security: extend userdata for IPsec events

[dpdk.git] / lib / librte_security / rte_security.h

diff --git a/lib/librte_security/rte_security.h b/lib/librte_security/rte_security.h
index 004a0eb..afa2861 100644 (file)
--- a/lib/librte_security/rte_security.h
+++ b/lib/librte_security/rte_security.h
@@ -52,6 +52,7 @@ extern "C" {
 #include <netinet/ip.h>
 #include <netinet/ip6.h>
 
+#include <rte_compat.h>
 #include <rte_common.h>
 #include <rte_crypto.h>
 #include <rte_mbuf.h>
@@ -221,6 +222,8 @@ struct rte_security_ipsec_xform {
        /**< IPsec SA Mode - transport/tunnel */
        struct rte_security_ipsec_tunnel_param tunnel;
        /**< Tunnel parameters, NULL for transport mode */
+       uint64_t esn_soft_limit;
+       /**< ESN for which the overflow event need to be raised */
 };
 
 /**
@@ -294,7 +297,7 @@ struct rte_security_session {
  *  - On success, pointer to session
  *  - On failure, NULL
  */
-struct rte_security_session *
+struct rte_security_session * __rte_experimental
 rte_security_session_create(struct rte_security_ctx *instance,
                            struct rte_security_session_conf *conf,
                            struct rte_mempool *mp);
@@ -309,11 +312,23 @@ rte_security_session_create(struct rte_security_ctx *instance,
  *  - On success returns 0
  *  - On failure return errno
  */
-int
+int __rte_experimental
 rte_security_session_update(struct rte_security_ctx *instance,
                            struct rte_security_session *sess,
                            struct rte_security_session_conf *conf);
 
+/**
+ * Get the size of the security session data for a device.
+ *
+ * @param   instance   security instance.
+ *
+ * @return
+ *   - Size of the private data, if successful
+ *   - 0 if device is invalid or does not support the operation.
+ */
+unsigned int __rte_experimental
+rte_security_session_get_size(struct rte_security_ctx *instance);
+
 /**
  * Free security session header and the session private data and
  * return it to its original mempool.
@@ -326,7 +341,7 @@ rte_security_session_update(struct rte_security_ctx *instance,
  *  - -EINVAL if session is NULL.
  *  - -EBUSY if not all device private data has been freed.
  */
-int
+int __rte_experimental
 rte_security_session_destroy(struct rte_security_ctx *instance,
                             struct rte_security_session *sess);
 
@@ -343,27 +358,29 @@ rte_security_session_destroy(struct rte_security_ctx *instance,
  *  - On success, zero.
  *  - On failure, a negative value.
  */
-int
+int __rte_experimental
 rte_security_set_pkt_metadata(struct rte_security_ctx *instance,
                              struct rte_security_session *sess,
                              struct rte_mbuf *mb, void *params);
 
 /**
- * Get userdata associated with the security session which processed the
- * packet. This userdata would be registered while creating the session, and
- * application can use this to identify the SA etc. Device-specific metadata
- * in the mbuf would be used for this.
+ * Get userdata associated with the security session. Device specific metadata
+ * provided would be used to uniquely identify the security session being
+ * referred to. This userdata would be registered while creating the session,
+ * and application can use this to identify the SA etc.
  *
- * This is valid only for inline processed ingress packets.
+ * Device specific metadata would be set in mbuf for inline processed inbound
+ * packets. In addition, the same metadata would be set for IPsec events
+ * reported by rte_eth_event framework.
  *
  * @param   instance   security instance
- * @param   md         device-specific metadata set in mbuf
+ * @param   md         device-specific metadata
  *
  * @return
  *  - On success, userdata
  *  - On failure, NULL
  */
-void *
+void * __rte_experimental
 rte_security_get_userdata(struct rte_security_ctx *instance, uint64_t md);
 
 /**
@@ -372,7 +389,7 @@ rte_security_get_userdata(struct rte_security_ctx *instance, uint64_t md);
  * @param      sym_op  crypto operation
  * @param      sess    security session
  */
-static inline int
+static inline int __rte_experimental
 __rte_security_attach_session(struct rte_crypto_sym_op *sym_op,
                              struct rte_security_session *sess)
 {
@@ -381,13 +398,13 @@ __rte_security_attach_session(struct rte_crypto_sym_op *sym_op,
        return 0;
 }
 
-static inline void *
+static inline void * __rte_experimental
 get_sec_session_private_data(const struct rte_security_session *sess)
 {
        return sess->sess_private_data;
 }
 
-static inline void
+static inline void __rte_experimental
 set_sec_session_private_data(struct rte_security_session *sess,
                             void *private_data)
 {
@@ -403,7 +420,7 @@ set_sec_session_private_data(struct rte_security_session *sess,
  * @param      op      crypto operation
  * @param      sess    security session
  */
-static inline int
+static inline int __rte_experimental
 rte_security_attach_session(struct rte_crypto_op *op,
                            struct rte_security_session *sess)
 {
@@ -445,7 +462,7 @@ struct rte_security_stats {
  *  - On success return 0
  *  - On failure errno
  */
-int
+int __rte_experimental
 rte_security_session_stats_get(struct rte_security_ctx *instance,
                               struct rte_security_session *sess,
                               struct rte_security_stats *stats);
@@ -529,7 +546,7 @@ struct rte_security_capability_idx {
  *   - Returns array of security capabilities.
  *   - Return NULL if no capabilities available.
  */
-const struct rte_security_capability *
+const struct rte_security_capability * __rte_experimental
 rte_security_capabilities_get(struct rte_security_ctx *instance);
 
 /**
@@ -543,7 +560,7 @@ rte_security_capabilities_get(struct rte_security_ctx *instance);
  *     index criteria.
  *   - Return NULL if the capability not matched on security instance.
  */
-const struct rte_security_capability *
+const struct rte_security_capability * __rte_experimental
 rte_security_capability_get(struct rte_security_ctx *instance,
                            struct rte_security_capability_idx *idx);