drivers/net/octeontx2/otx2_ethdev_sec.c

   1 /* SPDX-License-Identifier: BSD-3-Clause
   2  * Copyright (C) 2020 Marvell International Ltd.
   3  */
   4
   5 #include <rte_cryptodev.h>
   6 #include <rte_ethdev.h>
   7 #include <rte_eventdev.h>
   8 #include <rte_malloc.h>
   9 #include <rte_memzone.h>
  10 #include <rte_security.h>
  11 #include <rte_security_driver.h>
  12
  13 #include "otx2_cryptodev_qp.h"
  14 #include "otx2_ethdev.h"
  15 #include "otx2_ethdev_sec.h"
  16 #include "otx2_ipsec_fp.h"
  17 #include "otx2_sec_idev.h"
  18
  19 #define ETH_SEC_MAX_PKT_LEN     1450
  20
  21 struct eth_sec_tag_const {
  22         RTE_STD_C11
  23         union {
  24                 struct {
  25                         uint32_t rsvd_11_0  : 12;
  26                         uint32_t port       : 8;
  27                         uint32_t event_type : 4;
  28                         uint32_t rsvd_31_24 : 8;
  29                 };
  30                 uint32_t u32;
  31         };
  32 };
  33
  34 static struct rte_cryptodev_capabilities otx2_eth_sec_crypto_caps[] = {
  35         {       /* AES GCM */
  36                 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
  37                 {.sym = {
  38                         .xform_type = RTE_CRYPTO_SYM_XFORM_AEAD,
  39                         {.aead = {
  40                                 .algo = RTE_CRYPTO_AEAD_AES_GCM,
  41                                 .block_size = 16,
  42                                 .key_size = {
  43                                         .min = 16,
  44                                         .max = 32,
  45                                         .increment = 8
  46                                 },
  47                                 .digest_size = {
  48                                         .min = 16,
  49                                         .max = 16,
  50                                         .increment = 0
  51                                 },
  52                                 .aad_size = {
  53                                         .min = 8,
  54                                         .max = 12,
  55                                         .increment = 4
  56                                 },
  57                                 .iv_size = {
  58                                         .min = 12,
  59                                         .max = 12,
  60                                         .increment = 0
  61                                 }
  62                         }, }
  63                 }, }
  64         },
  65         {       /* AES CBC */
  66                 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
  67                 {.sym = {
  68                         .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
  69                         {.cipher = {
  70                                 .algo = RTE_CRYPTO_CIPHER_AES_CBC,
  71                                 .block_size = 16,
  72                                 .key_size = {
  73                                         .min = 16,
  74                                         .max = 32,
  75                                         .increment = 8
  76                                 },
  77                                 .iv_size = {
  78                                         .min = 16,
  79                                         .max = 16,
  80                                         .increment = 0
  81                                 }
  82                         }, }
  83                 }, }
  84         },
  85         {       /* SHA1 HMAC */
  86                 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
  87                 {.sym = {
  88                         .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
  89                         {.auth = {
  90                                 .algo = RTE_CRYPTO_AUTH_SHA1_HMAC,
  91                                 .block_size = 64,
  92                                 .key_size = {
  93                                         .min = 20,
  94                                         .max = 64,
  95                                         .increment = 1
  96                                 },
  97                                 .digest_size = {
  98                                         .min = 12,
  99                                         .max = 12,
 100                                         .increment = 0
 101                                 },
 102                         }, }
 103                 }, }
 104         },
 105         RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST()
 106 };
 107
 108 static const struct rte_security_capability otx2_eth_sec_capabilities[] = {
 109         {       /* IPsec Inline Protocol ESP Tunnel Ingress */
 110                 .action = RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL,
 111                 .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
 112                 .ipsec = {
 113                         .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
 114                         .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
 115                         .direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
 116                         .options = { 0 }
 117                 },
 118                 .crypto_capabilities = otx2_eth_sec_crypto_caps,
 119                 .ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA
 120         },
 121         {       /* IPsec Inline Protocol ESP Tunnel Egress */
 122                 .action = RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL,
 123                 .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
 124                 .ipsec = {
 125                         .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
 126                         .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
 127                         .direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
 128                         .options = { 0 }
 129                 },
 130                 .crypto_capabilities = otx2_eth_sec_crypto_caps,
 131                 .ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA
 132         },
 133         {
 134                 .action = RTE_SECURITY_ACTION_TYPE_NONE
 135         }
 136 };
 137
 138 static inline void
 139 in_sa_mz_name_get(char *name, int size, uint16_t port)
 140 {
 141         snprintf(name, size, "otx2_ipsec_in_sadb_%u", port);
 142 }
 143
 144 static struct otx2_ipsec_fp_in_sa *
 145 in_sa_get(uint16_t port, int sa_index)
 146 {
 147         char name[RTE_MEMZONE_NAMESIZE];
 148         struct otx2_ipsec_fp_in_sa *sa;
 149         const struct rte_memzone *mz;
 150
 151         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 152         mz = rte_memzone_lookup(name);
 153         if (mz == NULL) {
 154                 otx2_err("Could not get the memzone reserved for IN SA DB");
 155                 return NULL;
 156         }
 157
 158         sa = mz->addr;
 159
 160         return sa + sa_index;
 161 }
 162
 163 static int
 164 hmac_init(struct otx2_ipsec_fp_sa_ctl *ctl, struct otx2_cpt_qp *qp,
 165           const uint8_t *auth_key, int len, uint8_t *hmac_key)
 166 {
 167         struct inst_data {
 168                 struct otx2_cpt_res cpt_res;
 169                 uint8_t buffer[64];
 170         } *md;
 171
 172         volatile struct otx2_cpt_res *res;
 173         uint64_t timeout, lmt_status;
 174         struct otx2_cpt_inst_s inst;
 175         rte_iova_t md_iova;
 176         int ret;
 177
 178         memset(&inst, 0, sizeof(struct otx2_cpt_inst_s));
 179
 180         md = rte_zmalloc(NULL, sizeof(struct inst_data), OTX2_CPT_RES_ALIGN);
 181         if (md == NULL)
 182                 return -ENOMEM;
 183
 184         memcpy(md->buffer, auth_key, len);
 185
 186         md_iova = rte_malloc_virt2iova(md);
 187         if (md_iova == RTE_BAD_IOVA) {
 188                 ret = -EINVAL;
 189                 goto free_md;
 190         }
 191
 192         inst.res_addr = md_iova + offsetof(struct inst_data, cpt_res);
 193         inst.opcode = OTX2_CPT_OP_WRITE_HMAC_IPAD_OPAD;
 194         inst.param2 = ctl->auth_type;
 195         inst.dlen = len;
 196         inst.dptr = md_iova + offsetof(struct inst_data, buffer);
 197         inst.rptr = inst.dptr;
 198         inst.egrp = OTX2_CPT_EGRP_INLINE_IPSEC;
 199
 200         md->cpt_res.compcode = 0;
 201         md->cpt_res.uc_compcode = 0xff;
 202
 203         timeout = rte_get_timer_cycles() + 5 * rte_get_timer_hz();
 204
 205         rte_cio_wmb();
 206
 207         do {
 208                 otx2_lmt_mov(qp->lmtline, &inst, 2);
 209                 lmt_status = otx2_lmt_submit(qp->lf_nq_reg);
 210         } while (lmt_status == 0);
 211
 212         res = (volatile struct otx2_cpt_res *)&md->cpt_res;
 213
 214         /* Wait until instruction completes or times out */
 215         while (res->uc_compcode == 0xff) {
 216                 if (rte_get_timer_cycles() > timeout)
 217                         break;
 218         }
 219
 220         if (res->u16[0] != OTX2_SEC_COMP_GOOD) {
 221                 ret = -EIO;
 222                 goto free_md;
 223         }
 224
 225         /* Retrieve the ipad and opad from rptr */
 226         memcpy(hmac_key, md->buffer, 48);
 227
 228         ret = 0;
 229
 230 free_md:
 231         rte_free(md);
 232         return ret;
 233 }
 234
 235 static int
 236 eth_sec_ipsec_out_sess_create(struct rte_eth_dev *eth_dev,
 237                               struct rte_security_ipsec_xform *ipsec,
 238                               struct rte_crypto_sym_xform *crypto_xform,
 239                               struct rte_security_session *sec_sess)
 240 {
 241         struct rte_crypto_sym_xform *auth_xform, *cipher_xform;
 242         struct otx2_sec_session_ipsec_ip *sess;
 243         uint16_t port = eth_dev->data->port_id;
 244         int cipher_key_len, auth_key_len, ret;
 245         const uint8_t *cipher_key, *auth_key;
 246         struct otx2_ipsec_fp_sa_ctl *ctl;
 247         struct otx2_ipsec_fp_out_sa *sa;
 248         struct otx2_sec_session *priv;
 249         struct otx2_cpt_qp *qp;
 250
 251         priv = get_sec_session_private_data(sec_sess);
 252         sess = &priv->ipsec.ip;
 253
 254         sa = &sess->out_sa;
 255         ctl = &sa->ctl;
 256         if (ctl->valid) {
 257                 otx2_err("SA already registered");
 258                 return -EINVAL;
 259         }
 260
 261         memset(sess, 0, sizeof(struct otx2_sec_session_ipsec_ip));
 262
 263         if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD)
 264                 memcpy(sa->nonce, &ipsec->salt, 4);
 265
 266         if (ipsec->options.udp_encap == 1) {
 267                 sa->udp_src = 4500;
 268                 sa->udp_dst = 4500;
 269         }
 270
 271         if (ipsec->mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL) {
 272                 if (ipsec->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
 273                         memcpy(&sa->ip_src, &ipsec->tunnel.ipv4.src_ip,
 274                                sizeof(struct in_addr));
 275                         memcpy(&sa->ip_dst, &ipsec->tunnel.ipv4.dst_ip,
 276                                sizeof(struct in_addr));
 277                 } else {
 278                         return -EINVAL;
 279                 }
 280         } else {
 281                 return -EINVAL;
 282         }
 283
 284         cipher_xform = crypto_xform;
 285         auth_xform = crypto_xform->next;
 286
 287         cipher_key_len = 0;
 288         auth_key_len = 0;
 289         auth_key = NULL;
 290
 291         if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
 292                 cipher_key = crypto_xform->aead.key.data;
 293                 cipher_key_len = crypto_xform->aead.key.length;
 294         } else {
 295                 cipher_key = cipher_xform->cipher.key.data;
 296                 cipher_key_len = cipher_xform->cipher.key.length;
 297                 auth_key = auth_xform->auth.key.data;
 298                 auth_key_len = auth_xform->auth.key.length;
 299         }
 300
 301         if (cipher_key_len != 0)
 302                 memcpy(sa->cipher_key, cipher_key, cipher_key_len);
 303         else
 304                 return -EINVAL;
 305
 306         /* Get CPT QP to be used for this SA */
 307         ret = otx2_sec_idev_tx_cpt_qp_get(port, &qp);
 308         if (ret)
 309                 return ret;
 310
 311         sess->qp = qp;
 312
 313         sess->cpt_lmtline = qp->lmtline;
 314         sess->cpt_nq_reg = qp->lf_nq_reg;
 315
 316         /* Populate control word */
 317         ret = ipsec_fp_sa_ctl_set(ipsec, crypto_xform, ctl);
 318         if (ret)
 319                 goto cpt_put;
 320
 321         if (auth_key_len && auth_key) {
 322                 ret = hmac_init(ctl, qp, auth_key, auth_key_len, sa->hmac_key);
 323                 if (ret)
 324                         goto cpt_put;
 325         }
 326
 327         return 0;
 328 cpt_put:
 329         otx2_sec_idev_tx_cpt_qp_put(sess->qp);
 330         return ret;
 331 }
 332
 333 static int
 334 eth_sec_ipsec_in_sess_create(struct rte_eth_dev *eth_dev,
 335                              struct rte_security_ipsec_xform *ipsec,
 336                              struct rte_crypto_sym_xform *crypto_xform,
 337                              struct rte_security_session *sec_sess)
 338 {
 339         struct rte_crypto_sym_xform *auth_xform, *cipher_xform;
 340         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 341         struct otx2_sec_session_ipsec_ip *sess;
 342         uint16_t port = eth_dev->data->port_id;
 343         int cipher_key_len, auth_key_len, ret;
 344         const uint8_t *cipher_key, *auth_key;
 345         struct otx2_ipsec_fp_sa_ctl *ctl;
 346         struct otx2_ipsec_fp_in_sa *sa;
 347         struct otx2_sec_session *priv;
 348         struct otx2_cpt_qp *qp;
 349
 350         if (ipsec->spi >= dev->ipsec_in_max_spi) {
 351                 otx2_err("SPI exceeds max supported");
 352                 return -EINVAL;
 353         }
 354
 355         sa = in_sa_get(port, ipsec->spi);
 356         ctl = &sa->ctl;
 357
 358         priv = get_sec_session_private_data(sec_sess);
 359         sess = &priv->ipsec.ip;
 360
 361         if (ctl->valid) {
 362                 otx2_err("SA already registered");
 363                 return -EINVAL;
 364         }
 365
 366         memset(sa, 0, sizeof(struct otx2_ipsec_fp_in_sa));
 367
 368         auth_xform = crypto_xform;
 369         cipher_xform = crypto_xform->next;
 370
 371         cipher_key_len = 0;
 372         auth_key_len = 0;
 373         auth_key = NULL;
 374
 375         if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
 376                 if (crypto_xform->aead.algo == RTE_CRYPTO_AEAD_AES_GCM)
 377                         memcpy(sa->nonce, &ipsec->salt, 4);
 378                 cipher_key = crypto_xform->aead.key.data;
 379                 cipher_key_len = crypto_xform->aead.key.length;
 380         } else {
 381                 cipher_key = cipher_xform->cipher.key.data;
 382                 cipher_key_len = cipher_xform->cipher.key.length;
 383                 auth_key = auth_xform->auth.key.data;
 384                 auth_key_len = auth_xform->auth.key.length;
 385         }
 386
 387         if (cipher_key_len != 0)
 388                 memcpy(sa->cipher_key, cipher_key, cipher_key_len);
 389         else
 390                 return -EINVAL;
 391
 392         sess->in_sa = sa;
 393
 394         sa->userdata = priv->userdata;
 395
 396         ret = ipsec_fp_sa_ctl_set(ipsec, crypto_xform, ctl);
 397         if (ret)
 398                 return ret;
 399
 400         if (auth_key_len && auth_key) {
 401                 /* Get a queue pair for HMAC init */
 402                 ret = otx2_sec_idev_tx_cpt_qp_get(port, &qp);
 403                 if (ret)
 404                         return ret;
 405                 ret = hmac_init(ctl, qp, auth_key, auth_key_len, sa->hmac_key);
 406                 otx2_sec_idev_tx_cpt_qp_put(qp);
 407         }
 408         return ret;
 409 }
 410
 411 static int
 412 eth_sec_ipsec_sess_create(struct rte_eth_dev *eth_dev,
 413                           struct rte_security_ipsec_xform *ipsec,
 414                           struct rte_crypto_sym_xform *crypto_xform,
 415                           struct rte_security_session *sess)
 416 {
 417         int ret;
 418
 419         ret = ipsec_fp_xform_verify(ipsec, crypto_xform);
 420         if (ret)
 421                 return ret;
 422
 423         if (ipsec->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
 424                 return eth_sec_ipsec_in_sess_create(eth_dev, ipsec,
 425                                                     crypto_xform, sess);
 426         else
 427                 return eth_sec_ipsec_out_sess_create(eth_dev, ipsec,
 428                                                      crypto_xform, sess);
 429 }
 430
 431 static int
 432 otx2_eth_sec_session_create(void *device,
 433                             struct rte_security_session_conf *conf,
 434                             struct rte_security_session *sess,
 435                             struct rte_mempool *mempool)
 436 {
 437         struct otx2_sec_session *priv;
 438         int ret;
 439
 440         if (conf->action_type != RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL)
 441                 return -ENOTSUP;
 442
 443         if (rte_mempool_get(mempool, (void **)&priv)) {
 444                 otx2_err("Could not allocate security session private data");
 445                 return -ENOMEM;
 446         }
 447
 448         set_sec_session_private_data(sess, priv);
 449
 450         /*
 451          * Save userdata provided by the application. For ingress packets, this
 452          * could be used to identify the SA.
 453          */
 454         priv->userdata = conf->userdata;
 455
 456         if (conf->protocol == RTE_SECURITY_PROTOCOL_IPSEC)
 457                 ret = eth_sec_ipsec_sess_create(device, &conf->ipsec,
 458                                                 conf->crypto_xform,
 459                                                 sess);
 460         else
 461                 ret = -ENOTSUP;
 462
 463         if (ret)
 464                 goto mempool_put;
 465
 466         return 0;
 467
 468 mempool_put:
 469         rte_mempool_put(mempool, priv);
 470         set_sec_session_private_data(sess, NULL);
 471         return ret;
 472 }
 473
 474 static int
 475 otx2_eth_sec_session_destroy(void *device __rte_unused,
 476                              struct rte_security_session *sess)
 477 {
 478         struct otx2_sec_session_ipsec_ip *sess_ip;
 479         struct otx2_sec_session *priv;
 480         struct rte_mempool *sess_mp;
 481         int ret;
 482
 483         priv = get_sec_session_private_data(sess);
 484         if (priv == NULL)
 485                 return -EINVAL;
 486
 487         sess_ip = &priv->ipsec.ip;
 488
 489         /* Release CPT LF used for this session */
 490         if (sess_ip->qp != NULL) {
 491                 ret = otx2_sec_idev_tx_cpt_qp_put(sess_ip->qp);
 492                 if (ret)
 493                         return ret;
 494         }
 495
 496         sess_mp = rte_mempool_from_obj(priv);
 497
 498         set_sec_session_private_data(sess, NULL);
 499         rte_mempool_put(sess_mp, priv);
 500
 501         return 0;
 502 }
 503
 504 static unsigned int
 505 otx2_eth_sec_session_get_size(void *device __rte_unused)
 506 {
 507         return sizeof(struct otx2_sec_session);
 508 }
 509
 510 static const struct rte_security_capability *
 511 otx2_eth_sec_capabilities_get(void *device __rte_unused)
 512 {
 513         return otx2_eth_sec_capabilities;
 514 }
 515
 516 static struct rte_security_ops otx2_eth_sec_ops = {
 517         .session_create         = otx2_eth_sec_session_create,
 518         .session_destroy        = otx2_eth_sec_session_destroy,
 519         .session_get_size       = otx2_eth_sec_session_get_size,
 520         .capabilities_get       = otx2_eth_sec_capabilities_get
 521 };
 522
 523 int
 524 otx2_eth_sec_ctx_create(struct rte_eth_dev *eth_dev)
 525 {
 526         struct rte_security_ctx *ctx;
 527         int ret;
 528
 529         ctx = rte_malloc("otx2_eth_sec_ctx",
 530                          sizeof(struct rte_security_ctx), 0);
 531         if (ctx == NULL)
 532                 return -ENOMEM;
 533
 534         ret = otx2_sec_idev_cfg_init(eth_dev->data->port_id);
 535         if (ret) {
 536                 rte_free(ctx);
 537                 return ret;
 538         }
 539
 540         /* Populate ctx */
 541
 542         ctx->device = eth_dev;
 543         ctx->ops = &otx2_eth_sec_ops;
 544         ctx->sess_cnt = 0;
 545
 546         eth_dev->security_ctx = ctx;
 547
 548         return 0;
 549 }
 550
 551 void
 552 otx2_eth_sec_ctx_destroy(struct rte_eth_dev *eth_dev)
 553 {
 554         rte_free(eth_dev->security_ctx);
 555 }
 556
 557 static int
 558 eth_sec_ipsec_cfg(struct rte_eth_dev *eth_dev, uint8_t tt)
 559 {
 560         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 561         uint16_t port = eth_dev->data->port_id;
 562         struct nix_inline_ipsec_lf_cfg *req;
 563         struct otx2_mbox *mbox = dev->mbox;
 564         struct eth_sec_tag_const tag_const;
 565         char name[RTE_MEMZONE_NAMESIZE];
 566         const struct rte_memzone *mz;
 567
 568         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 569         mz = rte_memzone_lookup(name);
 570         if (mz == NULL)
 571                 return -EINVAL;
 572
 573         req = otx2_mbox_alloc_msg_nix_inline_ipsec_lf_cfg(mbox);
 574         req->enable = 1;
 575         req->sa_base_addr = mz->iova;
 576
 577         req->ipsec_cfg0.tt = tt;
 578
 579         tag_const.u32 = 0;
 580         tag_const.event_type = RTE_EVENT_TYPE_ETHDEV;
 581         tag_const.port = port;
 582         req->ipsec_cfg0.tag_const = tag_const.u32;
 583
 584         req->ipsec_cfg0.sa_pow2_size =
 585                         rte_log2_u32(sizeof(struct otx2_ipsec_fp_in_sa));
 586         req->ipsec_cfg0.lenm1_max = ETH_SEC_MAX_PKT_LEN - 1;
 587
 588         req->ipsec_cfg1.sa_idx_w = rte_log2_u32(dev->ipsec_in_max_spi);
 589         req->ipsec_cfg1.sa_idx_max = dev->ipsec_in_max_spi - 1;
 590
 591         return otx2_mbox_process(mbox);
 592 }
 593
 594 int
 595 otx2_eth_sec_init(struct rte_eth_dev *eth_dev)
 596 {
 597         const size_t sa_width = sizeof(struct otx2_ipsec_fp_in_sa);
 598         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 599         uint16_t port = eth_dev->data->port_id;
 600         char name[RTE_MEMZONE_NAMESIZE];
 601         const struct rte_memzone *mz;
 602         int mz_sz, ret;
 603         uint16_t nb_sa;
 604
 605         RTE_BUILD_BUG_ON(sa_width < 32 || sa_width > 512 ||
 606                          !RTE_IS_POWER_OF_2(sa_width));
 607
 608         if (!(dev->tx_offloads & DEV_TX_OFFLOAD_SECURITY) &&
 609             !(dev->rx_offloads & DEV_RX_OFFLOAD_SECURITY))
 610                 return 0;
 611
 612         nb_sa = dev->ipsec_in_max_spi;
 613         mz_sz = nb_sa * sa_width;
 614         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 615         mz = rte_memzone_reserve_aligned(name, mz_sz, rte_socket_id(),
 616                                          RTE_MEMZONE_IOVA_CONTIG, OTX2_ALIGN);
 617
 618         if (mz == NULL) {
 619                 otx2_err("Could not allocate inbound SA DB");
 620                 return -ENOMEM;
 621         }
 622
 623         memset(mz->addr, 0, mz_sz);
 624
 625         ret = eth_sec_ipsec_cfg(eth_dev, SSO_TT_ORDERED);
 626         if (ret < 0) {
 627                 otx2_err("Could not configure inline IPsec");
 628                 goto sec_fini;
 629         }
 630
 631         return 0;
 632
 633 sec_fini:
 634         otx2_err("Could not configure device for security");
 635         otx2_eth_sec_fini(eth_dev);
 636         return ret;
 637 }
 638
 639 void
 640 otx2_eth_sec_fini(struct rte_eth_dev *eth_dev)
 641 {
 642         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 643         uint16_t port = eth_dev->data->port_id;
 644         char name[RTE_MEMZONE_NAMESIZE];
 645
 646         if (!(dev->tx_offloads & DEV_TX_OFFLOAD_SECURITY) &&
 647             !(dev->rx_offloads & DEV_RX_OFFLOAD_SECURITY))
 648                 return;
 649
 650         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 651         rte_memzone_free(rte_memzone_lookup(name));
 652 }