[PATCH 1/3] examples/ipsec-secgw: avoid error pkt prints in fast path

[PATCH 1/3] examples/ipsec-secgw: avoid error pkt prints in fast path

[Nithin Dabilpuram]

Avoid printing errors due to bad packets in fast path as it
effects performance. Make them RTE_LOG_DP() instead.
Also print the actual ptype that is used to classify the pkt.

Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
---
 examples/ipsec-secgw/ipsec_worker.c | 2 +-
 examples/ipsec-secgw/ipsec_worker.h | 5 +----
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/examples/ipsec-secgw/ipsec_worker.c b/examples/ipsec-secgw/ipsec_worker.c
index 2f02946f86..58c80c73f0 100644
--- a/examples/ipsec-secgw/ipsec_worker.c
+++ b/examples/ipsec-secgw/ipsec_worker.c
@@ -578,7 +578,7 @@ process_ipsec_ev_outbound(struct ipsec_ctx *ctx, struct route_table *rt,
 		 * Only plain IPv4 & IPv6 packets are allowed
 		 * on protected port. Drop the rest.
 		 */
-		RTE_LOG(ERR, IPSEC, "Unsupported packet type = %d\n", type);
+		RTE_LOG_DP(DEBUG, IPSEC, "Unsupported packet type = %d\n", type);
 		goto drop_pkt_and_exit;
 	}
 
diff --git a/examples/ipsec-secgw/ipsec_worker.h b/examples/ipsec-secgw/ipsec_worker.h
index d5a68d91fa..cf59b9b5ab 100644
--- a/examples/ipsec-secgw/ipsec_worker.h
+++ b/examples/ipsec-secgw/ipsec_worker.h
@@ -123,7 +123,6 @@ prepare_one_packet(struct rte_security_ctx *ctx, struct rte_mbuf *pkt,
 		   struct ipsec_traffic *t)
 {
 	uint32_t ptype = pkt->packet_type;
-	const struct rte_ether_hdr *eth;
 	const struct rte_ipv4_hdr *iph4;
 	const struct rte_ipv6_hdr *iph6;
 	uint32_t tun_type, l3_type;
@@ -138,7 +137,6 @@ prepare_one_packet(struct rte_security_ctx *ctx, struct rte_mbuf *pkt,
 	tun_type = ptype & RTE_PTYPE_TUNNEL_MASK;
 	l3_type = ptype & RTE_PTYPE_L3_MASK;
 
-	eth = rte_pktmbuf_mtod(pkt, const struct rte_ether_hdr *);
 	if (RTE_ETH_IS_IPV4_HDR(l3_type)) {
 		iph4 = (const struct rte_ipv4_hdr *)rte_pktmbuf_adj(pkt,
 			RTE_ETHER_HDR_LEN);
@@ -192,8 +190,7 @@ prepare_one_packet(struct rte_security_ctx *ctx, struct rte_mbuf *pkt,
 		tx_offload = l3len << RTE_MBUF_L2_LEN_BITS;
 	} else {
 		/* Unknown/Unsupported type, drop the packet */
-		RTE_LOG(ERR, IPSEC, "Unsupported packet type 0x%x\n",
-			rte_be_to_cpu_16(eth->ether_type));
+		RTE_LOG_DP(DEBUG, IPSEC, "Unsupported packet type 0x%x\n", ptype);
 		free_pkts(&pkt, 1);
 		return;
 	}
-- 
2.25.1

[PATCH 2/3] examples/ipsec-secgw: skip Rx scatter for HW reassembly

[Nithin Dabilpuram]

When HW reassembly is enabled, currently both Rx scatter and
Tx multi-segs ethdev offload flags are enabled. Tx multi-seg is
needed to Tx the reassembled pkt but Rx scatter is not needed as
reassembly should be self sufficient offload flag. Hence remove it
and only enable Tx multi-segs when HW reassembly is enabled.

Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
---
 examples/ipsec-secgw/sa.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c
index 5f5d2685f6..a25b4e2de7 100644
--- a/examples/ipsec-secgw/sa.c
+++ b/examples/ipsec-secgw/sa.c
@@ -1850,7 +1850,6 @@ sa_check_offloads(uint16_t port_id, uint64_t *rx_offloads,
 				&& rule->portid == port_id)
 			*rx_offloads |= RTE_ETH_RX_OFFLOAD_SECURITY;
 		if (IS_HW_REASSEMBLY_EN(rule->flags)) {
-			*rx_offloads |= RTE_ETH_RX_OFFLOAD_SCATTER;
 			*tx_offloads |= RTE_ETH_TX_OFFLOAD_MULTI_SEGS;
 			*hw_reassembly = 1;
 		}
-- 
2.25.1

[PATCH 3/3] app/test: test inline reassembly with multi seg

[Nithin Dabilpuram]

Support testing inline reassembly with multi seg in
inline ipsec multi seg test command.

Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
---
 app/test/test_security_inline_proto.c         | 17 ++++--
 app/test/test_security_inline_proto_vectors.h | 53 ++++++++++++++++++-
 2 files changed, 64 insertions(+), 6 deletions(-)

diff --git a/app/test/test_security_inline_proto.c b/app/test/test_security_inline_proto.c
index 79858e559f..7f6fa0ad8c 100644
--- a/app/test/test_security_inline_proto.c
+++ b/app/test/test_security_inline_proto.c
@@ -1624,6 +1624,8 @@ inline_ipsec_testsuite_setup(void)
 		 * Without SG mode, default value is picked.
 		 */
 		plaintext_len = local_port_conf.rxmode.mtu - 256;
+	} else {
+		plaintext_len = 0;
 	}
 
 	return 0;
@@ -1934,6 +1936,7 @@ test_inline_ip_reassembly(const void *testdata)
 	const struct reassembly_vector *td = testdata;
 	struct ip_reassembly_test_packet full_pkt;
 	struct ip_reassembly_test_packet frags[MAX_FRAGS];
+	uint16_t extra_data, extra_data_sum = 0;
 	struct ipsec_test_flags flags = {0};
 	int i = 0;
 
@@ -1945,14 +1948,22 @@ test_inline_ip_reassembly(const void *testdata)
 			sizeof(struct ip_reassembly_test_packet));
 	reassembly_td.full_pkt = &full_pkt;
 
-	test_vector_payload_populate(reassembly_td.full_pkt, true);
 	for (; i < reassembly_td.nb_frags; i++) {
 		memcpy(&frags[i], td->frags[i],
 			sizeof(struct ip_reassembly_test_packet));
 		reassembly_td.frags[i] = &frags[i];
+
+		/* Add extra data for multi-seg test on all fragments except last one */
+		extra_data = 0;
+		if (plaintext_len && reassembly_td.frags[i]->len < plaintext_len &&
+		    (i != reassembly_td.nb_frags - 1))
+			extra_data = ((plaintext_len - reassembly_td.frags[i]->len) & ~0x7ULL);
+
 		test_vector_payload_populate(reassembly_td.frags[i],
-				(i == 0) ? true : false);
+				(i == 0) ? true : false, extra_data, extra_data_sum);
+		extra_data_sum += extra_data;
 	}
+	test_vector_payload_populate(reassembly_td.full_pkt, true, extra_data_sum, 0);
 
 	return test_ipsec_with_reassembly(&reassembly_td, &flags);
 }
@@ -2667,8 +2678,6 @@ test_ipsec_inline_proto_pkt_esn_antireplay4096(const void *test_data)
 	return test_ipsec_inline_proto_pkt_esn_antireplay(test_data, 4096);
 }
 
-
-
 static struct unit_test_suite inline_ipsec_testsuite  = {
 	.suite_name = "Inline IPsec Ethernet Device Unit Test Suite",
 	.unit_test_cases = {
diff --git a/app/test/test_security_inline_proto_vectors.h b/app/test/test_security_inline_proto_vectors.h
index 003537e200..61a045b446 100644
--- a/app/test/test_security_inline_proto_vectors.h
+++ b/app/test/test_security_inline_proto_vectors.h
@@ -17,7 +17,7 @@ uint8_t dummy_ipv6_eth_hdr[] = {
 		0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0x86, 0xdd,
 };
 
-#define MAX_FRAG_LEN		 1500
+#define MAX_FRAG_LEN		 IPSEC_TEXT_MAX_LEN
 #define MAX_FRAGS		 6
 #define MAX_PKT_LEN		 (MAX_FRAG_LEN * MAX_FRAGS)
 
@@ -468,9 +468,13 @@ struct ip_reassembly_test_packet pkt_ipv4_udp_p3_f5 = {
 
 static inline void
 test_vector_payload_populate(struct ip_reassembly_test_packet *pkt,
-		bool first_frag)
+			     bool first_frag, uint16_t extra_data, uint16_t extra_data_sum)
 {
+	bool is_ipv6 = ((pkt->data[0] >> 4) == 0x6);
 	uint32_t i = pkt->l4_offset;
+	uint16_t len, off;
+	size_t ext_len = 0;
+	int proto;
 
 	/**
 	 * For non-fragmented packets and first frag, skip 8 bytes from
@@ -479,6 +483,51 @@ test_vector_payload_populate(struct ip_reassembly_test_packet *pkt,
 	if (first_frag)
 		i += 8;
 
+	/* Fixup header and checksum */
+	if (extra_data || extra_data_sum) {
+		if (is_ipv6) {
+			struct rte_ipv6_hdr *hdr = (struct rte_ipv6_hdr *)pkt->data;
+			struct rte_ipv6_fragment_ext *frag_ext;
+			uint8_t *p = pkt->data;
+			uint16_t old_off;
+
+			len = rte_be_to_cpu_16(hdr->payload_len) + extra_data;
+			hdr->payload_len = rte_cpu_to_be_16(len);
+
+			/* Find frag extension header to add to frag offset */
+			if (extra_data_sum) {
+				proto = hdr->proto;
+				p += sizeof(struct rte_ipv6_hdr);
+				while (proto != IPPROTO_FRAGMENT &&
+				       (proto = rte_ipv6_get_next_ext(p, proto, &ext_len) >= 0))
+					p += ext_len;
+
+				/* Found fragment header, update the frag offset */
+				if (proto == IPPROTO_FRAGMENT) {
+					frag_ext = (struct rte_ipv6_fragment_ext *)p;
+					old_off = rte_be_to_cpu_16(frag_ext->frag_data);
+					off = old_off & 0xFFF8;
+					off += extra_data_sum;
+					frag_ext->frag_data = rte_cpu_to_be_16(off |
+									       (old_off & 0x7));
+				}
+			}
+		} else {
+			struct rte_ipv4_hdr *hdr = (struct rte_ipv4_hdr *)pkt->data;
+			uint16_t old_off = rte_be_to_cpu_16(hdr->fragment_offset);
+
+			len = rte_be_to_cpu_16(hdr->total_length) + extra_data;
+			off = old_off & 0x1FFF;
+			off += (extra_data_sum >> 3);
+
+			hdr->total_length = rte_cpu_to_be_16(len);
+			hdr->fragment_offset = rte_cpu_to_be_16(off | (old_off & 0xe000));
+			hdr->hdr_checksum = 0;
+			hdr->hdr_checksum = rte_ipv4_cksum(hdr);
+		}
+		pkt->len += extra_data;
+	}
+
 	for (; i < pkt->len; i++)
 		pkt->data[i] = 0x58;
 }
-- 
2.25.1

RE: [PATCH 1/3] examples/ipsec-secgw: avoid error pkt prints in fast path

[Akhil Goyal]

> Subject: [PATCH 1/3] examples/ipsec-secgw: avoid error pkt prints in fast path
> 
> Avoid printing errors due to bad packets in fast path as it
> effects performance. Make them RTE_LOG_DP() instead.
> Also print the actual ptype that is used to classify the pkt.
> 
> Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
Series
Acked-by: Akhil Goyal <gakhil@marvell.com>

Applied to dpdk-next-crypto
Thanks.