From patchwork Tue Sep 26 02:49:58 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chaoyong He X-Patchwork-Id: 131908 X-Patchwork-Delegate: ferruh.yigit@amd.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id E66134263C; Tue, 26 Sep 2023 04:51:43 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 7FD8040A73; Tue, 26 Sep 2023 04:50:50 +0200 (CEST) Received: from NAM10-DM6-obe.outbound.protection.outlook.com (mail-dm6nam10on2097.outbound.protection.outlook.com [40.107.93.97]) by mails.dpdk.org (Postfix) with ESMTP id 088FB406B8 for ; Tue, 26 Sep 2023 04:50:49 +0200 (CEST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=OWHLV1dHt/6FCTRR0XdfFfHkZyTNPMw7Jq0H6FMG2iherhKZ+HOeOiGn3C3usKI3w8Hf19hnNiYR7bFv2IORvqd3jQ/tJQPqxY3/J6Wferl65KN8ImLPZZQCTY2aGH12N2Lh3M1EZaS+7XWfcRNNLDti1Fx8lo4k/M0t5xBTCzBgXin61r7POnvOp1FL5v3lR9InXsyNtSP/nevJ44DmRjwqomjbVyX2vF8FhR0yyvnO9+nd56bvIU50XFjmEQqlsEL/kzhNXBh1DI4wwzBasAtkDmdgUsP/rDA1oh4HZSah7lxfXV1lYgQf4eAZ4QeDQ6SY5DPtxdufeAyOx3sI1Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=EYRQ9UDYnLsk8jRllKp9kQgg7WUQrpmRy1ztZD/Kplg=; b=QaYUSuliiSBdan56SEHrNjXxVVMdEozHODRqL8+UsAmlylLxXUsn4HRoarZqcdDeJhIsTpNlfEPvRJXBKW7WItk5mW/0/2MpaYfDLqzrsQTMibrh/iproV8tAnaIss3nt1eE2MHHOxK/TitN3AIzRtaYskvqzokW74N3olGkng1+2QzMiLQv8iwB14724KbgU4HluKKoX4t1qXIjs6AYwxnL06IR/a4H54KWp9VyL1qTSuEvne/oSx3HXTvQkYTBFG8Nvd1UGv+VqB0T7QUQpNUr7oGYJxf/M+5gsJmz5hI7bfmUUat+g46IvSf3LCc2EzNbrny/Mxq0IhZ62K6QNw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=corigine.com; dmarc=pass action=none header.from=corigine.com; dkim=pass header.d=corigine.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=corigine.onmicrosoft.com; s=selector2-corigine-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EYRQ9UDYnLsk8jRllKp9kQgg7WUQrpmRy1ztZD/Kplg=; b=lXX6L0/A/bUHaVABdolNPKqmoHUcXW070uQYC4JmEAAkSBlMC3iLAcdVhmITGLb75y+q8fdMY3F5RnZXapHjbYi4GLNwfCiKdh8OicMUOIcmgmW0CCjfK/tpvNXwBw4H0Qu3idYXf2NfVn3IQu5f01Po3J4lV0rRkTHO1lJhhyU= Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=corigine.com; Received: from PH0PR13MB5568.namprd13.prod.outlook.com (2603:10b6:510:12b::16) by SA3PR13MB6516.namprd13.prod.outlook.com (2603:10b6:806:39c::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6792.27; Tue, 26 Sep 2023 02:50:47 +0000 Received: from PH0PR13MB5568.namprd13.prod.outlook.com ([fe80::b070:92e1:931e:fee7]) by PH0PR13MB5568.namprd13.prod.outlook.com ([fe80::b070:92e1:931e:fee7%4]) with mapi id 15.20.6792.026; Tue, 26 Sep 2023 02:50:47 +0000 From: Chaoyong He To: dev@dpdk.org Cc: oss-drivers@corigine.com, Shihong Wang , Chang Miao , Chaoyong He Subject: [PATCH v2 09/10] net/nfp: support IPsec Rx and Tx offload Date: Tue, 26 Sep 2023 10:49:58 +0800 Message-Id: <20230926024959.207098-10-chaoyong.he@corigine.com> X-Mailer: git-send-email 2.39.1 In-Reply-To: <20230926024959.207098-1-chaoyong.he@corigine.com> References: <20230925060644.1458598-1-chaoyong.he@corigine.com> <20230926024959.207098-1-chaoyong.he@corigine.com> X-ClientProxiedBy: BYAPR05CA0020.namprd05.prod.outlook.com (2603:10b6:a03:c0::33) To PH0PR13MB5568.namprd13.prod.outlook.com (2603:10b6:510:12b::16) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PH0PR13MB5568:EE_|SA3PR13MB6516:EE_ X-MS-Office365-Filtering-Correlation-Id: f4c1183a-3fc1-47b0-b25f-08dbbe3b629b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: yUH6/FQFL/fxQUbgeFdPDBcvS3XQxA+CTwml7nIh+Wa1ntZEovlTfrcl37798qKcrfc/pXWUB8KVW1Hpe3GNgQIWvhOmxi4T4zgteNEKkkap3T7y2z2qmni3BXF7NuCuCqNTKYiToHWNCYxl6ytmmgpA/TijIt3WX+n5wqwP8hBa88/hqxaMhkbpFOQHY3ewMwvpcVDpw7dC11mZpabV1iTw8rzHyMFDENhtpz5y1yI9bG5S4j7J7ylknpcH7u2bfiSFIEgEXAHPoAkmOXcNt8jrVLMh/IDZoIUbgsJzZXJJPg06rumOVrfeboJDgm/Zpdsf3E/rXnPO82FPrwpfDRkv77jf9G22Vla3rM5/1hEhHdzJNHOMt82IotLxg+NuwMkUK6Jl3hOu7CqYx2/yNuH4Z/emrUB77kwQolX24LVY+Oa4+L9iMTBmOoQWZvy9oKzXJcJyy+VFmN7fi9CNGEpS9Ne92MRRW/qcH1W98Fv08cIefxuWmbgPaX8QzHREA+AceqA0z7PGQi4c8c3doDyE1hdAL+H/QoRcR2vk7BeByiRHfMrBZFXY1sBRWxYCNnH3n/uK6af5fAOww0O6t/o6QPnE/tWTG1Q4VuqHF7mMuFfwX9O47W9GLWtguK/elymktfyCyKxQC8a/z6Yt2dRCsodOGZacNwoWMZSaAco= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:PH0PR13MB5568.namprd13.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230031)(39830400003)(136003)(366004)(346002)(396003)(376002)(230922051799003)(1800799009)(451199024)(186009)(4326008)(83380400001)(2616005)(6486002)(6506007)(52116002)(478600001)(6666004)(86362001)(36756003)(38100700002)(1076003)(30864003)(26005)(66476007)(8936002)(66556008)(6916009)(6512007)(2906002)(38350700002)(66946007)(41300700001)(107886003)(316002)(44832011)(8676002)(5660300002)(54906003); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 9xPu9GWCT1DlDlc3SXkEWpfzz6T9HPbn6SBCqns9oQtissreXLX6b8bAqsfO7NCfVg+yT7q422/5+NMpG/orXjHaXhg0Fr2sgvTCaTx6yB9Q9dTTescpAHxNGlSqd2OXauBUNi6nrSAzAAGcEeoaA0Bjr8JNa7T9jIV8RgOSG54y6RBj9e5TifRhChfe4uvLVyTQ43BPrzlX2SvOJTjljTewn+kyK5ux+D2Ukqg7wxR3EZ0ELUK0ONrC0TZE2KEoHfAyqU2a24McAd77cPNIE5+yd1scznpqlG5d80JaXGIWuOBAeaiATMCN2YlLlBG5P3LAqIWVgeGykKme2oWRZ6rFH34FQBv6rSCmbUCirQtzlfVP4Jsabb/RC4bCU9Gm7cRGJu06BDFd0Gmd0ZJrkLOHlVg+L7odFb46kggAgkI+A0cgNax8vO4bzy9mn1SfOEFfQ7fg3JJhRyDHkmxyh5EawYleDdFZVzmDkN9LaAP+ksb2ii+inPdHexVQnsky81la2Rj/7OGz2V4cwhHnrC5u6DMSrrecM/kxTSCrhSexvEXttMCE+wUvC7uL6zHaoPjLsxjbMK8fxAwN3REFpe+gw5yBhThp6nBm5vDgGMbCpGiPqNTgFH+Tukb+Ojfk8VCAj3brooNkGlo54Ql7QgPS6CnhFsSaeMWxcDkpg05RAKHZrWoAz18hqzVWOqLtx80UAY+duWdSRSMO9bhAP33dP8oDL0VzHyX663It8lhB9k1YcR4AVpY7wI206SmuUAHU8DbUNkeDR47N/nKiD4onaN5+sEt2Ctkqb0WG6JcIVSB36S2tLJtCWivbhAUAb9aPNfKQC+eaoSGVh3N6saeRnUybyFudduLkZE+ycI6WXTk+81jcTRuSM3rhR6cGjmv6nq5G38VpVcLjsmhqM4PK+E9qCtpY8lCZ+rqHyuOv0qHIk3BJZFqPc9xxipkNA8dAIxDHA0TfTJb5AOGQ5IhRhke1WdIGReG21afIk7yp4ugt4VrbQAQ3HYakJmz57MKTq3Tl9WkAd6S7z0vC8MQs2TgaVz4+2oB7sBZnCDLPS0R6h9iOntdOXO1sW/DO6zpDrHabt0UNodSevvwgo689qlOYurgHQ06F+YnxnR2qmnHiOUw+ntvGaqcEk0HeJimV/vOjp1xbbjga6AweptZnOVi+/jx6CwkzVJpe7UgtdTO2TE2aTc8c1Qew7BZCpKnz7g6j4dhZJTsd8djdhG6kWo5N1UvVyAP5Wb5K/VzW0aYIEtUsluwkshSPgtGgmM/igN1yGeq2WUGjwOSmuP8Fm2PPqpt8SpYgwcONo8rrLshrO7gxeKN3oPOR9HsvOmX31OFlzTA88wHU+Z/ASDDjCSj9nW8fa0SIczDNjn+jZceQ5BXItXiSFFzN/GjARfAHeBubnQ81KXqasipMaJjfIg55VVapKyFHY6MvQOiqNdPGRMNhNIDqOYDOPzAcH+YLjSF5UtDxkmL9ARRvsxkBproFDzi9/901Jnsa5vTye/Au+GlFKi2DXJd09EgUswyz7FLqgIaJB39wi0fybES3GovyCi+2Jtg5+U/MkPyulOnGpnkY+oXkOv5te39Y2RcXpDwcE/b9WNpoaCDUvA== X-OriginatorOrg: corigine.com X-MS-Exchange-CrossTenant-Network-Message-Id: f4c1183a-3fc1-47b0-b25f-08dbbe3b629b X-MS-Exchange-CrossTenant-AuthSource: PH0PR13MB5568.namprd13.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Sep 2023 02:50:47.2778 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: fe128f2c-073b-4c20-818e-7246a585940c X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: dEyksXrZJZIRtfE+HkoItiknQrgl/EW7fxO5z1JcjdZ81oyu3IykroF/t6UvK12OIf2BrlyoZ6zhHMhaxJLNZzo4BW2V4Cqafp2MsxI3wy8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA3PR13MB6516 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org From: Shihong Wang The Rx path checks the ipsec metadata and base on the crypto status sets ol_flags in the rte_mbuf. The Tx path write IPsec message to mbuf metadata based on mbuf dynamic field. Signed-off-by: Shihong Wang Signed-off-by: Chang Miao Reviewed-by: Chaoyong He --- doc/guides/nics/nfp.rst | 31 +++++++++++++ drivers/net/nfp/nfd3/nfp_nfd3_dp.c | 24 ++++++++++ drivers/net/nfp/nfdk/nfp_nfdk_dp.c | 24 ++++++++++ drivers/net/nfp/nfp_ctrl.h | 1 + drivers/net/nfp/nfp_ipsec.c | 42 +++++++++++++++++ drivers/net/nfp/nfp_ipsec.h | 6 +++ drivers/net/nfp/nfp_rxtx.c | 74 ++++++++++++++++++++++++++++++ drivers/net/nfp/nfp_rxtx.h | 5 ++ 8 files changed, 207 insertions(+) diff --git a/doc/guides/nics/nfp.rst b/doc/guides/nics/nfp.rst index 456a22dcbc..fee1860f4a 100644 --- a/doc/guides/nics/nfp.rst +++ b/doc/guides/nics/nfp.rst @@ -348,6 +348,18 @@ Metadata with L2 (1W/4B) The vlan[0] is the innermost VLAN The vlan[1] is the QinQ info +NFP_NET_META_IPSEC +The IPsec type requires 4 bit. +The SA index value is 32 bit which need 1 data field. +:: + + ---------------------------------------------------------------- + 3 2 1 0 + 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | sa_idx | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + TX ~~ @@ -363,3 +375,22 @@ NFP_NET_META_VLAN ^ ^ NOTE: | TCI | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + +NFP_NET_META_IPSEC +The IPsec type requires 12 bit, because it requires three data fields. +:: + + ---------------------------------------------------------------- + 3 2 1 0 + 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | sa_idx | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | nfp_ipsec_force_seq_low | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + | nfp_ipsec_force_seq_hi | + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + + The sa_idx is 32 bit which need 1 data field. + The nfp_ipsec_force_seq_low & nfp_ipsec_force_seq_hi is Anti-re-anti-count, + which is 64 bit need two data fields. diff --git a/drivers/net/nfp/nfd3/nfp_nfd3_dp.c b/drivers/net/nfp/nfd3/nfp_nfd3_dp.c index ab0747fc16..64928254d8 100644 --- a/drivers/net/nfp/nfd3/nfp_nfd3_dp.c +++ b/drivers/net/nfp/nfd3/nfp_nfd3_dp.c @@ -147,10 +147,13 @@ nfp_net_nfd3_set_meta_data(struct nfp_net_meta_raw *meta_data, char *meta; uint8_t layer = 0; uint32_t meta_info; + uint32_t cap_extend; struct nfp_net_hw *hw; uint8_t vlan_layer = 0; + uint8_t ipsec_layer = 0; hw = txq->hw; + cap_extend = nn_cfg_readl(hw, NFP_NET_CFG_CAP_WORD1); if ((pkt->ol_flags & RTE_MBUF_F_TX_VLAN) != 0 && (hw->ctrl & NFP_NET_CFG_CTRL_TXVLAN_V2) != 0) { @@ -160,6 +163,18 @@ nfp_net_nfd3_set_meta_data(struct nfp_net_meta_raw *meta_data, meta_data->header |= NFP_NET_META_VLAN; } + if ((pkt->ol_flags & RTE_MBUF_F_TX_SEC_OFFLOAD) != 0 && + (cap_extend & NFP_NET_CFG_CTRL_IPSEC) != 0) { + uint32_t ipsec_type = NFP_NET_META_IPSEC | + NFP_NET_META_IPSEC << NFP_NET_META_FIELD_SIZE | + NFP_NET_META_IPSEC << (2 * NFP_NET_META_FIELD_SIZE); + if (meta_data->length == 0) + meta_data->length = NFP_NET_META_FIELD_SIZE; + uint8_t ipsec_offset = meta_data->length - NFP_NET_META_FIELD_SIZE; + meta_data->header |= (ipsec_type << ipsec_offset); + meta_data->length += 3 * NFP_NET_META_FIELD_SIZE; + } + if (meta_data->length == 0) return; @@ -180,6 +195,15 @@ nfp_net_nfd3_set_meta_data(struct nfp_net_meta_raw *meta_data, nfp_net_set_meta_vlan(meta_data, pkt, layer); vlan_layer++; break; + case NFP_NET_META_IPSEC: + if (ipsec_layer > 2) { + PMD_DRV_LOG(ERR, "At most 3 layers of ipsec is supported for now."); + return; + } + + nfp_net_set_meta_ipsec(meta_data, txq, pkt, layer, ipsec_layer); + ipsec_layer++; + break; default: PMD_DRV_LOG(ERR, "The metadata type not supported"); return; diff --git a/drivers/net/nfp/nfdk/nfp_nfdk_dp.c b/drivers/net/nfp/nfdk/nfp_nfdk_dp.c index a85734f121..d4bd5edb0a 100644 --- a/drivers/net/nfp/nfdk/nfp_nfdk_dp.c +++ b/drivers/net/nfp/nfdk/nfp_nfdk_dp.c @@ -177,13 +177,16 @@ nfp_net_nfdk_set_meta_data(struct rte_mbuf *pkt, char *meta; uint8_t layer = 0; uint32_t meta_type; + uint32_t cap_extend; struct nfp_net_hw *hw; uint32_t header_offset; uint8_t vlan_layer = 0; + uint8_t ipsec_layer = 0; struct nfp_net_meta_raw meta_data; memset(&meta_data, 0, sizeof(meta_data)); hw = txq->hw; + cap_extend = nn_cfg_readl(hw, NFP_NET_CFG_CAP_WORD1); if ((pkt->ol_flags & RTE_MBUF_F_TX_VLAN) != 0 && (hw->ctrl & NFP_NET_CFG_CTRL_TXVLAN_V2) != 0) { @@ -193,6 +196,18 @@ nfp_net_nfdk_set_meta_data(struct rte_mbuf *pkt, meta_data.header |= NFP_NET_META_VLAN; } + if ((pkt->ol_flags & RTE_MBUF_F_TX_SEC_OFFLOAD) != 0 && + (cap_extend & NFP_NET_CFG_CTRL_IPSEC) != 0) { + uint32_t ipsec_type = NFP_NET_META_IPSEC | + NFP_NET_META_IPSEC << NFP_NET_META_FIELD_SIZE | + NFP_NET_META_IPSEC << (2 * NFP_NET_META_FIELD_SIZE); + if (meta_data.length == 0) + meta_data.length = NFP_NET_META_FIELD_SIZE; + uint8_t ipsec_offset = meta_data.length - NFP_NET_META_FIELD_SIZE; + meta_data.header |= (ipsec_type << ipsec_offset); + meta_data.length += 3 * NFP_NET_META_FIELD_SIZE; + } + if (meta_data.length == 0) return; @@ -215,6 +230,15 @@ nfp_net_nfdk_set_meta_data(struct rte_mbuf *pkt, nfp_net_set_meta_vlan(&meta_data, pkt, layer); vlan_layer++; break; + case NFP_NET_META_IPSEC: + if (ipsec_layer > 2) { + PMD_DRV_LOG(ERR, "At most 3 layers of ipsec is supported for now."); + return; + } + + nfp_net_set_meta_ipsec(&meta_data, txq, pkt, layer, ipsec_layer); + ipsec_layer++; + break; default: PMD_DRV_LOG(ERR, "The metadata type not supported"); return; diff --git a/drivers/net/nfp/nfp_ctrl.h b/drivers/net/nfp/nfp_ctrl.h index 361739a4b9..3488df6ba8 100644 --- a/drivers/net/nfp/nfp_ctrl.h +++ b/drivers/net/nfp/nfp_ctrl.h @@ -39,6 +39,7 @@ #define NFP_NET_META_HASH 1 /* next field carries hash type */ #define NFP_NET_META_VLAN 4 #define NFP_NET_META_PORTID 5 +#define NFP_NET_META_IPSEC 9 #define NFP_META_PORT_ID_CTRL ~0U diff --git a/drivers/net/nfp/nfp_ipsec.c b/drivers/net/nfp/nfp_ipsec.c index 0022532027..8626c6323d 100644 --- a/drivers/net/nfp/nfp_ipsec.c +++ b/drivers/net/nfp/nfp_ipsec.c @@ -1153,6 +1153,47 @@ nfp_crypto_update_session(void *device __rte_unused, return 0; } +static int +nfp_security_set_pkt_metadata(void *device, + struct rte_security_session *session, + struct rte_mbuf *m, + void *params) +{ + int offset; + uint64_t *sqn; + struct nfp_net_hw *hw; + struct rte_eth_dev *eth_dev; + struct nfp_ipsec_session *priv_session; + + sqn = params; + eth_dev = device; + priv_session = SECURITY_GET_SESS_PRIV(session); + hw = NFP_NET_DEV_PRIVATE_TO_HW(eth_dev->data->dev_private); + + if (priv_session->ipsec.direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) { + struct nfp_tx_ipsec_desc_msg *desc_md; + + offset = hw->ipsec_data->pkt_dynfield_offset; + desc_md = RTE_MBUF_DYNFIELD(m, offset, struct nfp_tx_ipsec_desc_msg *); + + if (priv_session->msg.ctrl_word.ext_seq != 0 && sqn != NULL) { + desc_md->esn.low = rte_cpu_to_be_32(*sqn); + desc_md->esn.hi = rte_cpu_to_be_32(*sqn >> 32); + } else if (priv_session->msg.ctrl_word.ext_seq != 0) { + desc_md->esn.low = rte_cpu_to_be_32(priv_session->ipsec.esn.low); + desc_md->esn.hi = rte_cpu_to_be_32(priv_session->ipsec.esn.hi); + } else { + desc_md->esn.low = rte_cpu_to_be_32(priv_session->ipsec.esn.value); + desc_md->esn.hi = 0; + } + + desc_md->enc = 1; + desc_md->sa_idx = rte_cpu_to_be_32(priv_session->sa_index); + } + + return 0; +} + /** * Get discards packet statistics for each SA * @@ -1247,6 +1288,7 @@ static const struct rte_security_ops nfp_security_ops = { .session_update = nfp_crypto_update_session, .session_get_size = nfp_security_session_get_size, .session_stats_get = nfp_security_session_get_stats, + .set_pkt_metadata = nfp_security_set_pkt_metadata, .capabilities_get = nfp_crypto_capabilities_get, }; diff --git a/drivers/net/nfp/nfp_ipsec.h b/drivers/net/nfp/nfp_ipsec.h index 531bc60c5a..cacb05f13e 100644 --- a/drivers/net/nfp/nfp_ipsec.h +++ b/drivers/net/nfp/nfp_ipsec.h @@ -163,6 +163,12 @@ struct nfp_net_ipsec_data { struct nfp_ipsec_session *sa_entries[NFP_NET_IPSEC_MAX_SA_CNT]; }; +enum nfp_ipsec_meta_layer { + NFP_IPSEC_META_SAIDX, /**< Order of SA index in metadata */ + NFP_IPSEC_META_SEQLOW, /**< Order of Sequence Number (low 32bits) in metadata */ + NFP_IPSEC_META_SEQHI, /**< Order of Sequence Number (high 32bits) in metadata */ +}; + int nfp_ipsec_init(struct rte_eth_dev *dev); void nfp_ipsec_uninit(struct rte_eth_dev *dev); diff --git a/drivers/net/nfp/nfp_rxtx.c b/drivers/net/nfp/nfp_rxtx.c index e74aba7439..66a5d6cb3a 100644 --- a/drivers/net/nfp/nfp_rxtx.c +++ b/drivers/net/nfp/nfp_rxtx.c @@ -8,11 +8,13 @@ #include "nfp_rxtx.h" #include +#include #include "nfd3/nfp_nfd3.h" #include "nfdk/nfp_nfdk.h" #include "flower/nfp_flower.h" +#include "nfp_ipsec.h" #include "nfp_logs.h" /* Maximum number of supported VLANs in parsed form packet metadata. */ @@ -25,8 +27,10 @@ * read-only after it have been recorded during parsing by nfp_net_parse_meta(). * * @port_id: Port id value + * @sa_idx: IPsec SA index * @hash: RSS hash value * @hash_type: RSS hash type + * @ipsec_type: IPsec type * @vlan_layer: The layers of VLAN info which are passed from nic. * Only this number of entries of the @vlan array are valid. * @@ -44,8 +48,10 @@ */ struct nfp_meta_parsed { uint32_t port_id; + uint32_t sa_idx; uint32_t hash; uint8_t hash_type; + uint8_t ipsec_type; uint8_t vlan_layer; struct { uint8_t offload; @@ -304,6 +310,10 @@ nfp_net_parse_chained_meta(uint8_t *meta_base, meta->vlan[meta->vlan_layer].tpid = NFP_NET_META_TPID(vlan_info); ++meta->vlan_layer; break; + case NFP_NET_META_IPSEC: + meta->sa_idx = rte_be_to_cpu_32(*(rte_be32_t *)meta_offset); + meta->ipsec_type = meta_info & NFP_NET_META_FIELD_MASK; + break; default: /* Unsupported metadata can be a performance issue */ return false; @@ -429,6 +439,39 @@ nfp_net_parse_meta_qinq(const struct nfp_meta_parsed *meta, mb->ol_flags |= RTE_MBUF_F_RX_QINQ | RTE_MBUF_F_RX_QINQ_STRIPPED; } +/* + * Set mbuf IPsec Offload features based on metadata info. + * + * The IPsec Offload features is prepended to the mbuf ol_flags. + * Extract and decode metadata info and set the mbuf ol_flags. + */ +static void +nfp_net_parse_meta_ipsec(struct nfp_meta_parsed *meta, + struct nfp_net_rxq *rxq, + struct rte_mbuf *mbuf) +{ + int offset; + uint32_t sa_idx; + struct nfp_net_hw *hw; + struct nfp_tx_ipsec_desc_msg *desc_md; + + hw = rxq->hw; + sa_idx = meta->sa_idx; + + if (meta->ipsec_type != NFP_NET_META_IPSEC) + return; + + if (sa_idx >= NFP_NET_IPSEC_MAX_SA_CNT) { + mbuf->ol_flags |= RTE_MBUF_F_RX_SEC_OFFLOAD_FAILED; + } else { + mbuf->ol_flags |= RTE_MBUF_F_RX_SEC_OFFLOAD; + offset = hw->ipsec_data->pkt_dynfield_offset; + desc_md = RTE_MBUF_DYNFIELD(mbuf, offset, struct nfp_tx_ipsec_desc_msg *); + desc_md->sa_idx = sa_idx; + desc_md->enc = 0; + } +} + /* nfp_net_parse_meta() - Parse the metadata from packet */ static void nfp_net_parse_meta(struct nfp_net_rx_desc *rxds, @@ -453,6 +496,7 @@ nfp_net_parse_meta(struct nfp_net_rx_desc *rxds, nfp_net_parse_meta_hash(meta, rxq, mb); nfp_net_parse_meta_vlan(meta, rxds, rxq, mb); nfp_net_parse_meta_qinq(meta, rxq, mb); + nfp_net_parse_meta_ipsec(meta, rxq, mb); } else { PMD_RX_LOG(DEBUG, "RX chained metadata format is wrong!"); } @@ -1035,6 +1079,36 @@ nfp_net_set_meta_vlan(struct nfp_net_meta_raw *meta_data, meta_data->data[layer] = rte_cpu_to_be_32(tpid << 16 | vlan_tci); } +void +nfp_net_set_meta_ipsec(struct nfp_net_meta_raw *meta_data, + struct nfp_net_txq *txq, + struct rte_mbuf *pkt, + uint8_t layer, + uint8_t ipsec_layer) +{ + int offset; + struct nfp_net_hw *hw; + struct nfp_tx_ipsec_desc_msg *desc_md; + + hw = txq->hw; + offset = hw->ipsec_data->pkt_dynfield_offset; + desc_md = RTE_MBUF_DYNFIELD(pkt, offset, struct nfp_tx_ipsec_desc_msg *); + + switch (ipsec_layer) { + case NFP_IPSEC_META_SAIDX: + meta_data->data[layer] = desc_md->sa_idx; + break; + case NFP_IPSEC_META_SEQLOW: + meta_data->data[layer] = desc_md->esn.low; + break; + case NFP_IPSEC_META_SEQHI: + meta_data->data[layer] = desc_md->esn.hi; + break; + default: + break; + } +} + int nfp_net_tx_queue_setup(struct rte_eth_dev *dev, uint16_t queue_idx, diff --git a/drivers/net/nfp/nfp_rxtx.h b/drivers/net/nfp/nfp_rxtx.h index 4e8558074e..3c7138f7d6 100644 --- a/drivers/net/nfp/nfp_rxtx.h +++ b/drivers/net/nfp/nfp_rxtx.h @@ -257,5 +257,10 @@ int nfp_net_tx_free_bufs(struct nfp_net_txq *txq); void nfp_net_set_meta_vlan(struct nfp_net_meta_raw *meta_data, struct rte_mbuf *pkt, uint8_t layer); +void nfp_net_set_meta_ipsec(struct nfp_net_meta_raw *meta_data, + struct nfp_net_txq *txq, + struct rte_mbuf *pkt, + uint8_t layer, + uint8_t ipsec_layer); #endif /* _NFP_RXTX_H_ */