* [PATCH 2/4] crypto/dpaa_sec: enabling diffserv and ECN support
2024-10-24 15:01 [PATCH 1/4] crypto/dpaa_sec: enhance IPsec extended sequence number Hemant Agrawal
@ 2024-10-24 15:01 ` Hemant Agrawal
2024-10-24 15:01 ` [PATCH 3/4] crypto/dpaa_sec: add support for UDP-encapsulated ESP Hemant Agrawal
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Hemant Agrawal @ 2024-10-24 15:01 UTC (permalink / raw)
To: gakhil; +Cc: dev
Enabling DIFFSERV and ECN in IPSEC proto offload descriptor.
Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
drivers/crypto/dpaa_sec/dpaa_sec.c | 14 ++++++++++++--
drivers/crypto/dpaa_sec/dpaa_sec.h | 8 ++++++++
2 files changed, 20 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/dpaa_sec/dpaa_sec.c b/drivers/crypto/dpaa_sec/dpaa_sec.c
index e6ca0e6f0e..881435fdb6 100644
--- a/drivers/crypto/dpaa_sec/dpaa_sec.c
+++ b/drivers/crypto/dpaa_sec/dpaa_sec.c
@@ -3023,18 +3023,28 @@ dpaa_sec_set_ipsec_session(__rte_unused struct rte_cryptodev *dev,
session->encap_pdb.seq_num = conf->ipsec.esn.low;
}
+ if (ipsec_xform->options.ecn)
+ session->encap_pdb.options |= PDBOPTS_ESP_TECN;
} else if (ipsec_xform->direction ==
RTE_SECURITY_IPSEC_SA_DIR_INGRESS) {
- if (ipsec_xform->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4)
+ if (ipsec_xform->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
session->decap_pdb.options = sizeof(struct ip) << 16;
- else
+ if (ipsec_xform->options.copy_df)
+ session->decap_pdb.options |= PDBHMO_ESP_DFV;
+ } else {
session->decap_pdb.options =
sizeof(struct rte_ipv6_hdr) << 16;
+ }
if (ipsec_xform->options.esn) {
session->decap_pdb.options |= PDBOPTS_ESP_ESN;
session->decap_pdb.seq_num_ext_hi = conf->ipsec.esn.hi;
session->decap_pdb.seq_num = conf->ipsec.esn.low;
}
+ if (ipsec_xform->options.copy_dscp)
+ session->decap_pdb.options |= PDBHMO_ESP_DIFFSERV;
+ if (ipsec_xform->options.ecn)
+ session->decap_pdb.options |= PDBOPTS_ESP_TECN;
+
if (ipsec_xform->replay_win_sz) {
uint32_t win_sz;
win_sz = rte_align32pow2(ipsec_xform->replay_win_sz);
diff --git a/drivers/crypto/dpaa_sec/dpaa_sec.h b/drivers/crypto/dpaa_sec/dpaa_sec.h
index 02e5307660..603a7d8f38 100644
--- a/drivers/crypto/dpaa_sec/dpaa_sec.h
+++ b/drivers/crypto/dpaa_sec/dpaa_sec.h
@@ -990,6 +990,10 @@ static const struct rte_security_capability dpaa_sec_security_cap[] = {
.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
.options = {
+ .copy_df = 1,
+ .copy_dscp = 1,
+ .dec_ttl = 1,
+ .ecn = 1,
.esn = 1,
},
.replay_win_sz_max = 128
@@ -1004,6 +1008,10 @@ static const struct rte_security_capability dpaa_sec_security_cap[] = {
.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
.direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
.options = {
+ .copy_df = 1,
+ .copy_dscp = 1,
+ .dec_ttl = 1,
+ .ecn = 1,
.esn = 1,
},
.replay_win_sz_max = 128
--
2.25.1
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 3/4] crypto/dpaa_sec: add support for UDP-encapsulated ESP
2024-10-24 15:01 [PATCH 1/4] crypto/dpaa_sec: enhance IPsec extended sequence number Hemant Agrawal
2024-10-24 15:01 ` [PATCH 2/4] crypto/dpaa_sec: enabling diffserv and ECN support Hemant Agrawal
@ 2024-10-24 15:01 ` Hemant Agrawal
2024-10-24 15:01 ` [PATCH 4/4] crypto/dpaa2_sec: add support for IPv6 UDP encap Hemant Agrawal
2024-11-06 11:33 ` [EXTERNAL] [PATCH 1/4] crypto/dpaa_sec: enhance IPsec extended sequence number Akhil Goyal
3 siblings, 0 replies; 5+ messages in thread
From: Hemant Agrawal @ 2024-10-24 15:01 UTC (permalink / raw)
To: gakhil; +Cc: dev, Barry Cao
From: Barry Cao <barry.cao@nxp.com>
This patch enables support for NAT-T traversal in IPSEC ESP
protocol offload mode.
Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
Signed-off-by: Barry Cao <barry.cao@nxp.com>
---
drivers/crypto/dpaa_sec/dpaa_sec.c | 63 ++++++++++++++++++++++++------
drivers/crypto/dpaa_sec/dpaa_sec.h | 14 +++++++
2 files changed, 66 insertions(+), 11 deletions(-)
diff --git a/drivers/crypto/dpaa_sec/dpaa_sec.c b/drivers/crypto/dpaa_sec/dpaa_sec.c
index 881435fdb6..3fa88ca968 100644
--- a/drivers/crypto/dpaa_sec/dpaa_sec.c
+++ b/drivers/crypto/dpaa_sec/dpaa_sec.c
@@ -20,6 +20,7 @@
#include <dev_driver.h>
#include <rte_io.h>
#include <rte_ip.h>
+#include <rte_udp.h>
#include <rte_kvargs.h>
#include <rte_malloc.h>
#include <rte_mbuf.h>
@@ -46,6 +47,7 @@
#include <dpaax_iova_table.h>
#define DRIVER_DUMP_MODE "drv_dump_mode"
+#define DPAA_DEFAULT_NAT_T_PORT 4500
/* DPAA_SEC_DP_DUMP levels */
enum dpaa_sec_dump_levels {
@@ -2961,15 +2963,22 @@ dpaa_sec_set_ipsec_session(__rte_unused struct rte_cryptodev *dev,
RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
session->ip4_hdr.ip_v = IPVERSION;
session->ip4_hdr.ip_hl = 5;
- session->ip4_hdr.ip_len = rte_cpu_to_be_16(
- sizeof(session->ip4_hdr));
+ if (ipsec_xform->options.udp_encap)
+ session->ip4_hdr.ip_len = rte_cpu_to_be_16(
+ sizeof(session->ip4_hdr) + sizeof(struct rte_udp_hdr));
+ else
+ session->ip4_hdr.ip_len = rte_cpu_to_be_16(
+ sizeof(session->ip4_hdr));
session->ip4_hdr.ip_tos = ipsec_xform->tunnel.ipv4.dscp;
session->ip4_hdr.ip_id = 0;
session->ip4_hdr.ip_off = 0;
session->ip4_hdr.ip_ttl = ipsec_xform->tunnel.ipv4.ttl;
- session->ip4_hdr.ip_p = (ipsec_xform->proto ==
- RTE_SECURITY_IPSEC_SA_PROTO_ESP) ?
- IPPROTO_ESP : IPPROTO_AH;
+ if (ipsec_xform->options.udp_encap)
+ session->ip4_hdr.ip_p = IPPROTO_UDP;
+ else
+ session->ip4_hdr.ip_p = (ipsec_xform->proto ==
+ RTE_SECURITY_IPSEC_SA_PROTO_ESP) ?
+ IPPROTO_ESP : IPPROTO_AH;
session->ip4_hdr.ip_sum = 0;
session->ip4_hdr.ip_src =
ipsec_xform->tunnel.ipv4.src_ip;
@@ -2993,9 +3002,12 @@ dpaa_sec_set_ipsec_session(__rte_unused struct rte_cryptodev *dev,
session->ip6_hdr.payload_len = 0;
session->ip6_hdr.hop_limits =
ipsec_xform->tunnel.ipv6.hlimit;
- session->ip6_hdr.proto = (ipsec_xform->proto ==
- RTE_SECURITY_IPSEC_SA_PROTO_ESP) ?
- IPPROTO_ESP : IPPROTO_AH;
+ if (ipsec_xform->options.udp_encap)
+ session->ip6_hdr.proto = IPPROTO_UDP;
+ else
+ session->ip6_hdr.proto = (ipsec_xform->proto ==
+ RTE_SECURITY_IPSEC_SA_PROTO_ESP) ?
+ IPPROTO_ESP : IPPROTO_AH;
memcpy(&session->ip6_hdr.src_addr,
&ipsec_xform->tunnel.ipv6.src_addr, 16);
memcpy(&session->ip6_hdr.dst_addr,
@@ -3022,18 +3034,47 @@ dpaa_sec_set_ipsec_session(__rte_unused struct rte_cryptodev *dev,
session->encap_pdb.seq_num_ext_hi = conf->ipsec.esn.hi;
session->encap_pdb.seq_num = conf->ipsec.esn.low;
}
+ if (ipsec_xform->options.udp_encap) {
+ struct rte_udp_hdr *udp_hdr;
+
+ if (ipsec_xform->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4)
+ udp_hdr = (struct rte_udp_hdr *)(&session->udp4.udp_hdr);
+ else
+ udp_hdr = (struct rte_udp_hdr *)(&session->udp6.udp_hdr);
+
+ if (ipsec_xform->udp.sport)
+ udp_hdr->src_port = rte_cpu_to_be_16(ipsec_xform->udp.sport);
+ else
+ udp_hdr->src_port = rte_cpu_to_be_16(DPAA_DEFAULT_NAT_T_PORT);
+
+ if (ipsec_xform->udp.dport)
+ udp_hdr->dst_port = rte_cpu_to_be_16(ipsec_xform->udp.dport);
+ else
+ udp_hdr->dst_port = rte_cpu_to_be_16(DPAA_DEFAULT_NAT_T_PORT);
+ udp_hdr->dgram_len = 0;
+ udp_hdr->dgram_cksum = 0;
+ session->encap_pdb.ip_hdr_len += sizeof(struct rte_udp_hdr);
+ session->encap_pdb.options |= PDBOPTS_ESP_NAT | PDBOPTS_ESP_NUC;
+ }
if (ipsec_xform->options.ecn)
session->encap_pdb.options |= PDBOPTS_ESP_TECN;
} else if (ipsec_xform->direction ==
RTE_SECURITY_IPSEC_SA_DIR_INGRESS) {
if (ipsec_xform->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
- session->decap_pdb.options = sizeof(struct ip) << 16;
+ if (ipsec_xform->options.udp_encap)
+ session->decap_pdb.options =
+ (sizeof(struct ip) + sizeof(struct rte_udp_hdr)) << 16;
+ else
+ session->decap_pdb.options = sizeof(struct ip) << 16;
if (ipsec_xform->options.copy_df)
session->decap_pdb.options |= PDBHMO_ESP_DFV;
} else {
- session->decap_pdb.options =
- sizeof(struct rte_ipv6_hdr) << 16;
+ if (ipsec_xform->options.udp_encap)
+ session->decap_pdb.options =
+ (sizeof(struct rte_ipv6_hdr) + sizeof(struct rte_udp_hdr)) << 16;
+ else
+ session->decap_pdb.options = sizeof(struct rte_ipv6_hdr) << 16;
}
if (ipsec_xform->options.esn) {
session->decap_pdb.options |= PDBOPTS_ESP_ESN;
diff --git a/drivers/crypto/dpaa_sec/dpaa_sec.h b/drivers/crypto/dpaa_sec/dpaa_sec.h
index 603a7d8f38..64d9e22159 100644
--- a/drivers/crypto/dpaa_sec/dpaa_sec.h
+++ b/drivers/crypto/dpaa_sec/dpaa_sec.h
@@ -143,6 +143,16 @@ typedef struct dpaa_sec_job* (*dpaa_sec_build_raw_dp_fd_t)(uint8_t *drv_ctx,
void *userdata,
struct qm_fd *fd);
+struct dpaa_ipv4_udp {
+ struct ip ip4_hdr;
+ struct rte_udp_hdr udp_hdr;
+};
+
+struct dpaa_ipv6_udp {
+ struct rte_ipv6_hdr ip6_hdr;
+ struct rte_udp_hdr udp_hdr;
+};
+
typedef struct dpaa_sec_session_entry {
struct sec_cdb cdb; /**< cmd block associated with qp */
struct dpaa_sec_qp *qp[MAX_DPAA_CORES];
@@ -191,6 +201,8 @@ typedef struct dpaa_sec_session_entry {
union {
struct ip ip4_hdr;
struct rte_ipv6_hdr ip6_hdr;
+ struct dpaa_ipv4_udp udp4;
+ struct dpaa_ipv6_udp udp6;
};
uint8_t auth_cipher_text;
/**< Authenticate/cipher ordering */
@@ -995,6 +1007,7 @@ static const struct rte_security_capability dpaa_sec_security_cap[] = {
.dec_ttl = 1,
.ecn = 1,
.esn = 1,
+ .udp_encap = 1,
},
.replay_win_sz_max = 128
},
@@ -1013,6 +1026,7 @@ static const struct rte_security_capability dpaa_sec_security_cap[] = {
.dec_ttl = 1,
.ecn = 1,
.esn = 1,
+ .udp_encap = 1,
},
.replay_win_sz_max = 128
},
--
2.25.1
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 4/4] crypto/dpaa2_sec: add support for IPv6 UDP encap
2024-10-24 15:01 [PATCH 1/4] crypto/dpaa_sec: enhance IPsec extended sequence number Hemant Agrawal
2024-10-24 15:01 ` [PATCH 2/4] crypto/dpaa_sec: enabling diffserv and ECN support Hemant Agrawal
2024-10-24 15:01 ` [PATCH 3/4] crypto/dpaa_sec: add support for UDP-encapsulated ESP Hemant Agrawal
@ 2024-10-24 15:01 ` Hemant Agrawal
2024-11-06 11:33 ` [EXTERNAL] [PATCH 1/4] crypto/dpaa_sec: enhance IPsec extended sequence number Akhil Goyal
3 siblings, 0 replies; 5+ messages in thread
From: Hemant Agrawal @ 2024-10-24 15:01 UTC (permalink / raw)
To: gakhil; +Cc: dev
This patch enables support for NAT-T traversal in IPSEC ESP
protocol offload mode for IPv6
Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
---
drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c | 68 +++++++++++++--------
1 file changed, 43 insertions(+), 25 deletions(-)
diff --git a/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c b/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
index b34183d594..3814f954ce 100644
--- a/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
+++ b/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
@@ -50,6 +50,7 @@
#define FSL_SUBSYSTEM_SEC 1
#define FSL_MC_DPSECI_DEVID 3
+#define DPAA2_DEFAULT_NAT_T_PORT 4500
#define NO_PREFETCH 0
#define DRIVER_DUMP_MODE "drv_dump_mode"
@@ -3164,6 +3165,7 @@ dpaa2_sec_set_ipsec_session(struct rte_cryptodev *dev,
uint8_t hdr[48] = {};
struct rte_ipv4_hdr *ip4_hdr;
struct rte_ipv6_hdr *ip6_hdr;
+ struct rte_udp_hdr *uh = NULL;
struct ipsec_encap_pdb encap_pdb;
flc->dhr = SEC_FLC_DHR_OUTBOUND;
@@ -3235,29 +3237,10 @@ dpaa2_sec_set_ipsec_session(struct rte_cryptodev *dev,
memcpy(&ip4_hdr->dst_addr, &ipsec_xform->tunnel.ipv4.dst_ip,
sizeof(struct in_addr));
if (ipsec_xform->options.udp_encap) {
- uint16_t sport, dport;
- struct rte_udp_hdr *uh =
- (struct rte_udp_hdr *) (hdr +
- sizeof(struct rte_ipv4_hdr));
-
- sport = ipsec_xform->udp.sport ?
- ipsec_xform->udp.sport : 4500;
- dport = ipsec_xform->udp.dport ?
- ipsec_xform->udp.dport : 4500;
- uh->src_port = rte_cpu_to_be_16(sport);
- uh->dst_port = rte_cpu_to_be_16(dport);
- uh->dgram_len = 0;
- uh->dgram_cksum = 0;
-
ip4_hdr->next_proto_id = IPPROTO_UDP;
- ip4_hdr->total_length =
- rte_cpu_to_be_16(
+ ip4_hdr->total_length = rte_cpu_to_be_16(
sizeof(struct rte_ipv4_hdr) +
sizeof(struct rte_udp_hdr));
- encap_pdb.ip_hdr_len +=
- sizeof(struct rte_udp_hdr);
- encap_pdb.options |=
- PDBOPTS_ESP_NAT | PDBOPTS_ESP_NUC;
} else {
ip4_hdr->total_length =
rte_cpu_to_be_16(
@@ -3284,14 +3267,39 @@ dpaa2_sec_set_ipsec_session(struct rte_cryptodev *dev,
ip6_hdr->payload_len = 0;
ip6_hdr->hop_limits = ipsec_xform->tunnel.ipv6.hlimit ?
ipsec_xform->tunnel.ipv6.hlimit : 0x40;
- ip6_hdr->proto = (ipsec_xform->proto ==
- RTE_SECURITY_IPSEC_SA_PROTO_ESP) ?
- IPPROTO_ESP : IPPROTO_AH;
memcpy(&ip6_hdr->src_addr,
&ipsec_xform->tunnel.ipv6.src_addr, 16);
memcpy(&ip6_hdr->dst_addr,
&ipsec_xform->tunnel.ipv6.dst_addr, 16);
encap_pdb.ip_hdr_len = sizeof(struct rte_ipv6_hdr);
+ if (ipsec_xform->options.udp_encap)
+ ip6_hdr->proto = IPPROTO_UDP;
+ else
+ ip6_hdr->proto = (ipsec_xform->proto ==
+ RTE_SECURITY_IPSEC_SA_PROTO_ESP) ?
+ IPPROTO_ESP : IPPROTO_AH;
+ }
+ if (ipsec_xform->options.udp_encap) {
+ uint16_t sport, dport;
+
+ if (ipsec_xform->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4)
+ uh = (struct rte_udp_hdr *) (hdr +
+ sizeof(struct rte_ipv4_hdr));
+ else
+ uh = (struct rte_udp_hdr *) (hdr +
+ sizeof(struct rte_ipv6_hdr));
+
+ sport = ipsec_xform->udp.sport ?
+ ipsec_xform->udp.sport : DPAA2_DEFAULT_NAT_T_PORT;
+ dport = ipsec_xform->udp.dport ?
+ ipsec_xform->udp.dport : DPAA2_DEFAULT_NAT_T_PORT;
+ uh->src_port = rte_cpu_to_be_16(sport);
+ uh->dst_port = rte_cpu_to_be_16(dport);
+ uh->dgram_len = 0;
+ uh->dgram_cksum = 0;
+
+ encap_pdb.ip_hdr_len += sizeof(struct rte_udp_hdr);
+ encap_pdb.options |= PDBOPTS_ESP_NAT | PDBOPTS_ESP_NUC;
}
bufsize = cnstr_shdsc_ipsec_new_encap(priv->flc_desc[0].desc,
@@ -3320,13 +3328,23 @@ dpaa2_sec_set_ipsec_session(struct rte_cryptodev *dev,
if (ipsec_xform->tunnel.type ==
RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
- decap_pdb.options = sizeof(struct ip) << 16;
+ if (ipsec_xform->options.udp_encap)
+ decap_pdb.options =
+ (sizeof(struct ip) + sizeof(struct rte_udp_hdr)) << 16;
+ else
+ decap_pdb.options = sizeof(struct ip) << 16;
if (ipsec_xform->options.copy_df)
decap_pdb.options |= PDBHMO_ESP_DFV;
if (ipsec_xform->options.dec_ttl)
decap_pdb.options |= PDBHMO_ESP_DECAP_DTTL;
} else {
- decap_pdb.options = sizeof(struct rte_ipv6_hdr) << 16;
+ if (ipsec_xform->options.udp_encap) {
+ decap_pdb.options =
+ (sizeof(struct rte_ipv6_hdr) +
+ sizeof(struct rte_udp_hdr)) << 16;
+ } else {
+ decap_pdb.options = sizeof(struct rte_ipv6_hdr) << 16;
+ }
}
if (ipsec_xform->options.esn) {
decap_pdb.options |= PDBOPTS_ESP_ESN;
--
2.25.1
^ permalink raw reply [flat|nested] 5+ messages in thread* RE: [EXTERNAL] [PATCH 1/4] crypto/dpaa_sec: enhance IPsec extended sequence number
2024-10-24 15:01 [PATCH 1/4] crypto/dpaa_sec: enhance IPsec extended sequence number Hemant Agrawal
` (2 preceding siblings ...)
2024-10-24 15:01 ` [PATCH 4/4] crypto/dpaa2_sec: add support for IPv6 UDP encap Hemant Agrawal
@ 2024-11-06 11:33 ` Akhil Goyal
3 siblings, 0 replies; 5+ messages in thread
From: Akhil Goyal @ 2024-11-06 11:33 UTC (permalink / raw)
To: Hemant Agrawal; +Cc: dev, Gagandeep Singh, Barry Cao
> From: Gagandeep Singh <g.singh@nxp.com>
>
> Setting ESN seq number initialization.
> Initialize the sequence number of ESP to 1.
>
> Signed-off-by: Gagandeep Singh <g.singh@nxp.com>
> Signed-off-by: Barry Cao <barry.cao@nxp.com>
> ---
Series applied to dpdk-next-crypto
Thanks.
^ permalink raw reply [flat|nested] 5+ messages in thread