1 /*
2 * Copyright (c) 2017 Mellanox Technologies. All rights reserved.
3 *
4 * This software is available to you under a choice of one of two
5 * licenses. You may choose to be licensed under the terms of the GNU
6 * General Public License (GPL) Version 2, available from the file
7 * COPYING in the main directory of this source tree, or the
8 * OpenIB.org BSD license below:
9 *
10 * Redistribution and use in source and binary forms, with or
11 * without modification, are permitted provided that the following
12 * conditions are met:
13 *
14 * - Redistributions of source code must retain the above
15 * copyright notice, this list of conditions and the following
16 * disclaimer.
17 *
18 * - Redistributions in binary form must reproduce the above
19 * copyright notice, this list of conditions and the following
20 * disclaimer in the documentation and/or other materials
21 * provided with the distribution.
22 *
23 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
24 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
25 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
26 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
27 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
28 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
29 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
30 * SOFTWARE.
31 *
32 */
33
34 #ifndef __MLX5E_IPSEC_RXTX_H__
35 #define __MLX5E_IPSEC_RXTX_H__
36
37 #include <linux/skbuff.h>
38 #include <net/xfrm.h>
39 #include "en.h"
40 #include "en/txrx.h"
41
42 /* Bit31: IPsec marker, Bit30: reserved, Bit29-24: IPsec syndrome, Bit23-0: IPsec obj id */
43 #define MLX5_IPSEC_METADATA_MARKER(metadata) (((metadata) >> 31) & 0x1)
44 #define MLX5_IPSEC_METADATA_SYNDROM(metadata) (((metadata) >> 24) & GENMASK(5, 0))
45 #define MLX5_IPSEC_METADATA_HANDLE(metadata) ((metadata) & GENMASK(23, 0))
46 #define MLX5_IPSEC_METADATA_CREATE(id, syndrome) ((id) | ((syndrome) << 24))
47
48 struct mlx5e_accel_tx_ipsec_state {
49 struct xfrm_offload *xo;
50 struct xfrm_state *x;
51 u32 tailen;
52 u32 plen;
53 };
54
55 #ifdef CONFIG_MLX5_EN_IPSEC
56
57 void mlx5e_ipsec_inverse_table_init(void);
58 void mlx5e_ipsec_set_iv_esn(struct sk_buff *skb, struct xfrm_state *x,
59 struct xfrm_offload *xo);
60 void mlx5e_ipsec_set_iv(struct sk_buff *skb, struct xfrm_state *x,
61 struct xfrm_offload *xo);
62 bool mlx5e_ipsec_handle_tx_skb(struct net_device *netdev,
63 struct sk_buff *skb,
64 struct mlx5e_accel_tx_ipsec_state *ipsec_st);
65 void mlx5e_ipsec_handle_tx_wqe(struct mlx5e_tx_wqe *wqe,
66 struct mlx5e_accel_tx_ipsec_state *ipsec_st,
67 struct mlx5_wqe_inline_seg *inlseg);
68 void mlx5e_ipsec_offload_handle_rx_skb(struct net_device *netdev,
69 struct sk_buff *skb,
70 u32 ipsec_meta_data);
71 int mlx5_esw_ipsec_rx_make_metadata(struct mlx5e_priv *priv, u32 id, u32 *metadata);
mlx5e_ipsec_tx_ids_len(struct mlx5e_accel_tx_ipsec_state * ipsec_st)72 static inline unsigned int mlx5e_ipsec_tx_ids_len(struct mlx5e_accel_tx_ipsec_state *ipsec_st)
73 {
74 return ipsec_st->tailen;
75 }
76
mlx5_ipsec_is_rx_flow(struct mlx5_cqe64 * cqe)77 static inline bool mlx5_ipsec_is_rx_flow(struct mlx5_cqe64 *cqe)
78 {
79 return MLX5_IPSEC_METADATA_MARKER(be32_to_cpu(cqe->ft_metadata));
80 }
81
mlx5e_ipsec_eseg_meta(struct mlx5_wqe_eth_seg * eseg)82 static inline bool mlx5e_ipsec_eseg_meta(struct mlx5_wqe_eth_seg *eseg)
83 {
84 return eseg->flow_table_metadata & cpu_to_be32(MLX5_ETH_WQE_FT_META_IPSEC);
85 }
86
87 void mlx5e_ipsec_tx_build_eseg(struct mlx5e_priv *priv, struct sk_buff *skb,
88 struct mlx5_wqe_eth_seg *eseg);
89
90 static inline netdev_features_t
mlx5e_ipsec_feature_check(struct sk_buff * skb,netdev_features_t features)91 mlx5e_ipsec_feature_check(struct sk_buff *skb, netdev_features_t features)
92 {
93 struct xfrm_offload *xo = xfrm_offload(skb);
94 struct sec_path *sp = skb_sec_path(skb);
95
96 if (sp && sp->len && xo) {
97 struct xfrm_state *x = sp->xvec[0];
98
99 if (!x || !x->xso.offload_handle)
100 goto out_disable;
101
102 if (xo->inner_ipproto) {
103 /* Cannot support tunnel packet over IPsec tunnel mode
104 * because we cannot offload three IP header csum
105 */
106 if (x->props.mode == XFRM_MODE_TUNNEL)
107 goto out_disable;
108
109 /* Only support UDP or TCP L4 checksum */
110 if (xo->inner_ipproto != IPPROTO_UDP &&
111 xo->inner_ipproto != IPPROTO_TCP)
112 goto out_disable;
113 }
114
115 return features;
116
117 }
118
119 /* Disable CSUM and GSO for software IPsec */
120 out_disable:
121 return features & ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK);
122 }
123
124 static inline bool
mlx5e_ipsec_txwqe_build_eseg_csum(struct mlx5e_txqsq * sq,struct sk_buff * skb,struct mlx5_wqe_eth_seg * eseg)125 mlx5e_ipsec_txwqe_build_eseg_csum(struct mlx5e_txqsq *sq, struct sk_buff *skb,
126 struct mlx5_wqe_eth_seg *eseg)
127 {
128 u8 inner_ipproto;
129
130 if (!mlx5e_ipsec_eseg_meta(eseg))
131 return false;
132
133 eseg->cs_flags = MLX5_ETH_WQE_L3_CSUM;
134 inner_ipproto = xfrm_offload(skb)->inner_ipproto;
135 if (inner_ipproto) {
136 eseg->cs_flags |= MLX5_ETH_WQE_L3_INNER_CSUM;
137 if (inner_ipproto == IPPROTO_TCP || inner_ipproto == IPPROTO_UDP)
138 eseg->cs_flags |= MLX5_ETH_WQE_L4_INNER_CSUM;
139 } else if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) {
140 eseg->cs_flags |= MLX5_ETH_WQE_L4_CSUM;
141 sq->stats->csum_partial_inner++;
142 }
143
144 return true;
145 }
146 #else
147 static inline
mlx5e_ipsec_offload_handle_rx_skb(struct net_device * netdev,struct sk_buff * skb,u32 ipsec_meta_data)148 void mlx5e_ipsec_offload_handle_rx_skb(struct net_device *netdev,
149 struct sk_buff *skb,
150 u32 ipsec_meta_data)
151 {}
152
mlx5e_ipsec_eseg_meta(struct mlx5_wqe_eth_seg * eseg)153 static inline bool mlx5e_ipsec_eseg_meta(struct mlx5_wqe_eth_seg *eseg)
154 {
155 return false;
156 }
157
mlx5_ipsec_is_rx_flow(struct mlx5_cqe64 * cqe)158 static inline bool mlx5_ipsec_is_rx_flow(struct mlx5_cqe64 *cqe) { return false; }
159 static inline netdev_features_t
mlx5e_ipsec_feature_check(struct sk_buff * skb,netdev_features_t features)160 mlx5e_ipsec_feature_check(struct sk_buff *skb, netdev_features_t features)
161 { return features & ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK); }
162
163 static inline bool
mlx5e_ipsec_txwqe_build_eseg_csum(struct mlx5e_txqsq * sq,struct sk_buff * skb,struct mlx5_wqe_eth_seg * eseg)164 mlx5e_ipsec_txwqe_build_eseg_csum(struct mlx5e_txqsq *sq, struct sk_buff *skb,
165 struct mlx5_wqe_eth_seg *eseg)
166 {
167 return false;
168 }
169 #endif /* CONFIG_MLX5_EN_IPSEC */
170
171 #endif /* __MLX5E_IPSEC_RXTX_H__ */
172
