5_fc_id(counter);
1028+
rule = mlx5_add_flow_rules(tx->ft.sa, spec, &flow_act, dest, 2);
10081029
if (IS_ERR(rule)) {
10091030
err = PTR_ERR(rule);
10101031
mlx5_core_err(mdev, "fail to add TX ipsec rule err=%d\n", err);
@@ -1013,10 +1034,13 @@ static int tx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
10131034

10141035
kvfree(spec);
10151036
sa_entry->ipsec_rule.rule = rule;
1037+
sa_entry->ipsec_rule.fc = counter;
10161038
sa_entry->ipsec_rule.pkt_reformat = flow_act.pkt_reformat;
10171039
return 0;
10181040

10191041
err_add_flow:
1042+
mlx5_fc_destroy(mdev, counter);
1043+
err_add_cnt:
10201044
if (flow_act.pkt_reformat)
10211045
mlx5_packet_reformat_dealloc(mdev, flow_act.pkt_reformat);
10221046
err_pkt_reformat:
@@ -1299,7 +1323,7 @@ void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
12991323
struct mlx5_core_dev *mdev = mlx5e_ipsec_sa2dev(sa_entry);
13001324

13011325
mlx5_del_flow_rules(ipsec_rule->rule);
1302-
1326+
mlx5_fc_destroy(mdev, ipsec_rule->fc);
13031327
if (ipsec_rule->pkt_reformat)
13041328
mlx5_packet_reformat_dealloc(mdev, ipsec_rule->pkt_reformat);
13051329

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -489,18 +489,3 @@ int mlx5e_ipsec_aso_query(struct mlx5e_ipsec_sa_entry *sa_entry,
489489
spin_unlock_bh(&aso->lock);
490490
return ret;
491491
}
492-
493-
void mlx5e_ipsec_aso_update_curlft(struct mlx5e_ipsec_sa_entry *sa_entry,
494-
u64 *packets)
495-
{
496-
struct mlx5e_ipsec *ipsec = sa_entry->ipsec;
497-
struct mlx5e_ipsec_aso *aso = ipsec->aso;
498-
u64 hard_cnt;
499-
500-
hard_cnt = MLX5_GET(ipsec_aso, aso->ctx, remove_flow_pkt_cnt);
501-
/* HW decresases the limit till it reaches zero to fire an avent.
502-
* We need to fix the calculations, so the returned count is a total
503-
* number of passed packets and not how much left.
504-
*/
505-
*packets = sa_entry->attrs.hard_packet_limit - hard_cnt;
506-
}

0 commit comments

Comments
 (0)