From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp.tuxdriver.com (charlotte.tuxdriver.com [70.61.120.58]) by dpdk.org (Postfix) with ESMTP id 50A5B1D90 for ; Mon, 27 Nov 2017 14:55:26 +0100 (CET) Received: from [107.15.66.59] (helo=localhost) by smtp.tuxdriver.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1eJJsG-0005SX-AW; Mon, 27 Nov 2017 08:55:19 -0500 Date: Mon, 27 Nov 2017 08:55:01 -0500 From: Neil Horman To: Anoob Cc: Akhil Goyal , Declan Doherty , Radu Nicolau , Sergio Gonzalez Monroy , Jerin Jacob , Narayana Prasad , dev@dpdk.org Message-ID: <20171127135501.GA8850@hmswarspite.think-freely.org> References: <1511173905-22117-1-git-send-email-anoob.joseph@caviumnetworks.com> <1511333716-11955-1-git-send-email-anoob.joseph@caviumnetworks.com> <1511333716-11955-2-git-send-email-anoob.joseph@caviumnetworks.com> <20171122132720.GA624@hmswarspite.think-freely.org> <0f8af801-9833-ccc1-c969-c7b4e74aecac@caviumnetworks.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <0f8af801-9833-ccc1-c969-c7b4e74aecac@caviumnetworks.com> User-Agent: Mutt/1.9.1 (2017-09-22) X-Spam-Score: -2.9 (--) X-Spam-Status: No Subject: Re: [dpdk-dev] [PATCH v2 1/2] lib/security: add support for get metadata X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Nov 2017 13:55:28 -0000 On Wed, Nov 22, 2017 at 07:43:13PM +0530, Anoob wrote: > Hi, > > Please see inline. > > > On 11/22/2017 06:57 PM, Neil Horman wrote: > > On Wed, Nov 22, 2017 at 06:55:15AM +0000, Anoob Joseph wrote: > > > In case of inline protocol processed ingress traffic, the packet may not > > > have enough information to determine the security parameters with which > > > the packet was processed. For such cases, application could register a > > > 64 bit metadata in security session, which could be retrieved from the > > > packet using "rte_security_get_pkt_metadata" API. Application can use > > > this metadata to identify the parameters it need. > > > > > > Application can choose what it should register as the metadata. It can > > > register SPI or a pointer to SA. > > > > > > Signed-off-by: Anoob Joseph > > > --- > > > v2: > > > * Replaced get_session and get_cookie APIs with get_pkt_metadata API > > > > > > lib/librte_security/rte_security.c | 13 +++++++++++++ > > > lib/librte_security/rte_security.h | 19 +++++++++++++++++++ > > > lib/librte_security/rte_security_driver.h | 16 ++++++++++++++++ > > > 3 files changed, 48 insertions(+) > > > > > > diff --git a/lib/librte_security/rte_security.c b/lib/librte_security/rte_security.c > > > index 1227fca..804f11f 100644 > > > --- a/lib/librte_security/rte_security.c > > > +++ b/lib/librte_security/rte_security.c > > > @@ -108,6 +108,19 @@ rte_security_set_pkt_metadata(struct rte_security_ctx *instance, > > > sess, m, params); > > > } > > > +uint64_t > > > +rte_security_get_pkt_metadata(struct rte_security_ctx *instance, > > > + struct rte_mbuf *pkt) > > > +{ > > > + uint64_t mdata = 0; > > > + > > > + RTE_FUNC_PTR_OR_ERR_RET(*instance->ops->get_pkt_metadata, 0); > > > + if (instance->ops->get_pkt_metadata(instance->device, pkt, &mdata)) > > > + return 0; > > > + > > > + return mdata; > > > +} > > > + > > > const struct rte_security_capability * > > > rte_security_capabilities_get(struct rte_security_ctx *instance) > > > { > > > diff --git a/lib/librte_security/rte_security.h b/lib/librte_security/rte_security.h > > > index 653929b..aa3a471 100644 > > > --- a/lib/librte_security/rte_security.h > > > +++ b/lib/librte_security/rte_security.h > > > @@ -274,6 +274,8 @@ struct rte_security_session_conf { > > > /**< Configuration parameters for security session */ > > > struct rte_crypto_sym_xform *crypto_xform; > > > /**< Security Session Crypto Transformations */ > > > + uint64_t metadata; > > > + /**< Metadata registered by application */ > > This is going to break ABI. You need to announce the change so that application > > providers can be prepared for it. > The security library is under experimental tag. So is the announcement > required? Ah, thats correct, its not required. That said, thats probably the fourth time I've reviewed a patch and tripped over the fact that it was experimental. We should probably look at ways at making that fact more visible at review, compile and run time Neil > > > > > }; > > > struct rte_security_session { > > > @@ -346,6 +348,23 @@ rte_security_set_pkt_metadata(struct rte_security_ctx *instance, > > > struct rte_mbuf *mb, void *params); > > > /** > > > + * Get metadata from the packet. This is an application registered 64 bit > > > + * value, associated with the security session which processed the packet. > > > + * > > > + * This is valid only for inline processed ingress packets. > > > + * > > > + * @param instance security instance > > > + * @param pkt packet mbuf > > > + * > > > + * @return > > > + * - On success, metadata > > > + * - On failure, 0 > > > + */ > > > +uint64_t > > > +rte_security_get_pkt_metadata(struct rte_security_ctx *instance, > > > + struct rte_mbuf *pkt); > > > + > > > +/** > > > * Attach a session to a symmetric crypto operation > > > * > > > * @param sym_op crypto operation > > > diff --git a/lib/librte_security/rte_security_driver.h b/lib/librte_security/rte_security_driver.h > > > index 997fbe7..da0ebf4 100644 > > > --- a/lib/librte_security/rte_security_driver.h > > > +++ b/lib/librte_security/rte_security_driver.h > > > @@ -122,6 +122,20 @@ typedef int (*security_set_pkt_metadata_t)(void *device, > > > void *params); > > > /** > > > + * Get application interpretable metadata from the packet. > > > + * > > > + * @param device Crypto/eth device pointer > > > + * @param pkt Packet mbuf > > > + * @param mt Pointer to receive metadata > > > + * > > > + * @return > > > + * - Returns 0 if metadata is retrieved successfully. > > > + * - Returns -ve value for errors. > > > + */ > > > +typedef int (*security_get_pkt_metadata_t)(void *device, > > > + struct rte_mbuf *pkt, uint64_t *mt); > > > + > > > +/** > > > * Get security capabilities of the device. > > > * > > > * @param device crypto/eth device pointer > > > @@ -145,6 +159,8 @@ struct rte_security_ops { > > > /**< Clear a security sessions private data. */ > > > security_set_pkt_metadata_t set_pkt_metadata; > > > /**< Update mbuf metadata. */ > > > + security_get_pkt_metadata_t get_pkt_metadata; > > > + /**< Get metadata from packet. */ > > > security_capabilities_get_t capabilities_get; > > > /**< Get security capabilities. */ > > > }; > > > -- > > > 2.7.4 > > > > > > > >