Patch Detail

HTTP 200 OK
Allow: GET, PUT, PATCH, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 30414,
    "url": "https://patches.dpdk.org/api/patches/30414/?format=api",
    "web_url": "https://patches.dpdk.org/project/dpdk/patch/20171014221734.15511-11-akhil.goyal@nxp.com/",
    "project": {
        "id": 1,
        "url": "https://patches.dpdk.org/api/projects/1/?format=api",
        "name": "DPDK",
        "link_name": "dpdk",
        "list_id": "dev.dpdk.org",
        "list_email": "dev@dpdk.org",
        "web_url": "http://core.dpdk.org",
        "scm_url": "git://dpdk.org/dpdk",
        "webscm_url": "http://git.dpdk.org/dpdk",
        "list_archive_url": "https://inbox.dpdk.org/dev",
        "list_archive_url_format": "https://inbox.dpdk.org/dev/{}",
        "commit_url_format": ""
    },
    "msgid": "<20171014221734.15511-11-akhil.goyal@nxp.com>",
    "list_archive_url": "https://inbox.dpdk.org/dev/20171014221734.15511-11-akhil.goyal@nxp.com",
    "date": "2017-10-14T22:17:32",
    "name": "[dpdk-dev,v4,10/12] net/ixgbe: enable inline ipsec",
    "commit_ref": null,
    "pull_url": null,
    "state": "superseded",
    "archived": true,
    "hash": "2c7691993f71f891bd700662dbe22e0be880f4b8",
    "submitter": {
        "id": 517,
        "url": "https://patches.dpdk.org/api/people/517/?format=api",
        "name": "Akhil Goyal",
        "email": "akhil.goyal@nxp.com"
    },
    "delegate": null,
    "mbox": "https://patches.dpdk.org/project/dpdk/patch/20171014221734.15511-11-akhil.goyal@nxp.com/mbox/",
    "series": [],
    "comments": "https://patches.dpdk.org/api/patches/30414/comments/",
    "check": "fail",
    "checks": "https://patches.dpdk.org/api/patches/30414/checks/",
    "tags": {},
    "related": [],
    "headers": {
        "Return-Path": "<dev-bounces@dpdk.org>",
        "X-Original-To": "patchwork@dpdk.org",
        "Delivered-To": "patchwork@dpdk.org",
        "Received": [
            "from [92.243.14.124] (localhost [127.0.0.1])\n\tby dpdk.org (Postfix) with ESMTP id 878EF1B329;\n\tSun, 15 Oct 2017 00:21:26 +0200 (CEST)",
            "from NAM02-SN1-obe.outbound.protection.outlook.com\n\t(mail-sn1nam02on0087.outbound.protection.outlook.com [104.47.36.87])\n\tby dpdk.org (Postfix) with ESMTP id CDED81B2FE\n\tfor <dev@dpdk.org>; Sun, 15 Oct 2017 00:21:24 +0200 (CEST)",
            "from BN6PR03CA0059.namprd03.prod.outlook.com (2603:10b6:404:4c::21)\n\tby SN2PR03MB2365.namprd03.prod.outlook.com (2603:10b6:804:e::16) with\n\tMicrosoft SMTP Server (version=TLS1_2,\n\tcipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.7;\n\tSat, 14 Oct 2017 22:21:22 +0000",
            "from BN1AFFO11FD014.protection.gbl (2a01:111:f400:7c10::171) by\n\tBN6PR03CA0059.outlook.office365.com (2603:10b6:404:4c::21) with\n\tMicrosoft SMTP Server (version=TLS1_2,\n\tcipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.7 via\n\tFrontend Transport; Sat, 14 Oct 2017 22:21:22 +0000",
            "from az84smr01.freescale.net (192.88.158.2) by\n\tBN1AFFO11FD014.mail.protection.outlook.com (10.58.52.74) with\n\tMicrosoft SMTP Server (version=TLS1_0,\n\tcipher=TLS_RSA_WITH_AES_256_CBC_SHA) id 15.20.77.10\n\tvia Frontend Transport; Sat, 14 Oct 2017 22:21:22 +0000",
            "from netperf2.ap.freescale.net ([10.232.133.164])\n\tby az84smr01.freescale.net (8.14.3/8.14.0) with ESMTP id\n\tv9EMKCMT018714; Sat, 14 Oct 2017 15:21:15 -0700"
        ],
        "Authentication-Results": "spf=fail (sender IP is 192.88.158.2)\n\tsmtp.mailfrom=nxp.com; NXP1.onmicrosoft.com;\n\tdkim=none (message not signed)\n\theader.d=none;NXP1.onmicrosoft.com; dmarc=fail action=none\n\theader.from=nxp.com;",
        "Received-SPF": "Fail (protection.outlook.com: domain of nxp.com does not\n\tdesignate 192.88.158.2 as permitted sender)\n\treceiver=protection.outlook.com; \n\tclient-ip=192.88.158.2; helo=az84smr01.freescale.net;",
        "From": "Akhil Goyal <akhil.goyal@nxp.com>",
        "To": "<dev@dpdk.org>",
        "CC": "<declan.doherty@intel.com>, <pablo.de.lara.guarch@intel.com>,\n\t<hemant.agrawal@nxp.com>, <radu.nicolau@intel.com>,\n\t<borisp@mellanox.com>, \n\t<aviadye@mellanox.com>, <thomas@monjalon.net>, <sandeep.malik@nxp.com>,\n\t<jerin.jacob@caviumnetworks.com>, <john.mcnamara@intel.com>,\n\t<konstantin.ananyev@intel.com>, <shahafs@mellanox.com>,\n\t<olivier.matz@6wind.com>",
        "Date": "Sun, 15 Oct 2017 03:47:32 +0530",
        "Message-ID": "<20171014221734.15511-11-akhil.goyal@nxp.com>",
        "X-Mailer": "git-send-email 2.9.3",
        "In-Reply-To": "<20171014221734.15511-1-akhil.goyal@nxp.com>",
        "References": "<20171006181151.4758-1-akhil.goyal@nxp.com>\n\t<20171014221734.15511-1-akhil.goyal@nxp.com>",
        "X-EOPAttributedMessage": "0",
        "X-Matching-Connectors": "131524932826064417;\n\t(91ab9b29-cfa4-454e-5278-08d120cd25b8); ()",
        "X-Forefront-Antispam-Report": "CIP:192.88.158.2; IPV:NLI; CTRY:US; EFV:NLI;\n\tSFV:NSPM;\n\tSFS:(10009020)(6009001)(336005)(346002)(376002)(39860400002)(39380400002)(2980300002)(1110001)(1109001)(339900001)(199003)(189002)(77096006)(54906003)(6666003)(6916009)(2950100002)(68736007)(104016004)(106466001)(2906002)(2351001)(47776003)(69596002)(33646002)(105606002)(86362001)(575784001)(189998001)(16586007)(498600001)(5003940100001)(50986999)(8656003)(305945005)(76176999)(4326008)(48376002)(50466002)(97736004)(316002)(36756003)(1076002)(50226002)(81156014)(8676002)(81166006)(85426001)(5660300001)(8936002)(7416002)(356003)(53936002)(53946003)(579004);\n\tDIR:OUT; SFP:1101; SCL:1; SRVR:SN2PR03MB2365;\n\tH:az84smr01.freescale.net; FPR:; \n\tSPF:Fail; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en; ",
        "X-Microsoft-Exchange-Diagnostics": [
            "1; BN1AFFO11FD014;\n\t1:8bqQ3nJjGdYi+fK6MDSuWTqyEj9GJHUf/je3lgxWVODM7ZD4JJrvGraHa4MwqEVeEVvQsy6rENc3/iFN1La4gsHoiJSFvTlWSeJe/r49OycPv16VK7jaRKsvUOj07bD+",
            "1; SN2PR03MB2365;\n\t3:gfWx5Le4mI0bxd6TWEdxly3iRvU43SuJWZH/mPfS3ZrY9Q9Brwh3bbTszxdtJtTYPP8QyqHIWDcMtLOLFb1cnlirz0CoabVlWxH3BqXwzVUJHQWetYRI2WOym2B0kEuEq7vAnqQ/boWThGag8wYV/sf+LK3tAVlLp43KEos43oDP2sViqnuQQvvWtu9rmdPFyRLoxmQ4lRTt3/N8fXukUpj/knL90AuUgnQzAF5GbQkaFeEqmSUJm0x6paXTMhCvBvHA6VzvbOKgBbtz8w+VzLgaFc0IieCZUzH+qC09y7FZzst0FqralBwGNO3mThGlyjCCcBV+0pe3wZraWDgZ8J6mHqaDJHbfOx0Fccg2MUc=;\n\t25:+Qb+pNKb7HfDfP0h10aoNxP4f+Wy3MIXOtWzgQ4+DhpoH1m4RNYTcu3ox8bibj7rIxCJCpBkfOnFJ5u3mk2M3GxBNdF5Vz05nzKT1H4iktYRCvkZdJBJj16Ixtr8f2eDGJSiyWcji/G9Q2QNMZZCzlj54BMAmLsq0M2ogyb0rT9LORXKs55WwbvZJNO4OcwmTPV6sQUc2zXv89VYPTCnsOh9QpOxkwfsHSHrSkiyNqC2h4qx3ttV9RmDZaMhbKKCIjULGevXNiSNSQnYo9vtik6nn2SR7PpVRr8UfsNUulbf8W16WKL2zwKkYjLeeWZfUBVonXEMlD6ARFibR8Kkjw==",
            "1; SN2PR03MB2365;\n\t31:MQjRiJQ9XQNRFsA04O5gcJiCiG9naCR/iczMzteXND4NEECG392RQHhwklV1mB+UFGKA7WwK5ycPV8cxV/J5oQT79ojHhmu7VllUDrS9Jnw7DYkG28TcKyIpUOD+lmRYNy2NiZwhpHs1P7ATeWr0rCsDwJbPyjVe51xR2AhqU2Cgpr7izt970jqJYG9xz7aMC2t1F6zUrWiuE5IX72S639M4N2kT9H2jvgjwpI2B6CM=;\n\t4:0HuRVLd/4RTfqE3MWRd4KieUSmVd+NznKXeISnfw9g4uWJp1Xww+r9FSUnfFbTiGKJwk6hfFyjYAWwvos/68MVN983gtWOqLCFxNOq4tfTaa+mNrD5Ak6ZMAQV/7Q0zHzZj9qGnQLSKpITdTXfD0X3tvR5mWXftbKUbON40w1nMN1oY7sOuOWuS2qBCvGnZ32gjNMDeg9/Tmu5dnGvWhKCtnJnZokHnG3XRnEO/gpEYyo+0N3NTZhwgWfUWWIoN8ajaC+KCkzWdMi/v9ikQv5hv3zF+dDEEqIN7gTmpfjO0vPNnDxH7wiBJSS5LQz+POtS9eqEZ7b9rGzIZixzd33Q==",
            "=?us-ascii?Q?1; SN2PR03MB2365;\n\t23:wz7eZip/FyXAD14t0gbpEHBs1D9rIXSVWHRvI79v4?=\n\tjl5tft5PT5PuN7JhRPMXuYoV5gtIw7ovh3OYCCemaQrMcaDwZXszOcpVlD63WO8Gsifu448i5DPL/hjJeIQMfh1TCk9EL01i/oTo4ibaD2YeE4v4bxsnI21XdkUhZOZo+N/ai+izGQDRZRvj3FWSgmhjdvMABfBaqC1NPNCV8RcAGLt/CXm4Yr97asAMKxSUEupR+vtn3Y2J9CZfHfkAdSdQqQRTinVAL6BQBHcWH9/quYCKmVRaDd8tQ+yEEmCiNUYOfxhbxeg1gL+5KDRdykfrS/9njh+/F7SoNzhEH3y9ENZw2czcgup9lycpeb0QhGmWqZLuDXU34cDSgRw0fG6lsn/X7+ivKOyO+68zYZdkC4Dyp4rYRRe4hOca9R72WPWoXKoG7ImIvBljguAlvuUwcooUMDk1SUQ6tBrvVRaJ9IdyFvaKKRP6Fe3n5qYpRvGuoLc+WEg74DjNtjb+1Ra31YvP/Ivp9NMzbEWOMu1gdLElSggmjxath6CJvbhToIEG+OykDxnpZUM2tlGTxbxtPpvIAJkUM9yss+Rr99pJ4unbzzMAnwNEMRjNpvH5ImQ3pxUbuzARbsPcoOfNcM8cH5S8jufZwLWiTXjxd88t55AlimFVckcaR/5tYGIQKlW8xnDAnyOjhOLZX8/hfj8RYedrwvCGmgFSAJDDhfUYEEUYiqRtcw+PIItkBWjKWmXwyEXCcMRh4MjQxk0TFYCLwCAqFWZZxzRAy+qvlU61bNU/PtFN5Vtvp8+ll7ZhdbMY75TXnLxjNDfYFMbziW7XTllCpYRb74OT3RVqSHgWvFkIFXjX3pVPBRkpCJq50vs3yqGtKgRddD8oMdCaNMgtnRdNlkXffU/6pjQKuKpY3cgo7t0EZvCJ1oQ+VGBO/2l+gfYUcmpQmyObgKxsqPoueV+E9XaDSoqKu9NONIgQSX17TaT66YUSzndnBIc69XLUU9ZgepeSpYd7P7vFKh361gX/2zvf7VY4qBSDM6c4FGRTqgQJzAQ4uAgf4LagJqL0KQcSyI5qlKK+nm++P0txBxH2h3zo9eDXvHiGiJ+QM1XEsAB8jq1TS4DHbT+Xe3cy4sGLZPXO5GQk540w0oy4F13A1bNrIlkMybZ4Rh5NewM4sP5NAGcOW8xUf9dm2PE5JPHZRWPcnoT7UhMKAsMLLxmUypCuIwstV8JVbgUMGwrby21X+76Dv+tbN1so018r30nq9E0kWzoObUuMbWglXSL0Cj7zMQEONrdfeYPiw==",
            "1; SN2PR03MB2365;\n\t6:WTOUSQdiSCfxw5JlkKBZWkVQepc32AmstgTvkf2hvbgD1hniFQbC+ssn/zCdWvoKhCwA2OaLjiQQl1xg0rZrKvJH3xnMBb8U2g2CiubztSgLZIM9ufDAg88oGo4i5U9rI4FdrTucxW/ddOlv/KEopGtb8/bngmE5s+oeLdMXwGyIYlgGq0tfWzIfqOJgGGz7cvp6x/73eNcsLcd0k8FI01Yi9ErfQzsVUfD74idOuzHMJmpxVlfUztfoL+B1reZFFo/9PzYZXXO9I6ALlaDEg5jh8KNzNTuU0aQ8/0TAZohNiN72D+TGnBLbHAZrXuSkKolUYuBMKuDN9RTZxUD5Dg==;\n\t5:/fhFMkTcQbyxi0jZqrIQNvF+L3mUAD0ZGjkwUl4hovFC+uuAyFNdFrMT2gpJHbsh97voe6DOHORSs1uC30pZ/eQms/oNqJ/vCCmbZ8p1jZpObnCD62Haqol6Lh3A6oJxDGdw+D2p24slDdn8dMTJ/w==;\n\t24:6xtpfSD8a5p+0Gt7waLCpsWaLPpUdDR2vOuKdSuq4tPdWET9Lqw36qCRcQkrStU1J6ZjwO3bfXKoc3bJqOD60vZ/kQSDedB2gQ1Dtp6KKQw=;\n\t7:tV2AGYQs0aBztc6Kg9U9gRHNoBQHEcKhJIXcaCI88sUAaVgzNR1AIQ2N8jboukVqKsqWk/Of6v7JdcoR0TnhmGk2SoitYOtF31ZiWIEg2mk3i/iNbBy9fWxCCXc0pUdcxuyTCI+EOMuw9nEVFmdZFTn8nPSItsKQ4qD8Mk412Hm6Ma/l1PrXIz9CQHXH8zSiWcBcGcqHYRhnXrRhWDoBZSDBrLh4AlYSD8YNLZZzmx0="
        ],
        "MIME-Version": "1.0",
        "Content-Type": "text/plain",
        "X-MS-PublicTrafficType": "Email",
        "X-MS-Office365-Filtering-Correlation-Id": "6791d42f-79ac-484c-5b29-08d51351e698",
        "X-Microsoft-Antispam": "UriScan:; BCL:0; PCL:0;\n\tRULEID:(22001)(2017052603199)(201703131430075)(201703131517081);\n\tSRVR:SN2PR03MB2365; ",
        "X-MS-TrafficTypeDiagnostic": "SN2PR03MB2365:",
        "X-Exchange-Antispam-Report-Test": "UriScan:(192374486261705)(228905959029699); ",
        "X-Microsoft-Antispam-PRVS": "<SN2PR03MB2365FAB92A4CA3F522510843E6490@SN2PR03MB2365.namprd03.prod.outlook.com>",
        "X-Exchange-Antispam-Report-CFA-Test": "BCL:0; PCL:0;\n\tRULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6095135)(2401047)(8121501046)(5005006)(93006095)(93001095)(100000703101)(100105400095)(3002001)(10201501046)(6055026)(6096035)(201703131430075)(201703131433075)(201703131448075)(201703161259150)(201703151042153)(20161123565025)(20161123559100)(20161123561025)(20161123563025)(20161123556025)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);\n\tSRVR:SN2PR03MB2365; BCL:0; PCL:0;\n\tRULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(400006)(100000804101)(100110200095)(100000805101)(100110500095);\n\tSRVR:SN2PR03MB2365; ",
        "X-Forefront-PRVS": "046060344D",
        "SpamDiagnosticOutput": "1:99",
        "SpamDiagnosticMetadata": "NSPM",
        "X-MS-Exchange-CrossTenant-OriginalArrivalTime": "14 Oct 2017 22:21:22.2476\n\t(UTC)",
        "X-MS-Exchange-CrossTenant-Id": "5afe0b00-7697-4969-b663-5eab37d5f47e",
        "X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp": "TenantId=5afe0b00-7697-4969-b663-5eab37d5f47e;\n\tIp=[192.88.158.2]; \n\tHelo=[az84smr01.freescale.net]",
        "X-MS-Exchange-CrossTenant-FromEntityHeader": "HybridOnPrem",
        "X-MS-Exchange-Transport-CrossTenantHeadersStamped": "SN2PR03MB2365",
        "Subject": "[dpdk-dev] [PATCH v4 10/12] net/ixgbe: enable inline ipsec",
        "X-BeenThere": "dev@dpdk.org",
        "X-Mailman-Version": "2.1.15",
        "Precedence": "list",
        "List-Id": "DPDK patches and discussions <dev.dpdk.org>",
        "List-Unsubscribe": "<http://dpdk.org/ml/options/dev>,\n\t<mailto:dev-request@dpdk.org?subject=unsubscribe>",
        "List-Archive": "<http://dpdk.org/ml/archives/dev/>",
        "List-Post": "<mailto:dev@dpdk.org>",
        "List-Help": "<mailto:dev-request@dpdk.org?subject=help>",
        "List-Subscribe": "<http://dpdk.org/ml/listinfo/dev>,\n\t<mailto:dev-request@dpdk.org?subject=subscribe>",
        "Errors-To": "dev-bounces@dpdk.org",
        "Sender": "\"dev\" <dev-bounces@dpdk.org>"
    },
    "content": "From: Radu Nicolau <radu.nicolau@intel.com>\n\nSigned-off-by: Radu Nicolau <radu.nicolau@intel.com>\nSigned-off-by: Declan Doherty <declan.doherty@intel.com>\n---\n drivers/net/Makefile                   |   2 +-\n drivers/net/ixgbe/Makefile             |   2 +-\n drivers/net/ixgbe/base/ixgbe_osdep.h   |   8 +\n drivers/net/ixgbe/ixgbe_ethdev.c       |  19 +\n drivers/net/ixgbe/ixgbe_ethdev.h       |   6 +-\n drivers/net/ixgbe/ixgbe_flow.c         |  47 +++\n drivers/net/ixgbe/ixgbe_ipsec.c        | 744 +++++++++++++++++++++++++++++++++\n drivers/net/ixgbe/ixgbe_ipsec.h        | 147 +++++++\n drivers/net/ixgbe/ixgbe_rxtx.c         |  53 ++-\n drivers/net/ixgbe/ixgbe_rxtx.h         |  11 +-\n drivers/net/ixgbe/ixgbe_rxtx_vec_sse.c |  50 ++-\n 11 files changed, 1079 insertions(+), 10 deletions(-)\n create mode 100644 drivers/net/ixgbe/ixgbe_ipsec.c\n create mode 100644 drivers/net/ixgbe/ixgbe_ipsec.h",
    "diff": "diff --git a/drivers/net/Makefile b/drivers/net/Makefile\nindex 5d2ad2f..339ff36 100644\n--- a/drivers/net/Makefile\n+++ b/drivers/net/Makefile\n@@ -68,7 +68,7 @@ DEPDIRS-fm10k = $(core-libs) librte_hash\n DIRS-$(CONFIG_RTE_LIBRTE_I40E_PMD) += i40e\n DEPDIRS-i40e = $(core-libs) librte_hash\n DIRS-$(CONFIG_RTE_LIBRTE_IXGBE_PMD) += ixgbe\n-DEPDIRS-ixgbe = $(core-libs) librte_hash\n+DEPDIRS-ixgbe = $(core-libs) librte_hash librte_security\n DIRS-$(CONFIG_RTE_LIBRTE_LIO_PMD) += liquidio\n DEPDIRS-liquidio = $(core-libs)\n DIRS-$(CONFIG_RTE_LIBRTE_MLX4_PMD) += mlx4\ndiff --git a/drivers/net/ixgbe/Makefile b/drivers/net/ixgbe/Makefile\nindex 95c806d..6e963c7 100644\n--- a/drivers/net/ixgbe/Makefile\n+++ b/drivers/net/ixgbe/Makefile\n@@ -118,11 +118,11 @@ SRCS-$(CONFIG_RTE_IXGBE_INC_VECTOR) += ixgbe_rxtx_vec_neon.c\n else\n SRCS-$(CONFIG_RTE_IXGBE_INC_VECTOR) += ixgbe_rxtx_vec_sse.c\n endif\n-\n ifeq ($(CONFIG_RTE_LIBRTE_IXGBE_BYPASS),y)\n SRCS-$(CONFIG_RTE_LIBRTE_IXGBE_PMD) += ixgbe_bypass.c\n SRCS-$(CONFIG_RTE_LIBRTE_IXGBE_PMD) += ixgbe_82599_bypass.c\n endif\n+SRCS-$(CONFIG_RTE_LIBRTE_IXGBE_PMD) += ixgbe_ipsec.c\n SRCS-$(CONFIG_RTE_LIBRTE_IXGBE_PMD) += rte_pmd_ixgbe.c\n SRCS-$(CONFIG_RTE_LIBRTE_IXGBE_PMD) += ixgbe_tm.c\n \ndiff --git a/drivers/net/ixgbe/base/ixgbe_osdep.h b/drivers/net/ixgbe/base/ixgbe_osdep.h\nindex 4aab278..b132a0f 100644\n--- a/drivers/net/ixgbe/base/ixgbe_osdep.h\n+++ b/drivers/net/ixgbe/base/ixgbe_osdep.h\n@@ -161,4 +161,12 @@ static inline uint32_t ixgbe_read_addr(volatile void* addr)\n #define IXGBE_WRITE_REG_ARRAY(hw, reg, index, value) \\\n \tIXGBE_PCI_REG_WRITE(IXGBE_PCI_REG_ARRAY_ADDR((hw), (reg), (index)), (value))\n \n+#define IXGBE_WRITE_REG_THEN_POLL_MASK(hw, reg, val, mask, poll_ms)\t\\\n+{\t\t\t\t\t\t\t\t\t\\\n+\tuint32_t cnt = poll_ms;\t\t\t\t\t\t\\\n+\tIXGBE_WRITE_REG(hw, (reg), (val));\t\t\t\t\\\n+\twhile (((IXGBE_READ_REG(hw, (reg))) & (mask)) && (cnt--))\t\\\n+\t\trte_delay_ms(1);\t\t\t\t\t\\\n+}\n+\n #endif /* _IXGBE_OS_H_ */\ndiff --git a/drivers/net/ixgbe/ixgbe_ethdev.c b/drivers/net/ixgbe/ixgbe_ethdev.c\nindex 14b9c53..fcabd5e 100644\n--- a/drivers/net/ixgbe/ixgbe_ethdev.c\n+++ b/drivers/net/ixgbe/ixgbe_ethdev.c\n@@ -61,6 +61,7 @@\n #include <rte_random.h>\n #include <rte_dev.h>\n #include <rte_hash_crc.h>\n+#include <rte_security_driver.h>\n \n #include \"ixgbe_logs.h\"\n #include \"base/ixgbe_api.h\"\n@@ -1132,6 +1133,7 @@ eth_ixgbe_dev_init(struct rte_eth_dev *eth_dev)\n \t\tIXGBE_DEV_PRIVATE_TO_FILTER_INFO(eth_dev->data->dev_private);\n \tstruct ixgbe_bw_conf *bw_conf =\n \t\tIXGBE_DEV_PRIVATE_TO_BW_CONF(eth_dev->data->dev_private);\n+\tstruct rte_security_ctx *security_instance;\n \tuint32_t ctrl_ext;\n \tuint16_t csum;\n \tint diag, i;\n@@ -1139,6 +1141,17 @@ eth_ixgbe_dev_init(struct rte_eth_dev *eth_dev)\n \tPMD_INIT_FUNC_TRACE();\n \n \teth_dev->dev_ops = &ixgbe_eth_dev_ops;\n+\tsecurity_instance = rte_malloc(\"rte_security_instances_ops\",\n+\t\t\t\tsizeof(struct rte_security_ctx), 0);\n+\tif (security_instance == NULL)\n+\t\treturn -ENOMEM;\n+\tsecurity_instance->state = RTE_SECURITY_INSTANCE_VALID;\n+\tsecurity_instance->device = (void *)eth_dev;\n+\tsecurity_instance->ops = &ixgbe_security_ops;\n+\tsecurity_instance->sess_cnt = 0;\n+\n+\teth_dev->data->security_ctx = security_instance;\n+\n \teth_dev->rx_pkt_burst = &ixgbe_recv_pkts;\n \teth_dev->tx_pkt_burst = &ixgbe_xmit_pkts;\n \teth_dev->tx_pkt_prepare = &ixgbe_prep_pkts;\n@@ -1169,6 +1182,7 @@ eth_ixgbe_dev_init(struct rte_eth_dev *eth_dev)\n \n \trte_eth_copy_pci_info(eth_dev, pci_dev);\n \teth_dev->data->dev_flags |= RTE_ETH_DEV_DETACHABLE;\n+\teth_dev->data->dev_flags |= RTE_ETH_DEV_SECURITY;\n \n \t/* Vendor and Device ID need to be set before init of shared code */\n \thw->device_id = pci_dev->id.device_id;\n@@ -1401,6 +1415,8 @@ eth_ixgbe_dev_uninit(struct rte_eth_dev *eth_dev)\n \t/* Remove all Traffic Manager configuration */\n \tixgbe_tm_conf_uninit(eth_dev);\n \n+\trte_free(eth_dev->data->security_ctx);\n+\n \treturn 0;\n }\n \n@@ -3695,6 +3711,9 @@ ixgbe_dev_info_get(struct rte_eth_dev *dev, struct rte_eth_dev_info *dev_info)\n \t    hw->mac.type == ixgbe_mac_X550EM_a)\n \t\tdev_info->tx_offload_capa |= DEV_TX_OFFLOAD_OUTER_IPV4_CKSUM;\n \n+\tdev_info->rx_offload_capa |= DEV_RX_OFFLOAD_SECURITY;\n+\tdev_info->tx_offload_capa |= DEV_TX_OFFLOAD_SECURITY;\n+\n \tdev_info->default_rxconf = (struct rte_eth_rxconf) {\n \t\t.rx_thresh = {\n \t\t\t.pthresh = IXGBE_DEFAULT_RX_PTHRESH,\ndiff --git a/drivers/net/ixgbe/ixgbe_ethdev.h b/drivers/net/ixgbe/ixgbe_ethdev.h\nindex e28c856..f5b52c4 100644\n--- a/drivers/net/ixgbe/ixgbe_ethdev.h\n+++ b/drivers/net/ixgbe/ixgbe_ethdev.h\n@@ -38,6 +38,7 @@\n #include \"base/ixgbe_dcb_82599.h\"\n #include \"base/ixgbe_dcb_82598.h\"\n #include \"ixgbe_bypass.h\"\n+#include \"ixgbe_ipsec.h\"\n #include <rte_time.h>\n #include <rte_hash.h>\n #include <rte_pci.h>\n@@ -486,7 +487,7 @@ struct ixgbe_adapter {\n \tstruct ixgbe_filter_info    filter;\n \tstruct ixgbe_l2_tn_info     l2_tn;\n \tstruct ixgbe_bw_conf        bw_conf;\n-\n+\tstruct ixgbe_ipsec          ipsec;\n \tbool rx_bulk_alloc_allowed;\n \tbool rx_vec_allowed;\n \tstruct rte_timecounter      systime_tc;\n@@ -543,6 +544,9 @@ struct ixgbe_adapter {\n #define IXGBE_DEV_PRIVATE_TO_TM_CONF(adapter) \\\n \t(&((struct ixgbe_adapter *)adapter)->tm_conf)\n \n+#define IXGBE_DEV_PRIVATE_TO_IPSEC(adapter)\\\n+\t(&((struct ixgbe_adapter *)adapter)->ipsec)\n+\n /*\n  * RX/TX function prototypes\n  */\ndiff --git a/drivers/net/ixgbe/ixgbe_flow.c b/drivers/net/ixgbe/ixgbe_flow.c\nindex 904c146..13c8243 100644\n--- a/drivers/net/ixgbe/ixgbe_flow.c\n+++ b/drivers/net/ixgbe/ixgbe_flow.c\n@@ -187,6 +187,9 @@ const struct rte_flow_action *next_no_void_action(\n  * END\n  * other members in mask and spec should set to 0x00.\n  * item->last should be NULL.\n+ *\n+ * Special case for flow action type RTE_FLOW_ACTION_TYPE_SECURITY.\n+ *\n  */\n static int\n cons_parse_ntuple_filter(const struct rte_flow_attr *attr,\n@@ -226,6 +229,41 @@ cons_parse_ntuple_filter(const struct rte_flow_attr *attr,\n \t\treturn -rte_errno;\n \t}\n \n+\t/**\n+\t *  Special case for flow action type RTE_FLOW_ACTION_TYPE_SECURITY\n+\t */\n+\tact = next_no_void_action(actions, NULL);\n+\tif (act->type == RTE_FLOW_ACTION_TYPE_SECURITY) {\n+\t\tconst void *conf = act->conf;\n+\t\t/* check if the next not void item is END */\n+\t\tact = next_no_void_action(actions, act);\n+\t\tif (act->type != RTE_FLOW_ACTION_TYPE_END) {\n+\t\t\tmemset(filter, 0, sizeof(struct rte_eth_ntuple_filter));\n+\t\t\trte_flow_error_set(error, EINVAL,\n+\t\t\t\tRTE_FLOW_ERROR_TYPE_ACTION,\n+\t\t\t\tact, \"Not supported action.\");\n+\t\t\treturn -rte_errno;\n+\t\t}\n+\n+\t\t/* get the IP pattern*/\n+\t\titem = next_no_void_pattern(pattern, NULL);\n+\t\twhile (item->type != RTE_FLOW_ITEM_TYPE_IPV4 &&\n+\t\t\t\titem->type != RTE_FLOW_ITEM_TYPE_IPV6) {\n+\t\t\tif (item->last ||\n+\t\t\t\t\titem->type == RTE_FLOW_ITEM_TYPE_END) {\n+\t\t\t\trte_flow_error_set(error, EINVAL,\n+\t\t\t\t\tRTE_FLOW_ERROR_TYPE_ITEM,\n+\t\t\t\t\titem, \"IP pattern missing.\");\n+\t\t\t\treturn -rte_errno;\n+\t\t\t}\n+\t\t\titem = next_no_void_pattern(pattern, item);\n+\t\t}\n+\n+\t\tfilter->proto = IPPROTO_ESP;\n+\t\treturn ixgbe_crypto_add_ingress_sa_from_flow(conf, item->spec,\n+\t\t\t\t\titem->type == RTE_FLOW_ITEM_TYPE_IPV6);\n+\t}\n+\n \t/* the first not void item can be MAC or IPv4 */\n \titem = next_no_void_pattern(pattern, NULL);\n \n@@ -519,6 +557,10 @@ ixgbe_parse_ntuple_filter(struct rte_eth_dev *dev,\n \tif (ret)\n \t\treturn ret;\n \n+\t/* ESP flow not really a flow*/\n+\tif (filter->proto == IPPROTO_ESP)\n+\t\treturn 0;\n+\n \t/* Ixgbe doesn't support tcp flags. */\n \tif (filter->flags & RTE_NTUPLE_FLAGS_TCP_FLAG) {\n \t\tmemset(filter, 0, sizeof(struct rte_eth_ntuple_filter));\n@@ -2758,6 +2800,11 @@ ixgbe_flow_create(struct rte_eth_dev *dev,\n \tmemset(&ntuple_filter, 0, sizeof(struct rte_eth_ntuple_filter));\n \tret = ixgbe_parse_ntuple_filter(dev, attr, pattern,\n \t\t\tactions, &ntuple_filter, error);\n+\n+\t/* ESP flow not really a flow*/\n+\tif (ntuple_filter.proto == IPPROTO_ESP)\n+\t\treturn flow;\n+\n \tif (!ret) {\n \t\tret = ixgbe_add_del_ntuple_filter(dev, &ntuple_filter, TRUE);\n \t\tif (!ret) {\ndiff --git a/drivers/net/ixgbe/ixgbe_ipsec.c b/drivers/net/ixgbe/ixgbe_ipsec.c\nnew file mode 100644\nindex 0000000..6ace305\n--- /dev/null\n+++ b/drivers/net/ixgbe/ixgbe_ipsec.c\n@@ -0,0 +1,744 @@\n+/*-\n+ *   BSD LICENSE\n+ *\n+ *   Copyright(c) 2010-2017 Intel Corporation. All rights reserved.\n+ *   All rights reserved.\n+ *\n+ *   Redistribution and use in source and binary forms, with or without\n+ *   modification, are permitted provided that the following conditions\n+ *   are met:\n+ *\n+ *     * Redistributions of source code must retain the above copyright\n+ *       notice, this list of conditions and the following disclaimer.\n+ *     * Redistributions in binary form must reproduce the above copyright\n+ *       notice, this list of conditions and the following disclaimer in\n+ *       the documentation and/or other materials provided with the\n+ *       distribution.\n+ *     * Neither the name of Intel Corporation nor the names of its\n+ *       contributors may be used to endorse or promote products derived\n+ *       from this software without specific prior written permission.\n+ *\n+ *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n+ *   \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n+ *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n+ *   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n+ *   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n+ *   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n+ *   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n+ *   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n+ *   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n+ *   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n+ *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n+ */\n+\n+#include <rte_ethdev.h>\n+#include <rte_ethdev_pci.h>\n+#include <rte_ip.h>\n+#include <rte_jhash.h>\n+#include <rte_security_driver.h>\n+#include <rte_cryptodev.h>\n+#include <rte_flow.h>\n+\n+#include \"base/ixgbe_type.h\"\n+#include \"base/ixgbe_api.h\"\n+#include \"ixgbe_ethdev.h\"\n+#include \"ixgbe_ipsec.h\"\n+\n+#define RTE_IXGBE_REGISTER_POLL_WAIT_5_MS  5\n+\n+#define IXGBE_WAIT_RREAD \\\n+\tIXGBE_WRITE_REG_THEN_POLL_MASK(hw, IXGBE_IPSRXIDX, reg_val, \\\n+\tIPSRXIDX_READ, RTE_IXGBE_REGISTER_POLL_WAIT_5_MS)\n+#define IXGBE_WAIT_RWRITE \\\n+\tIXGBE_WRITE_REG_THEN_POLL_MASK(hw, IXGBE_IPSRXIDX, reg_val, \\\n+\tIPSRXIDX_WRITE, RTE_IXGBE_REGISTER_POLL_WAIT_5_MS)\n+#define IXGBE_WAIT_TREAD \\\n+\tIXGBE_WRITE_REG_THEN_POLL_MASK(hw, IXGBE_IPSTXIDX, reg_val, \\\n+\tIPSRXIDX_READ, RTE_IXGBE_REGISTER_POLL_WAIT_5_MS)\n+#define IXGBE_WAIT_TWRITE \\\n+\tIXGBE_WRITE_REG_THEN_POLL_MASK(hw, IXGBE_IPSTXIDX, reg_val, \\\n+\tIPSRXIDX_WRITE, RTE_IXGBE_REGISTER_POLL_WAIT_5_MS)\n+\n+#define CMP_IP(a, b) (\\\n+\t(a).ipv6[0] == (b).ipv6[0] && \\\n+\t(a).ipv6[1] == (b).ipv6[1] && \\\n+\t(a).ipv6[2] == (b).ipv6[2] && \\\n+\t(a).ipv6[3] == (b).ipv6[3])\n+\n+\n+static void\n+ixgbe_crypto_clear_ipsec_tables(struct rte_eth_dev *dev)\n+{\n+\tstruct ixgbe_hw *hw = IXGBE_DEV_PRIVATE_TO_HW(dev->data->dev_private);\n+\tint i = 0;\n+\n+\t/* clear Rx IP table*/\n+\tfor (i = 0; i < IPSEC_MAX_RX_IP_COUNT; i++) {\n+\t\tuint16_t index = i << 3;\n+\t\tuint32_t reg_val = IPSRXIDX_WRITE | IPSRXIDX_TABLE_IP | index;\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(0), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(1), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(2), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(3), 0);\n+\t\tIXGBE_WAIT_RWRITE;\n+\t}\n+\n+\t/* clear Rx SPI and Rx/Tx SA tables*/\n+\tfor (i = 0; i < IPSEC_MAX_SA_COUNT; i++) {\n+\t\tuint32_t index = i << 3;\n+\t\tuint32_t reg_val = IPSRXIDX_WRITE | IPSRXIDX_TABLE_SPI | index;\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXSPI, 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPIDX, 0);\n+\t\tIXGBE_WAIT_RWRITE;\n+\t\treg_val = IPSRXIDX_WRITE | IPSRXIDX_TABLE_KEY | index;\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXKEY(0), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXKEY(1), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXKEY(2), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXKEY(3), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXSALT, 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXMOD, 0);\n+\t\tIXGBE_WAIT_RWRITE;\n+\t\treg_val = IPSRXIDX_WRITE | index;\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSTXKEY(0), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSTXKEY(1), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSTXKEY(2), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSTXKEY(3), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSTXSALT, 0);\n+\t\tIXGBE_WAIT_TWRITE;\n+\t}\n+}\n+\n+static int\n+ixgbe_crypto_add_sa(struct ixgbe_crypto_session *ic_session)\n+{\n+\tstruct rte_eth_dev *dev = ic_session->dev;\n+\tstruct ixgbe_hw *hw = IXGBE_DEV_PRIVATE_TO_HW(dev->data->dev_private);\n+\tstruct ixgbe_ipsec *priv = IXGBE_DEV_PRIVATE_TO_IPSEC(\n+\t\t\tdev->data->dev_private);\n+\tuint32_t reg_val;\n+\tint sa_index = -1;\n+\n+\tif (ic_session->op == IXGBE_OP_AUTHENTICATED_DECRYPTION) {\n+\t\tint i, ip_index = -1;\n+\n+\t\t/* Find a match in the IP table*/\n+\t\tfor (i = 0; i < IPSEC_MAX_RX_IP_COUNT; i++) {\n+\t\t\tif (CMP_IP(priv->rx_ip_tbl[i].ip,\n+\t\t\t\t   ic_session->dst_ip)) {\n+\t\t\t\tip_index = i;\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n+\t\t/* If no match, find a free entry in the IP table*/\n+\t\tif (ip_index < 0) {\n+\t\t\tfor (i = 0; i < IPSEC_MAX_RX_IP_COUNT; i++) {\n+\t\t\t\tif (priv->rx_ip_tbl[i].ref_count == 0) {\n+\t\t\t\t\tip_index = i;\n+\t\t\t\t\tbreak;\n+\t\t\t\t}\n+\t\t\t}\n+\t\t}\n+\n+\t\t/* Fail if no match and no free entries*/\n+\t\tif (ip_index < 0) {\n+\t\t\tPMD_DRV_LOG(ERR,\n+\t\t\t\t    \"No free entry left in the Rx IP table\\n\");\n+\t\t\treturn -1;\n+\t\t}\n+\n+\t\t/* Find a free entry in the SA table*/\n+\t\tfor (i = 0; i < IPSEC_MAX_SA_COUNT; i++) {\n+\t\t\tif (priv->rx_sa_tbl[i].used == 0) {\n+\t\t\t\tsa_index = i;\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n+\t\t/* Fail if no free entries*/\n+\t\tif (sa_index < 0) {\n+\t\t\tPMD_DRV_LOG(ERR,\n+\t\t\t\t    \"No free entry left in the Rx SA table\\n\");\n+\t\t\treturn -1;\n+\t\t}\n+\n+\t\tpriv->rx_ip_tbl[ip_index].ip.ipv6[0] =\n+\t\t\t\tic_session->dst_ip.ipv6[0];\n+\t\tpriv->rx_ip_tbl[ip_index].ip.ipv6[1] =\n+\t\t\t\tic_session->dst_ip.ipv6[1];\n+\t\tpriv->rx_ip_tbl[ip_index].ip.ipv6[2] =\n+\t\t\t\tic_session->dst_ip.ipv6[2];\n+\t\tpriv->rx_ip_tbl[ip_index].ip.ipv6[3] =\n+\t\t\t\tic_session->dst_ip.ipv6[3];\n+\t\tpriv->rx_ip_tbl[ip_index].ref_count++;\n+\n+\t\tpriv->rx_sa_tbl[sa_index].spi =\n+\t\t\trte_cpu_to_be_32(ic_session->spi);\n+\t\tpriv->rx_sa_tbl[sa_index].ip_index = ip_index;\n+\t\tpriv->rx_sa_tbl[sa_index].key[3] =\n+\t\t\trte_cpu_to_be_32(*(uint32_t *)&ic_session->key[0]);\n+\t\tpriv->rx_sa_tbl[sa_index].key[2] =\n+\t\t\trte_cpu_to_be_32(*(uint32_t *)&ic_session->key[4]);\n+\t\tpriv->rx_sa_tbl[sa_index].key[1] =\n+\t\t\trte_cpu_to_be_32(*(uint32_t *)&ic_session->key[8]);\n+\t\tpriv->rx_sa_tbl[sa_index].key[0] =\n+\t\t\trte_cpu_to_be_32(*(uint32_t *)&ic_session->key[12]);\n+\t\tpriv->rx_sa_tbl[sa_index].salt =\n+\t\t\trte_cpu_to_be_32(ic_session->salt);\n+\t\tpriv->rx_sa_tbl[sa_index].mode = IPSRXMOD_VALID;\n+\t\tif (ic_session->op == IXGBE_OP_AUTHENTICATED_DECRYPTION)\n+\t\t\tpriv->rx_sa_tbl[sa_index].mode |=\n+\t\t\t\t\t(IPSRXMOD_PROTO | IPSRXMOD_DECRYPT);\n+\t\tif (ic_session->dst_ip.type == IPv6)\n+\t\t\tpriv->rx_sa_tbl[sa_index].mode |= IPSRXMOD_IPV6;\n+\t\tpriv->rx_sa_tbl[sa_index].used = 1;\n+\n+\t\t/* write IP table entry*/\n+\t\treg_val = IPSRXIDX_RX_EN | IPSRXIDX_WRITE |\n+\t\t\t\tIPSRXIDX_TABLE_IP | (ip_index << 3);\n+\t\tif (priv->rx_ip_tbl[ip_index].ip.type == IPv4) {\n+\t\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(0), 0);\n+\t\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(1), 0);\n+\t\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(2), 0);\n+\t\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(3),\n+\t\t\t\t\tpriv->rx_ip_tbl[ip_index].ip.ipv4);\n+\t\t} else {\n+\t\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(0),\n+\t\t\t\t\tpriv->rx_ip_tbl[ip_index].ip.ipv6[0]);\n+\t\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(1),\n+\t\t\t\t\tpriv->rx_ip_tbl[ip_index].ip.ipv6[1]);\n+\t\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(2),\n+\t\t\t\t\tpriv->rx_ip_tbl[ip_index].ip.ipv6[2]);\n+\t\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(3),\n+\t\t\t\t\tpriv->rx_ip_tbl[ip_index].ip.ipv6[3]);\n+\t\t}\n+\t\tIXGBE_WAIT_RWRITE;\n+\n+\t\t/* write SPI table entry*/\n+\t\treg_val = IPSRXIDX_RX_EN | IPSRXIDX_WRITE |\n+\t\t\t\tIPSRXIDX_TABLE_SPI | (sa_index << 3);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXSPI,\n+\t\t\t\tpriv->rx_sa_tbl[sa_index].spi);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPIDX,\n+\t\t\t\tpriv->rx_sa_tbl[sa_index].ip_index);\n+\t\tIXGBE_WAIT_RWRITE;\n+\n+\t\t/* write Key table entry*/\n+\t\treg_val = IPSRXIDX_RX_EN | IPSRXIDX_WRITE |\n+\t\t\t\tIPSRXIDX_TABLE_KEY | (sa_index << 3);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXKEY(0),\n+\t\t\t\tpriv->rx_sa_tbl[sa_index].key[0]);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXKEY(1),\n+\t\t\t\tpriv->rx_sa_tbl[sa_index].key[1]);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXKEY(2),\n+\t\t\t\tpriv->rx_sa_tbl[sa_index].key[2]);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXKEY(3),\n+\t\t\t\tpriv->rx_sa_tbl[sa_index].key[3]);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXSALT,\n+\t\t\t\tpriv->rx_sa_tbl[sa_index].salt);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXMOD,\n+\t\t\t\tpriv->rx_sa_tbl[sa_index].mode);\n+\t\tIXGBE_WAIT_RWRITE;\n+\n+\t} else { /* sess->dir == RTE_CRYPTO_OUTBOUND */\n+\t\tint i;\n+\n+\t\t/* Find a free entry in the SA table*/\n+\t\tfor (i = 0; i < IPSEC_MAX_SA_COUNT; i++) {\n+\t\t\tif (priv->tx_sa_tbl[i].used == 0) {\n+\t\t\t\tsa_index = i;\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n+\t\t/* Fail if no free entries*/\n+\t\tif (sa_index < 0) {\n+\t\t\tPMD_DRV_LOG(ERR,\n+\t\t\t\t    \"No free entry left in the Tx SA table\\n\");\n+\t\t\treturn -1;\n+\t\t}\n+\n+\t\tpriv->tx_sa_tbl[sa_index].spi =\n+\t\t\trte_cpu_to_be_32(ic_session->spi);\n+\t\tpriv->tx_sa_tbl[sa_index].key[3] =\n+\t\t\trte_cpu_to_be_32(*(uint32_t *)&ic_session->key[0]);\n+\t\tpriv->tx_sa_tbl[sa_index].key[2] =\n+\t\t\trte_cpu_to_be_32(*(uint32_t *)&ic_session->key[4]);\n+\t\tpriv->tx_sa_tbl[sa_index].key[1] =\n+\t\t\trte_cpu_to_be_32(*(uint32_t *)&ic_session->key[8]);\n+\t\tpriv->tx_sa_tbl[sa_index].key[0] =\n+\t\t\trte_cpu_to_be_32(*(uint32_t *)&ic_session->key[12]);\n+\t\tpriv->tx_sa_tbl[sa_index].salt =\n+\t\t\trte_cpu_to_be_32(ic_session->salt);\n+\n+\t\treg_val = IPSRXIDX_RX_EN | IPSRXIDX_WRITE | (sa_index << 3);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSTXKEY(0),\n+\t\t\t\tpriv->tx_sa_tbl[sa_index].key[0]);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSTXKEY(1),\n+\t\t\t\tpriv->tx_sa_tbl[sa_index].key[1]);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSTXKEY(2),\n+\t\t\t\tpriv->tx_sa_tbl[sa_index].key[2]);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSTXKEY(3),\n+\t\t\t\tpriv->tx_sa_tbl[sa_index].key[3]);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSTXSALT,\n+\t\t\t\tpriv->tx_sa_tbl[sa_index].salt);\n+\t\tIXGBE_WAIT_TWRITE;\n+\n+\t\tpriv->tx_sa_tbl[i].used = 1;\n+\t\tic_session->sa_index = sa_index;\n+\t}\n+\n+\treturn 0;\n+}\n+\n+static int\n+ixgbe_crypto_remove_sa(struct rte_eth_dev *dev,\n+\t\t       struct ixgbe_crypto_session *ic_session)\n+{\n+\tstruct ixgbe_hw *hw = IXGBE_DEV_PRIVATE_TO_HW(dev->data->dev_private);\n+\tstruct ixgbe_ipsec *priv =\n+\t\t\tIXGBE_DEV_PRIVATE_TO_IPSEC(dev->data->dev_private);\n+\tuint32_t reg_val;\n+\tint sa_index = -1;\n+\n+\tif (ic_session->op == IXGBE_OP_AUTHENTICATED_DECRYPTION) {\n+\t\tint i, ip_index = -1;\n+\n+\t\t/* Find a match in the IP table*/\n+\t\tfor (i = 0; i < IPSEC_MAX_RX_IP_COUNT; i++) {\n+\t\t\tif (CMP_IP(priv->rx_ip_tbl[i].ip, ic_session->dst_ip)) {\n+\t\t\t\tip_index = i;\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n+\n+\t\t/* Fail if no match*/\n+\t\tif (ip_index < 0) {\n+\t\t\tPMD_DRV_LOG(ERR,\n+\t\t\t\t    \"Entry not found in the Rx IP table\\n\");\n+\t\t\treturn -1;\n+\t\t}\n+\n+\t\t/* Find a free entry in the SA table*/\n+\t\tfor (i = 0; i < IPSEC_MAX_SA_COUNT; i++) {\n+\t\t\tif (priv->rx_sa_tbl[i].spi ==\n+\t\t\t\t  rte_cpu_to_be_32(ic_session->spi)) {\n+\t\t\t\tsa_index = i;\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n+\t\t/* Fail if no match*/\n+\t\tif (sa_index < 0) {\n+\t\t\tPMD_DRV_LOG(ERR,\n+\t\t\t\t    \"Entry not found in the Rx SA table\\n\");\n+\t\t\treturn -1;\n+\t\t}\n+\n+\t\t/* Disable and clear Rx SPI and key table table entryes*/\n+\t\treg_val = IPSRXIDX_WRITE | IPSRXIDX_TABLE_SPI | (sa_index << 3);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXSPI, 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPIDX, 0);\n+\t\tIXGBE_WAIT_RWRITE;\n+\t\treg_val = IPSRXIDX_WRITE | IPSRXIDX_TABLE_KEY | (sa_index << 3);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXKEY(0), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXKEY(1), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXKEY(2), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXKEY(3), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXSALT, 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXMOD, 0);\n+\t\tIXGBE_WAIT_RWRITE;\n+\t\tpriv->rx_sa_tbl[sa_index].used = 0;\n+\n+\t\t/* If last used then clear the IP table entry*/\n+\t\tpriv->rx_ip_tbl[ip_index].ref_count--;\n+\t\tif (priv->rx_ip_tbl[ip_index].ref_count == 0) {\n+\t\t\treg_val = IPSRXIDX_WRITE | IPSRXIDX_TABLE_IP |\n+\t\t\t\t\t(ip_index << 3);\n+\t\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(0), 0);\n+\t\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(1), 0);\n+\t\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(2), 0);\n+\t\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSRXIPADDR(3), 0);\n+\t\t}\n+\t} else { /* session->dir == RTE_CRYPTO_OUTBOUND */\n+\t\tint i;\n+\n+\t\t/* Find a match in the SA table*/\n+\t\tfor (i = 0; i < IPSEC_MAX_SA_COUNT; i++) {\n+\t\t\tif (priv->tx_sa_tbl[i].spi ==\n+\t\t\t\t    rte_cpu_to_be_32(ic_session->spi)) {\n+\t\t\t\tsa_index = i;\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n+\t\t/* Fail if no match entries*/\n+\t\tif (sa_index < 0) {\n+\t\t\tPMD_DRV_LOG(ERR,\n+\t\t\t\t    \"Entry not found in the Tx SA table\\n\");\n+\t\t\treturn -1;\n+\t\t}\n+\t\treg_val = IPSRXIDX_WRITE | (sa_index << 3);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSTXKEY(0), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSTXKEY(1), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSTXKEY(2), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSTXKEY(3), 0);\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_IPSTXSALT, 0);\n+\t\tIXGBE_WAIT_TWRITE;\n+\n+\t\tpriv->tx_sa_tbl[sa_index].used = 0;\n+\t}\n+\n+\treturn 0;\n+}\n+\n+static int\n+ixgbe_crypto_create_session(void *device,\n+\t\tstruct rte_security_session_conf *conf,\n+\t\tstruct rte_security_session *session,\n+\t\tstruct rte_mempool *mempool)\n+{\n+\tstruct rte_eth_dev *eth_dev = (struct rte_eth_dev *)device;\n+\tstruct ixgbe_crypto_session *ic_session = NULL;\n+\tstruct rte_crypto_aead_xform *aead_xform;\n+\tstruct rte_eth_conf *dev_conf = &eth_dev->data->dev_conf;\n+\n+\tif (rte_mempool_get(mempool, (void **)&ic_session)) {\n+\t\tPMD_DRV_LOG(ERR, \"Cannot get object from ic_session mempool\");\n+\t\treturn -ENOMEM;\n+\t}\n+\n+\tif (conf->crypto_xform->type != RTE_CRYPTO_SYM_XFORM_AEAD ||\n+\t\t\tconf->crypto_xform->aead.algo !=\n+\t\t\t\t\tRTE_CRYPTO_AEAD_AES_GCM) {\n+\t\tPMD_DRV_LOG(ERR, \"Unsupported crypto transformation mode\\n\");\n+\t\treturn -ENOTSUP;\n+\t}\n+\taead_xform = &conf->crypto_xform->aead;\n+\n+\tif (conf->ipsec.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) {\n+\t\tif (dev_conf->rxmode.enable_sec) {\n+\t\t\tic_session->op = IXGBE_OP_AUTHENTICATED_DECRYPTION;\n+\t\t} else {\n+\t\t\tPMD_DRV_LOG(ERR, \"IPsec decryption not enabled\\n\");\n+\t\t\treturn -ENOTSUP;\n+\t\t}\n+\t} else {\n+\t\tif (dev_conf->txmode.enable_sec) {\n+\t\t\tic_session->op = IXGBE_OP_AUTHENTICATED_ENCRYPTION;\n+\t\t} else {\n+\t\t\tPMD_DRV_LOG(ERR, \"IPsec encryption not enabled\\n\");\n+\t\t\treturn -ENOTSUP;\n+\t\t}\n+\t}\n+\n+\tic_session->key = aead_xform->key.data;\n+\tmemcpy(&ic_session->salt,\n+\t       &aead_xform->key.data[aead_xform->key.length], 4);\n+\tic_session->spi = conf->ipsec.spi;\n+\tic_session->dev = eth_dev;\n+\n+\tset_sec_session_private_data(session, ic_session);\n+\n+\tif (ic_session->op == IXGBE_OP_AUTHENTICATED_ENCRYPTION) {\n+\t\tif (ixgbe_crypto_add_sa(ic_session)) {\n+\t\t\tPMD_DRV_LOG(ERR, \"Failed to add SA\\n\");\n+\t\t\treturn -EPERM;\n+\t\t}\n+\t}\n+\n+\treturn 0;\n+}\n+\n+static int\n+ixgbe_crypto_remove_session(void *device,\n+\t\tstruct rte_security_session *session)\n+{\n+\tstruct rte_eth_dev *eth_dev = device;\n+\tstruct ixgbe_crypto_session *ic_session =\n+\t\t(struct ixgbe_crypto_session *)\n+\t\tget_sec_session_private_data(session);\n+\tstruct rte_mempool *mempool = rte_mempool_from_obj(ic_session);\n+\n+\tif (eth_dev != ic_session->dev) {\n+\t\tPMD_DRV_LOG(ERR, \"Session not bound to this device\\n\");\n+\t\treturn -ENODEV;\n+\t}\n+\n+\tif (ixgbe_crypto_remove_sa(eth_dev, ic_session)) {\n+\t\tPMD_DRV_LOG(ERR, \"Failed to remove session\\n\");\n+\t\treturn -EFAULT;\n+\t}\n+\n+\trte_mempool_put(mempool, (void *)ic_session);\n+\n+\treturn 0;\n+}\n+\n+static int\n+ixgbe_crypto_update_mb(void *device __rte_unused,\n+\t\tstruct rte_security_session *session,\n+\t\t       struct rte_mbuf *m, void *params __rte_unused)\n+{\n+\tstruct ixgbe_crypto_session *ic_session =\n+\t\t\tget_sec_session_private_data(session);\n+\tif (ic_session->op == IXGBE_OP_AUTHENTICATED_ENCRYPTION) {\n+\t\tstruct ixgbe_crypto_tx_desc_md *mdata =\n+\t\t\t(struct ixgbe_crypto_tx_desc_md *)&m->udata64;\n+\t\tmdata->enc = 1;\n+\t\tmdata->sa_idx = ic_session->sa_index;\n+\t\tmdata->pad_len = *rte_pktmbuf_mtod_offset(m,\n+\t\t\tuint8_t *, rte_pktmbuf_pkt_len(m) - 18) + 18;\n+\t}\n+\treturn 0;\n+}\n+\n+struct rte_cryptodev_capabilities aes_gmac_crypto_capabilities[] = {\n+\t{\t/* AES GMAC (128-bit) */\n+\t\t.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,\n+\t\t{.sym = {\n+\t\t\t.xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,\n+\t\t\t{.auth = {\n+\t\t\t\t.algo = RTE_CRYPTO_AUTH_AES_GMAC,\n+\t\t\t\t.block_size = 16,\n+\t\t\t\t.key_size = {\n+\t\t\t\t\t.min = 16,\n+\t\t\t\t\t.max = 16,\n+\t\t\t\t\t.increment = 0\n+\t\t\t\t},\n+\t\t\t\t.digest_size = {\n+\t\t\t\t\t.min = 12,\n+\t\t\t\t\t.max = 12,\n+\t\t\t\t\t.increment = 0\n+\t\t\t\t},\n+\t\t\t\t.iv_size = {\n+\t\t\t\t\t.min = 12,\n+\t\t\t\t\t.max = 12,\n+\t\t\t\t\t.increment = 0\n+\t\t\t\t}\n+\t\t\t}, }\n+\t\t}, }\n+\t},\n+\t{\n+\t\t.op = RTE_CRYPTO_OP_TYPE_UNDEFINED,\n+\t\t{.sym = {\n+\t\t\t.xform_type = RTE_CRYPTO_SYM_XFORM_NOT_SPECIFIED\n+\t\t}, }\n+\t},\n+};\n+\n+struct rte_cryptodev_capabilities aes_gcm_gmac_crypto_capabilities[] = {\n+\t{\t/* AES GMAC (128-bit) */\n+\t\t.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,\n+\t\t{.sym = {\n+\t\t\t.xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,\n+\t\t\t{.auth = {\n+\t\t\t\t.algo = RTE_CRYPTO_AUTH_AES_GMAC,\n+\t\t\t\t.block_size = 16,\n+\t\t\t\t.key_size = {\n+\t\t\t\t\t.min = 16,\n+\t\t\t\t\t.max = 16,\n+\t\t\t\t\t.increment = 0\n+\t\t\t\t},\n+\t\t\t\t.digest_size = {\n+\t\t\t\t\t.min = 12,\n+\t\t\t\t\t.max = 12,\n+\t\t\t\t\t.increment = 0\n+\t\t\t\t},\n+\t\t\t\t.iv_size = {\n+\t\t\t\t\t.min = 12,\n+\t\t\t\t\t.max = 12,\n+\t\t\t\t\t.increment = 0\n+\t\t\t\t}\n+\t\t\t}, }\n+\t\t}, }\n+\t},\n+\t{\t/* AES GCM (128-bit) */\n+\t\t.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,\n+\t\t{.sym = {\n+\t\t\t.xform_type = RTE_CRYPTO_SYM_XFORM_AEAD,\n+\t\t\t{.aead = {\n+\t\t\t\t.algo = RTE_CRYPTO_AEAD_AES_GCM,\n+\t\t\t\t.block_size = 16,\n+\t\t\t\t.key_size = {\n+\t\t\t\t\t.min = 16,\n+\t\t\t\t\t.max = 16,\n+\t\t\t\t\t.increment = 0\n+\t\t\t\t},\n+\t\t\t\t.digest_size = {\n+\t\t\t\t\t.min = 8,\n+\t\t\t\t\t.max = 16,\n+\t\t\t\t\t.increment = 4\n+\t\t\t\t},\n+\t\t\t\t.aad_size = {\n+\t\t\t\t\t.min = 0,\n+\t\t\t\t\t.max = 65535,\n+\t\t\t\t\t.increment = 1\n+\t\t\t\t},\n+\t\t\t\t.iv_size = {\n+\t\t\t\t\t.min = 12,\n+\t\t\t\t\t.max = 12,\n+\t\t\t\t\t.increment = 0\n+\t\t\t\t}\n+\t\t\t}, }\n+\t\t}, }\n+\t},\n+\t{\n+\t\t.op = RTE_CRYPTO_OP_TYPE_UNDEFINED,\n+\t\t{.sym = {\n+\t\t\t.xform_type = RTE_CRYPTO_SYM_XFORM_NOT_SPECIFIED\n+\t\t}, }\n+\t},\n+};\n+\n+static const struct rte_security_capability ixgbe_security_capabilities[] = {\n+\t{ /* IPsec Inline Crypto ESP Transport Egress */\n+\t\t.action = RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO,\n+\t\t.protocol = RTE_SECURITY_PROTOCOL_IPSEC,\n+\t\t.ipsec = {\n+\t\t\t.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,\n+\t\t\t.mode = RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT,\n+\t\t\t.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,\n+\t\t\t.options = { 0 }\n+\t\t},\n+\t\t.crypto_capabilities = aes_gcm_gmac_crypto_capabilities,\n+\t\t.ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA\n+\t},\n+\t{ /* IPsec Inline Crypto ESP Transport Ingress */\n+\t\t.action = RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO,\n+\t\t.protocol = RTE_SECURITY_PROTOCOL_IPSEC,\n+\t\t.ipsec = {\n+\t\t\t.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,\n+\t\t\t.mode = RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT,\n+\t\t\t.direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,\n+\t\t\t.options = { 0 }\n+\t\t},\n+\t\t.crypto_capabilities = aes_gcm_gmac_crypto_capabilities,\n+\t\t.ol_flags = 0\n+\t},\n+\t{ /* IPsec Inline Crypto ESP Tunnel Egress */\n+\t\t.action = RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO,\n+\t\t.protocol = RTE_SECURITY_PROTOCOL_IPSEC,\n+\t\t.ipsec = {\n+\t\t\t.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,\n+\t\t\t.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,\n+\t\t\t.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,\n+\t\t\t.options = { 0 }\n+\t\t},\n+\t\t.crypto_capabilities = aes_gcm_gmac_crypto_capabilities,\n+\t\t.ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA\n+\t},\n+\t{ /* IPsec Inline Crypto ESP Tunnel Ingress */\n+\t\t.action = RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO,\n+\t\t.protocol = RTE_SECURITY_PROTOCOL_IPSEC,\n+\t\t.ipsec = {\n+\t\t\t.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,\n+\t\t\t.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,\n+\t\t\t.direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,\n+\t\t\t.options = { 0 }\n+\t\t},\n+\t\t.crypto_capabilities = aes_gcm_gmac_crypto_capabilities,\n+\t\t.ol_flags = 0\n+\t},\n+\t{\n+\t\t.action = RTE_SECURITY_ACTION_TYPE_NONE\n+\t}\n+};\n+\n+static const struct rte_security_capability *\n+ixgbe_crypto_capabilities_get(void *device __rte_unused)\n+{\n+\treturn ixgbe_security_capabilities;\n+}\n+\n+\n+int\n+ixgbe_crypto_enable_ipsec(struct rte_eth_dev *dev)\n+{\n+\tstruct ixgbe_hw *hw = IXGBE_DEV_PRIVATE_TO_HW(dev->data->dev_private);\n+\tuint32_t reg;\n+\n+\t/* sanity checks */\n+\tif (dev->data->dev_conf.rxmode.enable_lro) {\n+\t\tPMD_DRV_LOG(ERR, \"RSC and IPsec not supported\");\n+\t\treturn -1;\n+\t}\n+\tif (!dev->data->dev_conf.rxmode.hw_strip_crc) {\n+\t\tPMD_DRV_LOG(ERR, \"HW CRC strip needs to be enabled for IPsec\");\n+\t\treturn -1;\n+\t}\n+\n+\n+\t/* Set IXGBE_SECTXBUFFAF to 0x15 as required in the datasheet*/\n+\tIXGBE_WRITE_REG(hw, IXGBE_SECTXBUFFAF, 0x15);\n+\n+\t/* IFG needs to be set to 3 when we are using security. Otherwise a Tx\n+\t * hang will occur with heavy traffic.\n+\t */\n+\treg = IXGBE_READ_REG(hw, IXGBE_SECTXMINIFG);\n+\treg = (reg & 0xFFFFFFF0) | 0x3;\n+\tIXGBE_WRITE_REG(hw, IXGBE_SECTXMINIFG, reg);\n+\n+\treg  = IXGBE_READ_REG(hw, IXGBE_HLREG0);\n+\treg |= IXGBE_HLREG0_TXCRCEN | IXGBE_HLREG0_RXCRCSTRP;\n+\tIXGBE_WRITE_REG(hw, IXGBE_HLREG0, reg);\n+\n+\tif (dev->data->dev_conf.rxmode.enable_sec) {\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_SECRXCTRL, 0);\n+\t\treg = IXGBE_READ_REG(hw, IXGBE_SECRXCTRL);\n+\t\tif (reg != 0) {\n+\t\t\tPMD_DRV_LOG(ERR, \"Error enabling Rx Crypto\");\n+\t\t\treturn -1;\n+\t\t}\n+\t}\n+\tif (dev->data->dev_conf.txmode.enable_sec) {\n+\t\tIXGBE_WRITE_REG(hw, IXGBE_SECTXCTRL,\n+\t\t\t\tIXGBE_SECTXCTRL_STORE_FORWARD);\n+\t\treg = IXGBE_READ_REG(hw, IXGBE_SECTXCTRL);\n+\t\tif (reg != IXGBE_SECTXCTRL_STORE_FORWARD) {\n+\t\t\tPMD_DRV_LOG(ERR, \"Error enabling Rx Crypto\");\n+\t\t\treturn -1;\n+\t\t}\n+\t}\n+\n+\tixgbe_crypto_clear_ipsec_tables(dev);\n+\n+\treturn 0;\n+}\n+\n+int\n+ixgbe_crypto_add_ingress_sa_from_flow(const void *sess,\n+\t\t\t\t      const void *ip_spec,\n+\t\t\t\t      uint8_t is_ipv6)\n+{\n+\tstruct ixgbe_crypto_session *ic_session\n+\t\t= get_sec_session_private_data(sess);\n+\n+\tif (ic_session->op == IXGBE_OP_AUTHENTICATED_DECRYPTION) {\n+\t\tif (is_ipv6) {\n+\t\t\tconst struct rte_flow_item_ipv6 *ipv6 = ip_spec;\n+\t\t\tic_session->src_ip.type = IPv6;\n+\t\t\tic_session->dst_ip.type = IPv6;\n+\t\t\trte_memcpy(ic_session->src_ip.ipv6,\n+\t\t\t\t   ipv6->hdr.src_addr, 16);\n+\t\t\trte_memcpy(ic_session->dst_ip.ipv6,\n+\t\t\t\t   ipv6->hdr.dst_addr, 16);\n+\t\t} else {\n+\t\t\tconst struct rte_flow_item_ipv4 *ipv4 = ip_spec;\n+\t\t\tic_session->src_ip.type = IPv4;\n+\t\t\tic_session->dst_ip.type = IPv4;\n+\t\t\tic_session->src_ip.ipv4 = ipv4->hdr.src_addr;\n+\t\t\tic_session->dst_ip.ipv4 = ipv4->hdr.dst_addr;\n+\t\t}\n+\t\treturn ixgbe_crypto_add_sa(ic_session);\n+\t}\n+\n+\treturn 0;\n+}\n+\n+\n+struct rte_security_ops ixgbe_security_ops = {\n+\t.session_create = ixgbe_crypto_create_session,\n+\t.session_update = NULL,\n+\t.session_stats_get = NULL,\n+\t.session_destroy = ixgbe_crypto_remove_session,\n+\n+\t.set_pkt_metadata = ixgbe_crypto_update_mb,\n+\n+\t.capabilities_get = ixgbe_crypto_capabilities_get\n+};\ndiff --git a/drivers/net/ixgbe/ixgbe_ipsec.h b/drivers/net/ixgbe/ixgbe_ipsec.h\nnew file mode 100644\nindex 0000000..9f06235\n--- /dev/null\n+++ b/drivers/net/ixgbe/ixgbe_ipsec.h\n@@ -0,0 +1,147 @@\n+/*-\n+ *   BSD LICENSE\n+ *\n+ *   Copyright(c) 2010-2017 Intel Corporation. All rights reserved.\n+ *   All rights reserved.\n+ *\n+ *   Redistribution and use in source and binary forms, with or without\n+ *   modification, are permitted provided that the following conditions\n+ *   are met:\n+ *\n+ *     * Redistributions of source code must retain the above copyright\n+ *       notice, this list of conditions and the following disclaimer.\n+ *     * Redistributions in binary form must reproduce the above copyright\n+ *       notice, this list of conditions and the following disclaimer in\n+ *       the documentation and/or other materials provided with the\n+ *       distribution.\n+ *     * Neither the name of Intel Corporation nor the names of its\n+ *       contributors may be used to endorse or promote products derived\n+ *       from this software without specific prior written permission.\n+ *\n+ *   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n+ *   \"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\n+ *   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\n+ *   A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\n+ *   OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\n+ *   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\n+ *   LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n+ *   DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\n+ *   THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n+ *   (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n+ *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n+ */\n+\n+#ifndef IXGBE_IPSEC_H_\n+#define IXGBE_IPSEC_H_\n+\n+#include <rte_security.h>\n+\n+#define IPSRXIDX_RX_EN                                    0x00000001\n+#define IPSRXIDX_TABLE_IP                                 0x00000002\n+#define IPSRXIDX_TABLE_SPI                                0x00000004\n+#define IPSRXIDX_TABLE_KEY                                0x00000006\n+#define IPSRXIDX_WRITE                                    0x80000000\n+#define IPSRXIDX_READ                                     0x40000000\n+#define IPSRXMOD_VALID                                    0x00000001\n+#define IPSRXMOD_PROTO                                    0x00000004\n+#define IPSRXMOD_DECRYPT                                  0x00000008\n+#define IPSRXMOD_IPV6                                     0x00000010\n+#define IXGBE_ADVTXD_POPTS_IPSEC                          0x00000400\n+#define IXGBE_ADVTXD_TUCMD_IPSEC_TYPE_ESP                 0x00002000\n+#define IXGBE_ADVTXD_TUCMD_IPSEC_ENCRYPT_EN               0x00004000\n+#define IXGBE_RXDADV_IPSEC_STATUS_SECP                    0x00020000\n+#define IXGBE_RXDADV_IPSEC_ERROR_BIT_MASK                 0x18000000\n+#define IXGBE_RXDADV_IPSEC_ERROR_INVALID_PROTOCOL         0x08000000\n+#define IXGBE_RXDADV_IPSEC_ERROR_INVALID_LENGTH           0x10000000\n+#define IXGBE_RXDADV_IPSEC_ERROR_AUTHENTICATION_FAILED    0x18000000\n+\n+#define IPSEC_MAX_RX_IP_COUNT           128\n+#define IPSEC_MAX_SA_COUNT              1024\n+\n+enum ixgbe_operation {\n+\tIXGBE_OP_AUTHENTICATED_ENCRYPTION,\n+\tIXGBE_OP_AUTHENTICATED_DECRYPTION\n+};\n+\n+enum ixgbe_gcm_key {\n+\tIXGBE_GCM_KEY_128,\n+\tIXGBE_GCM_KEY_256\n+};\n+\n+/**\n+ * Generic IP address structure\n+ * TODO: Find better location for this rte_net.h possibly.\n+ **/\n+struct ipaddr {\n+\tenum ipaddr_type {\n+\t\tIPv4,\n+\t\tIPv6\n+\t} type;\n+\t/**< IP Address Type - IPv4/IPv6 */\n+\n+\tunion {\n+\t\tuint32_t ipv4;\n+\t\tuint32_t ipv6[4];\n+\t};\n+};\n+\n+/** inline crypto crypto private session structure */\n+struct ixgbe_crypto_session {\n+\tenum ixgbe_operation op;\n+\tuint8_t *key;\n+\tuint32_t salt;\n+\tuint32_t sa_index;\n+\tuint32_t spi;\n+\tstruct ipaddr src_ip;\n+\tstruct ipaddr dst_ip;\n+\tstruct rte_eth_dev *dev;\n+} __rte_cache_aligned;\n+\n+struct ixgbe_crypto_rx_ip_table {\n+\tstruct ipaddr ip;\n+\tuint16_t ref_count;\n+};\n+struct ixgbe_crypto_rx_sa_table {\n+\tuint32_t spi;\n+\tuint32_t ip_index;\n+\tuint32_t key[4];\n+\tuint32_t salt;\n+\tuint8_t  mode;\n+\tuint8_t  used;\n+};\n+\n+struct ixgbe_crypto_tx_sa_table {\n+\tuint32_t spi;\n+\tuint32_t key[4];\n+\tuint32_t salt;\n+\tuint8_t  used;\n+};\n+\n+struct ixgbe_crypto_tx_desc_md {\n+\tunion {\n+\t\tuint64_t data;\n+\t\tstruct {\n+\t\t\t  uint32_t sa_idx;\n+\t\t\t  uint8_t pad_len;\n+\t\t\t  uint8_t enc;\n+\t\t};\n+\t};\n+};\n+\n+struct ixgbe_ipsec {\n+\tstruct ixgbe_crypto_rx_ip_table rx_ip_tbl[IPSEC_MAX_RX_IP_COUNT];\n+\tstruct ixgbe_crypto_rx_sa_table rx_sa_tbl[IPSEC_MAX_SA_COUNT];\n+\tstruct ixgbe_crypto_tx_sa_table tx_sa_tbl[IPSEC_MAX_SA_COUNT];\n+};\n+\n+extern struct rte_security_ops ixgbe_security_ops;\n+\n+\n+int ixgbe_crypto_enable_ipsec(struct rte_eth_dev *dev);\n+int ixgbe_crypto_add_ingress_sa_from_flow(const void *sess,\n+\t\t\t\t\t  const void *ip_spec,\n+\t\t\t\t\t  uint8_t is_ipv6);\n+\n+\n+\n+#endif /*IXGBE_IPSEC_H_*/\ndiff --git a/drivers/net/ixgbe/ixgbe_rxtx.c b/drivers/net/ixgbe/ixgbe_rxtx.c\nindex 0038dfb..279e3fa 100644\n--- a/drivers/net/ixgbe/ixgbe_rxtx.c\n+++ b/drivers/net/ixgbe/ixgbe_rxtx.c\n@@ -93,6 +93,7 @@\n \t\tPKT_TX_TCP_SEG |\t\t \\\n \t\tPKT_TX_MACSEC |\t\t\t \\\n \t\tPKT_TX_OUTER_IP_CKSUM |\t\t \\\n+\t\tPKT_TX_SEC_OFFLOAD |\t \\\n \t\tIXGBE_TX_IEEE1588_TMST)\n \n #define IXGBE_TX_OFFLOAD_NOTSUP_MASK \\\n@@ -395,7 +396,8 @@ ixgbe_xmit_pkts_vec(void *tx_queue, struct rte_mbuf **tx_pkts,\n static inline void\n ixgbe_set_xmit_ctx(struct ixgbe_tx_queue *txq,\n \t\tvolatile struct ixgbe_adv_tx_context_desc *ctx_txd,\n-\t\tuint64_t ol_flags, union ixgbe_tx_offload tx_offload)\n+\t\tuint64_t ol_flags, union ixgbe_tx_offload tx_offload,\n+\t\tstruct rte_mbuf *mb)\n {\n \tuint32_t type_tucmd_mlhl;\n \tuint32_t mss_l4len_idx = 0;\n@@ -479,6 +481,18 @@ ixgbe_set_xmit_ctx(struct ixgbe_tx_queue *txq,\n \t\tseqnum_seed |= tx_offload.l2_len\n \t\t\t       << IXGBE_ADVTXD_TUNNEL_LEN;\n \t}\n+\tif (mb->ol_flags & PKT_TX_SEC_OFFLOAD) {\n+\t\tstruct ixgbe_crypto_tx_desc_md *mdata =\n+\t\t\t\t(struct ixgbe_crypto_tx_desc_md *)\n+\t\t\t\t&mb->udata64;\n+\t\tseqnum_seed |=\n+\t\t\t(IXGBE_ADVTXD_IPSEC_SA_INDEX_MASK & mdata->sa_idx);\n+\t\ttype_tucmd_mlhl |= mdata->enc ?\n+\t\t\t\t(IXGBE_ADVTXD_TUCMD_IPSEC_TYPE_ESP |\n+\t\t\t\tIXGBE_ADVTXD_TUCMD_IPSEC_ENCRYPT_EN) : 0;\n+\t\ttype_tucmd_mlhl |=\n+\t\t\t(mdata->pad_len & IXGBE_ADVTXD_IPSEC_ESP_LEN_MASK);\n+\t}\n \n \ttxq->ctx_cache[ctx_idx].flags = ol_flags;\n \ttxq->ctx_cache[ctx_idx].tx_offload.data[0]  =\n@@ -657,6 +671,7 @@ ixgbe_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,\n \tuint32_t ctx = 0;\n \tuint32_t new_ctx;\n \tunion ixgbe_tx_offload tx_offload;\n+\tuint8_t use_ipsec;\n \n \ttx_offload.data[0] = 0;\n \ttx_offload.data[1] = 0;\n@@ -684,6 +699,7 @@ ixgbe_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,\n \t\t * are needed for offload functionality.\n \t\t */\n \t\tol_flags = tx_pkt->ol_flags;\n+\t\tuse_ipsec = txq->using_ipsec && (ol_flags & PKT_TX_SEC_OFFLOAD);\n \n \t\t/* If hardware offload required */\n \t\ttx_ol_req = ol_flags & IXGBE_TX_OFFLOAD_MASK;\n@@ -695,6 +711,13 @@ ixgbe_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,\n \t\t\ttx_offload.tso_segsz = tx_pkt->tso_segsz;\n \t\t\ttx_offload.outer_l2_len = tx_pkt->outer_l2_len;\n \t\t\ttx_offload.outer_l3_len = tx_pkt->outer_l3_len;\n+\t\t\tif (use_ipsec) {\n+\t\t\t\tstruct ixgbe_crypto_tx_desc_md *ipsec_mdata =\n+\t\t\t\t\t(struct ixgbe_crypto_tx_desc_md *)\n+\t\t\t\t\t\t\t&tx_pkt->udata64;\n+\t\t\t\ttx_offload.sa_idx = ipsec_mdata->sa_idx;\n+\t\t\t\ttx_offload.sec_pad_len = ipsec_mdata->pad_len;\n+\t\t\t}\n \n \t\t\t/* If new context need be built or reuse the exist ctx. */\n \t\t\tctx = what_advctx_update(txq, tx_ol_req,\n@@ -855,7 +878,7 @@ ixgbe_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,\n \t\t\t\t}\n \n \t\t\t\tixgbe_set_xmit_ctx(txq, ctx_txd, tx_ol_req,\n-\t\t\t\t\ttx_offload);\n+\t\t\t\t\ttx_offload, tx_pkt);\n \n \t\t\t\ttxe->last_id = tx_last;\n \t\t\t\ttx_id = txe->next_id;\n@@ -873,6 +896,8 @@ ixgbe_xmit_pkts(void *tx_queue, struct rte_mbuf **tx_pkts,\n \t\t}\n \n \t\tolinfo_status |= (pkt_len << IXGBE_ADVTXD_PAYLEN_SHIFT);\n+\t\tif (use_ipsec)\n+\t\t\tolinfo_status |= IXGBE_ADVTXD_POPTS_IPSEC;\n \n \t\tm_seg = tx_pkt;\n \t\tdo {\n@@ -1447,6 +1472,12 @@ rx_desc_error_to_pkt_flags(uint32_t rx_status)\n \t\tpkt_flags |= PKT_RX_EIP_CKSUM_BAD;\n \t}\n \n+\tif (rx_status & IXGBE_RXD_STAT_SECP) {\n+\t\tpkt_flags |= PKT_RX_SEC_OFFLOAD;\n+\t\tif (rx_status & IXGBE_RXDADV_LNKSEC_ERROR_BAD_SIG)\n+\t\t\tpkt_flags |= PKT_RX_SEC_OFFLOAD_FAILED;\n+\t}\n+\n \treturn pkt_flags;\n }\n \n@@ -2364,8 +2395,9 @@ void __attribute__((cold))\n ixgbe_set_tx_function(struct rte_eth_dev *dev, struct ixgbe_tx_queue *txq)\n {\n \t/* Use a simple Tx queue (no offloads, no multi segs) if possible */\n-\tif (((txq->txq_flags & IXGBE_SIMPLE_FLAGS) == IXGBE_SIMPLE_FLAGS)\n-\t\t\t&& (txq->tx_rs_thresh >= RTE_PMD_IXGBE_TX_MAX_BURST)) {\n+\tif (((txq->txq_flags & IXGBE_SIMPLE_FLAGS) == IXGBE_SIMPLE_FLAGS) &&\n+\t\t\t(txq->tx_rs_thresh >= RTE_PMD_IXGBE_TX_MAX_BURST) &&\n+\t\t\t!(dev->data->dev_conf.txmode.enable_sec)) {\n \t\tPMD_INIT_LOG(DEBUG, \"Using simple tx code path\");\n \t\tdev->tx_pkt_prepare = NULL;\n #ifdef RTE_IXGBE_INC_VECTOR\n@@ -2535,6 +2567,7 @@ ixgbe_dev_tx_queue_setup(struct rte_eth_dev *dev,\n \ttxq->txq_flags = tx_conf->txq_flags;\n \ttxq->ops = &def_txq_ops;\n \ttxq->tx_deferred_start = tx_conf->tx_deferred_start;\n+\ttxq->using_ipsec = dev->data->dev_conf.txmode.enable_sec;\n \n \t/*\n \t * Modification to set VFTDT for virtual function if vf is detected\n@@ -4519,6 +4552,7 @@ ixgbe_set_rx_function(struct rte_eth_dev *dev)\n \t\tstruct ixgbe_rx_queue *rxq = dev->data->rx_queues[i];\n \n \t\trxq->rx_using_sse = rx_using_sse;\n+\t\trxq->using_ipsec = dev->data->dev_conf.rxmode.enable_sec;\n \t}\n }\n \n@@ -5006,6 +5040,17 @@ ixgbe_dev_rxtx_start(struct rte_eth_dev *dev)\n \t\t\tdev->data->dev_conf.lpbk_mode == IXGBE_LPBK_82599_TX_RX)\n \t\tixgbe_setup_loopback_link_82599(hw);\n \n+\tif (dev->data->dev_conf.rxmode.enable_sec ||\n+\t\t\tdev->data->dev_conf.txmode.enable_sec) {\n+\t\tret = ixgbe_crypto_enable_ipsec(dev);\n+\t\tif (ret != 0) {\n+\t\t\tPMD_DRV_LOG(ERR,\n+\t\t\t\t    \"ixgbe_crypto_enable_ipsec fails with %d.\",\n+\t\t\t\t    ret);\n+\t\t\treturn ret;\n+\t\t}\n+\t}\n+\n \treturn 0;\n }\n \ndiff --git a/drivers/net/ixgbe/ixgbe_rxtx.h b/drivers/net/ixgbe/ixgbe_rxtx.h\nindex 81c527f..4017831 100644\n--- a/drivers/net/ixgbe/ixgbe_rxtx.h\n+++ b/drivers/net/ixgbe/ixgbe_rxtx.h\n@@ -138,8 +138,10 @@ struct ixgbe_rx_queue {\n \tuint16_t rx_nb_avail; /**< nr of staged pkts ready to ret to app */\n \tuint16_t rx_next_avail; /**< idx of next staged pkt to ret to app */\n \tuint16_t rx_free_trigger; /**< triggers rx buffer allocation */\n-\tuint16_t            rx_using_sse;\n+\tuint8_t            rx_using_sse;\n \t/**< indicates that vector RX is in use */\n+\tuint8_t            using_ipsec;\n+\t/**< indicates that IPsec RX feature is in use */\n #ifdef RTE_IXGBE_INC_VECTOR\n \tuint16_t            rxrearm_nb;     /**< number of remaining to be re-armed */\n \tuint16_t            rxrearm_start;  /**< the idx we start the re-arming from */\n@@ -183,6 +185,10 @@ union ixgbe_tx_offload {\n \t\t/* fields for TX offloading of tunnels */\n \t\tuint64_t outer_l3_len:8; /**< Outer L3 (IP) Hdr Length. */\n \t\tuint64_t outer_l2_len:8; /**< Outer L2 (MAC) Hdr Length. */\n+\n+\t\t/* inline ipsec related*/\n+\t\tuint64_t sa_idx:8;\t/**< TX SA database entry index */\n+\t\tuint64_t sec_pad_len:4;\t/**< padding length */\n \t};\n };\n \n@@ -247,6 +253,9 @@ struct ixgbe_tx_queue {\n \tstruct ixgbe_advctx_info ctx_cache[IXGBE_CTX_NUM];\n \tconst struct ixgbe_txq_ops *ops;       /**< txq ops */\n \tuint8_t             tx_deferred_start; /**< not in global dev start. */\n+\tuint8_t\t\t    using_ipsec;\n+\t/**< indicates that IPsec TX feature is in use */\n+\n };\n \n struct ixgbe_txq_ops {\ndiff --git a/drivers/net/ixgbe/ixgbe_rxtx_vec_sse.c b/drivers/net/ixgbe/ixgbe_rxtx_vec_sse.c\nindex e704a7f..c9b1e2e 100644\n--- a/drivers/net/ixgbe/ixgbe_rxtx_vec_sse.c\n+++ b/drivers/net/ixgbe/ixgbe_rxtx_vec_sse.c\n@@ -124,10 +124,12 @@ ixgbe_rxq_rearm(struct ixgbe_rx_queue *rxq)\n \n static inline void\n desc_to_olflags_v(__m128i descs[4], __m128i mbuf_init, uint8_t vlan_flags,\n-\tstruct rte_mbuf **rx_pkts)\n+\tstruct rte_mbuf **rx_pkts, uint8_t use_ipsec)\n {\n \t__m128i ptype0, ptype1, vtag0, vtag1, csum;\n \t__m128i rearm0, rearm1, rearm2, rearm3;\n+\t__m128i sterr0, sterr1, sterr2, sterr3;\n+\t__m128i tmp1, tmp2, tmp3, tmp4;\n \n \t/* mask everything except rss type */\n \tconst __m128i rsstype_msk = _mm_set_epi16(\n@@ -174,6 +176,41 @@ desc_to_olflags_v(__m128i descs[4], __m128i mbuf_init, uint8_t vlan_flags,\n \t\t0, PKT_RX_L4_CKSUM_GOOD >> sizeof(uint8_t), 0,\n \t\tPKT_RX_L4_CKSUM_GOOD >> sizeof(uint8_t));\n \n+\tconst __m128i ipsec_sterr_msk = _mm_set_epi32(\n+\t\t0, IXGBE_RXDADV_IPSEC_STATUS_SECP |\n+\t\t\tIXGBE_RXDADV_IPSEC_ERROR_AUTH_FAILED,\n+\t\t0, 0);\n+\tconst __m128i ipsec_proc_msk  = _mm_set_epi32(\n+\t\t0, IXGBE_RXDADV_IPSEC_STATUS_SECP, 0, 0);\n+\tconst __m128i ipsec_err_flag  = _mm_set_epi32(\n+\t\t0, PKT_RX_SEC_OFFLOAD_FAILED | PKT_RX_SEC_OFFLOAD,\n+\t\t0, 0);\n+\tconst __m128i ipsec_proc_flag = _mm_set_epi32(\n+\t\t0, PKT_RX_SEC_OFFLOAD, 0, 0);\n+\n+\tif (use_ipsec) {\n+\t\tsterr0 = _mm_and_si128(descs[0], ipsec_sterr_msk);\n+\t\tsterr1 = _mm_and_si128(descs[1], ipsec_sterr_msk);\n+\t\tsterr2 = _mm_and_si128(descs[2], ipsec_sterr_msk);\n+\t\tsterr3 = _mm_and_si128(descs[3], ipsec_sterr_msk);\n+\t\ttmp1 = _mm_cmpeq_epi32(sterr0, ipsec_sterr_msk);\n+\t\ttmp2 = _mm_cmpeq_epi32(sterr0, ipsec_proc_msk);\n+\t\ttmp3 = _mm_cmpeq_epi32(sterr1, ipsec_sterr_msk);\n+\t\ttmp4 = _mm_cmpeq_epi32(sterr1, ipsec_proc_msk);\n+\t\tsterr0 = _mm_or_si128(_mm_and_si128(tmp1, ipsec_err_flag),\n+\t\t\t\t\t_mm_and_si128(tmp2, ipsec_proc_flag));\n+\t\tsterr1 = _mm_or_si128(_mm_and_si128(tmp3, ipsec_err_flag),\n+\t\t\t\t\t_mm_and_si128(tmp4, ipsec_proc_flag));\n+\t\ttmp1 = _mm_cmpeq_epi32(sterr2, ipsec_sterr_msk);\n+\t\ttmp2 = _mm_cmpeq_epi32(sterr2, ipsec_proc_msk);\n+\t\ttmp3 = _mm_cmpeq_epi32(sterr3, ipsec_sterr_msk);\n+\t\ttmp4 = _mm_cmpeq_epi32(sterr3, ipsec_proc_msk);\n+\t\tsterr2 = _mm_or_si128(_mm_and_si128(tmp1, ipsec_err_flag),\n+\t\t\t\t\t_mm_and_si128(tmp2, ipsec_proc_flag));\n+\t\tsterr3 = _mm_or_si128(_mm_and_si128(tmp3, ipsec_err_flag),\n+\t\t\t\t\t_mm_and_si128(tmp4, ipsec_proc_flag));\n+\t}\n+\n \tptype0 = _mm_unpacklo_epi16(descs[0], descs[1]);\n \tptype1 = _mm_unpacklo_epi16(descs[2], descs[3]);\n \tvtag0 = _mm_unpackhi_epi16(descs[0], descs[1]);\n@@ -221,6 +258,13 @@ desc_to_olflags_v(__m128i descs[4], __m128i mbuf_init, uint8_t vlan_flags,\n \trearm2 = _mm_blend_epi16(mbuf_init, _mm_slli_si128(vtag1, 4), 0x10);\n \trearm3 = _mm_blend_epi16(mbuf_init, _mm_slli_si128(vtag1, 2), 0x10);\n \n+\tif (use_ipsec) {\n+\t\trearm0 = _mm_or_si128(rearm0, sterr0);\n+\t\trearm1 = _mm_or_si128(rearm1, sterr1);\n+\t\trearm2 = _mm_or_si128(rearm2, sterr2);\n+\t\trearm3 = _mm_or_si128(rearm3, sterr3);\n+\t}\n+\n \t/* write the rearm data and the olflags in one write */\n \tRTE_BUILD_BUG_ON(offsetof(struct rte_mbuf, ol_flags) !=\n \t\t\toffsetof(struct rte_mbuf, rearm_data) + 8);\n@@ -310,6 +354,7 @@ _recv_raw_pkts_vec(struct ixgbe_rx_queue *rxq, struct rte_mbuf **rx_pkts,\n \tvolatile union ixgbe_adv_rx_desc *rxdp;\n \tstruct ixgbe_rx_entry *sw_ring;\n \tuint16_t nb_pkts_recd;\n+\tuint8_t use_ipsec = rxq->using_ipsec;\n \tint pos;\n \tuint64_t var;\n \t__m128i shuf_msk;\n@@ -471,7 +516,8 @@ _recv_raw_pkts_vec(struct ixgbe_rx_queue *rxq, struct rte_mbuf **rx_pkts,\n \t\tsterr_tmp1 = _mm_unpackhi_epi32(descs[1], descs[0]);\n \n \t\t/* set ol_flags with vlan packet type */\n-\t\tdesc_to_olflags_v(descs, mbuf_init, vlan_flags, &rx_pkts[pos]);\n+\t\tdesc_to_olflags_v(descs, mbuf_init, vlan_flags,\n+\t\t\t\t  &rx_pkts[pos], use_ipsec);\n \n \t\t/* D.2 pkt 3,4 set in_port/nb_seg and remove crc */\n \t\tpkt_mb4 = _mm_add_epi16(pkt_mb4, crc_adjust);\n",
    "prefixes": [
        "dpdk-dev",
        "v4",
        "10/12"
    ]
}