The branch main has been updated by kib:
URL:
https://cgit.FreeBSD.org/src/commit/?id=9a7096ff547de2b5a09c5a4683853568e08c2f8a
commit 9a7096ff547de2b5a09c5a4683853568e08c2f8a
Author: Konstantin Belousov <k...@freebsd.org>
AuthorDate: 2024-07-19 19:15:35 +0000
Commit: Konstantin Belousov <k...@freebsd.org>
CommitDate: 2024-07-21 08:53:19 +0000
ipsec_offload: hide SA/SP offload lifecycle prints under verbose sysctl
Reported and reviewed by: kp
Discussed with: np
Sponsored by: NVIDIA networking
Differential revision: https://reviews.freebsd.org/D46045
---
sys/netipsec/ipsec_offload.c | 58 +++++++++++++++++++++++++++++++-------------
1 file changed, 41 insertions(+), 17 deletions(-)
diff --git a/sys/netipsec/ipsec_offload.c b/sys/netipsec/ipsec_offload.c
index 48082830b88b..8ccae7a94f2a 100644
--- a/sys/netipsec/ipsec_offload.c
+++ b/sys/netipsec/ipsec_offload.c
@@ -35,9 +35,12 @@
#include <sys/pctrie.h>
#include <sys/proc.h>
#include <sys/socket.h>
+#include <sys/sysctl.h>
#include <sys/protosw.h>
#include <sys/taskqueue.h>
+#include <machine/stdarg.h>
+
#include <net/if.h>
#include <net/if_var.h>
#include <net/vnet.h>
@@ -190,6 +193,27 @@ ipsec_accel_fini(void *arg)
SYSUNINIT(ipsec_accel_fini, SI_SUB_VNET_DONE, SI_ORDER_ANY,
ipsec_accel_fini, NULL);
+SYSCTL_NODE(_net_inet_ipsec, OID_AUTO, offload, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
+ "");
+
+static bool ipsec_offload_verbose = false;
+SYSCTL_BOOL(_net_inet_ipsec_offload, OID_AUTO, verbose, CTLFLAG_RW,
+ &ipsec_offload_verbose, 0,
+ "Verbose SA/SP offload install and deinstall");
+
+static void
+dprintf(const char *fmt, ...)
+{
+ va_list ap;
+
+ if (!ipsec_offload_verbose)
+ return;
+
+ va_start(ap, fmt);
+ vprintf(fmt, ap);
+ va_end(ap);
+}
+
static void
ipsec_accel_alloc_forget_tq(struct secasvar *sav)
{
@@ -209,7 +233,7 @@ ipsec_accel_sa_install_match(if_t ifp, void *arg)
if ((ifp->if_capenable2 & IFCAP2_BIT(IFCAP2_IPSEC_OFFLOAD)) == 0)
return (false);
if (ifp->if_ipsec_accel_m->if_sa_newkey == NULL) {
- printf("driver bug ifp %s if_sa_newkey NULL\n",
+ dprintf("driver bug ifp %s if_sa_newkey NULL\n",
if_name(ifp));
return (false);
}
@@ -226,7 +250,7 @@ ipsec_accel_sa_newkey_cb(if_t ifp, void *arg)
tq = arg;
- printf("ipsec_accel_sa_newkey_act: ifp %s h %p spi %#x "
+ dprintf("ipsec_accel_sa_newkey_act: ifp %s h %p spi %#x "
"flags %#x seq %d\n",
if_name(ifp), ifp->if_ipsec_accel_m->if_sa_newkey,
be32toh(tq->sav->spi), tq->sav->flags, tq->sav->seq);
@@ -240,7 +264,7 @@ ipsec_accel_sa_newkey_cb(if_t ifp, void *arg)
}
if (drv_spi == -1) {
/* XXXKIB */
- printf("ipsec_accel_sa_install_newkey: cannot alloc "
+ dprintf("ipsec_accel_sa_install_newkey: cannot alloc "
"drv_spi if %s spi %#x\n", if_name(ifp),
be32toh(tq->sav->spi));
return (ENOMEM);
@@ -249,14 +273,14 @@ ipsec_accel_sa_newkey_cb(if_t ifp, void *arg)
drv_spi, &priv);
if (error != 0) {
if (error == EOPNOTSUPP) {
- printf("ipsec_accel_sa_newkey: driver "
+ dprintf("ipsec_accel_sa_newkey: driver "
"refused sa if %s spi %#x\n",
if_name(ifp), be32toh(tq->sav->spi));
error = ipsec_accel_handle_sav(tq->sav,
ifp, drv_spi, priv, IFP_HS_REJECTED, NULL);
/* XXXKIB */
} else {
- printf("ipsec_accel_sa_newkey: driver "
+ dprintf("ipsec_accel_sa_newkey: driver "
"error %d if %s spi %#x\n",
error, if_name(ifp), be32toh(tq->sav->spi));
/* XXXKIB */
@@ -266,7 +290,7 @@ ipsec_accel_sa_newkey_cb(if_t ifp, void *arg)
drv_spi, priv, IFP_HS_HANDLED, NULL);
if (error != 0) {
/* XXXKIB */
- printf("ipsec_accel_sa_newkey: handle_sav "
+ dprintf("ipsec_accel_sa_newkey: handle_sav "
"err %d if %s spi %#x\n", error,
if_name(ifp), be32toh(tq->sav->spi));
}
@@ -324,13 +348,13 @@ ipsec_accel_sa_newkey_impl(struct secasvar *sav)
SADB_KEY_ACCEL_DEINST)) != 0)
return;
- printf(
+ dprintf(
"ipsec_accel_sa_install_newkey: spi %#x flags %#x seq %d\n",
be32toh(sav->spi), sav->flags, sav->seq);
tq = malloc(sizeof(*tq), M_TEMP, M_NOWAIT);
if (tq == NULL) {
- printf("ipsec_accel_sa_install_newkey: no memory for tq, "
+ dprintf("ipsec_accel_sa_install_newkey: no memory for tq, "
"spi %#x\n", be32toh(sav->spi));
/* XXXKIB */
return;
@@ -403,7 +427,7 @@ ipsec_accel_forget_handle_sav(struct ifp_handle_sav *i,
bool freesav)
sav = i->sav;
if ((i->flags & (IFP_HS_HANDLED | IFP_HS_REJECTED)) ==
IFP_HS_HANDLED) {
- printf("sa deinstall %s %p spi %#x ifl %#x\n",
+ dprintf("sa deinstall %s %p spi %#x ifl %#x\n",
if_name(ifp), sav, be32toh(sav->spi), i->flags);
ifp->if_ipsec_accel_m->if_sa_deinstall(ifp,
i->drv_spi, i->ifdata);
@@ -597,18 +621,18 @@ ipsec_accel_spdadd_cb(if_t ifp, void *arg)
sp = arg;
inp = sp->ipsec_accel_add_sp_inp;
- printf("ipsec_accel_spdadd_cb: ifp %s m %p sp %p inp %p\n",
+ dprintf("ipsec_accel_spdadd_cb: ifp %s m %p sp %p inp %p\n",
if_name(ifp), ifp->if_ipsec_accel_m->if_spdadd, sp, inp);
error = ipsec_accel_remember_sp(sp, ifp, &i);
if (error != 0) {
- printf("ipsec_accel_spdadd: %s if_spdadd %p remember res %d\n",
+ dprintf("ipsec_accel_spdadd: %s if_spdadd %p remember res %d\n",
if_name(ifp), sp, error);
return (error);
}
error = ifp->if_ipsec_accel_m->if_spdadd(ifp, sp, inp, &i->ifdata);
if (error != 0) {
i->flags |= IFP_HP_REJECTED;
- printf("ipsec_accel_spdadd: %s if_spdadd %p res %d\n",
+ dprintf("ipsec_accel_spdadd: %s if_spdadd %p res %d\n",
if_name(ifp), sp, error);
}
return (error);
@@ -676,11 +700,11 @@ ipsec_accel_spddel_act(void *arg, int pending)
NET_EPOCH_WAIT();
if ((i->flags & (IFP_HP_HANDLED | IFP_HP_REJECTED)) ==
IFP_HP_HANDLED) {
- printf("spd deinstall %s %p\n", if_name(i->ifp), sp);
+ dprintf("spd deinstall %s %p\n", if_name(i->ifp), sp);
error = i->ifp->if_ipsec_accel_m->if_spddel(i->ifp,
sp, i->ifdata);
if (error != 0) {
- printf(
+ dprintf(
"ipsec_accel_spddel: %s if_spddel %p res %d\n",
if_name(i->ifp), sp, error);
}
@@ -741,12 +765,12 @@ ipsec_accel_on_ifdown_sp(struct ifnet *ifp)
NET_EPOCH_WAIT();
if ((i->flags & (IFP_HP_HANDLED | IFP_HP_REJECTED)) ==
IFP_HP_HANDLED) {
- printf("spd deinstall %s %p\n", if_name(ifp), sp);
+ dprintf("spd deinstall %s %p\n", if_name(ifp), sp);
error = ifp->if_ipsec_accel_m->if_spddel(ifp,
sp, i->ifdata);
}
if (error != 0) {
- printf(
+ dprintf(
"ipsec_accel_on_ifdown_sp: %s if_spddel %p res %d\n",
if_name(ifp), sp, error);
}
@@ -894,7 +918,7 @@ ipsec_accel_input(struct mbuf *m, int offset, int proto)
if (tag->drv_spi < IPSEC_ACCEL_DRV_SPI_MIN ||
tag->drv_spi > IPSEC_ACCEL_DRV_SPI_MAX) {
- printf("if %s mbuf %p drv_spi %d invalid, packet dropped\n",
+ dprintf("if %s mbuf %p drv_spi %d invalid, packet dropped\n",
(m->m_flags & M_PKTHDR) != 0 ? if_name(m->m_pkthdr.rcvif) :
"<unknwn>", m, tag->drv_spi);
m_freem(m);
