diff mbox series

[v2] ixgbe/ixgbevf: fix XFRM_ALGO dependency

Message ID 20181018223943.3709-1-jeffrey.t.kirsher@intel.com
State Accepted
Delegated to: Jeff Kirsher
Headers show
Series [v2] ixgbe/ixgbevf: fix XFRM_ALGO dependency | expand

Commit Message

Kirsher, Jeffrey T Oct. 18, 2018, 10:39 p.m. UTC
Based on the original work from Arnd Bergmann.

When XFRM_ALGO is not enabled, the new ixgbe IPsec code produces a
link error:

drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.o: In function `ixgbe_ipsec_vf_add_sa':
ixgbe_ipsec.c:(.text+0x1266): undefined reference to `xfrm_aead_get_byname'

Simply selecting XFRM_ALGO from here causes circular dependencies, so
to fix it, we probably want this slightly more complex solution that is
similar to what other drivers with XFRM offload do:

A separate Kconfig symbol now controls whether we include the IPsec
offload code. To keep the old behavior, this is left as 'default y'. The
dependency in XFRM_OFFLOAD still causes a circular dependency but is
not actually needed because this symbol is not user visible, so removing
that dependency on top makes it all work.

CC: Arnd Bergmann <arnd@arndb.de>
CC: Shannon Nelson <shannon.nelson@oracle.com>
Fixes: eda0333ac293 ("ixgbe: add VF IPsec management")
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
---
v2: fixed spelling errors, also added the changes to ixgbevf driver as
    well

 drivers/net/ethernet/intel/Kconfig             | 18 ++++++++++++++++++
 drivers/net/ethernet/intel/ixgbe/Makefile      |  2 +-
 drivers/net/ethernet/intel/ixgbe/ixgbe.h       |  8 ++++----
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c  |  6 +++---
 drivers/net/ethernet/intel/ixgbevf/Makefile    |  2 +-
 drivers/net/ethernet/intel/ixgbevf/ixgbevf.h   |  4 ++--
 .../net/ethernet/intel/ixgbevf/ixgbevf_main.c  |  2 +-
 net/xfrm/Kconfig                               |  1 -
 8 files changed, 30 insertions(+), 13 deletions(-)

Comments

Shannon Nelson Oct. 18, 2018, 11:11 p.m. UTC | #1
On 10/18/2018 3:39 PM, Jeff Kirsher wrote:
> Based on the original work from Arnd Bergmann.
> 
> When XFRM_ALGO is not enabled, the new ixgbe IPsec code produces a
> link error:
> 
> drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.o: In function `ixgbe_ipsec_vf_add_sa':
> ixgbe_ipsec.c:(.text+0x1266): undefined reference to `xfrm_aead_get_byname'
> 
> Simply selecting XFRM_ALGO from here causes circular dependencies, so
> to fix it, we probably want this slightly more complex solution that is
> similar to what other drivers with XFRM offload do:
> 
> A separate Kconfig symbol now controls whether we include the IPsec
> offload code. To keep the old behavior, this is left as 'default y'. The
> dependency in XFRM_OFFLOAD still causes a circular dependency but is
> not actually needed because this symbol is not user visible, so removing
> that dependency on top makes it all work.
> 
> CC: Arnd Bergmann <arnd@arndb.de>
> CC: Shannon Nelson <shannon.nelson@oracle.com>
> Fixes: eda0333ac293 ("ixgbe: add VF IPsec management")
> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

Looks reasonable - thanks,
Ack-by: Shannon Nelson <shannon.nelson@oracle.com>


> ---
> v2: fixed spelling errors, also added the changes to ixgbevf driver as
>      well
> 
>   drivers/net/ethernet/intel/Kconfig             | 18 ++++++++++++++++++
>   drivers/net/ethernet/intel/ixgbe/Makefile      |  2 +-
>   drivers/net/ethernet/intel/ixgbe/ixgbe.h       |  8 ++++----
>   drivers/net/ethernet/intel/ixgbe/ixgbe_main.c  |  6 +++---
>   drivers/net/ethernet/intel/ixgbevf/Makefile    |  2 +-
>   drivers/net/ethernet/intel/ixgbevf/ixgbevf.h   |  4 ++--
>   .../net/ethernet/intel/ixgbevf/ixgbevf_main.c  |  2 +-
>   net/xfrm/Kconfig                               |  1 -
>   8 files changed, 30 insertions(+), 13 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/Kconfig b/drivers/net/ethernet/intel/Kconfig
> index fd3373d82a9e..59e1bc0f609e 100644
> --- a/drivers/net/ethernet/intel/Kconfig
> +++ b/drivers/net/ethernet/intel/Kconfig
> @@ -200,6 +200,15 @@ config IXGBE_DCB
>   
>   	  If unsure, say N.
>   
> +config IXGBE_IPSEC
> +	bool "IPSec XFRM cryptography-offload acceleration"
> +	depends on IXGBE
> +	depends on XFRM_OFFLOAD
> +	default y
> +	select XFRM_ALGO
> +	---help---
> +	  Enable support for IPSec offload in ixgbe.ko
> +
>   config IXGBEVF
>   	tristate "Intel(R) 10GbE PCI Express Virtual Function Ethernet support"
>   	depends on PCI_MSI
> @@ -217,6 +226,15 @@ config IXGBEVF
>   	  will be called ixgbevf.  MSI-X interrupt support is required
>   	  for this driver to work correctly.
>   
> +config IXGBEVF_IPSEC
> +	bool "IPSec XFRM cryptography-offload acceleration"
> +	depends on IXGBEVF
> +	depends on XFRM_OFFLOAD
> +	default y
> +	select XFRM_ALGO
> +	---help---
> +	  Enable support for IPSec offload in ixgbevf.ko
> +
>   config I40E
>   	tristate "Intel(R) Ethernet Controller XL710 Family support"
>   	imply PTP_1588_CLOCK
> diff --git a/drivers/net/ethernet/intel/ixgbe/Makefile b/drivers/net/ethernet/intel/ixgbe/Makefile
> index ca6b0c458e4a..4fb0d9e3f2da 100644
> --- a/drivers/net/ethernet/intel/ixgbe/Makefile
> +++ b/drivers/net/ethernet/intel/ixgbe/Makefile
> @@ -17,4 +17,4 @@ ixgbe-$(CONFIG_IXGBE_DCB) +=  ixgbe_dcb.o ixgbe_dcb_82598.o \
>   ixgbe-$(CONFIG_IXGBE_HWMON) += ixgbe_sysfs.o
>   ixgbe-$(CONFIG_DEBUG_FS) += ixgbe_debugfs.o
>   ixgbe-$(CONFIG_FCOE:m=y) += ixgbe_fcoe.o
> -ixgbe-$(CONFIG_XFRM_OFFLOAD) += ixgbe_ipsec.o
> +ixgbe-$(CONFIG_IXGBE_IPSEC) += ixgbe_ipsec.o
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
> index 7a7679e7be84..1d5d66436eac 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
> @@ -770,9 +770,9 @@ struct ixgbe_adapter {
>   #define IXGBE_RSS_KEY_SIZE     40  /* size of RSS Hash Key in bytes */
>   	u32 *rss_key;
>   
> -#ifdef CONFIG_XFRM_OFFLOAD
> +#ifdef CONFIG_IXGBE_IPSEC
>   	struct ixgbe_ipsec *ipsec;
> -#endif /* CONFIG_XFRM_OFFLOAD */
> +#endif /* CONFIG_IXGBE_IPSEC */
>   
>   	/* AF_XDP zero-copy */
>   	struct xdp_umem **xsk_umems;
> @@ -1009,7 +1009,7 @@ void ixgbe_store_key(struct ixgbe_adapter *adapter);
>   void ixgbe_store_reta(struct ixgbe_adapter *adapter);
>   s32 ixgbe_negotiate_fc(struct ixgbe_hw *hw, u32 adv_reg, u32 lp_reg,
>   		       u32 adv_sym, u32 adv_asm, u32 lp_sym, u32 lp_asm);
> -#ifdef CONFIG_XFRM_OFFLOAD
> +#ifdef CONFIG_IXGBE_IPSEC
>   void ixgbe_init_ipsec_offload(struct ixgbe_adapter *adapter);
>   void ixgbe_stop_ipsec_offload(struct ixgbe_adapter *adapter);
>   void ixgbe_ipsec_restore(struct ixgbe_adapter *adapter);
> @@ -1037,5 +1037,5 @@ static inline int ixgbe_ipsec_vf_add_sa(struct ixgbe_adapter *adapter,
>   					u32 *mbuf, u32 vf) { return -EACCES; }
>   static inline int ixgbe_ipsec_vf_del_sa(struct ixgbe_adapter *adapter,
>   					u32 *mbuf, u32 vf) { return -EACCES; }
> -#endif /* CONFIG_XFRM_OFFLOAD */
> +#endif /* CONFIG_IXGBE_IPSEC */
>   #endif /* _IXGBE_H_ */
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> index 70b95cbff39e..8a514f4c6658 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
> @@ -8694,7 +8694,7 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
>   
>   #endif /* IXGBE_FCOE */
>   
> -#ifdef CONFIG_XFRM_OFFLOAD
> +#ifdef CONFIG_IXGBE_IPSEC
>   	if (skb->sp && !ixgbe_ipsec_tx(tx_ring, first, &ipsec_tx))
>   		goto out_drop;
>   #endif
> @@ -10190,7 +10190,7 @@ ixgbe_features_check(struct sk_buff *skb, struct net_device *dev,
>   	 * the TSO, so it's the exception.
>   	 */
>   	if (skb->encapsulation && !(features & NETIF_F_TSO_MANGLEID)) {
> -#ifdef CONFIG_XFRM_OFFLOAD
> +#ifdef CONFIG_IXGBE_IPSEC
>   		if (!skb->sp)
>   #endif
>   			features &= ~NETIF_F_TSO;
> @@ -10884,7 +10884,7 @@ static int ixgbe_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>   	if (hw->mac.type >= ixgbe_mac_82599EB)
>   		netdev->features |= NETIF_F_SCTP_CRC;
>   
> -#ifdef CONFIG_XFRM_OFFLOAD
> +#ifdef CONFIG_IXGBE_IPSEC
>   #define IXGBE_ESP_FEATURES	(NETIF_F_HW_ESP | \
>   				 NETIF_F_HW_ESP_TX_CSUM | \
>   				 NETIF_F_GSO_ESP)
> diff --git a/drivers/net/ethernet/intel/ixgbevf/Makefile b/drivers/net/ethernet/intel/ixgbevf/Makefile
> index 297d0f0858b5..186a4bb24fde 100644
> --- a/drivers/net/ethernet/intel/ixgbevf/Makefile
> +++ b/drivers/net/ethernet/intel/ixgbevf/Makefile
> @@ -10,5 +10,5 @@ ixgbevf-objs := vf.o \
>                   mbx.o \
>                   ethtool.o \
>                   ixgbevf_main.o
> -ixgbevf-$(CONFIG_XFRM_OFFLOAD) += ipsec.o
> +ixgbevf-$(CONFIG_IXGBEVF_IPSEC) += ipsec.o
>   
> diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h b/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h
> index e399e1c0c54a..ecab686574b6 100644
> --- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h
> +++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h
> @@ -459,7 +459,7 @@ int ethtool_ioctl(struct ifreq *ifr);
>   
>   extern void ixgbevf_write_eitr(struct ixgbevf_q_vector *q_vector);
>   
> -#ifdef CONFIG_XFRM_OFFLOAD
> +#ifdef CONFIG_IXGBEVF_IPSEC
>   void ixgbevf_init_ipsec_offload(struct ixgbevf_adapter *adapter);
>   void ixgbevf_stop_ipsec_offload(struct ixgbevf_adapter *adapter);
>   void ixgbevf_ipsec_restore(struct ixgbevf_adapter *adapter);
> @@ -482,7 +482,7 @@ static inline int ixgbevf_ipsec_tx(struct ixgbevf_ring *tx_ring,
>   				   struct ixgbevf_tx_buffer *first,
>   				   struct ixgbevf_ipsec_tx_data *itd)
>   { return 0; }
> -#endif /* CONFIG_XFRM_OFFLOAD */
> +#endif /* CONFIG_IXGBEVF_IPSEC */
>   
>   void ixgbe_napi_add_all(struct ixgbevf_adapter *adapter);
>   void ixgbe_napi_del_all(struct ixgbevf_adapter *adapter);
> diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
> index d8ebd75bf41e..196b890467b2 100644
> --- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
> +++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
> @@ -4152,7 +4152,7 @@ static int ixgbevf_xmit_frame_ring(struct sk_buff *skb,
>   	first->tx_flags = tx_flags;
>   	first->protocol = vlan_get_protocol(skb);
>   
> -#ifdef CONFIG_XFRM_OFFLOAD
> +#ifdef CONFIG_IXGBEVF_IPSEC
>   	if (skb->sp && !ixgbevf_ipsec_tx(tx_ring, first, &ipsec_tx))
>   		goto out_drop;
>   #endif
> diff --git a/net/xfrm/Kconfig b/net/xfrm/Kconfig
> index 4a9ee2d83158..140270a13d54 100644
> --- a/net/xfrm/Kconfig
> +++ b/net/xfrm/Kconfig
> @@ -8,7 +8,6 @@ config XFRM
>   
>   config XFRM_OFFLOAD
>          bool
> -       depends on XFRM
>   
>   config XFRM_ALGO
>   	tristate
>
Bowers, AndrewX Oct. 22, 2018, 7:37 p.m. UTC | #2
> -----Original Message-----
> From: Intel-wired-lan [mailto:intel-wired-lan-bounces@osuosl.org] On
> Behalf Of Jeff Kirsher
> Sent: Thursday, October 18, 2018 3:40 PM
> To: intel-wired-lan@lists.osuosl.org
> Cc: Arnd Bergmann <arnd@arndb.de>
> Subject: [Intel-wired-lan] [PATCH v2] ixgbe/ixgbevf: fix XFRM_ALGO
> dependency
> 
> Based on the original work from Arnd Bergmann.
> 
> When XFRM_ALGO is not enabled, the new ixgbe IPsec code produces a link
> error:
> 
> drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.o: In function
> `ixgbe_ipsec_vf_add_sa':
> ixgbe_ipsec.c:(.text+0x1266): undefined reference to
> `xfrm_aead_get_byname'
> 
> Simply selecting XFRM_ALGO from here causes circular dependencies, so to
> fix it, we probably want this slightly more complex solution that is similar to
> what other drivers with XFRM offload do:
> 
> A separate Kconfig symbol now controls whether we include the IPsec
> offload code. To keep the old behavior, this is left as 'default y'. The
> dependency in XFRM_OFFLOAD still causes a circular dependency but is not
> actually needed because this symbol is not user visible, so removing that
> dependency on top makes it all work.
> 
> CC: Arnd Bergmann <arnd@arndb.de>
> CC: Shannon Nelson <shannon.nelson@oracle.com>
> Fixes: eda0333ac293 ("ixgbe: add VF IPsec management")
> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
> ---
> v2: fixed spelling errors, also added the changes to ixgbevf driver as
>     well
> 
>  drivers/net/ethernet/intel/Kconfig             | 18 ++++++++++++++++++
>  drivers/net/ethernet/intel/ixgbe/Makefile      |  2 +-
>  drivers/net/ethernet/intel/ixgbe/ixgbe.h       |  8 ++++----
>  drivers/net/ethernet/intel/ixgbe/ixgbe_main.c  |  6 +++---
>  drivers/net/ethernet/intel/ixgbevf/Makefile    |  2 +-
>  drivers/net/ethernet/intel/ixgbevf/ixgbevf.h   |  4 ++--
>  .../net/ethernet/intel/ixgbevf/ixgbevf_main.c  |  2 +-
>  net/xfrm/Kconfig                               |  1 -
>  8 files changed, 30 insertions(+), 13 deletions(-)

Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
diff mbox series

Patch

diff --git a/drivers/net/ethernet/intel/Kconfig b/drivers/net/ethernet/intel/Kconfig
index fd3373d82a9e..59e1bc0f609e 100644
--- a/drivers/net/ethernet/intel/Kconfig
+++ b/drivers/net/ethernet/intel/Kconfig
@@ -200,6 +200,15 @@  config IXGBE_DCB
 
 	  If unsure, say N.
 
+config IXGBE_IPSEC
+	bool "IPSec XFRM cryptography-offload acceleration"
+	depends on IXGBE
+	depends on XFRM_OFFLOAD
+	default y
+	select XFRM_ALGO
+	---help---
+	  Enable support for IPSec offload in ixgbe.ko
+
 config IXGBEVF
 	tristate "Intel(R) 10GbE PCI Express Virtual Function Ethernet support"
 	depends on PCI_MSI
@@ -217,6 +226,15 @@  config IXGBEVF
 	  will be called ixgbevf.  MSI-X interrupt support is required
 	  for this driver to work correctly.
 
+config IXGBEVF_IPSEC
+	bool "IPSec XFRM cryptography-offload acceleration"
+	depends on IXGBEVF
+	depends on XFRM_OFFLOAD
+	default y
+	select XFRM_ALGO
+	---help---
+	  Enable support for IPSec offload in ixgbevf.ko
+
 config I40E
 	tristate "Intel(R) Ethernet Controller XL710 Family support"
 	imply PTP_1588_CLOCK
diff --git a/drivers/net/ethernet/intel/ixgbe/Makefile b/drivers/net/ethernet/intel/ixgbe/Makefile
index ca6b0c458e4a..4fb0d9e3f2da 100644
--- a/drivers/net/ethernet/intel/ixgbe/Makefile
+++ b/drivers/net/ethernet/intel/ixgbe/Makefile
@@ -17,4 +17,4 @@  ixgbe-$(CONFIG_IXGBE_DCB) +=  ixgbe_dcb.o ixgbe_dcb_82598.o \
 ixgbe-$(CONFIG_IXGBE_HWMON) += ixgbe_sysfs.o
 ixgbe-$(CONFIG_DEBUG_FS) += ixgbe_debugfs.o
 ixgbe-$(CONFIG_FCOE:m=y) += ixgbe_fcoe.o
-ixgbe-$(CONFIG_XFRM_OFFLOAD) += ixgbe_ipsec.o
+ixgbe-$(CONFIG_IXGBE_IPSEC) += ixgbe_ipsec.o
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
index 7a7679e7be84..1d5d66436eac 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
@@ -770,9 +770,9 @@  struct ixgbe_adapter {
 #define IXGBE_RSS_KEY_SIZE     40  /* size of RSS Hash Key in bytes */
 	u32 *rss_key;
 
-#ifdef CONFIG_XFRM_OFFLOAD
+#ifdef CONFIG_IXGBE_IPSEC
 	struct ixgbe_ipsec *ipsec;
-#endif /* CONFIG_XFRM_OFFLOAD */
+#endif /* CONFIG_IXGBE_IPSEC */
 
 	/* AF_XDP zero-copy */
 	struct xdp_umem **xsk_umems;
@@ -1009,7 +1009,7 @@  void ixgbe_store_key(struct ixgbe_adapter *adapter);
 void ixgbe_store_reta(struct ixgbe_adapter *adapter);
 s32 ixgbe_negotiate_fc(struct ixgbe_hw *hw, u32 adv_reg, u32 lp_reg,
 		       u32 adv_sym, u32 adv_asm, u32 lp_sym, u32 lp_asm);
-#ifdef CONFIG_XFRM_OFFLOAD
+#ifdef CONFIG_IXGBE_IPSEC
 void ixgbe_init_ipsec_offload(struct ixgbe_adapter *adapter);
 void ixgbe_stop_ipsec_offload(struct ixgbe_adapter *adapter);
 void ixgbe_ipsec_restore(struct ixgbe_adapter *adapter);
@@ -1037,5 +1037,5 @@  static inline int ixgbe_ipsec_vf_add_sa(struct ixgbe_adapter *adapter,
 					u32 *mbuf, u32 vf) { return -EACCES; }
 static inline int ixgbe_ipsec_vf_del_sa(struct ixgbe_adapter *adapter,
 					u32 *mbuf, u32 vf) { return -EACCES; }
-#endif /* CONFIG_XFRM_OFFLOAD */
+#endif /* CONFIG_IXGBE_IPSEC */
 #endif /* _IXGBE_H_ */
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 70b95cbff39e..8a514f4c6658 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -8694,7 +8694,7 @@  netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
 
 #endif /* IXGBE_FCOE */
 
-#ifdef CONFIG_XFRM_OFFLOAD
+#ifdef CONFIG_IXGBE_IPSEC
 	if (skb->sp && !ixgbe_ipsec_tx(tx_ring, first, &ipsec_tx))
 		goto out_drop;
 #endif
@@ -10190,7 +10190,7 @@  ixgbe_features_check(struct sk_buff *skb, struct net_device *dev,
 	 * the TSO, so it's the exception.
 	 */
 	if (skb->encapsulation && !(features & NETIF_F_TSO_MANGLEID)) {
-#ifdef CONFIG_XFRM_OFFLOAD
+#ifdef CONFIG_IXGBE_IPSEC
 		if (!skb->sp)
 #endif
 			features &= ~NETIF_F_TSO;
@@ -10884,7 +10884,7 @@  static int ixgbe_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 	if (hw->mac.type >= ixgbe_mac_82599EB)
 		netdev->features |= NETIF_F_SCTP_CRC;
 
-#ifdef CONFIG_XFRM_OFFLOAD
+#ifdef CONFIG_IXGBE_IPSEC
 #define IXGBE_ESP_FEATURES	(NETIF_F_HW_ESP | \
 				 NETIF_F_HW_ESP_TX_CSUM | \
 				 NETIF_F_GSO_ESP)
diff --git a/drivers/net/ethernet/intel/ixgbevf/Makefile b/drivers/net/ethernet/intel/ixgbevf/Makefile
index 297d0f0858b5..186a4bb24fde 100644
--- a/drivers/net/ethernet/intel/ixgbevf/Makefile
+++ b/drivers/net/ethernet/intel/ixgbevf/Makefile
@@ -10,5 +10,5 @@  ixgbevf-objs := vf.o \
                 mbx.o \
                 ethtool.o \
                 ixgbevf_main.o
-ixgbevf-$(CONFIG_XFRM_OFFLOAD) += ipsec.o
+ixgbevf-$(CONFIG_IXGBEVF_IPSEC) += ipsec.o
 
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h b/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h
index e399e1c0c54a..ecab686574b6 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf.h
@@ -459,7 +459,7 @@  int ethtool_ioctl(struct ifreq *ifr);
 
 extern void ixgbevf_write_eitr(struct ixgbevf_q_vector *q_vector);
 
-#ifdef CONFIG_XFRM_OFFLOAD
+#ifdef CONFIG_IXGBEVF_IPSEC
 void ixgbevf_init_ipsec_offload(struct ixgbevf_adapter *adapter);
 void ixgbevf_stop_ipsec_offload(struct ixgbevf_adapter *adapter);
 void ixgbevf_ipsec_restore(struct ixgbevf_adapter *adapter);
@@ -482,7 +482,7 @@  static inline int ixgbevf_ipsec_tx(struct ixgbevf_ring *tx_ring,
 				   struct ixgbevf_tx_buffer *first,
 				   struct ixgbevf_ipsec_tx_data *itd)
 { return 0; }
-#endif /* CONFIG_XFRM_OFFLOAD */
+#endif /* CONFIG_IXGBEVF_IPSEC */
 
 void ixgbe_napi_add_all(struct ixgbevf_adapter *adapter);
 void ixgbe_napi_del_all(struct ixgbevf_adapter *adapter);
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index d8ebd75bf41e..196b890467b2 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -4152,7 +4152,7 @@  static int ixgbevf_xmit_frame_ring(struct sk_buff *skb,
 	first->tx_flags = tx_flags;
 	first->protocol = vlan_get_protocol(skb);
 
-#ifdef CONFIG_XFRM_OFFLOAD
+#ifdef CONFIG_IXGBEVF_IPSEC
 	if (skb->sp && !ixgbevf_ipsec_tx(tx_ring, first, &ipsec_tx))
 		goto out_drop;
 #endif
diff --git a/net/xfrm/Kconfig b/net/xfrm/Kconfig
index 4a9ee2d83158..140270a13d54 100644
--- a/net/xfrm/Kconfig
+++ b/net/xfrm/Kconfig
@@ -8,7 +8,6 @@  config XFRM
 
 config XFRM_OFFLOAD
        bool
-       depends on XFRM
 
 config XFRM_ALGO
 	tristate