examples/ipsec-secgw: add event mode
authorLukasz Bartosik <lbartosik@marvell.com>
Thu, 27 Feb 2020 16:18:32 +0000 (17:18 +0100)
committerAkhil Goyal <akhil.goyal@oss.nxp.com>
Sun, 5 Apr 2020 16:26:04 +0000 (18:26 +0200)
Add eventmode support to ipsec-secgw. With the aid of event helper
configure and use the eventmode capabilities.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
Signed-off-by: Lukasz Bartosik <lbartosik@marvell.com>
Acked-by: Konstantin Ananyev <konstantin.ananyev@intel.com>
Acked-by: Akhil Goyal <akhil.goyal@nxp.com>
examples/ipsec-secgw/event_helper.c
examples/ipsec-secgw/event_helper.h
examples/ipsec-secgw/ipsec-secgw.c
examples/ipsec-secgw/ipsec.h
examples/ipsec-secgw/sa.c
examples/ipsec-secgw/sad.h

index 0854fc2..076f1f2 100644 (file)
@@ -960,6 +960,8 @@ eh_find_worker(uint32_t lcore_id, struct eh_conf *conf,
        else
                curr_conf.cap.burst = EH_RX_TYPE_NON_BURST;
 
+       curr_conf.cap.ipsec_mode = conf->ipsec_mode;
+
        /* Parse the passed list and see if we have matching capabilities */
 
        /* Initialize the pointer used to traverse the list */
@@ -1400,6 +1402,7 @@ eh_conf_init(void)
 
        /* Packet transfer mode: poll */
        conf->mode = EH_PKT_TRANSFER_MODE_POLL;
+       conf->ipsec_mode = EH_IPSEC_MODE_TYPE_APP;
 
        /* Keep all ethernet ports enabled by default */
        conf->eth_portmask = -1;
index e17cab1..b65b343 100644 (file)
@@ -73,6 +73,14 @@ enum eh_tx_types {
        EH_TX_TYPE_NO_INTERNAL_PORT
 };
 
+/**
+ * Event mode ipsec mode types
+ */
+enum eh_ipsec_mode_types {
+       EH_IPSEC_MODE_TYPE_APP = 0,
+       EH_IPSEC_MODE_TYPE_DRIVER
+};
+
 /* Event dev params */
 struct eventdev_params {
        uint8_t eventdev_id;
@@ -182,6 +190,10 @@ struct eh_conf {
                 */
        void *mode_params;
                /**< Mode specific parameters */
+
+               /** Application specific params */
+       enum eh_ipsec_mode_types ipsec_mode;
+               /**< Mode of ipsec run */
 };
 
 /* Workers registered by the application */
@@ -193,6 +205,8 @@ struct eh_app_worker_params {
                        /**< Specify status of rx type burst */
                        uint64_t tx_internal_port : 1;
                        /**< Specify whether tx internal port is available */
+                       uint64_t ipsec_mode : 1;
+                       /**< Specify ipsec processing level */
                };
                uint64_t u64;
        } cap;
index e1ee7c3..ad16606 100644 (file)
@@ -2,6 +2,7 @@
  * Copyright(c) 2016 Intel Corporation
  */
 
+#include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <stdint.h>
 #include <sys/queue.h>
 #include <stdarg.h>
 #include <errno.h>
+#include <signal.h>
 #include <getopt.h>
 
 #include <rte_common.h>
+#include <rte_bitmap.h>
 #include <rte_byteorder.h>
 #include <rte_log.h>
 #include <rte_eal.h>
 #include <rte_jhash.h>
 #include <rte_cryptodev.h>
 #include <rte_security.h>
+#include <rte_eventdev.h>
 #include <rte_ip.h>
 #include <rte_ip_frag.h>
 
+#include "event_helper.h"
 #include "ipsec.h"
 #include "parser.h"
 #include "sad.h"
 
+volatile bool force_quit;
+
 #define RTE_LOGTYPE_IPSEC RTE_LOGTYPE_USER1
 
 #define MAX_JUMBO_PKT_LEN  9600
@@ -134,12 +141,20 @@ struct flow_info flow_info_tbl[RTE_MAX_ETHPORTS];
 #define CMD_LINE_OPT_CONFIG            "config"
 #define CMD_LINE_OPT_SINGLE_SA         "single-sa"
 #define CMD_LINE_OPT_CRYPTODEV_MASK    "cryptodev_mask"
+#define CMD_LINE_OPT_TRANSFER_MODE     "transfer-mode"
+#define CMD_LINE_OPT_SCHEDULE_TYPE     "event-schedule-type"
 #define CMD_LINE_OPT_RX_OFFLOAD                "rxoffload"
 #define CMD_LINE_OPT_TX_OFFLOAD                "txoffload"
 #define CMD_LINE_OPT_REASSEMBLE                "reassemble"
 #define CMD_LINE_OPT_MTU               "mtu"
 #define CMD_LINE_OPT_FRAG_TTL          "frag-ttl"
 
+#define CMD_LINE_ARG_EVENT     "event"
+#define CMD_LINE_ARG_POLL      "poll"
+#define CMD_LINE_ARG_ORDERED   "ordered"
+#define CMD_LINE_ARG_ATOMIC    "atomic"
+#define CMD_LINE_ARG_PARALLEL  "parallel"
+
 enum {
        /* long options mapped to a short option */
 
@@ -150,6 +165,8 @@ enum {
        CMD_LINE_OPT_CONFIG_NUM,
        CMD_LINE_OPT_SINGLE_SA_NUM,
        CMD_LINE_OPT_CRYPTODEV_MASK_NUM,
+       CMD_LINE_OPT_TRANSFER_MODE_NUM,
+       CMD_LINE_OPT_SCHEDULE_TYPE_NUM,
        CMD_LINE_OPT_RX_OFFLOAD_NUM,
        CMD_LINE_OPT_TX_OFFLOAD_NUM,
        CMD_LINE_OPT_REASSEMBLE_NUM,
@@ -161,6 +178,8 @@ static const struct option lgopts[] = {
        {CMD_LINE_OPT_CONFIG, 1, 0, CMD_LINE_OPT_CONFIG_NUM},
        {CMD_LINE_OPT_SINGLE_SA, 1, 0, CMD_LINE_OPT_SINGLE_SA_NUM},
        {CMD_LINE_OPT_CRYPTODEV_MASK, 1, 0, CMD_LINE_OPT_CRYPTODEV_MASK_NUM},
+       {CMD_LINE_OPT_TRANSFER_MODE, 1, 0, CMD_LINE_OPT_TRANSFER_MODE_NUM},
+       {CMD_LINE_OPT_SCHEDULE_TYPE, 1, 0, CMD_LINE_OPT_SCHEDULE_TYPE_NUM},
        {CMD_LINE_OPT_RX_OFFLOAD, 1, 0, CMD_LINE_OPT_RX_OFFLOAD_NUM},
        {CMD_LINE_OPT_TX_OFFLOAD, 1, 0, CMD_LINE_OPT_TX_OFFLOAD_NUM},
        {CMD_LINE_OPT_REASSEMBLE, 1, 0, CMD_LINE_OPT_REASSEMBLE_NUM},
@@ -1199,13 +1218,19 @@ main_loop(__attribute__((unused)) void *dummy)
 }
 
 static int32_t
-check_params(void)
+check_poll_mode_params(struct eh_conf *eh_conf)
 {
        uint8_t lcore;
        uint16_t portid;
        uint16_t i;
        int32_t socket_id;
 
+       if (!eh_conf)
+               return -EINVAL;
+
+       if (eh_conf->mode != EH_PKT_TRANSFER_MODE_POLL)
+               return 0;
+
        if (lcore_params == NULL) {
                printf("Error: No port/queue/core mappings\n");
                return -1;
@@ -1292,6 +1317,8 @@ print_usage(const char *prgname)
                " --config (port,queue,lcore)[,(port,queue,lcore)]"
                " [--single-sa SAIDX]"
                " [--cryptodev_mask MASK]"
+               " [--transfer-mode MODE]"
+               " [--event-schedule-type TYPE]"
                " [--" CMD_LINE_OPT_RX_OFFLOAD " RX_OFFLOAD_MASK]"
                " [--" CMD_LINE_OPT_TX_OFFLOAD " TX_OFFLOAD_MASK]"
                " [--" CMD_LINE_OPT_REASSEMBLE " REASSEMBLE_TABLE_SIZE]"
@@ -1310,11 +1337,24 @@ print_usage(const char *prgname)
                "  -c specifies inbound SAD cache size,\n"
                "     zero value disables the cache (default value: 128)\n"
                "  -f CONFIG_FILE: Configuration file\n"
-               "  --config (port,queue,lcore): Rx queue configuration\n"
+               "  --config (port,queue,lcore): Rx queue configuration. In poll\n"
+               "                               mode determines which queues from\n"
+               "                               which ports are mapped to which cores.\n"
+               "                               In event mode this option is not used\n"
+               "                               as packets are dynamically scheduled\n"
+               "                               to cores by HW.\n"
                "  --single-sa SAIDX: Use single SA index for outbound traffic,\n"
                "                     bypassing the SP\n"
                "  --cryptodev_mask MASK: Hexadecimal bitmask of the crypto\n"
                "                         devices to configure\n"
+               "  --transfer-mode MODE\n"
+               "               \"poll\"  : Packet transfer via polling (default)\n"
+               "               \"event\" : Packet transfer via event device\n"
+               "  --event-schedule-type TYPE queue schedule type, used only when\n"
+               "                             transfer mode is set to event\n"
+               "               \"ordered\"  : Ordered (default)\n"
+               "               \"atomic\"   : Atomic\n"
+               "               \"parallel\" : Parallel\n"
                "  --" CMD_LINE_OPT_RX_OFFLOAD
                ": bitmask of the RX HW offload capabilities to enable/use\n"
                "                         (DEV_RX_OFFLOAD_*)\n"
@@ -1449,8 +1489,45 @@ print_app_sa_prm(const struct app_sa_prm *prm)
        printf("Frag TTL: %" PRIu64 " ns\n", frag_ttl_ns);
 }
 
+static int
+parse_transfer_mode(struct eh_conf *conf, const char *optarg)
+{
+       if (!strcmp(CMD_LINE_ARG_POLL, optarg))
+               conf->mode = EH_PKT_TRANSFER_MODE_POLL;
+       else if (!strcmp(CMD_LINE_ARG_EVENT, optarg))
+               conf->mode = EH_PKT_TRANSFER_MODE_EVENT;
+       else {
+               printf("Unsupported packet transfer mode\n");
+               return -EINVAL;
+       }
+
+       return 0;
+}
+
+static int
+parse_schedule_type(struct eh_conf *conf, const char *optarg)
+{
+       struct eventmode_conf *em_conf = NULL;
+
+       /* Get eventmode conf */
+       em_conf = conf->mode_params;
+
+       if (!strcmp(CMD_LINE_ARG_ORDERED, optarg))
+               em_conf->ext_params.sched_type = RTE_SCHED_TYPE_ORDERED;
+       else if (!strcmp(CMD_LINE_ARG_ATOMIC, optarg))
+               em_conf->ext_params.sched_type = RTE_SCHED_TYPE_ATOMIC;
+       else if (!strcmp(CMD_LINE_ARG_PARALLEL, optarg))
+               em_conf->ext_params.sched_type = RTE_SCHED_TYPE_PARALLEL;
+       else {
+               printf("Unsupported queue schedule type\n");
+               return -EINVAL;
+       }
+
+       return 0;
+}
+
 static int32_t
-parse_args(int32_t argc, char **argv)
+parse_args(int32_t argc, char **argv, struct eh_conf *eh_conf)
 {
        int opt;
        int64_t ret;
@@ -1548,6 +1625,7 @@ parse_args(int32_t argc, char **argv)
                        /* else */
                        single_sa = 1;
                        single_sa_idx = ret;
+                       eh_conf->ipsec_mode = EH_IPSEC_MODE_TYPE_DRIVER;
                        printf("Configured with single SA index %u\n",
                                        single_sa_idx);
                        break;
@@ -1562,6 +1640,25 @@ parse_args(int32_t argc, char **argv)
                        /* else */
                        enabled_cryptodev_mask = ret;
                        break;
+
+               case CMD_LINE_OPT_TRANSFER_MODE_NUM:
+                       ret = parse_transfer_mode(eh_conf, optarg);
+                       if (ret < 0) {
+                               printf("Invalid packet transfer mode\n");
+                               print_usage(prgname);
+                               return -1;
+                       }
+                       break;
+
+               case CMD_LINE_OPT_SCHEDULE_TYPE_NUM:
+                       ret = parse_schedule_type(eh_conf, optarg);
+                       if (ret < 0) {
+                               printf("Invalid queue schedule type\n");
+                               print_usage(prgname);
+                               return -1;
+                       }
+                       break;
+
                case CMD_LINE_OPT_RX_OFFLOAD_NUM:
                        ret = parse_mask(optarg, &dev_rx_offload);
                        if (ret != 0) {
@@ -2476,16 +2573,141 @@ create_default_ipsec_flow(uint16_t port_id, uint64_t rx_offloads)
                port_id);
 }
 
+static void
+signal_handler(int signum)
+{
+       if (signum == SIGINT || signum == SIGTERM) {
+               printf("\n\nSignal %d received, preparing to exit...\n",
+                               signum);
+               force_quit = true;
+       }
+}
+
+static void
+ev_mode_sess_verify(struct ipsec_sa *sa, int nb_sa)
+{
+       struct rte_ipsec_session *ips;
+       int32_t i;
+
+       if (!sa || !nb_sa)
+               return;
+
+       for (i = 0; i < nb_sa; i++) {
+               ips = ipsec_get_primary_session(&sa[i]);
+               if (ips->type != RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL)
+                       rte_exit(EXIT_FAILURE, "Event mode supports only "
+                                "inline protocol sessions\n");
+       }
+
+}
+
+static int32_t
+check_event_mode_params(struct eh_conf *eh_conf)
+{
+       struct eventmode_conf *em_conf = NULL;
+       struct lcore_params *params;
+       uint16_t portid;
+
+       if (!eh_conf || !eh_conf->mode_params)
+               return -EINVAL;
+
+       /* Get eventmode conf */
+       em_conf = eh_conf->mode_params;
+
+       if (eh_conf->mode == EH_PKT_TRANSFER_MODE_POLL &&
+           em_conf->ext_params.sched_type != SCHED_TYPE_NOT_SET) {
+               printf("error: option --event-schedule-type applies only to "
+                      "event mode\n");
+               return -EINVAL;
+       }
+
+       if (eh_conf->mode != EH_PKT_TRANSFER_MODE_EVENT)
+               return 0;
+
+       /* Set schedule type to ORDERED if it wasn't explicitly set by user */
+       if (em_conf->ext_params.sched_type == SCHED_TYPE_NOT_SET)
+               em_conf->ext_params.sched_type = RTE_SCHED_TYPE_ORDERED;
+
+       /*
+        * Event mode currently supports only inline protocol sessions.
+        * If there are other types of sessions configured then exit with
+        * error.
+        */
+       ev_mode_sess_verify(sa_in, nb_sa_in);
+       ev_mode_sess_verify(sa_out, nb_sa_out);
+
+
+       /* Option --config does not apply to event mode */
+       if (nb_lcore_params > 0) {
+               printf("error: option --config applies only to poll mode\n");
+               return -EINVAL;
+       }
+
+       /*
+        * In order to use the same port_init routine for both poll and event
+        * modes initialize lcore_params with one queue for each eth port
+        */
+       lcore_params = lcore_params_array;
+       RTE_ETH_FOREACH_DEV(portid) {
+               if ((enabled_port_mask & (1 << portid)) == 0)
+                       continue;
+
+               params = &lcore_params[nb_lcore_params++];
+               params->port_id = portid;
+               params->queue_id = 0;
+               params->lcore_id = rte_get_next_lcore(0, 0, 1);
+       }
+
+       return 0;
+}
+
+static void
+inline_sessions_free(struct sa_ctx *sa_ctx)
+{
+       struct rte_ipsec_session *ips;
+       struct ipsec_sa *sa;
+       int32_t ret;
+       uint32_t i;
+
+       if (!sa_ctx)
+               return;
+
+       for (i = 0; i < sa_ctx->nb_sa; i++) {
+
+               sa = &sa_ctx->sa[i];
+               if (!sa->spi)
+                       continue;
+
+               ips = ipsec_get_primary_session(sa);
+               if (ips->type != RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL &&
+                   ips->type != RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO)
+                       continue;
+
+               if (!rte_eth_dev_is_valid_port(sa->portid))
+                       continue;
+
+               ret = rte_security_session_destroy(
+                               rte_eth_dev_get_sec_ctx(sa->portid),
+                               ips->security.ses);
+               if (ret)
+                       RTE_LOG(ERR, IPSEC, "Failed to destroy security "
+                                           "session type %d, spi %d\n",
+                                           ips->type, sa->spi);
+       }
+}
+
 int32_t
 main(int32_t argc, char **argv)
 {
        int32_t ret;
        uint32_t lcore_id;
+       uint32_t cdev_id;
        uint32_t i;
        uint8_t socket_id;
        uint16_t portid;
        uint64_t req_rx_offloads[RTE_MAX_ETHPORTS];
        uint64_t req_tx_offloads[RTE_MAX_ETHPORTS];
+       struct eh_conf *eh_conf = NULL;
        size_t sess_sz;
 
        /* init EAL */
@@ -2495,8 +2717,17 @@ main(int32_t argc, char **argv)
        argc -= ret;
        argv += ret;
 
+       force_quit = false;
+       signal(SIGINT, signal_handler);
+       signal(SIGTERM, signal_handler);
+
+       /* initialize event helper configuration */
+       eh_conf = eh_conf_init();
+       if (eh_conf == NULL)
+               rte_exit(EXIT_FAILURE, "Failed to init event helper config");
+
        /* parse application arguments (after the EAL ones) */
-       ret = parse_args(argc, argv);
+       ret = parse_args(argc, argv, eh_conf);
        if (ret < 0)
                rte_exit(EXIT_FAILURE, "Invalid parameters\n");
 
@@ -2513,8 +2744,11 @@ main(int32_t argc, char **argv)
                rte_exit(EXIT_FAILURE, "Invalid unprotected portmask 0x%x\n",
                                unprotected_port_mask);
 
-       if (check_params() < 0)
-               rte_exit(EXIT_FAILURE, "check_params failed\n");
+       if (check_poll_mode_params(eh_conf) < 0)
+               rte_exit(EXIT_FAILURE, "check_poll_mode_params failed\n");
+
+       if (check_event_mode_params(eh_conf) < 0)
+               rte_exit(EXIT_FAILURE, "check_event_mode_params failed\n");
 
        ret = init_lcore_rx_queues();
        if (ret < 0)
@@ -2555,6 +2789,18 @@ main(int32_t argc, char **argv)
 
        cryptodevs_init();
 
+       /*
+        * Set the enabled port mask in helper config for use by helper
+        * sub-system. This will be used while initializing devices using
+        * helper sub-system.
+        */
+       eh_conf->eth_portmask = enabled_port_mask;
+
+       /* Initialize eventmode components */
+       ret = eh_devs_init(eh_conf);
+       if (ret < 0)
+               rte_exit(EXIT_FAILURE, "eh_devs_init failed, err=%d\n", ret);
+
        /* start ports */
        RTE_ETH_FOREACH_DEV(portid) {
                if ((enabled_port_mask & (1 << portid)) == 0)
@@ -2614,5 +2860,48 @@ main(int32_t argc, char **argv)
                        return -1;
        }
 
+       /* Uninitialize eventmode components */
+       ret = eh_devs_uninit(eh_conf);
+       if (ret < 0)
+               rte_exit(EXIT_FAILURE, "eh_devs_uninit failed, err=%d\n", ret);
+
+       /* Free eventmode configuration memory */
+       eh_conf_uninit(eh_conf);
+
+       /* Destroy inline inbound and outbound sessions */
+       for (i = 0; i < NB_SOCKETS && i < rte_socket_count(); i++) {
+               socket_id = rte_socket_id_by_idx(i);
+               inline_sessions_free(socket_ctx[socket_id].sa_in);
+               inline_sessions_free(socket_ctx[socket_id].sa_out);
+       }
+
+       for (cdev_id = 0; cdev_id < rte_cryptodev_count(); cdev_id++) {
+               printf("Closing cryptodev %d...", cdev_id);
+               rte_cryptodev_stop(cdev_id);
+               rte_cryptodev_close(cdev_id);
+               printf(" Done\n");
+       }
+
+       RTE_ETH_FOREACH_DEV(portid) {
+               if ((enabled_port_mask & (1 << portid)) == 0)
+                       continue;
+
+               printf("Closing port %d...", portid);
+               if (flow_info_tbl[portid].rx_def_flow) {
+                       struct rte_flow_error err;
+
+                       ret = rte_flow_destroy(portid,
+                               flow_info_tbl[portid].rx_def_flow, &err);
+                       if (ret)
+                               RTE_LOG(ERR, IPSEC, "Failed to destroy flow "
+                                       " for port %u, err msg: %s\n", portid,
+                                       err.message);
+               }
+               rte_eth_dev_stop(portid);
+               rte_eth_dev_close(portid);
+               printf(" Done\n");
+       }
+       printf("Bye...\n");
+
        return 0;
 }
index 8f5d382..ec3d60b 100644 (file)
@@ -159,6 +159,24 @@ struct ipsec_sa {
        struct rte_security_session_conf sess_conf;
 } __rte_cache_aligned;
 
+struct ipsec_xf {
+       struct rte_crypto_sym_xform a;
+       struct rte_crypto_sym_xform b;
+};
+
+struct ipsec_sad {
+       struct rte_ipsec_sad *sad_v4;
+       struct rte_ipsec_sad *sad_v6;
+};
+
+struct sa_ctx {
+       void *satbl; /* pointer to array of rte_ipsec_sa objects*/
+       struct ipsec_sad sad;
+       struct ipsec_xf *xf;
+       uint32_t nb_sa;
+       struct ipsec_sa sa[];
+};
+
 struct ipsec_mbuf_metadata {
        struct ipsec_sa *sa;
        struct rte_crypto_op cop;
@@ -253,6 +271,12 @@ struct ipsec_traffic {
        struct traffic_type ip6;
 };
 
+extern struct ipsec_sa *sa_out;
+extern uint32_t nb_sa_out;
+
+extern struct ipsec_sa *sa_in;
+extern uint32_t nb_sa_in;
+
 uint16_t
 ipsec_inbound(struct ipsec_ctx *ctx, struct rte_mbuf *pkts[],
                uint16_t nb_pkts, uint16_t len);
index 4822d6b..0eb52d1 100644 (file)
@@ -135,14 +135,14 @@ const struct supported_aead_algo aead_algos[] = {
 
 #define SA_INIT_NB     128
 
-static struct ipsec_sa *sa_out;
+struct ipsec_sa *sa_out;
+uint32_t nb_sa_out;
 static uint32_t sa_out_sz;
-static uint32_t nb_sa_out;
 static struct ipsec_sa_cnt sa_out_cnt;
 
-static struct ipsec_sa *sa_in;
+struct ipsec_sa *sa_in;
+uint32_t nb_sa_in;
 static uint32_t sa_in_sz;
-static uint32_t nb_sa_in;
 static struct ipsec_sa_cnt sa_in_cnt;
 
 static const struct supported_cipher_algo *
@@ -826,19 +826,6 @@ print_one_sa_rule(const struct ipsec_sa *sa, int inbound)
        printf("\n");
 }
 
-struct ipsec_xf {
-       struct rte_crypto_sym_xform a;
-       struct rte_crypto_sym_xform b;
-};
-
-struct sa_ctx {
-       void *satbl; /* pointer to array of rte_ipsec_sa objects*/
-       struct ipsec_sad sad;
-       struct ipsec_xf *xf;
-       uint32_t nb_sa;
-       struct ipsec_sa sa[];
-};
-
 static struct sa_ctx *
 sa_create(const char *name, int32_t socket_id, uint32_t nb_sa)
 {
index 55712ba..473aaa9 100644 (file)
@@ -18,11 +18,6 @@ struct ipsec_sad_cache {
 
 RTE_DECLARE_PER_LCORE(struct ipsec_sad_cache, sad_cache);
 
-struct ipsec_sad {
-       struct rte_ipsec_sad *sad_v4;
-       struct rte_ipsec_sad *sad_v6;
-};
-
 int ipsec_sad_create(const char *name, struct ipsec_sad *sad,
        int socket_id, struct ipsec_sa_cnt *sa_cnt);