Re: [dpdk-dev] [PATCH v1 1/5] ipsec: add inbound SAD API

["Ananyev, Konstantin" <konstantin.ananyev@intel.com>]

> --- /dev/null
> +++ b/lib/librte_ipsec/rte_ipsec_sad.h
> @@ -0,0 +1,174 @@
> +
> +/* SPDX-License-Identifier: BSD-3-Clause
> + * Copyright(c) 2019 Intel Corporation
> + */
> +
> +#ifndef _RTE_IPSEC_SAD_H_
> +#define _RTE_IPSEC_SAD_H_
> +
> +#include <rte_compat.h>
> +
> +/**
> + * @file rte_ipsec_sad.h
> + * @b EXPERIMENTAL: this API may change without prior notice
> + *
> + * RTE IPsec security association database (SAD) support.
> + * It is not recommended to include this file directly,
> + * include <rte_ipsec.h> instead.
> + * Contains helper functions to lookup and maintain SAD
> + */
> +
> +#ifdef __cplusplus
> +extern "C" {
> +#endif
> +
> +struct rte_ipsec_sad;
> +
> +/** Type of key */
> +enum {
> +	RTE_IPSEC_SAD_SPI_ONLY = 0,
> +	RTE_IPSEC_SAD_SPI_DIP,
> +	RTE_IPSEC_SAD_SPI_DIP_SIP,
> +	RTE_IPSEC_SAD_KEY_TYPE_MASK,
> +};
> +
> +struct rte_ipsec_sadv4_key {
> +	uint32_t spi;
> +	uint32_t dip;
> +	uint32_t sip;
> +};
> +
> +struct rte_ipsec_sadv6_key {
> +	uint32_t spi;
> +	uint8_t dip[16];
> +	uint8_t sip[16];
> +};
> +
> +union rte_ipsec_sad_key {
> +	struct rte_ipsec_sadv4_key	v4;
> +	struct rte_ipsec_sadv6_key	v6;
> +};
> +
> +#define RTE_IPSEC_SAD_FLAG_IPV4			0x1
> +#define RTE_IPSEC_SAD_FLAG_IPV6			0x2

Don't think we need to values - ipv4/ipv6 flags are mutually exclusive here.
Might be better:
_ipv4=0, _ipv6=1 (or visa-versa) _mask=1

> +/** Flag to support reader writer concurrency */
> +#define RTE_IPSEC_SAD_FLAG_RW_CONCURRENCY	0x4
> +
> +/** IPsec SAD configuration structure */
> +struct rte_ipsec_sad_conf {
> +	int		socket_id;
> +	/** maximum number of SA for each type key */
> +	uint32_t	max_sa[RTE_IPSEC_SAD_KEY_TYPE_MASK];
> +	uint32_t	flags;
> +};
> +
> +/**
> + * Add a rule into the SAD. Could be safely called with concurrent lookups
> + *  if RTE_IPSEC_SAD_FLAG_RW_CONCURRENCY flag was configured on creation time.
> + *  While with this flag multi-reader - one-writer model Is MT safe,
> + *  multi-writer model is not and required extra synchronisation.
> + *
> + * @param sad
> + *   SAD object handle
> + * @param key
> + *   pointer to the key
> + * @param key_type
> + *   key type (spi only/spi+dip/spi+dip+sip)
> + * @param sa
> + *   Pointer associated with the key to save in a SAD
> + *   Must be 4 bytes aligned.
> + * @return
> + *   0 on success, negative value otherwise
> + */
> +__rte_experimental
> +int
> +rte_ipsec_sad_add(struct rte_ipsec_sad *sad, union rte_ipsec_sad_key *key,
> +	int key_type, void *sa);
> +
> +/**
> + * Delete a rule from the SAD. Could be safely called with concurrent lookups
> + *  if RTE_IPSEC_SAD_FLAG_RW_CONCURRENCY flag was configured on creation time.
> + *  While with this flag multi-reader - one-writer model Is MT safe,
> + *  multi-writer model is not and required extra synchronisation.
> + *
> + * @param sad
> + *   SAD object handle
> + * @param key
> + *   pointer to the key
> + * @param key_type
> + *   key type (spi only/spi+dip/spi+dip+sip)
> + * @return
> + *   0 on success, negative value otherwise
> + */
> +__rte_experimental
> +int
> +rte_ipsec_sad_del(struct rte_ipsec_sad *sad, union rte_ipsec_sad_key *key,
> +	int key_type);
> +/*
> + * Create SAD
> + *
> + * @param name
> + *  SAD name
> + * @param conf
> + *  Structure containing the configuration
> + * @return
> + *  Handle to SAD object on success
> + *  NULL otherwise with rte_errno set to an appropriate values.
> + */
> +__rte_experimental
> +struct rte_ipsec_sad *
> +rte_ipsec_sad_create(const char *name, struct rte_ipsec_sad_conf *conf);

const struct rte_ipsec_sad_conf * 


> +
> +/**
> + * Find an existing SAD object and return a pointer to it.
> + *
> + * @param name
> + *  Name of the rib object as passed to rte_ipsec_sad_create()
> + * @return
> + *  Pointer to sad object or NULL if object not found with rte_errno
> + *  set appropriately. Possible rte_errno values include:
> + *   - ENOENT - required entry not available to return.
> + */
> +__rte_experimental
> +struct rte_ipsec_sad *
> +rte_ipsec_sad_find_existing(const char *name);
> +
> +/**
> + * Free SAD object.
> + *
> + * @param sad
> + *   pointer to the SAD object
> + * @return
> + *   None
> + */
> +__rte_experimental
> +void
> +rte_ipsec_sad_free(struct rte_ipsec_sad *sad);

As a nit - might be better name I _destroy.
Usually such API comes in pairs: create/destroy, alloc/free, etc.


> +
> +/**
> + * Lookup multiple keys in the SAD.
> + *
> + * @param sad
> + *   SAD object handle
> + * @param keys
> + *   Array of keys to be looked up in the SAD
> + * @param sa
> + *   Pointer assocoated with the keys.
> + *   If the lookup for the given key failed, then corresponding sa
> + *   will be NULL
> + * @param n
> + *   Number of elements in keys array to lookup.
> + *  @return
> + *   -EINVAL for incorrect arguments, otherwise 0
> + */
> +__rte_experimental
> +int
> +rte_ipsec_sad_lookup(const struct rte_ipsec_sad *sad,
> +	const union rte_ipsec_sad_key *keys[],
> +	uint32_t n, void *sa[]);
> +
> +#ifdef __cplusplus
> +}
> +#endif
> +
> +#endif /* _RTE_IPSEC_SAD_H_ */
> diff --git a/lib/librte_ipsec/rte_ipsec_version.map b/lib/librte_ipsec/rte_ipsec_version.map
> index ee9f196..56c38ec 100644
> --- a/lib/librte_ipsec/rte_ipsec_version.map
> +++ b/lib/librte_ipsec/rte_ipsec_version.map
> @@ -11,5 +11,12 @@ EXPERIMENTAL {
>  	rte_ipsec_ses_from_crypto;
>  	rte_ipsec_session_prepare;
> 
> +	rte_ipsec_sad_add;
> +	rte_ipsec_sad_create;
> +	rte_ipsec_sad_del;
> +	rte_ipsec_sad_find_existing;
> +	rte_ipsec_sad_free;
> +	rte_ipsec_sad_lookup;
> +
>  	local: *;
>  };
> --
> 2.7.4