Add SA lifetime configuration in security. SA lifetime tracking can be offloaded on supported PMDs.
SA lifetime would cover soft & hard expiry in units of number of packets and bytes. When SA soft expiry happens, the packet is successfuly processed but with additional expiry notification. Crypto op structure, ``rte_crypto_op`` is updated to cover such notifications with lookaside protocol offloads. SA hard expiration would cause IPsec processing to return an error. PMDs crypto_cn10k, crypto_cn9k and crypto_octeontx2 are updated with their respective lifetime tracking capabilities. Unit tests are added for soft and hard expiry with number of packets. Changes in v4: - Removed extra comments around auxilliary flag macros (comment from Konstantin) Changes in v3: - Removed explicit 0 setting of soft expiry configuration in ipsec-secgw (comment from Konstantin) Changes in v2: - Clear soft expiry configuration in ipsec-secgw - Rebased on v3 of dependent series Anoob Joseph (6): security: add SA lifetime configuration common/cnxk: support lifetime configuration crypto/octeontx2: add checks for life configuration test/crypto: add packets soft expiry cases test/crypto: add packets hard expiry cases examples/ipsec-secgw: clear soft expiry configuration app/test/test_cryptodev.c | 38 +++++++++++- app/test/test_cryptodev_security_ipsec.c | 40 +++++++++++-- app/test/test_cryptodev_security_ipsec.h | 5 +- .../test_cryptodev_security_ipsec_test_vectors.h | 3 - doc/guides/rel_notes/deprecation.rst | 5 -- doc/guides/rel_notes/release_21_11.rst | 13 ++++ drivers/common/cnxk/cnxk_security.c | 70 ++++++++++++++++++++++ drivers/crypto/cnxk/cn10k_cryptodev_ops.c | 48 +++++++++++---- drivers/crypto/cnxk/cn9k_ipsec.c | 6 +- drivers/crypto/octeontx2/otx2_ipsec_po.h | 6 ++ examples/ipsec-secgw/ipsec.c | 1 - examples/ipsec-secgw/ipsec.h | 2 - lib/cryptodev/rte_crypto.h | 12 +++- lib/security/rte_security.h | 28 ++++++++- 14 files changed, 243 insertions(+), 34 deletions(-) -- 2.7.4
