| /Linux-v6.6/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ |
| D | ipsec_fs.c | 8 #include "ipsec.h"
35 /* IPsec RX flow steering */
43 static struct mlx5e_ipsec_rx *ipsec_rx(struct mlx5e_ipsec *ipsec, u32 family, int type) in ipsec_rx() argument
45 if (ipsec->is_uplink_rep && type == XFRM_DEV_OFFLOAD_PACKET) in ipsec_rx()
46 return ipsec->rx_esw; in ipsec_rx()
49 return ipsec->rx_ipv4; in ipsec_rx()
51 return ipsec->rx_ipv6; in ipsec_rx()
54 static struct mlx5e_ipsec_tx *ipsec_tx(struct mlx5e_ipsec *ipsec, int type) in ipsec_tx() argument
56 if (ipsec->is_uplink_rep && type == XFRM_DEV_OFFLOAD_PACKET) in ipsec_tx()
57 return ipsec->tx_esw; in ipsec_tx()
[all …]
|
| D | ipsec.c | 42 #include "ipsec.h"
80 queue_delayed_work(sa_entry->ipsec->wq, &dwork->dwork, in mlx5e_ipsec_handle_tx_limit()
649 struct mlx5e_ipsec *ipsec; in mlx5e_xfrm_add_state() local
655 if (!priv->ipsec) in mlx5e_xfrm_add_state()
658 ipsec = priv->ipsec; in mlx5e_xfrm_add_state()
665 sa_entry->ipsec = ipsec; in mlx5e_xfrm_add_state()
714 err = xa_insert_bh(&ipsec->sadb, sa_entry->ipsec_obj_id, sa_entry, in mlx5e_xfrm_add_state()
722 queue_delayed_work(ipsec->wq, &sa_entry->dwork->dwork, in mlx5e_xfrm_add_state()
727 xa_set_mark(&ipsec->sadb, sa_entry->ipsec_obj_id, in mlx5e_xfrm_add_state()
756 struct mlx5e_ipsec *ipsec = sa_entry->ipsec; in mlx5e_xfrm_del_state() local
[all …]
|
| D | ipsec_offload.c | 6 #include "ipsec.h"
77 /* We can accommodate up to 2^24 different IPsec objects in mlx5_ipsec_device_caps()
79 * to hold the IPsec Object unique handle. in mlx5_ipsec_device_caps()
112 * be used in other places as long as IPsec packet offload in mlx5e_ipsec_packet_setup()
213 mlx5_core_dbg(mdev, "Failed to create IPsec object (err = %d)\n", err); in mlx5_ipsec_create_sa_ctx()
253 mlx5_core_err(mdev, "Query IPsec object failed (Object id %d), err = %d\n", in mlx5_modify_ipsec_obj()
361 struct mlx5e_ipsec *ipsec = sa_entry->ipsec; in mlx5e_ipsec_handle_limits() local
362 struct mlx5e_ipsec_aso *aso = ipsec->aso; in mlx5e_ipsec_handle_limits()
448 aso = sa_entry->ipsec->aso; in mlx5e_ipsec_handle_event()
474 struct mlx5e_ipsec *ipsec = container_of(nb, struct mlx5e_ipsec, nb); in mlx5e_ipsec_event() local
[all …]
|
| D | ipsec_stats.c | 38 #include "ipsec.h"
69 if (!priv->ipsec) in MLX5E_DECLARE_STATS_GRP_OP_NUM_STATS()
81 if (!priv->ipsec) in MLX5E_DECLARE_STATS_GRP_OP_FILL_STRS()
95 if (!priv->ipsec) in MLX5E_DECLARE_STATS_GRP_OP_FILL_STATS()
98 mlx5e_accel_ipsec_fs_read_stats(priv, &priv->ipsec->hw_stats); in MLX5E_DECLARE_STATS_GRP_OP_FILL_STATS()
100 data[idx++] = MLX5E_READ_CTR_ATOMIC64(&priv->ipsec->hw_stats, in MLX5E_DECLARE_STATS_GRP_OP_FILL_STATS()
108 return priv->ipsec ? NUM_IPSEC_SW_COUNTERS : 0; in MLX5E_DECLARE_STATS_GRP_OP_NUM_STATS()
117 if (priv->ipsec) in MLX5E_DECLARE_STATS_GRP_OP_FILL_STRS()
128 if (priv->ipsec) in MLX5E_DECLARE_STATS_GRP_OP_FILL_STATS()
130 data[idx++] = MLX5E_READ_CTR_ATOMIC64(&priv->ipsec->sw_stats, in MLX5E_DECLARE_STATS_GRP_OP_FILL_STATS()
|
| D | ipsec_rxtx.c | 37 #include "ipsec.h"
273 atomic64_inc(&priv->ipsec->sw_stats.ipsec_tx_drop_bundle); in mlx5e_ipsec_handle_tx_skb()
279 atomic64_inc(&priv->ipsec->sw_stats.ipsec_tx_drop_no_state); in mlx5e_ipsec_handle_tx_skb()
286 atomic64_inc(&priv->ipsec->sw_stats.ipsec_tx_drop_not_ip); in mlx5e_ipsec_handle_tx_skb()
292 atomic64_inc(&priv->ipsec->sw_stats.ipsec_tx_drop_trailer); in mlx5e_ipsec_handle_tx_skb()
318 struct mlx5e_ipsec *ipsec = priv->ipsec; in mlx5e_ipsec_offload_handle_rx_skb() local
327 atomic64_inc(&ipsec->sw_stats.ipsec_rx_drop_sp_alloc); in mlx5e_ipsec_offload_handle_rx_skb()
332 sa_entry = xa_load(&ipsec->sadb, sa_handle); in mlx5e_ipsec_offload_handle_rx_skb()
335 atomic64_inc(&ipsec->sw_stats.ipsec_rx_drop_sadb_miss); in mlx5e_ipsec_offload_handle_rx_skb()
358 atomic64_inc(&ipsec->sw_stats.ipsec_rx_drop_syndrome); in mlx5e_ipsec_offload_handle_rx_skb()
[all …]
|
| D | ipsec.h | 168 /* Protect ASO WQ access, as it is global to whole IPsec */
258 struct mlx5e_ipsec *ipsec; member
293 struct mlx5e_ipsec *ipsec; member
304 void mlx5e_accel_ipsec_fs_cleanup(struct mlx5e_ipsec *ipsec);
305 int mlx5e_accel_ipsec_fs_init(struct mlx5e_ipsec *ipsec);
321 int mlx5e_ipsec_aso_init(struct mlx5e_ipsec *ipsec);
322 void mlx5e_ipsec_aso_cleanup(struct mlx5e_ipsec *ipsec);
334 return sa_entry->ipsec->mdev; in mlx5e_ipsec_sa2dev()
340 return pol_entry->ipsec->mdev; in mlx5e_ipsec_pol2dev()
|
| D | en_accel.h | 114 struct mlx5e_accel_tx_ipsec_state ipsec; member
136 if (unlikely(!mlx5e_ipsec_handle_tx_skb(dev, skb, &state->ipsec))) in mlx5e_accel_tx_begin()
158 return mlx5e_ipsec_tx_ids_len(&state->ipsec); in mlx5e_accel_tx_ids_len()
198 state->ipsec.xo && state->ipsec.tailen) in mlx5e_accel_tx_finish()
199 mlx5e_ipsec_handle_tx_wqe(wqe, &state->ipsec, inlseg); in mlx5e_accel_tx_finish()
|
| D | ipsec_rxtx.h | 42 /* Bit31: IPsec marker, Bit30: reserved, Bit29-24: IPsec syndrome, Bit23-0: IPsec obj id */
103 /* Cannot support tunnel packet over IPsec tunnel mode in mlx5e_ipsec_feature_check()
119 /* Disable CSUM and GSO for software IPsec */ in mlx5e_ipsec_feature_check()
|
| /Linux-v6.6/drivers/net/ethernet/intel/ixgbevf/ |
| D | ipsec.c | 94 * ixgbevf_ipsec_restore - restore the IPsec HW settings after a reset
103 struct ixgbevf_ipsec *ipsec = adapter->ipsec; in ixgbevf_ipsec_restore() local
112 struct rx_sa *r = &ipsec->rx_tbl[i]; in ixgbevf_ipsec_restore()
113 struct tx_sa *t = &ipsec->tx_tbl[i]; in ixgbevf_ipsec_restore()
134 * @ipsec: pointer to IPsec struct
140 int ixgbevf_ipsec_find_empty_idx(struct ixgbevf_ipsec *ipsec, bool rxtable) in ixgbevf_ipsec_find_empty_idx() argument
145 if (ipsec->num_rx_sa == IXGBE_IPSEC_MAX_SA_COUNT) in ixgbevf_ipsec_find_empty_idx()
150 if (!ipsec->rx_tbl[i].used) in ixgbevf_ipsec_find_empty_idx()
154 if (ipsec->num_tx_sa == IXGBE_IPSEC_MAX_SA_COUNT) in ixgbevf_ipsec_find_empty_idx()
159 if (!ipsec->tx_tbl[i].used) in ixgbevf_ipsec_find_empty_idx()
[all …]
|
| /Linux-v6.6/drivers/net/netdevsim/ |
| D | ipsec.c | 17 struct nsim_ipsec *ipsec = &ns->ipsec; in nsim_dbg_netdev_ops_read() local
26 bufsize = (ipsec->count * 4 * 60) + 60; in nsim_dbg_netdev_ops_read()
34 ipsec->count, ipsec->tx); in nsim_dbg_netdev_ops_read()
37 struct nsim_sa *sap = &ipsec->sa[i]; in nsim_dbg_netdev_ops_read()
68 static int nsim_ipsec_find_empty_idx(struct nsim_ipsec *ipsec) in nsim_ipsec_find_empty_idx() argument
72 if (ipsec->count == NSIM_IPSEC_MAX_SA_COUNT) in nsim_ipsec_find_empty_idx()
77 if (!ipsec->sa[i].used) in nsim_ipsec_find_empty_idx()
94 netdev_err(dev, "Unsupported IPsec algorithm\n"); in nsim_ipsec_parse_proto_keys()
99 netdev_err(dev, "IPsec offload requires %d bit authentication\n", in nsim_ipsec_parse_proto_keys()
109 netdev_err(dev, "Unsupported IPsec algorithm - please use %s\n", in nsim_ipsec_parse_proto_keys()
[all …]
|
| /Linux-v6.6/drivers/net/ethernet/mellanox/mlx5/core/esw/ |
| D | ipsec_fs.c | 6 #include "en_accel/ipsec.h"
24 static void esw_ipsec_rx_status_drop_destroy(struct mlx5e_ipsec *ipsec, in esw_ipsec_rx_status_drop_destroy() argument
29 mlx5_fc_destroy(ipsec->mdev, rx->status_drop_cnt); in esw_ipsec_rx_status_drop_destroy()
32 static void esw_ipsec_rx_status_pass_destroy(struct mlx5e_ipsec *ipsec, in esw_ipsec_rx_status_pass_destroy() argument
36 mlx5_chains_put_table(esw_chains(ipsec->mdev->priv.eswitch), 0, 1, 0); in esw_ipsec_rx_status_pass_destroy()
39 static int esw_ipsec_rx_status_drop_create(struct mlx5e_ipsec *ipsec, in esw_ipsec_rx_status_drop_create() argument
44 struct mlx5_core_dev *mdev = ipsec->mdev; in esw_ipsec_rx_status_drop_create()
67 "Failed to add ipsec rx status drop flow group, err=%d\n", err); in esw_ipsec_rx_status_drop_create()
75 "Failed to add ipsec rx status drop rule counter, err=%d\n", err); in esw_ipsec_rx_status_drop_create()
87 "Failed to add ipsec rx status drop rule, err=%d\n", err); in esw_ipsec_rx_status_drop_create()
[all …]
|
| D | ipsec_fs.h | 11 void mlx5_esw_ipsec_rx_status_destroy(struct mlx5e_ipsec *ipsec,
13 int mlx5_esw_ipsec_rx_status_create(struct mlx5e_ipsec *ipsec,
16 void mlx5_esw_ipsec_rx_create_attr_set(struct mlx5e_ipsec *ipsec,
18 int mlx5_esw_ipsec_rx_status_pass_dest_get(struct mlx5e_ipsec *ipsec,
25 void mlx5_esw_ipsec_tx_create_attr_set(struct mlx5e_ipsec *ipsec,
29 static inline void mlx5_esw_ipsec_rx_status_destroy(struct mlx5e_ipsec *ipsec, in mlx5_esw_ipsec_rx_status_destroy() argument
32 static inline int mlx5_esw_ipsec_rx_status_create(struct mlx5e_ipsec *ipsec, in mlx5_esw_ipsec_rx_status_create() argument
39 static inline void mlx5_esw_ipsec_rx_create_attr_set(struct mlx5e_ipsec *ipsec, in mlx5_esw_ipsec_rx_create_attr_set() argument
42 static inline int mlx5_esw_ipsec_rx_status_pass_dest_get(struct mlx5e_ipsec *ipsec, in mlx5_esw_ipsec_rx_status_pass_dest_get() argument
62 static inline void mlx5_esw_ipsec_tx_create_attr_set(struct mlx5e_ipsec *ipsec, in mlx5_esw_ipsec_tx_create_attr_set() argument
|
| /Linux-v6.6/drivers/net/ethernet/intel/ixgbe/ |
| D | ixgbe_ipsec.c | 248 /* final set for normal (no ipsec offload) processing */ in ixgbe_ipsec_stop_engine()
293 * ixgbe_ipsec_restore - restore the ipsec HW settings after a reset
305 struct ixgbe_ipsec *ipsec = adapter->ipsec; in ixgbe_ipsec_restore() local
319 struct rx_sa *r = &ipsec->rx_tbl[i]; in ixgbe_ipsec_restore()
320 struct tx_sa *t = &ipsec->tx_tbl[i]; in ixgbe_ipsec_restore()
341 struct rx_ip_sa *ipsa = &ipsec->ip_tbl[i]; in ixgbe_ipsec_restore()
350 * @ipsec: pointer to ipsec struct
355 static int ixgbe_ipsec_find_empty_idx(struct ixgbe_ipsec *ipsec, bool rxtable) in ixgbe_ipsec_find_empty_idx() argument
360 if (ipsec->num_rx_sa == IXGBE_IPSEC_MAX_SA_COUNT) in ixgbe_ipsec_find_empty_idx()
365 if (!ipsec->rx_tbl[i].used) in ixgbe_ipsec_find_empty_idx()
[all …]
|
| /Linux-v6.6/net/xfrm/ |
| D | Kconfig | 27 like IPsec used by native Linux tools.
37 Transformation(XFRM) user configuration interface like IPsec
46 This provides a virtual interface to route IPsec traffic.
64 A feature to update locator(s) of a given IPsec security
66 instance, in a Mobile IPv6 environment with IPsec configuration
116 They are required if you are going to use IPsec tools ported
128 locator(s) of a given IPsec security association.
130 environment with IPsec configuration where mobile nodes
|
| /Linux-v6.6/drivers/crypto/caam/ |
| D | pdb.h | 14 * PDB- IPSec ESP Header Modification Options
47 * PDB - IPSec ESP Encap/Decap Options
68 * General IPSec encap/decap PDB definitions
72 * ipsec_encap_cbc - PDB part for IPsec CBC encapsulation
80 * ipsec_encap_ctr - PDB part for IPsec CTR encapsulation
92 * ipsec_encap_ccm - PDB part for IPsec CCM encapsulation
108 * ipsec_encap_gcm - PDB part for IPsec GCM encapsulation
120 * ipsec_encap_pdb - PDB for IPsec encapsulation
127 * @seq_num_ext_hi: (optional) IPsec Extended Sequence Number (ESN)
128 * @seq_num: IPsec sequence number
[all …]
|
| /Linux-v6.6/Documentation/networking/ |
| D | xfrm_device.rst | 5 XFRM device - offloading the IPsec computations
15 IPsec is a useful feature for securing network traffic, but the
18 Luckily, there are NICs that offer a hardware based IPsec offload which
24 * IPsec crypto offload:
27 * IPsec packet offload:
82 The NIC driver offering ipsec offload will need to implement callbacks
113 -EOPNETSUPP offload not supported, try SW IPsec,
124 When the network stack is preparing an IPsec packet for an SA that has
140 The stack has already inserted the appropriate IPsec headers in the
148 IPsec headers are still in the packet data; they are removed later up
|
| /Linux-v6.6/drivers/net/ethernet/mellanox/mlx5/core/lib/ |
| D | ipsec_fs_roce.c | 69 mlx5_core_err(mdev, "Fail to add RX RoCE IPsec rule err=%d\n", in ipsec_fs_roce_rx_rule_setup()
80 mlx5_core_err(mdev, "Fail to add RX RoCE IPsec miss rule err=%d\n", in ipsec_fs_roce_rx_rule_setup()
113 mlx5_core_err(mdev, "Fail to add TX RoCE IPsec rule err=%d\n", in ipsec_fs_roce_tx_rule_setup()
164 mlx5_core_err(mdev, "Fail to create RoCE IPsec tx ft err=%d\n", err); in mlx5_ipsec_fs_roce_tx_create()
176 mlx5_core_err(mdev, "Fail to create RoCE IPsec tx group err=%d\n", err); in mlx5_ipsec_fs_roce_tx_create()
183 mlx5_core_err(mdev, "Fail to create RoCE IPsec tx rules err=%d\n", err); in mlx5_ipsec_fs_roce_tx_create()
260 mlx5_core_err(mdev, "Fail to create RoCE IPsec rx ft at nic err=%d\n", err); in mlx5_ipsec_fs_roce_rx_create()
284 mlx5_core_err(mdev, "Fail to create RoCE IPsec rx group at nic err=%d\n", err); in mlx5_ipsec_fs_roce_rx_create()
296 mlx5_core_err(mdev, "Fail to create RoCE IPsec rx miss group at nic err=%d\n", err); in mlx5_ipsec_fs_roce_rx_create()
307 mlx5_core_err(mdev, "Fail to create RoCE IPsec rx ft at rdma err=%d\n", err); in mlx5_ipsec_fs_roce_rx_create()
[all …]
|
| /Linux-v6.6/tools/testing/selftests/net/ |
| D | xfrm_policy.sh | 10 # ns3 and ns4 are connected via ipsec tunnel.
12 # ns1: ping 10.0.2.2: passes via ipsec tunnel.
13 # ns2: ping 10.0.1.2: passes via ipsec tunnel.
15 # ns1: ping 10.0.1.253: passes via ipsec tunnel (direct policy)
16 # ns2: ping 10.0.2.253: passes via ipsec tunnel (direct policy)
18 # ns1: ping 10.0.2.254: does NOT pass via ipsec tunnel (exception)
19 # ns2: ping 10.0.1.254: does NOT pass via ipsec tunnel (exception)
243 echo "PASS: ping to .254 bypassed ipsec tunnel ($logpostfix)"
246 # ping to .253 should use use ipsec due to direct policy exception.
249 echo "FAIL: expected ping to .253 to use ipsec tunnel ($logpostfix)"
[all …]
|
| /Linux-v6.6/Documentation/devicetree/bindings/rng/ |
| D | brcm,bcm2835.yaml | 29 const: ipsec
35 const: ipsec
78 clock-names = "ipsec";
81 reset-names = "ipsec";
|
| /Linux-v6.6/Documentation/networking/device_drivers/ethernet/mellanox/mlx5/ |
| D | switchdev.rst | 193 IPsec crypto capability setup
195 User who wants mlx5 PCI VFs to be able to perform IPsec crypto offloading need
196 to explicitly enable the VF ipsec_crypto capability. Enabling IPsec capability
198 IPsec capability enabled, any IPsec offloading is blocked on the PF.
203 IPsec packet capability setup
205 User who wants mlx5 PCI VFs to be able to perform IPsec packet offloading need
206 to explicitly enable the VF ipsec_packet capability. Enabling IPsec capability
208 IPsec capability enabled, any IPsec offloading is blocked on the PF.
|
| /Linux-v6.6/drivers/net/ethernet/netronome/ |
| D | Kconfig | 58 bool "NFP IPsec crypto offload support"
63 Enable driver support IPsec crypto offload on NFP NIC.
64 Say Y, if you are planning to make use of IPsec crypto
65 offload. NOTE that IPsec crypto offload on NFP NIC
|
| /Linux-v6.6/drivers/crypto/marvell/octeontx2/ |
| D | otx2_cptpf_ucode.h | 15 * On OcteonTX2 platform IPSec ucode can use both IE and SE engines therefore
37 OTX2_CPT_SE_UC_TYPE2 = 21,/* Fast Path IPSec + AirCrypto */
40 * Full Feature IPSec + AirCrypto + Kasumi
43 OTX2_CPT_IE_UC_TYPE2 = 31, /* Fast Path IPSec */
46 * Full Future IPSec
|
| /Linux-v6.6/Documentation/networking/devlink/ |
| D | devlink-port.rst | 131 Users may also set the IPsec crypto capability of the function using
134 Users may also set the IPsec packet capability of the function using
249 IPsec crypto capability setup
251 When user enables IPsec crypto capability for a VF, user application can offload
254 When IPsec crypto capability is disabled (default) for a VF, the XFRM state is
257 - Get IPsec crypto capability of the VF device::
264 - Set IPsec crypto capability of the VF device::
273 IPsec packet capability setup
275 When user enables IPsec packet capability for a VF, user application can offload
277 IPsec encapsulation.
[all …]
|
| /Linux-v6.6/drivers/net/ethernet/chelsio/inline_crypto/ |
| D | Kconfig | 29 tristate "Chelsio IPSec XFRM Tx crypto offload"
34 Support Chelsio Inline IPsec with Chelsio crypto accelerator.
35 Enable inline IPsec support for Tx.
|
| /Linux-v6.6/net/ipv6/ |
| D | Kconfig | 55 Support for IPsec AH (Authentication Header).
70 Support for IPsec ESP (Encapsulating Security Payload).
88 only if this system really does IPsec and want to do it
90 need it, even if it does IPsec.
112 typically needed for IPsec.
163 the notion of a secure tunnel for IPSEC and then use routing protocol
|
