drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c

   1 /*
   2  * Copyright (c) 2017 Mellanox Technologies. All rights reserved.
   3  *
   4  * This software is available to you under a choice of one of two
   5  * licenses.  You may choose to be licensed under the terms of the GNU
   6  * General Public License (GPL) Version 2, available from the file
   7  * COPYING in the main directory of this source tree, or the
   8  * OpenIB.org BSD license below:
   9  *
  10  *     Redistribution and use in source and binary forms, with or
  11  *     without modification, are permitted provided that the following
  12  *     conditions are met:
  13  *
  14  *      - Redistributions of source code must retain the above
  15  *        copyright notice, this list of conditions and the following
  16  *        disclaimer.
  17  *
  18  *      - Redistributions in binary form must reproduce the above
  19  *        copyright notice, this list of conditions and the following
  20  *        disclaimer in the documentation and/or other materials
  21  *        provided with the distribution.
  22  *
  23  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  24  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  25  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  26  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  27  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  28  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  29  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  30  * SOFTWARE.
  31  *
  32  */
  33
  34 #include <crypto/internal/geniv.h>
  35 #include <crypto/aead.h>
  36 #include <linux/inetdevice.h>
  37 #include <linux/netdevice.h>
  38
  39 #include "en.h"
  40 #include "en_accel/ipsec.h"
  41 #include "en_accel/ipsec_rxtx.h"
  42 #include "en_accel/ipsec_fs.h"
  43
  44 static struct mlx5e_ipsec_sa_entry *to_ipsec_sa_entry(struct xfrm_state *x)
  45 {
  46         struct mlx5e_ipsec_sa_entry *sa;
  47
  48         if (!x)
  49                 return NULL;
  50
  51         sa = (struct mlx5e_ipsec_sa_entry *)x->xso.offload_handle;
  52         if (!sa)
  53                 return NULL;
  54
  55         WARN_ON(sa->x != x);
  56         return sa;
  57 }
  58
  59 struct xfrm_state *mlx5e_ipsec_sadb_rx_lookup(struct mlx5e_ipsec *ipsec,
  60                                               unsigned int handle)
  61 {
  62         struct mlx5e_ipsec_sa_entry *sa_entry;
  63         struct xfrm_state *ret = NULL;
  64
  65         rcu_read_lock();
  66         hash_for_each_possible_rcu(ipsec->sadb_rx, sa_entry, hlist, handle)
  67                 if (sa_entry->handle == handle) {
  68                         ret = sa_entry->x;
  69                         xfrm_state_hold(ret);
  70                         break;
  71                 }
  72         rcu_read_unlock();
  73
  74         return ret;
  75 }
  76
  77 static int  mlx5e_ipsec_sadb_rx_add(struct mlx5e_ipsec_sa_entry *sa_entry,
  78                                     unsigned int handle)
  79 {
  80         struct mlx5e_ipsec *ipsec = sa_entry->ipsec;
  81         struct mlx5e_ipsec_sa_entry *_sa_entry;
  82         unsigned long flags;
  83
  84         rcu_read_lock();
  85         hash_for_each_possible_rcu(ipsec->sadb_rx, _sa_entry, hlist, handle)
  86                 if (_sa_entry->handle == handle) {
  87                         rcu_read_unlock();
  88                         return  -EEXIST;
  89                 }
  90         rcu_read_unlock();
  91
  92         spin_lock_irqsave(&ipsec->sadb_rx_lock, flags);
  93         sa_entry->handle = handle;
  94         hash_add_rcu(ipsec->sadb_rx, &sa_entry->hlist, sa_entry->handle);
  95         spin_unlock_irqrestore(&ipsec->sadb_rx_lock, flags);
  96
  97         return 0;
  98 }
  99
 100 static void mlx5e_ipsec_sadb_rx_del(struct mlx5e_ipsec_sa_entry *sa_entry)
 101 {
 102         struct mlx5e_ipsec *ipsec = sa_entry->ipsec;
 103         unsigned long flags;
 104
 105         spin_lock_irqsave(&ipsec->sadb_rx_lock, flags);
 106         hash_del_rcu(&sa_entry->hlist);
 107         spin_unlock_irqrestore(&ipsec->sadb_rx_lock, flags);
 108 }
 109
 110 static bool mlx5e_ipsec_update_esn_state(struct mlx5e_ipsec_sa_entry *sa_entry)
 111 {
 112         struct xfrm_replay_state_esn *replay_esn;
 113         u32 seq_bottom = 0;
 114         u8 overlap;
 115         u32 *esn;
 116
 117         if (!(sa_entry->x->props.flags & XFRM_STATE_ESN)) {
 118                 sa_entry->esn_state.trigger = 0;
 119                 return false;
 120         }
 121
 122         replay_esn = sa_entry->x->replay_esn;
 123         if (replay_esn->seq >= replay_esn->replay_window)
 124                 seq_bottom = replay_esn->seq - replay_esn->replay_window + 1;
 125
 126         overlap = sa_entry->esn_state.overlap;
 127
 128         sa_entry->esn_state.esn = xfrm_replay_seqhi(sa_entry->x,
 129                                                     htonl(seq_bottom));
 130         esn = &sa_entry->esn_state.esn;
 131
 132         sa_entry->esn_state.trigger = 1;
 133         if (unlikely(overlap && seq_bottom < MLX5E_IPSEC_ESN_SCOPE_MID)) {
 134                 ++(*esn);
 135                 sa_entry->esn_state.overlap = 0;
 136                 return true;
 137         } else if (unlikely(!overlap &&
 138                             (seq_bottom >= MLX5E_IPSEC_ESN_SCOPE_MID))) {
 139                 sa_entry->esn_state.overlap = 1;
 140                 return true;
 141         }
 142
 143         return false;
 144 }
 145
 146 static void
 147 mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry,
 148                                    struct mlx5_accel_esp_xfrm_attrs *attrs)
 149 {
 150         struct xfrm_state *x = sa_entry->x;
 151         struct aes_gcm_keymat *aes_gcm = &attrs->keymat.aes_gcm;
 152         struct aead_geniv_ctx *geniv_ctx;
 153         struct crypto_aead *aead;
 154         unsigned int crypto_data_len, key_len;
 155         int ivsize;
 156
 157         memset(attrs, 0, sizeof(*attrs));
 158
 159         /* key */
 160         crypto_data_len = (x->aead->alg_key_len + 7) / 8;
 161         key_len = crypto_data_len - 4; /* 4 bytes salt at end */
 162
 163         memcpy(aes_gcm->aes_key, x->aead->alg_key, key_len);
 164         aes_gcm->key_len = key_len * 8;
 165
 166         /* salt and seq_iv */
 167         aead = x->data;
 168         geniv_ctx = crypto_aead_ctx(aead);
 169         ivsize = crypto_aead_ivsize(aead);
 170         memcpy(&aes_gcm->seq_iv, &geniv_ctx->salt, ivsize);
 171         memcpy(&aes_gcm->salt, x->aead->alg_key + key_len,
 172                sizeof(aes_gcm->salt));
 173
 174         /* iv len */
 175         aes_gcm->icv_len = x->aead->alg_icv_len;
 176
 177         /* esn */
 178         if (sa_entry->esn_state.trigger) {
 179                 attrs->flags |= MLX5_ACCEL_ESP_FLAGS_ESN_TRIGGERED;
 180                 attrs->esn = sa_entry->esn_state.esn;
 181                 if (sa_entry->esn_state.overlap)
 182                         attrs->flags |= MLX5_ACCEL_ESP_FLAGS_ESN_STATE_OVERLAP;
 183         }
 184
 185         /* rx handle */
 186         attrs->sa_handle = sa_entry->handle;
 187
 188         /* algo type */
 189         attrs->keymat_type = MLX5_ACCEL_ESP_KEYMAT_AES_GCM;
 190
 191         /* action */
 192         attrs->action = (!(x->xso.flags & XFRM_OFFLOAD_INBOUND)) ?
 193                         MLX5_ACCEL_ESP_ACTION_ENCRYPT :
 194                         MLX5_ACCEL_ESP_ACTION_DECRYPT;
 195         /* flags */
 196         attrs->flags |= (x->props.mode == XFRM_MODE_TRANSPORT) ?
 197                         MLX5_ACCEL_ESP_FLAGS_TRANSPORT :
 198                         MLX5_ACCEL_ESP_FLAGS_TUNNEL;
 199
 200         /* spi */
 201         attrs->spi = x->id.spi;
 202
 203         /* source , destination ips */
 204         memcpy(&attrs->saddr, x->props.saddr.a6, sizeof(attrs->saddr));
 205         memcpy(&attrs->daddr, x->id.daddr.a6, sizeof(attrs->daddr));
 206         attrs->is_ipv6 = (x->props.family != AF_INET);
 207 }
 208
 209 static inline int mlx5e_xfrm_validate_state(struct xfrm_state *x)
 210 {
 211         struct net_device *netdev = x->xso.real_dev;
 212         struct mlx5e_priv *priv;
 213
 214         priv = netdev_priv(netdev);
 215
 216         if (x->props.aalgo != SADB_AALG_NONE) {
 217                 netdev_info(netdev, "Cannot offload authenticated xfrm states\n");
 218                 return -EINVAL;
 219         }
 220         if (x->props.ealgo != SADB_X_EALG_AES_GCM_ICV16) {
 221                 netdev_info(netdev, "Only AES-GCM-ICV16 xfrm state may be offloaded\n");
 222                 return -EINVAL;
 223         }
 224         if (x->props.calgo != SADB_X_CALG_NONE) {
 225                 netdev_info(netdev, "Cannot offload compressed xfrm states\n");
 226                 return -EINVAL;
 227         }
 228         if (x->props.flags & XFRM_STATE_ESN &&
 229             !(mlx5_accel_ipsec_device_caps(priv->mdev) &
 230             MLX5_ACCEL_IPSEC_CAP_ESN)) {
 231                 netdev_info(netdev, "Cannot offload ESN xfrm states\n");
 232                 return -EINVAL;
 233         }
 234         if (x->props.family != AF_INET &&
 235             x->props.family != AF_INET6) {
 236                 netdev_info(netdev, "Only IPv4/6 xfrm states may be offloaded\n");
 237                 return -EINVAL;
 238         }
 239         if (x->props.mode != XFRM_MODE_TRANSPORT &&
 240             x->props.mode != XFRM_MODE_TUNNEL) {
 241                 dev_info(&netdev->dev, "Only transport and tunnel xfrm states may be offloaded\n");
 242                 return -EINVAL;
 243         }
 244         if (x->id.proto != IPPROTO_ESP) {
 245                 netdev_info(netdev, "Only ESP xfrm state may be offloaded\n");
 246                 return -EINVAL;
 247         }
 248         if (x->encap) {
 249                 netdev_info(netdev, "Encapsulated xfrm state may not be offloaded\n");
 250                 return -EINVAL;
 251         }
 252         if (!x->aead) {
 253                 netdev_info(netdev, "Cannot offload xfrm states without aead\n");
 254                 return -EINVAL;
 255         }
 256         if (x->aead->alg_icv_len != 128) {
 257                 netdev_info(netdev, "Cannot offload xfrm states with AEAD ICV length other than 128bit\n");
 258                 return -EINVAL;
 259         }
 260         if ((x->aead->alg_key_len != 128 + 32) &&
 261             (x->aead->alg_key_len != 256 + 32)) {
 262                 netdev_info(netdev, "Cannot offload xfrm states with AEAD key length other than 128/256 bit\n");
 263                 return -EINVAL;
 264         }
 265         if (x->tfcpad) {
 266                 netdev_info(netdev, "Cannot offload xfrm states with tfc padding\n");
 267                 return -EINVAL;
 268         }
 269         if (!x->geniv) {
 270                 netdev_info(netdev, "Cannot offload xfrm states without geniv\n");
 271                 return -EINVAL;
 272         }
 273         if (strcmp(x->geniv, "seqiv")) {
 274                 netdev_info(netdev, "Cannot offload xfrm states with geniv other than seqiv\n");
 275                 return -EINVAL;
 276         }
 277         if (x->props.family == AF_INET6 &&
 278             !(mlx5_accel_ipsec_device_caps(priv->mdev) &
 279              MLX5_ACCEL_IPSEC_CAP_IPV6)) {
 280                 netdev_info(netdev, "IPv6 xfrm state offload is not supported by this device\n");
 281                 return -EINVAL;
 282         }
 283         return 0;
 284 }
 285
 286 static int mlx5e_xfrm_fs_add_rule(struct mlx5e_priv *priv,
 287                                   struct mlx5e_ipsec_sa_entry *sa_entry)
 288 {
 289         if (!mlx5_is_ipsec_device(priv->mdev))
 290                 return 0;
 291
 292         return mlx5e_accel_ipsec_fs_add_rule(priv, &sa_entry->xfrm->attrs,
 293                                              sa_entry->ipsec_obj_id,
 294                                              &sa_entry->ipsec_rule);
 295 }
 296
 297 static void mlx5e_xfrm_fs_del_rule(struct mlx5e_priv *priv,
 298                                    struct mlx5e_ipsec_sa_entry *sa_entry)
 299 {
 300         if (!mlx5_is_ipsec_device(priv->mdev))
 301                 return;
 302
 303         mlx5e_accel_ipsec_fs_del_rule(priv, &sa_entry->xfrm->attrs,
 304                                       &sa_entry->ipsec_rule);
 305 }
 306
 307 static int mlx5e_xfrm_add_state(struct xfrm_state *x)
 308 {
 309         struct mlx5e_ipsec_sa_entry *sa_entry = NULL;
 310         struct net_device *netdev = x->xso.real_dev;
 311         struct mlx5_accel_esp_xfrm_attrs attrs;
 312         struct mlx5e_priv *priv;
 313         unsigned int sa_handle;
 314         int err;
 315
 316         priv = netdev_priv(netdev);
 317
 318         err = mlx5e_xfrm_validate_state(x);
 319         if (err)
 320                 return err;
 321
 322         sa_entry = kzalloc(sizeof(*sa_entry), GFP_KERNEL);
 323         if (!sa_entry) {
 324                 err = -ENOMEM;
 325                 goto out;
 326         }
 327
 328         sa_entry->x = x;
 329         sa_entry->ipsec = priv->ipsec;
 330
 331         /* check esn */
 332         mlx5e_ipsec_update_esn_state(sa_entry);
 333
 334         /* create xfrm */
 335         mlx5e_ipsec_build_accel_xfrm_attrs(sa_entry, &attrs);
 336         sa_entry->xfrm =
 337                 mlx5_accel_esp_create_xfrm(priv->mdev, &attrs,
 338                                            MLX5_ACCEL_XFRM_FLAG_REQUIRE_METADATA);
 339         if (IS_ERR(sa_entry->xfrm)) {
 340                 err = PTR_ERR(sa_entry->xfrm);
 341                 goto err_sa_entry;
 342         }
 343
 344         /* create hw context */
 345         sa_entry->hw_context =
 346                         mlx5_accel_esp_create_hw_context(priv->mdev,
 347                                                          sa_entry->xfrm,
 348                                                          &sa_handle);
 349         if (IS_ERR(sa_entry->hw_context)) {
 350                 err = PTR_ERR(sa_entry->hw_context);
 351                 goto err_xfrm;
 352         }
 353
 354         sa_entry->ipsec_obj_id = sa_handle;
 355         err = mlx5e_xfrm_fs_add_rule(priv, sa_entry);
 356         if (err)
 357                 goto err_hw_ctx;
 358
 359         if (x->xso.flags & XFRM_OFFLOAD_INBOUND) {
 360                 err = mlx5e_ipsec_sadb_rx_add(sa_entry, sa_handle);
 361                 if (err)
 362                         goto err_add_rule;
 363         } else {
 364                 sa_entry->set_iv_op = (x->props.flags & XFRM_STATE_ESN) ?
 365                                 mlx5e_ipsec_set_iv_esn : mlx5e_ipsec_set_iv;
 366         }
 367
 368         x->xso.offload_handle = (unsigned long)sa_entry;
 369         goto out;
 370
 371 err_add_rule:
 372         mlx5e_xfrm_fs_del_rule(priv, sa_entry);
 373 err_hw_ctx:
 374         mlx5_accel_esp_free_hw_context(priv->mdev, sa_entry->hw_context);
 375 err_xfrm:
 376         mlx5_accel_esp_destroy_xfrm(sa_entry->xfrm);
 377 err_sa_entry:
 378         kfree(sa_entry);
 379
 380 out:
 381         return err;
 382 }
 383
 384 static void mlx5e_xfrm_del_state(struct xfrm_state *x)
 385 {
 386         struct mlx5e_ipsec_sa_entry *sa_entry = to_ipsec_sa_entry(x);
 387
 388         if (!sa_entry)
 389                 return;
 390
 391         if (x->xso.flags & XFRM_OFFLOAD_INBOUND)
 392                 mlx5e_ipsec_sadb_rx_del(sa_entry);
 393 }
 394
 395 static void mlx5e_xfrm_free_state(struct xfrm_state *x)
 396 {
 397         struct mlx5e_ipsec_sa_entry *sa_entry = to_ipsec_sa_entry(x);
 398         struct mlx5e_priv *priv = netdev_priv(x->xso.dev);
 399
 400         if (!sa_entry)
 401                 return;
 402
 403         if (sa_entry->hw_context) {
 404                 flush_workqueue(sa_entry->ipsec->wq);
 405                 mlx5e_xfrm_fs_del_rule(priv, sa_entry);
 406                 mlx5_accel_esp_free_hw_context(sa_entry->xfrm->mdev, sa_entry->hw_context);
 407                 mlx5_accel_esp_destroy_xfrm(sa_entry->xfrm);
 408         }
 409
 410         kfree(sa_entry);
 411 }
 412
 413 int mlx5e_ipsec_init(struct mlx5e_priv *priv)
 414 {
 415         struct mlx5e_ipsec *ipsec = NULL;
 416
 417         if (!MLX5_IPSEC_DEV(priv->mdev)) {
 418                 netdev_dbg(priv->netdev, "Not an IPSec offload device\n");
 419                 return 0;
 420         }
 421
 422         ipsec = kzalloc(sizeof(*ipsec), GFP_KERNEL);
 423         if (!ipsec)
 424                 return -ENOMEM;
 425
 426         hash_init(ipsec->sadb_rx);
 427         spin_lock_init(&ipsec->sadb_rx_lock);
 428         ipsec->en_priv = priv;
 429         ipsec->no_trailer = !!(mlx5_accel_ipsec_device_caps(priv->mdev) &
 430                                MLX5_ACCEL_IPSEC_CAP_RX_NO_TRAILER);
 431         ipsec->wq = alloc_ordered_workqueue("mlx5e_ipsec: %s", 0,
 432                                             priv->netdev->name);
 433         if (!ipsec->wq) {
 434                 kfree(ipsec);
 435                 return -ENOMEM;
 436         }
 437
 438         priv->ipsec = ipsec;
 439         mlx5e_accel_ipsec_fs_init(priv);
 440         netdev_dbg(priv->netdev, "IPSec attached to netdevice\n");
 441         return 0;
 442 }
 443
 444 void mlx5e_ipsec_cleanup(struct mlx5e_priv *priv)
 445 {
 446         struct mlx5e_ipsec *ipsec = priv->ipsec;
 447
 448         if (!ipsec)
 449                 return;
 450
 451         mlx5e_accel_ipsec_fs_cleanup(priv);
 452         destroy_workqueue(ipsec->wq);
 453
 454         kfree(ipsec);
 455         priv->ipsec = NULL;
 456 }
 457
 458 static bool mlx5e_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
 459 {
 460         if (x->props.family == AF_INET) {
 461                 /* Offload with IPv4 options is not supported yet */
 462                 if (ip_hdr(skb)->ihl > 5)
 463                         return false;
 464         } else {
 465                 /* Offload with IPv6 extension headers is not support yet */
 466                 if (ipv6_ext_hdr(ipv6_hdr(skb)->nexthdr))
 467                         return false;
 468         }
 469
 470         return true;
 471 }
 472
 473 struct mlx5e_ipsec_modify_state_work {
 474         struct work_struct              work;
 475         struct mlx5_accel_esp_xfrm_attrs attrs;
 476         struct mlx5e_ipsec_sa_entry     *sa_entry;
 477 };
 478
 479 static void _update_xfrm_state(struct work_struct *work)
 480 {
 481         int ret;
 482         struct mlx5e_ipsec_modify_state_work *modify_work =
 483                 container_of(work, struct mlx5e_ipsec_modify_state_work, work);
 484         struct mlx5e_ipsec_sa_entry *sa_entry = modify_work->sa_entry;
 485
 486         ret = mlx5_accel_esp_modify_xfrm(sa_entry->xfrm,
 487                                          &modify_work->attrs);
 488         if (ret)
 489                 netdev_warn(sa_entry->ipsec->en_priv->netdev,
 490                             "Not an IPSec offload device\n");
 491
 492         kfree(modify_work);
 493 }
 494
 495 static void mlx5e_xfrm_advance_esn_state(struct xfrm_state *x)
 496 {
 497         struct mlx5e_ipsec_sa_entry *sa_entry = to_ipsec_sa_entry(x);
 498         struct mlx5e_ipsec_modify_state_work *modify_work;
 499         bool need_update;
 500
 501         if (!sa_entry)
 502                 return;
 503
 504         need_update = mlx5e_ipsec_update_esn_state(sa_entry);
 505         if (!need_update)
 506                 return;
 507
 508         modify_work = kzalloc(sizeof(*modify_work), GFP_ATOMIC);
 509         if (!modify_work)
 510                 return;
 511
 512         mlx5e_ipsec_build_accel_xfrm_attrs(sa_entry, &modify_work->attrs);
 513         modify_work->sa_entry = sa_entry;
 514
 515         INIT_WORK(&modify_work->work, _update_xfrm_state);
 516         WARN_ON(!queue_work(sa_entry->ipsec->wq, &modify_work->work));
 517 }
 518
 519 static const struct xfrmdev_ops mlx5e_ipsec_xfrmdev_ops = {
 520         .xdo_dev_state_add      = mlx5e_xfrm_add_state,
 521         .xdo_dev_state_delete   = mlx5e_xfrm_del_state,
 522         .xdo_dev_state_free     = mlx5e_xfrm_free_state,
 523         .xdo_dev_offload_ok     = mlx5e_ipsec_offload_ok,
 524         .xdo_dev_state_advance_esn = mlx5e_xfrm_advance_esn_state,
 525 };
 526
 527 void mlx5e_ipsec_build_netdev(struct mlx5e_priv *priv)
 528 {
 529         struct mlx5_core_dev *mdev = priv->mdev;
 530         struct net_device *netdev = priv->netdev;
 531
 532         if (!(mlx5_accel_ipsec_device_caps(mdev) & MLX5_ACCEL_IPSEC_CAP_ESP) ||
 533             !MLX5_CAP_ETH(mdev, swp)) {
 534                 mlx5_core_dbg(mdev, "mlx5e: ESP and SWP offload not supported\n");
 535                 return;
 536         }
 537
 538         mlx5_core_info(mdev, "mlx5e: IPSec ESP acceleration enabled\n");
 539         netdev->xfrmdev_ops = &mlx5e_ipsec_xfrmdev_ops;
 540         netdev->features |= NETIF_F_HW_ESP;
 541         netdev->hw_enc_features |= NETIF_F_HW_ESP;
 542
 543         if (!MLX5_CAP_ETH(mdev, swp_csum)) {
 544                 mlx5_core_dbg(mdev, "mlx5e: SWP checksum not supported\n");
 545                 return;
 546         }
 547
 548         netdev->features |= NETIF_F_HW_ESP_TX_CSUM;
 549         netdev->hw_enc_features |= NETIF_F_HW_ESP_TX_CSUM;
 550
 551         if (!(mlx5_accel_ipsec_device_caps(mdev) & MLX5_ACCEL_IPSEC_CAP_LSO) ||
 552             !MLX5_CAP_ETH(mdev, swp_lso)) {
 553                 mlx5_core_dbg(mdev, "mlx5e: ESP LSO not supported\n");
 554                 return;
 555         }
 556
 557         if (mlx5_is_ipsec_device(mdev))
 558                 netdev->gso_partial_features |= NETIF_F_GSO_ESP;
 559
 560         mlx5_core_dbg(mdev, "mlx5e: ESP GSO capability turned on\n");
 561         netdev->features |= NETIF_F_GSO_ESP;
 562         netdev->hw_features |= NETIF_F_GSO_ESP;
 563         netdev->hw_enc_features |= NETIF_F_GSO_ESP;
 564 }