1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright(c) 2018 Oracle and/or its affiliates. All rights reserved. */
3 
4 #include "ixgbevf.h"
5 #include <net/xfrm.h>
6 #include <crypto/aead.h>
7 
8 #define IXGBE_IPSEC_KEY_BITS  160
9 static const char aes_gcm_name[] = "rfc4106(gcm(aes))";
10 
11 /**
12  * ixgbevf_ipsec_set_pf_sa - ask the PF to set up an SA
13  * @adapter: board private structure
14  * @xs: xfrm info to be sent to the PF
15  *
16  * Returns: positive offload handle from the PF, or negative error code
17  **/
18 static int ixgbevf_ipsec_set_pf_sa(struct ixgbevf_adapter *adapter,
19 				   struct xfrm_state *xs)
20 {
21 	u32 msgbuf[IXGBE_VFMAILBOX_SIZE] = { 0 };
22 	struct ixgbe_hw *hw = &adapter->hw;
23 	struct sa_mbx_msg *sam;
24 	int ret;
25 
26 	/* send the important bits to the PF */
27 	sam = (struct sa_mbx_msg *)(&msgbuf[1]);
28 	sam->flags = xs->xso.flags;
29 	sam->spi = xs->id.spi;
30 	sam->proto = xs->id.proto;
31 	sam->family = xs->props.family;
32 
33 	if (xs->props.family == AF_INET6)
34 		memcpy(sam->addr, &xs->id.daddr.a6, sizeof(xs->id.daddr.a6));
35 	else
36 		memcpy(sam->addr, &xs->id.daddr.a4, sizeof(xs->id.daddr.a4));
37 	memcpy(sam->key, xs->aead->alg_key, sizeof(sam->key));
38 
39 	msgbuf[0] = IXGBE_VF_IPSEC_ADD;
40 
41 	spin_lock_bh(&adapter->mbx_lock);
42 
43 	ret = hw->mbx.ops.write_posted(hw, msgbuf, IXGBE_VFMAILBOX_SIZE);
44 	if (ret)
45 		goto out;
46 
47 	ret = hw->mbx.ops.read_posted(hw, msgbuf, 2);
48 	if (ret)
49 		goto out;
50 
51 	ret = (int)msgbuf[1];
52 	if (msgbuf[0] & IXGBE_VT_MSGTYPE_NACK && ret >= 0)
53 		ret = -1;
54 
55 out:
56 	spin_unlock_bh(&adapter->mbx_lock);
57 
58 	return ret;
59 }
60 
61 /**
62  * ixgbevf_ipsec_del_pf_sa - ask the PF to delete an SA
63  * @adapter: board private structure
64  * @pfsa: sa index returned from PF when created, -1 for all
65  *
66  * Returns: 0 on success, or negative error code
67  **/
68 static int ixgbevf_ipsec_del_pf_sa(struct ixgbevf_adapter *adapter, int pfsa)
69 {
70 	struct ixgbe_hw *hw = &adapter->hw;
71 	u32 msgbuf[2];
72 	int err;
73 
74 	memset(msgbuf, 0, sizeof(msgbuf));
75 	msgbuf[0] = IXGBE_VF_IPSEC_DEL;
76 	msgbuf[1] = (u32)pfsa;
77 
78 	spin_lock_bh(&adapter->mbx_lock);
79 
80 	err = hw->mbx.ops.write_posted(hw, msgbuf, 2);
81 	if (err)
82 		goto out;
83 
84 	err = hw->mbx.ops.read_posted(hw, msgbuf, 2);
85 	if (err)
86 		goto out;
87 
88 out:
89 	spin_unlock_bh(&adapter->mbx_lock);
90 	return err;
91 }
92 
93 /**
94  * ixgbevf_ipsec_restore - restore the IPsec HW settings after a reset
95  * @adapter: board private structure
96  *
97  * Reload the HW tables from the SW tables after they've been bashed
98  * by a chip reset.  While we're here, make sure any stale VF data is
99  * removed, since we go through reset when num_vfs changes.
100  **/
101 void ixgbevf_ipsec_restore(struct ixgbevf_adapter *adapter)
102 {
103 	struct ixgbevf_ipsec *ipsec = adapter->ipsec;
104 	struct net_device *netdev = adapter->netdev;
105 	int i;
106 
107 	if (!(adapter->netdev->features & NETIF_F_HW_ESP))
108 		return;
109 
110 	/* reload the Rx and Tx keys */
111 	for (i = 0; i < IXGBE_IPSEC_MAX_SA_COUNT; i++) {
112 		struct rx_sa *r = &ipsec->rx_tbl[i];
113 		struct tx_sa *t = &ipsec->tx_tbl[i];
114 		int ret;
115 
116 		if (r->used) {
117 			ret = ixgbevf_ipsec_set_pf_sa(adapter, r->xs);
118 			if (ret < 0)
119 				netdev_err(netdev, "reload rx_tbl[%d] failed = %d\n",
120 					   i, ret);
121 		}
122 
123 		if (t->used) {
124 			ret = ixgbevf_ipsec_set_pf_sa(adapter, t->xs);
125 			if (ret < 0)
126 				netdev_err(netdev, "reload tx_tbl[%d] failed = %d\n",
127 					   i, ret);
128 		}
129 	}
130 }
131 
132 /**
133  * ixgbevf_ipsec_find_empty_idx - find the first unused security parameter index
134  * @ipsec: pointer to IPsec struct
135  * @rxtable: true if we need to look in the Rx table
136  *
137  * Returns the first unused index in either the Rx or Tx SA table
138  **/
139 static
140 int ixgbevf_ipsec_find_empty_idx(struct ixgbevf_ipsec *ipsec, bool rxtable)
141 {
142 	u32 i;
143 
144 	if (rxtable) {
145 		if (ipsec->num_rx_sa == IXGBE_IPSEC_MAX_SA_COUNT)
146 			return -ENOSPC;
147 
148 		/* search rx sa table */
149 		for (i = 0; i < IXGBE_IPSEC_MAX_SA_COUNT; i++) {
150 			if (!ipsec->rx_tbl[i].used)
151 				return i;
152 		}
153 	} else {
154 		if (ipsec->num_tx_sa == IXGBE_IPSEC_MAX_SA_COUNT)
155 			return -ENOSPC;
156 
157 		/* search tx sa table */
158 		for (i = 0; i < IXGBE_IPSEC_MAX_SA_COUNT; i++) {
159 			if (!ipsec->tx_tbl[i].used)
160 				return i;
161 		}
162 	}
163 
164 	return -ENOSPC;
165 }
166 
167 /**
168  * ixgbevf_ipsec_find_rx_state - find the state that matches
169  * @ipsec: pointer to IPsec struct
170  * @daddr: inbound address to match
171  * @proto: protocol to match
172  * @spi: SPI to match
173  * @ip4: true if using an IPv4 address
174  *
175  * Returns a pointer to the matching SA state information
176  **/
177 static
178 struct xfrm_state *ixgbevf_ipsec_find_rx_state(struct ixgbevf_ipsec *ipsec,
179 					       __be32 *daddr, u8 proto,
180 					       __be32 spi, bool ip4)
181 {
182 	struct xfrm_state *ret = NULL;
183 	struct rx_sa *rsa;
184 
185 	rcu_read_lock();
186 	hash_for_each_possible_rcu(ipsec->rx_sa_list, rsa, hlist,
187 				   (__force u32)spi) {
188 		if (spi == rsa->xs->id.spi &&
189 		    ((ip4 && *daddr == rsa->xs->id.daddr.a4) ||
190 		      (!ip4 && !memcmp(daddr, &rsa->xs->id.daddr.a6,
191 				       sizeof(rsa->xs->id.daddr.a6)))) &&
192 		    proto == rsa->xs->id.proto) {
193 			ret = rsa->xs;
194 			xfrm_state_hold(ret);
195 			break;
196 		}
197 	}
198 	rcu_read_unlock();
199 	return ret;
200 }
201 
202 /**
203  * ixgbevf_ipsec_parse_proto_keys - find the key and salt based on the protocol
204  * @xs: pointer to xfrm_state struct
205  * @mykey: pointer to key array to populate
206  * @mysalt: pointer to salt value to populate
207  *
208  * This copies the protocol keys and salt to our own data tables.  The
209  * 82599 family only supports the one algorithm.
210  **/
211 static int ixgbevf_ipsec_parse_proto_keys(struct xfrm_state *xs,
212 					  u32 *mykey, u32 *mysalt)
213 {
214 	struct net_device *dev = xs->xso.dev;
215 	unsigned char *key_data;
216 	char *alg_name = NULL;
217 	int key_len;
218 
219 	if (!xs->aead) {
220 		netdev_err(dev, "Unsupported IPsec algorithm\n");
221 		return -EINVAL;
222 	}
223 
224 	if (xs->aead->alg_icv_len != IXGBE_IPSEC_AUTH_BITS) {
225 		netdev_err(dev, "IPsec offload requires %d bit authentication\n",
226 			   IXGBE_IPSEC_AUTH_BITS);
227 		return -EINVAL;
228 	}
229 
230 	key_data = &xs->aead->alg_key[0];
231 	key_len = xs->aead->alg_key_len;
232 	alg_name = xs->aead->alg_name;
233 
234 	if (strcmp(alg_name, aes_gcm_name)) {
235 		netdev_err(dev, "Unsupported IPsec algorithm - please use %s\n",
236 			   aes_gcm_name);
237 		return -EINVAL;
238 	}
239 
240 	/* The key bytes come down in a big endian array of bytes, so
241 	 * we don't need to do any byte swapping.
242 	 * 160 accounts for 16 byte key and 4 byte salt
243 	 */
244 	if (key_len > IXGBE_IPSEC_KEY_BITS) {
245 		*mysalt = ((u32 *)key_data)[4];
246 	} else if (key_len == IXGBE_IPSEC_KEY_BITS) {
247 		*mysalt = 0;
248 	} else {
249 		netdev_err(dev, "IPsec hw offload only supports keys up to 128 bits with a 32 bit salt\n");
250 		return -EINVAL;
251 	}
252 	memcpy(mykey, key_data, 16);
253 
254 	return 0;
255 }
256 
257 /**
258  * ixgbevf_ipsec_add_sa - program device with a security association
259  * @xs: pointer to transformer state struct
260  **/
261 static int ixgbevf_ipsec_add_sa(struct xfrm_state *xs)
262 {
263 	struct net_device *dev = xs->xso.dev;
264 	struct ixgbevf_adapter *adapter = netdev_priv(dev);
265 	struct ixgbevf_ipsec *ipsec = adapter->ipsec;
266 	u16 sa_idx;
267 	int ret;
268 
269 	if (xs->id.proto != IPPROTO_ESP && xs->id.proto != IPPROTO_AH) {
270 		netdev_err(dev, "Unsupported protocol 0x%04x for IPsec offload\n",
271 			   xs->id.proto);
272 		return -EINVAL;
273 	}
274 
275 	if (xs->props.mode != XFRM_MODE_TRANSPORT) {
276 		netdev_err(dev, "Unsupported mode for ipsec offload\n");
277 		return -EINVAL;
278 	}
279 
280 	if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) {
281 		struct rx_sa rsa;
282 
283 		if (xs->calg) {
284 			netdev_err(dev, "Compression offload not supported\n");
285 			return -EINVAL;
286 		}
287 
288 		/* find the first unused index */
289 		ret = ixgbevf_ipsec_find_empty_idx(ipsec, true);
290 		if (ret < 0) {
291 			netdev_err(dev, "No space for SA in Rx table!\n");
292 			return ret;
293 		}
294 		sa_idx = (u16)ret;
295 
296 		memset(&rsa, 0, sizeof(rsa));
297 		rsa.used = true;
298 		rsa.xs = xs;
299 
300 		if (rsa.xs->id.proto & IPPROTO_ESP)
301 			rsa.decrypt = xs->ealg || xs->aead;
302 
303 		/* get the key and salt */
304 		ret = ixgbevf_ipsec_parse_proto_keys(xs, rsa.key, &rsa.salt);
305 		if (ret) {
306 			netdev_err(dev, "Failed to get key data for Rx SA table\n");
307 			return ret;
308 		}
309 
310 		/* get ip for rx sa table */
311 		if (xs->props.family == AF_INET6)
312 			memcpy(rsa.ipaddr, &xs->id.daddr.a6, 16);
313 		else
314 			memcpy(&rsa.ipaddr[3], &xs->id.daddr.a4, 4);
315 
316 		rsa.mode = IXGBE_RXMOD_VALID;
317 		if (rsa.xs->id.proto & IPPROTO_ESP)
318 			rsa.mode |= IXGBE_RXMOD_PROTO_ESP;
319 		if (rsa.decrypt)
320 			rsa.mode |= IXGBE_RXMOD_DECRYPT;
321 		if (rsa.xs->props.family == AF_INET6)
322 			rsa.mode |= IXGBE_RXMOD_IPV6;
323 
324 		ret = ixgbevf_ipsec_set_pf_sa(adapter, xs);
325 		if (ret < 0)
326 			return ret;
327 		rsa.pfsa = ret;
328 
329 		/* the preparations worked, so save the info */
330 		memcpy(&ipsec->rx_tbl[sa_idx], &rsa, sizeof(rsa));
331 
332 		xs->xso.offload_handle = sa_idx + IXGBE_IPSEC_BASE_RX_INDEX;
333 
334 		ipsec->num_rx_sa++;
335 
336 		/* hash the new entry for faster search in Rx path */
337 		hash_add_rcu(ipsec->rx_sa_list, &ipsec->rx_tbl[sa_idx].hlist,
338 			     (__force u32)rsa.xs->id.spi);
339 	} else {
340 		struct tx_sa tsa;
341 
342 		/* find the first unused index */
343 		ret = ixgbevf_ipsec_find_empty_idx(ipsec, false);
344 		if (ret < 0) {
345 			netdev_err(dev, "No space for SA in Tx table\n");
346 			return ret;
347 		}
348 		sa_idx = (u16)ret;
349 
350 		memset(&tsa, 0, sizeof(tsa));
351 		tsa.used = true;
352 		tsa.xs = xs;
353 
354 		if (xs->id.proto & IPPROTO_ESP)
355 			tsa.encrypt = xs->ealg || xs->aead;
356 
357 		ret = ixgbevf_ipsec_parse_proto_keys(xs, tsa.key, &tsa.salt);
358 		if (ret) {
359 			netdev_err(dev, "Failed to get key data for Tx SA table\n");
360 			memset(&tsa, 0, sizeof(tsa));
361 			return ret;
362 		}
363 
364 		ret = ixgbevf_ipsec_set_pf_sa(adapter, xs);
365 		if (ret < 0)
366 			return ret;
367 		tsa.pfsa = ret;
368 
369 		/* the preparations worked, so save the info */
370 		memcpy(&ipsec->tx_tbl[sa_idx], &tsa, sizeof(tsa));
371 
372 		xs->xso.offload_handle = sa_idx + IXGBE_IPSEC_BASE_TX_INDEX;
373 
374 		ipsec->num_tx_sa++;
375 	}
376 
377 	return 0;
378 }
379 
380 /**
381  * ixgbevf_ipsec_del_sa - clear out this specific SA
382  * @xs: pointer to transformer state struct
383  **/
384 static void ixgbevf_ipsec_del_sa(struct xfrm_state *xs)
385 {
386 	struct net_device *dev = xs->xso.dev;
387 	struct ixgbevf_adapter *adapter = netdev_priv(dev);
388 	struct ixgbevf_ipsec *ipsec = adapter->ipsec;
389 	u16 sa_idx;
390 
391 	if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) {
392 		sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_RX_INDEX;
393 
394 		if (!ipsec->rx_tbl[sa_idx].used) {
395 			netdev_err(dev, "Invalid Rx SA selected sa_idx=%d offload_handle=%lu\n",
396 				   sa_idx, xs->xso.offload_handle);
397 			return;
398 		}
399 
400 		ixgbevf_ipsec_del_pf_sa(adapter, ipsec->rx_tbl[sa_idx].pfsa);
401 		hash_del_rcu(&ipsec->rx_tbl[sa_idx].hlist);
402 		memset(&ipsec->rx_tbl[sa_idx], 0, sizeof(struct rx_sa));
403 		ipsec->num_rx_sa--;
404 	} else {
405 		sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_TX_INDEX;
406 
407 		if (!ipsec->tx_tbl[sa_idx].used) {
408 			netdev_err(dev, "Invalid Tx SA selected sa_idx=%d offload_handle=%lu\n",
409 				   sa_idx, xs->xso.offload_handle);
410 			return;
411 		}
412 
413 		ixgbevf_ipsec_del_pf_sa(adapter, ipsec->tx_tbl[sa_idx].pfsa);
414 		memset(&ipsec->tx_tbl[sa_idx], 0, sizeof(struct tx_sa));
415 		ipsec->num_tx_sa--;
416 	}
417 }
418 
419 /**
420  * ixgbevf_ipsec_offload_ok - can this packet use the xfrm hw offload
421  * @skb: current data packet
422  * @xs: pointer to transformer state struct
423  **/
424 static bool ixgbevf_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs)
425 {
426 	if (xs->props.family == AF_INET) {
427 		/* Offload with IPv4 options is not supported yet */
428 		if (ip_hdr(skb)->ihl != 5)
429 			return false;
430 	} else {
431 		/* Offload with IPv6 extension headers is not support yet */
432 		if (ipv6_ext_hdr(ipv6_hdr(skb)->nexthdr))
433 			return false;
434 	}
435 
436 	return true;
437 }
438 
439 static const struct xfrmdev_ops ixgbevf_xfrmdev_ops = {
440 	.xdo_dev_state_add = ixgbevf_ipsec_add_sa,
441 	.xdo_dev_state_delete = ixgbevf_ipsec_del_sa,
442 	.xdo_dev_offload_ok = ixgbevf_ipsec_offload_ok,
443 };
444 
445 /**
446  * ixgbevf_ipsec_tx - setup Tx flags for IPsec offload
447  * @tx_ring: outgoing context
448  * @first: current data packet
449  * @itd: ipsec Tx data for later use in building context descriptor
450  **/
451 int ixgbevf_ipsec_tx(struct ixgbevf_ring *tx_ring,
452 		     struct ixgbevf_tx_buffer *first,
453 		     struct ixgbevf_ipsec_tx_data *itd)
454 {
455 	struct ixgbevf_adapter *adapter = netdev_priv(tx_ring->netdev);
456 	struct ixgbevf_ipsec *ipsec = adapter->ipsec;
457 	struct xfrm_state *xs;
458 	struct sec_path *sp;
459 	struct tx_sa *tsa;
460 	u16 sa_idx;
461 
462 	sp = skb_sec_path(first->skb);
463 	if (unlikely(!sp->len)) {
464 		netdev_err(tx_ring->netdev, "%s: no xfrm state len = %d\n",
465 			   __func__, sp->len);
466 		return 0;
467 	}
468 
469 	xs = xfrm_input_state(first->skb);
470 	if (unlikely(!xs)) {
471 		netdev_err(tx_ring->netdev, "%s: no xfrm_input_state() xs = %p\n",
472 			   __func__, xs);
473 		return 0;
474 	}
475 
476 	sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_TX_INDEX;
477 	if (unlikely(sa_idx >= IXGBE_IPSEC_MAX_SA_COUNT)) {
478 		netdev_err(tx_ring->netdev, "%s: bad sa_idx=%d handle=%lu\n",
479 			   __func__, sa_idx, xs->xso.offload_handle);
480 		return 0;
481 	}
482 
483 	tsa = &ipsec->tx_tbl[sa_idx];
484 	if (unlikely(!tsa->used)) {
485 		netdev_err(tx_ring->netdev, "%s: unused sa_idx=%d\n",
486 			   __func__, sa_idx);
487 		return 0;
488 	}
489 
490 	itd->pfsa = tsa->pfsa - IXGBE_IPSEC_BASE_TX_INDEX;
491 
492 	first->tx_flags |= IXGBE_TX_FLAGS_IPSEC | IXGBE_TX_FLAGS_CSUM;
493 
494 	if (xs->id.proto == IPPROTO_ESP) {
495 		itd->flags |= IXGBE_ADVTXD_TUCMD_IPSEC_TYPE_ESP |
496 			      IXGBE_ADVTXD_TUCMD_L4T_TCP;
497 		if (first->protocol == htons(ETH_P_IP))
498 			itd->flags |= IXGBE_ADVTXD_TUCMD_IPV4;
499 
500 		/* The actual trailer length is authlen (16 bytes) plus
501 		 * 2 bytes for the proto and the padlen values, plus
502 		 * padlen bytes of padding.  This ends up not the same
503 		 * as the static value found in xs->props.trailer_len (21).
504 		 *
505 		 * ... but if we're doing GSO, don't bother as the stack
506 		 * doesn't add a trailer for those.
507 		 */
508 		if (!skb_is_gso(first->skb)) {
509 			/* The "correct" way to get the auth length would be
510 			 * to use
511 			 *    authlen = crypto_aead_authsize(xs->data);
512 			 * but since we know we only have one size to worry
513 			 * about * we can let the compiler use the constant
514 			 * and save us a few CPU cycles.
515 			 */
516 			const int authlen = IXGBE_IPSEC_AUTH_BITS / 8;
517 			struct sk_buff *skb = first->skb;
518 			u8 padlen;
519 			int ret;
520 
521 			ret = skb_copy_bits(skb, skb->len - (authlen + 2),
522 					    &padlen, 1);
523 			if (unlikely(ret))
524 				return 0;
525 			itd->trailer_len = authlen + 2 + padlen;
526 		}
527 	}
528 	if (tsa->encrypt)
529 		itd->flags |= IXGBE_ADVTXD_TUCMD_IPSEC_ENCRYPT_EN;
530 
531 	return 1;
532 }
533 
534 /**
535  * ixgbevf_ipsec_rx - decode IPsec bits from Rx descriptor
536  * @rx_ring: receiving ring
537  * @rx_desc: receive data descriptor
538  * @skb: current data packet
539  *
540  * Determine if there was an IPsec encapsulation noticed, and if so set up
541  * the resulting status for later in the receive stack.
542  **/
543 void ixgbevf_ipsec_rx(struct ixgbevf_ring *rx_ring,
544 		      union ixgbe_adv_rx_desc *rx_desc,
545 		      struct sk_buff *skb)
546 {
547 	struct ixgbevf_adapter *adapter = netdev_priv(rx_ring->netdev);
548 	__le16 pkt_info = rx_desc->wb.lower.lo_dword.hs_rss.pkt_info;
549 	__le16 ipsec_pkt_types = cpu_to_le16(IXGBE_RXDADV_PKTTYPE_IPSEC_AH |
550 					     IXGBE_RXDADV_PKTTYPE_IPSEC_ESP);
551 	struct ixgbevf_ipsec *ipsec = adapter->ipsec;
552 	struct xfrm_offload *xo = NULL;
553 	struct xfrm_state *xs = NULL;
554 	struct ipv6hdr *ip6 = NULL;
555 	struct iphdr *ip4 = NULL;
556 	struct sec_path *sp;
557 	void *daddr;
558 	__be32 spi;
559 	u8 *c_hdr;
560 	u8 proto;
561 
562 	/* Find the IP and crypto headers in the data.
563 	 * We can assume no VLAN header in the way, b/c the
564 	 * hw won't recognize the IPsec packet and anyway the
565 	 * currently VLAN device doesn't support xfrm offload.
566 	 */
567 	if (pkt_info & cpu_to_le16(IXGBE_RXDADV_PKTTYPE_IPV4)) {
568 		ip4 = (struct iphdr *)(skb->data + ETH_HLEN);
569 		daddr = &ip4->daddr;
570 		c_hdr = (u8 *)ip4 + ip4->ihl * 4;
571 	} else if (pkt_info & cpu_to_le16(IXGBE_RXDADV_PKTTYPE_IPV6)) {
572 		ip6 = (struct ipv6hdr *)(skb->data + ETH_HLEN);
573 		daddr = &ip6->daddr;
574 		c_hdr = (u8 *)ip6 + sizeof(struct ipv6hdr);
575 	} else {
576 		return;
577 	}
578 
579 	switch (pkt_info & ipsec_pkt_types) {
580 	case cpu_to_le16(IXGBE_RXDADV_PKTTYPE_IPSEC_AH):
581 		spi = ((struct ip_auth_hdr *)c_hdr)->spi;
582 		proto = IPPROTO_AH;
583 		break;
584 	case cpu_to_le16(IXGBE_RXDADV_PKTTYPE_IPSEC_ESP):
585 		spi = ((struct ip_esp_hdr *)c_hdr)->spi;
586 		proto = IPPROTO_ESP;
587 		break;
588 	default:
589 		return;
590 	}
591 
592 	xs = ixgbevf_ipsec_find_rx_state(ipsec, daddr, proto, spi, !!ip4);
593 	if (unlikely(!xs))
594 		return;
595 
596 	sp = secpath_set(skb);
597 	if (unlikely(!sp))
598 		return;
599 
600 	sp->xvec[sp->len++] = xs;
601 	sp->olen++;
602 	xo = xfrm_offload(skb);
603 	xo->flags = CRYPTO_DONE;
604 	xo->status = CRYPTO_SUCCESS;
605 
606 	adapter->rx_ipsec++;
607 }
608 
609 /**
610  * ixgbevf_init_ipsec_offload - initialize registers for IPsec operation
611  * @adapter: board private structure
612  **/
613 void ixgbevf_init_ipsec_offload(struct ixgbevf_adapter *adapter)
614 {
615 	struct ixgbevf_ipsec *ipsec;
616 	size_t size;
617 
618 	switch (adapter->hw.api_version) {
619 	case ixgbe_mbox_api_14:
620 		break;
621 	default:
622 		return;
623 	}
624 
625 	ipsec = kzalloc(sizeof(*ipsec), GFP_KERNEL);
626 	if (!ipsec)
627 		goto err1;
628 	hash_init(ipsec->rx_sa_list);
629 
630 	size = sizeof(struct rx_sa) * IXGBE_IPSEC_MAX_SA_COUNT;
631 	ipsec->rx_tbl = kzalloc(size, GFP_KERNEL);
632 	if (!ipsec->rx_tbl)
633 		goto err2;
634 
635 	size = sizeof(struct tx_sa) * IXGBE_IPSEC_MAX_SA_COUNT;
636 	ipsec->tx_tbl = kzalloc(size, GFP_KERNEL);
637 	if (!ipsec->tx_tbl)
638 		goto err2;
639 
640 	ipsec->num_rx_sa = 0;
641 	ipsec->num_tx_sa = 0;
642 
643 	adapter->ipsec = ipsec;
644 
645 	adapter->netdev->xfrmdev_ops = &ixgbevf_xfrmdev_ops;
646 
647 #define IXGBEVF_ESP_FEATURES	(NETIF_F_HW_ESP | \
648 				 NETIF_F_HW_ESP_TX_CSUM | \
649 				 NETIF_F_GSO_ESP)
650 
651 	adapter->netdev->features |= IXGBEVF_ESP_FEATURES;
652 	adapter->netdev->hw_enc_features |= IXGBEVF_ESP_FEATURES;
653 
654 	return;
655 
656 err2:
657 	kfree(ipsec->rx_tbl);
658 	kfree(ipsec->tx_tbl);
659 	kfree(ipsec);
660 err1:
661 	netdev_err(adapter->netdev, "Unable to allocate memory for SA tables");
662 }
663 
664 /**
665  * ixgbevf_stop_ipsec_offload - tear down the IPsec offload
666  * @adapter: board private structure
667  **/
668 void ixgbevf_stop_ipsec_offload(struct ixgbevf_adapter *adapter)
669 {
670 	struct ixgbevf_ipsec *ipsec = adapter->ipsec;
671 
672 	adapter->ipsec = NULL;
673 	if (ipsec) {
674 		kfree(ipsec->rx_tbl);
675 		kfree(ipsec->tx_tbl);
676 		kfree(ipsec);
677 	}
678 }
679