1 /* 2 * Copyright (c) 2017 Mellanox Technologies. All rights reserved. 3 * 4 * This software is available to you under a choice of one of two 5 * licenses. You may choose to be licensed under the terms of the GNU 6 * General Public License (GPL) Version 2, available from the file 7 * COPYING in the main directory of this source tree, or the 8 * OpenIB.org BSD license below: 9 * 10 * Redistribution and use in source and binary forms, with or 11 * without modification, are permitted provided that the following 12 * conditions are met: 13 * 14 * - Redistributions of source code must retain the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer. 17 * 18 * - Redistributions in binary form must reproduce the above 19 * copyright notice, this list of conditions and the following 20 * disclaimer in the documentation and/or other materials 21 * provided with the distribution. 22 * 23 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 24 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 25 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 26 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS 27 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 28 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 29 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 30 * SOFTWARE. 31 * 32 */ 33 34 #ifndef __MLX5E_IPSEC_RXTX_H__ 35 #define __MLX5E_IPSEC_RXTX_H__ 36 37 #include <linux/skbuff.h> 38 #include <net/xfrm.h> 39 #include "en.h" 40 #include "en/txrx.h" 41 42 /* Bit31: IPsec marker, Bit30: reserved, Bit29-24: IPsec syndrome, Bit23-0: IPsec obj id */ 43 #define MLX5_IPSEC_METADATA_MARKER(metadata) (((metadata) >> 31) & 0x1) 44 #define MLX5_IPSEC_METADATA_SYNDROM(metadata) (((metadata) >> 24) & GENMASK(5, 0)) 45 #define MLX5_IPSEC_METADATA_HANDLE(metadata) ((metadata) & GENMASK(23, 0)) 46 #define MLX5_IPSEC_METADATA_CREATE(id, syndrome) ((id) | ((syndrome) << 24)) 47 48 struct mlx5e_accel_tx_ipsec_state { 49 struct xfrm_offload *xo; 50 struct xfrm_state *x; 51 u32 tailen; 52 u32 plen; 53 }; 54 55 #ifdef CONFIG_MLX5_EN_IPSEC 56 57 void mlx5e_ipsec_set_iv_esn(struct sk_buff *skb, struct xfrm_state *x, 58 struct xfrm_offload *xo); 59 void mlx5e_ipsec_set_iv(struct sk_buff *skb, struct xfrm_state *x, 60 struct xfrm_offload *xo); 61 bool mlx5e_ipsec_handle_tx_skb(struct net_device *netdev, 62 struct sk_buff *skb, 63 struct mlx5e_accel_tx_ipsec_state *ipsec_st); 64 void mlx5e_ipsec_handle_tx_wqe(struct mlx5e_tx_wqe *wqe, 65 struct mlx5e_accel_tx_ipsec_state *ipsec_st, 66 struct mlx5_wqe_inline_seg *inlseg); 67 void mlx5e_ipsec_offload_handle_rx_skb(struct net_device *netdev, 68 struct sk_buff *skb, 69 u32 ipsec_meta_data); 70 int mlx5_esw_ipsec_rx_make_metadata(struct mlx5e_priv *priv, u32 id, u32 *metadata); 71 static inline unsigned int mlx5e_ipsec_tx_ids_len(struct mlx5e_accel_tx_ipsec_state *ipsec_st) 72 { 73 return ipsec_st->tailen; 74 } 75 76 static inline bool mlx5_ipsec_is_rx_flow(struct mlx5_cqe64 *cqe) 77 { 78 return MLX5_IPSEC_METADATA_MARKER(be32_to_cpu(cqe->ft_metadata)); 79 } 80 81 static inline bool mlx5e_ipsec_eseg_meta(struct mlx5_wqe_eth_seg *eseg) 82 { 83 return eseg->flow_table_metadata & cpu_to_be32(MLX5_ETH_WQE_FT_META_IPSEC); 84 } 85 86 void mlx5e_ipsec_tx_build_eseg(struct mlx5e_priv *priv, struct sk_buff *skb, 87 struct mlx5_wqe_eth_seg *eseg); 88 89 static inline netdev_features_t 90 mlx5e_ipsec_feature_check(struct sk_buff *skb, netdev_features_t features) 91 { 92 struct xfrm_offload *xo = xfrm_offload(skb); 93 struct sec_path *sp = skb_sec_path(skb); 94 95 if (sp && sp->len && xo) { 96 struct xfrm_state *x = sp->xvec[0]; 97 98 if (!x || !x->xso.offload_handle) 99 goto out_disable; 100 101 if (xo->inner_ipproto) { 102 /* Cannot support tunnel packet over IPsec tunnel mode 103 * because we cannot offload three IP header csum 104 */ 105 if (x->props.mode == XFRM_MODE_TUNNEL) 106 goto out_disable; 107 108 /* Only support UDP or TCP L4 checksum */ 109 if (xo->inner_ipproto != IPPROTO_UDP && 110 xo->inner_ipproto != IPPROTO_TCP) 111 goto out_disable; 112 } 113 114 return features; 115 116 } 117 118 /* Disable CSUM and GSO for software IPsec */ 119 out_disable: 120 return features & ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK); 121 } 122 123 static inline bool 124 mlx5e_ipsec_txwqe_build_eseg_csum(struct mlx5e_txqsq *sq, struct sk_buff *skb, 125 struct mlx5_wqe_eth_seg *eseg) 126 { 127 u8 inner_ipproto; 128 129 if (!mlx5e_ipsec_eseg_meta(eseg)) 130 return false; 131 132 eseg->cs_flags = MLX5_ETH_WQE_L3_CSUM; 133 inner_ipproto = xfrm_offload(skb)->inner_ipproto; 134 if (inner_ipproto) { 135 eseg->cs_flags |= MLX5_ETH_WQE_L3_INNER_CSUM; 136 if (inner_ipproto == IPPROTO_TCP || inner_ipproto == IPPROTO_UDP) 137 eseg->cs_flags |= MLX5_ETH_WQE_L4_INNER_CSUM; 138 } else if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) { 139 eseg->cs_flags |= MLX5_ETH_WQE_L4_CSUM; 140 sq->stats->csum_partial_inner++; 141 } 142 143 return true; 144 } 145 #else 146 static inline 147 void mlx5e_ipsec_offload_handle_rx_skb(struct net_device *netdev, 148 struct sk_buff *skb, 149 u32 ipsec_meta_data) 150 {} 151 152 static inline bool mlx5e_ipsec_eseg_meta(struct mlx5_wqe_eth_seg *eseg) 153 { 154 return false; 155 } 156 157 static inline bool mlx5_ipsec_is_rx_flow(struct mlx5_cqe64 *cqe) { return false; } 158 static inline netdev_features_t 159 mlx5e_ipsec_feature_check(struct sk_buff *skb, netdev_features_t features) 160 { return features & ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK); } 161 162 static inline bool 163 mlx5e_ipsec_txwqe_build_eseg_csum(struct mlx5e_txqsq *sq, struct sk_buff *skb, 164 struct mlx5_wqe_eth_seg *eseg) 165 { 166 return false; 167 } 168 #endif /* CONFIG_MLX5_EN_IPSEC */ 169 170 #endif /* __MLX5E_IPSEC_RXTX_H__ */ 171