crypto/octeontx2: fix lookaside IPsec IPv6

Fixing IPv6 mixed tunnel mode support by updating
inputs to firmware.

Fixes: 4edede7bc6ee ("crypto/octeontx2: support lookaside IPsec IPv6")
Cc: stable@dpdk.org
Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
Acked-by: Anoob Joseph <anoobj@marvell.com>

diff --git a/drivers/crypto/octeontx2/otx2_cryptodev_ops.c b/drivers/crypto/octeontx2/otx2_cryptodev_ops.c
index 4330cbd1c1fbcff4be5a95434170c92137bf514e..339b82f33ed4551176d27dd66b9d1eff96562fe3 100644 (file)
--- a/drivers/crypto/octeontx2/otx2_cryptodev_ops.c
+++ b/drivers/crypto/octeontx2/otx2_cryptodev_ops.c
@@ -984,13 +984,12 @@ otx2_cpt_sec_post_process(struct rte_crypto_op *cop, uintptr_t *rsp)
 
        if (word0->s.opcode.major == OTX2_IPSEC_PO_PROCESS_IPSEC_INB) {
                data = rte_pktmbuf_mtod(m, char *);
+               ip = (struct rte_ipv4_hdr *)(data +
+                       OTX2_IPSEC_PO_INB_RPTR_HDR);
 
-               if (rsp[4] == OTX2_IPSEC_PO_TRANSPORT ||
-                   rsp[4] == OTX2_IPSEC_PO_TUNNEL_IPV4) {
-                       ip = (struct rte_ipv4_hdr *)(data +
-                               OTX2_IPSEC_PO_INB_RPTR_HDR);
+               if ((ip->version_ihl >> 4) == 4) {
                        m_len = rte_be_to_cpu_16(ip->total_length);
-               } else if (rsp[4] == OTX2_IPSEC_PO_TUNNEL_IPV6) {
+               } else {
                        ip6 = (struct rte_ipv6_hdr *)(data +
                                OTX2_IPSEC_PO_INB_RPTR_HDR);
                        m_len = rte_be_to_cpu_16(ip6->payload_len) +

diff --git a/drivers/crypto/octeontx2/otx2_cryptodev_sec.c b/drivers/crypto/octeontx2/otx2_cryptodev_sec.c
index a5db40047d0f10ad161ef614858478e281df8c09..9a4f84f8d890e55c0c4627c07aebda9ba90d8d04 100644 (file)
--- a/drivers/crypto/octeontx2/otx2_cryptodev_sec.c
+++ b/drivers/crypto/octeontx2/otx2_cryptodev_sec.c
@@ -194,9 +194,6 @@ set_session_misc_attributes(struct otx2_sec_session_ipsec_lp *sess,
                sess->auth_iv_length = auth_xform->auth.iv.length;
                sess->mac_len = auth_xform->auth.digest_length;
        }
-
-       sess->ucmd_param1 = OTX2_IPSEC_PO_PER_PKT_IV;
-       sess->ucmd_param2 = 0;
 }
 
 static int
@@ -232,7 +229,6 @@ crypto_sec_ipsec_outb_session_create(struct rte_cryptodev *crypto_dev,
        memset(sa, 0, sizeof(struct otx2_ipsec_po_out_sa));
 
        /* Initialize lookaside ipsec private data */
-       lp->mode_type = OTX2_IPSEC_PO_TRANSPORT;
        lp->ip_id = 0;
        lp->seq_lo = 1;
        lp->seq_hi = 0;
@@ -285,7 +281,6 @@ crypto_sec_ipsec_outb_session_create(struct rte_cryptodev *crypto_dev,
 
        if (ipsec->mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL) {
                if (ipsec->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
-                       lp->mode_type = OTX2_IPSEC_PO_TUNNEL_IPV4;
                        ip->version_ihl = RTE_IPV4_VHL_DEF;
                        ip->time_to_live = ipsec->tunnel.ipv4.ttl;
                        ip->type_of_service |= (ipsec->tunnel.ipv4.dscp << 2);
@@ -298,7 +293,6 @@ crypto_sec_ipsec_outb_session_create(struct rte_cryptodev *crypto_dev,
                } else if (ipsec->tunnel.type ==
                                RTE_SECURITY_IPSEC_TUNNEL_IPV6) {
 
-                       lp->mode_type = OTX2_IPSEC_PO_TUNNEL_IPV6;
                        if (ctl->enc_type == OTX2_IPSEC_PO_SA_ENC_AES_GCM) {
                                template = &sa->aes_gcm.template;
                                ctx_len = offsetof(struct otx2_ipsec_po_out_sa,
@@ -387,6 +381,10 @@ crypto_sec_ipsec_outb_session_create(struct rte_cryptodev *crypto_dev,
        lp->ucmd_opcode = (lp->ctx_len << 8) |
                                (OTX2_IPSEC_PO_PROCESS_IPSEC_OUTB);
 
+       /* Set per packet IV and IKEv2 bits */
+       lp->ucmd_param1 = BIT(11) | BIT(9);
+       lp->ucmd_param2 = 0;
+
        set_session_misc_attributes(lp, crypto_xform,
                                    auth_xform, cipher_xform);
 
@@ -429,20 +427,12 @@ crypto_sec_ipsec_inb_session_create(struct rte_cryptodev *crypto_dev,
        if (ret)
                return ret;
 
-       lp->mode_type = OTX2_IPSEC_PO_TRANSPORT;
-
        auth_xform = crypto_xform;
        cipher_xform = crypto_xform->next;
 
        cipher_key_len = 0;
        auth_key_len = 0;
 
-       if (ipsec->mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL)
-               lp->mode_type = (ipsec->tunnel.type ==
-                               RTE_SECURITY_IPSEC_TUNNEL_IPV4) ?
-                               OTX2_IPSEC_PO_TUNNEL_IPV4 :
-                               OTX2_IPSEC_PO_TUNNEL_IPV6;
-
        if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
                if (crypto_xform->aead.algo == RTE_CRYPTO_AEAD_AES_GCM)
                        memcpy(sa->iv.gcm.nonce, &ipsec->salt, 4);
@@ -482,6 +472,10 @@ crypto_sec_ipsec_inb_session_create(struct rte_cryptodev *crypto_dev,
        lp->cpt_inst_w7 = inst.u64[7];
        lp->ucmd_opcode = (lp->ctx_len << 8) |
                                (OTX2_IPSEC_PO_PROCESS_IPSEC_INB);
+       lp->ucmd_param1 = 0;
+
+       /* Set IKEv2 bit */
+       lp->ucmd_param2 = BIT(12);
 
        set_session_misc_attributes(lp, crypto_xform,
                                    auth_xform, cipher_xform);

diff --git a/drivers/crypto/octeontx2/otx2_cryptodev_sec.h b/drivers/crypto/octeontx2/otx2_cryptodev_sec.h
index 87f55c97fe42ef436ac15a55bb7116f8a7604a47..ff3329c9c161599b12ee010e29043b62f2494c57 100644 (file)
--- a/drivers/crypto/octeontx2/otx2_cryptodev_sec.h
+++ b/drivers/crypto/octeontx2/otx2_cryptodev_sec.h
@@ -55,8 +55,6 @@ struct otx2_sec_session_ipsec_lp {
        uint8_t iv_length;
        /** Auth IV length in bytes */
        uint8_t auth_iv_length;
-       /** IPsec mode and tunnel type */
-       enum otx2_ipsec_po_mode_type mode_type;
 };
 
 int otx2_crypto_sec_ctx_create(struct rte_cryptodev *crypto_dev);

diff --git a/drivers/crypto/octeontx2/otx2_ipsec_po.h b/drivers/crypto/octeontx2/otx2_ipsec_po.h
index b61c5e0c04f2e577703171ff45c69e41ac56e139..695f55264452393b3134304131f65738c074c907 100644 (file)
--- a/drivers/crypto/octeontx2/otx2_ipsec_po.h
+++ b/drivers/crypto/octeontx2/otx2_ipsec_po.h
@@ -11,8 +11,6 @@
 
 #define OTX2_IPSEC_PO_AES_GCM_INB_CTX_LEN    0x09
 
-#define OTX2_IPSEC_PO_PER_PKT_IV  BIT(11)
-
 #define OTX2_IPSEC_PO_WRITE_IPSEC_OUTB     0x20
 #define OTX2_IPSEC_PO_WRITE_IPSEC_INB      0x21
 #define OTX2_IPSEC_PO_PROCESS_IPSEC_OUTB   0x23
@@ -20,12 +18,6 @@
 
 #define OTX2_IPSEC_PO_INB_RPTR_HDR         0x8
 
-enum otx2_ipsec_po_mode_type {
-       OTX2_IPSEC_PO_TRANSPORT = 1,
-       OTX2_IPSEC_PO_TUNNEL_IPV4,
-       OTX2_IPSEC_PO_TUNNEL_IPV6,
-};
-
 enum otx2_ipsec_po_comp_e {
        OTX2_IPSEC_PO_CC_SUCCESS = 0x00,
        OTX2_IPSEC_PO_CC_AUTH_UNSUPPORTED = 0xB0,

diff --git a/drivers/crypto/octeontx2/otx2_ipsec_po_ops.h b/drivers/crypto/octeontx2/otx2_ipsec_po_ops.h
index 25ee10f34264efc9043f0ac01ec1f5955f09524b..c3abf021871c9095901cbd1666e9753002e737fd 100644 (file)
--- a/drivers/crypto/octeontx2/otx2_ipsec_po_ops.h
+++ b/drivers/crypto/octeontx2/otx2_ipsec_po_ops.h
@@ -25,8 +25,7 @@ otx2_ipsec_po_out_rlen_get(struct otx2_sec_session_ipsec_lp *sess,
 }
 
 static __rte_always_inline struct cpt_request_info *
-alloc_request_struct(char *maddr, void *cop, int mdata_len,
-                    enum otx2_ipsec_po_mode_type mode_type)
+alloc_request_struct(char *maddr, void *cop, int mdata_len)
 {
        struct cpt_request_info *req;
        struct cpt_meta_info *meta;
@@ -48,7 +47,6 @@ alloc_request_struct(char *maddr, void *cop, int mdata_len,
        op[1] = (uintptr_t)cop;
        op[2] = (uintptr_t)req;
        op[3] = mdata_len;
-       op[4] = mode_type;
 
        return req;
 }
@@ -86,8 +84,7 @@ process_outb_sa(struct rte_crypto_op *cop,
        }
 
        mdata += extend_tail; /* mdata follows encrypted data */
-       req = alloc_request_struct(mdata, (void *)cop, mdata_len,
-               sess->mode_type);
+       req = alloc_request_struct(mdata, (void *)cop, mdata_len);
 
        data = rte_pktmbuf_prepend(m_src, extend_head);
        if (unlikely(data == NULL)) {
@@ -153,8 +150,7 @@ process_inb_sa(struct rte_crypto_op *cop,
                goto exit;
        }
 
-       req = alloc_request_struct(mdata, (void *)cop, mdata_len,
-               sess->mode_type);
+       req = alloc_request_struct(mdata, (void *)cop, mdata_len);
 
        /* Prepare CPT instruction */
        word0.u64 = sess->ucmd_w0;