net/mlx5: Simplify IPsec capabilities logic

Reduce number of hard-coded IPsec capabilities by making sure
that mlx5_ipsec_device_caps() sets only supported bits.

As part of this change, remove _ACCEL_ notations from the capabilities
names as they represent IPsec-capable device, so it is aligned with
MLX5_CAP_IPSEC() macro. And prepare the code to IPsec full offload mode.

Reviewed-by: Raed Salem <raeds@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
index 28729b1..be7650d 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
@@ -215,7 +215,7 @@ static inline int mlx5e_xfrm_validate_state(struct xfrm_state *x)
                return -EINVAL;
        }
        if (x->props.flags & XFRM_STATE_ESN &&
-           !(mlx5_ipsec_device_caps(priv->mdev) & MLX5_ACCEL_IPSEC_CAP_ESN)) {
+           !(mlx5_ipsec_device_caps(priv->mdev) & MLX5_IPSEC_CAP_ESN)) {
                netdev_info(netdev, "Cannot offload ESN xfrm states\n");
                return -EINVAL;
        }
@@ -262,11 +262,6 @@ static inline int mlx5e_xfrm_validate_state(struct xfrm_state *x)
                netdev_info(netdev, "Cannot offload xfrm states with geniv other than seqiv\n");
                return -EINVAL;
        }
-       if (x->props.family == AF_INET6 &&
-           !(mlx5_ipsec_device_caps(priv->mdev) & MLX5_ACCEL_IPSEC_CAP_IPV6)) {
-               netdev_info(netdev, "IPv6 xfrm state offload is not supported by this device\n");
-               return -EINVAL;
-       }
        return 0;
 }
 
@@ -457,12 +452,6 @@ void mlx5e_ipsec_build_netdev(struct mlx5e_priv *priv)
        if (!mlx5_ipsec_device_caps(mdev))
                return;
 
-       if (!(mlx5_ipsec_device_caps(mdev) & MLX5_ACCEL_IPSEC_CAP_ESP) ||
-           !MLX5_CAP_ETH(mdev, swp)) {
-               mlx5_core_dbg(mdev, "mlx5e: ESP and SWP offload not supported\n");
-               return;
-       }
-
        mlx5_core_info(mdev, "mlx5e: IPSec ESP acceleration enabled\n");
        netdev->xfrmdev_ops = &mlx5e_ipsec_xfrmdev_ops;
        netdev->features |= NETIF_F_HW_ESP;
@@ -476,8 +465,7 @@ void mlx5e_ipsec_build_netdev(struct mlx5e_priv *priv)
        netdev->features |= NETIF_F_HW_ESP_TX_CSUM;
        netdev->hw_enc_features |= NETIF_F_HW_ESP_TX_CSUM;
 
-       if (!(mlx5_ipsec_device_caps(mdev) & MLX5_ACCEL_IPSEC_CAP_LSO) ||
-           !MLX5_CAP_ETH(mdev, swp_lso)) {
+       if (!MLX5_CAP_ETH(mdev, swp_lso)) {
                mlx5_core_dbg(mdev, "mlx5e: ESP LSO not supported\n");
                return;
        }

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
index af1467c..97c5562 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h
@@ -102,12 +102,9 @@ struct mlx5_accel_esp_xfrm_attrs {
        u8 is_ipv6;
 };
 
-enum mlx5_accel_ipsec_cap {
-       MLX5_ACCEL_IPSEC_CAP_DEVICE             = 1 << 0,
-       MLX5_ACCEL_IPSEC_CAP_ESP                = 1 << 1,
-       MLX5_ACCEL_IPSEC_CAP_IPV6               = 1 << 2,
-       MLX5_ACCEL_IPSEC_CAP_LSO                = 1 << 3,
-       MLX5_ACCEL_IPSEC_CAP_ESN                = 1 << 4,
+enum mlx5_ipsec_cap {
+       MLX5_IPSEC_CAP_CRYPTO           = 1 << 0,
+       MLX5_IPSEC_CAP_ESN              = 1 << 1,
 };
 
 struct mlx5e_priv;

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c
index 817747d..b44bce3 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c
@@ -7,7 +7,7 @@
 
 u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev)
 {
-       u32 caps;
+       u32 caps = 0;
 
        if (!MLX5_CAP_GEN(mdev, ipsec_offload))
                return 0;
@@ -19,23 +19,23 @@ u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev)
            MLX5_HCA_CAP_GENERAL_OBJECT_TYPES_IPSEC))
                return 0;
 
-       if (!MLX5_CAP_IPSEC(mdev, ipsec_crypto_offload) ||
-           !MLX5_CAP_ETH(mdev, insert_trailer))
-               return 0;
-
        if (!MLX5_CAP_FLOWTABLE_NIC_TX(mdev, ipsec_encrypt) ||
            !MLX5_CAP_FLOWTABLE_NIC_RX(mdev, ipsec_decrypt))
                return 0;
 
-       caps = MLX5_ACCEL_IPSEC_CAP_DEVICE | MLX5_ACCEL_IPSEC_CAP_IPV6 |
-              MLX5_ACCEL_IPSEC_CAP_LSO;
+       if (!MLX5_CAP_IPSEC(mdev, ipsec_crypto_esp_aes_gcm_128_encrypt) ||
+           !MLX5_CAP_IPSEC(mdev, ipsec_crypto_esp_aes_gcm_128_decrypt))
+               return 0;
 
-       if (MLX5_CAP_IPSEC(mdev, ipsec_crypto_esp_aes_gcm_128_encrypt) &&
-           MLX5_CAP_IPSEC(mdev, ipsec_crypto_esp_aes_gcm_128_decrypt))
-               caps |= MLX5_ACCEL_IPSEC_CAP_ESP;
+       if (MLX5_CAP_IPSEC(mdev, ipsec_crypto_offload) &&
+           MLX5_CAP_ETH(mdev, insert_trailer) && MLX5_CAP_ETH(mdev, swp))
+               caps |= MLX5_IPSEC_CAP_CRYPTO;
+
+       if (!caps)
+               return 0;
 
        if (MLX5_CAP_IPSEC(mdev, ipsec_esn))
-               caps |= MLX5_ACCEL_IPSEC_CAP_ESN;
+               caps |= MLX5_IPSEC_CAP_ESN;
 
        /* We can accommodate up to 2^24 different IPsec objects
         * because we use up to 24 bit in flow table metadata