drivers/net/octeontx2/otx2_ethdev_sec.c

   1 /* SPDX-License-Identifier: BSD-3-Clause
   2  * Copyright (C) 2020 Marvell International Ltd.
   3  */
   4
   5 #include <rte_cryptodev.h>
   6 #include <rte_ethdev.h>
   7 #include <rte_eventdev.h>
   8 #include <rte_malloc.h>
   9 #include <rte_memzone.h>
  10 #include <rte_security.h>
  11 #include <rte_security_driver.h>
  12
  13 #include "otx2_common.h"
  14 #include "otx2_cryptodev_qp.h"
  15 #include "otx2_ethdev.h"
  16 #include "otx2_ethdev_sec.h"
  17 #include "otx2_ipsec_fp.h"
  18 #include "otx2_sec_idev.h"
  19
  20 #define ETH_SEC_MAX_PKT_LEN     1450
  21
  22 struct eth_sec_tag_const {
  23         RTE_STD_C11
  24         union {
  25                 struct {
  26                         uint32_t rsvd_11_0  : 12;
  27                         uint32_t port       : 8;
  28                         uint32_t event_type : 4;
  29                         uint32_t rsvd_31_24 : 8;
  30                 };
  31                 uint32_t u32;
  32         };
  33 };
  34
  35 static struct rte_cryptodev_capabilities otx2_eth_sec_crypto_caps[] = {
  36         {       /* AES GCM */
  37                 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
  38                 {.sym = {
  39                         .xform_type = RTE_CRYPTO_SYM_XFORM_AEAD,
  40                         {.aead = {
  41                                 .algo = RTE_CRYPTO_AEAD_AES_GCM,
  42                                 .block_size = 16,
  43                                 .key_size = {
  44                                         .min = 16,
  45                                         .max = 32,
  46                                         .increment = 8
  47                                 },
  48                                 .digest_size = {
  49                                         .min = 16,
  50                                         .max = 16,
  51                                         .increment = 0
  52                                 },
  53                                 .aad_size = {
  54                                         .min = 8,
  55                                         .max = 12,
  56                                         .increment = 4
  57                                 },
  58                                 .iv_size = {
  59                                         .min = 12,
  60                                         .max = 12,
  61                                         .increment = 0
  62                                 }
  63                         }, }
  64                 }, }
  65         },
  66         {       /* AES CBC */
  67                 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
  68                 {.sym = {
  69                         .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
  70                         {.cipher = {
  71                                 .algo = RTE_CRYPTO_CIPHER_AES_CBC,
  72                                 .block_size = 16,
  73                                 .key_size = {
  74                                         .min = 16,
  75                                         .max = 32,
  76                                         .increment = 8
  77                                 },
  78                                 .iv_size = {
  79                                         .min = 16,
  80                                         .max = 16,
  81                                         .increment = 0
  82                                 }
  83                         }, }
  84                 }, }
  85         },
  86         {       /* SHA1 HMAC */
  87                 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
  88                 {.sym = {
  89                         .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
  90                         {.auth = {
  91                                 .algo = RTE_CRYPTO_AUTH_SHA1_HMAC,
  92                                 .block_size = 64,
  93                                 .key_size = {
  94                                         .min = 20,
  95                                         .max = 64,
  96                                         .increment = 1
  97                                 },
  98                                 .digest_size = {
  99                                         .min = 12,
 100                                         .max = 12,
 101                                         .increment = 0
 102                                 },
 103                         }, }
 104                 }, }
 105         },
 106         RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST()
 107 };
 108
 109 static const struct rte_security_capability otx2_eth_sec_capabilities[] = {
 110         {       /* IPsec Inline Protocol ESP Tunnel Ingress */
 111                 .action = RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL,
 112                 .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
 113                 .ipsec = {
 114                         .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
 115                         .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
 116                         .direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
 117                         .options = { 0 }
 118                 },
 119                 .crypto_capabilities = otx2_eth_sec_crypto_caps,
 120                 .ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA
 121         },
 122         {       /* IPsec Inline Protocol ESP Tunnel Egress */
 123                 .action = RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL,
 124                 .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
 125                 .ipsec = {
 126                         .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
 127                         .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
 128                         .direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
 129                         .options = { 0 }
 130                 },
 131                 .crypto_capabilities = otx2_eth_sec_crypto_caps,
 132                 .ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA
 133         },
 134         {
 135                 .action = RTE_SECURITY_ACTION_TYPE_NONE
 136         }
 137 };
 138
 139 static void
 140 lookup_mem_sa_tbl_clear(struct rte_eth_dev *eth_dev)
 141 {
 142         static const char name[] = OTX2_NIX_FASTPATH_LOOKUP_MEM;
 143         uint16_t port = eth_dev->data->port_id;
 144         const struct rte_memzone *mz;
 145         uint64_t **sa_tbl;
 146         uint8_t *mem;
 147
 148         mz = rte_memzone_lookup(name);
 149         if (mz == NULL)
 150                 return;
 151
 152         mem = mz->addr;
 153
 154         sa_tbl  = (uint64_t **)RTE_PTR_ADD(mem, OTX2_NIX_SA_TBL_START);
 155         if (sa_tbl[port] == NULL)
 156                 return;
 157
 158         rte_free(sa_tbl[port]);
 159         sa_tbl[port] = NULL;
 160 }
 161
 162 static int
 163 lookup_mem_sa_index_update(struct rte_eth_dev *eth_dev, int spi, void *sa)
 164 {
 165         static const char name[] = OTX2_NIX_FASTPATH_LOOKUP_MEM;
 166         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 167         uint16_t port = eth_dev->data->port_id;
 168         const struct rte_memzone *mz;
 169         uint64_t **sa_tbl;
 170         uint8_t *mem;
 171
 172         mz = rte_memzone_lookup(name);
 173         if (mz == NULL) {
 174                 otx2_err("Could not find fastpath lookup table");
 175                 return -EINVAL;
 176         }
 177
 178         mem = mz->addr;
 179
 180         sa_tbl = (uint64_t **)RTE_PTR_ADD(mem, OTX2_NIX_SA_TBL_START);
 181
 182         if (sa_tbl[port] == NULL) {
 183                 sa_tbl[port] = rte_malloc(NULL, dev->ipsec_in_max_spi *
 184                                           sizeof(uint64_t), 0);
 185         }
 186
 187         sa_tbl[port][spi] = (uint64_t)sa;
 188
 189         return 0;
 190 }
 191
 192 static inline void
 193 in_sa_mz_name_get(char *name, int size, uint16_t port)
 194 {
 195         snprintf(name, size, "otx2_ipsec_in_sadb_%u", port);
 196 }
 197
 198 static struct otx2_ipsec_fp_in_sa *
 199 in_sa_get(uint16_t port, int sa_index)
 200 {
 201         char name[RTE_MEMZONE_NAMESIZE];
 202         struct otx2_ipsec_fp_in_sa *sa;
 203         const struct rte_memzone *mz;
 204
 205         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 206         mz = rte_memzone_lookup(name);
 207         if (mz == NULL) {
 208                 otx2_err("Could not get the memzone reserved for IN SA DB");
 209                 return NULL;
 210         }
 211
 212         sa = mz->addr;
 213
 214         return sa + sa_index;
 215 }
 216
 217 static int
 218 hmac_init(struct otx2_ipsec_fp_sa_ctl *ctl, struct otx2_cpt_qp *qp,
 219           const uint8_t *auth_key, int len, uint8_t *hmac_key)
 220 {
 221         struct inst_data {
 222                 struct otx2_cpt_res cpt_res;
 223                 uint8_t buffer[64];
 224         } *md;
 225
 226         volatile struct otx2_cpt_res *res;
 227         uint64_t timeout, lmt_status;
 228         struct otx2_cpt_inst_s inst;
 229         rte_iova_t md_iova;
 230         int ret;
 231
 232         memset(&inst, 0, sizeof(struct otx2_cpt_inst_s));
 233
 234         md = rte_zmalloc(NULL, sizeof(struct inst_data), OTX2_CPT_RES_ALIGN);
 235         if (md == NULL)
 236                 return -ENOMEM;
 237
 238         memcpy(md->buffer, auth_key, len);
 239
 240         md_iova = rte_malloc_virt2iova(md);
 241         if (md_iova == RTE_BAD_IOVA) {
 242                 ret = -EINVAL;
 243                 goto free_md;
 244         }
 245
 246         inst.res_addr = md_iova + offsetof(struct inst_data, cpt_res);
 247         inst.opcode = OTX2_CPT_OP_WRITE_HMAC_IPAD_OPAD;
 248         inst.param2 = ctl->auth_type;
 249         inst.dlen = len;
 250         inst.dptr = md_iova + offsetof(struct inst_data, buffer);
 251         inst.rptr = inst.dptr;
 252         inst.egrp = OTX2_CPT_EGRP_INLINE_IPSEC;
 253
 254         md->cpt_res.compcode = 0;
 255         md->cpt_res.uc_compcode = 0xff;
 256
 257         timeout = rte_get_timer_cycles() + 5 * rte_get_timer_hz();
 258
 259         rte_cio_wmb();
 260
 261         do {
 262                 otx2_lmt_mov(qp->lmtline, &inst, 2);
 263                 lmt_status = otx2_lmt_submit(qp->lf_nq_reg);
 264         } while (lmt_status == 0);
 265
 266         res = (volatile struct otx2_cpt_res *)&md->cpt_res;
 267
 268         /* Wait until instruction completes or times out */
 269         while (res->uc_compcode == 0xff) {
 270                 if (rte_get_timer_cycles() > timeout)
 271                         break;
 272         }
 273
 274         if (res->u16[0] != OTX2_SEC_COMP_GOOD) {
 275                 ret = -EIO;
 276                 goto free_md;
 277         }
 278
 279         /* Retrieve the ipad and opad from rptr */
 280         memcpy(hmac_key, md->buffer, 48);
 281
 282         ret = 0;
 283
 284 free_md:
 285         rte_free(md);
 286         return ret;
 287 }
 288
 289 static int
 290 eth_sec_ipsec_out_sess_create(struct rte_eth_dev *eth_dev,
 291                               struct rte_security_ipsec_xform *ipsec,
 292                               struct rte_crypto_sym_xform *crypto_xform,
 293                               struct rte_security_session *sec_sess)
 294 {
 295         struct rte_crypto_sym_xform *auth_xform, *cipher_xform;
 296         struct otx2_sec_session_ipsec_ip *sess;
 297         uint16_t port = eth_dev->data->port_id;
 298         int cipher_key_len, auth_key_len, ret;
 299         const uint8_t *cipher_key, *auth_key;
 300         struct otx2_ipsec_fp_sa_ctl *ctl;
 301         struct otx2_ipsec_fp_out_sa *sa;
 302         struct otx2_sec_session *priv;
 303         struct otx2_cpt_qp *qp;
 304
 305         priv = get_sec_session_private_data(sec_sess);
 306         sess = &priv->ipsec.ip;
 307
 308         sa = &sess->out_sa;
 309         ctl = &sa->ctl;
 310         if (ctl->valid) {
 311                 otx2_err("SA already registered");
 312                 return -EINVAL;
 313         }
 314
 315         memset(sess, 0, sizeof(struct otx2_sec_session_ipsec_ip));
 316
 317         if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD)
 318                 memcpy(sa->nonce, &ipsec->salt, 4);
 319
 320         if (ipsec->options.udp_encap == 1) {
 321                 sa->udp_src = 4500;
 322                 sa->udp_dst = 4500;
 323         }
 324
 325         if (ipsec->mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL) {
 326                 if (ipsec->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
 327                         memcpy(&sa->ip_src, &ipsec->tunnel.ipv4.src_ip,
 328                                sizeof(struct in_addr));
 329                         memcpy(&sa->ip_dst, &ipsec->tunnel.ipv4.dst_ip,
 330                                sizeof(struct in_addr));
 331                 } else {
 332                         return -EINVAL;
 333                 }
 334         } else {
 335                 return -EINVAL;
 336         }
 337
 338         cipher_xform = crypto_xform;
 339         auth_xform = crypto_xform->next;
 340
 341         cipher_key_len = 0;
 342         auth_key_len = 0;
 343         auth_key = NULL;
 344
 345         if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
 346                 cipher_key = crypto_xform->aead.key.data;
 347                 cipher_key_len = crypto_xform->aead.key.length;
 348         } else {
 349                 cipher_key = cipher_xform->cipher.key.data;
 350                 cipher_key_len = cipher_xform->cipher.key.length;
 351                 auth_key = auth_xform->auth.key.data;
 352                 auth_key_len = auth_xform->auth.key.length;
 353         }
 354
 355         if (cipher_key_len != 0)
 356                 memcpy(sa->cipher_key, cipher_key, cipher_key_len);
 357         else
 358                 return -EINVAL;
 359
 360         /* Get CPT QP to be used for this SA */
 361         ret = otx2_sec_idev_tx_cpt_qp_get(port, &qp);
 362         if (ret)
 363                 return ret;
 364
 365         sess->qp = qp;
 366
 367         sess->cpt_lmtline = qp->lmtline;
 368         sess->cpt_nq_reg = qp->lf_nq_reg;
 369
 370         /* Populate control word */
 371         ret = ipsec_fp_sa_ctl_set(ipsec, crypto_xform, ctl);
 372         if (ret)
 373                 goto cpt_put;
 374
 375         if (auth_key_len && auth_key) {
 376                 ret = hmac_init(ctl, qp, auth_key, auth_key_len, sa->hmac_key);
 377                 if (ret)
 378                         goto cpt_put;
 379         }
 380
 381         return 0;
 382 cpt_put:
 383         otx2_sec_idev_tx_cpt_qp_put(sess->qp);
 384         return ret;
 385 }
 386
 387 static int
 388 eth_sec_ipsec_in_sess_create(struct rte_eth_dev *eth_dev,
 389                              struct rte_security_ipsec_xform *ipsec,
 390                              struct rte_crypto_sym_xform *crypto_xform,
 391                              struct rte_security_session *sec_sess)
 392 {
 393         struct rte_crypto_sym_xform *auth_xform, *cipher_xform;
 394         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 395         struct otx2_sec_session_ipsec_ip *sess;
 396         uint16_t port = eth_dev->data->port_id;
 397         int cipher_key_len, auth_key_len, ret;
 398         const uint8_t *cipher_key, *auth_key;
 399         struct otx2_ipsec_fp_sa_ctl *ctl;
 400         struct otx2_ipsec_fp_in_sa *sa;
 401         struct otx2_sec_session *priv;
 402         struct otx2_cpt_qp *qp;
 403
 404         if (ipsec->spi >= dev->ipsec_in_max_spi) {
 405                 otx2_err("SPI exceeds max supported");
 406                 return -EINVAL;
 407         }
 408
 409         sa = in_sa_get(port, ipsec->spi);
 410         ctl = &sa->ctl;
 411
 412         priv = get_sec_session_private_data(sec_sess);
 413         sess = &priv->ipsec.ip;
 414
 415         if (ctl->valid) {
 416                 otx2_err("SA already registered");
 417                 return -EINVAL;
 418         }
 419
 420         memset(sa, 0, sizeof(struct otx2_ipsec_fp_in_sa));
 421
 422         auth_xform = crypto_xform;
 423         cipher_xform = crypto_xform->next;
 424
 425         cipher_key_len = 0;
 426         auth_key_len = 0;
 427         auth_key = NULL;
 428
 429         if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
 430                 if (crypto_xform->aead.algo == RTE_CRYPTO_AEAD_AES_GCM)
 431                         memcpy(sa->nonce, &ipsec->salt, 4);
 432                 cipher_key = crypto_xform->aead.key.data;
 433                 cipher_key_len = crypto_xform->aead.key.length;
 434         } else {
 435                 cipher_key = cipher_xform->cipher.key.data;
 436                 cipher_key_len = cipher_xform->cipher.key.length;
 437                 auth_key = auth_xform->auth.key.data;
 438                 auth_key_len = auth_xform->auth.key.length;
 439         }
 440
 441         if (cipher_key_len != 0)
 442                 memcpy(sa->cipher_key, cipher_key, cipher_key_len);
 443         else
 444                 return -EINVAL;
 445
 446         sess->in_sa = sa;
 447
 448         sa->userdata = priv->userdata;
 449
 450         if (lookup_mem_sa_index_update(eth_dev, ipsec->spi, sa))
 451                 return -EINVAL;
 452
 453         ret = ipsec_fp_sa_ctl_set(ipsec, crypto_xform, ctl);
 454         if (ret)
 455                 return ret;
 456
 457         if (auth_key_len && auth_key) {
 458                 /* Get a queue pair for HMAC init */
 459                 ret = otx2_sec_idev_tx_cpt_qp_get(port, &qp);
 460                 if (ret)
 461                         return ret;
 462                 ret = hmac_init(ctl, qp, auth_key, auth_key_len, sa->hmac_key);
 463                 otx2_sec_idev_tx_cpt_qp_put(qp);
 464         }
 465         return ret;
 466 }
 467
 468 static int
 469 eth_sec_ipsec_sess_create(struct rte_eth_dev *eth_dev,
 470                           struct rte_security_ipsec_xform *ipsec,
 471                           struct rte_crypto_sym_xform *crypto_xform,
 472                           struct rte_security_session *sess)
 473 {
 474         int ret;
 475
 476         ret = ipsec_fp_xform_verify(ipsec, crypto_xform);
 477         if (ret)
 478                 return ret;
 479
 480         if (ipsec->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
 481                 return eth_sec_ipsec_in_sess_create(eth_dev, ipsec,
 482                                                     crypto_xform, sess);
 483         else
 484                 return eth_sec_ipsec_out_sess_create(eth_dev, ipsec,
 485                                                      crypto_xform, sess);
 486 }
 487
 488 static int
 489 otx2_eth_sec_session_create(void *device,
 490                             struct rte_security_session_conf *conf,
 491                             struct rte_security_session *sess,
 492                             struct rte_mempool *mempool)
 493 {
 494         struct otx2_sec_session *priv;
 495         int ret;
 496
 497         if (conf->action_type != RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL)
 498                 return -ENOTSUP;
 499
 500         if (rte_mempool_get(mempool, (void **)&priv)) {
 501                 otx2_err("Could not allocate security session private data");
 502                 return -ENOMEM;
 503         }
 504
 505         set_sec_session_private_data(sess, priv);
 506
 507         /*
 508          * Save userdata provided by the application. For ingress packets, this
 509          * could be used to identify the SA.
 510          */
 511         priv->userdata = conf->userdata;
 512
 513         if (conf->protocol == RTE_SECURITY_PROTOCOL_IPSEC)
 514                 ret = eth_sec_ipsec_sess_create(device, &conf->ipsec,
 515                                                 conf->crypto_xform,
 516                                                 sess);
 517         else
 518                 ret = -ENOTSUP;
 519
 520         if (ret)
 521                 goto mempool_put;
 522
 523         return 0;
 524
 525 mempool_put:
 526         rte_mempool_put(mempool, priv);
 527         set_sec_session_private_data(sess, NULL);
 528         return ret;
 529 }
 530
 531 static int
 532 otx2_eth_sec_session_destroy(void *device __rte_unused,
 533                              struct rte_security_session *sess)
 534 {
 535         struct otx2_sec_session_ipsec_ip *sess_ip;
 536         struct otx2_sec_session *priv;
 537         struct rte_mempool *sess_mp;
 538         int ret;
 539
 540         priv = get_sec_session_private_data(sess);
 541         if (priv == NULL)
 542                 return -EINVAL;
 543
 544         sess_ip = &priv->ipsec.ip;
 545
 546         /* Release CPT LF used for this session */
 547         if (sess_ip->qp != NULL) {
 548                 ret = otx2_sec_idev_tx_cpt_qp_put(sess_ip->qp);
 549                 if (ret)
 550                         return ret;
 551         }
 552
 553         sess_mp = rte_mempool_from_obj(priv);
 554
 555         set_sec_session_private_data(sess, NULL);
 556         rte_mempool_put(sess_mp, priv);
 557
 558         return 0;
 559 }
 560
 561 static unsigned int
 562 otx2_eth_sec_session_get_size(void *device __rte_unused)
 563 {
 564         return sizeof(struct otx2_sec_session);
 565 }
 566
 567 static int
 568 otx2_eth_sec_set_pkt_mdata(void *device __rte_unused,
 569                             struct rte_security_session *session,
 570                             struct rte_mbuf *m, void *params __rte_unused)
 571 {
 572         /* Set security session as the pkt metadata */
 573         m->udata64 = (uint64_t)session;
 574
 575         return 0;
 576 }
 577
 578 static int
 579 otx2_eth_sec_get_userdata(void *device __rte_unused, uint64_t md,
 580                            void **userdata)
 581 {
 582         /* Retrieve userdata  */
 583         *userdata = (void *)md;
 584
 585         return 0;
 586 }
 587
 588 static const struct rte_security_capability *
 589 otx2_eth_sec_capabilities_get(void *device __rte_unused)
 590 {
 591         return otx2_eth_sec_capabilities;
 592 }
 593
 594 static struct rte_security_ops otx2_eth_sec_ops = {
 595         .session_create         = otx2_eth_sec_session_create,
 596         .session_destroy        = otx2_eth_sec_session_destroy,
 597         .session_get_size       = otx2_eth_sec_session_get_size,
 598         .set_pkt_metadata       = otx2_eth_sec_set_pkt_mdata,
 599         .get_userdata           = otx2_eth_sec_get_userdata,
 600         .capabilities_get       = otx2_eth_sec_capabilities_get
 601 };
 602
 603 int
 604 otx2_eth_sec_ctx_create(struct rte_eth_dev *eth_dev)
 605 {
 606         struct rte_security_ctx *ctx;
 607         int ret;
 608
 609         ctx = rte_malloc("otx2_eth_sec_ctx",
 610                          sizeof(struct rte_security_ctx), 0);
 611         if (ctx == NULL)
 612                 return -ENOMEM;
 613
 614         ret = otx2_sec_idev_cfg_init(eth_dev->data->port_id);
 615         if (ret) {
 616                 rte_free(ctx);
 617                 return ret;
 618         }
 619
 620         /* Populate ctx */
 621
 622         ctx->device = eth_dev;
 623         ctx->ops = &otx2_eth_sec_ops;
 624         ctx->sess_cnt = 0;
 625
 626         eth_dev->security_ctx = ctx;
 627
 628         return 0;
 629 }
 630
 631 void
 632 otx2_eth_sec_ctx_destroy(struct rte_eth_dev *eth_dev)
 633 {
 634         rte_free(eth_dev->security_ctx);
 635 }
 636
 637 static int
 638 eth_sec_ipsec_cfg(struct rte_eth_dev *eth_dev, uint8_t tt)
 639 {
 640         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 641         uint16_t port = eth_dev->data->port_id;
 642         struct nix_inline_ipsec_lf_cfg *req;
 643         struct otx2_mbox *mbox = dev->mbox;
 644         struct eth_sec_tag_const tag_const;
 645         char name[RTE_MEMZONE_NAMESIZE];
 646         const struct rte_memzone *mz;
 647
 648         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 649         mz = rte_memzone_lookup(name);
 650         if (mz == NULL)
 651                 return -EINVAL;
 652
 653         req = otx2_mbox_alloc_msg_nix_inline_ipsec_lf_cfg(mbox);
 654         req->enable = 1;
 655         req->sa_base_addr = mz->iova;
 656
 657         req->ipsec_cfg0.tt = tt;
 658
 659         tag_const.u32 = 0;
 660         tag_const.event_type = RTE_EVENT_TYPE_ETHDEV;
 661         tag_const.port = port;
 662         req->ipsec_cfg0.tag_const = tag_const.u32;
 663
 664         req->ipsec_cfg0.sa_pow2_size =
 665                         rte_log2_u32(sizeof(struct otx2_ipsec_fp_in_sa));
 666         req->ipsec_cfg0.lenm1_max = ETH_SEC_MAX_PKT_LEN - 1;
 667
 668         req->ipsec_cfg1.sa_idx_w = rte_log2_u32(dev->ipsec_in_max_spi);
 669         req->ipsec_cfg1.sa_idx_max = dev->ipsec_in_max_spi - 1;
 670
 671         return otx2_mbox_process(mbox);
 672 }
 673
 674 int
 675 otx2_eth_sec_init(struct rte_eth_dev *eth_dev)
 676 {
 677         const size_t sa_width = sizeof(struct otx2_ipsec_fp_in_sa);
 678         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 679         uint16_t port = eth_dev->data->port_id;
 680         char name[RTE_MEMZONE_NAMESIZE];
 681         const struct rte_memzone *mz;
 682         int mz_sz, ret;
 683         uint16_t nb_sa;
 684
 685         RTE_BUILD_BUG_ON(sa_width < 32 || sa_width > 512 ||
 686                          !RTE_IS_POWER_OF_2(sa_width));
 687
 688         if (!(dev->tx_offloads & DEV_TX_OFFLOAD_SECURITY) &&
 689             !(dev->rx_offloads & DEV_RX_OFFLOAD_SECURITY))
 690                 return 0;
 691
 692         nb_sa = dev->ipsec_in_max_spi;
 693         mz_sz = nb_sa * sa_width;
 694         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 695         mz = rte_memzone_reserve_aligned(name, mz_sz, rte_socket_id(),
 696                                          RTE_MEMZONE_IOVA_CONTIG, OTX2_ALIGN);
 697
 698         if (mz == NULL) {
 699                 otx2_err("Could not allocate inbound SA DB");
 700                 return -ENOMEM;
 701         }
 702
 703         memset(mz->addr, 0, mz_sz);
 704
 705         ret = eth_sec_ipsec_cfg(eth_dev, SSO_TT_ORDERED);
 706         if (ret < 0) {
 707                 otx2_err("Could not configure inline IPsec");
 708                 goto sec_fini;
 709         }
 710
 711         return 0;
 712
 713 sec_fini:
 714         otx2_err("Could not configure device for security");
 715         otx2_eth_sec_fini(eth_dev);
 716         return ret;
 717 }
 718
 719 void
 720 otx2_eth_sec_fini(struct rte_eth_dev *eth_dev)
 721 {
 722         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 723         uint16_t port = eth_dev->data->port_id;
 724         char name[RTE_MEMZONE_NAMESIZE];
 725
 726         if (!(dev->tx_offloads & DEV_TX_OFFLOAD_SECURITY) &&
 727             !(dev->rx_offloads & DEV_RX_OFFLOAD_SECURITY))
 728                 return;
 729
 730         lookup_mem_sa_tbl_clear(eth_dev);
 731
 732         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 733         rte_memzone_free(rte_memzone_lookup(name));
 734 }