From: Nithin Dabilpuram <ndabilpuram@marvell.com>
To: Nithin Dabilpuram <ndabilpuram@marvell.com>,
Kiran Kumar K <kirankumark@marvell.com>,
Sunil Kumar Kori <skori@marvell.com>,
Satha Rao <skoteshwar@marvell.com>
Cc: <jerinj@marvell.com>, <dev@dpdk.org>,
Vidya Sagar Velumuri <vvelumuri@marvell.com>
Subject: [PATCH v3 30/32] net/cnxk: enable esn and antireplay support
Date: Mon, 12 Sep 2022 18:44:23 +0530 [thread overview]
Message-ID: <20220912131425.1973415-30-ndabilpuram@marvell.com> (raw)
In-Reply-To: <20220912131425.1973415-1-ndabilpuram@marvell.com>
From: Vidya Sagar Velumuri <vvelumuri@marvell.com>
Enable ESN and anti-replay in IPsec capabilities
Add support for session update security API
Fix the cpt command population for ESN enabled case
Signed-off-by: Vidya Sagar Velumuri <vvelumuri@marvell.com>
---
drivers/net/cnxk/cn9k_ethdev_sec.c | 139 ++++++++++++++++++++++++++++-
1 file changed, 137 insertions(+), 2 deletions(-)
diff --git a/drivers/net/cnxk/cn9k_ethdev_sec.c b/drivers/net/cnxk/cn9k_ethdev_sec.c
index 6a76090403..a96a4fa8cd 100644
--- a/drivers/net/cnxk/cn9k_ethdev_sec.c
+++ b/drivers/net/cnxk/cn9k_ethdev_sec.c
@@ -296,8 +296,10 @@ static const struct rte_security_capability cn9k_eth_sec_capabilities[] = {
.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
.direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
+ .replay_win_sz_max = CNXK_ON_AR_WIN_SIZE_MAX,
.options = {
- .udp_encap = 1
+ .udp_encap = 1,
+ .esn = 1
}
},
.crypto_capabilities = cn9k_eth_sec_crypto_caps,
@@ -312,7 +314,8 @@ static const struct rte_security_capability cn9k_eth_sec_capabilities[] = {
.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
.options = {
.udp_encap = 1,
- .iv_gen_disable = 1
+ .iv_gen_disable = 1,
+ .esn = 1
}
},
.crypto_capabilities = cn9k_eth_sec_crypto_caps,
@@ -375,6 +378,137 @@ outb_dbg_iv_update(struct roc_ie_on_common_sa *common_sa, const char *__iv_str)
free(iv_str);
}
+static int
+cn9k_eth_sec_session_update(void *device,
+ struct rte_security_session *sess,
+ struct rte_security_session_conf *conf)
+{
+ struct rte_eth_dev *eth_dev = (struct rte_eth_dev *)device;
+ struct cnxk_eth_dev *dev = cnxk_eth_pmd_priv(eth_dev);
+ struct rte_security_ipsec_xform *ipsec;
+ struct cn9k_outb_priv_data *outb_priv;
+ struct cnxk_ipsec_outb_rlens *rlens;
+ struct cn9k_sec_sess_priv sess_priv;
+ struct rte_crypto_sym_xform *crypto;
+ struct cnxk_eth_sec_sess *eth_sec;
+ struct roc_ie_on_outb_sa *outb_sa;
+ rte_spinlock_t *lock;
+ char tbuf[128] = {0};
+ const char *iv_str;
+ uint32_t sa_idx;
+ int ctx_len;
+ int rc = 0;
+
+ if (conf->action_type != RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL)
+ return -ENOTSUP;
+
+ if (conf->protocol != RTE_SECURITY_PROTOCOL_IPSEC)
+ return -ENOTSUP;
+
+ if (rte_security_dynfield_register() < 0)
+ return -ENOTSUP;
+
+ ipsec = &conf->ipsec;
+ crypto = conf->crypto_xform;
+
+ if (ipsec->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
+ return -ENOTSUP;
+
+ eth_sec = cnxk_eth_sec_sess_get_by_sess(dev, sess);
+ if (!eth_sec)
+ return -ENOENT;
+
+ eth_sec->spi = conf->ipsec.spi;
+
+ lock = &dev->outb.lock;
+ rte_spinlock_lock(lock);
+
+ outb_sa = eth_sec->sa;
+ outb_priv = roc_nix_inl_on_ipsec_outb_sa_sw_rsvd(outb_sa);
+ sa_idx = outb_priv->sa_idx;
+
+ /* Disable SA */
+ outb_sa->common_sa.ctl.valid = 0;
+
+ /* Sync SA content */
+ plt_atomic_thread_fence(__ATOMIC_ACQ_REL);
+
+ sess_priv.u64 = 0;
+ memset(outb_sa, 0, sizeof(struct roc_ie_on_outb_sa));
+
+ /* Fill outbound sa params */
+ rc = cnxk_on_ipsec_outb_sa_create(ipsec, crypto, outb_sa);
+ if (rc < 0) {
+ snprintf(tbuf, sizeof(tbuf),
+ "Failed to init outbound sa, rc=%d", rc);
+ rc |= cnxk_eth_outb_sa_idx_put(dev, sa_idx);
+ goto exit;
+ }
+
+ ctx_len = rc;
+ rc = roc_nix_inl_ctx_write(&dev->nix, outb_sa, outb_sa, false,
+ ctx_len);
+ if (rc) {
+ snprintf(tbuf, sizeof(tbuf),
+ "Failed to init outbound sa, rc=%d", rc);
+ rc |= cnxk_eth_outb_sa_idx_put(dev, sa_idx);
+ goto exit;
+ }
+
+ /* When IV is provided by the application,
+ * copy the IV to context and enable explicit IV flag in context.
+ */
+ if (ipsec->options.iv_gen_disable == 1) {
+ outb_sa->common_sa.ctl.explicit_iv_en = 1;
+ iv_str = getenv("ETH_SEC_IV_OVR");
+ if (iv_str)
+ outb_dbg_iv_update(&outb_sa->common_sa, iv_str);
+ }
+
+ outb_priv->userdata = conf->userdata;
+ outb_priv->eth_sec = eth_sec;
+ /* Start sequence number with 1 */
+ outb_priv->esn = ipsec->esn.value;
+
+ memcpy(&outb_priv->nonce, outb_sa->common_sa.iv.gcm.nonce, 4);
+ if (outb_sa->common_sa.ctl.enc_type == ROC_IE_ON_SA_ENC_AES_GCM)
+ outb_priv->copy_salt = 1;
+
+ rlens = &outb_priv->rlens;
+ /* Save rlen info */
+ cnxk_ipsec_outb_rlens_get(rlens, ipsec, crypto);
+
+ sess_priv.sa_idx = outb_priv->sa_idx;
+ sess_priv.roundup_byte = rlens->roundup_byte;
+ sess_priv.roundup_len = rlens->roundup_len;
+ sess_priv.partial_len = rlens->partial_len;
+
+ /* Pointer from eth_sec -> outb_sa */
+ eth_sec->sa = outb_sa;
+ eth_sec->sess = sess;
+ eth_sec->sa_idx = sa_idx;
+ eth_sec->spi = ipsec->spi;
+
+ /* Sync SA content */
+ plt_atomic_thread_fence(__ATOMIC_ACQ_REL);
+
+ rte_spinlock_unlock(lock);
+
+ plt_nix_dbg("Created outbound session with spi=%u, sa_idx=%u",
+ eth_sec->spi, eth_sec->sa_idx);
+
+ /* Update fast path info in priv area.
+ */
+ set_sec_session_private_data(sess, (void *)sess_priv.u64);
+
+ return 0;
+exit:
+ rte_spinlock_unlock(lock);
+ if (rc)
+ plt_err("%s", tbuf);
+ return rc;
+}
+
static int
cn9k_eth_sec_session_create(void *device,
struct rte_security_session_conf *conf,
@@ -677,6 +811,7 @@ cn9k_eth_sec_ops_override(void)
/* Update platform specific ops */
cnxk_eth_sec_ops.session_create = cn9k_eth_sec_session_create;
+ cnxk_eth_sec_ops.session_update = cn9k_eth_sec_session_update;
cnxk_eth_sec_ops.session_destroy = cn9k_eth_sec_session_destroy;
cnxk_eth_sec_ops.capabilities_get = cn9k_eth_sec_capabilities_get;
}
--
2.25.1
next prev parent reply other threads:[~2022-09-12 13:18 UTC|newest]
Thread overview: 89+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-09 18:48 [PATCH 01/23] common/cnxk: fix part value for cn10k Nithin Dabilpuram
2022-08-09 18:48 ` [PATCH 02/23] common/cnxk: add cn10ka A1 platform Nithin Dabilpuram
2022-08-09 18:48 ` [PATCH 03/23] common/cnxk: update inbound inline IPsec config mailbox Nithin Dabilpuram
2022-08-09 18:48 ` [PATCH 04/23] net/cnxk: fix missing fc wait for outbound path in vec mode Nithin Dabilpuram
2022-08-09 18:48 ` [PATCH 05/23] common/cnxk: limit meta aura workaround to CN10K A0 Nithin Dabilpuram
2022-08-09 18:48 ` [PATCH 06/23] common/cnxk: delay inline device RQ enable to dev start Nithin Dabilpuram
2022-08-09 18:48 ` [PATCH 07/23] common/cnxk: reserve aura zero on cn10ka NPA Nithin Dabilpuram
2022-08-09 18:48 ` [PATCH 08/23] common/cnxk: add support to set NPA buf type Nithin Dabilpuram
2022-08-09 18:48 ` [PATCH 09/23] common/cnxk: update attributes to pools used by NIX Nithin Dabilpuram
2022-08-09 18:48 ` [PATCH 10/23] common/cnxk: support zero aura for inline inbound meta Nithin Dabilpuram
2022-08-09 18:48 ` [PATCH 11/23] net/cnxk: support for zero aura for inline meta Nithin Dabilpuram
2022-08-09 18:48 ` [PATCH 12/23] common/cnxk: avoid the use of platform specific APIs Nithin Dabilpuram
2022-08-09 18:48 ` [PATCH 13/23] net/cnxk: use full context IPsec structures in fp Nithin Dabilpuram
2022-08-09 18:48 ` [PATCH 14/23] net/cnxk: add crypto capabilities for HMAC-SHA2 Nithin Dabilpuram
2022-08-09 18:48 ` [PATCH 15/23] common/cnxk: enable aging on CN10K platform Nithin Dabilpuram
2022-08-09 18:49 ` [PATCH 16/23] common/cnxk: updated shaper profile with red algorithm Nithin Dabilpuram
2022-08-09 18:49 ` [PATCH 17/23] common/cnxk: add 98xx A1 platform Nithin Dabilpuram
2022-08-09 18:49 ` [PATCH 18/23] net/cnxk: enable additional ciphers for inline Nithin Dabilpuram
2022-08-09 18:49 ` [PATCH 19/23] net/cnxk: enable 3des-cbc cipher capability Nithin Dabilpuram
2022-08-09 18:49 ` [PATCH 20/23] net/cnxk: skip PFC configuration on LBK Nithin Dabilpuram
2022-08-09 18:49 ` [PATCH 21/23] common/cnxk: add support for CPT second pass Nithin Dabilpuram
2022-08-09 18:49 ` [PATCH 22/23] common/cnxk: add CQ limit associated with SQ Nithin Dabilpuram
2022-08-09 18:49 ` [PATCH 23/23] common/cnxk: support Tx compl event via RQ to CQ mapping Nithin Dabilpuram
2022-08-30 4:51 ` [PATCH 01/23] common/cnxk: fix part value for cn10k Jerin Jacob
2022-08-30 5:16 ` [EXT] " Nithin Kumar Dabilpuram
2022-09-05 13:31 ` [PATCH v2 01/31] cnxk/net: add fc check in vector event Tx path Nithin Dabilpuram
2022-09-05 13:31 ` [PATCH v2 02/31] common/cnxk: fix part value for cn10k Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 03/31] common/cnxk: add cn10ka A1 platform Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 04/31] common/cnxk: update inbound inline IPsec config mailbox Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 05/31] net/cnxk: fix missing fc wait for outbound path in vec mode Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 06/31] common/cnxk: limit meta aura workaround to CN10K A0 Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 07/31] common/cnxk: delay inline device RQ enable to dev start Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 08/31] common/cnxk: reserve aura zero on cn10ka NPA Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 09/31] common/cnxk: add support to set NPA buf type Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 10/31] common/cnxk: update attributes to pools used by NIX Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 11/31] common/cnxk: support zero aura for inline inbound meta Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 12/31] net/cnxk: support for zero aura for inline meta Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 13/31] common/cnxk: avoid the use of platform specific APIs Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 14/31] net/cnxk: use full context IPsec structures in fp Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 15/31] net/cnxk: add crypto capabilities for HMAC-SHA2 Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 16/31] common/cnxk: enable aging on CN10K platform Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 17/31] common/cnxk: updated shaper profile with red algorithm Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 18/31] common/cnxk: add 98xx A1 platform Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 19/31] net/cnxk: enable additional ciphers for inline Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 20/31] net/cnxk: enable 3des-cbc cipher capability Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 21/31] net/cnxk: skip PFC configuration on LBK Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 22/31] common/cnxk: add support for CPT second pass Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 23/31] common/cnxk: add CQ limit associated with SQ Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 24/31] common/cnxk: support Tx compl event via RQ to CQ mapping Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 25/31] event/cnxk: wait for CPT fc on wqe path Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 26/31] net/cnxk: limit port specific SA table size Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 27/31] net/cnxk: add support for crypto cipher DES-CBC Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 28/31] net/cnxk: Add support for crypto auth alg MD5 Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 29/31] net/cnxk: enable esn and antireplay support Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 30/31] common/cnxk: dump device basic info to file Nithin Dabilpuram
2022-09-05 13:32 ` [PATCH v2 31/31] net/cnxk: dumps device private information Nithin Dabilpuram
2022-09-12 13:13 ` [PATCH v3 01/32] net/cnxk: add eth port specific PTP enable Nithin Dabilpuram
2022-09-12 13:13 ` [PATCH v3 02/32] cnxk/net: add fc check in vector event Tx path Nithin Dabilpuram
2022-09-12 13:13 ` [PATCH v3 03/32] common/cnxk: fix part value for cn10k Nithin Dabilpuram
2022-09-12 13:13 ` [PATCH v3 04/32] common/cnxk: add cn10ka A1 platform Nithin Dabilpuram
2022-09-12 13:13 ` [PATCH v3 05/32] common/cnxk: update inbound inline IPsec config mailbox Nithin Dabilpuram
2022-09-12 13:13 ` [PATCH v3 06/32] net/cnxk: fix missing fc wait for outbound path in vec mode Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 07/32] common/cnxk: limit meta aura workaround to CN10K A0 Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 08/32] common/cnxk: delay inline device RQ enable to dev start Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 09/32] common/cnxk: reserve aura zero on cn10ka NPA Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 10/32] common/cnxk: add support to set NPA buf type Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 11/32] common/cnxk: update attributes to pools used by NIX Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 12/32] common/cnxk: support zero aura for inline inbound meta Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 13/32] net/cnxk: support for zero aura for inline meta Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 14/32] common/cnxk: avoid the use of platform specific APIs Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 15/32] net/cnxk: use full context IPsec structures in fp Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 16/32] net/cnxk: add crypto capabilities for HMAC-SHA2 Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 17/32] common/cnxk: enable aging on CN10K platform Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 18/32] common/cnxk: updated shaper profile with red algorithm Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 19/32] common/cnxk: add 98xx A1 platform Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 20/32] net/cnxk: enable additional ciphers for inline Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 21/32] net/cnxk: enable 3des-cbc cipher capability Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 22/32] net/cnxk: skip PFC configuration on LBK Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 23/32] common/cnxk: add support for CPT second pass Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 24/32] common/cnxk: add CQ limit associated with SQ Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 25/32] common/cnxk: support Tx compl event via RQ to CQ mapping Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 26/32] event/cnxk: wait for CPT fc on wqe path Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 27/32] net/cnxk: limit port specific SA table size Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 28/32] net/cnxk: add support for crypto cipher DES-CBC Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 29/32] net/cnxk: add support for crypto auth alg MD5 Nithin Dabilpuram
2022-09-12 13:14 ` Nithin Dabilpuram [this message]
2022-09-12 13:14 ` [PATCH v3 31/32] common/cnxk: dump device basic info to file Nithin Dabilpuram
2022-09-12 13:14 ` [PATCH v3 32/32] net/cnxk: dumps device private information Nithin Dabilpuram
2022-09-16 11:36 ` Jerin Jacob
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220912131425.1973415-30-ndabilpuram@marvell.com \
--to=ndabilpuram@marvell.com \
--cc=dev@dpdk.org \
--cc=jerinj@marvell.com \
--cc=kirankumark@marvell.com \
--cc=skori@marvell.com \
--cc=skoteshwar@marvell.com \
--cc=vvelumuri@marvell.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).