xfrm: add support to HW update soft and hard limits

Both in RX and TX, the traffic that performs IPsec packet offload
transformation is accounted by HW. It is needed to properly handle
hard limits that require to drop the packet.

It means that XFRM core needs to update internal counters with the one
that accounted by the HW, so new callbacks are introduced in this patch.

In case of soft or hard limit is occurred, the driver should call to
xfrm_state_check_expire() that will perform key rekeying exactly as
done by XFRM core.

Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 4096e3fe8e4a1ee4f594c00fe92c1ba0d3b99f08..29ae964e3b8933a6b2fb94c0497678d28c7c800e 100644 (file)
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1040,6 +1040,7 @@ struct xfrmdev_ops {
        bool    (*xdo_dev_offload_ok) (struct sk_buff *skb,
                                       struct xfrm_state *x);
        void    (*xdo_dev_state_advance_esn) (struct xfrm_state *x);
+       void    (*xdo_dev_state_update_curlft) (struct xfrm_state *x);
        int     (*xdo_dev_policy_add) (struct xfrm_policy *x);
        void    (*xdo_dev_policy_delete) (struct xfrm_policy *x);
        void    (*xdo_dev_policy_free) (struct xfrm_policy *x);

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index b6ee14991a32fe9d8ccea082fc4bd8075f38d581..5413cdd5ad621d78094f0223a74ec60678669a6c 100644 (file)
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1571,6 +1571,23 @@ struct xfrm_state *xfrm_stateonly_find(struct net *net, u32 mark, u32 if_id,
 struct xfrm_state *xfrm_state_lookup_byspi(struct net *net, __be32 spi,
                                              unsigned short family);
 int xfrm_state_check_expire(struct xfrm_state *x);
+#ifdef CONFIG_XFRM_OFFLOAD
+static inline void xfrm_dev_state_update_curlft(struct xfrm_state *x)
+{
+       struct xfrm_dev_offload *xdo = &x->xso;
+       struct net_device *dev = xdo->dev;
+
+       if (x->xso.type != XFRM_DEV_OFFLOAD_PACKET)
+               return;
+
+       if (dev && dev->xfrmdev_ops &&
+           dev->xfrmdev_ops->xdo_dev_state_update_curlft)
+               dev->xfrmdev_ops->xdo_dev_state_update_curlft(x);
+
+}
+#else
+static inline void xfrm_dev_state_update_curlft(struct xfrm_state *x) {}
+#endif
 void xfrm_state_insert(struct xfrm_state *x);
 int xfrm_state_add(struct xfrm_state *x);
 int xfrm_state_update(struct xfrm_state *x);

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 2a190e85da806660ffee6b326f8f11897b651e27..cc1d0ea42672d513ea983d11056cd0b355b4ffb4 100644 (file)
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -570,6 +570,8 @@ static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me)
        int err = 0;
 
        spin_lock(&x->lock);
+       xfrm_dev_state_update_curlft(x);
+
        if (x->km.state == XFRM_STATE_DEAD)
                goto out;
        if (x->km.state == XFRM_STATE_EXPIRED)
@@ -1936,6 +1938,8 @@ EXPORT_SYMBOL(xfrm_state_update);
 
 int xfrm_state_check_expire(struct xfrm_state *x)
 {
+       xfrm_dev_state_update_curlft(x);
+
        if (!x->curlft.use_time)
                x->curlft.use_time = ktime_get_real_seconds();