crypto/cnxk: add security capabilities

Add security capabilities supported by crypto cn10k PMD.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
Signed-off-by: Srujana Challa <schalla@marvell.com>
Signed-off-by: Tejasree Kondoj <ktejasree@marvell.com>
Acked-by: Akhil Goyal <gakhil@marvell.com>

diff --git a/doc/guides/cryptodevs/cnxk.rst b/doc/guides/cryptodevs/cnxk.rst
index 66b0b63..db949fa 100644 (file)
--- a/doc/guides/cryptodevs/cnxk.rst
+++ b/doc/guides/cryptodevs/cnxk.rst
@@ -185,6 +185,30 @@ running the test application:
     ./dpdk-test
     RTE>>cryptodev_cn10k_autotest
 
+Lookaside IPsec Support
+-----------------------
+
+The OCTEON cnxk SoCs can accelerate IPsec traffic in lookaside protocol mode,
+with its **cryptographic accelerator (CPT)**. ``OCTEON cnxk crypto PMD`` implements
+this as an ``RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL`` offload.
+
+Refer to :doc:`../prog_guide/rte_security` for more details on protocol offloads.
+
+This feature can be tested with ipsec-secgw sample application.
+
+Supported OCTEON cnxk SoCs
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+- CN10XX
+
+Features supported
+~~~~~~~~~~~~~~~~~~
+
+* IPv4
+* ESP
+* Tunnel mode
+* AES-128/192/256-GCM
+
 Limitations
 -----------
 

diff --git a/doc/guides/cryptodevs/features/cn10k.ini b/doc/guides/cryptodevs/features/cn10k.ini
index 77c4a2d..b268f84 100644 (file)
--- a/doc/guides/cryptodevs/features/cn10k.ini
+++ b/doc/guides/cryptodevs/features/cn10k.ini
@@ -7,6 +7,7 @@
 Symmetric crypto       = Y
 Sym operation chaining = Y
 HW Accelerated         = Y
+Protocol offload       = Y
 In Place SGL           = Y
 OOP SGL In LB  Out     = Y
 OOP SGL In SGL Out     = Y

diff --git a/doc/guides/rel_notes/release_21_08.rst b/doc/guides/rel_notes/release_21_08.rst
index a1ec3a9..d937cd6 100644 (file)
--- a/doc/guides/rel_notes/release_21_08.rst
+++ b/doc/guides/rel_notes/release_21_08.rst
@@ -89,6 +89,7 @@ New Features
   * Added cnxk crypto PMD which provides support for an integrated
     crypto driver for CN9K and CN10K series of SOCs. Support for
     symmetric crypto algorithms is added to both the PMDs.
+  * Added support for lookaside protocol (IPsec) offload in cn10k PMD.
 
 * **Added Baseband PHY CNXK PMD.**
 

diff --git a/drivers/crypto/cnxk/cn10k_cryptodev.c b/drivers/crypto/cnxk/cn10k_cryptodev.c
index cacf9c2..22ae810 100644 (file)
--- a/drivers/crypto/cnxk/cn10k_cryptodev.c
+++ b/drivers/crypto/cnxk/cn10k_cryptodev.c
@@ -99,6 +99,7 @@ cn10k_cpt_pci_probe(struct rte_pci_driver *pci_drv __rte_unused,
                             RTE_CRYPTODEV_FF_OOP_SGL_IN_LB_OUT |
                             RTE_CRYPTODEV_FF_OOP_SGL_IN_SGL_OUT |
                             RTE_CRYPTODEV_FF_SYM_SESSIONLESS |
+                            RTE_CRYPTODEV_FF_SECURITY |
                             RTE_CRYPTODEV_FF_DIGEST_ENCRYPTED;
 
        cn10k_cpt_set_enqdeq_fns(dev);

diff --git a/drivers/crypto/cnxk/cnxk_cryptodev.h b/drivers/crypto/cnxk/cnxk_cryptodev.h
index 03af4af..6760c13 100644 (file)
--- a/drivers/crypto/cnxk/cnxk_cryptodev.h
+++ b/drivers/crypto/cnxk/cnxk_cryptodev.h
@@ -6,6 +6,7 @@
 #define _CNXK_CRYPTODEV_H_
 
 #include <rte_cryptodev.h>
+#include <rte_security.h>
 
 #include "roc_cpt.h"
 
@@ -19,6 +20,9 @@
 struct cnxk_cpt_vf {
        struct roc_cpt cpt;
        struct rte_cryptodev_capabilities crypto_caps[CNXK_CPT_MAX_CAPS];
+       struct rte_cryptodev_capabilities
+               sec_crypto_caps[CNXK_SEC_CRYPTO_MAX_CAPS];
+       struct rte_security_capability sec_caps[CNXK_SEC_MAX_CAPS];
 };
 
 int cnxk_cpt_eng_grp_add(struct roc_cpt *roc_cpt);

diff --git a/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.c b/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.c
index a5195e8..d52fa89 100644 (file)
--- a/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.c
+++ b/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.c
@@ -3,6 +3,7 @@
  */
 
 #include <rte_cryptodev.h>
+#include <rte_security.h>
 
 #include "roc_api.h"
 
@@ -18,6 +19,15 @@
                                     RTE_DIM(caps_##name));                    \
        } while (0)
 
+#define SEC_CAPS_ADD(cnxk_caps, cur_pos, hw_caps, name)                        \
+       do {                                                                   \
+               if ((hw_caps[CPT_ENG_TYPE_SE].name) ||                         \
+                   (hw_caps[CPT_ENG_TYPE_IE].name) ||                         \
+                   (hw_caps[CPT_ENG_TYPE_AE].name))                           \
+                       sec_caps_add(cnxk_caps, cur_pos, sec_caps_##name,      \
+                                    RTE_DIM(sec_caps_##name));                \
+       } while (0)
+
 static const struct rte_cryptodev_capabilities caps_sha1_sha2[] = {
        {       /* SHA1 */
                .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
@@ -658,6 +668,69 @@ static const struct rte_cryptodev_capabilities caps_end[] = {
        RTE_CRYPTODEV_END_OF_CAPABILITIES_LIST()
 };
 
+static const struct rte_cryptodev_capabilities sec_caps_aes[] = {
+       {       /* AES GCM */
+               .op = RTE_CRYPTO_OP_TYPE_SYMMETRIC,
+               {.sym = {
+                       .xform_type = RTE_CRYPTO_SYM_XFORM_AEAD,
+                       {.aead = {
+                               .algo = RTE_CRYPTO_AEAD_AES_GCM,
+                               .block_size = 16,
+                               .key_size = {
+                                       .min = 16,
+                                       .max = 32,
+                                       .increment = 8
+                               },
+                               .digest_size = {
+                                       .min = 16,
+                                       .max = 16,
+                                       .increment = 0
+                               },
+                               .aad_size = {
+                                       .min = 8,
+                                       .max = 12,
+                                       .increment = 4
+                               },
+                               .iv_size = {
+                                       .min = 12,
+                                       .max = 12,
+                                       .increment = 0
+                               }
+                       }, }
+               }, }
+       },
+};
+
+static const struct rte_security_capability sec_caps_templ[] = {
+       {       /* IPsec Lookaside Protocol ESP Tunnel Ingress */
+               .action = RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL,
+               .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
+               .ipsec = {
+                       .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+                       .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+                       .direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
+                       .options = { 0 }
+               },
+               .crypto_capabilities = NULL,
+               .ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA
+       },
+       {       /* IPsec Lookaside Protocol ESP Tunnel Egress */
+               .action = RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL,
+               .protocol = RTE_SECURITY_PROTOCOL_IPSEC,
+               .ipsec = {
+                       .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
+                       .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
+                       .direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
+                       .options = { 0 }
+               },
+               .crypto_capabilities = NULL,
+               .ol_flags = RTE_SECURITY_TX_OLOAD_NEED_MDATA
+       },
+       {
+               .action = RTE_SECURITY_ACTION_TYPE_NONE
+       }
+};
+
 static void
 cpt_caps_add(struct rte_cryptodev_capabilities cnxk_caps[], int *cur_pos,
             const struct rte_cryptodev_capabilities *caps, int nb_caps)
@@ -692,8 +765,49 @@ cnxk_crypto_capabilities_get(struct cnxk_cpt_vf *vf)
        return vf->crypto_caps;
 }
 
+static void
+sec_caps_add(struct rte_cryptodev_capabilities cnxk_caps[], int *cur_pos,
+            const struct rte_cryptodev_capabilities *caps, int nb_caps)
+{
+       if (*cur_pos + nb_caps > CNXK_SEC_CRYPTO_MAX_CAPS)
+               return;
+
+       memcpy(&cnxk_caps[*cur_pos], caps, nb_caps * sizeof(caps[0]));
+       *cur_pos += nb_caps;
+}
+
+static void
+sec_crypto_caps_populate(struct rte_cryptodev_capabilities cnxk_caps[],
+                        union cpt_eng_caps *hw_caps)
+{
+       int cur_pos = 0;
+
+       SEC_CAPS_ADD(cnxk_caps, &cur_pos, hw_caps, aes);
+
+       sec_caps_add(cnxk_caps, &cur_pos, caps_end, RTE_DIM(caps_end));
+}
+
 void
 cnxk_cpt_caps_populate(struct cnxk_cpt_vf *vf)
 {
+       unsigned long i;
+
        crypto_caps_populate(vf->crypto_caps, vf->cpt.hw_caps);
+       sec_crypto_caps_populate(vf->sec_crypto_caps, vf->cpt.hw_caps);
+
+       PLT_STATIC_ASSERT(RTE_DIM(sec_caps_templ) <= RTE_DIM(vf->sec_caps));
+       memcpy(vf->sec_caps, sec_caps_templ, sizeof(sec_caps_templ));
+
+       for (i = 0; i < RTE_DIM(sec_caps_templ) - 1; i++)
+               vf->sec_caps[i].crypto_capabilities = vf->sec_crypto_caps;
+}
+
+const struct rte_security_capability *
+cnxk_crypto_sec_capabilities_get(void *device)
+{
+       struct rte_cryptodev *dev = device;
+       struct cnxk_cpt_vf *vf;
+
+       vf = dev->data->dev_private;
+       return vf->sec_caps;
 }

diff --git a/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.h b/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.h
index 85f5ad2..fe07e43 100644 (file)
--- a/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.h
+++ b/drivers/crypto/cnxk/cnxk_cryptodev_capabilities.h
@@ -10,7 +10,7 @@
 #include "cnxk_cryptodev.h"
 
 /*
- * Initialize crypto capabilities for the device
+ * Initialize crypto and IPsec capabilities for the device
  *
  */
 void cnxk_cpt_caps_populate(struct cnxk_cpt_vf *vf);
@@ -22,4 +22,11 @@ void cnxk_cpt_caps_populate(struct cnxk_cpt_vf *vf);
 const struct rte_cryptodev_capabilities *
 cnxk_crypto_capabilities_get(struct cnxk_cpt_vf *vf);
 
+/*
+ * Get security capabilities list for the device
+ *
+ */
+const struct rte_security_capability *
+cnxk_crypto_sec_capabilities_get(void *device);
+
 #endif /* _CNXK_CRYPTODEV_CAPABILITIES_H_ */

diff --git a/drivers/crypto/cnxk/cnxk_cryptodev_sec.c b/drivers/crypto/cnxk/cnxk_cryptodev_sec.c
index f03d2ed..8d04d4b 100644 (file)
--- a/drivers/crypto/cnxk/cnxk_cryptodev_sec.c
+++ b/drivers/crypto/cnxk/cnxk_cryptodev_sec.c
@@ -7,6 +7,7 @@
 #include <rte_security.h>
 #include <rte_security_driver.h>
 
+#include "cnxk_cryptodev_capabilities.h"
 #include "cnxk_cryptodev_sec.h"
 
 /* Common security ops */
@@ -16,7 +17,7 @@ struct rte_security_ops cnxk_sec_ops = {
        .session_get_size = NULL,
        .set_pkt_metadata = NULL,
        .get_userdata = NULL,
-       .capabilities_get = NULL,
+       .capabilities_get = cnxk_crypto_sec_capabilities_get
 };
 
 int