ipsec.c

  1// SPDX-License-Identifier: GPL-2.0
  2/* Copyright(c) 2018 Oracle and/or its affiliates. All rights reserved. */
  3
  4#include "ixgbevf.h"
  5#include <net/xfrm.h>
  6#include <crypto/aead.h>
  7
  8#define IXGBE_IPSEC_KEY_BITS  160
  9static const char aes_gcm_name[] = "rfc4106(gcm(aes))";
 10
 11/**
 12 * ixgbevf_ipsec_set_pf_sa - ask the PF to set up an SA
 13 * @adapter: board private structure
 14 * @xs: xfrm info to be sent to the PF
 15 *
 16 * Returns: positive offload handle from the PF, or negative error code
 17 **/
 18static int ixgbevf_ipsec_set_pf_sa(struct ixgbevf_adapter *adapter,
 19				   struct xfrm_state *xs)
 20{
 21	u32 msgbuf[IXGBE_VFMAILBOX_SIZE] = { 0 };
 22	struct ixgbe_hw *hw = &adapter->hw;
 23	struct sa_mbx_msg *sam;
 24	int ret;
 25
 26	/* send the important bits to the PF */
 27	sam = (struct sa_mbx_msg *)(&msgbuf[1]);
 28	sam->dir = xs->xso.dir;
 29	sam->spi = xs->id.spi;
 30	sam->proto = xs->id.proto;
 31	sam->family = xs->props.family;
 32
 33	if (xs->props.family == AF_INET6)
 34		memcpy(sam->addr, &xs->id.daddr.a6, sizeof(xs->id.daddr.a6));
 35	else
 36		memcpy(sam->addr, &xs->id.daddr.a4, sizeof(xs->id.daddr.a4));
 37	memcpy(sam->key, xs->aead->alg_key, sizeof(sam->key));
 38
 39	msgbuf[0] = IXGBE_VF_IPSEC_ADD;
 40
 41	spin_lock_bh(&adapter->mbx_lock);
 42
 43	ret = ixgbevf_write_mbx(hw, msgbuf, IXGBE_VFMAILBOX_SIZE);
 44	if (ret)
 45		goto out;
 46
 47	ret = ixgbevf_poll_mbx(hw, msgbuf, 2);
 48	if (ret)
 49		goto out;
 50
 51	ret = (int)msgbuf[1];
 52	if (msgbuf[0] & IXGBE_VT_MSGTYPE_FAILURE && ret >= 0)
 53		ret = -1;
 54
 55out:
 56	spin_unlock_bh(&adapter->mbx_lock);
 57
 58	return ret;
 59}
 60
 61/**
 62 * ixgbevf_ipsec_del_pf_sa - ask the PF to delete an SA
 63 * @adapter: board private structure
 64 * @pfsa: sa index returned from PF when created, -1 for all
 65 *
 66 * Returns: 0 on success, or negative error code
 67 **/
 68static int ixgbevf_ipsec_del_pf_sa(struct ixgbevf_adapter *adapter, int pfsa)
 69{
 70	struct ixgbe_hw *hw = &adapter->hw;
 71	u32 msgbuf[2];
 72	int err;
 73
 74	memset(msgbuf, 0, sizeof(msgbuf));
 75	msgbuf[0] = IXGBE_VF_IPSEC_DEL;
 76	msgbuf[1] = (u32)pfsa;
 77
 78	spin_lock_bh(&adapter->mbx_lock);
 79
 80	err = ixgbevf_write_mbx(hw, msgbuf, 2);
 81	if (err)
 82		goto out;
 83
 84	err = ixgbevf_poll_mbx(hw, msgbuf, 2);
 85	if (err)
 86		goto out;
 87
 88out:
 89	spin_unlock_bh(&adapter->mbx_lock);
 90	return err;
 91}
 92
 93/**
 94 * ixgbevf_ipsec_restore - restore the IPsec HW settings after a reset
 95 * @adapter: board private structure
 96 *
 97 * Reload the HW tables from the SW tables after they've been bashed
 98 * by a chip reset.  While we're here, make sure any stale VF data is
 99 * removed, since we go through reset when num_vfs changes.
100 **/
101void ixgbevf_ipsec_restore(struct ixgbevf_adapter *adapter)
102{
103	struct ixgbevf_ipsec *ipsec = adapter->ipsec;
104	struct net_device *netdev = adapter->netdev;
105	int i;
106
107	if (!(adapter->netdev->features & NETIF_F_HW_ESP))
108		return;
109
110	/* reload the Rx and Tx keys */
111	for (i = 0; i < IXGBE_IPSEC_MAX_SA_COUNT; i++) {
112		struct rx_sa *r = &ipsec->rx_tbl[i];
113		struct tx_sa *t = &ipsec->tx_tbl[i];
114		int ret;
115
116		if (r->used) {
117			ret = ixgbevf_ipsec_set_pf_sa(adapter, r->xs);
118			if (ret < 0)
119				netdev_err(netdev, "reload rx_tbl[%d] failed = %d\n",
120					   i, ret);
121		}
122
123		if (t->used) {
124			ret = ixgbevf_ipsec_set_pf_sa(adapter, t->xs);
125			if (ret < 0)
126				netdev_err(netdev, "reload tx_tbl[%d] failed = %d\n",
127					   i, ret);
128		}
129	}
130}
131
132/**
133 * ixgbevf_ipsec_find_empty_idx - find the first unused security parameter index
134 * @ipsec: pointer to IPsec struct
135 * @rxtable: true if we need to look in the Rx table
136 *
137 * Returns the first unused index in either the Rx or Tx SA table
138 **/
139static
140int ixgbevf_ipsec_find_empty_idx(struct ixgbevf_ipsec *ipsec, bool rxtable)
141{
142	u32 i;
143
144	if (rxtable) {
145		if (ipsec->num_rx_sa == IXGBE_IPSEC_MAX_SA_COUNT)
146			return -ENOSPC;
147
148		/* search rx sa table */
149		for (i = 0; i < IXGBE_IPSEC_MAX_SA_COUNT; i++) {
150			if (!ipsec->rx_tbl[i].used)
151				return i;
152		}
153	} else {
154		if (ipsec->num_tx_sa == IXGBE_IPSEC_MAX_SA_COUNT)
155			return -ENOSPC;
156
157		/* search tx sa table */
158		for (i = 0; i < IXGBE_IPSEC_MAX_SA_COUNT; i++) {
159			if (!ipsec->tx_tbl[i].used)
160				return i;
161		}
162	}
163
164	return -ENOSPC;
165}
166
167/**
168 * ixgbevf_ipsec_find_rx_state - find the state that matches
169 * @ipsec: pointer to IPsec struct
170 * @daddr: inbound address to match
171 * @proto: protocol to match
172 * @spi: SPI to match
173 * @ip4: true if using an IPv4 address
174 *
175 * Returns a pointer to the matching SA state information
176 **/
177static
178struct xfrm_state *ixgbevf_ipsec_find_rx_state(struct ixgbevf_ipsec *ipsec,
179					       __be32 *daddr, u8 proto,
180					       __be32 spi, bool ip4)
181{
182	struct xfrm_state *ret = NULL;
183	struct rx_sa *rsa;
184
185	rcu_read_lock();
186	hash_for_each_possible_rcu(ipsec->rx_sa_list, rsa, hlist,
187				   (__force u32)spi) {
188		if (spi == rsa->xs->id.spi &&
189		    ((ip4 && *daddr == rsa->xs->id.daddr.a4) ||
190		      (!ip4 && !memcmp(daddr, &rsa->xs->id.daddr.a6,
191				       sizeof(rsa->xs->id.daddr.a6)))) &&
192		    proto == rsa->xs->id.proto) {
193			ret = rsa->xs;
194			xfrm_state_hold(ret);
195			break;
196		}
197	}
198	rcu_read_unlock();
199	return ret;
200}
201
202/**
203 * ixgbevf_ipsec_parse_proto_keys - find the key and salt based on the protocol
204 * @dev: pointer to net device to program
205 * @xs: pointer to xfrm_state struct
206 * @mykey: pointer to key array to populate
207 * @mysalt: pointer to salt value to populate
208 *
209 * This copies the protocol keys and salt to our own data tables.  The
210 * 82599 family only supports the one algorithm.
211 **/
212static int ixgbevf_ipsec_parse_proto_keys(struct net_device *dev,
213					  struct xfrm_state *xs,
214					  u32 *mykey, u32 *mysalt)
215{
216	unsigned char *key_data;
217	char *alg_name = NULL;
218	int key_len;
219
220	if (!xs->aead) {
221		netdev_err(dev, "Unsupported IPsec algorithm\n");
222		return -EINVAL;
223	}
224
225	if (xs->aead->alg_icv_len != IXGBE_IPSEC_AUTH_BITS) {
226		netdev_err(dev, "IPsec offload requires %d bit authentication\n",
227			   IXGBE_IPSEC_AUTH_BITS);
228		return -EINVAL;
229	}
230
231	key_data = &xs->aead->alg_key[0];
232	key_len = xs->aead->alg_key_len;
233	alg_name = xs->aead->alg_name;
234
235	if (strcmp(alg_name, aes_gcm_name)) {
236		netdev_err(dev, "Unsupported IPsec algorithm - please use %s\n",
237			   aes_gcm_name);
238		return -EINVAL;
239	}
240
241	/* The key bytes come down in a big endian array of bytes, so
242	 * we don't need to do any byte swapping.
243	 * 160 accounts for 16 byte key and 4 byte salt
244	 */
245	if (key_len > IXGBE_IPSEC_KEY_BITS) {
246		*mysalt = ((u32 *)key_data)[4];
247	} else if (key_len == IXGBE_IPSEC_KEY_BITS) {
248		*mysalt = 0;
249	} else {
250		netdev_err(dev, "IPsec hw offload only supports keys up to 128 bits with a 32 bit salt\n");
251		return -EINVAL;
252	}
253	memcpy(mykey, key_data, 16);
254
255	return 0;
256}
257
258/**
259 * ixgbevf_ipsec_add_sa - program device with a security association
260 * @dev: pointer to net device to program
261 * @xs: pointer to transformer state struct
262 * @extack: extack point to fill failure reason
263 **/
264static int ixgbevf_ipsec_add_sa(struct net_device *dev,
265				struct xfrm_state *xs,
266				struct netlink_ext_ack *extack)
267{
268	struct ixgbevf_adapter *adapter;
269	struct ixgbevf_ipsec *ipsec;
270	u16 sa_idx;
271	int ret;
272
273	adapter = netdev_priv(dev);
274	ipsec = adapter->ipsec;
275
276	if (!(adapter->pf_features & IXGBEVF_PF_SUP_IPSEC))
277		return -EOPNOTSUPP;
278
279	if (xs->id.proto != IPPROTO_ESP && xs->id.proto != IPPROTO_AH) {
280		NL_SET_ERR_MSG_MOD(extack, "Unsupported protocol for IPsec offload");
281		return -EINVAL;
282	}
283
284	if (xs->props.mode != XFRM_MODE_TRANSPORT) {
285		NL_SET_ERR_MSG_MOD(extack, "Unsupported mode for ipsec offload");
286		return -EINVAL;
287	}
288
289	if (xs->xso.type != XFRM_DEV_OFFLOAD_CRYPTO) {
290		NL_SET_ERR_MSG_MOD(extack, "Unsupported ipsec offload type");
291		return -EINVAL;
292	}
293
294	if (xs->xso.dir == XFRM_DEV_OFFLOAD_IN) {
295		struct rx_sa rsa;
296
297		if (xs->calg) {
298			NL_SET_ERR_MSG_MOD(extack, "Compression offload not supported");
299			return -EINVAL;
300		}
301
302		/* find the first unused index */
303		ret = ixgbevf_ipsec_find_empty_idx(ipsec, true);
304		if (ret < 0) {
305			NL_SET_ERR_MSG_MOD(extack, "No space for SA in Rx table!");
306			return ret;
307		}
308		sa_idx = (u16)ret;
309
310		memset(&rsa, 0, sizeof(rsa));
311		rsa.used = true;
312		rsa.xs = xs;
313
314		if (rsa.xs->id.proto & IPPROTO_ESP)
315			rsa.decrypt = xs->ealg || xs->aead;
316
317		/* get the key and salt */
318		ret = ixgbevf_ipsec_parse_proto_keys(dev, xs, rsa.key,
319						     &rsa.salt);
320		if (ret) {
321			NL_SET_ERR_MSG_MOD(extack, "Failed to get key data for Rx SA table");
322			return ret;
323		}
324
325		/* get ip for rx sa table */
326		if (xs->props.family == AF_INET6)
327			memcpy(rsa.ipaddr, &xs->id.daddr.a6, 16);
328		else
329			memcpy(&rsa.ipaddr[3], &xs->id.daddr.a4, 4);
330
331		rsa.mode = IXGBE_RXMOD_VALID;
332		if (rsa.xs->id.proto & IPPROTO_ESP)
333			rsa.mode |= IXGBE_RXMOD_PROTO_ESP;
334		if (rsa.decrypt)
335			rsa.mode |= IXGBE_RXMOD_DECRYPT;
336		if (rsa.xs->props.family == AF_INET6)
337			rsa.mode |= IXGBE_RXMOD_IPV6;
338
339		ret = ixgbevf_ipsec_set_pf_sa(adapter, xs);
340		if (ret < 0)
341			return ret;
342		rsa.pfsa = ret;
343
344		/* the preparations worked, so save the info */
345		memcpy(&ipsec->rx_tbl[sa_idx], &rsa, sizeof(rsa));
346
347		xs->xso.offload_handle = sa_idx + IXGBE_IPSEC_BASE_RX_INDEX;
348
349		ipsec->num_rx_sa++;
350
351		/* hash the new entry for faster search in Rx path */
352		hash_add_rcu(ipsec->rx_sa_list, &ipsec->rx_tbl[sa_idx].hlist,
353			     (__force u32)rsa.xs->id.spi);
354	} else {
355		struct tx_sa tsa;
356
357		/* find the first unused index */
358		ret = ixgbevf_ipsec_find_empty_idx(ipsec, false);
359		if (ret < 0) {
360			NL_SET_ERR_MSG_MOD(extack, "No space for SA in Tx table");
361			return ret;
362		}
363		sa_idx = (u16)ret;
364
365		memset(&tsa, 0, sizeof(tsa));
366		tsa.used = true;
367		tsa.xs = xs;
368
369		if (xs->id.proto & IPPROTO_ESP)
370			tsa.encrypt = xs->ealg || xs->aead;
371
372		ret = ixgbevf_ipsec_parse_proto_keys(dev, xs, tsa.key,
373						     &tsa.salt);
374		if (ret) {
375			NL_SET_ERR_MSG_MOD(extack, "Failed to get key data for Tx SA table");
376			memset(&tsa, 0, sizeof(tsa));
377			return ret;
378		}
379
380		ret = ixgbevf_ipsec_set_pf_sa(adapter, xs);
381		if (ret < 0)
382			return ret;
383		tsa.pfsa = ret;
384
385		/* the preparations worked, so save the info */
386		memcpy(&ipsec->tx_tbl[sa_idx], &tsa, sizeof(tsa));
387
388		xs->xso.offload_handle = sa_idx + IXGBE_IPSEC_BASE_TX_INDEX;
389
390		ipsec->num_tx_sa++;
391	}
392
393	return 0;
394}
395
396/**
397 * ixgbevf_ipsec_del_sa - clear out this specific SA
398 * @dev: pointer to net device to program
399 * @xs: pointer to transformer state struct
400 **/
401static void ixgbevf_ipsec_del_sa(struct net_device *dev,
402				 struct xfrm_state *xs)
403{
404	struct ixgbevf_adapter *adapter;
405	struct ixgbevf_ipsec *ipsec;
406	u16 sa_idx;
407
408	adapter = netdev_priv(dev);
409	ipsec = adapter->ipsec;
410
411	if (!(adapter->pf_features & IXGBEVF_PF_SUP_IPSEC))
412		return;
413
414	if (xs->xso.dir == XFRM_DEV_OFFLOAD_IN) {
415		sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_RX_INDEX;
416
417		if (!ipsec->rx_tbl[sa_idx].used) {
418			netdev_err(dev, "Invalid Rx SA selected sa_idx=%d offload_handle=%lu\n",
419				   sa_idx, xs->xso.offload_handle);
420			return;
421		}
422
423		ixgbevf_ipsec_del_pf_sa(adapter, ipsec->rx_tbl[sa_idx].pfsa);
424		hash_del_rcu(&ipsec->rx_tbl[sa_idx].hlist);
425		memset(&ipsec->rx_tbl[sa_idx], 0, sizeof(struct rx_sa));
426		ipsec->num_rx_sa--;
427	} else {
428		sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_TX_INDEX;
429
430		if (!ipsec->tx_tbl[sa_idx].used) {
431			netdev_err(dev, "Invalid Tx SA selected sa_idx=%d offload_handle=%lu\n",
432				   sa_idx, xs->xso.offload_handle);
433			return;
434		}
435
436		ixgbevf_ipsec_del_pf_sa(adapter, ipsec->tx_tbl[sa_idx].pfsa);
437		memset(&ipsec->tx_tbl[sa_idx], 0, sizeof(struct tx_sa));
438		ipsec->num_tx_sa--;
439	}
440}
441
442static const struct xfrmdev_ops ixgbevf_xfrmdev_ops = {
443	.xdo_dev_state_add = ixgbevf_ipsec_add_sa,
444	.xdo_dev_state_delete = ixgbevf_ipsec_del_sa,
445};
446
447/**
448 * ixgbevf_ipsec_tx - setup Tx flags for IPsec offload
449 * @tx_ring: outgoing context
450 * @first: current data packet
451 * @itd: ipsec Tx data for later use in building context descriptor
452 **/
453int ixgbevf_ipsec_tx(struct ixgbevf_ring *tx_ring,
454		     struct ixgbevf_tx_buffer *first,
455		     struct ixgbevf_ipsec_tx_data *itd)
456{
457	struct ixgbevf_adapter *adapter = netdev_priv(tx_ring->netdev);
458	struct ixgbevf_ipsec *ipsec = adapter->ipsec;
459	struct xfrm_state *xs;
460	struct sec_path *sp;
461	struct tx_sa *tsa;
462	u16 sa_idx;
463
464	sp = skb_sec_path(first->skb);
465	if (unlikely(!sp->len)) {
466		netdev_err(tx_ring->netdev, "%s: no xfrm state len = %d\n",
467			   __func__, sp->len);
468		return 0;
469	}
470
471	xs = xfrm_input_state(first->skb);
472	if (unlikely(!xs)) {
473		netdev_err(tx_ring->netdev, "%s: no xfrm_input_state() xs = %p\n",
474			   __func__, xs);
475		return 0;
476	}
477
478	sa_idx = xs->xso.offload_handle - IXGBE_IPSEC_BASE_TX_INDEX;
479	if (unlikely(sa_idx >= IXGBE_IPSEC_MAX_SA_COUNT)) {
480		netdev_err(tx_ring->netdev, "%s: bad sa_idx=%d handle=%lu\n",
481			   __func__, sa_idx, xs->xso.offload_handle);
482		return 0;
483	}
484
485	tsa = &ipsec->tx_tbl[sa_idx];
486	if (unlikely(!tsa->used)) {
487		netdev_err(tx_ring->netdev, "%s: unused sa_idx=%d\n",
488			   __func__, sa_idx);
489		return 0;
490	}
491
492	itd->pfsa = tsa->pfsa - IXGBE_IPSEC_BASE_TX_INDEX;
493
494	first->tx_flags |= IXGBE_TX_FLAGS_IPSEC | IXGBE_TX_FLAGS_CSUM;
495
496	if (xs->id.proto == IPPROTO_ESP) {
497		itd->flags |= IXGBE_ADVTXD_TUCMD_IPSEC_TYPE_ESP |
498			      IXGBE_ADVTXD_TUCMD_L4T_TCP;
499		if (first->protocol == htons(ETH_P_IP))
500			itd->flags |= IXGBE_ADVTXD_TUCMD_IPV4;
501
502		/* The actual trailer length is authlen (16 bytes) plus
503		 * 2 bytes for the proto and the padlen values, plus
504		 * padlen bytes of padding.  This ends up not the same
505		 * as the static value found in xs->props.trailer_len (21).
506		 *
507		 * ... but if we're doing GSO, don't bother as the stack
508		 * doesn't add a trailer for those.
509		 */
510		if (!skb_is_gso(first->skb)) {
511			/* The "correct" way to get the auth length would be
512			 * to use
513			 *    authlen = crypto_aead_authsize(xs->data);
514			 * but since we know we only have one size to worry
515			 * about * we can let the compiler use the constant
516			 * and save us a few CPU cycles.
517			 */
518			const int authlen = IXGBE_IPSEC_AUTH_BITS / 8;
519			struct sk_buff *skb = first->skb;
520			u8 padlen;
521			int ret;
522
523			ret = skb_copy_bits(skb, skb->len - (authlen + 2),
524					    &padlen, 1);
525			if (unlikely(ret))
526				return 0;
527			itd->trailer_len = authlen + 2 + padlen;
528		}
529	}
530	if (tsa->encrypt)
531		itd->flags |= IXGBE_ADVTXD_TUCMD_IPSEC_ENCRYPT_EN;
532
533	return 1;
534}
535
536/**
537 * ixgbevf_ipsec_rx - decode IPsec bits from Rx descriptor
538 * @rx_ring: receiving ring
539 * @rx_desc: receive data descriptor
540 * @skb: current data packet
541 *
542 * Determine if there was an IPsec encapsulation noticed, and if so set up
543 * the resulting status for later in the receive stack.
544 **/
545void ixgbevf_ipsec_rx(struct ixgbevf_ring *rx_ring,
546		      union ixgbe_adv_rx_desc *rx_desc,
547		      struct sk_buff *skb)
548{
549	struct ixgbevf_adapter *adapter = netdev_priv(rx_ring->netdev);
550	__le16 pkt_info = rx_desc->wb.lower.lo_dword.hs_rss.pkt_info;
551	__le16 ipsec_pkt_types = cpu_to_le16(IXGBE_RXDADV_PKTTYPE_IPSEC_AH |
552					     IXGBE_RXDADV_PKTTYPE_IPSEC_ESP);
553	struct ixgbevf_ipsec *ipsec = adapter->ipsec;
554	struct xfrm_offload *xo = NULL;
555	struct xfrm_state *xs = NULL;
556	struct ipv6hdr *ip6 = NULL;
557	struct iphdr *ip4 = NULL;
558	struct sec_path *sp;
559	void *daddr;
560	__be32 spi;
561	u8 *c_hdr;
562	u8 proto;
563
564	/* Find the IP and crypto headers in the data.
565	 * We can assume no VLAN header in the way, b/c the
566	 * hw won't recognize the IPsec packet and anyway the
567	 * currently VLAN device doesn't support xfrm offload.
568	 */
569	if (pkt_info & cpu_to_le16(IXGBE_RXDADV_PKTTYPE_IPV4)) {
570		ip4 = (struct iphdr *)(skb->data + ETH_HLEN);
571		daddr = &ip4->daddr;
572		c_hdr = (u8 *)ip4 + ip4->ihl * 4;
573	} else if (pkt_info & cpu_to_le16(IXGBE_RXDADV_PKTTYPE_IPV6)) {
574		ip6 = (struct ipv6hdr *)(skb->data + ETH_HLEN);
575		daddr = &ip6->daddr;
576		c_hdr = (u8 *)ip6 + sizeof(struct ipv6hdr);
577	} else {
578		return;
579	}
580
581	switch (pkt_info & ipsec_pkt_types) {
582	case cpu_to_le16(IXGBE_RXDADV_PKTTYPE_IPSEC_AH):
583		spi = ((struct ip_auth_hdr *)c_hdr)->spi;
584		proto = IPPROTO_AH;
585		break;
586	case cpu_to_le16(IXGBE_RXDADV_PKTTYPE_IPSEC_ESP):
587		spi = ((struct ip_esp_hdr *)c_hdr)->spi;
588		proto = IPPROTO_ESP;
589		break;
590	default:
591		return;
592	}
593
594	xs = ixgbevf_ipsec_find_rx_state(ipsec, daddr, proto, spi, !!ip4);
595	if (unlikely(!xs))
596		return;
597
598	sp = secpath_set(skb);
599	if (unlikely(!sp))
600		return;
601
602	sp->xvec[sp->len++] = xs;
603	sp->olen++;
604	xo = xfrm_offload(skb);
605	xo->flags = CRYPTO_DONE;
606	xo->status = CRYPTO_SUCCESS;
607
608	adapter->rx_ipsec++;
609}
610
611/**
612 * ixgbevf_init_ipsec_offload - initialize registers for IPsec operation
613 * @adapter: board private structure
614 **/
615void ixgbevf_init_ipsec_offload(struct ixgbevf_adapter *adapter)
616{
617	struct ixgbevf_ipsec *ipsec;
618	size_t size;
619
620	switch (adapter->hw.api_version) {
621	case ixgbe_mbox_api_17:
622		if (!(adapter->pf_features & IXGBEVF_PF_SUP_IPSEC))
623			return;
624		break;
625	case ixgbe_mbox_api_14:
626		break;
627	default:
628		return;
629	}
630
631	ipsec = kzalloc(sizeof(*ipsec), GFP_KERNEL);
632	if (!ipsec)
633		goto err1;
634	hash_init(ipsec->rx_sa_list);
635
636	size = sizeof(struct rx_sa) * IXGBE_IPSEC_MAX_SA_COUNT;
637	ipsec->rx_tbl = kzalloc(size, GFP_KERNEL);
638	if (!ipsec->rx_tbl)
639		goto err2;
640
641	size = sizeof(struct tx_sa) * IXGBE_IPSEC_MAX_SA_COUNT;
642	ipsec->tx_tbl = kzalloc(size, GFP_KERNEL);
643	if (!ipsec->tx_tbl)
644		goto err2;
645
646	ipsec->num_rx_sa = 0;
647	ipsec->num_tx_sa = 0;
648
649	adapter->ipsec = ipsec;
650
651	adapter->netdev->xfrmdev_ops = &ixgbevf_xfrmdev_ops;
652
653#define IXGBEVF_ESP_FEATURES	(NETIF_F_HW_ESP | \
654				 NETIF_F_HW_ESP_TX_CSUM | \
655				 NETIF_F_GSO_ESP)
656
657	adapter->netdev->features |= IXGBEVF_ESP_FEATURES;
658	adapter->netdev->hw_enc_features |= IXGBEVF_ESP_FEATURES;
659
660	return;
661
662err2:
663	kfree(ipsec->rx_tbl);
664	kfree(ipsec->tx_tbl);
665	kfree(ipsec);
666err1:
667	netdev_err(adapter->netdev, "Unable to allocate memory for SA tables");
668}
669
670/**
671 * ixgbevf_stop_ipsec_offload - tear down the IPsec offload
672 * @adapter: board private structure
673 **/
674void ixgbevf_stop_ipsec_offload(struct ixgbevf_adapter *adapter)
675{
676	struct ixgbevf_ipsec *ipsec = adapter->ipsec;
677
678	adapter->ipsec = NULL;
679	if (ipsec) {
680		kfree(ipsec->rx_tbl);
681		kfree(ipsec->tx_tbl);
682		kfree(ipsec);
683	}
684}