From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id DD3D4A04F0; Mon, 16 Dec 2019 16:58:50 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id AF8532BC8; Mon, 16 Dec 2019 16:58:50 +0100 (CET) Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by dpdk.org (Postfix) with ESMTP id D7780288C for ; Mon, 16 Dec 2019 16:58:48 +0100 (CET) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 16 Dec 2019 07:58:47 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.69,322,1571727600"; d="scan'208";a="416479864" Received: from vmedvedk-mobl.ger.corp.intel.com (HELO [10.237.220.96]) ([10.237.220.96]) by fmsmga006.fm.intel.com with ESMTP; 16 Dec 2019 07:58:44 -0800 To: Anoob Joseph , "Ananyev, Konstantin" , Akhil Goyal , Adrien Mazarguil , "Doherty, Declan" , "Yigit, Ferruh" , Jerin Jacob Kollanukkaran , Thomas Monjalon Cc: Ankur Dwivedi , Hemant Agrawal , Matan Azrad , "Nicolau, Radu" , Shahaf Shuler , Narayana Prasad Raju Athreya , "dev@dpdk.org" References: <1575801683-27269-1-git-send-email-anoobj@marvell.com> From: "Medvedkin, Vladimir" Message-ID: <1fc05516-3686-4267-a760-edbe0b92bc87@intel.com> Date: Mon, 16 Dec 2019 15:58:43 +0000 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.9.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Subject: Re: [dpdk-dev] [PATCH] ethdev: allow multiple security sessions to use one rte flow X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Hi Anoob, On 11/12/2019 17:33, Anoob Joseph wrote: > Hi Konstantin, > > Please see inline. > > Thanks, > Anoob > >> -----Original Message----- >> From: dev On Behalf Of Ananyev, Konstantin >> Sent: Wednesday, December 11, 2019 4:36 PM >> To: Anoob Joseph ; Akhil Goyal ; >> Adrien Mazarguil ; Doherty, Declan >> ; Yigit, Ferruh ; Jerin Jacob >> Kollanukkaran ; Thomas Monjalon >> >> Cc: Ankur Dwivedi ; Hemant Agrawal >> ; Matan Azrad ; Nicolau, >> Radu ; Shahaf Shuler ; >> Narayana Prasad Raju Athreya ; dev@dpdk.org >> Subject: Re: [dpdk-dev] [PATCH] ethdev: allow multiple security sessions to use >> one rte flow >> >> >>>>> The rte_security API which enables inline protocol/crypto feature >>>>> mandates that for every security session an rte_flow is created. >>>>> This would internally translate to a rule in the hardware which >>>>> would do packet classification. >>>>> >>>>> In rte_securty, one SA would be one security session. And if an >>>>> rte_flow need to be created for every session, the number of SAs >>>>> supported by an inline implementation would be limited by the >>>>> number of rte_flows the PMD would be able to support. >>>>> >>>>> If the fields SPI & IP addresses are allowed to be a range, then >>>>> this limitation can be overcome. Multiple flows will be able to >>>>> use one rule for SECURITY processing. In this case, the security >>>>> session provided as conf would be NULL. >>>> Wonder what will be the usage model for it? >>>> AFAIK, RFC 4301 clearly states that either SPI value alone or in >>>> conjunction with dst (and src) IP should clearly identify SA for inbound SAD >> lookup. >>>> Am I missing something obvious here? >>> [Anoob] Existing SECURITY action type requires application to create >>> an 'rte_flow' per SA, which is not really required if h/w can use SPI to uniquely >> identify the security session/SA. >>> Existing rte_flow usage: IP (dst,src) + ESP + SPI -> security >>> processing enabled on one security session (ie on SA) >>> >>> The above rule would uniquely identify packets for an SA. But with the >>> above usage, we would quickly exhaust entries available in h/w lookup >>> tables (which are limited on our hardware). But if h/w can use SPI field to index >> into a table (for example), then the above requirement of one rte_flow per SA is >> not required. >>> Proposed rte_flow usage: IP (any) + ESP + SPI (any) -> security >>> processing enabled on all ESP packets So this means that SA will be indexed only by spi? What about SA's which are indexed by SPI+DIP+SIP? >>> >>> Now h/w could use SPI to index into a pre-populated table to get >>> security session. Please do note that, SPI is not ignored during the actual >> lookup. Just that it is not used while creating 'rte_flow'. >> >> And this table will be prepopulated by user and pointer to it will be somehow >> passed via rte_flow API? >> If yes, then what would be the mechanism? > [Anoob] I'm not sure what exactly you meant by user. But may be I'll explain how it's done in OCTEONTX2 PMD. > > The application would create security_session for every SA. SPI etc would be available to PMD (in conf) when the session is created. Now the PMD would populate SA related params in a specific location that h/w would access. This memory is allocated during device configure and h/w would have the pointer after the initialization is done. If memory is allocated during device configure what is upper limit for number of sessions? What if app needs more? > > PMD uses SPI as index to write into specific locations(during session create) and h/w would use it when it sees an ESP packet eligible for SECURITY (in receive path, per packet). As long as session creation could populate at memory locations that h/w would look at, this scheme would work. What algorithm of indexing by SPI is there? Could I use any arbitrary SPI? If some kind of hashing is used, what about collisions? > >>> The usage of one 'rte_flow' for multiple SAs is not mandatory. It is >>> only required when application requires large number of SAs. The proposed >> change is to allow more efficient usage of h/w resources where it's permitted by >> the PMD. >>>>> Application should do an rte_flow_validate() to make sure the flow >>>>> is supported on the PMD. >>>>> >>>>> Signed-off-by: Anoob Joseph >>>>> --- >>>>> lib/librte_ethdev/rte_flow.h | 6 ++++++ >>>>> 1 file changed, 6 insertions(+) >>>>> >>>>> diff --git a/lib/librte_ethdev/rte_flow.h >>>>> b/lib/librte_ethdev/rte_flow.h index 452d359..21fa7ed 100644 >>>>> --- a/lib/librte_ethdev/rte_flow.h >>>>> +++ b/lib/librte_ethdev/rte_flow.h >>>>> @@ -2239,6 +2239,12 @@ struct rte_flow_action_meter { >>>>> * direction. >>>>> * >>>>> * Multiple flows can be configured to use the same security session. >>>>> + * >>>>> + * The NULL value is allowed for security session. If security >>>>> + session is NULL, >>>>> + * then SPI field in ESP flow item and IP addresses in flow items >>>>> + 'IPv4' and >>>>> + * 'IPv6' will be allowed to be a range. The rule thus created >>>>> + can enable >>>>> + * SECURITY processing on multiple flows. >>>>> + * >>>>> */ >>>>> struct rte_flow_action_security { >>>>> void *security_session; /**< Pointer to security session structure. >>>>> */ >>>>> -- >>>>> 2.7.4 -- Regards, Vladimir