From: Tejasree Kondoj <ktejasree@marvell.com>
To: Akhil Goyal <gakhil@marvell.com>
Cc: Vidya Sagar Velumuri <vvelumuri@marvell.com>,
Anoob Joseph <anoobj@marvell.com>,
Aakash Sasidharan <asasidharan@marvell.com>,
"Nithinsen Kaithakadan" <nkaithakadan@marvell.com>,
Rupesh Chiluka <rchiluka@marvell.com>, <dev@dpdk.org>
Subject: [PATCH 26/40] crypto/cnxk: add enq and dequeue support for TLS
Date: Fri, 23 May 2025 19:20:57 +0530 [thread overview]
Message-ID: <20250523135111.2178408-27-ktejasree@marvell.com> (raw)
In-Reply-To: <20250523135111.2178408-1-ktejasree@marvell.com>
From: Vidya Sagar Velumuri <vvelumuri@marvell.com>
Add enqueue and dequeue support for TLS for cn20k
Signed-off-by: Vidya Sagar Velumuri <vvelumuri@marvell.com>
---
drivers/crypto/cnxk/cn20k_cryptodev_ops.c | 14 ++
drivers/crypto/cnxk/cn20k_tls_ops.h | 250 ++++++++++++++++++++++
2 files changed, 264 insertions(+)
create mode 100644 drivers/crypto/cnxk/cn20k_tls_ops.h
diff --git a/drivers/crypto/cnxk/cn20k_cryptodev_ops.c b/drivers/crypto/cnxk/cn20k_cryptodev_ops.c
index 97dfa5865f..cdca1f4a24 100644
--- a/drivers/crypto/cnxk/cn20k_cryptodev_ops.c
+++ b/drivers/crypto/cnxk/cn20k_cryptodev_ops.c
@@ -16,6 +16,7 @@
#include "cn20k_cryptodev_ops.h"
#include "cn20k_cryptodev_sec.h"
#include "cn20k_ipsec_la_ops.h"
+#include "cn20k_tls_ops.h"
#include "cnxk_ae.h"
#include "cnxk_cryptodev.h"
#include "cnxk_cryptodev_ops.h"
@@ -86,6 +87,17 @@ cpt_sec_ipsec_inst_fill(struct cnxk_cpt_qp *qp, struct rte_crypto_op *op,
return ret;
}
+static __rte_always_inline int __rte_hot
+cpt_sec_tls_inst_fill(struct cnxk_cpt_qp *qp, struct rte_crypto_op *op,
+ struct cn20k_sec_session *sess, struct cpt_inst_s *inst,
+ struct cpt_inflight_req *infl_req)
+{
+ if (sess->tls_opt.is_write)
+ return process_tls_write(&qp->lf, op, sess, &qp->meta_info, infl_req, inst);
+ else
+ return process_tls_read(op, sess, &qp->meta_info, infl_req, inst);
+}
+
static __rte_always_inline int __rte_hot
cpt_sec_inst_fill(struct cnxk_cpt_qp *qp, struct rte_crypto_op *op, struct cn20k_sec_session *sess,
struct cpt_inst_s *inst, struct cpt_inflight_req *infl_req)
@@ -93,6 +105,8 @@ cpt_sec_inst_fill(struct cnxk_cpt_qp *qp, struct rte_crypto_op *op, struct cn20k
if (sess->proto == RTE_SECURITY_PROTOCOL_IPSEC)
return cpt_sec_ipsec_inst_fill(qp, op, sess, &inst[0], infl_req);
+ else if (sess->proto == RTE_SECURITY_PROTOCOL_TLS_RECORD)
+ return cpt_sec_tls_inst_fill(qp, op, sess, &inst[0], infl_req);
return 0;
}
diff --git a/drivers/crypto/cnxk/cn20k_tls_ops.h b/drivers/crypto/cnxk/cn20k_tls_ops.h
new file mode 100644
index 0000000000..14f879f2a9
--- /dev/null
+++ b/drivers/crypto/cnxk/cn20k_tls_ops.h
@@ -0,0 +1,250 @@
+/* SPDX-License-Identifier: BSD-3-Clause
+ * Copyright(C) 2025 Marvell.
+ */
+
+#ifndef __CN20K_TLS_OPS_H__
+#define __CN20K_TLS_OPS_H__
+
+#include <rte_crypto_sym.h>
+#include <rte_security.h>
+
+#include "roc_ie.h"
+
+#include "cn20k_cryptodev.h"
+#include "cn20k_cryptodev_sec.h"
+#include "cnxk_cryptodev.h"
+#include "cnxk_cryptodev_ops.h"
+#include "cnxk_sg.h"
+
+static __rte_always_inline int
+process_tls_write(struct roc_cpt_lf *lf, struct rte_crypto_op *cop, struct cn20k_sec_session *sess,
+ struct cpt_qp_meta_info *m_info, struct cpt_inflight_req *infl_req,
+ struct cpt_inst_s *inst)
+{
+ struct cn20k_tls_opt tls_opt = sess->tls_opt;
+ struct rte_crypto_sym_op *sym_op = cop->sym;
+#ifdef LA_IPSEC_DEBUG
+ struct roc_ie_ow_tls_write_sa *write_sa;
+#endif
+ struct rte_mbuf *m_src = sym_op->m_src;
+ struct rte_mbuf *m_dst = sym_op->m_dst;
+ uint32_t pad_len, pad_bytes;
+ struct rte_mbuf *last_seg;
+ union cpt_inst_w4 w4;
+ void *m_data = NULL;
+ uint8_t *in_buffer;
+
+ pad_bytes = (cop->aux_flags * 8) > 0xff ? 0xff : (cop->aux_flags * 8);
+ pad_len = (pad_bytes >> tls_opt.pad_shift) * tls_opt.enable_padding;
+
+#ifdef LA_IPSEC_DEBUG
+ write_sa = &sess->tls_rec.write_sa;
+ if (write_sa->w2.s.iv_at_cptr == ROC_IE_OW_TLS_IV_SRC_FROM_SA) {
+
+ uint8_t *iv = PLT_PTR_ADD(write_sa->cipher_key, 32);
+
+ if (write_sa->w2.s.cipher_select == ROC_IE_OW_TLS_CIPHER_AES_GCM) {
+ uint32_t *tmp;
+
+ /* For GCM, the IV and salt format will be like below:
+ * iv[0-3]: lower bytes of IV in BE format.
+ * iv[4-7]: salt / nonce.
+ * iv[12-15]: upper bytes of IV in BE format.
+ */
+ memcpy(iv, rte_crypto_op_ctod_offset(cop, uint8_t *, sess->iv_offset), 4);
+ tmp = (uint32_t *)iv;
+ *tmp = rte_be_to_cpu_32(*tmp);
+
+ memcpy(iv + 12,
+ rte_crypto_op_ctod_offset(cop, uint8_t *, sess->iv_offset + 4), 4);
+ tmp = (uint32_t *)(iv + 12);
+ *tmp = rte_be_to_cpu_32(*tmp);
+ } else if (write_sa->w2.s.cipher_select == ROC_IE_OW_TLS_CIPHER_AES_CBC) {
+ uint64_t *tmp;
+
+ memcpy(iv, rte_crypto_op_ctod_offset(cop, uint8_t *, sess->iv_offset), 16);
+ tmp = (uint64_t *)iv;
+ *tmp = rte_be_to_cpu_64(*tmp);
+ tmp = (uint64_t *)(iv + 8);
+ *tmp = rte_be_to_cpu_64(*tmp);
+ } else if (write_sa->w2.s.cipher_select == ROC_IE_OW_TLS_CIPHER_3DES) {
+ uint64_t *tmp;
+
+ memcpy(iv, rte_crypto_op_ctod_offset(cop, uint8_t *, sess->iv_offset), 8);
+ tmp = (uint64_t *)iv;
+ *tmp = rte_be_to_cpu_64(*tmp);
+ }
+
+ /* Trigger CTX reload to fetch new data from DRAM */
+ roc_cpt_lf_ctx_reload(lf, write_sa);
+ rte_delay_ms(1);
+ }
+#else
+ RTE_SET_USED(lf);
+#endif
+ /* Single buffer direct mode */
+ if (likely(m_src->next == NULL)) {
+ void *vaddr;
+
+ if (unlikely(rte_pktmbuf_tailroom(m_src) < sess->max_extended_len)) {
+ plt_dp_err("Not enough tail room");
+ return -ENOMEM;
+ }
+
+ vaddr = rte_pktmbuf_mtod(m_src, void *);
+ inst->dptr = (uint64_t)vaddr;
+ inst->rptr = (uint64_t)vaddr;
+
+ w4.u64 = sess->inst.w4;
+ w4.s.param1 = m_src->data_len;
+ w4.s.dlen = m_src->data_len;
+
+ w4.s.param2 = cop->param1.tls_record.content_type;
+ w4.s.opcode_minor = pad_len;
+
+ inst->w4.u64 = w4.u64;
+ } else {
+ struct roc_sg2list_comp *scatter_comp, *gather_comp;
+ union cpt_inst_w5 cpt_inst_w5;
+ union cpt_inst_w6 cpt_inst_w6;
+ uint32_t g_size_bytes;
+ int i;
+
+ last_seg = rte_pktmbuf_lastseg(m_src);
+
+ if (unlikely(rte_pktmbuf_tailroom(last_seg) < sess->max_extended_len)) {
+ plt_dp_err("Not enough tail room (required: %d, available: %d)",
+ sess->max_extended_len, rte_pktmbuf_tailroom(last_seg));
+ return -ENOMEM;
+ }
+
+ m_data = alloc_op_meta(NULL, m_info->mlen, m_info->pool, infl_req);
+ if (unlikely(m_data == NULL)) {
+ plt_dp_err("Error allocating meta buffer for request");
+ return -ENOMEM;
+ }
+
+ in_buffer = (uint8_t *)m_data;
+ /* Input Gather List */
+ i = 0;
+ gather_comp = (struct roc_sg2list_comp *)((uint8_t *)in_buffer);
+ i = fill_sg2_comp_from_pkt(gather_comp, i, m_src);
+
+ cpt_inst_w5.s.gather_sz = ((i + 2) / 3);
+ g_size_bytes = ((i + 2) / 3) * sizeof(struct roc_sg2list_comp);
+
+ /* Output Scatter List */
+ last_seg->data_len += sess->max_extended_len + pad_bytes;
+ i = 0;
+ scatter_comp = (struct roc_sg2list_comp *)((uint8_t *)gather_comp + g_size_bytes);
+
+ if (m_dst == NULL)
+ m_dst = m_src;
+ i = fill_sg2_comp_from_pkt(scatter_comp, i, m_dst);
+
+ cpt_inst_w6.s.scatter_sz = ((i + 2) / 3);
+
+ cpt_inst_w5.s.dptr = (uint64_t)gather_comp;
+ cpt_inst_w6.s.rptr = (uint64_t)scatter_comp;
+
+ inst->w5.u64 = cpt_inst_w5.u64;
+ inst->w6.u64 = cpt_inst_w6.u64;
+ w4.u64 = sess->inst.w4;
+ w4.s.dlen = rte_pktmbuf_pkt_len(m_src);
+ w4.s.opcode_major &= (~(ROC_IE_OW_INPLACE_BIT));
+ w4.s.opcode_minor = pad_len;
+ w4.s.param1 = w4.s.dlen;
+ w4.s.param2 = cop->param1.tls_record.content_type;
+ inst->w4.u64 = w4.u64;
+ }
+
+ return 0;
+}
+
+static __rte_always_inline int
+process_tls_read(struct rte_crypto_op *cop, struct cn20k_sec_session *sess,
+ struct cpt_qp_meta_info *m_info, struct cpt_inflight_req *infl_req,
+ struct cpt_inst_s *inst)
+{
+ struct rte_crypto_sym_op *sym_op = cop->sym;
+ struct rte_mbuf *m_src = sym_op->m_src;
+ struct rte_mbuf *m_dst = sym_op->m_dst;
+ union cpt_inst_w4 w4;
+ uint8_t *in_buffer;
+ void *m_data;
+
+ if (likely(m_src->next == NULL)) {
+ void *vaddr;
+
+ vaddr = rte_pktmbuf_mtod(m_src, void *);
+
+ inst->dptr = (uint64_t)vaddr;
+ inst->rptr = (uint64_t)vaddr;
+
+ w4.u64 = sess->inst.w4;
+ w4.s.dlen = m_src->data_len;
+ w4.s.param1 = m_src->data_len;
+ inst->w4.u64 = w4.u64;
+ } else {
+ struct roc_sg2list_comp *scatter_comp, *gather_comp;
+ int tail_len = sess->tls_opt.tail_fetch_len * 16;
+ int pkt_len = rte_pktmbuf_pkt_len(m_src);
+ union cpt_inst_w5 cpt_inst_w5;
+ union cpt_inst_w6 cpt_inst_w6;
+ uint32_t g_size_bytes;
+ int i;
+
+ m_data = alloc_op_meta(NULL, m_info->mlen, m_info->pool, infl_req);
+ if (unlikely(m_data == NULL)) {
+ plt_dp_err("Error allocating meta buffer for request");
+ return -ENOMEM;
+ }
+
+ in_buffer = (uint8_t *)m_data;
+ /* Input Gather List */
+ i = 0;
+
+ /* First 32 bytes in m_data are rsvd for tail fetch.
+ * SG list start from 32 byte onwards.
+ */
+ gather_comp = (struct roc_sg2list_comp *)((uint8_t *)(in_buffer + 32));
+
+ /* Add the last blocks as first gather component for tail fetch. */
+ if (tail_len) {
+ const uint8_t *output;
+
+ output = rte_pktmbuf_read(m_src, pkt_len - tail_len, tail_len, in_buffer);
+ if (output != in_buffer)
+ rte_memcpy(in_buffer, output, tail_len);
+ i = fill_sg2_comp(gather_comp, i, (uint64_t)in_buffer, tail_len);
+ }
+
+ i = fill_sg2_comp_from_pkt(gather_comp, i, m_src);
+
+ cpt_inst_w5.s.gather_sz = ((i + 2) / 3);
+ g_size_bytes = ((i + 2) / 3) * sizeof(struct roc_sg2list_comp);
+
+ i = 0;
+ scatter_comp = (struct roc_sg2list_comp *)((uint8_t *)gather_comp + g_size_bytes);
+
+ if (m_dst == NULL)
+ m_dst = m_src;
+ i = fill_sg2_comp_from_pkt(scatter_comp, i, m_dst);
+
+ cpt_inst_w6.s.scatter_sz = ((i + 2) / 3);
+
+ cpt_inst_w5.s.dptr = (uint64_t)gather_comp;
+ cpt_inst_w6.s.rptr = (uint64_t)scatter_comp;
+
+ inst->w5.u64 = cpt_inst_w5.u64;
+ inst->w6.u64 = cpt_inst_w6.u64;
+ w4.u64 = sess->inst.w4;
+ w4.s.dlen = pkt_len + tail_len;
+ w4.s.param1 = w4.s.dlen;
+ w4.s.opcode_major &= (~(ROC_IE_OW_INPLACE_BIT));
+ inst->w4.u64 = w4.u64;
+ }
+
+ return 0;
+}
+#endif /* __CN20K_TLS_OPS_H__ */
--
2.25.1
next prev parent reply other threads:[~2025-05-23 13:55 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-05-23 13:50 [PATCH 00/40] fixes and new features to cnxk crypto PMD Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 01/40] crypto/cnxk: update the sg list population Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 02/40] crypto/cnxk: add lookaside IPsec CPT LF stats Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 03/40] crypto/cnxk: fix qp stats PMD API Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 04/40] crypto/cnxk: fail Rx inject configure if not supported Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 05/40] crypto/cnxk: add check for max supported gather entries Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 06/40] crypto/cnxk: enable IV from application support Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 07/40] crypto/cnxk: add probe for cn20k crypto device Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 08/40] crypto/cnxk: add ops skeleton for cn20k Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 09/40] crypto/cnxk: add dev info get Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 10/40] crypto/cnxk: add skeletion for enq deq functions Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 11/40] crypto/cnxk: add lmtst routines for cn20k Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 12/40] crypto/cnxk: add enqueue function support Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 13/40] crypto/cnxk: add cryptodev dequeue support for cn20k Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 14/40] crypto/cnxk: move debug dumps to common Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 15/40] crypto/cnxk: add rte security skeletion for cn20k Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 16/40] crypto/cnxk: add security session creation Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 17/40] crypto/cnxk: add security session destroy Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 18/40] crypto/cnxk: move code to common Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 19/40] crypto/cnxk: add rte sec session update Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 20/40] crypto/cnxk: add rte security datapath handling Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 21/40] crypto/cnxk: add Rx inject in security lookaside Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 22/40] crypto/cnxk: add skeleton for tls Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 23/40] crypto/cnxk: add tls write session creation Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 24/40] crypto/cnxk: add tls read " Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 25/40] crypto/cnxk: add tls session destroy Tejasree Kondoj
2025-05-23 13:50 ` Tejasree Kondoj [this message]
2025-05-23 13:50 ` [PATCH 27/40] crypto/cnxk: tls post process Tejasree Kondoj
2025-05-23 13:50 ` [PATCH 28/40] crypto/cnxk: add tls session update Tejasree Kondoj
2025-05-23 13:51 ` [PATCH 29/40] crypto/cnxk: include required headers Tejasree Kondoj
2025-05-23 13:51 ` [PATCH 30/40] crypto/cnxk: support raw API for cn20k Tejasree Kondoj
2025-05-23 13:51 ` [PATCH 31/40] crypto/cnxk: add model check " Tejasree Kondoj
2025-05-23 13:51 ` [PATCH 32/40] common/cnxk: fix salt handling with aes-ctr Tejasree Kondoj
2025-05-23 13:51 ` [PATCH 33/40] common/cnxk: set correct salt value for ctr algos Tejasree Kondoj
2025-05-23 13:51 ` [PATCH 34/40] crypto/cnxk: extend check for max supported gather entries Tejasree Kondoj
2025-05-23 13:51 ` [PATCH 35/40] crypto/cnxk: add struct variable for custom metadata Tejasree Kondoj
2025-05-23 13:51 ` [PATCH 36/40] crypto/cnxk: add asym sessionless handling Tejasree Kondoj
2025-05-23 13:51 ` [PATCH 37/40] crypto/cnxk: add support for sessionless asym Tejasree Kondoj
2025-05-23 13:51 ` [PATCH 38/40] doc: update CN20K CPT documentation Tejasree Kondoj
2025-05-23 13:51 ` [PATCH 39/40] common/cnxk: update qsize in CPT iq enable Tejasree Kondoj
2025-05-23 13:51 ` [PATCH 40/40] crypto/cnxk: copy 8B iv into sess in aes ctr Tejasree Kondoj
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250523135111.2178408-27-ktejasree@marvell.com \
--to=ktejasree@marvell.com \
--cc=anoobj@marvell.com \
--cc=asasidharan@marvell.com \
--cc=dev@dpdk.org \
--cc=gakhil@marvell.com \
--cc=nkaithakadan@marvell.com \
--cc=rchiluka@marvell.com \
--cc=vvelumuri@marvell.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).