d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

crypto/dpaax_sec: enable anti replay window config

Browse Source 
This patch usages the anti replay window size to config
the anti replay checking  in decap path for lookaside
IPSEC offload

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
Acked-by: Akhil Goyal <akhil.goyal@nxp.com>
This commit is contained in:
Hemant Agrawal 2019-11-06 12:24:14 +05:30 committed by Akhil Goyal
parent 6909014946
commit a37ce227a8
4 changed files with 50 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
View File

@ -2904,6 +2904,27 @@ dpaa2_sec_set_ipsec_session(struct rte_cryptodev *dev,
sizeof(struct rte_ipv6_hdr) << 16;
if (ipsec_xform->options.esn)
decap_pdb.options |= PDBOPTS_ESP_ESN;
if (ipsec_xform->replay_win_sz) {
uint32_t win_sz;
win_sz = rte_align32pow2(ipsec_xform->replay_win_sz);
switch (win_sz) {
case 1:
case 2:
case 4:
case 8:
case 16:
case 32:
decap_pdb.options |= PDBOPTS_ESP_ARS32;
break;
case 64:
decap_pdb.options |= PDBOPTS_ESP_ARS64;
break;
default:
decap_pdb.options |= PDBOPTS_ESP_ARS128;
}
}
session->dir = DIR_DEC;
bufsize = cnstr_shdsc_ipsec_new_decap(priv->flc_desc[0].desc,
1, 0, SHR_SERIAL,

6
drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h
View File

@ -716,7 +716,8 @@ static const struct rte_security_capability dpaa2_sec_security_cap[] = {
.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
.options = { 0 }
.options = { 0 },
.replay_win_sz_max = 128
},
.crypto_capabilities = dpaa2_sec_capabilities
},
@ -727,7 +728,8 @@ static const struct rte_security_capability dpaa2_sec_security_cap[] = {
.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
.direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
.options = { 0 }
.options = { 0 },
.replay_win_sz_max = 128
},
.crypto_capabilities = dpaa2_sec_capabilities
},

21
drivers/crypto/dpaa_sec/dpaa_sec.c
View File

@ -2834,6 +2834,27 @@ dpaa_sec_set_ipsec_session(__rte_unused struct rte_cryptodev *dev,
sizeof(struct rte_ipv6_hdr) << 16;
if (ipsec_xform->options.esn)
session->decap_pdb.options |= PDBOPTS_ESP_ESN;
if (ipsec_xform->replay_win_sz) {
uint32_t win_sz;
win_sz = rte_align32pow2(ipsec_xform->replay_win_sz);
switch (win_sz) {
case 1:
case 2:
case 4:
case 8:
case 16:
case 32:
session->decap_pdb.options |= PDBOPTS_ESP_ARS32;
break;
case 64:
session->decap_pdb.options |= PDBOPTS_ESP_ARS64;
break;
default:
session->decap_pdb.options |=
PDBOPTS_ESP_ARS128;
}
}
} else
goto out;
rte_spinlock_lock(&internals->lock);

6
drivers/crypto/dpaa_sec/dpaa_sec.h
View File

@ -733,7 +733,8 @@ static const struct rte_security_capability dpaa_sec_security_cap[] = {
.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
.direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
.options = { 0 }
.options = { 0 },
.replay_win_sz_max = 128
},
.crypto_capabilities = dpaa_sec_capabilities
},
@ -744,7 +745,8 @@ static const struct rte_security_capability dpaa_sec_security_cap[] = {
.proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
.mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
.direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
.options = { 0 }
.options = { 0 },
.replay_win_sz_max = 128
},
.crypto_capabilities = dpaa_sec_capabilities
},