crypto/dpaax_sec: enable anti replay window config

This patch usages the anti replay window size to config
the anti replay checking  in decap path for lookaside
IPSEC offload

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>
Acked-by: Akhil Goyal <akhil.goyal@nxp.com>

diff --git a/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c b/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
index 1cb78c6..06ebe5e 100644 (file)
--- a/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
+++ b/drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c
@@ -2904,6 +2904,27 @@ dpaa2_sec_set_ipsec_session(struct rte_cryptodev *dev,
                                sizeof(struct rte_ipv6_hdr) << 16;
                if (ipsec_xform->options.esn)
                        decap_pdb.options |= PDBOPTS_ESP_ESN;
+
+               if (ipsec_xform->replay_win_sz) {
+                       uint32_t win_sz;
+                       win_sz = rte_align32pow2(ipsec_xform->replay_win_sz);
+
+                       switch (win_sz) {
+                       case 1:
+                       case 2:
+                       case 4:
+                       case 8:
+                       case 16:
+                       case 32:
+                               decap_pdb.options |= PDBOPTS_ESP_ARS32;
+                               break;
+                       case 64:
+                               decap_pdb.options |= PDBOPTS_ESP_ARS64;
+                               break;
+                       default:
+                               decap_pdb.options |= PDBOPTS_ESP_ARS128;
+                       }
+               }
                session->dir = DIR_DEC;
                bufsize = cnstr_shdsc_ipsec_new_decap(priv->flc_desc[0].desc,
                                1, 0, SHR_SERIAL,

diff --git a/drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h b/drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h
index c10fbf8..528b64e 100644 (file)
--- a/drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h
+++ b/drivers/crypto/dpaa2_sec/dpaa2_sec_priv.h
@@ -716,7 +716,8 @@ static const struct rte_security_capability dpaa2_sec_security_cap[] = {
                        .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
                        .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
                        .direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
-                       .options = { 0 }
+                       .options = { 0 },
+                       .replay_win_sz_max = 128
                },
                .crypto_capabilities = dpaa2_sec_capabilities
        },
@@ -727,7 +728,8 @@ static const struct rte_security_capability dpaa2_sec_security_cap[] = {
                        .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
                        .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
                        .direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
-                       .options = { 0 }
+                       .options = { 0 },
+                       .replay_win_sz_max = 128
                },
                .crypto_capabilities = dpaa2_sec_capabilities
        },

diff --git a/drivers/crypto/dpaa_sec/dpaa_sec.c b/drivers/crypto/dpaa_sec/dpaa_sec.c
index d4cf7fa..e0b307c 100644 (file)
--- a/drivers/crypto/dpaa_sec/dpaa_sec.c
+++ b/drivers/crypto/dpaa_sec/dpaa_sec.c
@@ -2834,6 +2834,27 @@ dpaa_sec_set_ipsec_session(__rte_unused struct rte_cryptodev *dev,
                                        sizeof(struct rte_ipv6_hdr) << 16;
                if (ipsec_xform->options.esn)
                        session->decap_pdb.options |= PDBOPTS_ESP_ESN;
+               if (ipsec_xform->replay_win_sz) {
+                       uint32_t win_sz;
+                       win_sz = rte_align32pow2(ipsec_xform->replay_win_sz);
+
+                       switch (win_sz) {
+                       case 1:
+                       case 2:
+                       case 4:
+                       case 8:
+                       case 16:
+                       case 32:
+                               session->decap_pdb.options |= PDBOPTS_ESP_ARS32;
+                               break;
+                       case 64:
+                               session->decap_pdb.options |= PDBOPTS_ESP_ARS64;
+                               break;
+                       default:
+                               session->decap_pdb.options |=
+                                                       PDBOPTS_ESP_ARS128;
+                       }
+               }
        } else
                goto out;
        rte_spinlock_lock(&internals->lock);

diff --git a/drivers/crypto/dpaa_sec/dpaa_sec.h b/drivers/crypto/dpaa_sec/dpaa_sec.h
index 039cce8..3ecc7ea 100644 (file)
--- a/drivers/crypto/dpaa_sec/dpaa_sec.h
+++ b/drivers/crypto/dpaa_sec/dpaa_sec.h
@@ -733,7 +733,8 @@ static const struct rte_security_capability dpaa_sec_security_cap[] = {
                        .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
                        .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
                        .direction = RTE_SECURITY_IPSEC_SA_DIR_EGRESS,
-                       .options = { 0 }
+                       .options = { 0 },
+                       .replay_win_sz_max = 128
                },
                .crypto_capabilities = dpaa_sec_capabilities
        },
@@ -744,7 +745,8 @@ static const struct rte_security_capability dpaa_sec_security_cap[] = {
                        .proto = RTE_SECURITY_IPSEC_SA_PROTO_ESP,
                        .mode = RTE_SECURITY_IPSEC_SA_MODE_TUNNEL,
                        .direction = RTE_SECURITY_IPSEC_SA_DIR_INGRESS,
-                       .options = { 0 }
+                       .options = { 0 },
+                       .replay_win_sz_max = 128
                },
                .crypto_capabilities = dpaa_sec_capabilities
        },