From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id EE571A0558; Mon, 5 Sep 2022 15:35:07 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id C6B7042BB5; Mon, 5 Sep 2022 15:33:59 +0200 (CEST) Received: from mx0b-0016f401.pphosted.com (mx0b-0016f401.pphosted.com [67.231.156.173]) by mails.dpdk.org (Postfix) with ESMTP id CC06742BB4 for ; Mon, 5 Sep 2022 15:33:58 +0200 (CEST) Received: from pps.filterd (m0045851.ppops.net [127.0.0.1]) by mx0b-0016f401.pphosted.com (8.17.1.5/8.17.1.5) with ESMTP id 285DAeOS009446 for ; Mon, 5 Sep 2022 06:33:58 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=pfpt0220; bh=kSLNNXONXuW+Kblv4R19qHb/Uq3keBsaFyUTjVGsqnc=; b=KRBpRYa2FtB9Nb0sBVUpakLyl0uFRUdAXYq72hBRkJj4XixrFC+54Ax9ul6CjZG052XI br4DuP13zsa6t5WWxER44NO2eK15uNY79CmQuCAFZB807GCl+sC3dZkXNvymC9vWH5py kuESpTIA8w27YNkQwWJQrk/oxEnRZKj6/rBfnRsXtJSDhcgeOVIKnuDavNkA/7ccDRlm YSxOI5D6ySE62P7dP50/3YXPOPGx/SkBHd1NJMvbCBQYB9Luf5r5azMYWvjBXuX3fJva JJrr+nN9YX4Ov6ATePaWJKmyNWGabIM/yhroQYqPn0LQ9keO8bmJnvqstazJ8LrpHFmY ug== Received: from dc5-exch02.marvell.com ([199.233.59.182]) by mx0b-0016f401.pphosted.com (PPS) with ESMTPS id 3jc6epngkq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Mon, 05 Sep 2022 06:33:58 -0700 Received: from DC5-EXCH02.marvell.com (10.69.176.39) by DC5-EXCH02.marvell.com (10.69.176.39) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Mon, 5 Sep 2022 06:33:56 -0700 Received: from maili.marvell.com (10.69.176.80) by DC5-EXCH02.marvell.com (10.69.176.39) with Microsoft SMTP Server id 15.0.1497.18 via Frontend Transport; Mon, 5 Sep 2022 06:33:56 -0700 Received: from localhost.localdomain (unknown [10.29.52.204]) by maili.marvell.com (Postfix) with ESMTP id B836D5E6872; Mon, 5 Sep 2022 06:33:53 -0700 (PDT) From: Nithin Dabilpuram To: Nithin Dabilpuram , Kiran Kumar K , Sunil Kumar Kori , Satha Rao CC: , , Vidya Sagar Velumuri Subject: [PATCH v2 29/31] net/cnxk: enable esn and antireplay support Date: Mon, 5 Sep 2022 19:02:26 +0530 Message-ID: <20220905133228.818616-29-ndabilpuram@marvell.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220905133228.818616-1-ndabilpuram@marvell.com> References: <20220809184908.24030-1-ndabilpuram@marvell.com> <20220905133228.818616-1-ndabilpuram@marvell.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Proofpoint-ORIG-GUID: JwPHLH5h979kG1conrUL2LkdTW31uyaz X-Proofpoint-GUID: JwPHLH5h979kG1conrUL2LkdTW31uyaz X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.205,Aquarius:18.0.895,Hydra:6.0.517,FMLib:17.11.122.1 definitions=2022-09-05_09,2022-09-05_02,2022-06-22_01 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org From: Vidya Sagar Velumuri Enable ESN and anti-replay in IPsec capabilities Add support for session update security API Fix the cpt command population for ESN enabled case Signed-off-by: Vidya Sagar Velumuri --- drivers/net/cnxk/cn9k_ethdev_sec.c | 139 ++++++++++++++++++++++++++++- 1 file changed, 137 insertions(+), 2 deletions(-) diff --git a/drivers/net/cnxk/cn9k_ethdev_sec.c b/drivers/net/cnxk/cn9k_ethdev_sec.c index 90cb1d252d..6dc5ebed5d 100644 --- a/drivers/net/cnxk/cn9k_ethdev_sec.c +++ b/drivers/net/cnxk/cn9k_ethdev_sec.c @@ -296,8 +296,10 @@ static const struct rte_security_capability cn9k_eth_sec_capabilities[] = { .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP, .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL, .direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS, + .replay_win_sz_max = CNXK_ON_AR_WIN_SIZE_MAX, .options = { - .udp_encap = 1 + .udp_encap = 1, + .esn = 1 } }, .crypto_capabilities = cn9k_eth_sec_crypto_caps, @@ -312,7 +314,8 @@ static const struct rte_security_capability cn9k_eth_sec_capabilities[] = { .direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS, .options = { .udp_encap = 1, - .iv_gen_disable = 1 + .iv_gen_disable = 1, + .esn = 1 } }, .crypto_capabilities = cn9k_eth_sec_crypto_caps, @@ -375,6 +378,137 @@ outb_dbg_iv_update(struct roc_ie_on_common_sa *common_sa, const char *__iv_str) free(iv_str); } +static int +cn9k_eth_sec_session_update(void *device, + struct rte_security_session *sess, + struct rte_security_session_conf *conf) +{ + struct rte_eth_dev *eth_dev = (struct rte_eth_dev *)device; + struct cnxk_eth_dev *dev = cnxk_eth_pmd_priv(eth_dev); + struct rte_security_ipsec_xform *ipsec; + struct cn9k_outb_priv_data *outb_priv; + struct cnxk_ipsec_outb_rlens *rlens; + struct cn9k_sec_sess_priv sess_priv; + struct rte_crypto_sym_xform *crypto; + struct cnxk_eth_sec_sess *eth_sec; + struct roc_ie_on_outb_sa *outb_sa; + rte_spinlock_t *lock; + char tbuf[128] = {0}; + const char *iv_str; + uint32_t sa_idx; + int ctx_len; + int rc = 0; + + if (conf->action_type != RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL) + return -ENOTSUP; + + if (conf->protocol != RTE_SECURITY_PROTOCOL_IPSEC) + return -ENOTSUP; + + if (rte_security_dynfield_register() < 0) + return -ENOTSUP; + + ipsec = &conf->ipsec; + crypto = conf->crypto_xform; + + if (ipsec->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) + return -ENOTSUP; + + eth_sec = cnxk_eth_sec_sess_get_by_sess(dev, sess); + if (!eth_sec) + return -ENOENT; + + eth_sec->spi = conf->ipsec.spi; + + lock = &dev->outb.lock; + rte_spinlock_lock(lock); + + outb_sa = eth_sec->sa; + outb_priv = roc_nix_inl_on_ipsec_outb_sa_sw_rsvd(outb_sa); + sa_idx = outb_priv->sa_idx; + + /* Disable SA */ + outb_sa->common_sa.ctl.valid = 0; + + /* Sync SA content */ + plt_atomic_thread_fence(__ATOMIC_ACQ_REL); + + sess_priv.u64 = 0; + memset(outb_sa, 0, sizeof(struct roc_ie_on_outb_sa)); + + /* Fill outbound sa params */ + rc = cnxk_on_ipsec_outb_sa_create(ipsec, crypto, outb_sa); + if (rc < 0) { + snprintf(tbuf, sizeof(tbuf), + "Failed to init outbound sa, rc=%d", rc); + rc |= cnxk_eth_outb_sa_idx_put(dev, sa_idx); + goto exit; + } + + ctx_len = rc; + rc = roc_nix_inl_ctx_write(&dev->nix, outb_sa, outb_sa, false, + ctx_len); + if (rc) { + snprintf(tbuf, sizeof(tbuf), + "Failed to init outbound sa, rc=%d", rc); + rc |= cnxk_eth_outb_sa_idx_put(dev, sa_idx); + goto exit; + } + + /* When IV is provided by the application, + * copy the IV to context and enable explicit IV flag in context. + */ + if (ipsec->options.iv_gen_disable == 1) { + outb_sa->common_sa.ctl.explicit_iv_en = 1; + iv_str = getenv("ETH_SEC_IV_OVR"); + if (iv_str) + outb_dbg_iv_update(&outb_sa->common_sa, iv_str); + } + + outb_priv->userdata = conf->userdata; + outb_priv->eth_sec = eth_sec; + /* Start sequence number with 1 */ + outb_priv->esn = ipsec->esn.value; + + memcpy(&outb_priv->nonce, outb_sa->common_sa.iv.gcm.nonce, 4); + if (outb_sa->common_sa.ctl.enc_type == ROC_IE_ON_SA_ENC_AES_GCM) + outb_priv->copy_salt = 1; + + rlens = &outb_priv->rlens; + /* Save rlen info */ + cnxk_ipsec_outb_rlens_get(rlens, ipsec, crypto); + + sess_priv.sa_idx = outb_priv->sa_idx; + sess_priv.roundup_byte = rlens->roundup_byte; + sess_priv.roundup_len = rlens->roundup_len; + sess_priv.partial_len = rlens->partial_len; + + /* Pointer from eth_sec -> outb_sa */ + eth_sec->sa = outb_sa; + eth_sec->sess = sess; + eth_sec->sa_idx = sa_idx; + eth_sec->spi = ipsec->spi; + + /* Sync SA content */ + plt_atomic_thread_fence(__ATOMIC_ACQ_REL); + + rte_spinlock_unlock(lock); + + plt_nix_dbg("Created outbound session with spi=%u, sa_idx=%u", + eth_sec->spi, eth_sec->sa_idx); + + /* Update fast path info in priv area. + */ + set_sec_session_private_data(sess, (void *)sess_priv.u64); + + return 0; +exit: + rte_spinlock_unlock(lock); + if (rc) + plt_err("%s", tbuf); + return rc; +} + static int cn9k_eth_sec_session_create(void *device, struct rte_security_session_conf *conf, @@ -678,6 +812,7 @@ cn9k_eth_sec_ops_override(void) /* Update platform specific ops */ cnxk_eth_sec_ops.session_create = cn9k_eth_sec_session_create; + cnxk_eth_sec_ops.session_update = cn9k_eth_sec_session_update; cnxk_eth_sec_ops.session_destroy = cn9k_eth_sec_session_destroy; cnxk_eth_sec_ops.capabilities_get = cn9k_eth_sec_capabilities_get; } -- 2.25.1