Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/58871/?format=api
{ "id": 58871, "url": "http://patches.dpdk.org/api/patches/58871/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/patch/20190906131330.40185-10-roy.fan.zhang@intel.com/", "project": { "id": 1, "url": "http://patches.dpdk.org/api/projects/1/?format=api", "name": "DPDK", "link_name": "dpdk", "list_id": "dev.dpdk.org", "list_email": "dev@dpdk.org", "web_url": "http://core.dpdk.org", "scm_url": "git://dpdk.org/dpdk", "webscm_url": "http://git.dpdk.org/dpdk", "list_archive_url": "https://inbox.dpdk.org/dev", "list_archive_url_format": "https://inbox.dpdk.org/dev/{}", "commit_url_format": "" }, "msgid": "<20190906131330.40185-10-roy.fan.zhang@intel.com>", "list_archive_url": "https://inbox.dpdk.org/dev/20190906131330.40185-10-roy.fan.zhang@intel.com", "date": "2019-09-06T13:13:29", "name": "[09/10] examples/ipsec-secgw: add security cpu_crypto action support", "commit_ref": null, "pull_url": null, "state": "changes-requested", "archived": true, "hash": "319f0ec7935765bb93ec1021254d171a8affad32", "submitter": { "id": 304, "url": "http://patches.dpdk.org/api/people/304/?format=api", "name": "Fan Zhang", "email": "roy.fan.zhang@intel.com" }, "delegate": { "id": 6690, "url": "http://patches.dpdk.org/api/users/6690/?format=api", "username": "akhil", "first_name": "akhil", "last_name": "goyal", "email": "gakhil@marvell.com" }, "mbox": "http://patches.dpdk.org/project/dpdk/patch/20190906131330.40185-10-roy.fan.zhang@intel.com/mbox/", "series": [ { "id": 6303, "url": "http://patches.dpdk.org/api/series/6303/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/list/?series=6303", "date": "2019-09-06T13:13:20", "name": "security: add software synchronous crypto process", "version": 1, "mbox": "http://patches.dpdk.org/series/6303/mbox/" } ], "comments": "http://patches.dpdk.org/api/patches/58871/comments/", "check": "success", "checks": "http://patches.dpdk.org/api/patches/58871/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<dev-bounces@dpdk.org>", "X-Original-To": "patchwork@dpdk.org", "Delivered-To": "patchwork@dpdk.org", "Received": [ "from [92.243.14.124] (localhost [127.0.0.1])\n\tby dpdk.org (Postfix) with ESMTP id 8C63F1F3CD;\n\tFri, 6 Sep 2019 15:14:08 +0200 (CEST)", "from mga11.intel.com (mga11.intel.com [192.55.52.93])\n\tby dpdk.org (Postfix) with ESMTP id 57BB91F3A3\n\tfor <dev@dpdk.org>; Fri, 6 Sep 2019 15:13:50 +0200 (CEST)", "from fmsmga002.fm.intel.com ([10.253.24.26])\n\tby fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384;\n\t06 Sep 2019 06:13:49 -0700", "from silpixa00398673.ir.intel.com (HELO\n\tsilpixa00398673.ger.corp.intel.com) ([10.237.223.136])\n\tby fmsmga002.fm.intel.com with ESMTP; 06 Sep 2019 06:13:47 -0700" ], "X-Amp-Result": "SKIPPED(no attachment in message)", "X-Amp-File-Uploaded": "False", "X-ExtLoop1": "1", "X-IronPort-AV": "E=Sophos;i=\"5.64,473,1559545200\"; d=\"scan'208\";a=\"213140789\"", "From": "Fan Zhang <roy.fan.zhang@intel.com>", "To": "dev@dpdk.org", "Cc": "konstantin.ananyev@intel.com, declan.doherty@intel.com,\n\takhil.goyal@nxp.com, Fan Zhang <roy.fan.zhang@intel.com>", "Date": "Fri, 6 Sep 2019 14:13:29 +0100", "Message-Id": "<20190906131330.40185-10-roy.fan.zhang@intel.com>", "X-Mailer": "git-send-email 2.14.5", "In-Reply-To": "<20190906131330.40185-1-roy.fan.zhang@intel.com>", "References": "<20190903154046.55992-1-roy.fan.zhang@intel.com>\n\t<20190906131330.40185-1-roy.fan.zhang@intel.com>", "Subject": "[dpdk-dev] [PATCH 09/10] examples/ipsec-secgw: add security\n\tcpu_crypto action support", "X-BeenThere": "dev@dpdk.org", "X-Mailman-Version": "2.1.15", "Precedence": "list", "List-Id": "DPDK patches and discussions <dev.dpdk.org>", "List-Unsubscribe": "<https://mails.dpdk.org/options/dev>,\n\t<mailto:dev-request@dpdk.org?subject=unsubscribe>", "List-Archive": "<http://mails.dpdk.org/archives/dev/>", "List-Post": "<mailto:dev@dpdk.org>", "List-Help": "<mailto:dev-request@dpdk.org?subject=help>", "List-Subscribe": "<https://mails.dpdk.org/listinfo/dev>,\n\t<mailto:dev-request@dpdk.org?subject=subscribe>", "Errors-To": "dev-bounces@dpdk.org", "Sender": "\"dev\" <dev-bounces@dpdk.org>" }, "content": "Since ipsec library is added cpu_crypto security action type support,\nthis patch updates ipsec-secgw sample application with added action type\n\"cpu-crypto\". The patch also includes a number of test scripts to\nprove the correctness of the implementation.\n\nSigned-off-by: Fan Zhang <roy.fan.zhang@intel.com>\n---\n examples/ipsec-secgw/ipsec.c | 22 ++++++++++++++++++++++\n examples/ipsec-secgw/ipsec_process.c | 7 ++++---\n examples/ipsec-secgw/sa.c | 13 +++++++++++--\n examples/ipsec-secgw/test/run_test.sh | 10 ++++++++++\n .../test/trs_3descbc_sha1_cpu_crypto_defs.sh | 5 +++++\n .../test/trs_aescbc_sha1_cpu_crypto_defs.sh | 5 +++++\n .../test/trs_aesctr_sha1_cpu_crypto_defs.sh | 5 +++++\n .../ipsec-secgw/test/trs_aesgcm_cpu_crypto_defs.sh | 5 +++++\n .../test/trs_aesgcm_mb_cpu_crypto_defs.sh | 7 +++++++\n .../test/tun_3descbc_sha1_cpu_crypto_defs.sh | 5 +++++\n .../test/tun_aescbc_sha1_cpu_crypto_defs.sh | 5 +++++\n .../test/tun_aesctr_sha1_cpu_crypto_defs.sh | 5 +++++\n .../ipsec-secgw/test/tun_aesgcm_cpu_crypto_defs.sh | 5 +++++\n .../test/tun_aesgcm_mb_cpu_crypto_defs.sh | 7 +++++++\n 14 files changed, 101 insertions(+), 5 deletions(-)\n create mode 100644 examples/ipsec-secgw/test/trs_3descbc_sha1_cpu_crypto_defs.sh\n create mode 100644 examples/ipsec-secgw/test/trs_aescbc_sha1_cpu_crypto_defs.sh\n create mode 100644 examples/ipsec-secgw/test/trs_aesctr_sha1_cpu_crypto_defs.sh\n create mode 100644 examples/ipsec-secgw/test/trs_aesgcm_cpu_crypto_defs.sh\n create mode 100644 examples/ipsec-secgw/test/trs_aesgcm_mb_cpu_crypto_defs.sh\n create mode 100644 examples/ipsec-secgw/test/tun_3descbc_sha1_cpu_crypto_defs.sh\n create mode 100644 examples/ipsec-secgw/test/tun_aescbc_sha1_cpu_crypto_defs.sh\n create mode 100644 examples/ipsec-secgw/test/tun_aesctr_sha1_cpu_crypto_defs.sh\n create mode 100644 examples/ipsec-secgw/test/tun_aesgcm_cpu_crypto_defs.sh\n create mode 100644 examples/ipsec-secgw/test/tun_aesgcm_mb_cpu_crypto_defs.sh", "diff": "diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c\nindex dc85adfe5..4c39a7de6 100644\n--- a/examples/ipsec-secgw/ipsec.c\n+++ b/examples/ipsec-secgw/ipsec.c\n@@ -10,6 +10,7 @@\n #include <rte_crypto.h>\n #include <rte_security.h>\n #include <rte_cryptodev.h>\n+#include <rte_ipsec.h>\n #include <rte_ethdev.h>\n #include <rte_mbuf.h>\n #include <rte_hash.h>\n@@ -105,6 +106,26 @@ create_lookaside_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa)\n \t\t\t\t\"SEC Session init failed: err: %d\\n\", ret);\n \t\t\t\treturn -1;\n \t\t\t}\n+\t\t} else if (sa->type == RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO) {\n+\t\t\tstruct rte_security_ctx *ctx =\n+\t\t\t\t(struct rte_security_ctx *)\n+\t\t\t\trte_cryptodev_get_sec_ctx(\n+\t\t\t\t\tipsec_ctx->tbl[cdev_id_qp].id);\n+\t\t\tint32_t offset = sizeof(struct rte_esp_hdr) +\n+\t\t\t\t\tsa->iv_len;\n+\n+\t\t\t/* Set IPsec parameters in conf */\n+\t\t\tsess_conf.cpucrypto.cipher_offset = offset;\n+\n+\t\t\tset_ipsec_conf(sa, &(sess_conf.ipsec));\n+\t\t\tsa->security_ctx = ctx;\n+\t\t\tsa->sec_session = rte_security_session_create(ctx,\n+\t\t\t\t&sess_conf, ipsec_ctx->session_priv_pool);\n+\t\t\tif (sa->sec_session == NULL) {\n+\t\t\t\tRTE_LOG(ERR, IPSEC,\n+\t\t\t\t\"SEC Session init failed: err: %d\\n\", ret);\n+\t\t\t\treturn -1;\n+\t\t\t}\n \t\t} else {\n \t\t\tRTE_LOG(ERR, IPSEC, \"Inline not supported\\n\");\n \t\t\treturn -1;\n@@ -473,6 +494,7 @@ ipsec_enqueue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx,\n \t\t\t\t\t\tsa->sec_session, pkts[i], NULL);\n \t\t\tcontinue;\n \t\tcase RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO:\n+\t\tcase RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO:\n \t\t\tRTE_ASSERT(sa->sec_session != NULL);\n \t\t\tpriv->cop.type = RTE_CRYPTO_OP_TYPE_SYMMETRIC;\n \t\t\tpriv->cop.status = RTE_CRYPTO_OP_STATUS_NOT_PROCESSED;\ndiff --git a/examples/ipsec-secgw/ipsec_process.c b/examples/ipsec-secgw/ipsec_process.c\nindex 868f1a28d..1932b631f 100644\n--- a/examples/ipsec-secgw/ipsec_process.c\n+++ b/examples/ipsec-secgw/ipsec_process.c\n@@ -101,7 +101,8 @@ fill_ipsec_session(struct rte_ipsec_session *ss, struct ipsec_ctx *ctx,\n \t\t}\n \t\tss->crypto.ses = sa->crypto_session;\n \t/* setup session action type */\n-\t} else if (sa->type == RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL) {\n+\t} else if (sa->type == RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL ||\n+\t\t\tsa->type == RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO) {\n \t\tif (sa->sec_session == NULL) {\n \t\t\trc = create_lookaside_session(ctx, sa);\n \t\t\tif (rc != 0)\n@@ -227,8 +228,8 @@ ipsec_process(struct ipsec_ctx *ctx, struct ipsec_traffic *trf)\n \n \t\t/* process packets inline */\n \t\telse if (sa->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO ||\n-\t\t\t\tsa->type ==\n-\t\t\t\tRTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL) {\n+\t\t\tsa->type == RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL ||\n+\t\t\tsa->type == RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO) {\n \n \t\t\tsatp = rte_ipsec_sa_type(ips->sa);\n \ndiff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c\nindex c3cf3bd1f..ba773346f 100644\n--- a/examples/ipsec-secgw/sa.c\n+++ b/examples/ipsec-secgw/sa.c\n@@ -570,6 +570,9 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens,\n \t\t\t\tRTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL;\n \t\t\telse if (strcmp(tokens[ti], \"no-offload\") == 0)\n \t\t\t\trule->type = RTE_SECURITY_ACTION_TYPE_NONE;\n+\t\t\telse if (strcmp(tokens[ti], \"cpu-crypto\") == 0)\n+\t\t\t\trule->type =\n+\t\t\t\t\tRTE_SECURITY_ACTION_TYPE_CPU_CRYPTO;\n \t\t\telse {\n \t\t\t\tAPP_CHECK(0, status, \"Invalid input \\\"%s\\\"\",\n \t\t\t\t\t\ttokens[ti]);\n@@ -624,10 +627,13 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens,\n \tif (status->status < 0)\n \t\treturn;\n \n-\tif ((rule->type != RTE_SECURITY_ACTION_TYPE_NONE) && (portid_p == 0))\n+\tif ((rule->type != RTE_SECURITY_ACTION_TYPE_NONE && rule->type !=\n+\t\t\tRTE_SECURITY_ACTION_TYPE_CPU_CRYPTO) &&\n+\t\t\t(portid_p == 0))\n \t\tprintf(\"Missing portid option, falling back to non-offload\\n\");\n \n-\tif (!type_p || !portid_p) {\n+\tif (!type_p || (!portid_p && rule->type !=\n+\t\t\tRTE_SECURITY_ACTION_TYPE_CPU_CRYPTO)) {\n \t\trule->type = RTE_SECURITY_ACTION_TYPE_NONE;\n \t\trule->portid = -1;\n \t}\n@@ -709,6 +715,9 @@ print_one_sa_rule(const struct ipsec_sa *sa, int inbound)\n \tcase RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL:\n \t\tprintf(\"lookaside-protocol-offload \");\n \t\tbreak;\n+\tcase RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO:\n+\t\tprintf(\"cpu-crypto-accelerated\");\n+\t\tbreak;\n \t}\n \tprintf(\"\\n\");\n }\ndiff --git a/examples/ipsec-secgw/test/run_test.sh b/examples/ipsec-secgw/test/run_test.sh\nindex 8055a4c04..f322aa785 100755\n--- a/examples/ipsec-secgw/test/run_test.sh\n+++ b/examples/ipsec-secgw/test/run_test.sh\n@@ -32,15 +32,21 @@ usage()\n }\n \n LINUX_TEST=\"tun_aescbc_sha1 \\\n+tun_aescbc_sha1_cpu_crypto \\\n tun_aescbc_sha1_esn \\\n tun_aescbc_sha1_esn_atom \\\n tun_aesgcm \\\n+tun_aesgcm_cpu_crypto \\\n+tun_aesgcm_mb_cpu_crypto \\\n tun_aesgcm_esn \\\n tun_aesgcm_esn_atom \\\n trs_aescbc_sha1 \\\n+trs_aescbc_sha1_cpu_crypto \\\n trs_aescbc_sha1_esn \\\n trs_aescbc_sha1_esn_atom \\\n trs_aesgcm \\\n+trs_aesgcm_cpu_crypto \\\n+trs_aesgcm_mb_cpu_crypto \\\n trs_aesgcm_esn \\\n trs_aesgcm_esn_atom \\\n tun_aescbc_sha1_old \\\n@@ -49,17 +55,21 @@ trs_aescbc_sha1_old \\\n trs_aesgcm_old \\\n tun_aesctr_sha1 \\\n tun_aesctr_sha1_old \\\n+tun_aesctr_cpu_crypto \\\n tun_aesctr_sha1_esn \\\n tun_aesctr_sha1_esn_atom \\\n trs_aesctr_sha1 \\\n+trs_aesctr_sha1_cpu_crypto \\\n trs_aesctr_sha1_old \\\n trs_aesctr_sha1_esn \\\n trs_aesctr_sha1_esn_atom \\\n tun_3descbc_sha1 \\\n+tun_3descbc_sha1_cpu_crypto \\\n tun_3descbc_sha1_old \\\n tun_3descbc_sha1_esn \\\n tun_3descbc_sha1_esn_atom \\\n trs_3descbc_sha1 \\\n+trs_3descbc_sha1 \\\n trs_3descbc_sha1_old \\\n trs_3descbc_sha1_esn \\\n trs_3descbc_sha1_esn_atom\"\ndiff --git a/examples/ipsec-secgw/test/trs_3descbc_sha1_cpu_crypto_defs.sh b/examples/ipsec-secgw/test/trs_3descbc_sha1_cpu_crypto_defs.sh\nnew file mode 100644\nindex 000000000..a864a8886\n--- /dev/null\n+++ b/examples/ipsec-secgw/test/trs_3descbc_sha1_cpu_crypto_defs.sh\n@@ -0,0 +1,5 @@\n+#! /bin/bash\n+\n+. ${DIR}/trs_3descbc_sha1_defs.sh\n+\n+SGW_CFG_XPRM='type cpu-crypto'\ndiff --git a/examples/ipsec-secgw/test/trs_aescbc_sha1_cpu_crypto_defs.sh b/examples/ipsec-secgw/test/trs_aescbc_sha1_cpu_crypto_defs.sh\nnew file mode 100644\nindex 000000000..b515cd9f8\n--- /dev/null\n+++ b/examples/ipsec-secgw/test/trs_aescbc_sha1_cpu_crypto_defs.sh\n@@ -0,0 +1,5 @@\n+#! /bin/bash\n+\n+. ${DIR}/trs_aescbc_sha1_defs.sh\n+\n+SGW_CFG_XPRM='type cpu-crypto'\ndiff --git a/examples/ipsec-secgw/test/trs_aesctr_sha1_cpu_crypto_defs.sh b/examples/ipsec-secgw/test/trs_aesctr_sha1_cpu_crypto_defs.sh\nnew file mode 100644\nindex 000000000..745a2a02b\n--- /dev/null\n+++ b/examples/ipsec-secgw/test/trs_aesctr_sha1_cpu_crypto_defs.sh\n@@ -0,0 +1,5 @@\n+#! /bin/bash\n+\n+. ${DIR}/trs_aesctr_sha1_defs.sh\n+\n+SGW_CFG_XPRM='type cpu-crypto'\ndiff --git a/examples/ipsec-secgw/test/trs_aesgcm_cpu_crypto_defs.sh b/examples/ipsec-secgw/test/trs_aesgcm_cpu_crypto_defs.sh\nnew file mode 100644\nindex 000000000..8917122da\n--- /dev/null\n+++ b/examples/ipsec-secgw/test/trs_aesgcm_cpu_crypto_defs.sh\n@@ -0,0 +1,5 @@\n+#! /bin/bash\n+\n+. ${DIR}/trs_aesgcm_defs.sh\n+\n+SGW_CFG_XPRM='type cpu-crypto'\ndiff --git a/examples/ipsec-secgw/test/trs_aesgcm_mb_cpu_crypto_defs.sh b/examples/ipsec-secgw/test/trs_aesgcm_mb_cpu_crypto_defs.sh\nnew file mode 100644\nindex 000000000..26943321f\n--- /dev/null\n+++ b/examples/ipsec-secgw/test/trs_aesgcm_mb_cpu_crypto_defs.sh\n@@ -0,0 +1,7 @@\n+#! /bin/bash\n+\n+. ${DIR}/trs_aesgcm_defs.sh\n+\n+CRYPTO_DEV=${CRYPTO_DEV:-'--vdev=\"crypto_aesni_mb0\"'}\n+\n+SGW_CFG_XPRM='type cpu-crypto'\ndiff --git a/examples/ipsec-secgw/test/tun_3descbc_sha1_cpu_crypto_defs.sh b/examples/ipsec-secgw/test/tun_3descbc_sha1_cpu_crypto_defs.sh\nnew file mode 100644\nindex 000000000..747141f62\n--- /dev/null\n+++ b/examples/ipsec-secgw/test/tun_3descbc_sha1_cpu_crypto_defs.sh\n@@ -0,0 +1,5 @@\n+#! /bin/bash\n+\n+. ${DIR}/tun_3descbc_sha1_defs.sh\n+\n+SGW_CFG_XPRM='type cpu-crypto'\ndiff --git a/examples/ipsec-secgw/test/tun_aescbc_sha1_cpu_crypto_defs.sh b/examples/ipsec-secgw/test/tun_aescbc_sha1_cpu_crypto_defs.sh\nnew file mode 100644\nindex 000000000..56076fa50\n--- /dev/null\n+++ b/examples/ipsec-secgw/test/tun_aescbc_sha1_cpu_crypto_defs.sh\n@@ -0,0 +1,5 @@\n+#! /bin/bash\n+\n+. ${DIR}/tun_aescbc_sha1_defs.sh\n+\n+SGW_CFG_XPRM='type cpu-crypto'\ndiff --git a/examples/ipsec-secgw/test/tun_aesctr_sha1_cpu_crypto_defs.sh b/examples/ipsec-secgw/test/tun_aesctr_sha1_cpu_crypto_defs.sh\nnew file mode 100644\nindex 000000000..3af680533\n--- /dev/null\n+++ b/examples/ipsec-secgw/test/tun_aesctr_sha1_cpu_crypto_defs.sh\n@@ -0,0 +1,5 @@\n+#! /bin/bash\n+\n+. ${DIR}/tun_aesctr_sha1_defs.sh\n+\n+SGW_CFG_XPRM='type cpu-crypto'\ndiff --git a/examples/ipsec-secgw/test/tun_aesgcm_cpu_crypto_defs.sh b/examples/ipsec-secgw/test/tun_aesgcm_cpu_crypto_defs.sh\nnew file mode 100644\nindex 000000000..5bf1c0ae5\n--- /dev/null\n+++ b/examples/ipsec-secgw/test/tun_aesgcm_cpu_crypto_defs.sh\n@@ -0,0 +1,5 @@\n+#! /bin/bash\n+\n+. ${DIR}/tun_aesgcm_defs.sh\n+\n+SGW_CFG_XPRM='type cpu-crypto'\ndiff --git a/examples/ipsec-secgw/test/tun_aesgcm_mb_cpu_crypto_defs.sh b/examples/ipsec-secgw/test/tun_aesgcm_mb_cpu_crypto_defs.sh\nnew file mode 100644\nindex 000000000..039b8095e\n--- /dev/null\n+++ b/examples/ipsec-secgw/test/tun_aesgcm_mb_cpu_crypto_defs.sh\n@@ -0,0 +1,7 @@\n+#! /bin/bash\n+\n+. ${DIR}/tun_aesgcm_defs.sh\n+\n+CRYPTO_DEV=${CRYPTO_DEV:-'--vdev=\"crypto_aesni_mb0\"'}\n+\n+SGW_CFG_XPRM='type cpu-crypto'\n", "prefixes": [ "09/10" ] }