Cannot configure IPsec full offload in Cx-7

Infrastructure & Networking DOCA Enterprise Networking
,
1

Hello, I’m trying to Configure IPsec full offload following the official documentations. Here is my system config:

uname -r
6.8.0-79-generic

sudo ethtool -k enp23s0np0|egrep “esp”
tx-esp-segmentation: on
esp-hw-offload: on [fixed]
esp-tx-csum-hw-offload: on [fixed]

cat /boot/config-uname -r| egrep -i “CONFIG_XFRM_OFFLOAD|CONFIG_INET_ESP_OFFLOAD|CONFIG_INET6_ESP_OFFLOAD|MLX5_EN_IPSEC”CONFIG_XFRM_OFFLOAD=y
CONFIG_INET_ESP_OFFLOAD=m
CONFIG_INET6_ESP_OFFLOAD=m
CONFIG_MLX5_EN_IPSEC=y

/opt/mellanox/iproute2/sbin/ip xfrm state help 2>&1|grep offload
        [ offload [ crypto | packet ] dev DEV dir DIR ]

But when I try to add the xfrm state, I get this error:

/opt/mellanox/iproute2/sbin/ip xfrm state add src 192.168.1.64/24 dst 192.168.1.65/24 proto esp spi 0x4834535d reqid 0x4834535d mode transport aead 'rfc4106(gcm(aes))' 0xc57f6f084ebf8c6a71dd9a053c2e03b94c658a9bf00dd25780e73948931d10d08058a27c 128 offload packet dev enp23s0np0 dir out sel src 192.168.1.64 dst 192.168.1.65
Error: Attribute failed policy validation.

dmesg |tail -n1
[69358.006743] netlink: 'ip': attribute type 33 has an invalid length.

Am I missing something?

2

Hi @virtnet,

I’m not sure which steps you followed to configure IPSec full offload, but please note that on ConnectX-7 it is supported only in DMFS mode.

Kindly refer to the MLNX_OFED documentation:
https://docs.nvidia.com/networking/display/mlnxofedv24103250lts/ipsec+packet+offload

Example configuration steps:

echo 1 > /sys/class/net/$PF0/device/sriov_numvfs
echo 0000:08:00.2 > /sys/bus/pci/drivers/mlx5_core/unbind
devlink dev param set pci/0000:08:00.0 name flow_steering_mode value dmfs cmode runtime
devlink dev eswitch set pci/0000:08:00.0 mode switchdev
devlink port function set pci/0000:08:00.0/1 ipsec_packet enable
echo 0000:08:00.2 > /sys/bus/pci/drivers/mlx5_core/bind

Regards,
Chen

3

Thank you @chenh1 .

I was finally able to configure IPsec offload for RoCEv2 traffic on PF device.

On DMFS requirement, I was able to offload even without DMFS mode. In the below screenshot, left device has SMFS and right has DMFS. Could you please clarify if DMFS is a requirement even if I’m using PF device (no SRIOV)?

rocev2-ipsec
rocev2-ipsec1920×434 157 KB