From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0041.outbound.protection.outlook.com [104.47.34.41]) by dpdk.org (Postfix) with ESMTP id C37275F22 for ; Thu, 1 Mar 2018 10:22:32 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=CAVIUMNETWORKS.onmicrosoft.com; s=selector1-cavium-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=hXdnbHB6tG5b9zBvm7nGdyxZCS2md6xpSznj205oTww=; b=K0Vfzokj8JpfhTVwU56ZBgq/vBsVL25TtAjMKKGyKHmORn1f0PJmfDpmNPY1l6VhA744HbqqIeCsnJeUeQoiDIUomWEtv3wXhGp5GqfQfwMf21Dtb6XxnhJXYzVs2/foL1KDVp7A1W+Uwm5UqkVymBdUwjDEFukCT741CesrxYY= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Anoob.Joseph@cavium.com; Received: from ajoseph83.caveonetworks.com.caveonetworks.com (115.113.156.2) by DM2PR0701MB1068.namprd07.prod.outlook.com (2a01:111:e400:2472::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.527.15; Thu, 1 Mar 2018 09:22:28 +0000 From: Anoob Joseph To: Akhil Goyal , Declan Doherty , Radu Nicolau Cc: Anoob Joseph , Jerin Jacob , Narayana Prasad , Nelio Laranjeiro , dev@dpdk.org Date: Thu, 1 Mar 2018 14:51:42 +0530 Message-Id: <1519896103-32479-5-git-send-email-anoob.joseph@caviumnetworks.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1519896103-32479-1-git-send-email-anoob.joseph@caviumnetworks.com> References: <1519191430-19201-1-git-send-email-anoob.joseph@caviumnetworks.com> <1519896103-32479-1-git-send-email-anoob.joseph@caviumnetworks.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [115.113.156.2] X-ClientProxiedBy: MWHPR06CA0006.namprd06.prod.outlook.com (2603:10b6:301:39::19) To DM2PR0701MB1068.namprd07.prod.outlook.com (2a01:111:e400:2472::21) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 8b5752d3-8420-4fe7-3d37-08d57f55f5c7 X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(4534165)(7168020)(4627221)(201703031133081)(201702281549075)(5600026)(4604075)(2017052603307)(7153060)(7193020); SRVR:DM2PR0701MB1068; X-Microsoft-Exchange-Diagnostics: 1; DM2PR0701MB1068; 3:QkVhcBIu8oKthm4cpTftFBl1kNL0AcJSq0PvAF9wYls+r8XqLtySn/SvdZtXTHDMOdpsXeFl4lE+8D3zwBkDTxYq8stCDq2ODuOm24yeZKZfGOZoYJWh7qAPYikpgfKibnXpbcICepTULvgFFjiWTq9dQyv1AkfFSa7W8ks0jeH79+v6mKVrNgzsszPmf9HExr+HYPzl5F7FCs281h2PaNoUTaS57JP+Rlgc9/apvGcoyz0/dNcpfMgGbunoYtJ8; 25:GNIjbio8pCLyH77WIsixH82L6YOpbA0yCpw+ifpe7bPZUAhBWwJagcdxjsDYk8bV73+dz8XKsZBg+fx3X0xAgUCiZP/TA8IayvNd0/wYcsgVSM2cN4zBKaakYTyIS4C96c8xeruD+IpNhyUhfi6nWTRK7JolQdTPTziPsp/LnIbeDICjFIvnxzxwm0yUNvG1pIUqxuS6qX3VovSq09etFVF9TISAZKbyyav2wqUeXb4tLekuW2+sUv8Q/bzCo7fxBO3w4T2RVxntFCvHfGE4CBafk+a4lf+wqLwPCWFbajMnsjoYtP4Wc+gkCXpUY9RNV0uTLgwdToJ1uOp0+oBxYQ==; 31:TXlHS7XYkJO8fvBbJ4K2v2jGYYXrb5Vg9buybvNIrFeaxl3sYNDKiwvXeYgEbywY71dgLeVtqovZ1tPwZ+LM+teelwxI27DmX8EgCPq/pKHc9VFILQRCtocbW9OFiEb77s00rsAKcW6KEgE5LQ+/8VT75zPz/FlpHtbk8rg8omQ+hYn/sWlt7eDv0JmLsVOqRR7rOYD64xvgxXOK1HWWVT1rPv+RZCs6c0IJApHR2Hw= X-MS-TrafficTypeDiagnostic: DM2PR0701MB1068: X-Microsoft-Exchange-Diagnostics: 1; DM2PR0701MB1068; 20:75p9MuEEOrp3aQbjzcpJsnRLBIlMoIm4SEyUuRrAaXbYKkgvBVy+psMuO3oRGqZ1dANQiFNHzC9DNbZTuUbDNfjWZNfwEkAJ6STEHAvFUKC3SlIDiHsPplwRUQUqh5m7RZInKpsDptXFgQ3b9MheBq65jLZxqCAf7Ike1f84Hk1Am1C/kj66uoUAoctyZFTv6XHpiUSwj5d/E6ZVmMb/DuURXMsiFVvB70alIIhmbBaBK4EYReOyp08X3uaZHfFZsfv+oF71p6ivhg0NkbKWRot0vmpFKxB3Y17dolm72eS49ypycrSMybP9Yu4lKj/9tj3sBfGzPqqS4o1Gp9kFm7w7L1edC8X3IoBR++Px3qqSK6cwRl6nLefBsUyTOpoAxnsj0uAr4FJRNnp1x569/k2qdVu9jjAcuLQ05S8FMVig/hGXudg6feDjEwdE8KDGWdZiyaIrZrlsU9qeLjFp4XxPYfejLnHxIhpFBrE6+8NcToxModz0KCsDmRiTnP4NaD9H2cuoRyGB/f/Ecu9FSLoktJisL2NgfHx0bZYJnZ54EaDxAx8o3tDr2D8LyZp+KdowUwIlcZgE0Y0Lq/hNhoQ9d+hqh3Fcer8lsUsmG/Y=; 4:e6k4TK7/ZinY3973g9mfXi1x3d93w9mpNAQUjPDGchOvfm1vI3ApqOOaftLRkxPH/slmDca7PU1fheKTgBXCMhmIq0fr2x71P+V/0TaCWrTavHs8Mf1XVg8t3H3WEOza6YEBKiW+U6HomT8aca8SAa8LpGNzO2zkmZPfU0s2EknVMAQdmLu+sPF/Cb9qPZQBACUq6w39TstoWWiUuxP97vTwd/4pWJ0bronXptaChAiBF1fMA9uPBabzu5C5wVDhpHDwtD9VWzb2TZuSnk/IjPpUXopdIgfsyqnSZxS3g/7Th9TGvRSwC/mlpSwPKTL0 X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(192374486261705); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(6040501)(2401047)(8121501046)(5005006)(3002001)(3231220)(944501224)(52105095)(93006095)(10201501046)(6041288)(20161123564045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123562045)(20161123560045)(6072148)(201708071742011); SRVR:DM2PR0701MB1068; BCL:0; PCL:0; RULEID:; SRVR:DM2PR0701MB1068; X-Forefront-PRVS: 05986C03E0 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(39860400002)(366004)(396003)(376002)(39380400002)(346002)(199004)(189003)(76176011)(186003)(8676002)(386003)(6116002)(50226002)(2950100002)(106356001)(6666003)(2906002)(81166006)(52116002)(478600001)(81156014)(3846002)(72206003)(36756003)(97736004)(8656006)(8936002)(54906003)(110136005)(6512007)(25786009)(50466002)(316002)(105586002)(51416003)(5660300001)(42882007)(6486002)(47776003)(16586007)(55236004)(48376002)(26005)(6506007)(66066001)(59450400001)(53936002)(305945005)(68736007)(4326008)(16526019)(7736002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM2PR0701MB1068; H:ajoseph83.caveonetworks.com.caveonetworks.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; Received-SPF: None (protection.outlook.com: cavium.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; DM2PR0701MB1068; 23:lAcJ9It4Nt0Pbfo8pLc7+GpTWoC0/NcgqHHqpr8?= =?us-ascii?Q?q0o4GmR1mapE6a/SzQuZIWj3tKQ2JYVfrme/Ji/waEdTlynq17mlH63+WMyr?= =?us-ascii?Q?Hf5n+z47xLrVZdvNnM6BAr6OKxvuHmsspGNMrXO4LILCDtjLELN0OQhRYt+1?= =?us-ascii?Q?65jnb0cnKY9sHFNTH/Y6v0nja66YtPgAzcL2MO3mEfVIIXTRuxZdWRiUULQA?= =?us-ascii?Q?+E7gllTN5+WzwSxeS9QxbAF+otyNlqz50qQgIHePukP7eRdQYDnTPnZqhli4?= =?us-ascii?Q?x44P9UcQT3xmML64iRANasEkBtdO/zxcRXLzhwRLWUYYkWvypZ0r6+6OROcl?= =?us-ascii?Q?ZrY89Cp+uU/lidkDuX81pzf+WhXLd9VOxt9p60xokOGzmiZ/IV5uToLgb/Cy?= =?us-ascii?Q?9VufPr5Y5Oq6BlEstYKnJKPEF7JR3WLzlOXnLnSD64aC86QTOi7BB1jCkVVp?= =?us-ascii?Q?8mZxyzhm1S4rd/twjSVtfjSA7XvgEFk4B8GWidaRjkC8/lCntRAO8AW4jdL7?= =?us-ascii?Q?BzKTfSDuL/mT8Ci1x65AHb5lBgcP5ENbfBR60Ig6xSvwlVJOqReoxCTgGhLw?= =?us-ascii?Q?53ro1kfTVctNmmIljGE+8hYs1wAo9sye+LZWdbvKAiJ2b6p5szRh09J5priv?= =?us-ascii?Q?/o8TC9e0tbBe/b+ANdqiljeFj8aXiT4OBjayRKcm0ZGl2H21MEPJRLjX/Y5E?= =?us-ascii?Q?ChX1SU3uHd3zBzbex8GjGbi4DJ4AAUio9wRwwA30cAj2WvfYQRnu+feFgG6J?= =?us-ascii?Q?jgtxYboQNhFEZmEbi2mxzNr1291PSWf64bTLPNxEnQ5JDmhz2a6g2kqXgHc2?= =?us-ascii?Q?U/Mckzs38Lo36m5eRHj4zQ+doJQnfeQpop5S3upDk4LE2xs9bCzvDLPjltuc?= =?us-ascii?Q?hqHcVwkCppPROcPt2yDuKXnYwtr45OhP8kPQKiLA4LBzJW+lvWhizlaX2NiT?= =?us-ascii?Q?GAnffT4BGXbrHnIgI+KOXxD7gNhHOPjVWlvdLIFQ9AA5KlVApdfekrU5C9/t?= =?us-ascii?Q?WigGXOGgfkoRjii2+ng1Xo5dtXdkbriNnpCDCbn8FrM2ZEWdihGzK+46XWlN?= =?us-ascii?Q?b5+XoE77Q60H51XsZrNM4Ivb8fOtqrNPaE63pXKXijWqs2fSsWuOYLFzzl4i?= =?us-ascii?Q?1bHiXK+5AhK0INN0htWwCLpySVESZyk1pvQi80SUL9+i04J8f2nR/j2xjMBd?= =?us-ascii?Q?P1G/o84x8BcXnOe+dQCbNg8HFYPvgfdb54S7i?= X-Microsoft-Exchange-Diagnostics: 1; DM2PR0701MB1068; 6:Gu8bp8kcy1cOt/dZVymtTZnb1sKKK46hQuZQI9g0ccnvihDosR7Bc9BG+so/+XxGAp0nij0qqOpWOqPOvSuLajoOYH3mUqfe7umLxsaAXY9VHackTFgvuSLH2yKAdC9y46bpaseA3cR0+KFfAXdatBOdvt+evUWFLaZpPOXeEfD9QoB5Ya8a+4cMf19vmsAV48C9mHdbf9iX4bCUSLM+P+tEtNuTNxlTJq+S89XBBY8hkZlFWzvcbDTXvJ6LgWuobPBOHRa1PUIAlndryH1FXA1TG+5l2dTSB+d3LgaT+RoUghC6wc+QiQO9uVmNkkciTktRcN33vqzNRyCktO+1ZqaCKzdjLCmpcxE60kIa98w=; 5:PXl9YyWzyIOJh0tAmG6RAYNGnNmzZ2K8ryESNT/KEJsS6iMk18B3eE1Yi2F/pnQhGRnfJjjlwuWqwHZ63aDYyDVRo2oWu/DhoyoauHxq3R0gYfRgsBdtRAtQ5FzFQXtQt4DrjbXEKrWfPMG4HHO27eMBNpnNAeIiPWq7tKSua+M=; 24:TleQJ9buTFrVubSoHqv8m0WutjQY2/VFPnH/4fRox0/b2tfvstphVqzfaMYFMVpZ1f9vXIDVvE4lQvCxmWtERBQ4RkR0hVDefG0tX2ay9Qw=; 7:4/9I0hmFcTYA6HYpmF2xbfE1NJs2QwMqUMMYIVI+hYjC+deTsbxDdAAZDHxiZp4PdypPW6Gt3rL4UMIRPsyMAEkUEkDK+XudI1VuPVpkckhQiaaK1GZXEQag9mbRi//KQ/YsmIsjsANKNmfNMCvcH8JMDQSGBVIgeqQaAj3BZ7kK1Hk4gN4l8OMmV13j9ulbpK2CJoAvYTRvGn5sFhn2vJq5g18s1PNnpYUZp6PJxY0F5HS5t3ti58WN0nkgvbgX SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: caviumnetworks.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Mar 2018 09:22:28.8184 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 8b5752d3-8420-4fe7-3d37-08d57f55f5c7 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 711e4ccf-2e9b-4bcf-a551-4094005b6194 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR0701MB1068 Subject: [dpdk-dev] [PATCH v2 4/5] examples/ipsec-secgw: handle ESN soft limit event X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Mar 2018 09:22:33 -0000 For inline protocol processing, the PMD/device is required to maintain the ESN. But the application is required to monitor ESN overflow to initiate SA expiry. For such cases, application would set the ESN soft limit. An IPsec event would be raised by rte_eth_event framework, when ESN hits the soft limit set by the application. Signed-off-by: Anoob Joseph --- v2: * No change examples/ipsec-secgw/ipsec-secgw.c | 56 ++++++++++++++++++++++++++++++++++++++ examples/ipsec-secgw/ipsec.c | 10 +++++-- examples/ipsec-secgw/ipsec.h | 2 ++ 3 files changed, 65 insertions(+), 3 deletions(-) diff --git a/examples/ipsec-secgw/ipsec-secgw.c b/examples/ipsec-secgw/ipsec-secgw.c index 3a8562e..5726fd3 100644 --- a/examples/ipsec-secgw/ipsec-secgw.c +++ b/examples/ipsec-secgw/ipsec-secgw.c @@ -40,6 +40,7 @@ #include #include #include +#include #include "ipsec.h" #include "parser.h" @@ -1640,6 +1641,58 @@ pool_init(struct socket_ctx *ctx, int32_t socket_id, uint32_t nb_mbuf) printf("Allocated mbuf pool on socket %d\n", socket_id); } +static inline int +inline_ipsec_event_esn_overflow(struct rte_security_ctx *ctx, uint64_t md) +{ + struct ipsec_sa *sa; + + /* For inline protocol processing, the metadata in the event will + * uniquely identify the security session which raised the event. + * Application would then need the userdata it had registered with the + * security session to process the event. + */ + + sa = (struct ipsec_sa *)rte_security_get_userdata(ctx, md); + + if (sa == NULL) { + /* userdata could not be retrieved */ + return -1; + } + + /* Sequence number over flow. SA need to be re-established */ + RTE_SET_USED(sa); + return 0; +} + +static int +inline_ipsec_event_callback(uint16_t port_id, enum rte_eth_event_type type, + void *param, void *ret_param) +{ + struct rte_eth_event_ipsec_desc *event_desc = NULL; + struct rte_security_ctx *ctx = (struct rte_security_ctx *) + rte_eth_dev_get_sec_ctx(port_id); + + RTE_SET_USED(param); + + if (type != RTE_ETH_EVENT_IPSEC) + return -1; + + event_desc = ret_param; + if (event_desc == NULL) { + printf("Event descriptor not set\n"); + return -1; + } + + if (event_desc->stype == RTE_ETH_EVENT_IPSEC_ESN_OVERFLOW) + return inline_ipsec_event_esn_overflow(ctx, event_desc->md); + else if (event_desc->stype >= RTE_ETH_EVENT_IPSEC_MAX) { + printf("Invalid IPsec event reported\n"); + return -1; + } + + return -1; +} + int32_t main(int32_t argc, char **argv) { @@ -1727,6 +1780,9 @@ main(int32_t argc, char **argv) */ if (promiscuous_on) rte_eth_promiscuous_enable(portid); + + rte_eth_dev_callback_register(portid, + RTE_ETH_EVENT_IPSEC, inline_ipsec_event_callback, NULL); } check_all_ports_link_status(nb_ports, enabled_port_mask); diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c index 5fb5bc1..acdd189 100644 --- a/examples/ipsec-secgw/ipsec.c +++ b/examples/ipsec-secgw/ipsec.c @@ -36,6 +36,7 @@ set_ipsec_conf(struct ipsec_sa *sa, struct rte_security_ipsec_xform *ipsec) } /* TODO support for Transport and IPV6 tunnel */ } + ipsec->esn_soft_limit = IPSEC_OFFLOAD_ESN_SOFTLIMIT; } static inline int @@ -270,11 +271,14 @@ create_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa) * the packet is received, this userdata will be * retrieved using the metadata from the packet. * - * This is required only for inbound SAs. + * The PMD is expected to set similar metadata for other + * operations, like rte_eth_event, which are tied to + * security session. In such cases, the userdata could + * be obtained to uniquely identify the security + * parameters denoted. */ - if (sa->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) - sess_conf.userdata = (void *) sa; + sess_conf.userdata = (void *) sa; sa->sec_session = rte_security_session_create(ctx, &sess_conf, ipsec_ctx->session_pool); diff --git a/examples/ipsec-secgw/ipsec.h b/examples/ipsec-secgw/ipsec.h index 6059f6c..c1450f6 100644 --- a/examples/ipsec-secgw/ipsec.h +++ b/examples/ipsec-secgw/ipsec.h @@ -21,6 +21,8 @@ #define MAX_DIGEST_SIZE 32 /* Bytes -- 256 bits */ +#define IPSEC_OFFLOAD_ESN_SOFTLIMIT 0xffffff00 + #define IV_OFFSET (sizeof(struct rte_crypto_op) + \ sizeof(struct rte_crypto_sym_op)) -- 2.7.4