Having trouble with decryption IPSEC packet on Security Accelerator

Yakup

I would like to understand your system better.  I assume (correct me if I am wrong) that you want to send and receive encrypted messages not through the PA, like point to point direct interface.  The more you tell me about your application the better I can advise you.

To answer your question. IPSEC mode was design with PA in mind.  I think that you can use IPSEC mode without the PA but you have to be careful that the descriptors' format and data that you build will be identical to what the PA builds and send to the SA for processing. And the TX and RX format is not necessary the same format. 

The DATA_MODE was design for your case.  Look at the examples in the release.  I think that you need two channels for the DATA_MODE, one for TX and one for RX and you have to compare the authentication manually in the application.

Does it make sense?

Ran

The reason why you do not see much information about the RX format is because the descriptor is built by the PA and not by software so "there was no need to describe how to build it"

I will do some research to find where the RX descriptor format is explained, but it might take me a day or two.

Best Regards

Ran

More information from the expert in engineering:

Please find the descriptor that needs to be built by host instead of PA (if PA is not in the path) for the Rx Side as below. I have provided the Tx Side also for completeness. Fundamentally, the descriptor needs to be updated as below:

On the Tx Side:

1. After the channel is created, call the SA LLD API to perform the protocol specific operations using Sa_chanSendData (Sa_ChanHandle, Sa_PktInfo_t*, flag_to_indicate_force_non_encryption)
   1. This would return the swInfo for that channel, that needs to be filled in the Host Descriptor’s SwInfo0 and SwInfo1 fields using Cppi_setSoftwareInfo API
   2. Prepare the PS information command, psInfo (8 byte long, where second word can be zeros) as “psInfo[0] = PASAHO_SINFO_FORMAT_CMD(payloadOffset, payloadLen);”

                                                               i.      Note: #define PASAHO_SINFO_FORMAT_CMD(offset, len)   (((offset) << 16) | (len) | (PASAHO_SA_SHORT_INFO << 29))   where PASAHO_SA_SHORT_INFO = 1

1. Set the 8 byte PS Data in the descriptor as Cppi_setPSData (Cppi_DescType_HOST, (Cppi_Desc *)hd, (uint8_t *)psInfo, 8);

On the Rx Side:

1.            Get the associated SwInfo for that Channel and update the descriptor with the corresponding SwInfo0 and SwInfo1 for the packet in that channel of interest to be decrypted.

      - SwInfo0 and SwInfo1 for that channel can be obtained from the information SA LLD provided to application during Channel registration process, SA LLD has below call out function that is implemented in Application.

/**

*  @brief  Callout to externally supplied system to register the security channel with its software

*  routing information to be programmed into the PASS lookup table in the from-Network direction.

 *  It may be triggered by the Sa_chanControl(), Sa_chanSendData() and Sa_chanReceiveData() APIs.

*  This is a function pointer and must point to a valid function which meets the API requirements.

*

*  @param[in]   handle       SALLD channel instance identifier.

*  @param[in]   chanSwInfo   Pointer to SALLD software routing information structure.

*

*  @sa Sa_SWInfo_t

*

*/

   void (*ChanRegister) (Sa_ChanHandle handle, Sa_SWInfo_t* chanSwInfo);

 2.           Set the 24 byte PS data information in the descriptor as below.

Construct 6 32-bit word (24-byte) PS data as below.

Uint32_t Word0                = start_offset;

Uint32_t Word1                = end_offset << 16;

Uint32_t Word2                = esp_ah_offset;

Uint32_t Word3                = Word4 = Word5 = 0;

Where esp_ah_offset is offset_to_ESP_header and Start Offset is offset_to_ESP_header + 8, end_offset is offset to end of Ip payload.

Ran