drivers/net/octeontx2/otx2_ethdev_sec.c

   1 /* SPDX-License-Identifier: BSD-3-Clause
   2  * Copyright (C) 2020 Marvell International Ltd.
   3  */
   4
   5 #include <rte_cryptodev.h>
   6 #include <rte_esp.h>
   7 #include <rte_ethdev.h>
   8 #include <rte_eventdev.h>
   9 #include <rte_ip.h>
  10 #include <rte_malloc.h>
  11 #include <rte_memzone.h>
  12 #include <rte_security.h>
  13 #include <rte_security_driver.h>
  14 #include <rte_udp.h>
  15
  16 #include "otx2_common.h"
  17 #include "otx2_cryptodev_qp.h"
  18 #include "otx2_ethdev.h"
  19 #include "otx2_ethdev_sec.h"
  20 #include "otx2_ipsec_fp.h"
  21 #include "otx2_sec_idev.h"
  22
  23 #define ETH_SEC_MAX_PKT_LEN     1450
  24
  25 #define AH_HDR_LEN      12
  26 #define AES_GCM_IV_LEN  8
  27 #define AES_GCM_MAC_LEN 16
  28 #define AES_CBC_IV_LEN  16
  29 #define SHA1_HMAC_LEN   12
  30
  31 #define AES_GCM_ROUNDUP_BYTE_LEN        4
  32 #define AES_CBC_ROUNDUP_BYTE_LEN        16
  33
  34 struct eth_sec_tag_const {
  35         RTE_STD_C11
  36         union {
  37                 struct {
  38                         uint32_t rsvd_11_0  : 12;
  39                         uint32_t port       : 8;
  40                         uint32_t event_type : 4;
  41                         uint32_t rsvd_31_24 : 8;
  42                 };
  43                 uint32_t u32;
  44         };
  45 };
  46
  47 static struct rte_cryptodev_capabilities otx2_eth_sec_crypto_caps[] = {
  48         {       /* AES GCM */
  49                 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
  50                 {.sym = {
  51                         .xform_type = RTE_CRYPTO_SYM_XFORM_AEAD,
  52                         {.aead = {
  53                                 .algo = RTE_CRYPTO_AEAD_AES_GCM,
  54                                 .block_size = 16,
  55                                 .key_size = {
  56                                         .min = 16,
  57                                         .max = 32,
  58                                         .increment = 8
  59                                 },
  60                                 .digest_size = {
  61                                         .min = 16,
  62                                         .max = 16,
  63                                         .increment = 0
  64                                 },
  65                                 .aad_size = {
  66                                         .min = 8,
  67                                         .max = 12,
  68                                         .increment = 4
  69                                 },
  70                                 .iv_size = {
  71                                         .min = 12,
  72                                         .max = 12,
  73                                         .increment = 0
  74                                 }
  75                         }, }
  76                 }, }
  77         },
  78         {       /* AES CBC */
  79                 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
  80                 {.sym = {
  81                         .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
  82                         {.cipher = {
  83                                 .algo = RTE_CRYPTO_CIPHER_AES_CBC,
  84                                 .block_size = 16,
  85                                 .key_size = {
  86                                         .min = 16,
  87                                         .max = 32,
  88                                         .increment = 8
  89                                 },
  90                                 .iv_size = {
  91                                         .min = 16,
  92                                         .max = 16,
  93                                         .increment = 0
  94                                 }
  95                         }, }
  96                 }, }
  97         },
  98         {       /* SHA1 HMAC */
  99                 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
 100                 {.sym = {
 101                         .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
 102                         {.auth = {
 103                                 .algo = RTE_CRYPTO_AUTH_SHA1_HMAC,
 104                                 .block_size = 64,
 105                                 .key_size = {
 106                                         .min = 20,
 107                                         .max = 64,
 108                                         .increment = 1
 109                                 },
 110                                 .digest_size = {
 111                                         .min = 12,
 112                                         .max = 12,
 113                                         .increment = 0
 114                                 },
 115                         }, }
 116                 }, }
 117         },
 118         RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST()
 119 };
 120
 121 static const struct rte_security_capability otx2_eth_sec_capabilities[] = {
 122         {       /* IPsec Inline Protocol ESP Tunnel Ingress */
 123                 .action = RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL,
 124                 .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
 125                 .ipsec = {
 126                         .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
 127                         .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
 128                         .direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
 129                         .options = { 0 }
 130                 },
 131                 .crypto_capabilities = otx2_eth_sec_crypto_caps,
 132                 .ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA
 133         },
 134         {       /* IPsec Inline Protocol ESP Tunnel Egress */
 135                 .action = RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL,
 136                 .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
 137                 .ipsec = {
 138                         .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
 139                         .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
 140                         .direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
 141                         .options = { 0 }
 142                 },
 143                 .crypto_capabilities = otx2_eth_sec_crypto_caps,
 144                 .ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA
 145         },
 146         {
 147                 .action = RTE_SECURITY_ACTION_TYPE_NONE
 148         }
 149 };
 150
 151 static void
 152 lookup_mem_sa_tbl_clear(struct rte_eth_dev *eth_dev)
 153 {
 154         static const char name[] = OTX2_NIX_FASTPATH_LOOKUP_MEM;
 155         uint16_t port = eth_dev->data->port_id;
 156         const struct rte_memzone *mz;
 157         uint64_t **sa_tbl;
 158         uint8_t *mem;
 159
 160         mz = rte_memzone_lookup(name);
 161         if (mz == NULL)
 162                 return;
 163
 164         mem = mz->addr;
 165
 166         sa_tbl  = (uint64_t **)RTE_PTR_ADD(mem, OTX2_NIX_SA_TBL_START);
 167         if (sa_tbl[port] == NULL)
 168                 return;
 169
 170         rte_free(sa_tbl[port]);
 171         sa_tbl[port] = NULL;
 172 }
 173
 174 static int
 175 lookup_mem_sa_index_update(struct rte_eth_dev *eth_dev, int spi, void *sa)
 176 {
 177         static const char name[] = OTX2_NIX_FASTPATH_LOOKUP_MEM;
 178         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 179         uint16_t port = eth_dev->data->port_id;
 180         const struct rte_memzone *mz;
 181         uint64_t **sa_tbl;
 182         uint8_t *mem;
 183
 184         mz = rte_memzone_lookup(name);
 185         if (mz == NULL) {
 186                 otx2_err("Could not find fastpath lookup table");
 187                 return -EINVAL;
 188         }
 189
 190         mem = mz->addr;
 191
 192         sa_tbl = (uint64_t **)RTE_PTR_ADD(mem, OTX2_NIX_SA_TBL_START);
 193
 194         if (sa_tbl[port] == NULL) {
 195                 sa_tbl[port] = rte_malloc(NULL, dev->ipsec_in_max_spi *
 196                                           sizeof(uint64_t), 0);
 197         }
 198
 199         sa_tbl[port][spi] = (uint64_t)sa;
 200
 201         return 0;
 202 }
 203
 204 static inline void
 205 in_sa_mz_name_get(char *name, int size, uint16_t port)
 206 {
 207         snprintf(name, size, "otx2_ipsec_in_sadb_%u", port);
 208 }
 209
 210 static struct otx2_ipsec_fp_in_sa *
 211 in_sa_get(uint16_t port, int sa_index)
 212 {
 213         char name[RTE_MEMZONE_NAMESIZE];
 214         struct otx2_ipsec_fp_in_sa *sa;
 215         const struct rte_memzone *mz;
 216
 217         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 218         mz = rte_memzone_lookup(name);
 219         if (mz == NULL) {
 220                 otx2_err("Could not get the memzone reserved for IN SA DB");
 221                 return NULL;
 222         }
 223
 224         sa = mz->addr;
 225
 226         return sa + sa_index;
 227 }
 228
 229 static int
 230 ipsec_sa_const_set(struct rte_security_ipsec_xform *ipsec,
 231                    struct rte_crypto_sym_xform *xform,
 232                    struct otx2_sec_session_ipsec_ip *sess)
 233 {
 234         struct rte_crypto_sym_xform *cipher_xform, *auth_xform;
 235
 236         sess->partial_len = sizeof(struct rte_ipv4_hdr);
 237
 238         if (ipsec->proto == RTE_SECURITY_IPSEC_SA_PROTO_ESP) {
 239                 sess->partial_len += sizeof(struct rte_esp_hdr);
 240                 sess->roundup_len = sizeof(struct rte_esp_tail);
 241         } else if (ipsec->proto == RTE_SECURITY_IPSEC_SA_PROTO_AH) {
 242                 sess->partial_len += AH_HDR_LEN;
 243         } else {
 244                 return -EINVAL;
 245         }
 246
 247         if (ipsec->options.udp_encap)
 248                 sess->partial_len += sizeof(struct rte_udp_hdr);
 249
 250         if (xform->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
 251                 if (xform->aead.algo == RTE_CRYPTO_AEAD_AES_GCM) {
 252                         sess->partial_len += AES_GCM_IV_LEN;
 253                         sess->partial_len += AES_GCM_MAC_LEN;
 254                         sess->roundup_byte = AES_GCM_ROUNDUP_BYTE_LEN;
 255                 }
 256                 return 0;
 257         }
 258
 259         if (ipsec->direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
 260                 cipher_xform = xform;
 261                 auth_xform = xform->next;
 262         } else if (ipsec->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) {
 263                 auth_xform = xform;
 264                 cipher_xform = xform->next;
 265         } else {
 266                 return -EINVAL;
 267         }
 268         if (cipher_xform->cipher.algo == RTE_CRYPTO_CIPHER_AES_CBC) {
 269                 sess->partial_len += AES_CBC_IV_LEN;
 270                 sess->roundup_byte = AES_CBC_ROUNDUP_BYTE_LEN;
 271         } else {
 272                 return -EINVAL;
 273         }
 274
 275         if (auth_xform->auth.algo == RTE_CRYPTO_AUTH_SHA1_HMAC)
 276                 sess->partial_len += SHA1_HMAC_LEN;
 277         else
 278                 return -EINVAL;
 279
 280         return 0;
 281 }
 282
 283 static int
 284 hmac_init(struct otx2_ipsec_fp_sa_ctl *ctl, struct otx2_cpt_qp *qp,
 285           const uint8_t *auth_key, int len, uint8_t *hmac_key)
 286 {
 287         struct inst_data {
 288                 struct otx2_cpt_res cpt_res;
 289                 uint8_t buffer[64];
 290         } *md;
 291
 292         volatile struct otx2_cpt_res *res;
 293         uint64_t timeout, lmt_status;
 294         struct otx2_cpt_inst_s inst;
 295         rte_iova_t md_iova;
 296         int ret;
 297
 298         memset(&inst, 0, sizeof(struct otx2_cpt_inst_s));
 299
 300         md = rte_zmalloc(NULL, sizeof(struct inst_data), OTX2_CPT_RES_ALIGN);
 301         if (md == NULL)
 302                 return -ENOMEM;
 303
 304         memcpy(md->buffer, auth_key, len);
 305
 306         md_iova = rte_malloc_virt2iova(md);
 307         if (md_iova == RTE_BAD_IOVA) {
 308                 ret = -EINVAL;
 309                 goto free_md;
 310         }
 311
 312         inst.res_addr = md_iova + offsetof(struct inst_data, cpt_res);
 313         inst.opcode = OTX2_CPT_OP_WRITE_HMAC_IPAD_OPAD;
 314         inst.param2 = ctl->auth_type;
 315         inst.dlen = len;
 316         inst.dptr = md_iova + offsetof(struct inst_data, buffer);
 317         inst.rptr = inst.dptr;
 318         inst.egrp = OTX2_CPT_EGRP_INLINE_IPSEC;
 319
 320         md->cpt_res.compcode = 0;
 321         md->cpt_res.uc_compcode = 0xff;
 322
 323         timeout = rte_get_timer_cycles() + 5 * rte_get_timer_hz();
 324
 325         rte_cio_wmb();
 326
 327         do {
 328                 otx2_lmt_mov(qp->lmtline, &inst, 2);
 329                 lmt_status = otx2_lmt_submit(qp->lf_nq_reg);
 330         } while (lmt_status == 0);
 331
 332         res = (volatile struct otx2_cpt_res *)&md->cpt_res;
 333
 334         /* Wait until instruction completes or times out */
 335         while (res->uc_compcode == 0xff) {
 336                 if (rte_get_timer_cycles() > timeout)
 337                         break;
 338         }
 339
 340         if (res->u16[0] != OTX2_SEC_COMP_GOOD) {
 341                 ret = -EIO;
 342                 goto free_md;
 343         }
 344
 345         /* Retrieve the ipad and opad from rptr */
 346         memcpy(hmac_key, md->buffer, 48);
 347
 348         ret = 0;
 349
 350 free_md:
 351         rte_free(md);
 352         return ret;
 353 }
 354
 355 static int
 356 eth_sec_ipsec_out_sess_create(struct rte_eth_dev *eth_dev,
 357                               struct rte_security_ipsec_xform *ipsec,
 358                               struct rte_crypto_sym_xform *crypto_xform,
 359                               struct rte_security_session *sec_sess)
 360 {
 361         struct rte_crypto_sym_xform *auth_xform, *cipher_xform;
 362         struct otx2_sec_session_ipsec_ip *sess;
 363         uint16_t port = eth_dev->data->port_id;
 364         int cipher_key_len, auth_key_len, ret;
 365         const uint8_t *cipher_key, *auth_key;
 366         struct otx2_ipsec_fp_sa_ctl *ctl;
 367         struct otx2_ipsec_fp_out_sa *sa;
 368         struct otx2_sec_session *priv;
 369         struct otx2_cpt_inst_s inst;
 370         struct otx2_cpt_qp *qp;
 371
 372         priv = get_sec_session_private_data(sec_sess);
 373         sess = &priv->ipsec.ip;
 374
 375         sa = &sess->out_sa;
 376         ctl = &sa->ctl;
 377         if (ctl->valid) {
 378                 otx2_err("SA already registered");
 379                 return -EINVAL;
 380         }
 381
 382         memset(sess, 0, sizeof(struct otx2_sec_session_ipsec_ip));
 383
 384         sess->seq = 1;
 385
 386         ret = ipsec_sa_const_set(ipsec, crypto_xform, sess);
 387         if (ret < 0)
 388                 return ret;
 389
 390         if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD)
 391                 memcpy(sa->nonce, &ipsec->salt, 4);
 392
 393         if (ipsec->options.udp_encap == 1) {
 394                 sa->udp_src = 4500;
 395                 sa->udp_dst = 4500;
 396         }
 397
 398         if (ipsec->mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL) {
 399                 /* Start ip id from 1 */
 400                 sess->ip_id = 1;
 401
 402                 if (ipsec->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
 403                         memcpy(&sa->ip_src, &ipsec->tunnel.ipv4.src_ip,
 404                                sizeof(struct in_addr));
 405                         memcpy(&sa->ip_dst, &ipsec->tunnel.ipv4.dst_ip,
 406                                sizeof(struct in_addr));
 407                 } else {
 408                         return -EINVAL;
 409                 }
 410         } else {
 411                 return -EINVAL;
 412         }
 413
 414         cipher_xform = crypto_xform;
 415         auth_xform = crypto_xform->next;
 416
 417         cipher_key_len = 0;
 418         auth_key_len = 0;
 419         auth_key = NULL;
 420
 421         if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
 422                 cipher_key = crypto_xform->aead.key.data;
 423                 cipher_key_len = crypto_xform->aead.key.length;
 424         } else {
 425                 cipher_key = cipher_xform->cipher.key.data;
 426                 cipher_key_len = cipher_xform->cipher.key.length;
 427                 auth_key = auth_xform->auth.key.data;
 428                 auth_key_len = auth_xform->auth.key.length;
 429         }
 430
 431         if (cipher_key_len != 0)
 432                 memcpy(sa->cipher_key, cipher_key, cipher_key_len);
 433         else
 434                 return -EINVAL;
 435
 436         /* Determine word 7 of CPT instruction */
 437         inst.u64[7] = 0;
 438         inst.egrp = OTX2_CPT_EGRP_INLINE_IPSEC;
 439         inst.cptr = rte_mempool_virt2iova(sa);
 440         sess->inst_w7 = inst.u64[7];
 441
 442         /* Get CPT QP to be used for this SA */
 443         ret = otx2_sec_idev_tx_cpt_qp_get(port, &qp);
 444         if (ret)
 445                 return ret;
 446
 447         sess->qp = qp;
 448
 449         sess->cpt_lmtline = qp->lmtline;
 450         sess->cpt_nq_reg = qp->lf_nq_reg;
 451
 452         /* Populate control word */
 453         ret = ipsec_fp_sa_ctl_set(ipsec, crypto_xform, ctl);
 454         if (ret)
 455                 goto cpt_put;
 456
 457         if (auth_key_len && auth_key) {
 458                 ret = hmac_init(ctl, qp, auth_key, auth_key_len, sa->hmac_key);
 459                 if (ret)
 460                         goto cpt_put;
 461         }
 462
 463         return 0;
 464 cpt_put:
 465         otx2_sec_idev_tx_cpt_qp_put(sess->qp);
 466         return ret;
 467 }
 468
 469 static int
 470 eth_sec_ipsec_in_sess_create(struct rte_eth_dev *eth_dev,
 471                              struct rte_security_ipsec_xform *ipsec,
 472                              struct rte_crypto_sym_xform *crypto_xform,
 473                              struct rte_security_session *sec_sess)
 474 {
 475         struct rte_crypto_sym_xform *auth_xform, *cipher_xform;
 476         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 477         struct otx2_sec_session_ipsec_ip *sess;
 478         uint16_t port = eth_dev->data->port_id;
 479         int cipher_key_len, auth_key_len, ret;
 480         const uint8_t *cipher_key, *auth_key;
 481         struct otx2_ipsec_fp_sa_ctl *ctl;
 482         struct otx2_ipsec_fp_in_sa *sa;
 483         struct otx2_sec_session *priv;
 484         struct otx2_cpt_qp *qp;
 485
 486         if (ipsec->spi >= dev->ipsec_in_max_spi) {
 487                 otx2_err("SPI exceeds max supported");
 488                 return -EINVAL;
 489         }
 490
 491         sa = in_sa_get(port, ipsec->spi);
 492         ctl = &sa->ctl;
 493
 494         priv = get_sec_session_private_data(sec_sess);
 495         sess = &priv->ipsec.ip;
 496
 497         if (ctl->valid) {
 498                 otx2_err("SA already registered");
 499                 return -EINVAL;
 500         }
 501
 502         memset(sa, 0, sizeof(struct otx2_ipsec_fp_in_sa));
 503
 504         auth_xform = crypto_xform;
 505         cipher_xform = crypto_xform->next;
 506
 507         cipher_key_len = 0;
 508         auth_key_len = 0;
 509         auth_key = NULL;
 510
 511         if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
 512                 if (crypto_xform->aead.algo == RTE_CRYPTO_AEAD_AES_GCM)
 513                         memcpy(sa->nonce, &ipsec->salt, 4);
 514                 cipher_key = crypto_xform->aead.key.data;
 515                 cipher_key_len = crypto_xform->aead.key.length;
 516         } else {
 517                 cipher_key = cipher_xform->cipher.key.data;
 518                 cipher_key_len = cipher_xform->cipher.key.length;
 519                 auth_key = auth_xform->auth.key.data;
 520                 auth_key_len = auth_xform->auth.key.length;
 521         }
 522
 523         if (cipher_key_len != 0)
 524                 memcpy(sa->cipher_key, cipher_key, cipher_key_len);
 525         else
 526                 return -EINVAL;
 527
 528         sess->in_sa = sa;
 529
 530         sa->userdata = priv->userdata;
 531
 532         if (lookup_mem_sa_index_update(eth_dev, ipsec->spi, sa))
 533                 return -EINVAL;
 534
 535         ret = ipsec_fp_sa_ctl_set(ipsec, crypto_xform, ctl);
 536         if (ret)
 537                 return ret;
 538
 539         if (auth_key_len && auth_key) {
 540                 /* Get a queue pair for HMAC init */
 541                 ret = otx2_sec_idev_tx_cpt_qp_get(port, &qp);
 542                 if (ret)
 543                         return ret;
 544                 ret = hmac_init(ctl, qp, auth_key, auth_key_len, sa->hmac_key);
 545                 otx2_sec_idev_tx_cpt_qp_put(qp);
 546         }
 547         return ret;
 548 }
 549
 550 static int
 551 eth_sec_ipsec_sess_create(struct rte_eth_dev *eth_dev,
 552                           struct rte_security_ipsec_xform *ipsec,
 553                           struct rte_crypto_sym_xform *crypto_xform,
 554                           struct rte_security_session *sess)
 555 {
 556         int ret;
 557
 558         ret = ipsec_fp_xform_verify(ipsec, crypto_xform);
 559         if (ret)
 560                 return ret;
 561
 562         if (ipsec->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
 563                 return eth_sec_ipsec_in_sess_create(eth_dev, ipsec,
 564                                                     crypto_xform, sess);
 565         else
 566                 return eth_sec_ipsec_out_sess_create(eth_dev, ipsec,
 567                                                      crypto_xform, sess);
 568 }
 569
 570 static int
 571 otx2_eth_sec_session_create(void *device,
 572                             struct rte_security_session_conf *conf,
 573                             struct rte_security_session *sess,
 574                             struct rte_mempool *mempool)
 575 {
 576         struct otx2_sec_session *priv;
 577         int ret;
 578
 579         if (conf->action_type != RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL)
 580                 return -ENOTSUP;
 581
 582         if (rte_mempool_get(mempool, (void **)&priv)) {
 583                 otx2_err("Could not allocate security session private data");
 584                 return -ENOMEM;
 585         }
 586
 587         set_sec_session_private_data(sess, priv);
 588
 589         /*
 590          * Save userdata provided by the application. For ingress packets, this
 591          * could be used to identify the SA.
 592          */
 593         priv->userdata = conf->userdata;
 594
 595         if (conf->protocol == RTE_SECURITY_PROTOCOL_IPSEC)
 596                 ret = eth_sec_ipsec_sess_create(device, &conf->ipsec,
 597                                                 conf->crypto_xform,
 598                                                 sess);
 599         else
 600                 ret = -ENOTSUP;
 601
 602         if (ret)
 603                 goto mempool_put;
 604
 605         return 0;
 606
 607 mempool_put:
 608         rte_mempool_put(mempool, priv);
 609         set_sec_session_private_data(sess, NULL);
 610         return ret;
 611 }
 612
 613 static int
 614 otx2_eth_sec_session_destroy(void *device __rte_unused,
 615                              struct rte_security_session *sess)
 616 {
 617         struct otx2_sec_session_ipsec_ip *sess_ip;
 618         struct otx2_sec_session *priv;
 619         struct rte_mempool *sess_mp;
 620         int ret;
 621
 622         priv = get_sec_session_private_data(sess);
 623         if (priv == NULL)
 624                 return -EINVAL;
 625
 626         sess_ip = &priv->ipsec.ip;
 627
 628         /* Release CPT LF used for this session */
 629         if (sess_ip->qp != NULL) {
 630                 ret = otx2_sec_idev_tx_cpt_qp_put(sess_ip->qp);
 631                 if (ret)
 632                         return ret;
 633         }
 634
 635         sess_mp = rte_mempool_from_obj(priv);
 636
 637         set_sec_session_private_data(sess, NULL);
 638         rte_mempool_put(sess_mp, priv);
 639
 640         return 0;
 641 }
 642
 643 static unsigned int
 644 otx2_eth_sec_session_get_size(void *device __rte_unused)
 645 {
 646         return sizeof(struct otx2_sec_session);
 647 }
 648
 649 static int
 650 otx2_eth_sec_set_pkt_mdata(void *device __rte_unused,
 651                             struct rte_security_session *session,
 652                             struct rte_mbuf *m, void *params __rte_unused)
 653 {
 654         /* Set security session as the pkt metadata */
 655         m->udata64 = (uint64_t)session;
 656
 657         return 0;
 658 }
 659
 660 static int
 661 otx2_eth_sec_get_userdata(void *device __rte_unused, uint64_t md,
 662                            void **userdata)
 663 {
 664         /* Retrieve userdata  */
 665         *userdata = (void *)md;
 666
 667         return 0;
 668 }
 669
 670 static const struct rte_security_capability *
 671 otx2_eth_sec_capabilities_get(void *device __rte_unused)
 672 {
 673         return otx2_eth_sec_capabilities;
 674 }
 675
 676 static struct rte_security_ops otx2_eth_sec_ops = {
 677         .session_create         = otx2_eth_sec_session_create,
 678         .session_destroy        = otx2_eth_sec_session_destroy,
 679         .session_get_size       = otx2_eth_sec_session_get_size,
 680         .set_pkt_metadata       = otx2_eth_sec_set_pkt_mdata,
 681         .get_userdata           = otx2_eth_sec_get_userdata,
 682         .capabilities_get       = otx2_eth_sec_capabilities_get
 683 };
 684
 685 int
 686 otx2_eth_sec_ctx_create(struct rte_eth_dev *eth_dev)
 687 {
 688         struct rte_security_ctx *ctx;
 689         int ret;
 690
 691         ctx = rte_malloc("otx2_eth_sec_ctx",
 692                          sizeof(struct rte_security_ctx), 0);
 693         if (ctx == NULL)
 694                 return -ENOMEM;
 695
 696         ret = otx2_sec_idev_cfg_init(eth_dev->data->port_id);
 697         if (ret) {
 698                 rte_free(ctx);
 699                 return ret;
 700         }
 701
 702         /* Populate ctx */
 703
 704         ctx->device = eth_dev;
 705         ctx->ops = &otx2_eth_sec_ops;
 706         ctx->sess_cnt = 0;
 707
 708         eth_dev->security_ctx = ctx;
 709
 710         return 0;
 711 }
 712
 713 void
 714 otx2_eth_sec_ctx_destroy(struct rte_eth_dev *eth_dev)
 715 {
 716         rte_free(eth_dev->security_ctx);
 717 }
 718
 719 static int
 720 eth_sec_ipsec_cfg(struct rte_eth_dev *eth_dev, uint8_t tt)
 721 {
 722         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 723         uint16_t port = eth_dev->data->port_id;
 724         struct nix_inline_ipsec_lf_cfg *req;
 725         struct otx2_mbox *mbox = dev->mbox;
 726         struct eth_sec_tag_const tag_const;
 727         char name[RTE_MEMZONE_NAMESIZE];
 728         const struct rte_memzone *mz;
 729
 730         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 731         mz = rte_memzone_lookup(name);
 732         if (mz == NULL)
 733                 return -EINVAL;
 734
 735         req = otx2_mbox_alloc_msg_nix_inline_ipsec_lf_cfg(mbox);
 736         req->enable = 1;
 737         req->sa_base_addr = mz->iova;
 738
 739         req->ipsec_cfg0.tt = tt;
 740
 741         tag_const.u32 = 0;
 742         tag_const.event_type = RTE_EVENT_TYPE_ETHDEV;
 743         tag_const.port = port;
 744         req->ipsec_cfg0.tag_const = tag_const.u32;
 745
 746         req->ipsec_cfg0.sa_pow2_size =
 747                         rte_log2_u32(sizeof(struct otx2_ipsec_fp_in_sa));
 748         req->ipsec_cfg0.lenm1_max = ETH_SEC_MAX_PKT_LEN - 1;
 749
 750         req->ipsec_cfg1.sa_idx_w = rte_log2_u32(dev->ipsec_in_max_spi);
 751         req->ipsec_cfg1.sa_idx_max = dev->ipsec_in_max_spi - 1;
 752
 753         return otx2_mbox_process(mbox);
 754 }
 755
 756 int
 757 otx2_eth_sec_init(struct rte_eth_dev *eth_dev)
 758 {
 759         const size_t sa_width = sizeof(struct otx2_ipsec_fp_in_sa);
 760         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 761         uint16_t port = eth_dev->data->port_id;
 762         char name[RTE_MEMZONE_NAMESIZE];
 763         const struct rte_memzone *mz;
 764         int mz_sz, ret;
 765         uint16_t nb_sa;
 766
 767         RTE_BUILD_BUG_ON(sa_width < 32 || sa_width > 512 ||
 768                          !RTE_IS_POWER_OF_2(sa_width));
 769
 770         if (!(dev->tx_offloads & DEV_TX_OFFLOAD_SECURITY) &&
 771             !(dev->rx_offloads & DEV_RX_OFFLOAD_SECURITY))
 772                 return 0;
 773
 774         nb_sa = dev->ipsec_in_max_spi;
 775         mz_sz = nb_sa * sa_width;
 776         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 777         mz = rte_memzone_reserve_aligned(name, mz_sz, rte_socket_id(),
 778                                          RTE_MEMZONE_IOVA_CONTIG, OTX2_ALIGN);
 779
 780         if (mz == NULL) {
 781                 otx2_err("Could not allocate inbound SA DB");
 782                 return -ENOMEM;
 783         }
 784
 785         memset(mz->addr, 0, mz_sz);
 786
 787         ret = eth_sec_ipsec_cfg(eth_dev, SSO_TT_ORDERED);
 788         if (ret < 0) {
 789                 otx2_err("Could not configure inline IPsec");
 790                 goto sec_fini;
 791         }
 792
 793         return 0;
 794
 795 sec_fini:
 796         otx2_err("Could not configure device for security");
 797         otx2_eth_sec_fini(eth_dev);
 798         return ret;
 799 }
 800
 801 void
 802 otx2_eth_sec_fini(struct rte_eth_dev *eth_dev)
 803 {
 804         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 805         uint16_t port = eth_dev->data->port_id;
 806         char name[RTE_MEMZONE_NAMESIZE];
 807
 808         if (!(dev->tx_offloads & DEV_TX_OFFLOAD_SECURITY) &&
 809             !(dev->rx_offloads & DEV_RX_OFFLOAD_SECURITY))
 810                 return;
 811
 812         lookup_mem_sa_tbl_clear(eth_dev);
 813
 814         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 815         rte_memzone_free(rte_memzone_lookup(name));
 816 }