/* SPDX-License-Identifier: BSD-3-Clause
- * Copyright 2017 NXP.
- * Copyright(c) 2017 Intel Corporation.
+ * Copyright 2017,2019 NXP
+ * Copyright(c) 2017-2020 Intel Corporation.
*/
#ifndef _RTE_SECURITY_H_
/**< Tunnel parameters, NULL for transport mode */
uint64_t esn_soft_limit;
/**< ESN for which the overflow event need to be raised */
+ uint32_t replay_win_sz;
+ /**< Anti replay window size to enable sequence replay attack handling.
+ * replay checking is disabled if the window size is 0.
+ */
};
/**
uint32_t hfn;
/** HFN Threshold for key renegotiation */
uint32_t hfn_threshold;
+ /** HFN can be given as a per packet value also.
+ * As we do not have IV in case of PDCP, and HFN is
+ * used to generate IV. IV field can be used to get the
+ * per packet HFN while enq/deq.
+ * If hfn_ovrd field is set, user is expected to set the
+ * per packet HFN in place of IV. PMDs will extract the HFN
+ * and perform operations accordingly.
+ */
+ uint32_t hfn_ovrd;
+};
+
+/** DOCSIS direction */
+enum rte_security_docsis_direction {
+ RTE_SECURITY_DOCSIS_UPLINK,
+ /**< Uplink
+ * - Decryption, followed by CRC Verification
+ */
+ RTE_SECURITY_DOCSIS_DOWNLINK,
+ /**< Downlink
+ * - CRC Generation, followed by Encryption
+ */
+};
+
+/**
+ * DOCSIS security session configuration.
+ *
+ * This structure contains data required to create a DOCSIS security session.
+ */
+struct rte_security_docsis_xform {
+ enum rte_security_docsis_direction direction;
+ /**< DOCSIS direction */
};
/**
/**< All security protocol processing is performed inline during
* transmission
*/
- RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL
+ RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL,
/**< All security protocol processing including crypto is performed
* on a lookaside accelerator
*/
+ RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO
+ /**< Similar to ACTION_TYPE_NONE but crypto processing for security
+ * protocol is processed synchronously by a CPU.
+ */
};
/** Security session protocol definition */
/**< MACSec Protocol */
RTE_SECURITY_PROTOCOL_PDCP,
/**< PDCP Protocol */
+ RTE_SECURITY_PROTOCOL_DOCSIS,
+ /**< DOCSIS Protocol */
};
/**
struct rte_security_ipsec_xform ipsec;
struct rte_security_macsec_xform macsec;
struct rte_security_pdcp_xform pdcp;
+ struct rte_security_docsis_xform docsis;
};
/**< Configuration parameters for security session */
struct rte_crypto_sym_xform *crypto_xform;
* @param conf update configuration parameters
* @return
* - On success returns 0
- * - On failure return errno
+ * - On failure returns a negative errno value.
*/
__rte_experimental
int
* return it to its original mempool.
*
* @param instance security instance
- * @param sess security session to freed
+ * @param sess security session to be freed
*
* @return
* - 0 if successful.
- * - -EINVAL if session is NULL.
+ * - -EINVAL if session or context instance is NULL.
* - -EBUSY if not all device private data has been freed.
+ * - -ENOTSUP if destroying private data is not supported.
+ * - other negative values in case of freeing private data errors.
*/
int
rte_security_session_destroy(struct rte_security_ctx *instance,
uint64_t reserved;
};
+struct rte_security_docsis_stats {
+ uint64_t reserved;
+};
+
struct rte_security_stats {
enum rte_security_session_protocol protocol;
/**< Security protocol to be configured */
struct rte_security_macsec_stats macsec;
struct rte_security_ipsec_stats ipsec;
struct rte_security_pdcp_stats pdcp;
+ struct rte_security_docsis_stats docsis;
};
};
/**< IPsec SA direction */
struct rte_security_ipsec_sa_options options;
/**< IPsec SA supported options */
+ uint32_t replay_win_sz_max;
+ /**< IPsec Anti Replay Window Size. A '0' value
+ * indicates that Anti Replay is not supported.
+ */
} ipsec;
/**< IPsec capability */
struct {
/**< Capability flags, see RTE_SECURITY_PDCP_* */
} pdcp;
/**< PDCP capability */
+ struct {
+ enum rte_security_docsis_direction direction;
+ /**< DOCSIS direction */
+ } docsis;
+ /**< DOCSIS capability */
};
const struct rte_cryptodev_capabilities *crypto_capabilities;
enum rte_security_pdcp_domain domain;
uint32_t capa_flags;
} pdcp;
+ struct {
+ enum rte_security_docsis_direction direction;
+ } docsis;
};
};