Commit 32188be8 authored by Bharat Bhushan's avatar Bharat Bhushan Committed by David S. Miller
Browse files

cn10k-ipsec: Allow ipsec crypto offload for skb with SA 



Allow to use hardware offload for outbound ipsec crypto
mode if security association (SA) is set for a given skb.

Signed-off-by: default avatarBharat Bhushan <bbhushan2@marvell.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6a77a158

drivers/net/ethernet/marvell/octeontx2/nic/cn10k_ipsec.c

+15 −0
Original line number Diff line number Diff line
@@ -746,9 +746,24 @@ static void cn10k_ipsec_del_state(struct xfrm_state *x) 
		queue_work(pf->ipsec.sa_workq, &pf->ipsec.sa_work);

}



static bool cn10k_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *x)

{

	if (x->props.family == AF_INET) {

		/* Offload with IPv4 options is not supported yet */

		if (ip_hdr(skb)->ihl > 5)

			return false;

	} else {

		/* Offload with IPv6 extension headers is not support yet */

		if (ipv6_ext_hdr(ipv6_hdr(skb)->nexthdr))

			return false;

	}

	return true;

}



static const struct xfrmdev_ops cn10k_ipsec_xfrmdev_ops = {

	.xdo_dev_state_add	= cn10k_ipsec_add_state,

	.xdo_dev_state_delete	= cn10k_ipsec_del_state,

	.xdo_dev_offload_ok	= cn10k_ipsec_offload_ok,

};



static void cn10k_ipsec_sa_wq_handler(struct work_struct *work)