1 files changed, 54 insertions, 58 deletions

diff --git a/src/vnet/ipsec/esp_encrypt.c b/src/vnet/ipsec/esp_encrypt.c
index 9a1c0f1e744..f5461684166 100644
--- a/src/vnet/ipsec/esp_encrypt.c
+++ b/src/vnet/ipsec/esp_encrypt.c
@@ -28,7 +28,6 @@
 #define foreach_esp_encrypt_next                   \
 _(DROP4, "ip4-drop")                               \
 _(DROP6, "ip6-drop")                               \
-_(PENDING, "pending")                              \
 _(HANDOFF4, "handoff4")                            \
 _(HANDOFF6, "handoff6")                            \
 _(INTERFACE_OUTPUT, "interface-output")
@@ -474,7 +473,7 @@ esp_prepare_async_frame (vlib_main_t * vm, ipsec_per_thread_data_t * ptd,
 			 vnet_crypto_async_frame_t ** async_frame,
 			 ipsec_sa_t * sa, vlib_buffer_t * b,
 			 esp_header_t * esp, u8 * payload, u32 payload_len,
-			 u8 iv_sz, u8 icv_sz, u32 bi, u16 * next, u32 hdr_len,
+			 u8 iv_sz, u8 icv_sz, u32 bi, u16 next, u32 hdr_len,
 			 u16 async_next, vlib_buffer_t * lb)
 {
   esp_post_data_t *post = esp_post_data (b);
@@ -484,8 +483,7 @@ esp_prepare_async_frame (vlib_main_t * vm, ipsec_per_thread_data_t * ptd,
   i16 crypto_start_offset, integ_start_offset = 0;
   u16 crypto_total_len, integ_total_len;
 
-  post->next_index = next[0];
-  next[0] = ESP_ENCRYPT_NEXT_PENDING;
+  post->next_index = next;
 
   /* crypto */
   crypto_start_offset = payload - b->data;
@@ -555,21 +553,6 @@ out:
 					 iv, tag, aad, flag);
 }
 
-/* when submitting a frame is failed, drop all buffers in the frame */
-static_always_inline void
-esp_async_recycle_failed_submit (vnet_crypto_async_frame_t * f,
-				 vlib_buffer_t ** b, u16 * next,
-				 u16 drop_next)
-{
-  u32 n_drop = f->n_elts;
-  while (--n_drop)
-    {
-      (b - n_drop)[0]->error = ESP_ENCRYPT_ERROR_CRYPTO_ENGINE_ERROR;
-      (next - n_drop)[0] = drop_next;
-    }
-  vnet_crypto_async_reset_frame (f);
-}
-
 always_inline uword
 esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 		    vlib_frame_t * frame, int is_ip6, int is_tun,
@@ -595,6 +578,7 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
   int is_async = im->async_mode;
   vnet_crypto_async_op_id_t last_async_op = ~0;
   u16 drop_next = (is_ip6 ? ESP_ENCRYPT_NEXT_DROP6 : ESP_ENCRYPT_NEXT_DROP4);
+  u16 n_async_drop = 0;
 
   vlib_get_buffers (vm, from, b, n_left);
   if (!is_async)
@@ -663,10 +647,11 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	    {
 	      if (async_frame && async_frame->n_elts)
 		{
-		  if (vnet_crypto_async_submit_open_frame (vm, async_frame)
-		      < 0)
-		    esp_async_recycle_failed_submit (async_frame, b,
-						     next, drop_next);
+		  if (vnet_crypto_async_submit_open_frame (vm, async_frame))
+		    esp_async_recycle_failed_submit (async_frame, b, from,
+						     nexts, &n_async_drop,
+						     drop_next,
+						     ESP_ENCRYPT_ERROR_CRYPTO_ENGINE_ERROR);
 		}
 	      async_frame =
 		vnet_crypto_async_get_frame (vm, sa0->crypto_async_enc_op_id);
@@ -685,8 +670,10 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 
       if (PREDICT_TRUE (thread_index != sa0->encrypt_thread_index))
 	{
-	  next[0] = (is_ip6 ?
-		     ESP_ENCRYPT_NEXT_HANDOFF6 : ESP_ENCRYPT_NEXT_HANDOFF4);
+	  esp_set_next_index (is_async, from, nexts, from[b - bufs],
+			      &n_async_drop,
+			      (is_ip6 ? ESP_ENCRYPT_NEXT_HANDOFF6 :
+			       ESP_ENCRYPT_NEXT_HANDOFF4), next);
 	  goto trace;
 	}
 
@@ -695,7 +682,8 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
       if (n_bufs == 0)
 	{
 	  b[0]->error = node->errors[ESP_ENCRYPT_ERROR_NO_BUFFERS];
-	  next[0] = drop_next;
+	  esp_set_next_index (is_async, from, nexts, from[b - bufs],
+			      &n_async_drop, drop_next, next);
 	  goto trace;
 	}
 
@@ -709,7 +697,8 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
       if (PREDICT_FALSE (esp_seq_advance (sa0)))
 	{
 	  b[0]->error = node->errors[ESP_ENCRYPT_ERROR_SEQ_CYCLED];
-	  next[0] = drop_next;
+	  esp_set_next_index (is_async, from, nexts, from[b - bufs],
+			      &n_async_drop, drop_next, next);
 	  goto trace;
 	}
 
@@ -727,7 +716,8 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 	  if (!next_hdr_ptr)
 	    {
 	      b[0]->error = node->errors[ESP_ENCRYPT_ERROR_NO_BUFFERS];
-	      next[0] = drop_next;
+	      esp_set_next_index (is_async, from, nexts, from[b - bufs],
+				  &n_async_drop, drop_next, next);
 	      goto trace;
 	    }
 	  b[0]->flags &= ~VLIB_BUFFER_TOTAL_LENGTH_VALID;
@@ -801,7 +791,11 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
 						 vlib_buffer_length_in_chain
 						 (vm, b[0]));
 	  if (!next_hdr_ptr)
-	    goto trace;
+	    {
+	      esp_set_next_index (is_async, from, nexts, from[b - bufs],
+				  &n_async_drop, drop_next, next);
+	      goto trace;
+	    }
 
 	  b[0]->flags &= ~VLIB_BUFFER_TOTAL_LENGTH_VALID;
 	  payload_len = b[0]->current_length;
@@ -894,15 +888,25 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
       if (is_async)
 	{
 	  if (PREDICT_FALSE (sa0->crypto_async_enc_op_id == 0))
-	    goto trace;
+	    {
+	      esp_set_next_index (is_async, from, nexts, from[b - bufs],
+				  &n_async_drop, drop_next, next);
+	      goto trace;
+	    }
 
 	  if (esp_prepare_async_frame (vm, ptd, &async_frame, sa0, b[0], esp,
 				       payload, payload_len, iv_sz,
-				       icv_sz, from[b - bufs], next, hdr_len,
-				       async_next, lb))
+				       icv_sz, from[b - bufs], next[0],
+				       hdr_len, async_next, lb))
 	    {
-	      esp_async_recycle_failed_submit (async_frame, b, next,
-					       drop_next);
+	      /* The fail only caused by submission, free the whole frame. */
+	      if (async_frame->n_elts)
+		esp_async_recycle_failed_submit (async_frame, b, from, nexts,
+						 &n_async_drop, drop_next,
+						 ESP_ENCRYPT_ERROR_CRYPTO_ENGINE_ERROR);
+	      b[0]->error = ESP_ENCRYPT_ERROR_CRYPTO_ENGINE_ERROR;
+	      esp_set_next_index (1, from, nexts, from[b - bufs],
+				  &n_async_drop, drop_next, next);
 	      goto trace;
 	    }
 	}
@@ -950,10 +954,22 @@ esp_encrypt_inline (vlib_main_t * vm, vlib_node_runtime_t * node,
       esp_process_chained_ops (vm, node, ptd->chained_integ_ops, bufs, nexts,
 			       ptd->chunks, drop_next);
     }
-  else if (async_frame && async_frame->n_elts)
+  else
     {
-      if (vnet_crypto_async_submit_open_frame (vm, async_frame) < 0)
-	esp_async_recycle_failed_submit (async_frame, b, next, drop_next);
+      if (async_frame && async_frame->n_elts)
+	{
+	  if (vnet_crypto_async_submit_open_frame (vm, async_frame) < 0)
+	    esp_async_recycle_failed_submit (async_frame, b, from, nexts,
+					     &n_async_drop, drop_next,
+					     ESP_ENCRYPT_ERROR_CRYPTO_ENGINE_ERROR);
+	}
+      vlib_node_increment_counter (vm, node->node_index,
+				   ESP_ENCRYPT_ERROR_RX_PKTS,
+				   frame->n_vectors);
+      if (n_async_drop)
+	vlib_buffer_enqueue_to_next (vm, node, from, nexts, n_async_drop);
+
+      return frame->n_vectors;
     }
 
   vlib_node_increment_counter (vm, node->node_index,
@@ -1073,8 +1089,7 @@ VLIB_REGISTER_NODE (esp4_encrypt_node) = {
     [ESP_ENCRYPT_NEXT_DROP6] = "ip6-drop",
     [ESP_ENCRYPT_NEXT_HANDOFF4] = "esp4-encrypt-handoff",
     [ESP_ENCRYPT_NEXT_HANDOFF6] = "esp6-encrypt-handoff",
-    [ESP_ENCRYPT_NEXT_INTERFACE_OUTPUT] = "interface-output",
-    [ESP_ENCRYPT_NEXT_PENDING] = "esp-encrypt-pending",
+    [ESP_ENCRYPT_NEXT_INTERFACE_OUTPUT] = "interface-output"
   },
 };
 /* *INDENT-ON* */
@@ -1165,7 +1180,6 @@ VLIB_REGISTER_NODE (esp4_encrypt_tun_node) = {
     [ESP_ENCRYPT_NEXT_HANDOFF4] = "esp4-encrypt-tun-handoff",
     [ESP_ENCRYPT_NEXT_HANDOFF6] = "error-drop",
     [ESP_ENCRYPT_NEXT_INTERFACE_OUTPUT] = "adj-midchain-tx",
-    [ESP_ENCRYPT_NEXT_PENDING] = "esp-encrypt-pending",
   },
 };
 
@@ -1213,7 +1227,6 @@ VLIB_REGISTER_NODE (esp6_encrypt_tun_node) = {
     [ESP_ENCRYPT_NEXT_DROP6] = "ip6-drop",
     [ESP_ENCRYPT_NEXT_HANDOFF4] = "error-drop",
     [ESP_ENCRYPT_NEXT_HANDOFF6] = "esp6-encrypt-tun-handoff",
-    [ESP_ENCRYPT_NEXT_PENDING] = "esp-encrypt-pending",
     [ESP_ENCRYPT_NEXT_INTERFACE_OUTPUT] = "adj-midchain-tx",
   },
 };
@@ -1354,23 +1367,6 @@ VLIB_REGISTER_NODE (esp6_no_crypto_tun_node) =
 };
 /* *INDENT-ON* */
 
-VLIB_NODE_FN (esp_encrypt_pending_node) (vlib_main_t * vm,
-					 vlib_node_runtime_t * node,
-					 vlib_frame_t * from_frame)
-{
-  return from_frame->n_vectors;
-}
-
-/* *INDENT-OFF* */
-VLIB_REGISTER_NODE (esp_encrypt_pending_node) = {
-  .name = "esp-encrypt-pending",
-  .vector_size = sizeof (u32),
-  .type = VLIB_NODE_TYPE_INTERNAL,
-
-  .n_next_nodes = 0
-};
-/* *INDENT-ON* */
-
 /*
  * fd.io coding-style-patch-verification: ON
  *