From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by dpdk.org (Postfix) with ESMTP id 978951D90 for ; Wed, 22 Nov 2017 13:12:26 +0100 (CET) Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga105.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 Nov 2017 04:12:24 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.44,436,1505804400"; d="scan'208";a="1247232472" Received: from rnicolau-mobl.ger.corp.intel.com (HELO [10.237.221.73]) ([10.237.221.73]) by fmsmga002.fm.intel.com with ESMTP; 22 Nov 2017 04:12:22 -0800 To: Anoob , Akhil Goyal , Declan Doherty , Sergio Gonzalez Monroy Cc: Jerin Jacob , Narayana Prasad , dev@dpdk.org References: <1511173905-22117-1-git-send-email-anoob.joseph@caviumnetworks.com> <1511333716-11955-1-git-send-email-anoob.joseph@caviumnetworks.com> <1511333716-11955-2-git-send-email-anoob.joseph@caviumnetworks.com> <451150d9-bf64-3a49-908b-96883302b0a2@intel.com> <11271d70-eb73-1147-3969-0b718a912f8e@caviumnetworks.com> From: Radu Nicolau Message-ID: <77f86a5f-c17d-f51f-3be5-c5ac910daf6f@intel.com> Date: Wed, 22 Nov 2017 12:12:21 +0000 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 In-Reply-To: <11271d70-eb73-1147-3969-0b718a912f8e@caviumnetworks.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Subject: Re: [dpdk-dev] [PATCH v2 1/2] lib/security: add support for get metadata X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Nov 2017 12:12:27 -0000 On 11/22/2017 11:52 AM, Anoob wrote: > Hi, > > See inline. > > > Thanks, > Anoob > > On 11/22/2017 04:59 PM, Radu Nicolau wrote: >> >> >> On 11/22/2017 6:55 AM, Anoob Joseph wrote: >>> In case of inline protocol processed ingress traffic, the packet may >>> not >>> have enough information to determine the security parameters with which >>> the packet was processed. For such cases, application could register a >>> 64 bit metadata in security session, which could be retrieved from the >>> packet using "rte_security_get_pkt_metadata" API. Application can use >>> this metadata to identify the parameters it need. >>> >>> Application can choose what it should register as the metadata. It can >>> register SPI or a pointer to SA. >>> >>> Signed-off-by: Anoob Joseph >>> --- >>> v2: >>> * Replaced get_session and get_cookie APIs with get_pkt_metadata API >>> >>>   lib/librte_security/rte_security.c        | 13 +++++++++++++ >>>   lib/librte_security/rte_security.h        | 19 +++++++++++++++++++ >>>   lib/librte_security/rte_security_driver.h | 16 ++++++++++++++++ >>>   3 files changed, 48 insertions(+) >>> >>> diff --git a/lib/librte_security/rte_security.c >>> b/lib/librte_security/rte_security.c >>> index 1227fca..804f11f 100644 >>> --- a/lib/librte_security/rte_security.c >>> +++ b/lib/librte_security/rte_security.c >>> @@ -108,6 +108,19 @@ rte_security_set_pkt_metadata(struct >>> rte_security_ctx *instance, >>>                              sess, m, params); >>>   } >>>   +uint64_t >>> +rte_security_get_pkt_metadata(struct rte_security_ctx *instance, >>> +                  struct rte_mbuf *pkt) >>> +{ >>> +    uint64_t mdata = 0; >>> + >>> + RTE_FUNC_PTR_OR_ERR_RET(*instance->ops->get_pkt_metadata, 0); >>> +    if (instance->ops->get_pkt_metadata(instance->device, pkt, >>> &mdata)) >>> +        return 0; >>> + >>> +    return mdata; >>> +} >>> + >> Can you change the returned type to void *? > Will do that. >>>   const struct rte_security_capability * >>>   rte_security_capabilities_get(struct rte_security_ctx *instance) >>>   { >>> diff --git a/lib/librte_security/rte_security.h >>> b/lib/librte_security/rte_security.h >>> index 653929b..aa3a471 100644 >>> --- a/lib/librte_security/rte_security.h >>> +++ b/lib/librte_security/rte_security.h >>> @@ -274,6 +274,8 @@ struct rte_security_session_conf { >>>       /**< Configuration parameters for security session */ >>>       struct rte_crypto_sym_xform *crypto_xform; >>>       /**< Security Session Crypto Transformations */ >>> +    uint64_t metadata; >>> +    /**< Metadata registered by application */ >>>   }; >> Can you rename it to userdata? > Will do it. Thought it would be confusing, as this will be returned by > rte_security_get_pkt_metadata. So get_metadata would give userdata of > the security session. I can document it that way and proceed, right? Also make it a pointer please. You should document it in the PMD documentation, as this is a PMD specific behavior. Your PMD returns just the userdata pointer set in the security_conf struct, but other PMDs can return different things. >>>     struct rte_security_session { >>> @@ -346,6 +348,23 @@ rte_security_set_pkt_metadata(struct >>> rte_security_ctx *instance, >>>                     struct rte_mbuf *mb, void *params); >>>     /** >>> + * Get metadata from the packet. This is an application registered >>> 64 bit >>> + * value, associated with the security session which processed the >>> packet. >>> + * >>> + * This is valid only for inline processed ingress packets. >>> + * >>> + * @param   instance    security instance >>> + * @param   pkt        packet mbuf >>> + * >>> + * @return >>> + *  - On success, metadata >>> + *  - On failure, 0 >>> + */ >>> +uint64_t >>> +rte_security_get_pkt_metadata(struct rte_security_ctx *instance, >>> +                  struct rte_mbuf *pkt); >>> + >>> +/** >>>    * Attach a session to a symmetric crypto operation >>>    * >>>    * @param    sym_op    crypto operation >>> diff --git a/lib/librte_security/rte_security_driver.h >>> b/lib/librte_security/rte_security_driver.h >>> index 997fbe7..da0ebf4 100644 >>> --- a/lib/librte_security/rte_security_driver.h >>> +++ b/lib/librte_security/rte_security_driver.h >>> @@ -122,6 +122,20 @@ typedef int (*security_set_pkt_metadata_t)(void >>> *device, >>>           void *params); >>>     /** >>> + * Get application interpretable metadata from the packet. >>> + * >>> + * @param    device        Crypto/eth device pointer >>> + * @param    pkt        Packet mbuf >>> + * @param    mt        Pointer to receive metadata >>> + * >>> + * @return >>> + *  - Returns 0 if metadata is retrieved successfully. >>> + *  - Returns -ve value for errors. >>> + */ >>> +typedef int (*security_get_pkt_metadata_t)(void *device, >>> +        struct rte_mbuf *pkt, uint64_t *mt); >>> + >>> +/** >>>    * Get security capabilities of the device. >>>    * >>>    * @param    device        crypto/eth device pointer >>> @@ -145,6 +159,8 @@ struct rte_security_ops { >>>       /**< Clear a security sessions private data. */ >>>       security_set_pkt_metadata_t set_pkt_metadata; >>>       /**< Update mbuf metadata. */ >>> +    security_get_pkt_metadata_t get_pkt_metadata; >>> +    /**< Get metadata from packet. */ >>>       security_capabilities_get_t capabilities_get; >>>       /**< Get security capabilities. */ >>>   }; >> >