net/virtio: fix incorrect cast of void *
[dpdk.git] / ipsec / ipsec_sad.c
1 /* SPDX-License-Identifier: BSD-3-Clause
2  * Copyright(c) 2019 Intel Corporation
3  */
4
5 #include <string.h>
6
7 #include <rte_eal_memconfig.h>
8 #include <rte_errno.h>
9 #include <rte_hash.h>
10 #include <rte_hash_crc.h>
11 #include <rte_malloc.h>
12 #include <rte_random.h>
13 #include <rte_rwlock.h>
14 #include <rte_tailq.h>
15
16 #include "rte_ipsec_sad.h"
17
18 /*
19  * Rules are stored in three hash tables depending on key_type.
20  * Each rule will also be stored in SPI_ONLY table.
21  * for each data entry within this table last two bits are reserved to
22  * indicate presence of entries with the same SPI in DIP and DIP+SIP tables.
23  */
24
25 #define SAD_PREFIX              "SAD_"
26 /* "SAD_<name>" */
27 #define SAD_FORMAT              SAD_PREFIX "%s"
28
29 #define DEFAULT_HASH_FUNC       rte_hash_crc
30 #define MIN_HASH_ENTRIES        8U /* From rte_cuckoo_hash.h */
31
32 struct hash_cnt {
33         uint32_t cnt_dip;
34         uint32_t cnt_dip_sip;
35 };
36
37 struct rte_ipsec_sad {
38         char name[RTE_IPSEC_SAD_NAMESIZE];
39         struct rte_hash *hash[RTE_IPSEC_SAD_KEY_TYPE_MASK];
40         uint32_t keysize[RTE_IPSEC_SAD_KEY_TYPE_MASK];
41         uint32_t init_val;
42         /* Array to track number of more specific rules
43          * (spi_dip or spi_dip_sip). Used only in add/delete
44          * as a helper struct.
45          */
46         __extension__ struct hash_cnt cnt_arr[];
47 };
48
49 TAILQ_HEAD(rte_ipsec_sad_list, rte_tailq_entry);
50 static struct rte_tailq_elem rte_ipsec_sad_tailq = {
51         .name = "RTE_IPSEC_SAD",
52 };
53 EAL_REGISTER_TAILQ(rte_ipsec_sad_tailq)
54
55 #define SET_BIT(ptr, bit)       (void *)((uintptr_t)(ptr) | (uintptr_t)(bit))
56 #define CLEAR_BIT(ptr, bit)     (void *)((uintptr_t)(ptr) & ~(uintptr_t)(bit))
57 #define GET_BIT(ptr, bit)       (void *)((uintptr_t)(ptr) & (uintptr_t)(bit))
58
59 /*
60  * @internal helper function
61  * Add a rule of type SPI_DIP or SPI_DIP_SIP.
62  * Inserts a rule into an appropriate hash table,
63  * updates the value for a given SPI in SPI_ONLY hash table
64  * reflecting presence of more specific rule type in two LSBs.
65  * Updates a counter that reflects the number of rules whith the same SPI.
66  */
67 static inline int
68 add_specific(struct rte_ipsec_sad *sad, const void *key,
69                 int key_type, void *sa)
70 {
71         void *tmp_val;
72         int ret, notexist;
73
74         /* Check if the key is present in the table.
75          * Need for further accaunting in cnt_arr
76          */
77         ret = rte_hash_lookup_with_hash(sad->hash[key_type], key,
78                 rte_hash_crc(key, sad->keysize[key_type], sad->init_val));
79         notexist = (ret == -ENOENT);
80
81         /* Add an SA to the corresponding table.*/
82         ret = rte_hash_add_key_with_hash_data(sad->hash[key_type], key,
83                 rte_hash_crc(key, sad->keysize[key_type], sad->init_val), sa);
84         if (ret != 0)
85                 return ret;
86
87         /* Check if there is an entry in SPI only table with the same SPI */
88         ret = rte_hash_lookup_with_hash_data(sad->hash[RTE_IPSEC_SAD_SPI_ONLY],
89                 key, rte_hash_crc(key, sad->keysize[RTE_IPSEC_SAD_SPI_ONLY],
90                 sad->init_val), &tmp_val);
91         if (ret < 0)
92                 tmp_val = NULL;
93         tmp_val = SET_BIT(tmp_val, key_type);
94
95         /* Add an entry into SPI only table */
96         ret = rte_hash_add_key_with_hash_data(
97                 sad->hash[RTE_IPSEC_SAD_SPI_ONLY], key,
98                 rte_hash_crc(key, sad->keysize[RTE_IPSEC_SAD_SPI_ONLY],
99                 sad->init_val), tmp_val);
100         if (ret != 0)
101                 return ret;
102
103         /* Update a counter for a given SPI */
104         ret = rte_hash_lookup_with_hash(sad->hash[RTE_IPSEC_SAD_SPI_ONLY], key,
105                 rte_hash_crc(key, sad->keysize[RTE_IPSEC_SAD_SPI_ONLY],
106                 sad->init_val));
107         if (ret < 0)
108                 return ret;
109         if (key_type == RTE_IPSEC_SAD_SPI_DIP)
110                 sad->cnt_arr[ret].cnt_dip += notexist;
111         else
112                 sad->cnt_arr[ret].cnt_dip_sip += notexist;
113
114         return 0;
115 }
116
117 int
118 rte_ipsec_sad_add(struct rte_ipsec_sad *sad,
119                 const union rte_ipsec_sad_key *key,
120                 int key_type, void *sa)
121 {
122         void *tmp_val;
123         int ret;
124
125         if ((sad == NULL) || (key == NULL) || (sa == NULL) ||
126                         /* sa must be 4 byte aligned */
127                         (GET_BIT(sa, RTE_IPSEC_SAD_KEY_TYPE_MASK) != 0))
128                 return -EINVAL;
129
130         /*
131          * Rules are stored in three hash tables depending on key_type.
132          * All rules will also have an entry in SPI_ONLY table, with entry
133          * value's two LSB's also indicating presence of rule with this SPI
134          * in other tables.
135          */
136         switch (key_type) {
137         case(RTE_IPSEC_SAD_SPI_ONLY):
138                 ret = rte_hash_lookup_with_hash_data(sad->hash[key_type],
139                         key, rte_hash_crc(key, sad->keysize[key_type],
140                         sad->init_val), &tmp_val);
141                 if (ret >= 0)
142                         tmp_val = SET_BIT(sa, GET_BIT(tmp_val,
143                                 RTE_IPSEC_SAD_KEY_TYPE_MASK));
144                 else
145                         tmp_val = sa;
146                 ret = rte_hash_add_key_with_hash_data(sad->hash[key_type],
147                         key, rte_hash_crc(key, sad->keysize[key_type],
148                         sad->init_val), tmp_val);
149                 return ret;
150         case(RTE_IPSEC_SAD_SPI_DIP):
151         case(RTE_IPSEC_SAD_SPI_DIP_SIP):
152                 return add_specific(sad, key, key_type, sa);
153         default:
154                 return -EINVAL;
155         }
156 }
157
158 /*
159  * @internal helper function
160  * Delete a rule of type SPI_DIP or SPI_DIP_SIP.
161  * Deletes an entry from an appropriate hash table and decrements
162  * an entry counter for given SPI.
163  * If entry to remove is the last one with given SPI within the table,
164  * then it will also update related entry in SPI_ONLY table.
165  * Removes an entry from SPI_ONLY hash table if there no rule left
166  * for this SPI in any table.
167  */
168 static inline int
169 del_specific(struct rte_ipsec_sad *sad, const void *key, int key_type)
170 {
171         void *tmp_val;
172         int ret;
173         uint32_t *cnt;
174
175         /* Remove an SA from the corresponding table.*/
176         ret = rte_hash_del_key_with_hash(sad->hash[key_type], key,
177                 rte_hash_crc(key, sad->keysize[key_type], sad->init_val));
178         if (ret < 0)
179                 return ret;
180
181         /* Get an index of cnt_arr entry for a given SPI */
182         ret = rte_hash_lookup_with_hash_data(sad->hash[RTE_IPSEC_SAD_SPI_ONLY],
183                 key, rte_hash_crc(key, sad->keysize[RTE_IPSEC_SAD_SPI_ONLY],
184                 sad->init_val), &tmp_val);
185         if (ret < 0)
186                 return ret;
187         cnt = (key_type == RTE_IPSEC_SAD_SPI_DIP) ?
188                         &sad->cnt_arr[ret].cnt_dip :
189                         &sad->cnt_arr[ret].cnt_dip_sip;
190         if (--(*cnt) != 0)
191                 return 0;
192
193         /* corresponding counter is 0, clear the bit indicating
194          * the presence of more specific rule for a given SPI.
195          */
196         tmp_val = CLEAR_BIT(tmp_val, key_type);
197
198         /* if there are no rules left with same SPI,
199          * remove an entry from SPI_only table
200          */
201         if (tmp_val == NULL)
202                 ret = rte_hash_del_key_with_hash(
203                         sad->hash[RTE_IPSEC_SAD_SPI_ONLY], key,
204                         rte_hash_crc(key, sad->keysize[RTE_IPSEC_SAD_SPI_ONLY],
205                         sad->init_val));
206         else
207                 ret = rte_hash_add_key_with_hash_data(
208                         sad->hash[RTE_IPSEC_SAD_SPI_ONLY], key,
209                         rte_hash_crc(key, sad->keysize[RTE_IPSEC_SAD_SPI_ONLY],
210                         sad->init_val), tmp_val);
211         if (ret < 0)
212                 return ret;
213         return 0;
214 }
215
216 int
217 rte_ipsec_sad_del(struct rte_ipsec_sad *sad,
218                 const union rte_ipsec_sad_key *key,
219                 int key_type)
220 {
221         void *tmp_val;
222         int ret;
223
224         if ((sad == NULL) || (key == NULL))
225                 return -EINVAL;
226         switch (key_type) {
227         case(RTE_IPSEC_SAD_SPI_ONLY):
228                 ret = rte_hash_lookup_with_hash_data(sad->hash[key_type],
229                         key, rte_hash_crc(key, sad->keysize[key_type],
230                         sad->init_val), &tmp_val);
231                 if (ret < 0)
232                         return ret;
233                 if (GET_BIT(tmp_val, RTE_IPSEC_SAD_KEY_TYPE_MASK) == 0) {
234                         ret = rte_hash_del_key_with_hash(sad->hash[key_type],
235                                 key, rte_hash_crc(key, sad->keysize[key_type],
236                                 sad->init_val));
237                         ret = ret < 0 ? ret : 0;
238                 } else {
239                         tmp_val = GET_BIT(tmp_val,
240                                 RTE_IPSEC_SAD_KEY_TYPE_MASK);
241                         ret = rte_hash_add_key_with_hash_data(
242                                 sad->hash[key_type], key,
243                                 rte_hash_crc(key, sad->keysize[key_type],
244                                 sad->init_val), tmp_val);
245                 }
246                 return ret;
247         case(RTE_IPSEC_SAD_SPI_DIP):
248         case(RTE_IPSEC_SAD_SPI_DIP_SIP):
249                 return del_specific(sad, key, key_type);
250         default:
251                 return -EINVAL;
252         }
253 }
254
255 struct rte_ipsec_sad *
256 rte_ipsec_sad_create(const char *name, const struct rte_ipsec_sad_conf *conf)
257 {
258         char hash_name[RTE_HASH_NAMESIZE];
259         char sad_name[RTE_IPSEC_SAD_NAMESIZE];
260         struct rte_tailq_entry *te;
261         struct rte_ipsec_sad_list *sad_list;
262         struct rte_ipsec_sad *sad, *tmp_sad = NULL;
263         struct rte_hash_parameters hash_params = {0};
264         int ret;
265         uint32_t sa_sum;
266
267         RTE_BUILD_BUG_ON(RTE_IPSEC_SAD_KEY_TYPE_MASK != 3);
268
269         if ((name == NULL) || (conf == NULL) ||
270                         ((conf->max_sa[RTE_IPSEC_SAD_SPI_ONLY] == 0) &&
271                         (conf->max_sa[RTE_IPSEC_SAD_SPI_DIP] == 0) &&
272                         (conf->max_sa[RTE_IPSEC_SAD_SPI_DIP_SIP] == 0))) {
273                 rte_errno = EINVAL;
274                 return NULL;
275         }
276
277         ret = snprintf(sad_name, RTE_IPSEC_SAD_NAMESIZE, SAD_FORMAT, name);
278         if (ret < 0 || ret >= RTE_IPSEC_SAD_NAMESIZE) {
279                 rte_errno = ENAMETOOLONG;
280                 return NULL;
281         }
282
283         /** Init SAD*/
284         sa_sum = RTE_MAX(MIN_HASH_ENTRIES,
285                 conf->max_sa[RTE_IPSEC_SAD_SPI_ONLY]) +
286                 RTE_MAX(MIN_HASH_ENTRIES,
287                 conf->max_sa[RTE_IPSEC_SAD_SPI_DIP]) +
288                 RTE_MAX(MIN_HASH_ENTRIES,
289                 conf->max_sa[RTE_IPSEC_SAD_SPI_DIP_SIP]);
290         sad = rte_zmalloc_socket(NULL, sizeof(*sad) +
291                 (sizeof(struct hash_cnt) * sa_sum),
292                 RTE_CACHE_LINE_SIZE, conf->socket_id);
293         if (sad == NULL) {
294                 rte_errno = ENOMEM;
295                 return NULL;
296         }
297         memcpy(sad->name, sad_name, sizeof(sad_name));
298
299         hash_params.hash_func = DEFAULT_HASH_FUNC;
300         hash_params.hash_func_init_val = rte_rand();
301         sad->init_val = hash_params.hash_func_init_val;
302         hash_params.socket_id = conf->socket_id;
303         hash_params.name = hash_name;
304         if (conf->flags & RTE_IPSEC_SAD_FLAG_RW_CONCURRENCY)
305                 hash_params.extra_flag = RTE_HASH_EXTRA_FLAGS_RW_CONCURRENCY;
306
307         /** Init hash[RTE_IPSEC_SAD_SPI_ONLY] for SPI only */
308         snprintf(hash_name, sizeof(hash_name), "sad_1_%p", sad);
309         hash_params.key_len = sizeof(((struct rte_ipsec_sadv4_key *)0)->spi);
310         sad->keysize[RTE_IPSEC_SAD_SPI_ONLY] = hash_params.key_len;
311         hash_params.entries = sa_sum;
312         sad->hash[RTE_IPSEC_SAD_SPI_ONLY] = rte_hash_create(&hash_params);
313         if (sad->hash[RTE_IPSEC_SAD_SPI_ONLY] == NULL) {
314                 rte_ipsec_sad_destroy(sad);
315                 return NULL;
316         }
317
318         /** Init hash[RTE_IPSEC_SAD_SPI_DIP] for SPI + DIP */
319         snprintf(hash_name, sizeof(hash_name), "sad_2_%p", sad);
320         if (conf->flags & RTE_IPSEC_SAD_FLAG_IPV6)
321                 hash_params.key_len +=
322                         sizeof(((struct rte_ipsec_sadv6_key *)0)->dip);
323         else
324                 hash_params.key_len +=
325                         sizeof(((struct rte_ipsec_sadv4_key *)0)->dip);
326         sad->keysize[RTE_IPSEC_SAD_SPI_DIP] = hash_params.key_len;
327         hash_params.entries = RTE_MAX(MIN_HASH_ENTRIES,
328                         conf->max_sa[RTE_IPSEC_SAD_SPI_DIP]);
329         sad->hash[RTE_IPSEC_SAD_SPI_DIP] = rte_hash_create(&hash_params);
330         if (sad->hash[RTE_IPSEC_SAD_SPI_DIP] == NULL) {
331                 rte_ipsec_sad_destroy(sad);
332                 return NULL;
333         }
334
335         /** Init hash[[RTE_IPSEC_SAD_SPI_DIP_SIP] for SPI + DIP + SIP */
336         snprintf(hash_name, sizeof(hash_name), "sad_3_%p", sad);
337         if (conf->flags & RTE_IPSEC_SAD_FLAG_IPV6)
338                 hash_params.key_len +=
339                         sizeof(((struct rte_ipsec_sadv6_key *)0)->sip);
340         else
341                 hash_params.key_len +=
342                         sizeof(((struct rte_ipsec_sadv4_key *)0)->sip);
343         sad->keysize[RTE_IPSEC_SAD_SPI_DIP_SIP] = hash_params.key_len;
344         hash_params.entries = RTE_MAX(MIN_HASH_ENTRIES,
345                         conf->max_sa[RTE_IPSEC_SAD_SPI_DIP_SIP]);
346         sad->hash[RTE_IPSEC_SAD_SPI_DIP_SIP] = rte_hash_create(&hash_params);
347         if (sad->hash[RTE_IPSEC_SAD_SPI_DIP_SIP] == NULL) {
348                 rte_ipsec_sad_destroy(sad);
349                 return NULL;
350         }
351
352         sad_list = RTE_TAILQ_CAST(rte_ipsec_sad_tailq.head,
353                         rte_ipsec_sad_list);
354         rte_mcfg_tailq_write_lock();
355         /* guarantee there's no existing */
356         TAILQ_FOREACH(te, sad_list, next) {
357                 tmp_sad = (struct rte_ipsec_sad *)te->data;
358                 if (strncmp(sad_name, tmp_sad->name,
359                                 RTE_IPSEC_SAD_NAMESIZE) == 0)
360                         break;
361         }
362         if (te != NULL) {
363                 rte_mcfg_tailq_write_unlock();
364                 rte_errno = EEXIST;
365                 rte_ipsec_sad_destroy(sad);
366                 return NULL;
367         }
368
369         /* allocate tailq entry */
370         te = rte_zmalloc("IPSEC_SAD_TAILQ_ENTRY", sizeof(*te), 0);
371         if (te == NULL) {
372                 rte_mcfg_tailq_write_unlock();
373                 rte_errno = ENOMEM;
374                 rte_ipsec_sad_destroy(sad);
375                 return NULL;
376         }
377
378         te->data = (void *)sad;
379         TAILQ_INSERT_TAIL(sad_list, te, next);
380         rte_mcfg_tailq_write_unlock();
381         return sad;
382 }
383
384 struct rte_ipsec_sad *
385 rte_ipsec_sad_find_existing(const char *name)
386 {
387         char sad_name[RTE_IPSEC_SAD_NAMESIZE];
388         struct rte_ipsec_sad *sad = NULL;
389         struct rte_tailq_entry *te;
390         struct rte_ipsec_sad_list *sad_list;
391         int ret;
392
393         ret = snprintf(sad_name, RTE_IPSEC_SAD_NAMESIZE, SAD_FORMAT, name);
394         if (ret < 0 || ret >= RTE_IPSEC_SAD_NAMESIZE) {
395                 rte_errno = ENAMETOOLONG;
396                 return NULL;
397         }
398
399         sad_list = RTE_TAILQ_CAST(rte_ipsec_sad_tailq.head,
400                 rte_ipsec_sad_list);
401
402         rte_mcfg_tailq_read_lock();
403         TAILQ_FOREACH(te, sad_list, next) {
404                 sad = (struct rte_ipsec_sad *) te->data;
405                 if (strncmp(sad_name, sad->name, RTE_IPSEC_SAD_NAMESIZE) == 0)
406                         break;
407         }
408         rte_mcfg_tailq_read_unlock();
409
410         if (te == NULL) {
411                 rte_errno = ENOENT;
412                 return NULL;
413         }
414
415         return sad;
416 }
417
418 void
419 rte_ipsec_sad_destroy(struct rte_ipsec_sad *sad)
420 {
421         struct rte_tailq_entry *te;
422         struct rte_ipsec_sad_list *sad_list;
423
424         if (sad == NULL)
425                 return;
426
427         sad_list = RTE_TAILQ_CAST(rte_ipsec_sad_tailq.head,
428                         rte_ipsec_sad_list);
429         rte_mcfg_tailq_write_lock();
430         TAILQ_FOREACH(te, sad_list, next) {
431                 if (te->data == (void *)sad)
432                         break;
433         }
434         if (te != NULL)
435                 TAILQ_REMOVE(sad_list, te, next);
436
437         rte_mcfg_tailq_write_unlock();
438
439         rte_hash_free(sad->hash[RTE_IPSEC_SAD_SPI_ONLY]);
440         rte_hash_free(sad->hash[RTE_IPSEC_SAD_SPI_DIP]);
441         rte_hash_free(sad->hash[RTE_IPSEC_SAD_SPI_DIP_SIP]);
442         rte_free(sad);
443         if (te != NULL)
444                 rte_free(te);
445 }
446
447 /*
448  * @internal helper function
449  * Lookup a batch of keys in three hash tables.
450  * First lookup key in SPI_ONLY table.
451  * If there is an entry for the corresponding SPI check its value.
452  * Two least significant bits of the value indicate
453  * the presence of more specific rule in other tables.
454  * Perform additional lookup in corresponding hash tables
455  * and update the value if lookup succeeded.
456  */
457 static int
458 __ipsec_sad_lookup(const struct rte_ipsec_sad *sad,
459                 const union rte_ipsec_sad_key *keys[], void *sa[], uint32_t n)
460 {
461         const void *keys_2[RTE_HASH_LOOKUP_BULK_MAX];
462         const void *keys_3[RTE_HASH_LOOKUP_BULK_MAX];
463         void *vals_2[RTE_HASH_LOOKUP_BULK_MAX] = {NULL};
464         void *vals_3[RTE_HASH_LOOKUP_BULK_MAX] = {NULL};
465         uint32_t idx_2[RTE_HASH_LOOKUP_BULK_MAX];
466         uint32_t idx_3[RTE_HASH_LOOKUP_BULK_MAX];
467         uint64_t mask_1, mask_2, mask_3;
468         uint64_t map, map_spec;
469         uint32_t n_2 = 0;
470         uint32_t n_3 = 0;
471         uint32_t i;
472         int found = 0;
473         hash_sig_t hash_sig[RTE_HASH_LOOKUP_BULK_MAX];
474         hash_sig_t hash_sig_2[RTE_HASH_LOOKUP_BULK_MAX];
475         hash_sig_t hash_sig_3[RTE_HASH_LOOKUP_BULK_MAX];
476
477         for (i = 0; i < n; i++) {
478                 sa[i] = NULL;
479                 hash_sig[i] = rte_hash_crc_4byte(keys[i]->v4.spi,
480                         sad->init_val);
481         }
482
483         /*
484          * Lookup keys in SPI only hash table first.
485          */
486         rte_hash_lookup_with_hash_bulk_data(sad->hash[RTE_IPSEC_SAD_SPI_ONLY],
487                 (const void **)keys, hash_sig, n, &mask_1, sa);
488         for (map = mask_1; map; map &= (map - 1)) {
489                 i = rte_bsf64(map);
490                 /*
491                  * if returned value indicates presence of a rule in other
492                  * tables save a key for further lookup.
493                  */
494                 if ((uintptr_t)sa[i] & RTE_IPSEC_SAD_SPI_DIP_SIP) {
495                         idx_3[n_3] = i;
496                         hash_sig_3[n_3] = rte_hash_crc(keys[i],
497                                 sad->keysize[RTE_IPSEC_SAD_SPI_DIP_SIP],
498                                 sad->init_val);
499                         keys_3[n_3++] = keys[i];
500                 }
501                 if ((uintptr_t)sa[i] & RTE_IPSEC_SAD_SPI_DIP) {
502                         idx_2[n_2] = i;
503                         hash_sig_2[n_2] = rte_hash_crc(keys[i],
504                                 sad->keysize[RTE_IPSEC_SAD_SPI_DIP],
505                                 sad->init_val);
506                         keys_2[n_2++] = keys[i];
507                 }
508                 /* clear 2 LSB's which indicate the presence
509                  * of more specific rules
510                  */
511                 sa[i] = CLEAR_BIT(sa[i], RTE_IPSEC_SAD_KEY_TYPE_MASK);
512         }
513
514         /* Lookup for more specific rules in SPI_DIP table */
515         if (n_2 != 0) {
516                 rte_hash_lookup_with_hash_bulk_data(
517                         sad->hash[RTE_IPSEC_SAD_SPI_DIP],
518                         keys_2, hash_sig_2, n_2, &mask_2, vals_2);
519                 for (map_spec = mask_2; map_spec; map_spec &= (map_spec - 1)) {
520                         i = rte_bsf64(map_spec);
521                         sa[idx_2[i]] = vals_2[i];
522                 }
523         }
524         /* Lookup for more specific rules in SPI_DIP_SIP table */
525         if (n_3 != 0) {
526                 rte_hash_lookup_with_hash_bulk_data(
527                         sad->hash[RTE_IPSEC_SAD_SPI_DIP_SIP],
528                         keys_3, hash_sig_3, n_3, &mask_3, vals_3);
529                 for (map_spec = mask_3; map_spec; map_spec &= (map_spec - 1)) {
530                         i = rte_bsf64(map_spec);
531                         sa[idx_3[i]] = vals_3[i];
532                 }
533         }
534
535         for (i = 0; i < n; i++)
536                 found += (sa[i] != NULL);
537
538         return found;
539 }
540
541 int
542 rte_ipsec_sad_lookup(const struct rte_ipsec_sad *sad,
543                 const union rte_ipsec_sad_key *keys[], void *sa[], uint32_t n)
544 {
545         uint32_t num, i = 0;
546         int found = 0;
547
548         if (unlikely((sad == NULL) || (keys == NULL) || (sa == NULL)))
549                 return -EINVAL;
550
551         do {
552                 num = RTE_MIN(n - i, (uint32_t)RTE_HASH_LOOKUP_BULK_MAX);
553                 found += __ipsec_sad_lookup(sad,
554                         &keys[i], &sa[i], num);
555                 i += num;
556         } while (i != n);
557
558         return found;
559 }