From: Nithin Dabilpuram <ndabilpuram@marvell.com>
To: <gakhil@marvell.com>,
Cristian Dumitrescu <cristian.dumitrescu@intel.com>
Cc: <jerinj@marvell.com>, <dev@dpdk.org>,
Nithin Dabilpuram <ndabilpuram@marvell.com>
Subject: [PATCH v2 1/3] security: introduce out of place support for inline ingress
Date: Thu, 21 Sep 2023 07:45:46 +0530 [thread overview]
Message-ID: <20230921021548.1196858-1-ndabilpuram@marvell.com> (raw)
In-Reply-To: <20230309085645.1630826-1-ndabilpuram@marvell.com>
Similar to out of place(OOP) processing support that exists for
Lookaside crypto/security sessions, Inline ingress security
sessions may also need out of place processing in usecases
where original encrypted packet needs to be retained for post
processing. So for NIC's which have such a kind of HW support,
a new SA option is provided to indicate whether OOP needs to
be enabled on that Inline ingress security session or not.
Since for inline ingress sessions, packet is not received by
CPU until the processing is done, we can only have per-SA
option and not per-packet option like Lookaside sessions.
Also remove reserved_opts field from the rte_security_ipsec_sa_options
struct as mentioned in deprecation notice.
Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
---
v2:
- Fix documentation issue in 1/3 and update release notes
v1:
- Removed reserved_opts field from sa_options struct
doc/guides/rel_notes/deprecation.rst | 5 ----
doc/guides/rel_notes/release_23_11.rst | 8 ++++++
lib/pipeline/rte_swx_ipsec.c | 1 -
lib/security/rte_security.c | 17 +++++++++++
lib/security/rte_security.h | 40 ++++++++++++++++++++++----
lib/security/rte_security_driver.h | 8 ++++++
lib/security/version.map | 2 ++
7 files changed, 69 insertions(+), 12 deletions(-)
diff --git a/doc/guides/rel_notes/deprecation.rst b/doc/guides/rel_notes/deprecation.rst
index bcd02e7762..8311035f2d 100644
--- a/doc/guides/rel_notes/deprecation.rst
+++ b/doc/guides/rel_notes/deprecation.rst
@@ -147,11 +147,6 @@ Deprecation Notices
* security: Hide structures ``rte_security_ops`` and ``rte_security_ctx``
as these are internal to DPDK library and drivers.
-* security: New SA option ``ingress_oop`` would be added in structure
- ``rte_security_ipsec_sa_options`` to support out of place processing
- for inline inbound SA from DPDK 23.11. ``reserved_opts`` field in the
- same struct would be removed as discussed in techboard meeting.
-
* eventdev: The single-event (non-burst) enqueue and dequeue operations,
used by static inline burst enqueue and dequeue functions in ``rte_eventdev.h``,
will be removed in DPDK 23.11.
diff --git a/doc/guides/rel_notes/release_23_11.rst b/doc/guides/rel_notes/release_23_11.rst
index 55ba7c16ae..85d4a929b0 100644
--- a/doc/guides/rel_notes/release_23_11.rst
+++ b/doc/guides/rel_notes/release_23_11.rst
@@ -86,6 +86,10 @@ New Features
Enabled support for QAT 2.0c (4944) devices in QAT crypto driver.
+* **Added out of place processing support for inline ingress security session.**
+
+ Similar to out of place processing support for lookaside security session, added
+ the same support for inline ingress security session.
Removed Items
-------------
@@ -109,6 +113,8 @@ Removed Items
``rte_crypto_auth_algorithm_strings``, ``rte_crypto_aead_algorithm_strings`` and
``rte_crypto_asym_xform_strings``.
+* security: Removed deprecated field ``reserved_opts`` from struct
+ ``rte_security_ipsec_sa_options``.
API Changes
-----------
@@ -141,6 +147,8 @@ ABI Changes
Also, make sure to start the actual text at the margin.
=======================================================
+* security: struct ``rte_security_ipsec_sa_options`` was updated due to inline
+ out-of-place feature addition.
Known Issues
------------
diff --git a/lib/pipeline/rte_swx_ipsec.c b/lib/pipeline/rte_swx_ipsec.c
index 6c217ee797..28576c2a48 100644
--- a/lib/pipeline/rte_swx_ipsec.c
+++ b/lib/pipeline/rte_swx_ipsec.c
@@ -1555,7 +1555,6 @@ ipsec_xform_get(struct rte_swx_ipsec_sa_params *p,
ipsec_xform->options.ip_csum_enable = 0;
ipsec_xform->options.l4_csum_enable = 0;
ipsec_xform->options.ip_reassembly_en = 0;
- ipsec_xform->options.reserved_opts = 0;
ipsec_xform->direction = p->encrypt ?
RTE_SECURITY_IPSEC_SA_DIR_EGRESS :
diff --git a/lib/security/rte_security.c b/lib/security/rte_security.c
index 2d729b735b..42af4a2c35 100644
--- a/lib/security/rte_security.c
+++ b/lib/security/rte_security.c
@@ -27,7 +27,10 @@
} while (0)
#define RTE_SECURITY_DYNFIELD_NAME "rte_security_dynfield_metadata"
+#define RTE_SECURITY_OOP_DYNFIELD_NAME "rte_security_oop_dynfield_metadata"
+
int rte_security_dynfield_offset = -1;
+int rte_security_oop_dynfield_offset = -1;
int
rte_security_dynfield_register(void)
@@ -42,6 +45,20 @@ rte_security_dynfield_register(void)
return rte_security_dynfield_offset;
}
+int
+rte_security_oop_dynfield_register(void)
+{
+ static const struct rte_mbuf_dynfield dynfield_desc = {
+ .name = RTE_SECURITY_OOP_DYNFIELD_NAME,
+ .size = sizeof(rte_security_oop_dynfield_t),
+ .align = __alignof__(rte_security_oop_dynfield_t),
+ };
+
+ rte_security_oop_dynfield_offset =
+ rte_mbuf_dynfield_register(&dynfield_desc);
+ return rte_security_oop_dynfield_offset;
+}
+
void *
rte_security_session_create(struct rte_security_ctx *instance,
struct rte_security_session_conf *conf,
diff --git a/lib/security/rte_security.h b/lib/security/rte_security.h
index 439bbb957f..da58fe1f14 100644
--- a/lib/security/rte_security.h
+++ b/lib/security/rte_security.h
@@ -273,14 +273,16 @@ struct rte_security_ipsec_sa_options {
*/
uint32_t ip_reassembly_en : 1;
- /** Reserved bit fields for future extension
+ /** Enable out of place processing on inline inbound packets.
*
- * User should ensure reserved_opts is cleared as it may change in
- * subsequent releases to support new options.
- *
- * Note: Reduce number of bits in reserved_opts for every new option.
+ * * 1: Enable driver to perform Out-of-place(OOP) processing for this inline
+ * inbound SA if supported by driver. PMD need to register mbuf
+ * dynamic field using rte_security_oop_dynfield_register()
+ * and security session creation would fail if dynfield is not
+ * registered successfully.
+ * * 0: Disable OOP processing for this session (default).
*/
- uint32_t reserved_opts : 17;
+ uint32_t ingress_oop : 1;
};
/** IPSec security association direction */
@@ -825,6 +827,13 @@ typedef uint64_t rte_security_dynfield_t;
/** Dynamic mbuf field for device-specific metadata */
extern int rte_security_dynfield_offset;
+/** Out-of-Place(OOP) processing field type */
+typedef struct rte_mbuf *rte_security_oop_dynfield_t;
+/** Dynamic mbuf field for pointer to original mbuf for
+ * OOP processing session.
+ */
+extern int rte_security_oop_dynfield_offset;
+
/**
* @warning
* @b EXPERIMENTAL: this API may change without prior notice
@@ -847,6 +856,25 @@ rte_security_dynfield(struct rte_mbuf *mbuf)
rte_security_dynfield_t *);
}
+/**
+ * @warning
+ * @b EXPERIMENTAL: this API may change without prior notice
+ *
+ * Get pointer to mbuf field for original mbuf pointer when
+ * Out-Of-Place(OOP) processing is enabled in security session.
+ *
+ * @param mbuf packet to access
+ * @return pointer to mbuf field
+ */
+__rte_experimental
+static inline rte_security_oop_dynfield_t *
+rte_security_oop_dynfield(struct rte_mbuf *mbuf)
+{
+ return RTE_MBUF_DYNFIELD(mbuf,
+ rte_security_oop_dynfield_offset,
+ rte_security_oop_dynfield_t *);
+}
+
/**
* @warning
* @b EXPERIMENTAL: this API may change without prior notice
diff --git a/lib/security/rte_security_driver.h b/lib/security/rte_security_driver.h
index 31444a05d3..1e6a6ef8e3 100644
--- a/lib/security/rte_security_driver.h
+++ b/lib/security/rte_security_driver.h
@@ -197,6 +197,14 @@ typedef int (*security_macsec_sa_stats_get_t)(void *device, uint16_t sa_id,
__rte_internal
int rte_security_dynfield_register(void);
+/**
+ * @internal
+ * Register mbuf dynamic field for security inline ingress Out-of-Place(OOP)
+ * processing.
+ */
+__rte_internal
+int rte_security_oop_dynfield_register(void);
+
/**
* Update the mbuf with provided metadata.
*
diff --git a/lib/security/version.map b/lib/security/version.map
index b2097a969d..86f976a302 100644
--- a/lib/security/version.map
+++ b/lib/security/version.map
@@ -23,10 +23,12 @@ EXPERIMENTAL {
rte_security_macsec_sc_stats_get;
rte_security_session_stats_get;
rte_security_session_update;
+ rte_security_oop_dynfield_offset;
};
INTERNAL {
global:
rte_security_dynfield_register;
+ rte_security_oop_dynfield_register;
};
--
2.25.1
next prev parent reply other threads:[~2023-09-21 2:18 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-09 8:56 [RFC 1/2] " Nithin Dabilpuram
2023-03-09 8:56 ` [RFC 2/2] test/security: add unittest for inline ingress oop Nithin Dabilpuram
2023-04-11 10:04 ` [PATCH 1/3] security: introduce out of place support for inline ingress Nithin Dabilpuram
2023-04-11 10:04 ` [PATCH 2/3] net/cnxk: support inline ingress out of place session Nithin Dabilpuram
2023-04-11 10:04 ` [PATCH 3/3] test/security: add unittest for inline ingress oop Nithin Dabilpuram
2023-04-11 18:05 ` [PATCH 1/3] security: introduce out of place support for inline ingress Stephen Hemminger
2023-04-18 8:33 ` Jerin Jacob
2023-04-24 22:41 ` Thomas Monjalon
2023-05-19 8:07 ` Jerin Jacob
2023-05-30 9:23 ` Jerin Jacob
2023-05-30 13:51 ` Thomas Monjalon
2023-05-31 9:26 ` Morten Brørup
2023-07-01 7:15 ` [PATCH] doc: announce addition of new security IPsec SA option Nithin Dabilpuram
2023-07-03 14:35 ` Akhil Goyal
2023-07-04 5:15 ` [PATCH v2] " Nithin Dabilpuram
2023-07-05 14:07 ` Jerin Jacob
2023-07-11 8:55 ` [EXT] " Akhil Goyal
2023-07-06 23:05 ` [PATCH] " Ji, Kai
2023-08-11 8:54 ` [PATCH 1/3] security: introduce out of place support for inline ingress Nithin Dabilpuram
2023-08-11 8:54 ` [PATCH 2/3] net/cnxk: support inline ingress out of place session Nithin Dabilpuram
2023-08-11 8:54 ` [PATCH 3/3] test/security: add unittest for inline ingress oop Nithin Dabilpuram
2023-09-19 19:55 ` [PATCH 1/3] security: introduce out of place support for inline ingress Akhil Goyal
2023-09-21 2:15 ` Nithin Dabilpuram [this message]
2023-09-21 2:15 ` [PATCH v2 2/3] net/cnxk: support inline ingress out of place session Nithin Dabilpuram
2023-09-21 2:15 ` [PATCH v2 3/3] test/security: add unittest for inline ingress oop Nithin Dabilpuram
2023-09-21 10:44 ` [PATCH v2 1/3] security: introduce out of place support for inline ingress Akhil Goyal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230921021548.1196858-1-ndabilpuram@marvell.com \
--to=ndabilpuram@marvell.com \
--cc=cristian.dumitrescu@intel.com \
--cc=dev@dpdk.org \
--cc=gakhil@marvell.com \
--cc=jerinj@marvell.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).