From: Akhil Goyal <akhil.goyal@nxp.com>
To: dev@dpdk.org
Cc: hemant.agrawal@nxp.com, konstantin.ananyev@intel.com,
Akhil Goyal <akhil.goyal@nxp.com>
Subject: [dpdk-dev] [PATCH 1/3] crypto/dpaa_sec: support IPv6 tunnel for protocol offload
Date: Mon, 5 Aug 2019 11:08:25 +0530 [thread overview]
Message-ID: <20190805053827.29066-1-akhil.goyal@nxp.com> (raw)
outer IP header is formed at the time of session initialization
using the ipsec xform. This outer IP header will be appended by
hardware for each packet.
Signed-off-by: Akhil Goyal <akhil.goyal@nxp.com>
---
drivers/crypto/dpaa_sec/dpaa_sec.c | 69 ++++++++++++++++++++++--------
drivers/crypto/dpaa_sec/dpaa_sec.h | 11 ++++-
2 files changed, 61 insertions(+), 19 deletions(-)
diff --git a/drivers/crypto/dpaa_sec/dpaa_sec.c b/drivers/crypto/dpaa_sec/dpaa_sec.c
index 122c80a07..abb107b55 100644
--- a/drivers/crypto/dpaa_sec/dpaa_sec.c
+++ b/drivers/crypto/dpaa_sec/dpaa_sec.c
@@ -2230,26 +2230,56 @@ dpaa_sec_set_ipsec_session(__rte_unused struct rte_cryptodev *dev,
}
if (ipsec_xform->direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
- memset(&session->encap_pdb, 0, sizeof(struct ipsec_encap_pdb) +
+ if (ipsec_xform->tunnel.type ==
+ RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
+ memset(&session->encap_pdb, 0,
+ sizeof(struct ipsec_encap_pdb) +
sizeof(session->ip4_hdr));
- session->ip4_hdr.ip_v = IPVERSION;
- session->ip4_hdr.ip_hl = 5;
- session->ip4_hdr.ip_len = rte_cpu_to_be_16(
+ session->ip4_hdr.ip_v = IPVERSION;
+ session->ip4_hdr.ip_hl = 5;
+ session->ip4_hdr.ip_len = rte_cpu_to_be_16(
sizeof(session->ip4_hdr));
- session->ip4_hdr.ip_tos = ipsec_xform->tunnel.ipv4.dscp;
- session->ip4_hdr.ip_id = 0;
- session->ip4_hdr.ip_off = 0;
- session->ip4_hdr.ip_ttl = ipsec_xform->tunnel.ipv4.ttl;
- session->ip4_hdr.ip_p = (ipsec_xform->proto ==
- RTE_SECURITY_IPSEC_SA_PROTO_ESP) ? IPPROTO_ESP
- : IPPROTO_AH;
- session->ip4_hdr.ip_sum = 0;
- session->ip4_hdr.ip_src = ipsec_xform->tunnel.ipv4.src_ip;
- session->ip4_hdr.ip_dst = ipsec_xform->tunnel.ipv4.dst_ip;
- session->ip4_hdr.ip_sum = calc_chksum((uint16_t *)
+ session->ip4_hdr.ip_tos = ipsec_xform->tunnel.ipv4.dscp;
+ session->ip4_hdr.ip_id = 0;
+ session->ip4_hdr.ip_off = 0;
+ session->ip4_hdr.ip_ttl = ipsec_xform->tunnel.ipv4.ttl;
+ session->ip4_hdr.ip_p = (ipsec_xform->proto ==
+ RTE_SECURITY_IPSEC_SA_PROTO_ESP) ?
+ IPPROTO_ESP : IPPROTO_AH;
+ session->ip4_hdr.ip_sum = 0;
+ session->ip4_hdr.ip_src =
+ ipsec_xform->tunnel.ipv4.src_ip;
+ session->ip4_hdr.ip_dst =
+ ipsec_xform->tunnel.ipv4.dst_ip;
+ session->ip4_hdr.ip_sum = calc_chksum((uint16_t *)
(void *)&session->ip4_hdr,
sizeof(struct ip));
-
+ session->encap_pdb.ip_hdr_len = sizeof(struct ip);
+ } else if (ipsec_xform->tunnel.type ==
+ RTE_SECURITY_IPSEC_TUNNEL_IPV6) {
+ memset(&session->encap_pdb, 0,
+ sizeof(struct ipsec_encap_pdb) +
+ sizeof(session->ip6_hdr));
+ session->ip6_hdr.vtc_flow = rte_cpu_to_be_32(
+ DPAA_IPv6_DEFAULT_VTC_FLOW |
+ ((ipsec_xform->tunnel.ipv6.dscp <<
+ IPv6_TC_SHIFT) & IPv6_TC_MASK) |
+ ((ipsec_xform->tunnel.ipv6.flabel <<
+ IPv6_FLOW_SHIFT) & IPv6_FLOW_MASK));
+ /* Payload length will be updated by HW */
+ session->ip6_hdr.payload_len = 0;
+ session->ip6_hdr.hop_limits =
+ ipsec_xform->tunnel.ipv6.hlimit;
+ session->ip6_hdr.proto = (ipsec_xform->proto ==
+ RTE_SECURITY_IPSEC_SA_PROTO_ESP) ?
+ IPPROTO_ESP : IPPROTO_AH;
+ memcpy(&session->ip6_hdr.src_addr,
+ &ipsec_xform->tunnel.ipv6.src_addr, 16);
+ memcpy(&session->ip6_hdr.dst_addr,
+ &ipsec_xform->tunnel.ipv6.dst_addr, 16);
+ session->encap_pdb.ip_hdr_len =
+ sizeof(struct rte_ipv6_hdr);
+ }
session->encap_pdb.options =
(IPVERSION << PDBNH_ESP_ENCAP_SHIFT) |
PDBOPTS_ESP_OIHI_PDB_INL |
@@ -2257,13 +2287,16 @@ dpaa_sec_set_ipsec_session(__rte_unused struct rte_cryptodev *dev,
PDBHMO_ESP_ENCAP_DTTL |
PDBHMO_ESP_SNR;
session->encap_pdb.spi = ipsec_xform->spi;
- session->encap_pdb.ip_hdr_len = sizeof(struct ip);
session->dir = DIR_ENC;
} else if (ipsec_xform->direction ==
RTE_SECURITY_IPSEC_SA_DIR_INGRESS) {
memset(&session->decap_pdb, 0, sizeof(struct ipsec_decap_pdb));
- session->decap_pdb.options = sizeof(struct ip) << 16;
+ if (ipsec_xform->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4)
+ session->decap_pdb.options = sizeof(struct ip) << 16;
+ else
+ session->decap_pdb.options =
+ sizeof(struct rte_ipv6_hdr) << 16;
session->dir = DIR_DEC;
} else
goto out;
diff --git a/drivers/crypto/dpaa_sec/dpaa_sec.h b/drivers/crypto/dpaa_sec/dpaa_sec.h
index 75c0960a9..3851f3e2c 100644
--- a/drivers/crypto/dpaa_sec/dpaa_sec.h
+++ b/drivers/crypto/dpaa_sec/dpaa_sec.h
@@ -19,6 +19,12 @@
#define AES_CTR_IV_LEN 16
#define AES_GCM_IV_LEN 12
+#define DPAA_IPv6_DEFAULT_VTC_FLOW 0x60000000
+#define IPv6_TC_SHIFT 20
+#define IPv6_FLOW_SHIFT 0
+#define IPv6_TC_MASK 0x0FF00000
+#define IPv6_FLOW_MASK 0x000FFFFF
+
/* Minimum job descriptor consists of a oneword job descriptor HEADER and
* a pointer to the shared descriptor.
*/
@@ -139,7 +145,10 @@ typedef struct dpaa_sec_session_entry {
uint32_t digest_length;
struct ipsec_decap_pdb decap_pdb;
struct ipsec_encap_pdb encap_pdb;
- struct ip ip4_hdr;
+ union {
+ struct ip ip4_hdr;
+ struct rte_ipv6_hdr ip6_hdr;
+ };
};
struct sec_pdcp_ctxt pdcp;
};
--
2.17.1
next reply other threads:[~2019-08-05 5:51 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-05 5:38 Akhil Goyal [this message]
2019-08-05 5:38 ` [dpdk-dev] [PATCH 2/3] crypto/dpaa2_sec: " Akhil Goyal
2019-08-05 5:38 ` [dpdk-dev] [PATCH 3/3] examples/ipsec-secgw: support IPv6 tunnel for lookaside proto Akhil Goyal
2019-08-05 7:26 ` [dpdk-dev] [PATCH 1/3] crypto/dpaa_sec: support IPv6 tunnel for protocol offload Akhil Goyal
2019-08-05 8:22 ` [dpdk-dev] [PATCH v2 0/3] support IPv6 tunnel for lookaside crypto Akhil Goyal
2019-08-05 8:22 ` [dpdk-dev] [PATCH v2 1/3] crypto/dpaa_sec: support IPv6 tunnel for protocol offload Akhil Goyal
2019-08-05 8:22 ` [dpdk-dev] [PATCH v2 2/3] crypto/dpaa2_sec: " Akhil Goyal
2019-08-05 8:22 ` [dpdk-dev] [PATCH v2 3/3] examples/ipsec-secgw: support IPv6 tunnel for lookaside proto Akhil Goyal
2019-09-05 12:48 ` [dpdk-dev] [PATCH v3 0/3] support IPv6 tunnel for lookaside crypto Akhil Goyal
2019-09-05 12:48 ` [dpdk-dev] [PATCH v3 1/3] crypto/dpaa_sec: support IPv6 tunnel for protocol offload Akhil Goyal
2019-09-05 12:48 ` [dpdk-dev] [PATCH v3 2/3] crypto/dpaa2_sec: " Akhil Goyal
2019-09-05 12:48 ` [dpdk-dev] [PATCH v3 3/3] examples/ipsec-secgw: support IPv6 tunnel for lookaside proto Akhil Goyal
2019-09-19 15:17 ` Akhil Goyal
2019-09-24 11:25 ` Ananyev, Konstantin
2019-09-27 14:16 ` [dpdk-dev] [PATCH v3 0/3] support IPv6 tunnel for lookaside crypto Akhil Goyal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190805053827.29066-1-akhil.goyal@nxp.com \
--to=akhil.goyal@nxp.com \
--cc=dev@dpdk.org \
--cc=hemant.agrawal@nxp.com \
--cc=konstantin.ananyev@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).