This patch introduce new RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO action type to
security library. The type represents performing crypto operation with CPU
cycles. The patch also includes a new API to process crypto operations in
bulk and the function pointers for PMDs.
Signed-off-by: Fan Zhang <roy.fan.zh...@intel.com>
---
lib/librte_security/rte_security.c | 11 ++++++
lib/librte_security/rte_security.h | 53 +++++++++++++++++++++++++++-
lib/librte_security/rte_security_driver.h | 22 ++++++++++++
lib/librte_security/rte_security_version.map | 1 +
4 files changed, 86 insertions(+), 1 deletion(-)
diff --git a/lib/librte_security/rte_security.c
b/lib/librte_security/rte_security.c
index bc81ce15d..cdd1ee6af 100644
--- a/lib/librte_security/rte_security.c
+++ b/lib/librte_security/rte_security.c
@@ -141,3 +141,14 @@ rte_security_capability_get(struct rte_security_ctx
*instance,
return NULL;
}
+
+int
+rte_security_process_cpu_crypto_bulk(struct rte_security_ctx *instance,
+ struct rte_security_session *sess,
+ struct rte_security_vec buf[], void *iv[], void *aad[],
+ void *digest[], int status[], uint32_t num)
+{
+ RTE_FUNC_PTR_OR_ERR_RET(*instance->ops->process_cpu_crypto_bulk, -1);
+ return instance->ops->process_cpu_crypto_bulk(sess, buf, iv,
+ aad, digest, status, num);
+}
diff --git a/lib/librte_security/rte_security.h
b/lib/librte_security/rte_security.h
index aaafdfcd7..0caf5d697 100644
--- a/lib/librte_security/rte_security.h
+++ b/lib/librte_security/rte_security.h
@@ -18,6 +18,7 @@ extern "C" {
#endif
#include <sys/types.h>
+#include <sys/uio.h>
#include <netinet/in.h>
#include <netinet/ip.h>
@@ -289,6 +290,20 @@ struct rte_security_pdcp_xform {
uint32_t hfn_ovrd;
};
+struct rte_security_cpu_crypto_xform {
+ /** For cipher/authentication crypto operation the authentication may
+ * cover more content then the cipher. E.g., for IPSec ESP encryption
+ * with AES-CBC and SHA1-HMAC, the encryption happens after the ESP
+ * header but whole packet (apart from MAC header) is authenticated.
+ * The cipher_offset field is used to deduct the cipher data pointer
+ * from the buffer to be processed.
+ *
+ * NOTE this parameter shall be ignored by AEAD algorithms, since it
+ * uses the same offset for cipher and authentication.
+ */
+ int32_t cipher_offset;
+};
+
/**
* Security session action type.
*/
@@ -303,10 +318,14 @@ enum rte_security_session_action_type {
/**< All security protocol processing is performed inline during
* transmission
*/
- RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL
+ RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL,
/**< All security protocol processing including crypto is performed
* on a lookaside accelerator
*/
+ RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO
+ /**< Crypto processing for security protocol is processed by CPU
+ * synchronously
+ */
};
/** Security session protocol definition */
@@ -332,6 +351,7 @@ struct rte_security_session_conf {
struct rte_security_ipsec_xform ipsec;
struct rte_security_macsec_xform macsec;
struct rte_security_pdcp_xform pdcp;
+ struct rte_security_cpu_crypto_xform cpucrypto;
};
/**< Configuration parameters for security session */
struct rte_crypto_sym_xform *crypto_xform;
@@ -665,6 +685,37 @@ const struct rte_security_capability *
rte_security_capability_get(struct rte_security_ctx *instance,
struct rte_security_capability_idx *idx);
+/**
+ * Security vector structure, contains pointer to vector array and the length
+ * of the array
+ */
+struct rte_security_vec {
+ struct iovec *vec;
+ uint32_t num;
+};
+
+/**
+ * Processing bulk crypto workload with CPU
+ *
+ * @param instance security instance.
+ * @param sess security session
+ * @param buf array of buffer SGL vectors
+ * @param iv array of IV pointers
+ * @param aad array of AAD pointers
+ * @param digest array of digest pointers
+ * @param status array of status for the function to return
+ * @param num number of elements in each array
+ * @return
+ * - On success, 0
+ * - On any failure, -1
+ */
+__rte_experimental
+int
+rte_security_process_cpu_crypto_bulk(struct rte_security_ctx *instance,
+ struct rte_security_session *sess,
+ struct rte_security_vec buf[], void *iv[], void *aad[],
+ void *digest[], int status[], uint32_t num);
+
#ifdef __cplusplus
}
#endif
diff --git a/lib/librte_security/rte_security_driver.h
b/lib/librte_security/rte_security_driver.h
index 1b561f852..fe940fffa 100644
--- a/lib/librte_security/rte_security_driver.h
+++ b/lib/librte_security/rte_security_driver.h
@@ -132,6 +132,26 @@ typedef int (*security_get_userdata_t)(void *device,
typedef const struct rte_security_capability *(*security_capabilities_get_t)(
void *device);
+/**
+ * Process security operations in bulk using CPU accelerated method.
+ *
+ * @param sess Security session structure.
+ * @param buf Buffer to the vectors to be processed.
+ * @param iv IV pointers.
+ * @param aad AAD pointers.
+ * @param digest Digest pointers.
+ * @param status Array of status value.
+ * @param num Number of elements in each array.
+ * @return
+ * - On success, 0
+ * - On any failure, -1
+ */
+
+typedef int (*security_process_cpu_crypto_bulk_t)(
+ struct rte_security_session *sess,
+ struct rte_security_vec buf[], void *iv[], void *aad[],
+ void *digest[], int status[], uint32_t num);
+
/** Security operations function pointer table */
struct rte_security_ops {
security_session_create_t session_create;
@@ -150,6 +170,8 @@ struct rte_security_ops {
/**< Get userdata associated with session which processed the packet. */
security_capabilities_get_t capabilities_get;
/**< Get security capabilities. */
+ security_process_cpu_crypto_bulk_t process_cpu_crypto_bulk;
+ /**< Process data in bulk. */
};
#ifdef __cplusplus
diff --git a/lib/librte_security/rte_security_version.map
b/lib/librte_security/rte_security_version.map
index 53267bf3c..2132e7a00 100644
--- a/lib/librte_security/rte_security_version.map
+++ b/lib/librte_security/rte_security_version.map
@@ -18,4 +18,5 @@ EXPERIMENTAL {
rte_security_get_userdata;
rte_security_session_stats_get;
rte_security_session_update;
+ rte_security_process_cpu_crypto_bulk;
};
--
2.14.5
