DPDK patches and discussions
 help / color / mirror / Atom feed
From: Anoob Joseph <anoobj@marvell.com>
To: Akhil Goyal <gakhil@marvell.com>, Thomas Monjalon <thomas@monjalon.net>
Cc: Tejasree Kondoj <ktejasree@marvell.com>,
	Jerin Jacob <jerinj@marvell.com>,
	 Ankur Dwivedi <adwivedi@marvell.com>, <dev@dpdk.org>,
	Anoob Joseph <anoobj@marvell.com>,
	Srujana Challa <schalla@marvell.com>
Subject: [dpdk-dev] [PATCH v2 3/4] crypto/cnxk: add security handling in datapath ops
Date: Fri, 25 Jun 2021 11:45:07 +0530	[thread overview]
Message-ID: <1624601708-29991-4-git-send-email-anoobj@marvell.com> (raw)
In-Reply-To: <1624601708-29991-1-git-send-email-anoobj@marvell.com>

From: Tejasree Kondoj <ktejasree@marvell.com>

Add security handling in enqueue dequeue ops.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
Signed-off-by: Srujana Challa <schalla@marvell.com>
Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
---
 drivers/crypto/cnxk/cn10k_cryptodev_ops.c | 78 ++++++++++++++++++++++++++++++-
 drivers/crypto/cnxk/cn10k_ipsec_la_ops.h  | 74 +++++++++++++++++++++++++++++
 2 files changed, 151 insertions(+), 1 deletion(-)
 create mode 100644 drivers/crypto/cnxk/cn10k_ipsec_la_ops.h

diff --git a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c
index 6207627..29525cd 100644
--- a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c
+++ b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c
@@ -4,9 +4,12 @@
 
 #include <rte_cryptodev.h>
 #include <rte_cryptodev_pmd.h>
+#include <rte_ip.h>
 
 #include "cn10k_cryptodev.h"
 #include "cn10k_cryptodev_ops.h"
+#include "cn10k_ipsec_la_ops.h"
+#include "cn10k_ipsec.h"
 #include "cnxk_cryptodev.h"
 #include "cnxk_cryptodev_ops.h"
 #include "cnxk_se.h"
@@ -42,6 +45,38 @@ cn10k_cpt_sym_temp_sess_create(struct cnxk_cpt_qp *qp, struct rte_crypto_op *op)
 }
 
 static __rte_always_inline int __rte_hot
+cpt_sec_inst_fill(struct rte_crypto_op *op, struct cn10k_sec_session *sess,
+		  struct cpt_inflight_req *infl_req, struct cpt_inst_s *inst)
+{
+	struct rte_crypto_sym_op *sym_op = op->sym;
+	union roc_ot_ipsec_sa_word2 *w2;
+	struct cn10k_ipsec_sa *sa;
+	int ret;
+
+	if (unlikely(sym_op->m_dst && sym_op->m_dst != sym_op->m_src)) {
+		plt_dp_err("Out of place is not supported");
+		return -ENOTSUP;
+	}
+
+	if (unlikely(!rte_pktmbuf_is_contiguous(sym_op->m_src))) {
+		plt_dp_err("Scatter Gather mode is not supported");
+		return -ENOTSUP;
+	}
+
+	sa = &sess->sa;
+	w2 = (union roc_ot_ipsec_sa_word2 *)&sa->in_sa.w2;
+
+	if (w2->s.dir == ROC_IE_OT_SA_DIR_OUTBOUND)
+		ret = process_outb_sa(op, sa, inst);
+	else {
+		infl_req->op_flags |= CPT_OP_FLAGS_IPSEC_DIR_INBOUND;
+		ret = process_inb_sa(op, sa, inst);
+	}
+
+	return ret;
+}
+
+static __rte_always_inline int __rte_hot
 cpt_sym_inst_fill(struct cnxk_cpt_qp *qp, struct rte_crypto_op *op,
 		  struct cnxk_se_sess *sess, struct cpt_inflight_req *infl_req,
 		  struct cpt_inst_s *inst)
@@ -64,6 +99,7 @@ static inline int
 cn10k_cpt_fill_inst(struct cnxk_cpt_qp *qp, struct rte_crypto_op *ops[],
 		    struct cpt_inst_s inst[], struct cpt_inflight_req *infl_req)
 {
+	struct cn10k_sec_session *sec_sess;
 	struct rte_crypto_sym_op *sym_op;
 	struct cnxk_se_sess *sess;
 	struct rte_crypto_op *op;
@@ -79,7 +115,15 @@ cn10k_cpt_fill_inst(struct cnxk_cpt_qp *qp, struct rte_crypto_op *ops[],
 	sym_op = op->sym;
 
 	if (op->type == RTE_CRYPTO_OP_TYPE_SYMMETRIC) {
-		if (op->sess_type == RTE_CRYPTO_OP_WITH_SESSION) {
+		if (op->sess_type == RTE_CRYPTO_OP_SECURITY_SESSION) {
+			sec_sess = get_sec_session_private_data(
+				sym_op->sec_session);
+			ret = cpt_sec_inst_fill(op, sec_sess, infl_req,
+						&inst[0]);
+			if (unlikely(ret))
+				return 0;
+			w7 = sec_sess->sa.inst.w7;
+		} else if (op->sess_type == RTE_CRYPTO_OP_WITH_SESSION) {
 			sess = get_sym_session_private_data(
 				sym_op->session, cn10k_cryptodev_driver_id);
 			ret = cpt_sym_inst_fill(qp, op, sess, infl_req,
@@ -196,6 +240,34 @@ cn10k_cpt_enqueue_burst(void *qptr, struct rte_crypto_op **ops, uint16_t nb_ops)
 }
 
 static inline void
+cn10k_cpt_sec_post_process(struct rte_crypto_op *cop,
+			   struct cpt_inflight_req *infl_req)
+{
+	struct rte_crypto_sym_op *sym_op = cop->sym;
+	struct rte_mbuf *m = sym_op->m_src;
+	struct rte_ipv6_hdr *ip6;
+	struct rte_ipv4_hdr *ip;
+	uint16_t m_len;
+
+	if (infl_req->op_flags & CPT_OP_FLAGS_IPSEC_DIR_INBOUND) {
+		ip = (struct rte_ipv4_hdr *)rte_pktmbuf_mtod(m, char *);
+
+		if (((ip->version_ihl & 0xf0) >> RTE_IPV4_IHL_MULTIPLIER) ==
+		    IPVERSION) {
+			m_len = rte_be_to_cpu_16(ip->total_length);
+		} else {
+			PLT_ASSERT(((ip->version_ihl & 0xf0) >>
+				    RTE_IPV4_IHL_MULTIPLIER) == IPV6_VERSION);
+			ip6 = (struct rte_ipv6_hdr *)ip;
+			m_len = rte_be_to_cpu_16(ip6->payload_len) +
+				sizeof(struct rte_ipv6_hdr);
+		}
+		m->data_len = m_len;
+		m->pkt_len = m_len;
+	}
+}
+
+static inline void
 cn10k_cpt_dequeue_post_process(struct cnxk_cpt_qp *qp,
 			       struct rte_crypto_op *cop,
 			       struct cpt_inflight_req *infl_req)
@@ -219,6 +291,10 @@ cn10k_cpt_dequeue_post_process(struct cnxk_cpt_qp *qp,
 
 		cop->status = RTE_CRYPTO_OP_STATUS_SUCCESS;
 		if (cop->type == RTE_CRYPTO_OP_TYPE_SYMMETRIC) {
+			if (cop->sess_type == RTE_CRYPTO_OP_SECURITY_SESSION) {
+				cn10k_cpt_sec_post_process(cop, infl_req);
+				return;
+			}
 
 			/* Verify authentication data if required */
 			if (unlikely(infl_req->op_flags &
diff --git a/drivers/crypto/cnxk/cn10k_ipsec_la_ops.h b/drivers/crypto/cnxk/cn10k_ipsec_la_ops.h
new file mode 100644
index 0000000..1e9ebb5
--- /dev/null
+++ b/drivers/crypto/cnxk/cn10k_ipsec_la_ops.h
@@ -0,0 +1,74 @@
+/* SPDX-License-Identifier: BSD-3-Clause
+ * Copyright(C) 2021 Marvell.
+ */
+
+#ifndef __CN10K_IPSEC_LA_OPS_H__
+#define __CN10K_IPSEC_LA_OPS_H__
+
+#include <rte_crypto_sym.h>
+#include <rte_security.h>
+
+#include "cn10k_cryptodev.h"
+#include "cn10k_ipsec.h"
+#include "cnxk_cryptodev.h"
+
+static __rte_always_inline int32_t
+ipsec_po_out_rlen_get(struct cn10k_ipsec_sa *sess, uint32_t plen)
+{
+	uint32_t enc_payload_len;
+
+	enc_payload_len =
+		RTE_ALIGN_CEIL(plen + sess->roundup_len, sess->roundup_byte);
+
+	return sess->partial_len + enc_payload_len;
+}
+
+static __rte_always_inline int
+process_outb_sa(struct rte_crypto_op *cop, struct cn10k_ipsec_sa *sess,
+		struct cpt_inst_s *inst)
+{
+	struct rte_crypto_sym_op *sym_op = cop->sym;
+	struct rte_mbuf *m_src = sym_op->m_src;
+	uint32_t dlen, rlen, extend_tail;
+	char *mdata;
+
+	dlen = rte_pktmbuf_pkt_len(m_src);
+	rlen = ipsec_po_out_rlen_get(sess, dlen);
+
+	extend_tail = rlen - dlen;
+
+	mdata = rte_pktmbuf_append(m_src, extend_tail);
+	if (unlikely(mdata == NULL)) {
+		plt_dp_err("Not enough tail room");
+		return -ENOMEM;
+	}
+
+	/* Prepare CPT instruction */
+	inst->w4.u64 = sess->inst.w4;
+	inst->w4.s.dlen = dlen;
+	inst->dptr = rte_pktmbuf_iova(m_src);
+	inst->rptr = inst->dptr;
+
+	return 0;
+}
+
+static __rte_always_inline int
+process_inb_sa(struct rte_crypto_op *cop, struct cn10k_ipsec_sa *sa,
+	       struct cpt_inst_s *inst)
+{
+	struct rte_crypto_sym_op *sym_op = cop->sym;
+	struct rte_mbuf *m_src = sym_op->m_src;
+	uint32_t dlen;
+
+	dlen = rte_pktmbuf_pkt_len(m_src);
+
+	/* Prepare CPT instruction */
+	inst->w4.u64 = sa->inst.w4;
+	inst->w4.s.dlen = dlen;
+	inst->dptr = rte_pktmbuf_iova(m_src);
+	inst->rptr = inst->dptr;
+
+	return 0;
+}
+
+#endif /* __CN10K_IPSEC_LA_OPS_H__ */
-- 
2.7.4


  parent reply	other threads:[~2021-06-25  6:15 UTC|newest]

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-02 17:10 [dpdk-dev] [PATCH 0/4] Add rte_security in crypto_cn10k PMD Anoob Joseph
2021-06-02 17:10 ` [dpdk-dev] [PATCH 1/4] crypto/cnxk: add security ctx skeleton Anoob Joseph
2021-06-16 20:14   ` Akhil Goyal
2021-06-25  6:15   ` [dpdk-dev] [PATCH v2 0/4] Add rte_security in crypto_cn10k PMD Anoob Joseph
2021-06-25  6:15     ` [dpdk-dev] [PATCH v2 1/4] crypto/cnxk: add security ctx skeleton Anoob Joseph
2021-06-25  6:15     ` [dpdk-dev] [PATCH v2 2/4] crypto/cnxk: add security session ops Anoob Joseph
2021-06-25  6:15     ` Anoob Joseph [this message]
2021-06-25  6:15     ` [dpdk-dev] [PATCH v2 4/4] crypto/cnxk: add security capabilities Anoob Joseph
2021-06-29  7:34     ` [dpdk-dev] [PATCH v3 0/8] Add lookaside IPsec and asymmetric in cnxk crypto PMDs Anoob Joseph
2021-06-29  7:34       ` [dpdk-dev] [PATCH v3 1/8] crypto/cnxk: add security ctx skeleton Anoob Joseph
2021-06-29  7:34       ` [dpdk-dev] [PATCH v3 2/8] crypto/cnxk: add security session ops Anoob Joseph
2021-06-29  7:34       ` [dpdk-dev] [PATCH v3 3/8] crypto/cnxk: add security handling in datapath ops Anoob Joseph
2021-06-29  7:34       ` [dpdk-dev] [PATCH v3 4/8] crypto/cnxk: add security capabilities Anoob Joseph
2021-06-29  7:34       ` [dpdk-dev] [PATCH v3 5/8] crypto/cnxk: add asymmetric session ops Anoob Joseph
2021-06-29  7:34       ` [dpdk-dev] [PATCH v3 6/8] crypto/cnxk: add asymmetric datapath ops Anoob Joseph
2021-06-29  7:34       ` [dpdk-dev] [PATCH v3 7/8] crypto/cnxk: add asymmetric capabilities Anoob Joseph
2021-06-29  7:34       ` [dpdk-dev] [PATCH v3 8/8] test/crypto: add cnxk for asymmetric cases Anoob Joseph
2021-06-29 19:52       ` [dpdk-dev] [PATCH v3 0/8] Add lookaside IPsec and asymmetric in cnxk crypto PMDs Akhil Goyal
2021-06-02 17:11 ` [dpdk-dev] [PATCH 2/4] crypto/cnxk: add security capabilities Anoob Joseph
2021-06-02 17:11 ` [dpdk-dev] [PATCH 3/4] crypto/cnxk: add security session ops Anoob Joseph
2021-06-16 20:11   ` Akhil Goyal
2021-06-17  7:16     ` Anoob Joseph
2021-06-02 17:11 ` [dpdk-dev] [PATCH 4/4] crypto/cnxk: add security handling in datapath ops Anoob Joseph
2021-06-16 20:15 ` [dpdk-dev] [PATCH 0/4] Add rte_security in crypto_cn10k PMD Akhil Goyal

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1624601708-29991-4-git-send-email-anoobj@marvell.com \
    --to=anoobj@marvell.com \
    --cc=adwivedi@marvell.com \
    --cc=dev@dpdk.org \
    --cc=gakhil@marvell.com \
    --cc=jerinj@marvell.com \
    --cc=ktejasree@marvell.com \
    --cc=schalla@marvell.com \
    --cc=thomas@monjalon.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).