X-Git-Url: http://git.droids-corp.org/?a=blobdiff_plain;f=examples%2Fipsec-secgw%2Fsa.c;h=e75b687c464105651dbe1d2c976d6cf2626a0697;hb=2df00d562d20;hp=5a9c960478f849510c23ea69a33d1643acca44e1;hpb=e1143d7dbbf484837f3eefb077a9b0af0f7e1c45;p=dpdk.git

diff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c
index 5a9c960478..e75b687c46 100644
--- a/examples/ipsec-secgw/sa.c
+++ b/examples/ipsec-secgw/sa.c
@@ -1,5 +1,5 @@
 /* SPDX-License-Identifier: BSD-3-Clause
- * Copyright(c) 2016-2017 Intel Corporation
+ * Copyright(c) 2016-2020 Intel Corporation
  */
 
 /*
@@ -617,6 +617,8 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens,
 				RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL;
 			else if (strcmp(tokens[ti], "no-offload") == 0)
 				ips->type = RTE_SECURITY_ACTION_TYPE_NONE;
+			else if (strcmp(tokens[ti], "cpu-crypto") == 0)
+				ips->type = RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO;
 			else {
 				APP_CHECK(0, status, "Invalid input \"%s\"",
 						tokens[ti]);
@@ -710,10 +712,12 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens,
 	if (status->status < 0)
 		return;
 
-	if ((ips->type != RTE_SECURITY_ACTION_TYPE_NONE) && (portid_p == 0))
+	if ((ips->type != RTE_SECURITY_ACTION_TYPE_NONE && ips->type !=
+			RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO) && (portid_p == 0))
 		printf("Missing portid option, falling back to non-offload\n");
 
-	if (!type_p || !portid_p) {
+	if (!type_p || (!portid_p && ips->type !=
+			RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO)) {
 		ips->type = RTE_SECURITY_ACTION_TYPE_NONE;
 		rule->portid = -1;
 	}
@@ -799,15 +803,25 @@ print_one_sa_rule(const struct ipsec_sa *sa, int inbound)
 	case RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL:
 		printf("lookaside-protocol-offload ");
 		break;
+	case RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO:
+		printf("cpu-crypto-accelerated");
+		break;
 	}
 
 	fallback_ips = &sa->sessions[IPSEC_SESSION_FALLBACK];
 	if (fallback_ips != NULL && sa->fallback_sessions > 0) {
 		printf("inline fallback: ");
-		if (fallback_ips->type == RTE_SECURITY_ACTION_TYPE_NONE)
+		switch (fallback_ips->type) {
+		case RTE_SECURITY_ACTION_TYPE_NONE:
 			printf("lookaside-none");
-		else
+			break;
+		case RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO:
+			printf("cpu-crypto-accelerated");
+			break;
+		default:
 			printf("invalid");
+			break;
+		}
 	}
 	printf("\n");
 }
@@ -848,7 +862,7 @@ sa_create(const char *name, int32_t socket_id, uint32_t nb_sa)
 		return NULL;
 	}
 
-	sa_ctx = rte_malloc(NULL, sizeof(struct sa_ctx) +
+	sa_ctx = rte_zmalloc(NULL, sizeof(struct sa_ctx) +
 		sizeof(struct ipsec_sa) * nb_sa, RTE_CACHE_LINE_SIZE);
 
 	if (sa_ctx == NULL) {
@@ -1026,7 +1040,6 @@ sa_add_rules(struct sa_ctx *sa_ctx, const struct ipsec_sa entries[],
 				return -EINVAL;
 		}
 
-
 		switch (WITHOUT_TRANSPORT_VERSION(sa->flags)) {
 		case IP4_TUNNEL:
 			sa->src.ip.ip4 = rte_cpu_to_be_32(sa->src.ip.ip4);
@@ -1077,7 +1090,6 @@ sa_add_rules(struct sa_ctx *sa_ctx, const struct ipsec_sa entries[],
 					return -EINVAL;
 				}
 			}
-			print_one_sa_rule(sa, inbound);
 		} else {
 			switch (sa->cipher_algo) {
 			case RTE_CRYPTO_CIPHER_NULL:
@@ -1142,9 +1154,9 @@ sa_add_rules(struct sa_ctx *sa_ctx, const struct ipsec_sa entries[],
 			sa_ctx->xf[idx].a.next = &sa_ctx->xf[idx].b;
 			sa_ctx->xf[idx].b.next = NULL;
 			sa->xforms = &sa_ctx->xf[idx].a;
-
-			print_one_sa_rule(sa, inbound);
 		}
+
+		print_one_sa_rule(sa, inbound);
 	}
 
 	return 0;
@@ -1460,9 +1472,6 @@ inbound_sa_lookup(struct sa_ctx *sa_ctx, struct rte_mbuf *pkts[],
 		void *sa_arr[], uint16_t nb_pkts)
 {
 	uint32_t i;
-	struct ip *ip;
-	uint32_t *src4_addr;
-	uint8_t *src6_addr;
 	void *result_sa;
 	struct ipsec_sa *sa;
 
@@ -1488,32 +1497,7 @@ inbound_sa_lookup(struct sa_ctx *sa_ctx, struct rte_mbuf *pkts[],
 			intsa |= IPSEC_SA_OFFLOAD_FALLBACK_FLAG;
 			result_sa = (void *)intsa;
 		}
-
-		ip = rte_pktmbuf_mtod(pkts[i], struct ip *);
-		switch (WITHOUT_TRANSPORT_VERSION(sa->flags)) {
-		case IP4_TUNNEL:
-			src4_addr = RTE_PTR_ADD(ip,
-				offsetof(struct ip, ip_src));
-			if ((ip->ip_v == IPVERSION) &&
-					(sa->src.ip.ip4 == *src4_addr) &&
-					(sa->dst.ip.ip4 == *(src4_addr + 1)))
-				sa_arr[i] = result_sa;
-			else
-				sa_arr[i] = NULL;
-			break;
-		case IP6_TUNNEL:
-			src6_addr = RTE_PTR_ADD(ip,
-				offsetof(struct ip6_hdr, ip6_src));
-			if ((ip->ip_v == IP6_VERSION) &&
-				!memcmp(&sa->src.ip.ip6.ip6, src6_addr, 16) &&
-				!memcmp(&sa->dst.ip.ip6.ip6, src6_addr + 16, 16))
-				sa_arr[i] = result_sa;
-			else
-				sa_arr[i] = NULL;
-			break;
-		case TRANSPORT:
-			sa_arr[i] = result_sa;
-		}
+		sa_arr[i] = result_sa;
 	}
 }