This patch adds support for enabling capability to copy
dscp and df bits from inner to outer header and vice-versa.
Signed-off-by: Hemant Agrawal <hemant.agra...@nxp.com>
---
drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c | 18 ++++++++++++++----
drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h | 10 ++++++++--
2 files changed, 22 insertions(+), 6 deletions(-)
diff --git a/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
b/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
index daa6a71360..3b96798242 100644
--- a/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
+++ b/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
@@ -3193,10 +3193,14 @@ dpaa2_sec_set_ipsec_session(struct rte_cryptodev *dev,
encap_pdb.options |= PDBHMO_ESP_ENCAP_DTTL;
if (ipsec_xform->options.esn)
encap_pdb.options |= PDBOPTS_ESP_ESN;
+ if (ipsec_xform->options.copy_dscp)
+ encap_pdb.options |= PDBOPTS_ESP_DIFFSERV;
encap_pdb.spi = ipsec_xform->spi;
session->dir = DIR_ENC;
if (ipsec_xform->tunnel.type ==
RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
+ if (ipsec_xform->options.copy_df)
+ encap_pdb.options |= PDBHMO_ESP_DFBIT;
encap_pdb.ip_hdr_len = sizeof(struct ip);
ip4_hdr.ip_v = IPVERSION;
ip4_hdr.ip_hl = 5;
@@ -3261,12 +3265,18 @@ dpaa2_sec_set_ipsec_session(struct rte_cryptodev *dev,
break;
}
- decap_pdb.options = (ipsec_xform->tunnel.type ==
- RTE_SECURITY_IPSEC_TUNNEL_IPV4) ?
- sizeof(struct ip) << 16 :
- sizeof(struct rte_ipv6_hdr) << 16;
+ if (ipsec_xform->tunnel.type ==
+ RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
+ decap_pdb.options = sizeof(struct ip) << 16;
+ if (ipsec_xform->options.copy_df)
+ decap_pdb.options |= PDBHMO_ESP_DFV;
+ } else {
+ decap_pdb.options = sizeof(struct rte_ipv6_hdr) << 16;
+ }
if (ipsec_xform->options.esn)
decap_pdb.options |= PDBOPTS_ESP_ESN;
+ if (ipsec_xform->options.copy_dscp)
+ decap_pdb.options |= PDBOPTS_ESP_DIFFSERV;
if (ipsec_xform->replay_win_sz) {
uint32_t win_sz;
diff --git a/drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h
b/drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h
index 5a4eb8e2ed..0f29e6299f 100644
--- a/drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h
+++ b/drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h
@@ -929,7 +929,10 @@ static const struct rte_security_capability
dpaa2_sec_security_cap[] = {
.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
- .options = { 0 },
+ .options = {
+ .copy_df = 1,
+ .copy_dscp = 1,
+ },
.replay_win_sz_max = 128
},
.crypto_capabilities = dpaa2_sec_capabilities
@@ -941,7 +944,10 @@ static const struct rte_security_capability
dpaa2_sec_security_cap[] = {
.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
.direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
- .options = { 0 },
+ .options = {
+ .copy_df = 1,
+ .copy_dscp = 1,
+ },
.replay_win_sz_max = 128
},
.crypto_capabilities = dpaa2_sec_capabilities
--
2.17.1
