From mboxrd@z Thu Jan  1 00:00:00 1970
From: "Doherty, Declan" <declan.doherty@intel.com>
Subject: Re: [PATCH 09/11] net/ixgbe: enable inline ipsec
Date: Fri, 15 Sep 2017 14:14:26 +0100
Message-ID: <8886d571-1708-1710-14fd-69e03a5e427c@intel.com>
References: <20170914082651.26232-1-akhil.goyal@nxp.com>
 <20170914082651.26232-10-akhil.goyal@nxp.com>
 <ecd42e7e-f001-2603-32b4-3852bd3abca9@nxp.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 8bit
Cc: pablo.de.lara.guarch@intel.com, radu.nicolau@intel.com,
 borisp@mellanox.com, aviadye@mellanox.com, thomas@monjalon.net,
 sandeep.malik@nxp.com, jerin.jacob@caviumnetworks.com
To: Hemant Agrawal <hemant.agrawal@nxp.com>, Akhil Goyal
 <akhil.goyal@nxp.com>, dev@dpdk.org
Return-path: <dev-bounces@dpdk.org>
Received: from mga06.intel.com (mga06.intel.com [134.134.136.31])
 by dpdk.org (Postfix) with ESMTP id 5671E2BBE
 for <dev@dpdk.org>; Fri, 15 Sep 2017 15:14:35 +0200 (CEST)
In-Reply-To: <ecd42e7e-f001-2603-32b4-3852bd3abca9@nxp.com>
Content-Language: en-US
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <http://dpdk.org/ml/options/dev>,
 <mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://dpdk.org/ml/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <http://dpdk.org/ml/listinfo/dev>,
 <mailto:dev-request@dpdk.org?subject=subscribe>
Errors-To: dev-bounces@dpdk.org
Sender: "dev" <dev-bounces@dpdk.org>

On 15/09/2017 5:48 AM, Hemant Agrawal wrote:
> Hi Radu,
>
> On 9/14/2017 1:56 PM, Akhil Goyal wrote:
>
>> +static const struct rte_security_capability 
>> ixgbe_security_capabilities[] = {
>> +    { /* IPsec Inline Crypto AH Transport Egress */
>> +        .action = RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO,
>> +        .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
>> +        .ipsec = {
>> +            .proto = RTE_SECURITY_IPSEC_SA_PROTO_AH,
>
> You are supporting AH, however only ESP is proposed in other patch for 
> addition to rte_flow?

Hemant, this was a mistake on my part when defining the capabilities, 
although the ixgbe is capable of supporting AH we haven't done the 
enablement of that yet.  I'll update this file to remove the AH 
capabilities for the moment, until we have time to implement and test fully.
>
>> +            .mode = RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT,
>> +            .direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
>> +            .options = { 0 },
>> +        },
>> +        .crypto_capabilities = aes_gmac_crypto_capabilities
>> +    },
>> +    { /* IPsec Inline Crypto ESP Transport Egress */
>> +        .action = RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO,
>> +        .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
>> +        .ipsec = {
>> +            .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
>> +            .mode = RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT,
>> +            .direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
>> +            .options = { 0 }
>> +        },
>> +        .crypto_capabilities = aes_gcm_gmac_crypto_capabilities
>> +    },
>> +    { /* IPsec Inline Crypto AH Transport Ingress */
>> +        .action = RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO,
>> +        .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
>> +        .ipsec = {
>> +            .proto = RTE_SECURITY_IPSEC_SA_PROTO_AH,
>> +            .mode = RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT,
>> +            .direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
>> +            .options = { 0 }
>> +        },
>> +        .crypto_capabilities = aes_gmac_crypto_capabilities
>> +    },
>> +    { /* IPsec Inline Crypto AH Tunnel Ingress */
>> +        .action = RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO,
>> +        .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
>> +        .ipsec = {
>> +            .proto = RTE_SECURITY_IPSEC_SA_PROTO_AH,
>> +            .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
>> +            .direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
>> +            .options = { 0 }
>> +        },
>> +        .crypto_capabilities = aes_gmac_crypto_capabilities
>> +    },
>> +    { /* IPsec Inline Crypto ESP Transport Ingress */
>> +        .action = RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO,
>> +        .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
>> +        .ipsec = {
>> +            .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
>> +            .mode = RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT,
>> +            .direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
>> +            .options = { 0 }
>> +        },
>> +        .crypto_capabilities = aes_gcm_gmac_crypto_capabilities
>> +    },
>> +    { /* IPsec Inline Crypto ESP Tunnel Ingress */
>> +        .action = RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO,
>> +        .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
>> +        .ipsec = {
>> +            .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
>> +            .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
>> +            .direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
>> +            .options = { 0 }
>> +        },
>> +        .crypto_capabilities = aes_gcm_gmac_crypto_capabilities
>> +    },
>> +    {
>> +        .action = RTE_SECURITY_ACTION_TYPE_NONE
>> +    }
>> +};
>
>