From: Bharat Bhushan Date: Wed, 4 Dec 2024 05:56:58 +0000 (+0530) Subject: cn10k-ipsec: Allow ipsec crypto offload for skb with SA X-Git-Tag: v6.14-rc1~162^2~262^2~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=32188be805d052a91b999a723fd93698d83a7fa5;p=thirdparty%2Fkernel%2Flinux.git cn10k-ipsec: Allow ipsec crypto offload for skb with SA Allow to use hardware offload for outbound ipsec crypto mode if security association (SA) is set for a given skb. Signed-off-by: Bharat Bhushan Signed-off-by: David S. Miller --- diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_ipsec.c b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_ipsec.c index 9a9b06f4c2cc3..e9bf4632695e0 100644 --- a/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_ipsec.c +++ b/drivers/net/ethernet/marvell/octeontx2/nic/cn10k_ipsec.c @@ -746,9 +746,24 @@ static void cn10k_ipsec_del_state(struct xfrm_state *x) queue_work(pf->ipsec.sa_workq, &pf->ipsec.sa_work); } +static bool cn10k_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *x) +{ + if (x->props.family == AF_INET) { + /* Offload with IPv4 options is not supported yet */ + if (ip_hdr(skb)->ihl > 5) + return false; + } else { + /* Offload with IPv6 extension headers is not support yet */ + if (ipv6_ext_hdr(ipv6_hdr(skb)->nexthdr)) + return false; + } + return true; +} + static const struct xfrmdev_ops cn10k_ipsec_xfrmdev_ops = { .xdo_dev_state_add = cn10k_ipsec_add_state, .xdo_dev_state_delete = cn10k_ipsec_del_state, + .xdo_dev_offload_ok = cn10k_ipsec_offload_ok, }; static void cn10k_ipsec_sa_wq_handler(struct work_struct *work)