68 	struct mlx5_core_dev *mdev = mlx5e_ipsec_sa2dev(sa_entry);  in mlx5e_ipsec_handle_counters_onedir()  local
70 	mlx5_fc_query(mdev, ipsec_rule->fc, packets, bytes);  in mlx5e_ipsec_handle_counters_onedir()
249 static int mlx5e_xfrm_validate_state(struct mlx5_core_dev *mdev,  in mlx5e_xfrm_validate_state()  argument
256 	if (!(mlx5_ipsec_device_caps(mdev) &  in mlx5e_xfrm_validate_state()
258 		mlx5_core_err(mdev, "FULL offload is not supported\n");  in mlx5e_xfrm_validate_state()
264 		mlx5_core_err(mdev, "Cannot offload authenticated xfrm states\n");  in mlx5e_xfrm_validate_state()
268 		mlx5_core_err(mdev, "Only IPSec aes-gcm-16 encryption protocol may be offloaded\n");  in mlx5e_xfrm_validate_state()
272 		mlx5_core_err(mdev, "Cannot offload compressed xfrm states\n");  in mlx5e_xfrm_validate_state()
276 		mlx5_core_err(mdev, "Cannot offload xfrm states with AEAD key length other than 128/256 bits\n");  in mlx5e_xfrm_validate_state()
281 		mlx5_core_err(mdev, "Only IPv4/6 xfrm states may be offloaded\n");  in mlx5e_xfrm_validate_state()
285 		mlx5_core_err(mdev, "Only ESP xfrm state may be offloaded\n");  in mlx5e_xfrm_validate_state()
291 		mlx5_core_err(mdev, "Cannot offload xfrm states with AEAD key length other than 128/256 bit\n");  in mlx5e_xfrm_validate_state()
296 		mlx5_core_err(mdev, "Only transport xfrm states may be offloaded in full offload mode\n");  in mlx5e_xfrm_validate_state()
301 		if (!(mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_ESPINUDP)) {  in mlx5e_xfrm_validate_state()
302 			mlx5_core_err(mdev, "Encapsulation is not supported\n");  in mlx5e_xfrm_validate_state()
309 		mlx5_core_err(mdev, "Unsupported replay window size %d\n", savp->replay->wsize);  in mlx5e_xfrm_validate_state()
314 		if ((mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_ESN) == 0) {  in mlx5e_xfrm_validate_state()
315 			mlx5_core_err(mdev, "ESN is not supported\n");  in mlx5e_xfrm_validate_state()
319 		mlx5_core_warn(mdev,  in mlx5e_xfrm_validate_state()
336 	struct mlx5_core_dev *mdev = priv->mdev;  in mlx5e_if_sa_newkey_onedir()  local
350 	err = mlx5e_xfrm_validate_state(mdev, sav);  in mlx5e_if_sa_newkey_onedir()
371 	err = mlx5e_xfrm_validate_state(mdev, sav);  in mlx5e_if_sa_newkey_onedir()
400 	err = xa_insert(&mdev->ipsec_sadb, sa_entry->ipsec_obj_id, sa_entry, GFP_KERNEL);  in mlx5e_if_sa_newkey_onedir()
465 	struct mlx5_core_dev *mdev = mlx5e_ipsec_sa2dev(sa_entry);  in mlx5e_if_sa_deinstall_onekey()  local
468 	old = xa_erase(&mdev->ipsec_sadb, sa_entry->ipsec_obj_id);  in mlx5e_if_sa_deinstall_onekey()
507 	struct mlx5_core_dev *mdev = mlx5e_ipsec_sa2dev(sa_entry);  in mlx5e_if_sa_cnt_one()  local
509 	mlx5_fc_query(mdev, ipsec_rule->fc, packets, bytes);  in mlx5e_if_sa_cnt_one()
535 static int mlx5e_xfrm_validate_policy(struct mlx5_core_dev *mdev,  in mlx5e_xfrm_validate_policy()  argument
540 	if (!(mlx5_ipsec_device_caps(mdev) &  in mlx5e_xfrm_validate_policy()
542 		mlx5_core_err(mdev, "FULL offload is not supported\n");  in mlx5e_xfrm_validate_policy()
547 		mlx5_core_err(mdev, "Can offload exactly one template, "  in mlx5e_xfrm_validate_policy()
553             !(mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_PRIO)) {  in mlx5e_xfrm_validate_policy()
554 		mlx5_core_err(mdev, "Device does not support policy priority\n");  in mlx5e_xfrm_validate_policy()
559 		mlx5_core_err(mdev, "Not valid input data\n");  in mlx5e_xfrm_validate_policy()
564 		mlx5_core_err(mdev, "Wrong policy direction\n");  in mlx5e_xfrm_validate_policy()
569 		mlx5_core_err(mdev, "Device supports transport mode only");  in mlx5e_xfrm_validate_policy()
575                 mlx5_core_err(mdev, "Offloaded policy must be specific on its action\n");  in mlx5e_xfrm_validate_policy()
580 		mlx5_core_err(mdev, "Missing port information for IKE bypass\n");  in mlx5e_xfrm_validate_policy()
588 			mlx5_core_err(mdev, "Unsupported IKE bypass protocol %d\n",  in mlx5e_xfrm_validate_policy()
667 	err = mlx5e_xfrm_validate_policy(priv->mdev, sp, inp1);  in mlx5e_if_spd_install()
744 	struct mlx5_core_dev *mdev = priv->mdev;  in mlx5e_ipsec_init()  local
749 	mlx5_core_info(mdev, "ipsec "  in mlx5e_ipsec_init()
759 	    MLX5_CAP_GEN(mdev, ipsec_offload) != 0,  in mlx5e_ipsec_init()
760 	    MLX5_CAP_GEN(mdev, log_max_dek) != 0,  in mlx5e_ipsec_init()
761 	    (MLX5_CAP_GEN_64(mdev, general_obj_types) &  in mlx5e_ipsec_init()
763 	    MLX5_CAP_FLOWTABLE_NIC_TX(mdev, ipsec_encrypt) != 0,  in mlx5e_ipsec_init()
764 	    MLX5_CAP_FLOWTABLE_NIC_RX(mdev, ipsec_decrypt) != 0,  in mlx5e_ipsec_init()
765 	    MLX5_CAP_IPSEC(mdev, ipsec_crypto_esp_aes_gcm_128_encrypt) != 0,  in mlx5e_ipsec_init()
766 	    MLX5_CAP_IPSEC(mdev, ipsec_crypto_esp_aes_gcm_128_decrypt) != 0,  in mlx5e_ipsec_init()
767 	    MLX5_CAP_IPSEC(mdev, ipsec_full_offload) != 0,  in mlx5e_ipsec_init()
768             MLX5_CAP_FLOWTABLE_NIC_TX(mdev, reformat_add_esp_trasport) != 0,  in mlx5e_ipsec_init()
769             MLX5_CAP_FLOWTABLE_NIC_RX(mdev, reformat_del_esp_trasport) != 0,  in mlx5e_ipsec_init()
770             MLX5_CAP_FLOWTABLE_NIC_RX(mdev, decap) != 0,  in mlx5e_ipsec_init()
771 	    MLX5_CAP_FLOWTABLE_NIC_TX(mdev, ignore_flow_level) != 0,  in mlx5e_ipsec_init()
772 	    MLX5_CAP_FLOWTABLE_NIC_RX(mdev, ignore_flow_level) != 0,  in mlx5e_ipsec_init()
773 	    MLX5_CAP_FLOWTABLE_NIC_TX(mdev,  in mlx5e_ipsec_init()
775 	    MLX5_CAP_FLOWTABLE_NIC_RX(mdev,  in mlx5e_ipsec_init()
777 	    MLX5_CAP_IPSEC(mdev, ipsec_esn) != 0);  in mlx5e_ipsec_init()
779 	if (!(mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_PACKET_OFFLOAD)) {  in mlx5e_ipsec_init()
780 		mlx5_core_dbg(mdev, "Not an IPSec offload device\n");  in mlx5e_ipsec_init()
784 	xa_init_flags(&mdev->ipsec_sadb, XA_FLAGS_ALLOC);  in mlx5e_ipsec_init()
790 	pipsec->mdev = mdev;  in mlx5e_ipsec_init()
810 	mlx5_core_dbg(mdev, "IPSec attached to netdevice\n");  in mlx5e_ipsec_init()
819 	mlx5_core_err(priv->mdev, "IPSec initialization failed, %d\n", ret);  in mlx5e_ipsec_init()