d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

crypto/cnxk: add security capabilities

Browse Source 
Add security capabilities supported by crypto cn10k PMD.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
Signed-off-by: Srujana Challa <schalla@marvell.com>
Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
Acked-by: Akhil Goyal <gakhil@marvell.com>
This commit is contained in:
Anoob Joseph 2021-06-29 13:04:32 +05:30 committed by Akhil Goyal
parent baee42a6be
commit 69407e7936
8 changed files with 155 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
doc/guides/cryptodevs/cnxk.rst
View File

@ -185,6 +185,30 @@ running the test application:
./dpdk-test
RTE>>cryptodev_cn10k_autotest
Lookaside IPsec Support
-----------------------
The OCTEON cnxk SoCs can accelerate IPsec traffic in lookaside protocol mode,
with its **cryptographic accelerator (CPT)**. ``OCTEON cnxk crypto PMD`` implements
this as an ``RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL`` offload.
Refer to :doc:`../prog_guide/rte_security` for more details on protocol offloads.
This feature can be tested with ipsec-secgw sample application.
Supported OCTEON cnxk SoCs
~~~~~~~~~~~~~~~~~~~~~~~~~~
- CN10XX
Features supported
~~~~~~~~~~~~~~~~~~
* IPv4
* ESP
* Tunnel mode
* AES-128/192/256-GCM
Limitations
-----------

1
doc/guides/cryptodevs/features/cn10k.ini
View File

@ -7,6 +7,7 @@
Symmetric crypto = Y
Sym operation chaining = Y
HW Accelerated = Y
Protocol offload = Y
In Place SGL = Y
OOP SGL In LB Out = Y
OOP SGL In SGL Out = Y

1
doc/guides/rel_notes/release_21_08.rst
View File

@ -89,6 +89,7 @@ New Features
* Added cnxk crypto PMD which provides support for an integrated
crypto driver for CN9K and CN10K series of SOCs. Support for
symmetric crypto algorithms is added to both the PMDs.
* Added support for lookaside protocol (IPsec) offload in cn10k PMD.
* **Added Baseband PHY CNXK PMD.**

1
drivers/crypto/cnxk/cn10k_cryptodev.c
View File

@ -99,6 +99,7 @@ cn10k_cpt_pci_probe(struct rte_pci_driver *pci_drv __rte_unused,
RTE_CRYPTODEV_FF_OOP_SGL_IN_LB_OUT |
RTE_CRYPTODEV_FF_OOP_SGL_IN_SGL_OUT |
RTE_CRYPTODEV_FF_SYM_SESSIONLESS |
RTE_CRYPTODEV_FF_SECURITY |
RTE_CRYPTODEV_FF_DIGEST_ENCRYPTED;
cn10k_cpt_set_enqdeq_fns(dev);

4
drivers/crypto/cnxk/cnxk_cryptodev.h
View File

@ -6,6 +6,7 @@
#define _CNXK_CRYPTODEV_H_
#include <rte_cryptodev.h>
#include <rte_security.h>
#include "roc_cpt.h"
@ -19,6 +20,9 @@
struct cnxk_cpt_vf {
struct roc_cpt cpt;
struct rte_cryptodev_capabilities crypto_caps[CNXK_CPT_MAX_CAPS];
struct rte_cryptodev_capabilities
sec_crypto_caps[CNXK_SEC_CRYPTO_MAX_CAPS];
struct rte_security_capability sec_caps[CNXK_SEC_MAX_CAPS];
};
int cnxk_cpt_eng_grp_add(struct roc_cpt *roc_cpt);

114
drivers/crypto/cnxk/cnxk_cryptodev_capabilities.c
View File

@ -3,6 +3,7 @@
*/
#include <rte_cryptodev.h>
#include <rte_security.h>
#include "roc_api.h"
@ -18,6 +19,15 @@
RTE_DIM(caps_##name)); \
} while (0)
#define SEC_CAPS_ADD(cnxk_caps, cur_pos, hw_caps, name) \
do { \
if ((hw_caps[CPT_ENG_TYPE_SE].name) || \
(hw_caps[CPT_ENG_TYPE_IE].name) || \
(hw_caps[CPT_ENG_TYPE_AE].name)) \
sec_caps_add(cnxk_caps, cur_pos, sec_caps_##name, \
RTE_DIM(sec_caps_##name)); \
} while (0)
static const struct rte_cryptodev_capabilities caps_sha1_sha2[] = {
{ /* SHA1 */
.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
@ -658,6 +668,69 @@ static const struct rte_cryptodev_capabilities caps_end[] = {
RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST()
};
static const struct rte_cryptodev_capabilities sec_caps_aes[] = {
{ /* AES GCM */
.op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
{.sym = {
.xform_type = RTE_CRYPTO_SYM_XFORM_AEAD,
{.aead = {
.algo = RTE_CRYPTO_AEAD_AES_GCM,
.block_size = 16,
.key_size = {
.min = 16,
.max = 32,
.increment = 8
},
.digest_size = {
.min = 16,
.max = 16,
.increment = 0
},
.aad_size = {
.min = 8,
.max = 12,
.increment = 4
},
.iv_size = {
.min = 12,
.max = 12,
.increment = 0
}
}, }
}, }
},
};
static const struct rte_security_capability sec_caps_templ[] = {
{ /* IPsec Lookaside Protocol ESP Tunnel Ingress */
.action = RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL,
.protocol = RTE_SECURITY_PROTOCOL_IPSEC,
.ipsec = {
.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
.direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
.options = { 0 }
},
.crypto_capabilities = NULL,
.ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA
},
{ /* IPsec Lookaside Protocol ESP Tunnel Egress */
.action = RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL,
.protocol = RTE_SECURITY_PROTOCOL_IPSEC,
.ipsec = {
.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
.options = { 0 }
},
.crypto_capabilities = NULL,
.ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA
},
{
.action = RTE_SECURITY_ACTION_TYPE_NONE
}
};
static void
cpt_caps_add(struct rte_cryptodev_capabilities cnxk_caps[], int *cur_pos,
const struct rte_cryptodev_capabilities *caps, int nb_caps)
@ -692,8 +765,49 @@ cnxk_crypto_capabilities_get(struct cnxk_cpt_vf *vf)
return vf->crypto_caps;
}
static void
sec_caps_add(struct rte_cryptodev_capabilities cnxk_caps[], int *cur_pos,
const struct rte_cryptodev_capabilities *caps, int nb_caps)
{
if (*cur_pos + nb_caps > CNXK_SEC_CRYPTO_MAX_CAPS)
return;
memcpy(&cnxk_caps[*cur_pos], caps, nb_caps * sizeof(caps[0]));
*cur_pos += nb_caps;
}
static void
sec_crypto_caps_populate(struct rte_cryptodev_capabilities cnxk_caps[],
union cpt_eng_caps *hw_caps)
{
int cur_pos = 0;
SEC_CAPS_ADD(cnxk_caps, &cur_pos, hw_caps, aes);
sec_caps_add(cnxk_caps, &cur_pos, caps_end, RTE_DIM(caps_end));
}
void
cnxk_cpt_caps_populate(struct cnxk_cpt_vf *vf)
{
unsigned long i;
crypto_caps_populate(vf->crypto_caps, vf->cpt.hw_caps);
sec_crypto_caps_populate(vf->sec_crypto_caps, vf->cpt.hw_caps);
PLT_STATIC_ASSERT(RTE_DIM(sec_caps_templ) <= RTE_DIM(vf->sec_caps));
memcpy(vf->sec_caps, sec_caps_templ, sizeof(sec_caps_templ));
for (i = 0; i < RTE_DIM(sec_caps_templ) - 1; i++)
vf->sec_caps[i].crypto_capabilities = vf->sec_crypto_caps;
}
const struct rte_security_capability *
cnxk_crypto_sec_capabilities_get(void *device)
{
struct rte_cryptodev *dev = device;
struct cnxk_cpt_vf *vf;
vf = dev->data->dev_private;
return vf->sec_caps;
}

9
drivers/crypto/cnxk/cnxk_cryptodev_capabilities.h
View File

@ -10,7 +10,7 @@
#include "cnxk_cryptodev.h"
/*
* Initialize crypto capabilities for the device
* Initialize crypto and IPsec capabilities for the device
*
*/
void cnxk_cpt_caps_populate(struct cnxk_cpt_vf *vf);
@ -22,4 +22,11 @@ void cnxk_cpt_caps_populate(struct cnxk_cpt_vf *vf);
const struct rte_cryptodev_capabilities *
cnxk_crypto_capabilities_get(struct cnxk_cpt_vf *vf);
/*
* Get security capabilities list for the device
*
*/
const struct rte_security_capability *
cnxk_crypto_sec_capabilities_get(void *device);
#endif /* _CNXK_CRYPTODEV_CAPABILITIES_H_ */

3
drivers/crypto/cnxk/cnxk_cryptodev_sec.c
View File

@ -7,6 +7,7 @@
#include <rte_security.h>
#include <rte_security_driver.h>
#include "cnxk_cryptodev_capabilities.h"
#include "cnxk_cryptodev_sec.h"
/* Common security ops */
@ -16,7 +17,7 @@ struct rte_security_ops cnxk_sec_ops = {
.session_get_size = NULL,
.set_pkt_metadata = NULL,
.get_userdata = NULL,
.capabilities_get = NULL,
.capabilities_get = cnxk_crypto_sec_capabilities_get
};
int