[dpdk-users] Issue with IPsec Security Gateway sample application (on VM) at 1Gbps traffic

[Sergio Gonzalez Monroy]

Hi Chinmaya,

What DPDK version are you using? Does it happen with latest DPDK 16.07?

On 11/08/2016 09:26, Chinmaya Dwibedy wrote:
> Hi,
>
>
> I changed the classify algorithm to RTE_ACL_CLASSIFY_SCALAR via
> rte_acl_set_ctx_classify() . Did not find the aforesaid crash issue. How
> does DPDK decide the classify method for the given platform (default) at
> startup ACL library?  Furthermore how to know which classify method it has
> chosen?

My understanding is that SCALAR should be the default unless you change it.
That can be done by manually setting it or doing rte_acl_init();

Sergio

>
> The VM where I am running the dpdk application supports SSE/ AVX
> instructions set. They why it gets crashed during rte_acl_classify () with
> 1000 Mbps traffic and 100 IPsec tunnels.
>
>
> Thank you in advance for support and time.
>
>
> [root at vpn-server ipsec-secgw]# grep -o sse /proc/cpuinfo
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> sse
>
> [root at vpn-server ipsec-secgw]# grep -o avx /proc/cpuinfo
>
> avx
>
> avx
>
> avx
>
> avx
>
> avx
>
> avx
>
> avx
>
> avx
>
> [root at vpn-server ipsec-secgw]#
>
>
>
> Regards,
>
> Chinmaya
>
> On Wed, Aug 10, 2016 at 7:22 PM, Chinmaya Dwibedy <ckdwibedy at gmail.com>
> wrote:
>
>> Hi ,
>>
>>
>> I am running the IPsec Security Gateway application ( at
>> http://dpdk.org/browse/dpdk/tree/examples/ipsec-secgw) on two VMs.  It
>> uses AESNI crypto device.
>>
>>
>> Modified this application to add the Security Associations (SA) as ACL
>> rules like Security Policies (SP). I have added 100 entries of SP and SA. I
>> am also able to send the UDP traffic (one packet) in each of these tunnels.
>> But while sending 1 Gbs traffic (distributed through 100 tunnels) , it is
>> getting crashed . Here is the core dump
>>
>>
>>
>> Core was generated by `./build/ipsec-secgw -l 0 -n 4 --pci-blacklist
>> 0000:00:04.0 -- -p 0x3 --config=('.
>>
>> Program terminated with signal SIGSEGV, Segmentation fault.
>>
>> #0  0x000000000047d8c5 in search_avx2x16 ()
>>
>> Missing separate debuginfos, use: debuginfo-install
>> glibc-2.18-12.fc20.x86_64 openssl-libs-1.0.1e-37.fc20.x8
>>
>>                                           6_64 zlib-1.2.8-3.fc20.x86_64
>>
>> (gdb) bt
>>
>> #0  0x000000000047d8c5 in search_avx2x16 ()
>>
>> #1  0x0000000000436955 in process_pkts_outbound (ctx=0x9b3800
>> <socket_ctx>, traffic=0x7fff335746d0,
>>
>>      portid=1 '\001') at /root/dpdk-2.2.0/examples/
>> ipsec-secgw/ipsec-secgw.c:551
>>
>> #2  0x0000000000437055 in process_pkts (ctx=0x9b3800 <socket_ctx>,
>> pkts=0x7fff33574eb0, nb_pkts=23 '\027',
>>
>>      portid=1 '\001') at /root/dpdk-2.2.0/examples/
>> ipsec-secgw/ipsec-secgw.c:677
>>
>> #3  0x0000000000437a08 in main_loop (dummy=0x0) at
>> /root/dpdk-2.2.0/examples/ipsec-secgw/ipsec-secgw.c:890
>>
>> #4  0x00000000004a15f3 in rte_eal_mp_remote_launch ()
>>
>> #5  0x000000000043a3dd in main (argc=9, argv=0x7fff33575270)
>>
>>      at /root/dpdk-2.2.0/examples/ipsec-secgw/ipsec-secgw.c:1904
>>
>> (gdb)
>>
>>
>>
>> I am using ESP tunnel mode with AES encryption algorithm and SHA1
>> authentication algorithm . Here is the configuration to lunch the
>> application ./build/ipsec-secgw  -l 0 -n 4 --pci-blacklist 0000:00:05.0 --
>> -p 0x3 --config="(0,0,0),(1,0,0)" -u 0x1 --cdev AESNI --ep0
>>
>>
>> There might be packets drop but it should not crash. Note that, with one
>> IPsec tunnel, I do not face this issue. Can anyone please suggest what
>> might be the issues behind this crash? Thank you in advance for your time
>> and support.
>>
>>
>> Please feel free to let me know if additional information is needed.
>>
>>
>>
>>
>> Regards,
>>
>> Chinmaya
>>