Commit effbe267 authored by Leon Romanovsky's avatar Leon Romanovsky Committed by Saeed Mahameed

net/mlx5: Simplify IPsec capabilities logic

Reduce number of hard-coded IPsec capabilities by making sure
that mlx5_ipsec_device_caps() sets only supported bits.

As part of this change, remove _ACCEL_ notations from the capabilities
names as they represent IPsec-capable device, so it is aligned with
MLX5_CAP_IPSEC() macro. And prepare the code to IPsec full offload mode.
Reviewed-by: default avatarRaed Salem <raeds@nvidia.com>
Signed-off-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
parent a8444b0b
...@@ -215,7 +215,7 @@ static inline int mlx5e_xfrm_validate_state(struct xfrm_state *x) ...@@ -215,7 +215,7 @@ static inline int mlx5e_xfrm_validate_state(struct xfrm_state *x)
return -EINVAL; return -EINVAL;
} }
if (x->props.flags & XFRM_STATE_ESN && if (x->props.flags & XFRM_STATE_ESN &&
!(mlx5_ipsec_device_caps(priv->mdev) & MLX5_ACCEL_IPSEC_CAP_ESN)) { !(mlx5_ipsec_device_caps(priv->mdev) & MLX5_IPSEC_CAP_ESN)) {
netdev_info(netdev, "Cannot offload ESN xfrm states\n"); netdev_info(netdev, "Cannot offload ESN xfrm states\n");
return -EINVAL; return -EINVAL;
} }
...@@ -262,11 +262,6 @@ static inline int mlx5e_xfrm_validate_state(struct xfrm_state *x) ...@@ -262,11 +262,6 @@ static inline int mlx5e_xfrm_validate_state(struct xfrm_state *x)
netdev_info(netdev, "Cannot offload xfrm states with geniv other than seqiv\n"); netdev_info(netdev, "Cannot offload xfrm states with geniv other than seqiv\n");
return -EINVAL; return -EINVAL;
} }
if (x->props.family == AF_INET6 &&
!(mlx5_ipsec_device_caps(priv->mdev) & MLX5_ACCEL_IPSEC_CAP_IPV6)) {
netdev_info(netdev, "IPv6 xfrm state offload is not supported by this device\n");
return -EINVAL;
}
return 0; return 0;
} }
...@@ -457,12 +452,6 @@ void mlx5e_ipsec_build_netdev(struct mlx5e_priv *priv) ...@@ -457,12 +452,6 @@ void mlx5e_ipsec_build_netdev(struct mlx5e_priv *priv)
if (!mlx5_ipsec_device_caps(mdev)) if (!mlx5_ipsec_device_caps(mdev))
return; return;
if (!(mlx5_ipsec_device_caps(mdev) & MLX5_ACCEL_IPSEC_CAP_ESP) ||
!MLX5_CAP_ETH(mdev, swp)) {
mlx5_core_dbg(mdev, "mlx5e: ESP and SWP offload not supported\n");
return;
}
mlx5_core_info(mdev, "mlx5e: IPSec ESP acceleration enabled\n"); mlx5_core_info(mdev, "mlx5e: IPSec ESP acceleration enabled\n");
netdev->xfrmdev_ops = &mlx5e_ipsec_xfrmdev_ops; netdev->xfrmdev_ops = &mlx5e_ipsec_xfrmdev_ops;
netdev->features |= NETIF_F_HW_ESP; netdev->features |= NETIF_F_HW_ESP;
...@@ -476,8 +465,7 @@ void mlx5e_ipsec_build_netdev(struct mlx5e_priv *priv) ...@@ -476,8 +465,7 @@ void mlx5e_ipsec_build_netdev(struct mlx5e_priv *priv)
netdev->features |= NETIF_F_HW_ESP_TX_CSUM; netdev->features |= NETIF_F_HW_ESP_TX_CSUM;
netdev->hw_enc_features |= NETIF_F_HW_ESP_TX_CSUM; netdev->hw_enc_features |= NETIF_F_HW_ESP_TX_CSUM;
if (!(mlx5_ipsec_device_caps(mdev) & MLX5_ACCEL_IPSEC_CAP_LSO) || if (!MLX5_CAP_ETH(mdev, swp_lso)) {
!MLX5_CAP_ETH(mdev, swp_lso)) {
mlx5_core_dbg(mdev, "mlx5e: ESP LSO not supported\n"); mlx5_core_dbg(mdev, "mlx5e: ESP LSO not supported\n");
return; return;
} }
......
...@@ -102,12 +102,9 @@ struct mlx5_accel_esp_xfrm_attrs { ...@@ -102,12 +102,9 @@ struct mlx5_accel_esp_xfrm_attrs {
u8 is_ipv6; u8 is_ipv6;
}; };
enum mlx5_accel_ipsec_cap { enum mlx5_ipsec_cap {
MLX5_ACCEL_IPSEC_CAP_DEVICE = 1 << 0, MLX5_IPSEC_CAP_CRYPTO = 1 << 0,
MLX5_ACCEL_IPSEC_CAP_ESP = 1 << 1, MLX5_IPSEC_CAP_ESN = 1 << 1,
MLX5_ACCEL_IPSEC_CAP_IPV6 = 1 << 2,
MLX5_ACCEL_IPSEC_CAP_LSO = 1 << 3,
MLX5_ACCEL_IPSEC_CAP_ESN = 1 << 4,
}; };
struct mlx5e_priv; struct mlx5e_priv;
......
...@@ -7,7 +7,7 @@ ...@@ -7,7 +7,7 @@
u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev) u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev)
{ {
u32 caps; u32 caps = 0;
if (!MLX5_CAP_GEN(mdev, ipsec_offload)) if (!MLX5_CAP_GEN(mdev, ipsec_offload))
return 0; return 0;
...@@ -19,23 +19,23 @@ u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev) ...@@ -19,23 +19,23 @@ u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev)
MLX5_HCA_CAP_GENERAL_OBJECT_TYPES_IPSEC)) MLX5_HCA_CAP_GENERAL_OBJECT_TYPES_IPSEC))
return 0; return 0;
if (!MLX5_CAP_IPSEC(mdev, ipsec_crypto_offload) ||
!MLX5_CAP_ETH(mdev, insert_trailer))
return 0;
if (!MLX5_CAP_FLOWTABLE_NIC_TX(mdev, ipsec_encrypt) || if (!MLX5_CAP_FLOWTABLE_NIC_TX(mdev, ipsec_encrypt) ||
!MLX5_CAP_FLOWTABLE_NIC_RX(mdev, ipsec_decrypt)) !MLX5_CAP_FLOWTABLE_NIC_RX(mdev, ipsec_decrypt))
return 0; return 0;
caps = MLX5_ACCEL_IPSEC_CAP_DEVICE | MLX5_ACCEL_IPSEC_CAP_IPV6 | if (!MLX5_CAP_IPSEC(mdev, ipsec_crypto_esp_aes_gcm_128_encrypt) ||
MLX5_ACCEL_IPSEC_CAP_LSO; !MLX5_CAP_IPSEC(mdev, ipsec_crypto_esp_aes_gcm_128_decrypt))
return 0;
if (MLX5_CAP_IPSEC(mdev, ipsec_crypto_esp_aes_gcm_128_encrypt) && if (MLX5_CAP_IPSEC(mdev, ipsec_crypto_offload) &&
MLX5_CAP_IPSEC(mdev, ipsec_crypto_esp_aes_gcm_128_decrypt)) MLX5_CAP_ETH(mdev, insert_trailer) && MLX5_CAP_ETH(mdev, swp))
caps |= MLX5_ACCEL_IPSEC_CAP_ESP; caps |= MLX5_IPSEC_CAP_CRYPTO;
if (!caps)
return 0;
if (MLX5_CAP_IPSEC(mdev, ipsec_esn)) if (MLX5_CAP_IPSEC(mdev, ipsec_esn))
caps |= MLX5_ACCEL_IPSEC_CAP_ESN; caps |= MLX5_IPSEC_CAP_ESN;
/* We can accommodate up to 2^24 different IPsec objects /* We can accommodate up to 2^24 different IPsec objects
* because we use up to 24 bit in flow table metadata * because we use up to 24 bit in flow table metadata
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment