From patchwork Tue Nov 3 10:08:14 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiawen Wu X-Patchwork-Id: 83554 X-Patchwork-Delegate: ferruh.yigit@amd.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 6CABAA0521; Tue, 3 Nov 2020 11:18:59 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 2BC84CAC8; Tue, 3 Nov 2020 11:07:56 +0100 (CET) Received: from smtpbgsg2.qq.com (smtpbgsg2.qq.com [54.254.200.128]) by dpdk.org (Postfix) with ESMTP id 3E6DDCA34 for ; Tue, 3 Nov 2020 11:07:37 +0100 (CET) X-QQ-mid: bizesmtp26t1604398052tzgbpwq8 Received: from localhost.localdomain.com (unknown [183.129.236.74]) by esmtp10.qq.com (ESMTP) with id ; Tue, 03 Nov 2020 18:07:32 +0800 (CST) X-QQ-SSF: 01400000002000C0C000B00A0000000 X-QQ-FEAT: 5p2KJntE3DErE050/BaFXCSu5InmSBchB3zAZe3bjKsNnLoLykA9fLzT7Ynyo i1aZMaNCDStsuVoQIvF03qTAdQn3e+cSOtH/xPihzniiadbKJwPn/TTEnH7bLkESG0ZPrDe ONHL0d2GepJnGpcAObrJ7hzE0mCe37qA8p2/CKw2gemEiEIGBA6y5dkJdoX2JhYKq/xtiOA waVdEJVMv0fIAmUte2QkVO/UGX2z8XDIWZRSssk1o3bZ7fbZ4TBzKDQhLlBroGfDJZhm1s5 enY1ZSaeDRgHw3SaT0mJACloP+kpzVsd7M3+d7BX/WE/oTQEm/oP25BnGHsSOp/yD3taJXU 4xeQd7lZMWkUCU2Dvrt8aT9MOSbVx/eiIP2KCnD X-QQ-GoodBg: 2 From: Jiawen Wu To: dev@dpdk.org Cc: Jiawen Wu Date: Tue, 3 Nov 2020 18:08:14 +0800 Message-Id: <20201103100818.311881-34-jiawenwu@trustnetic.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20201103100818.311881-1-jiawenwu@trustnetic.com> References: <20201103100818.311881-1-jiawenwu@trustnetic.com> X-QQ-SENDSIZE: 520 Feedback-ID: bizesmtp:trustnetic.com:qybgforeign:qybgforeign5 X-QQ-Bgrelay: 1 Subject: [dpdk-dev] [PATCH 33/37] net/txgbe: add IPsec context creation X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Initialize securiry context, and add support to get security capabilities. Signed-off-by: Jiawen Wu --- doc/guides/nics/features/txgbe.ini | 1 + drivers/net/txgbe/meson.build | 3 +- drivers/net/txgbe/txgbe_ethdev.c | 13 +++ drivers/net/txgbe/txgbe_ethdev.h | 3 + drivers/net/txgbe/txgbe_ipsec.c | 181 +++++++++++++++++++++++++++++ drivers/net/txgbe/txgbe_ipsec.h | 13 +++ 6 files changed, 213 insertions(+), 1 deletion(-) create mode 100644 drivers/net/txgbe/txgbe_ipsec.c create mode 100644 drivers/net/txgbe/txgbe_ipsec.h diff --git a/doc/guides/nics/features/txgbe.ini b/doc/guides/nics/features/txgbe.ini index d6705f7aa..54daa382a 100644 --- a/doc/guides/nics/features/txgbe.ini +++ b/doc/guides/nics/features/txgbe.ini @@ -29,6 +29,7 @@ Flow control = Y Flow API = Y Rate limitation = Y Traffic mirroring = Y +Inline crypto = Y CRC offload = P VLAN offload = P QinQ offload = P diff --git a/drivers/net/txgbe/meson.build b/drivers/net/txgbe/meson.build index 352baad8b..f6a51a998 100644 --- a/drivers/net/txgbe/meson.build +++ b/drivers/net/txgbe/meson.build @@ -8,13 +8,14 @@ sources = files( 'txgbe_ethdev.c', 'txgbe_fdir.c', 'txgbe_flow.c', + 'txgbe_ipsec.c', 'txgbe_ptypes.c', 'txgbe_pf.c', 'txgbe_rxtx.c', 'txgbe_tm.c', ) -deps += ['hash'] +deps += ['hash', 'security'] includes += include_directories('base') diff --git a/drivers/net/txgbe/txgbe_ethdev.c b/drivers/net/txgbe/txgbe_ethdev.c index c92a4aa5f..c0582e264 100644 --- a/drivers/net/txgbe/txgbe_ethdev.c +++ b/drivers/net/txgbe/txgbe_ethdev.c @@ -16,6 +16,9 @@ #include #include #include +#ifdef RTE_LIB_SECURITY +#include +#endif #include "txgbe_logs.h" #include "base/txgbe.h" @@ -549,6 +552,12 @@ eth_txgbe_dev_init(struct rte_eth_dev *eth_dev, void *init_params __rte_unused) /* Unlock any pending hardware semaphore */ txgbe_swfw_lock_reset(hw); +#ifdef RTE_LIB_SECURITY + /* Initialize security_ctx only for primary process*/ + if (txgbe_ipsec_ctx_create(eth_dev)) + return -ENOMEM; +#endif + /* Initialize DCB configuration*/ memset(dcb_config, 0, sizeof(struct txgbe_dcb_config)); txgbe_dcb_init(hw, dcb_config); @@ -1971,6 +1980,10 @@ txgbe_dev_close(struct rte_eth_dev *dev) /* Remove all Traffic Manager configuration */ txgbe_tm_conf_uninit(dev); +#ifdef RTE_LIB_SECURITY + rte_free(dev->security_ctx); +#endif + return ret; } diff --git a/drivers/net/txgbe/txgbe_ethdev.h b/drivers/net/txgbe/txgbe_ethdev.h index 2d15e1ac3..1e7fa1f87 100644 --- a/drivers/net/txgbe/txgbe_ethdev.h +++ b/drivers/net/txgbe/txgbe_ethdev.h @@ -9,6 +9,9 @@ #include "base/txgbe.h" #include "txgbe_ptypes.h" +#ifdef RTE_LIB_SECURITY +#include "txgbe_ipsec.h" +#endif #include #include #include diff --git a/drivers/net/txgbe/txgbe_ipsec.c b/drivers/net/txgbe/txgbe_ipsec.c new file mode 100644 index 000000000..b21bba237 --- /dev/null +++ b/drivers/net/txgbe/txgbe_ipsec.c @@ -0,0 +1,181 @@ +/* SPDX-License-Identifier: BSD-3-Clause + * Copyright(c) 2015-2020 + */ + +#include +#include +#include +#include +#include +#include + +#include "base/txgbe.h" +#include "txgbe_ethdev.h" +#include "txgbe_ipsec.h" + +static const struct rte_security_capability * +txgbe_crypto_capabilities_get(void *device __rte_unused) +{ + static const struct rte_cryptodev_capabilities + aes_gcm_gmac_crypto_capabilities[] = { + { /* AES GMAC (128-bit) */ + .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC, + {.sym = { + .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH, + {.auth = { + .algo = RTE_CRYPTO_AUTH_AES_GMAC, + .block_size = 16, + .key_size = { + .min = 16, + .max = 16, + .increment = 0 + }, + .digest_size = { + .min = 16, + .max = 16, + .increment = 0 + }, + .iv_size = { + .min = 12, + .max = 12, + .increment = 0 + } + }, } + }, } + }, + { /* AES GCM (128-bit) */ + .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC, + {.sym = { + .xform_type = RTE_CRYPTO_SYM_XFORM_AEAD, + {.aead = { + .algo = RTE_CRYPTO_AEAD_AES_GCM, + .block_size = 16, + .key_size = { + .min = 16, + .max = 16, + .increment = 0 + }, + .digest_size = { + .min = 16, + .max = 16, + .increment = 0 + }, + .aad_size = { + .min = 0, + .max = 65535, + .increment = 1 + }, + .iv_size = { + .min = 12, + .max = 12, + .increment = 0 + } + }, } + }, } + }, + { + .op = RTE_CRYPTO_OP_TYPE_UNDEFINED, + {.sym = { + .xform_type = RTE_CRYPTO_SYM_XFORM_NOT_SPECIFIED + }, } + }, + }; + + static const struct rte_security_capability + txgbe_security_capabilities[] = { + { /* IPsec Inline Crypto ESP Transport Egress */ + .action = RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO, + .protocol = RTE_SECURITY_PROTOCOL_IPSEC, + {.ipsec = { + .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP, + .mode = RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT, + .direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS, + .options = { 0 } + } }, + .crypto_capabilities = aes_gcm_gmac_crypto_capabilities, + .ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA + }, + { /* IPsec Inline Crypto ESP Transport Ingress */ + .action = RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO, + .protocol = RTE_SECURITY_PROTOCOL_IPSEC, + {.ipsec = { + .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP, + .mode = RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT, + .direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS, + .options = { 0 } + } }, + .crypto_capabilities = aes_gcm_gmac_crypto_capabilities, + .ol_flags = 0 + }, + { /* IPsec Inline Crypto ESP Tunnel Egress */ + .action = RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO, + .protocol = RTE_SECURITY_PROTOCOL_IPSEC, + {.ipsec = { + .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP, + .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL, + .direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS, + .options = { 0 } + } }, + .crypto_capabilities = aes_gcm_gmac_crypto_capabilities, + .ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA + }, + { /* IPsec Inline Crypto ESP Tunnel Ingress */ + .action = RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO, + .protocol = RTE_SECURITY_PROTOCOL_IPSEC, + {.ipsec = { + .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP, + .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL, + .direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS, + .options = { 0 } + } }, + .crypto_capabilities = aes_gcm_gmac_crypto_capabilities, + .ol_flags = 0 + }, + { + .action = RTE_SECURITY_ACTION_TYPE_NONE + } + }; + + return txgbe_security_capabilities; +} + +static struct rte_security_ops txgbe_security_ops = { + .capabilities_get = txgbe_crypto_capabilities_get +}; + +static int +txgbe_crypto_capable(struct rte_eth_dev *dev) +{ + struct txgbe_hw *hw = TXGBE_DEV_HW(dev); + uint32_t reg_i, reg, capable = 1; + /* test if rx crypto can be enabled and then write back initial value*/ + reg_i = rd32(hw, TXGBE_SECRXCTL); + wr32m(hw, TXGBE_SECRXCTL, TXGBE_SECRXCTL_ODSA, 0); + reg = rd32m(hw, TXGBE_SECRXCTL, TXGBE_SECRXCTL_ODSA); + if (reg != 0) + capable = 0; + wr32(hw, TXGBE_SECRXCTL, reg_i); + return capable; +} + +int +txgbe_ipsec_ctx_create(struct rte_eth_dev *dev) +{ + struct rte_security_ctx *ctx = NULL; + + if (txgbe_crypto_capable(dev)) { + ctx = rte_malloc("rte_security_instances_ops", + sizeof(struct rte_security_ctx), 0); + if (ctx) { + ctx->device = (void *)dev; + ctx->ops = &txgbe_security_ops; + ctx->sess_cnt = 0; + dev->security_ctx = ctx; + } else { + return -ENOMEM; + } + } + if (rte_security_dynfield_register() < 0) + return -rte_errno; + return 0; +} diff --git a/drivers/net/txgbe/txgbe_ipsec.h b/drivers/net/txgbe/txgbe_ipsec.h new file mode 100644 index 000000000..f58ebab3d --- /dev/null +++ b/drivers/net/txgbe/txgbe_ipsec.h @@ -0,0 +1,13 @@ +/* SPDX-License-Identifier: BSD-3-Clause + * Copyright(c) 2015-2020 + */ + +#ifndef TXGBE_IPSEC_H_ +#define TXGBE_IPSEC_H_ + +#include +#include + +int txgbe_ipsec_ctx_create(struct rte_eth_dev *dev); + +#endif /*TXGBE_IPSEC_H_*/