examples/ipsec-secgw: handle ESN soft limit event

[dpdk.git] / examples / ipsec-secgw / ipsec.c

diff --git a/examples/ipsec-secgw/ipsec.c b/examples/ipsec-secgw/ipsec.c
index 05e89a1..acdd189 100644 (file)
--- a/examples/ipsec-secgw/ipsec.c
+++ b/examples/ipsec-secgw/ipsec.c
@@ -36,6 +36,7 @@ set_ipsec_conf(struct ipsec_sa *sa, struct rte_security_ipsec_xform *ipsec)
                }
                /* TODO support for Transport and IPV6 tunnel */
        }
+       ipsec->esn_soft_limit = IPSEC_OFFLOAD_ESN_SOFTLIMIT;
 }
 
 static inline int
@@ -166,7 +167,7 @@ create_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa)
                        sa->pattern[2].type = RTE_FLOW_ITEM_TYPE_ESP;
                        sa->pattern[2].spec = &sa->esp_spec;
                        sa->pattern[2].mask = &rte_flow_item_esp_mask;
-                       sa->esp_spec.hdr.spi = sa->spi;
+                       sa->esp_spec.hdr.spi = rte_cpu_to_be_32(sa->spi);
 
                        sa->pattern[3].type = RTE_FLOW_ITEM_TYPE_END;
 
@@ -221,6 +222,12 @@ create_session(struct ipsec_ctx *ipsec_ctx, struct ipsec_sa *sa)
                                        &(struct rte_flow_action_queue){
                                        .index = 0,
                                };
+                               ret = rte_flow_validate(sa->portid, &sa->attr,
+                                                       sa->pattern, sa->action,
+                                                       &err);
+                               /* Try End. */
+                               sa->action[1].type = RTE_FLOW_ACTION_TYPE_END;
+                               sa->action[1].conf = NULL;
                                ret = rte_flow_validate(sa->portid, &sa->attr,
                                                        sa->pattern, sa->action,
                                                        &err);
@@ -264,11 +271,14 @@ flow_create_failure:
                         * the packet is received, this userdata will be
                         * retrieved using the metadata from the packet.
                         *
-                        * This is required only for inbound SAs.
+                        * The PMD is expected to set similar metadata for other
+                        * operations, like rte_eth_event, which are tied to
+                        * security session. In such cases, the userdata could
+                        * be obtained to uniquely identify the security
+                        * parameters denoted.
                         */
 
-                       if (sa->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
-                               sess_conf.userdata = (void *) sa;
+                       sess_conf.userdata = (void *) sa;
 
                        sa->sec_session = rte_security_session_create(ctx,
                                        &sess_conf, ipsec_ctx->session_pool);
@@ -368,7 +378,6 @@ ipsec_enqueue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx,
        struct ipsec_mbuf_metadata *priv;
        struct rte_crypto_sym_op *sym_cop;
        struct ipsec_sa *sa;
-       struct cdev_qp *cqp;
 
        for (i = 0; i < nb_pkts; i++) {
                if (unlikely(sas[i] == NULL)) {
@@ -431,8 +440,7 @@ ipsec_enqueue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx,
                                continue;
                        }
 
-                       cqp = &ipsec_ctx->tbl[sa->cdev_id_qp];
-                       cqp->ol_pkts[cqp->ol_pkts_cnt++] = pkts[i];
+                       ipsec_ctx->ol_pkts[ipsec_ctx->ol_pkts_cnt++] = pkts[i];
                        if (sa->ol_flags & RTE_SECURITY_TX_OLOAD_NEED_MDATA)
                                rte_security_set_pkt_metadata(
                                                sa->security_ctx,
@@ -459,8 +467,7 @@ ipsec_enqueue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx,
                                continue;
                        }
 
-                       cqp = &ipsec_ctx->tbl[sa->cdev_id_qp];
-                       cqp->ol_pkts[cqp->ol_pkts_cnt++] = pkts[i];
+                       ipsec_ctx->ol_pkts[ipsec_ctx->ol_pkts_cnt++] = pkts[i];
                        if (sa->ol_flags & RTE_SECURITY_TX_OLOAD_NEED_MDATA)
                                rte_security_set_pkt_metadata(
                                                sa->security_ctx,
@@ -485,11 +492,10 @@ ipsec_dequeue(ipsec_xform_fn xform_func, struct ipsec_ctx *ipsec_ctx,
 
        for (i = 0; i < ipsec_ctx->nb_qps && nb_pkts < max_pkts;) {
                struct cdev_qp *cqp;
-
                cqp = &ipsec_ctx->tbl[ipsec_ctx->last_qp];
 
-               while (cqp->ol_pkts_cnt > 0 && nb_pkts < max_pkts) {
-                       pkt = cqp->ol_pkts[--cqp->ol_pkts_cnt];
+               while (ipsec_ctx->ol_pkts_cnt > 0 && nb_pkts < max_pkts) {
+                       pkt = ipsec_ctx->ol_pkts[--ipsec_ctx->ol_pkts_cnt];
                        rte_prefetch0(pkt);
                        priv = get_priv(pkt);
                        sa = priv->sa;