Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/124891/?format=api
{ "id": 124891, "url": "https://patches.dpdk.org/api/patches/124891/?format=api", "web_url": "https://patches.dpdk.org/project/dpdk/patch/20230309085645.1630826-1-ndabilpuram@marvell.com/", "project": { "id": 1, "url": "https://patches.dpdk.org/api/projects/1/?format=api", "name": "DPDK", "link_name": "dpdk", "list_id": "dev.dpdk.org", "list_email": "dev@dpdk.org", "web_url": "http://core.dpdk.org", "scm_url": "git://dpdk.org/dpdk", "webscm_url": "http://git.dpdk.org/dpdk", "list_archive_url": "https://inbox.dpdk.org/dev", "list_archive_url_format": "https://inbox.dpdk.org/dev/{}", "commit_url_format": "" }, "msgid": "<20230309085645.1630826-1-ndabilpuram@marvell.com>", "list_archive_url": "https://inbox.dpdk.org/dev/20230309085645.1630826-1-ndabilpuram@marvell.com", "date": "2023-03-09T08:56:43", "name": "[RFC,1/2] security: introduce out of place support for inline ingress", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": true, "hash": "e36c74caac5338a08fb1eff1dcc432e6bd15cec8", "submitter": { "id": 1202, "url": "https://patches.dpdk.org/api/people/1202/?format=api", "name": "Nithin Dabilpuram", "email": "ndabilpuram@marvell.com" }, "delegate": { "id": 6690, "url": "https://patches.dpdk.org/api/users/6690/?format=api", "username": "akhil", "first_name": "akhil", "last_name": "goyal", "email": "gakhil@marvell.com" }, "mbox": "https://patches.dpdk.org/project/dpdk/patch/20230309085645.1630826-1-ndabilpuram@marvell.com/mbox/", "series": [ { "id": 27302, "url": "https://patches.dpdk.org/api/series/27302/?format=api", "web_url": "https://patches.dpdk.org/project/dpdk/list/?series=27302", "date": "2023-03-09T08:56:43", "name": "[RFC,1/2] security: introduce out of place support for inline ingress", "version": 1, "mbox": "https://patches.dpdk.org/series/27302/mbox/" } ], "comments": "https://patches.dpdk.org/api/patches/124891/comments/", "check": "success", "checks": "https://patches.dpdk.org/api/patches/124891/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<dev-bounces@dpdk.org>", "X-Original-To": "patchwork@inbox.dpdk.org", "Delivered-To": "patchwork@inbox.dpdk.org", "Received": [ "from mails.dpdk.org (mails.dpdk.org [217.70.189.124])\n\tby inbox.dpdk.org (Postfix) with ESMTP id 25B1C41E2B;\n\tThu, 9 Mar 2023 09:57:00 +0100 (CET)", "from mails.dpdk.org (localhost [127.0.0.1])\n\tby mails.dpdk.org (Postfix) with ESMTP id 0EDCF40ED7;\n\tThu, 9 Mar 2023 09:57:00 +0100 (CET)", "from mx0b-0016f401.pphosted.com (mx0b-0016f401.pphosted.com\n [67.231.156.173])\n by mails.dpdk.org (Postfix) with ESMTP id A096F400D7\n for <dev@dpdk.org>; Thu, 9 Mar 2023 09:56:58 +0100 (CET)", "from pps.filterd (m0045851.ppops.net [127.0.0.1])\n by mx0b-0016f401.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id\n 3295OqKe018369; Thu, 9 Mar 2023 00:56:57 -0800", "from dc5-exch01.marvell.com ([199.233.59.181])\n by mx0b-0016f401.pphosted.com (PPS) with ESMTPS id 3p6ff3gbfd-1\n (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT);\n Thu, 09 Mar 2023 00:56:57 -0800", "from DC5-EXCH01.marvell.com (10.69.176.38) by DC5-EXCH01.marvell.com\n (10.69.176.38) with Microsoft SMTP Server (TLS) id 15.0.1497.42;\n Thu, 9 Mar 2023 00:56:55 -0800", "from maili.marvell.com (10.69.176.80) by DC5-EXCH01.marvell.com\n (10.69.176.38) with Microsoft SMTP Server id 15.0.1497.42 via Frontend\n Transport; Thu, 9 Mar 2023 00:56:55 -0800", "from hyd1588t430.caveonetworks.com (unknown [10.29.52.204])\n by maili.marvell.com (Postfix) with ESMTP id C69A35B693F;\n Thu, 9 Mar 2023 00:56:53 -0800 (PST)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com;\n h=from : to : cc :\n subject : date : message-id : mime-version : content-transfer-encoding :\n content-type; s=pfpt0220; bh=RpF5Ll8yJrY8uac7iL6x6nwU6/DPf75NU0Dxs1RV3qk=;\n b=YZlly3rAQ/6mx/ZjnCATAST2iIh+UezVubD+28ksQut68K0PJhkTbtSWr1leGViVCIEr\n zZrnd556I6XdRQpOJn11JDUf6U+Berkt4a9dqITv7G77OG7fiv1ciZe0FKDRi/Y0ES4G\n W0DdLELO+QEheWgM11/NCgbyXa6lpVVIdXwHE14famWQPqNUlGf5xi1IMlIxF3LIOb+Y\n SPL5KQdwO3R2Z55RNlRQwDQyr10Jsiar01VUoPqllQIcLrMOA2BGfylChFDLIxmpecvW\n KQc4SZHEr+rdQ8pEhPCnURqwO3Odq9snG9NwN//C1VjzMI5XVkXHSB2mNzZsOWBqFFeS eA==", "From": "Nithin Dabilpuram <ndabilpuram@marvell.com>", "To": "Thomas Monjalon <thomas@monjalon.net>, Akhil Goyal <gakhil@marvell.com>", "CC": "<jerinj@marvell.com>, <dev@dpdk.org>, Nithin Dabilpuram\n <ndabilpuram@marvell.com>", "Subject": "[RFC 1/2] security: introduce out of place support for inline ingress", "Date": "Thu, 9 Mar 2023 14:26:43 +0530", "Message-ID": "<20230309085645.1630826-1-ndabilpuram@marvell.com>", "X-Mailer": "git-send-email 2.25.1", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Content-Type": "text/plain", "X-Proofpoint-ORIG-GUID": "9XpukHyeZIqDzEKRJiR7OkPReFvyve7e", "X-Proofpoint-GUID": "9XpukHyeZIqDzEKRJiR7OkPReFvyve7e", "X-Proofpoint-Virus-Version": "vendor=baseguard\n engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22\n definitions=2023-03-09_05,2023-03-08_03,2023-02-09_01", "X-BeenThere": "dev@dpdk.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "DPDK patches and discussions <dev.dpdk.org>", "List-Unsubscribe": "<https://mails.dpdk.org/options/dev>,\n <mailto:dev-request@dpdk.org?subject=unsubscribe>", "List-Archive": "<http://mails.dpdk.org/archives/dev/>", "List-Post": "<mailto:dev@dpdk.org>", "List-Help": "<mailto:dev-request@dpdk.org?subject=help>", "List-Subscribe": "<https://mails.dpdk.org/listinfo/dev>,\n <mailto:dev-request@dpdk.org?subject=subscribe>", "Errors-To": "dev-bounces@dpdk.org" }, "content": "Similar to out of place(OOP) processing support that exists for\nLookaside crypto/security sessions, Inline ingress security\nsessions may also need out of place processing in usecases\nwhere original encrypted packet needs to be retained for post\nprocessing. So for NIC's which have such a kind of HW support,\na new SA option is provided to indicate whether OOP needs to\nbe enabled on that Inline ingress security session or not.\n\nSince for inline ingress sessions, packet is not received by\nCPU until the processing is done, we can only have per-SA\noption and not per-packet option like Lookaside sessions.\n\nIn order to return the original encrypted packet mbuf,\nthis patch adds a new mbuf dynamic field of 8B size\ncontaining pointer to original mbuf which will be populated\nfor packets associated with Inline SA that has OOP enabled.\n\nSigned-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>\n---\n devtools/libabigail.abignore | 4 +++\n lib/security/rte_security.c | 17 +++++++++++++\n lib/security/rte_security.h | 39 +++++++++++++++++++++++++++++-\n lib/security/rte_security_driver.h | 8 ++++++\n lib/security/version.map | 2 ++\n 5 files changed, 69 insertions(+), 1 deletion(-)", "diff": "diff --git a/devtools/libabigail.abignore b/devtools/libabigail.abignore\nindex 7a93de3ba1..9f52ffbf2e 100644\n--- a/devtools/libabigail.abignore\n+++ b/devtools/libabigail.abignore\n@@ -34,3 +34,7 @@\n ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n ; Temporary exceptions till next major ABI version ;\n ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;\n+\n+; Ignore change to reserved opts for new SA option\n+[suppress_type]\n+ name = rte_security_ipsec_sa_options\ndiff --git a/lib/security/rte_security.c b/lib/security/rte_security.c\nindex e102c55e55..c2199dd8db 100644\n--- a/lib/security/rte_security.c\n+++ b/lib/security/rte_security.c\n@@ -27,7 +27,10 @@\n } while (0)\n \n #define RTE_SECURITY_DYNFIELD_NAME \"rte_security_dynfield_metadata\"\n+#define RTE_SECURITY_OOP_DYNFIELD_NAME \"rte_security_oop_dynfield_metadata\"\n+\n int rte_security_dynfield_offset = -1;\n+int rte_security_oop_dynfield_offset = -1;\n \n int\n rte_security_dynfield_register(void)\n@@ -42,6 +45,20 @@ rte_security_dynfield_register(void)\n \treturn rte_security_dynfield_offset;\n }\n \n+int\n+rte_security_oop_dynfield_register(void)\n+{\n+\tstatic const struct rte_mbuf_dynfield dynfield_desc = {\n+\t\t.name = RTE_SECURITY_OOP_DYNFIELD_NAME,\n+\t\t.size = sizeof(rte_security_oop_dynfield_t),\n+\t\t.align = __alignof__(rte_security_oop_dynfield_t),\n+\t};\n+\n+\trte_security_oop_dynfield_offset =\n+\t\trte_mbuf_dynfield_register(&dynfield_desc);\n+\treturn rte_security_oop_dynfield_offset;\n+}\n+\n void *\n rte_security_session_create(struct rte_security_ctx *instance,\n \t\t\t struct rte_security_session_conf *conf,\ndiff --git a/lib/security/rte_security.h b/lib/security/rte_security.h\nindex 4bacf9fcd9..866cd4e8ee 100644\n--- a/lib/security/rte_security.h\n+++ b/lib/security/rte_security.h\n@@ -275,6 +275,17 @@ struct rte_security_ipsec_sa_options {\n \t */\n \tuint32_t ip_reassembly_en : 1;\n \n+\t/** Enable out of place processing on inline inbound packets.\n+\t *\n+\t * * 1: Enable driver to perform Out-of-place(OOP) processing for this inline\n+\t * inbound SA if supported by driver. PMD need to register mbuf\n+\t * dynamic field using rte_security_oop_dynfield_register()\n+\t * and security session creation would fail if dynfield is not\n+\t * registered successfully.\n+\t * * 0: Disable OOP processing for this session (default).\n+\t */\n+\tuint32_t ingress_oop : 1;\n+\n \t/** Reserved bit fields for future extension\n \t *\n \t * User should ensure reserved_opts is cleared as it may change in\n@@ -282,7 +293,7 @@ struct rte_security_ipsec_sa_options {\n \t *\n \t * Note: Reduce number of bits in reserved_opts for every new option.\n \t */\n-\tuint32_t reserved_opts : 17;\n+\tuint32_t reserved_opts : 16;\n };\n \n /** IPSec security association direction */\n@@ -812,6 +823,13 @@ typedef uint64_t rte_security_dynfield_t;\n /** Dynamic mbuf field for device-specific metadata */\n extern int rte_security_dynfield_offset;\n \n+/** Out-of-Place(OOP) processing field type */\n+typedef struct rte_mbuf *rte_security_oop_dynfield_t;\n+/** Dynamic mbuf field for pointer to original mbuf for\n+ * OOP processing session.\n+ */\n+extern int rte_security_oop_dynfield_offset;\n+\n /**\n * @warning\n * @b EXPERIMENTAL: this API may change without prior notice\n@@ -834,6 +852,25 @@ rte_security_dynfield(struct rte_mbuf *mbuf)\n \t\trte_security_dynfield_t *);\n }\n \n+/**\n+ * @warning\n+ * @b EXPERIMENTAL: this API may change without prior notice\n+ *\n+ * Get pointer to mbuf field for original mbuf pointer when\n+ * Out-Of-Place(OOP) processing is enabled in security session.\n+ *\n+ * @param mbuf packet to access\n+ * @return pointer to mbuf field\n+ */\n+__rte_experimental\n+static inline rte_security_oop_dynfield_t *\n+rte_security_oop_dynfield(struct rte_mbuf *mbuf)\n+{\n+\treturn RTE_MBUF_DYNFIELD(mbuf,\n+\t\t\trte_security_oop_dynfield_offset,\n+\t\t\trte_security_oop_dynfield_t *);\n+}\n+\n /**\n * @warning\n * @b EXPERIMENTAL: this API may change without prior notice\ndiff --git a/lib/security/rte_security_driver.h b/lib/security/rte_security_driver.h\nindex 421e6f7780..91e7786ab7 100644\n--- a/lib/security/rte_security_driver.h\n+++ b/lib/security/rte_security_driver.h\n@@ -190,6 +190,14 @@ typedef int (*security_macsec_sa_stats_get_t)(void *device, uint16_t sa_id,\n __rte_internal\n int rte_security_dynfield_register(void);\n \n+/**\n+ * @internal\n+ * Register mbuf dynamic field for Security inline ingress Out-of-Place(OOP)\n+ * processing.\n+ */\n+__rte_internal\n+int rte_security_oop_dynfield_register(void);\n+\n /**\n * Update the mbuf with provided metadata.\n *\ndiff --git a/lib/security/version.map b/lib/security/version.map\nindex 07dcce9ffb..59a95f40bd 100644\n--- a/lib/security/version.map\n+++ b/lib/security/version.map\n@@ -23,10 +23,12 @@ EXPERIMENTAL {\n \trte_security_macsec_sc_stats_get;\n \trte_security_session_stats_get;\n \trte_security_session_update;\n+\trte_security_oop_dynfield_offset;\n };\n \n INTERNAL {\n \tglobal:\n \n \trte_security_dynfield_register;\n+\trte_security_oop_dynfield_register;\n };\n", "prefixes": [ "RFC", "1/2" ] }