Commit d785e1fe authored Oct 14, 2020 by Antony Antony Committed by Tony Nguyen Mar 04, 2021

ixgbe: fail to create xfrm offload of IPsec tunnel mode SA



Based on talks and indirect references ixgbe IPsec offlod do not
support IPsec tunnel mode offload. It can only support IPsec transport
mode offload. Now explicitly fail when creating non transport mode SA
with offload to avoid false performance expectations.

Fixes: 63a67fe2 ("ixgbe: add ipsec offload add and remove SA")
Signed-off-by: Antony Antony <antony@phenome.org>
Acked-by: Shannon Nelson <snelson@pensando.io>
Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>

parent a9ecb0cb

drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -575,6 +575,11 @@ static int ixgbe_ipsec_add_sa(struct xfrm_state *xs)
		return -EINVAL;
		}

		if (xs->props.mode != XFRM_MODE_TRANSPORT) {
		netdev_err(dev, "Unsupported mode for ipsec offload\n");
		return -EINVAL;
		}

		if (ixgbe_ipsec_check_mgmt_ip(xs)) {
		netdev_err(dev, "IPsec IP addr clash with mgmt filters\n");
		return -EINVAL;

drivers/net/ethernet/intel/ixgbevf/ipsec.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -272,6 +272,11 @@ static int ixgbevf_ipsec_add_sa(struct xfrm_state *xs)
		return -EINVAL;
		}

		if (xs->props.mode != XFRM_MODE_TRANSPORT) {
		netdev_err(dev, "Unsupported mode for ipsec offload\n");
		return -EINVAL;
		}

		if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) {
		struct rx_sa rsa;