ConnectX-6 Dx Crypto Enable, impossible to enable ipsec_packet on VF

Infrastructure & Networking Adapters and Cables Ethernet Adapter Cards
1

Hello,
I use a ConnectX-6 Dx Crypto Enable card on a Dell R640 with ubuntu 24.04 and kernel 6.8.
The firmware of my card is 22.45.1020.
I installed the last MLNX_OFED, 24.10-3.2.5.0-LTS.

Ipsec packets offload works perfectly with PFs and strongswan.

I would like to use the crypto engine on a VF like this doc says:

I follow the commands but when I try:
/opt/mellanox/iproute2/sbin/devlink port function set pci/0000:08:00.00/1 ipsec_packet enable
mlx5_core: Device not supported
Kernel error

I already double check if on the PF the flow-steering is dmfs.

function set ipsec_crypto works but when I try to add a ip xfrm state , I get a mlx5 error “Crypto offload is not supported”.

Anyone have seen the same problem ?
Do you have any solutions ?

2

Hi

Maybe your card is not the type which support crypto offload.

Please contact Nvidia support for further check:

https://enterprise-support.NVIDIA.com/s/create-case

Thank you

3

I know it’s been awhile, but I have the same problem. He mentioned above it works perfectly for PF so the card does support it. I have the same question: Should it work for VF? ethtool on the VF says esp offload available on the PF but not VF

4

So I got this to work! Im running ubuntu 24.04 which comes with iproute2 6.1. We need a much newer version to support the ipsec_crypto flag. The card is in switchdev mode and has 8 VF enabled. I built the latest, 6.12, from GitHub then did this:

echo 0000:85:00.1 | tee /sys/bus/pci/drivers/mlx5_core/unbind
/root/src/iproute2/devlink/devlink port function set pci/0000:85:00.0/1 ipsec_crypto enable
echo 0000:85:00.1 | tee /sys/bus/pci/drivers/mlx5_core/bind
ethtool -k enp133s0v0|grep offload

and the VF now shows esp offload enabled