DPDK patches and discussions
 help / color / mirror / Atom feed
* [dpdk-dev] [PATCH] ethdev: allow multiple security sessions to use one rte flow
@ 2019-12-08 10:41 Anoob Joseph
  2019-12-09  7:37 ` Jerin Jacob
  2019-12-09 13:18 ` Ananyev, Konstantin
  0 siblings, 2 replies; 30+ messages in thread
From: Anoob Joseph @ 2019-12-08 10:41 UTC (permalink / raw)
  To: Akhil Goyal, Adrien Mazarguil, Declan Doherty, Ferruh Yigit,
	Jerin Jacob, Thomas Monjalon
  Cc: Anoob Joseph, Ankur Dwivedi, Hemant Agrawal, Konstantin Ananyev,
	Matan Azrad, Radu Nicolau, Shahaf Shuler, Narayana Prasad, dev

The rte_security API which enables inline protocol/crypto feature
mandates that for every security session an rte_flow is created. This
would internally translate to a rule in the hardware which would do
packet classification.

In rte_securty, one SA would be one security session. And if an rte_flow
need to be created for every session, the number of SAs supported by an
inline implementation would be limited by the number of rte_flows the
PMD would be able to support.

If the fields SPI & IP addresses are allowed to be a range, then this
limitation can be overcome. Multiple flows will be able to use one rule
for SECURITY processing. In this case, the security session provided as
conf would be NULL.

Application should do an rte_flow_validate() to make sure the flow is
supported on the PMD.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
---
 lib/librte_ethdev/rte_flow.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/librte_ethdev/rte_flow.h b/lib/librte_ethdev/rte_flow.h
index 452d359..21fa7ed 100644
--- a/lib/librte_ethdev/rte_flow.h
+++ b/lib/librte_ethdev/rte_flow.h
@@ -2239,6 +2239,12 @@ struct rte_flow_action_meter {
  * direction.
  *
  * Multiple flows can be configured to use the same security session.
+ *
+ * The NULL value is allowed for security session. If security session is NULL,
+ * then SPI field in ESP flow item and IP addresses in flow items 'IPv4' and
+ * 'IPv6' will be allowed to be a range. The rule thus created can enable
+ * SECURITY processing on multiple flows.
+ *
  */
 struct rte_flow_action_security {
 	void *security_session; /**< Pointer to security session structure. */
-- 
2.7.4


^ permalink raw reply	[flat|nested] 30+ messages in thread

end of thread, other threads:[~2020-01-20  9:51 UTC | newest]

Thread overview: 30+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-12-08 10:41 [dpdk-dev] [PATCH] ethdev: allow multiple security sessions to use one rte flow Anoob Joseph
2019-12-09  7:37 ` Jerin Jacob
2019-12-10 20:47   ` Ori Kam
2020-01-20  9:51     ` Thomas Monjalon
2019-12-09 13:18 ` Ananyev, Konstantin
2019-12-09 13:57   ` Anoob Joseph
2019-12-11 11:06     ` Ananyev, Konstantin
2019-12-11 17:33       ` Anoob Joseph
2019-12-13 11:55         ` Ananyev, Konstantin
2019-12-15  6:07           ` Anoob Joseph
2019-12-16 12:54             ` Ananyev, Konstantin
2019-12-16 15:37               ` Anoob Joseph
2019-12-16 15:58         ` Medvedkin, Vladimir
2019-12-16 16:16           ` [dpdk-dev] [EXT] " Anoob Joseph
2019-12-17 11:21             ` Medvedkin, Vladimir
2019-12-17 14:24               ` Anoob Joseph
2019-12-17 17:44                 ` Medvedkin, Vladimir
2019-12-18  3:54                   ` Anoob Joseph
2019-12-18 13:52                     ` Medvedkin, Vladimir
2019-12-19  4:37                       ` Anoob Joseph
2019-12-19 17:45                         ` Medvedkin, Vladimir
2019-12-23 13:34                         ` Ananyev, Konstantin
2020-01-08 14:29                           ` Medvedkin, Vladimir
2020-01-09  7:35                             ` Ori Kam
2020-01-14  9:27                               ` Anoob Joseph
2020-01-16 11:36                                 ` Ori Kam
2020-01-16 12:03                                   ` Anoob Joseph
2020-01-16 13:37                                     ` Ori Kam
2020-01-18  8:11                                       ` Anoob Joseph
2020-01-19  7:25                                         ` Ori Kam

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).