drivers/net/octeontx2/otx2_ethdev_sec.c

   1 /* SPDX-License-Identifier: BSD-3-Clause
   2  * Copyright (C) 2020 Marvell International Ltd.
   3  */
   4
   5 #include <rte_cryptodev.h>
   6 #include <rte_esp.h>
   7 #include <rte_ethdev.h>
   8 #include <rte_eventdev.h>
   9 #include <rte_ip.h>
  10 #include <rte_malloc.h>
  11 #include <rte_memzone.h>
  12 #include <rte_security.h>
  13 #include <rte_security_driver.h>
  14 #include <rte_udp.h>
  15
  16 #include "otx2_common.h"
  17 #include "otx2_cryptodev_qp.h"
  18 #include "otx2_ethdev.h"
  19 #include "otx2_ethdev_sec.h"
  20 #include "otx2_ipsec_fp.h"
  21 #include "otx2_sec_idev.h"
  22 #include "otx2_security.h"
  23
  24 #define AH_HDR_LEN      12
  25 #define AES_GCM_IV_LEN  8
  26 #define AES_GCM_MAC_LEN 16
  27 #define AES_CBC_IV_LEN  16
  28 #define SHA1_HMAC_LEN   12
  29
  30 #define AES_GCM_ROUNDUP_BYTE_LEN        4
  31 #define AES_CBC_ROUNDUP_BYTE_LEN        16
  32
  33 struct eth_sec_tag_const {
  34         RTE_STD_C11
  35         union {
  36                 struct {
  37                         uint32_t rsvd_11_0  : 12;
  38                         uint32_t port       : 8;
  39                         uint32_t event_type : 4;
  40                         uint32_t rsvd_31_24 : 8;
  41                 };
  42                 uint32_t u32;
  43         };
  44 };
  45
  46 static struct rte_cryptodev_capabilities otx2_eth_sec_crypto_caps[] = {
  47         {       /* AES GCM */
  48                 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
  49                 {.sym = {
  50                         .xform_type = RTE_CRYPTO_SYM_XFORM_AEAD,
  51                         {.aead = {
  52                                 .algo = RTE_CRYPTO_AEAD_AES_GCM,
  53                                 .block_size = 16,
  54                                 .key_size = {
  55                                         .min = 16,
  56                                         .max = 32,
  57                                         .increment = 8
  58                                 },
  59                                 .digest_size = {
  60                                         .min = 16,
  61                                         .max = 16,
  62                                         .increment = 0
  63                                 },
  64                                 .aad_size = {
  65                                         .min = 8,
  66                                         .max = 12,
  67                                         .increment = 4
  68                                 },
  69                                 .iv_size = {
  70                                         .min = 12,
  71                                         .max = 12,
  72                                         .increment = 0
  73                                 }
  74                         }, }
  75                 }, }
  76         },
  77         {       /* AES CBC */
  78                 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
  79                 {.sym = {
  80                         .xform_type = RTE_CRYPTO_SYM_XFORM_CIPHER,
  81                         {.cipher = {
  82                                 .algo = RTE_CRYPTO_CIPHER_AES_CBC,
  83                                 .block_size = 16,
  84                                 .key_size = {
  85                                         .min = 16,
  86                                         .max = 32,
  87                                         .increment = 8
  88                                 },
  89                                 .iv_size = {
  90                                         .min = 16,
  91                                         .max = 16,
  92                                         .increment = 0
  93                                 }
  94                         }, }
  95                 }, }
  96         },
  97         {       /* SHA1 HMAC */
  98                 .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
  99                 {.sym = {
 100                         .xform_type = RTE_CRYPTO_SYM_XFORM_AUTH,
 101                         {.auth = {
 102                                 .algo = RTE_CRYPTO_AUTH_SHA1_HMAC,
 103                                 .block_size = 64,
 104                                 .key_size = {
 105                                         .min = 20,
 106                                         .max = 64,
 107                                         .increment = 1
 108                                 },
 109                                 .digest_size = {
 110                                         .min = 12,
 111                                         .max = 12,
 112                                         .increment = 0
 113                                 },
 114                         }, }
 115                 }, }
 116         },
 117         RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST()
 118 };
 119
 120 static const struct rte_security_capability otx2_eth_sec_capabilities[] = {
 121         {       /* IPsec Inline Protocol ESP Tunnel Ingress */
 122                 .action = RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL,
 123                 .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
 124                 .ipsec = {
 125                         .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
 126                         .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
 127                         .direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
 128                         .options = { 0 }
 129                 },
 130                 .crypto_capabilities = otx2_eth_sec_crypto_caps,
 131                 .ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA
 132         },
 133         {       /* IPsec Inline Protocol ESP Tunnel Egress */
 134                 .action = RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL,
 135                 .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
 136                 .ipsec = {
 137                         .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
 138                         .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
 139                         .direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
 140                         .options = { 0 }
 141                 },
 142                 .crypto_capabilities = otx2_eth_sec_crypto_caps,
 143                 .ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA
 144         },
 145         {
 146                 .action = RTE_SECURITY_ACTION_TYPE_NONE
 147         }
 148 };
 149
 150 static void
 151 lookup_mem_sa_tbl_clear(struct rte_eth_dev *eth_dev)
 152 {
 153         static const char name[] = OTX2_NIX_FASTPATH_LOOKUP_MEM;
 154         uint16_t port = eth_dev->data->port_id;
 155         const struct rte_memzone *mz;
 156         uint64_t **sa_tbl;
 157         uint8_t *mem;
 158
 159         mz = rte_memzone_lookup(name);
 160         if (mz == NULL)
 161                 return;
 162
 163         mem = mz->addr;
 164
 165         sa_tbl  = (uint64_t **)RTE_PTR_ADD(mem, OTX2_NIX_SA_TBL_START);
 166         if (sa_tbl[port] == NULL)
 167                 return;
 168
 169         rte_free(sa_tbl[port]);
 170         sa_tbl[port] = NULL;
 171 }
 172
 173 static int
 174 lookup_mem_sa_index_update(struct rte_eth_dev *eth_dev, int spi, void *sa)
 175 {
 176         static const char name[] = OTX2_NIX_FASTPATH_LOOKUP_MEM;
 177         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 178         uint16_t port = eth_dev->data->port_id;
 179         const struct rte_memzone *mz;
 180         uint64_t **sa_tbl;
 181         uint8_t *mem;
 182
 183         mz = rte_memzone_lookup(name);
 184         if (mz == NULL) {
 185                 otx2_err("Could not find fastpath lookup table");
 186                 return -EINVAL;
 187         }
 188
 189         mem = mz->addr;
 190
 191         sa_tbl = (uint64_t **)RTE_PTR_ADD(mem, OTX2_NIX_SA_TBL_START);
 192
 193         if (sa_tbl[port] == NULL) {
 194                 sa_tbl[port] = rte_malloc(NULL, dev->ipsec_in_max_spi *
 195                                           sizeof(uint64_t), 0);
 196         }
 197
 198         sa_tbl[port][spi] = (uint64_t)sa;
 199
 200         return 0;
 201 }
 202
 203 static inline void
 204 in_sa_mz_name_get(char *name, int size, uint16_t port)
 205 {
 206         snprintf(name, size, "otx2_ipsec_in_sadb_%u", port);
 207 }
 208
 209 static struct otx2_ipsec_fp_in_sa *
 210 in_sa_get(uint16_t port, int sa_index)
 211 {
 212         char name[RTE_MEMZONE_NAMESIZE];
 213         struct otx2_ipsec_fp_in_sa *sa;
 214         const struct rte_memzone *mz;
 215
 216         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 217         mz = rte_memzone_lookup(name);
 218         if (mz == NULL) {
 219                 otx2_err("Could not get the memzone reserved for IN SA DB");
 220                 return NULL;
 221         }
 222
 223         sa = mz->addr;
 224
 225         return sa + sa_index;
 226 }
 227
 228 static int
 229 ipsec_sa_const_set(struct rte_security_ipsec_xform *ipsec,
 230                    struct rte_crypto_sym_xform *xform,
 231                    struct otx2_sec_session_ipsec_ip *sess)
 232 {
 233         struct rte_crypto_sym_xform *cipher_xform, *auth_xform;
 234
 235         sess->partial_len = sizeof(struct rte_ipv4_hdr);
 236
 237         if (ipsec->proto == RTE_SECURITY_IPSEC_SA_PROTO_ESP) {
 238                 sess->partial_len += sizeof(struct rte_esp_hdr);
 239                 sess->roundup_len = sizeof(struct rte_esp_tail);
 240         } else if (ipsec->proto == RTE_SECURITY_IPSEC_SA_PROTO_AH) {
 241                 sess->partial_len += AH_HDR_LEN;
 242         } else {
 243                 return -EINVAL;
 244         }
 245
 246         if (ipsec->options.udp_encap)
 247                 sess->partial_len += sizeof(struct rte_udp_hdr);
 248
 249         if (xform->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
 250                 if (xform->aead.algo == RTE_CRYPTO_AEAD_AES_GCM) {
 251                         sess->partial_len += AES_GCM_IV_LEN;
 252                         sess->partial_len += AES_GCM_MAC_LEN;
 253                         sess->roundup_byte = AES_GCM_ROUNDUP_BYTE_LEN;
 254                 }
 255                 return 0;
 256         }
 257
 258         if (ipsec->direction == RTE_SECURITY_IPSEC_SA_DIR_EGRESS) {
 259                 cipher_xform = xform;
 260                 auth_xform = xform->next;
 261         } else if (ipsec->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS) {
 262                 auth_xform = xform;
 263                 cipher_xform = xform->next;
 264         } else {
 265                 return -EINVAL;
 266         }
 267         if (cipher_xform->cipher.algo == RTE_CRYPTO_CIPHER_AES_CBC) {
 268                 sess->partial_len += AES_CBC_IV_LEN;
 269                 sess->roundup_byte = AES_CBC_ROUNDUP_BYTE_LEN;
 270         } else {
 271                 return -EINVAL;
 272         }
 273
 274         if (auth_xform->auth.algo == RTE_CRYPTO_AUTH_SHA1_HMAC)
 275                 sess->partial_len += SHA1_HMAC_LEN;
 276         else
 277                 return -EINVAL;
 278
 279         return 0;
 280 }
 281
 282 static int
 283 hmac_init(struct otx2_ipsec_fp_sa_ctl *ctl, struct otx2_cpt_qp *qp,
 284           const uint8_t *auth_key, int len, uint8_t *hmac_key)
 285 {
 286         struct inst_data {
 287                 struct otx2_cpt_res cpt_res;
 288                 uint8_t buffer[64];
 289         } *md;
 290
 291         volatile struct otx2_cpt_res *res;
 292         uint64_t timeout, lmt_status;
 293         struct otx2_cpt_inst_s inst;
 294         rte_iova_t md_iova;
 295         int ret;
 296
 297         memset(&inst, 0, sizeof(struct otx2_cpt_inst_s));
 298
 299         md = rte_zmalloc(NULL, sizeof(struct inst_data), OTX2_CPT_RES_ALIGN);
 300         if (md == NULL)
 301                 return -ENOMEM;
 302
 303         memcpy(md->buffer, auth_key, len);
 304
 305         md_iova = rte_malloc_virt2iova(md);
 306         if (md_iova == RTE_BAD_IOVA) {
 307                 ret = -EINVAL;
 308                 goto free_md;
 309         }
 310
 311         inst.res_addr = md_iova + offsetof(struct inst_data, cpt_res);
 312         inst.opcode = OTX2_CPT_OP_WRITE_HMAC_IPAD_OPAD;
 313         inst.param2 = ctl->auth_type;
 314         inst.dlen = len;
 315         inst.dptr = md_iova + offsetof(struct inst_data, buffer);
 316         inst.rptr = inst.dptr;
 317         inst.egrp = OTX2_CPT_EGRP_INLINE_IPSEC;
 318
 319         md->cpt_res.compcode = 0;
 320         md->cpt_res.uc_compcode = 0xff;
 321
 322         timeout = rte_get_timer_cycles() + 5 * rte_get_timer_hz();
 323
 324         rte_cio_wmb();
 325
 326         do {
 327                 otx2_lmt_mov(qp->lmtline, &inst, 2);
 328                 lmt_status = otx2_lmt_submit(qp->lf_nq_reg);
 329         } while (lmt_status == 0);
 330
 331         res = (volatile struct otx2_cpt_res *)&md->cpt_res;
 332
 333         /* Wait until instruction completes or times out */
 334         while (res->uc_compcode == 0xff) {
 335                 if (rte_get_timer_cycles() > timeout)
 336                         break;
 337         }
 338
 339         if (res->u16[0] != OTX2_SEC_COMP_GOOD) {
 340                 ret = -EIO;
 341                 goto free_md;
 342         }
 343
 344         /* Retrieve the ipad and opad from rptr */
 345         memcpy(hmac_key, md->buffer, 48);
 346
 347         ret = 0;
 348
 349 free_md:
 350         rte_free(md);
 351         return ret;
 352 }
 353
 354 static int
 355 eth_sec_ipsec_out_sess_create(struct rte_eth_dev *eth_dev,
 356                               struct rte_security_ipsec_xform *ipsec,
 357                               struct rte_crypto_sym_xform *crypto_xform,
 358                               struct rte_security_session *sec_sess)
 359 {
 360         struct rte_crypto_sym_xform *auth_xform, *cipher_xform;
 361         struct otx2_sec_session_ipsec_ip *sess;
 362         uint16_t port = eth_dev->data->port_id;
 363         int cipher_key_len, auth_key_len, ret;
 364         const uint8_t *cipher_key, *auth_key;
 365         struct otx2_ipsec_fp_sa_ctl *ctl;
 366         struct otx2_ipsec_fp_out_sa *sa;
 367         struct otx2_sec_session *priv;
 368         struct otx2_cpt_inst_s inst;
 369         struct otx2_cpt_qp *qp;
 370
 371         priv = get_sec_session_private_data(sec_sess);
 372         sess = &priv->ipsec.ip;
 373
 374         sa = &sess->out_sa;
 375         ctl = &sa->ctl;
 376         if (ctl->valid) {
 377                 otx2_err("SA already registered");
 378                 return -EINVAL;
 379         }
 380
 381         memset(sess, 0, sizeof(struct otx2_sec_session_ipsec_ip));
 382
 383         sess->seq = 1;
 384
 385         ret = ipsec_sa_const_set(ipsec, crypto_xform, sess);
 386         if (ret < 0)
 387                 return ret;
 388
 389         if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD)
 390                 memcpy(sa->nonce, &ipsec->salt, 4);
 391
 392         if (ipsec->options.udp_encap == 1) {
 393                 sa->udp_src = 4500;
 394                 sa->udp_dst = 4500;
 395         }
 396
 397         if (ipsec->mode == RTE_SECURITY_IPSEC_SA_MODE_TUNNEL) {
 398                 /* Start ip id from 1 */
 399                 sess->ip_id = 1;
 400
 401                 if (ipsec->tunnel.type == RTE_SECURITY_IPSEC_TUNNEL_IPV4) {
 402                         memcpy(&sa->ip_src, &ipsec->tunnel.ipv4.src_ip,
 403                                sizeof(struct in_addr));
 404                         memcpy(&sa->ip_dst, &ipsec->tunnel.ipv4.dst_ip,
 405                                sizeof(struct in_addr));
 406                 } else {
 407                         return -EINVAL;
 408                 }
 409         } else {
 410                 return -EINVAL;
 411         }
 412
 413         cipher_xform = crypto_xform;
 414         auth_xform = crypto_xform->next;
 415
 416         cipher_key_len = 0;
 417         auth_key_len = 0;
 418         auth_key = NULL;
 419
 420         if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
 421                 cipher_key = crypto_xform->aead.key.data;
 422                 cipher_key_len = crypto_xform->aead.key.length;
 423         } else {
 424                 cipher_key = cipher_xform->cipher.key.data;
 425                 cipher_key_len = cipher_xform->cipher.key.length;
 426                 auth_key = auth_xform->auth.key.data;
 427                 auth_key_len = auth_xform->auth.key.length;
 428         }
 429
 430         if (cipher_key_len != 0)
 431                 memcpy(sa->cipher_key, cipher_key, cipher_key_len);
 432         else
 433                 return -EINVAL;
 434
 435         /* Determine word 7 of CPT instruction */
 436         inst.u64[7] = 0;
 437         inst.egrp = OTX2_CPT_EGRP_INLINE_IPSEC;
 438         inst.cptr = rte_mempool_virt2iova(sa);
 439         sess->inst_w7 = inst.u64[7];
 440
 441         /* Get CPT QP to be used for this SA */
 442         ret = otx2_sec_idev_tx_cpt_qp_get(port, &qp);
 443         if (ret)
 444                 return ret;
 445
 446         sess->qp = qp;
 447
 448         sess->cpt_lmtline = qp->lmtline;
 449         sess->cpt_nq_reg = qp->lf_nq_reg;
 450
 451         /* Populate control word */
 452         ret = ipsec_fp_sa_ctl_set(ipsec, crypto_xform, ctl);
 453         if (ret)
 454                 goto cpt_put;
 455
 456         if (auth_key_len && auth_key) {
 457                 ret = hmac_init(ctl, qp, auth_key, auth_key_len, sa->hmac_key);
 458                 if (ret)
 459                         goto cpt_put;
 460         }
 461
 462         return 0;
 463 cpt_put:
 464         otx2_sec_idev_tx_cpt_qp_put(sess->qp);
 465         return ret;
 466 }
 467
 468 static int
 469 eth_sec_ipsec_in_sess_create(struct rte_eth_dev *eth_dev,
 470                              struct rte_security_ipsec_xform *ipsec,
 471                              struct rte_crypto_sym_xform *crypto_xform,
 472                              struct rte_security_session *sec_sess)
 473 {
 474         struct rte_crypto_sym_xform *auth_xform, *cipher_xform;
 475         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 476         struct otx2_sec_session_ipsec_ip *sess;
 477         uint16_t port = eth_dev->data->port_id;
 478         int cipher_key_len, auth_key_len, ret;
 479         const uint8_t *cipher_key, *auth_key;
 480         struct otx2_ipsec_fp_sa_ctl *ctl;
 481         struct otx2_ipsec_fp_in_sa *sa;
 482         struct otx2_sec_session *priv;
 483         struct otx2_cpt_qp *qp;
 484
 485         if (ipsec->spi >= dev->ipsec_in_max_spi) {
 486                 otx2_err("SPI exceeds max supported");
 487                 return -EINVAL;
 488         }
 489
 490         sa = in_sa_get(port, ipsec->spi);
 491         ctl = &sa->ctl;
 492
 493         priv = get_sec_session_private_data(sec_sess);
 494         sess = &priv->ipsec.ip;
 495
 496         if (ctl->valid) {
 497                 otx2_err("SA already registered");
 498                 return -EINVAL;
 499         }
 500
 501         memset(sa, 0, sizeof(struct otx2_ipsec_fp_in_sa));
 502
 503         auth_xform = crypto_xform;
 504         cipher_xform = crypto_xform->next;
 505
 506         cipher_key_len = 0;
 507         auth_key_len = 0;
 508         auth_key = NULL;
 509
 510         if (crypto_xform->type == RTE_CRYPTO_SYM_XFORM_AEAD) {
 511                 if (crypto_xform->aead.algo == RTE_CRYPTO_AEAD_AES_GCM)
 512                         memcpy(sa->nonce, &ipsec->salt, 4);
 513                 cipher_key = crypto_xform->aead.key.data;
 514                 cipher_key_len = crypto_xform->aead.key.length;
 515         } else {
 516                 cipher_key = cipher_xform->cipher.key.data;
 517                 cipher_key_len = cipher_xform->cipher.key.length;
 518                 auth_key = auth_xform->auth.key.data;
 519                 auth_key_len = auth_xform->auth.key.length;
 520         }
 521
 522         if (cipher_key_len != 0)
 523                 memcpy(sa->cipher_key, cipher_key, cipher_key_len);
 524         else
 525                 return -EINVAL;
 526
 527         sess->in_sa = sa;
 528
 529         sa->userdata = priv->userdata;
 530
 531         if (lookup_mem_sa_index_update(eth_dev, ipsec->spi, sa))
 532                 return -EINVAL;
 533
 534         ret = ipsec_fp_sa_ctl_set(ipsec, crypto_xform, ctl);
 535         if (ret)
 536                 return ret;
 537
 538         if (auth_key_len && auth_key) {
 539                 /* Get a queue pair for HMAC init */
 540                 ret = otx2_sec_idev_tx_cpt_qp_get(port, &qp);
 541                 if (ret)
 542                         return ret;
 543                 ret = hmac_init(ctl, qp, auth_key, auth_key_len, sa->hmac_key);
 544                 otx2_sec_idev_tx_cpt_qp_put(qp);
 545         }
 546         return ret;
 547 }
 548
 549 static int
 550 eth_sec_ipsec_sess_create(struct rte_eth_dev *eth_dev,
 551                           struct rte_security_ipsec_xform *ipsec,
 552                           struct rte_crypto_sym_xform *crypto_xform,
 553                           struct rte_security_session *sess)
 554 {
 555         int ret;
 556
 557         ret = ipsec_fp_xform_verify(ipsec, crypto_xform);
 558         if (ret)
 559                 return ret;
 560
 561         if (ipsec->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
 562                 return eth_sec_ipsec_in_sess_create(eth_dev, ipsec,
 563                                                     crypto_xform, sess);
 564         else
 565                 return eth_sec_ipsec_out_sess_create(eth_dev, ipsec,
 566                                                      crypto_xform, sess);
 567 }
 568
 569 static int
 570 otx2_eth_sec_session_create(void *device,
 571                             struct rte_security_session_conf *conf,
 572                             struct rte_security_session *sess,
 573                             struct rte_mempool *mempool)
 574 {
 575         struct otx2_sec_session *priv;
 576         int ret;
 577
 578         if (conf->action_type != RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL)
 579                 return -ENOTSUP;
 580
 581         if (rte_mempool_get(mempool, (void **)&priv)) {
 582                 otx2_err("Could not allocate security session private data");
 583                 return -ENOMEM;
 584         }
 585
 586         set_sec_session_private_data(sess, priv);
 587
 588         /*
 589          * Save userdata provided by the application. For ingress packets, this
 590          * could be used to identify the SA.
 591          */
 592         priv->userdata = conf->userdata;
 593
 594         if (conf->protocol == RTE_SECURITY_PROTOCOL_IPSEC)
 595                 ret = eth_sec_ipsec_sess_create(device, &conf->ipsec,
 596                                                 conf->crypto_xform,
 597                                                 sess);
 598         else
 599                 ret = -ENOTSUP;
 600
 601         if (ret)
 602                 goto mempool_put;
 603
 604         return 0;
 605
 606 mempool_put:
 607         rte_mempool_put(mempool, priv);
 608         set_sec_session_private_data(sess, NULL);
 609         return ret;
 610 }
 611
 612 static int
 613 otx2_eth_sec_session_destroy(void *device __rte_unused,
 614                              struct rte_security_session *sess)
 615 {
 616         struct otx2_sec_session_ipsec_ip *sess_ip;
 617         struct otx2_sec_session *priv;
 618         struct rte_mempool *sess_mp;
 619         int ret;
 620
 621         priv = get_sec_session_private_data(sess);
 622         if (priv == NULL)
 623                 return -EINVAL;
 624
 625         sess_ip = &priv->ipsec.ip;
 626
 627         /* Release CPT LF used for this session */
 628         if (sess_ip->qp != NULL) {
 629                 ret = otx2_sec_idev_tx_cpt_qp_put(sess_ip->qp);
 630                 if (ret)
 631                         return ret;
 632         }
 633
 634         sess_mp = rte_mempool_from_obj(priv);
 635
 636         set_sec_session_private_data(sess, NULL);
 637         rte_mempool_put(sess_mp, priv);
 638
 639         return 0;
 640 }
 641
 642 static unsigned int
 643 otx2_eth_sec_session_get_size(void *device __rte_unused)
 644 {
 645         return sizeof(struct otx2_sec_session);
 646 }
 647
 648 static int
 649 otx2_eth_sec_set_pkt_mdata(void *device __rte_unused,
 650                             struct rte_security_session *session,
 651                             struct rte_mbuf *m, void *params __rte_unused)
 652 {
 653         /* Set security session as the pkt metadata */
 654         m->udata64 = (uint64_t)session;
 655
 656         return 0;
 657 }
 658
 659 static int
 660 otx2_eth_sec_get_userdata(void *device __rte_unused, uint64_t md,
 661                            void **userdata)
 662 {
 663         /* Retrieve userdata  */
 664         *userdata = (void *)md;
 665
 666         return 0;
 667 }
 668
 669 static const struct rte_security_capability *
 670 otx2_eth_sec_capabilities_get(void *device __rte_unused)
 671 {
 672         return otx2_eth_sec_capabilities;
 673 }
 674
 675 static struct rte_security_ops otx2_eth_sec_ops = {
 676         .session_create         = otx2_eth_sec_session_create,
 677         .session_destroy        = otx2_eth_sec_session_destroy,
 678         .session_get_size       = otx2_eth_sec_session_get_size,
 679         .set_pkt_metadata       = otx2_eth_sec_set_pkt_mdata,
 680         .get_userdata           = otx2_eth_sec_get_userdata,
 681         .capabilities_get       = otx2_eth_sec_capabilities_get
 682 };
 683
 684 int
 685 otx2_eth_sec_ctx_create(struct rte_eth_dev *eth_dev)
 686 {
 687         struct rte_security_ctx *ctx;
 688         int ret;
 689
 690         ctx = rte_malloc("otx2_eth_sec_ctx",
 691                          sizeof(struct rte_security_ctx), 0);
 692         if (ctx == NULL)
 693                 return -ENOMEM;
 694
 695         ret = otx2_sec_idev_cfg_init(eth_dev->data->port_id);
 696         if (ret) {
 697                 rte_free(ctx);
 698                 return ret;
 699         }
 700
 701         /* Populate ctx */
 702
 703         ctx->device = eth_dev;
 704         ctx->ops = &otx2_eth_sec_ops;
 705         ctx->sess_cnt = 0;
 706
 707         eth_dev->security_ctx = ctx;
 708
 709         return 0;
 710 }
 711
 712 void
 713 otx2_eth_sec_ctx_destroy(struct rte_eth_dev *eth_dev)
 714 {
 715         rte_free(eth_dev->security_ctx);
 716 }
 717
 718 static int
 719 eth_sec_ipsec_cfg(struct rte_eth_dev *eth_dev, uint8_t tt)
 720 {
 721         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 722         uint16_t port = eth_dev->data->port_id;
 723         struct nix_inline_ipsec_lf_cfg *req;
 724         struct otx2_mbox *mbox = dev->mbox;
 725         struct eth_sec_tag_const tag_const;
 726         char name[RTE_MEMZONE_NAMESIZE];
 727         const struct rte_memzone *mz;
 728
 729         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 730         mz = rte_memzone_lookup(name);
 731         if (mz == NULL)
 732                 return -EINVAL;
 733
 734         req = otx2_mbox_alloc_msg_nix_inline_ipsec_lf_cfg(mbox);
 735         req->enable = 1;
 736         req->sa_base_addr = mz->iova;
 737
 738         req->ipsec_cfg0.tt = tt;
 739
 740         tag_const.u32 = 0;
 741         tag_const.event_type = RTE_EVENT_TYPE_ETHDEV;
 742         tag_const.port = port;
 743         req->ipsec_cfg0.tag_const = tag_const.u32;
 744
 745         req->ipsec_cfg0.sa_pow2_size =
 746                         rte_log2_u32(sizeof(struct otx2_ipsec_fp_in_sa));
 747         req->ipsec_cfg0.lenm1_max = NIX_MAX_FRS - 1;
 748
 749         req->ipsec_cfg1.sa_idx_w = rte_log2_u32(dev->ipsec_in_max_spi);
 750         req->ipsec_cfg1.sa_idx_max = dev->ipsec_in_max_spi - 1;
 751
 752         return otx2_mbox_process(mbox);
 753 }
 754
 755 int
 756 otx2_eth_sec_update_tag_type(struct rte_eth_dev *eth_dev)
 757 {
 758         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 759         struct otx2_mbox *mbox = dev->mbox;
 760         struct nix_aq_enq_rsp *rsp;
 761         struct nix_aq_enq_req *aq;
 762         int ret;
 763
 764         aq = otx2_mbox_alloc_msg_nix_aq_enq(mbox);
 765         aq->qidx = 0; /* Read RQ:0 context */
 766         aq->ctype = NIX_AQ_CTYPE_RQ;
 767         aq->op = NIX_AQ_INSTOP_READ;
 768
 769         ret = otx2_mbox_process_msg(mbox, (void *)&rsp);
 770         if (ret < 0) {
 771                 otx2_err("Could not read RQ context");
 772                 return ret;
 773         }
 774
 775         /* Update tag type */
 776         ret = eth_sec_ipsec_cfg(eth_dev, rsp->rq.sso_tt);
 777         if (ret < 0)
 778                 otx2_err("Could not update sec eth tag type");
 779
 780         return ret;
 781 }
 782
 783 int
 784 otx2_eth_sec_init(struct rte_eth_dev *eth_dev)
 785 {
 786         const size_t sa_width = sizeof(struct otx2_ipsec_fp_in_sa);
 787         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 788         uint16_t port = eth_dev->data->port_id;
 789         char name[RTE_MEMZONE_NAMESIZE];
 790         const struct rte_memzone *mz;
 791         int mz_sz, ret;
 792         uint16_t nb_sa;
 793
 794         RTE_BUILD_BUG_ON(sa_width < 32 || sa_width > 512 ||
 795                          !RTE_IS_POWER_OF_2(sa_width));
 796
 797         if (!(dev->tx_offloads & DEV_TX_OFFLOAD_SECURITY) &&
 798             !(dev->rx_offloads & DEV_RX_OFFLOAD_SECURITY))
 799                 return 0;
 800
 801         nb_sa = dev->ipsec_in_max_spi;
 802         mz_sz = nb_sa * sa_width;
 803         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 804         mz = rte_memzone_reserve_aligned(name, mz_sz, rte_socket_id(),
 805                                          RTE_MEMZONE_IOVA_CONTIG, OTX2_ALIGN);
 806
 807         if (mz == NULL) {
 808                 otx2_err("Could not allocate inbound SA DB");
 809                 return -ENOMEM;
 810         }
 811
 812         memset(mz->addr, 0, mz_sz);
 813
 814         ret = eth_sec_ipsec_cfg(eth_dev, SSO_TT_ORDERED);
 815         if (ret < 0) {
 816                 otx2_err("Could not configure inline IPsec");
 817                 goto sec_fini;
 818         }
 819
 820         return 0;
 821
 822 sec_fini:
 823         otx2_err("Could not configure device for security");
 824         otx2_eth_sec_fini(eth_dev);
 825         return ret;
 826 }
 827
 828 void
 829 otx2_eth_sec_fini(struct rte_eth_dev *eth_dev)
 830 {
 831         struct otx2_eth_dev *dev = otx2_eth_pmd_priv(eth_dev);
 832         uint16_t port = eth_dev->data->port_id;
 833         char name[RTE_MEMZONE_NAMESIZE];
 834
 835         if (!(dev->tx_offloads & DEV_TX_OFFLOAD_SECURITY) &&
 836             !(dev->rx_offloads & DEV_RX_OFFLOAD_SECURITY))
 837                 return;
 838
 839         lookup_mem_sa_tbl_clear(eth_dev);
 840
 841         in_sa_mz_name_get(name, RTE_MEMZONE_NAMESIZE, port);
 842         rte_memzone_free(rte_memzone_lookup(name));
 843 }