From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id F0FD2A0613 for ; Fri, 27 Sep 2019 12:38:57 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id ACD0C1BF03; Fri, 27 Sep 2019 12:38:57 +0200 (CEST) Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) by dpdk.org (Postfix) with ESMTP id B47781BEB8 for ; Fri, 27 Sep 2019 12:38:55 +0200 (CEST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga006.jf.intel.com ([10.7.209.51]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 27 Sep 2019 03:38:54 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,555,1559545200"; d="scan'208";a="194440652" Received: from irsmsx109.ger.corp.intel.com ([163.33.3.23]) by orsmga006.jf.intel.com with ESMTP; 27 Sep 2019 03:38:53 -0700 Received: from irsmsx155.ger.corp.intel.com (163.33.192.3) by IRSMSX109.ger.corp.intel.com (163.33.3.23) with Microsoft SMTP Server (TLS) id 14.3.439.0; Fri, 27 Sep 2019 11:38:53 +0100 Received: from irsmsx105.ger.corp.intel.com ([169.254.7.164]) by irsmsx155.ger.corp.intel.com ([169.254.14.139]) with mapi id 14.03.0439.000; Fri, 27 Sep 2019 11:38:52 +0100 From: "Ananyev, Konstantin" To: "Zhang, Roy Fan" , "dev@dpdk.org" CC: "Doherty, Declan" , "akhil.goyal@nxp.com" Thread-Topic: [PATCH 08/10] ipsec: add rte_security cpu_crypto action support Thread-Index: AQHVZLTz1xBXZzw+5EG4S9a5D69UjKc/a8YQ Date: Fri, 27 Sep 2019 10:38:51 +0000 Message-ID: <2601191342CEEE43887BDE71AB977258019196BFF6@irsmsx105.ger.corp.intel.com> References: <20190903154046.55992-1-roy.fan.zhang@intel.com> <20190906131330.40185-1-roy.fan.zhang@intel.com> <20190906131330.40185-9-roy.fan.zhang@intel.com> In-Reply-To: <20190906131330.40185-9-roy.fan.zhang@intel.com> Accept-Language: en-IE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiNzhmYjZmZjEtM2ZiMi00MjlmLTkwYWQtZTM1OWQxZTcwODQ1IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiblVzYVI0SGxxRTBuK0N0N0t3OEJXQkJYY0RnTWV6OEp4TmZTV096VHllZ2xlU2NhTGR5cHc2TEhpUm5WUGRLSiJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [163.33.239.182] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [dpdk-dev] [PATCH 08/10] ipsec: add rte_security cpu_crypto action support X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Hi Fan, >=20 > This patch updates the ipsec library to handle the newly introduced > RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO action. >=20 > Signed-off-by: Fan Zhang > --- > lib/librte_ipsec/esp_inb.c | 174 +++++++++++++++++++++++++- > lib/librte_ipsec/esp_outb.c | 290 ++++++++++++++++++++++++++++++++++++++= +++++- > lib/librte_ipsec/sa.c | 53 ++++++-- > lib/librte_ipsec/sa.h | 29 +++++ > lib/librte_ipsec/ses.c | 4 +- > 5 files changed, 539 insertions(+), 11 deletions(-) >=20 > diff --git a/lib/librte_ipsec/esp_inb.c b/lib/librte_ipsec/esp_inb.c > index 8e3ecbc64..6077dcb1e 100644 > --- a/lib/librte_ipsec/esp_inb.c > +++ b/lib/librte_ipsec/esp_inb.c > @@ -105,6 +105,73 @@ inb_cop_prepare(struct rte_crypto_op *cop, > } > } >=20 > +static inline int > +inb_sync_crypto_proc_prepare(const struct rte_ipsec_sa *sa, struct rte_m= buf *mb, > + const union sym_op_data *icv, uint32_t pofs, uint32_t plen, > + struct rte_security_vec *buf, struct iovec *cur_vec, > + void *iv, void **aad, void **digest) > +{ > + struct rte_mbuf *ms; > + struct iovec *vec =3D cur_vec; > + struct aead_gcm_iv *gcm; > + struct aesctr_cnt_blk *ctr; > + uint64_t *ivp; > + uint32_t algo, left, off =3D 0, n_seg =3D 0; Same thing as for outbound pls keep definitions and assignments separated. > + > + ivp =3D rte_pktmbuf_mtod_offset(mb, uint64_t *, > + pofs + sizeof(struct rte_esp_hdr)); > + algo =3D sa->algo_type; > + > + switch (algo) { > + case ALGO_TYPE_AES_GCM: > + gcm =3D (struct aead_gcm_iv *)iv; > + aead_gcm_iv_fill(gcm, ivp[0], sa->salt); > + *aad =3D icv->va + sa->icv_len; > + off =3D sa->ctp.cipher.offset + pofs; > + break; > + case ALGO_TYPE_AES_CBC: > + case ALGO_TYPE_3DES_CBC: > + off =3D sa->ctp.auth.offset + pofs; > + break; > + case ALGO_TYPE_AES_CTR: > + off =3D sa->ctp.auth.offset + pofs; > + ctr =3D (struct aesctr_cnt_blk *)iv; > + aes_ctr_cnt_blk_fill(ctr, ivp[0], sa->salt); > + break; > + case ALGO_TYPE_NULL: > + break; > + } > + > + *digest =3D icv->va; > + > + left =3D plen - sa->ctp.cipher.length; > + > + ms =3D mbuf_get_seg_ofs(mb, &off); > + if (!ms) > + return -1; Same as for outbound: I think no need to check/return failure. This function could be split into two. > + > + while (n_seg < RTE_LIBRTE_IP_FRAG_MAX_FRAG && left && ms) { Same thing - we shouldn't limt ourselves to 5 segs per packet. Pretty much same comments about code restructuring as for outbound case. > + uint32_t len =3D RTE_MIN(left, ms->data_len - off); > + > + vec->iov_base =3D rte_pktmbuf_mtod_offset(ms, void *, off); > + vec->iov_len =3D len; > + > + left -=3D len; > + vec++; > + n_seg++; > + ms =3D ms->next; > + off =3D 0; > + } > + > + if (left) > + return -1; > + > + buf->vec =3D cur_vec; > + buf->num =3D n_seg; > + > + return n_seg; > +} > + > /* > * Helper function for prepare() to deal with situation when > * ICV is spread by two segments. Tries to move ICV completely into the > @@ -512,7 +579,6 @@ tun_process(const struct rte_ipsec_sa *sa, struct rte= _mbuf *mb[], > return k; > } >=20 > - > /* > * *process* function for tunnel packets > */ > @@ -625,6 +691,112 @@ esp_inb_pkt_process(struct rte_ipsec_sa *sa, struct= rte_mbuf *mb[], > return n; > } >=20 > +/* > + * process packets using sync crypto engine > + */ > +static uint16_t > +esp_inb_sync_crypto_pkt_process(const struct rte_ipsec_session *ss, > + struct rte_mbuf *mb[], uint16_t num, uint8_t sqh_len, > + esp_inb_process_t process) > +{ > + int32_t rc; > + uint32_t i, k, hl, n, p; > + struct rte_ipsec_sa *sa; > + struct replay_sqn *rsn; > + union sym_op_data icv; > + uint32_t sqn[num]; > + uint32_t dr[num]; > + struct rte_security_vec buf[num]; > + struct iovec vec[RTE_LIBRTE_IP_FRAG_MAX_FRAG * num]; > + uint32_t vec_idx =3D 0; > + uint8_t ivs[num][IPSEC_MAX_IV_SIZE]; > + void *iv[num]; > + void *aad[num]; > + void *digest[num]; > + int status[num]; > + > + sa =3D ss->sa; > + rsn =3D rsn_acquire(sa); > + > + k =3D 0; > + for (i =3D 0; i !=3D num; i++) { > + hl =3D mb[i]->l2_len + mb[i]->l3_len; > + rc =3D inb_pkt_prepare(sa, rsn, mb[i], hl, &icv); > + if (rc >=3D 0) { > + iv[k] =3D (void *)ivs[k]; > + rc =3D inb_sync_crypto_proc_prepare(sa, mb[i], &icv, hl, > + rc, &buf[k], &vec[vec_idx], iv[k], > + &aad[k], &digest[k]); > + if (rc < 0) { > + dr[i - k] =3D i; > + continue; > + } > + > + vec_idx +=3D rc; > + k++; > + } else > + dr[i - k] =3D i; > + } > + > + /* copy not prepared mbufs beyond good ones */ > + if (k !=3D num) { > + rte_errno =3D EBADMSG; > + > + if (unlikely(k =3D=3D 0)) > + return 0; > + > + move_bad_mbufs(mb, dr, num, num - k); > + } > + > + /* process the packets */ > + n =3D 0; > + rte_security_process_cpu_crypto_bulk(ss->security.ctx, > + ss->security.ses, buf, iv, aad, digest, status, > + k); > + /* move failed process packets to dr */ > + for (i =3D 0; i < k; i++) { > + if (status[i]) { > + dr[n++] =3D i; > + rte_errno =3D EBADMSG; > + } > + } > + > + /* move bad packets to the back */ > + if (n) > + move_bad_mbufs(mb, dr, k, n); I don't think you need to set dr[] here and call that function, see below. > + > + /* process packets */ > + p =3D process(sa, mb, sqn, dr, k - n, sqh_len); tun_process(), etc. expects PKT_RX_SEC_OFFLOAD_FAILED to be set in mb->ol_f= lags for failed packets. So you either need to set this value in ol_flags based on status, or tweak existing process functions, or introduce new ones. > + > + if (p !=3D k - n && p !=3D 0) > + move_bad_mbufs(mb, dr, k - n, k - n - p); > + > + if (p !=3D num) > + rte_errno =3D EBADMSG; > + > + return p; > +} > + > +uint16_t > +esp_inb_tun_sync_crypto_pkt_process(const struct rte_ipsec_session *ss, > + struct rte_mbuf *mb[], uint16_t num) > +{ > + struct rte_ipsec_sa *sa =3D ss->sa; > + > + return esp_inb_sync_crypto_pkt_process(ss, mb, num, sa->sqh_len, > + tun_process); > +} > + > +uint16_t > +esp_inb_trs_sync_crypto_pkt_process(const struct rte_ipsec_session *ss, > + struct rte_mbuf *mb[], uint16_t num) > +{ > + struct rte_ipsec_sa *sa =3D ss->sa; > + > + return esp_inb_sync_crypto_pkt_process(ss, mb, num, sa->sqh_len, > + trs_process); > +} > + > /* > * process group of ESP inbound tunnel packets. > */