5 files changed, 72 insertions, 10 deletions

diff --git a/sys/dev/mlx5/mlx5_accel/mlx5_ipsec_fs.c b/sys/dev/mlx5/mlx5_accel/mlx5_ipsec_fs.c
index fb9ca94278db..d1f454a5ec41 100644
--- a/sys/dev/mlx5/mlx5_accel/mlx5_ipsec_fs.c
+++ b/sys/dev/mlx5/mlx5_accel/mlx5_ipsec_fs.c
@@ -1134,6 +1134,11 @@ static int tx_add_kspi_rule(struct mlx5e_ipsec_sa_entry *sa_entry,
 	setup_fte_no_frags(spec);
 	setup_fte_reg_a_with_tag(spec, sa_entry->kspi);
 
+	if (sa_entry->vid != VLAN_NONE)
+		setup_fte_vid(spec, sa_entry->vid);
+	else
+		setup_fte_no_vid(spec);
+
 	rule = mlx5_add_flow_rules(tx->ft.sa_kspi, spec, flow_act, dest, num_dest);
 	if (IS_ERR(rule)) {
 		err = PTR_ERR(rule);
@@ -1169,6 +1174,10 @@ static int tx_add_reqid_ip_rules(struct mlx5e_ipsec_sa_entry *sa_entry,
 	flow_act->flags |= FLOW_ACT_IGNORE_FLOW_LEVEL;
 
 	if(attrs->reqid) {
+		if (sa_entry->vid != VLAN_NONE)
+			setup_fte_vid(spec, sa_entry->vid);
+		else
+			setup_fte_no_vid(spec);
 		setup_fte_no_frags(spec);
 		setup_fte_reg_c0(spec, attrs->reqid);
 		rule = mlx5_add_flow_rules(tx->ft.sa, spec, flow_act, dest, num_dest);
@@ -1181,6 +1190,11 @@ static int tx_add_reqid_ip_rules(struct mlx5e_ipsec_sa_entry *sa_entry,
 		memset(spec, 0, sizeof(*spec));
 	}
 
+	if (sa_entry->vid != VLAN_NONE)
+		setup_fte_vid(spec, sa_entry->vid);
+	else
+		setup_fte_no_vid(spec);
+
 	if (attrs->family == AF_INET)
 		setup_fte_addr4(spec, &attrs->saddr.a4, &attrs->daddr.a4);
 	else
@@ -1322,6 +1336,11 @@ static int tx_add_policy(struct mlx5e_ipsec_pol_entry *pol_entry)
                 goto err_mod_header;
         }
 
+        if (attrs->vid != VLAN_NONE)
+                setup_fte_vid(spec, attrs->vid);
+        else
+                setup_fte_no_vid(spec);
+
         flow_act.flags |= FLOW_ACT_NO_APPEND;
         dest[dstn].ft = tx->ft.sa;
         dest[dstn].type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE;
diff --git a/sys/dev/mlx5/mlx5_accel/mlx5_ipsec_offload.c b/sys/dev/mlx5/mlx5_accel/mlx5_ipsec_offload.c
index 978e5f25ceaf..cc0bc1f3fcd2 100644
--- a/sys/dev/mlx5/mlx5_accel/mlx5_ipsec_offload.c
+++ b/sys/dev/mlx5/mlx5_accel/mlx5_ipsec_offload.c
@@ -120,7 +120,7 @@ static void mlx5e_ipsec_packet_setup(void *obj, u32 pdn,
 
 	switch (attrs->dir) {
 	case IPSEC_DIR_OUTBOUND:
-		if (attrs->replay_esn.replay_window != 0)
+		if (attrs->replay_esn.trigger)
 			MLX5_SET(ipsec_aso, aso_ctx, mode, MLX5_IPSEC_ASO_INC_SN);
 		else
 			MLX5_SET(ipsec_aso, aso_ctx, mode, MLX5_IPSEC_ASO_MODE);
diff --git a/sys/dev/mlx5/mlx5_en/en_hw_tls.h b/sys/dev/mlx5/mlx5_en/en_hw_tls.h
index d637314e040e..cd57d2ac5f72 100644
--- a/sys/dev/mlx5/mlx5_en/en_hw_tls.h
+++ b/sys/dev/mlx5/mlx5_en/en_hw_tls.h
@@ -82,6 +82,8 @@ struct mlx5e_tls {
 	struct sysctl_ctx_list ctx;
 	struct mlx5e_tls_stats stats;
 	struct workqueue_struct *wq;
+	struct workqueue_struct *prealloc_wq;
+	struct work_struct prealloc_work;
 	uma_zone_t zone;
 	uint32_t max_resources;		/* max number of resources */
 	int zone_max;
@@ -92,6 +94,7 @@ struct mlx5e_tls {
 int mlx5e_tls_init(struct mlx5e_priv *);
 void mlx5e_tls_cleanup(struct mlx5e_priv *);
 int mlx5e_sq_tls_xmit(struct mlx5e_sq *, struct mlx5e_xmit_args *, struct mbuf **);
+void mlx5e_tls_prealloc_tags(struct mlx5e_priv *priv);
 
 if_snd_tag_alloc_t mlx5e_tls_snd_tag_alloc;
 
diff --git a/sys/dev/mlx5/mlx5_en/mlx5_en_hw_tls.c b/sys/dev/mlx5/mlx5_en/mlx5_en_hw_tls.c
index 6c83de5f3580..851316ccfcd7 100644
--- a/sys/dev/mlx5/mlx5_en/mlx5_en_hw_tls.c
+++ b/sys/dev/mlx5/mlx5_en/mlx5_en_hw_tls.c
@@ -80,23 +80,39 @@ static const char *mlx5e_tls_stats_desc[] = {
 };
 
 static void mlx5e_tls_work(struct work_struct *);
+static void mlx5e_tls_prealloc_work(struct work_struct *);
 
 /*
- * Expand the tls tag UMA zone in a sleepable context
+ * Expand the tls tag UMA zone in an async context
  */
 
 static void
-mlx5e_prealloc_tags(struct mlx5e_priv *priv, int nitems)
+mlx5e_tls_prealloc_work(struct work_struct *work)
 {
+	struct mlx5e_priv *priv;
+	struct mlx5e_tls *ptls;
 	struct mlx5e_tls_tag **tags;
-	int i;
+	int i, nitems;
+
+	ptls = container_of(work, struct mlx5e_tls, prealloc_work);
+	priv = container_of(ptls, struct mlx5e_priv, tls);
+	nitems = ptls->zone_max;
 
 	tags = malloc(sizeof(tags[0]) * nitems,
-	    M_MLX5E_TLS, M_WAITOK);
-	for (i = 0; i < nitems; i++)
-		tags[i] = uma_zalloc(priv->tls.zone, M_WAITOK);
+	    M_MLX5E_TLS, M_WAITOK | M_ZERO);
+	for (i = 0; i < nitems; i++) {
+		tags[i] = uma_zalloc(priv->tls.zone, M_NOWAIT);
+		/*
+		 * If the allocation fails, its likely we are competing
+		 * with real consumers of tags and the zone is full,
+		 * so exit the loop, and release the tags like we would
+		 * if we allocated all "nitems"
+		 */
+		if (tags[i] == NULL)
+			break;
+	}
 	__compiler_membar();
-	for (i = 0; i < nitems; i++)
+	for (i = 0; i < nitems && tags[i] != NULL; i++)
 		uma_zfree(priv->tls.zone, tags[i]);
 	free(tags, M_MLX5E_TLS);
 }
@@ -244,8 +260,6 @@ mlx5e_tls_init(struct mlx5e_priv *priv)
 	}
 
 	uma_zone_set_max(ptls->zone, ptls->zone_max);
-	if (prealloc_tags != 0)
-		mlx5e_prealloc_tags(priv, ptls->zone_max);
 
 	for (x = 0; x != MLX5E_TLS_STATS_NUM; x++)
 		ptls->stats.arg[x] = counter_u64_alloc(M_WAITOK);
@@ -271,6 +285,23 @@ mlx5e_tls_init(struct mlx5e_priv *priv)
 }
 
 void
+mlx5e_tls_prealloc_tags(struct mlx5e_priv *priv)
+{
+	struct mlx5e_tls *ptls = &priv->tls;
+	int prealloc_tags = 0;
+
+	if (ptls->prealloc_wq != NULL)
+		return;
+
+	TUNABLE_INT_FETCH("hw.mlx5.tls_prealloc_tags", &prealloc_tags);
+	if (prealloc_tags == 0)
+		return;
+	ptls->prealloc_wq = create_singlethread_workqueue("mlx5-tls-prealloc_wq");
+	INIT_WORK(&ptls->prealloc_work, mlx5e_tls_prealloc_work);
+	queue_work(ptls->prealloc_wq, &ptls->prealloc_work);
+}
+
+void
 mlx5e_tls_cleanup(struct mlx5e_priv *priv)
 {
 	struct mlx5e_tls *ptls = &priv->tls;
@@ -280,6 +311,10 @@ mlx5e_tls_cleanup(struct mlx5e_priv *priv)
 		return;
 
 	ptls->init = 0;
+	if (ptls->prealloc_wq != NULL) {
+		flush_workqueue(ptls->prealloc_wq);
+		destroy_workqueue(ptls->prealloc_wq);
+	}
 	flush_workqueue(ptls->wq);
 	sysctl_ctx_free(&ptls->ctx);
 	uma_zdestroy(ptls->zone);
diff --git a/sys/dev/mlx5/mlx5_en/mlx5_en_main.c b/sys/dev/mlx5/mlx5_en/mlx5_en_main.c
index f83506bda1aa..4658bebb7845 100644
--- a/sys/dev/mlx5/mlx5_en/mlx5_en_main.c
+++ b/sys/dev/mlx5/mlx5_en/mlx5_en_main.c
@@ -3335,6 +3335,11 @@ mlx5e_open_locked(if_t ifp)
 
 	mlx5e_update_carrier(priv);
 
+#ifdef KERN_TLS
+	if ((if_getcapenable(ifp) & (IFCAP_TXTLS4 | IFCAP_TXTLS6)) != 0)
+		mlx5e_tls_prealloc_tags(priv);
+#endif
+
 	return (0);
 
 err_close_channels: