-a 0002:02:00.0,tag_as_xor=1
+- ``Min SPI for inbound inline IPsec`` (default ``0``)
+
+ Min SPI supported for inbound inline IPsec processing can be specified by
+ ``ipsec_in_min_spi`` ``devargs`` parameter.
+
+ For example::
+
+ -a 0002:02:00.0,ipsec_in_min_spi=6
+
+ With the above configuration, application can enable inline IPsec processing
+ for inbound SA with min SPI of 6.
+
- ``Max SPI for inbound inline IPsec`` (default ``255``)
Max SPI supported for inbound inline IPsec processing can be specified by
-a 0002:02:00.0,ipsec_in_max_spi=128
With the above configuration, application can enable inline IPsec processing
- for 128 inbound SAs (SPI 0-127).
+ with max SPI of 128.
- ``Max SA's for outbound inline IPsec`` (default ``4096``)
Runtime Config Options for inline device
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+- ``Min SPI for inbound inline IPsec`` (default ``0``)
+
+ Min SPI supported for inbound inline IPsec processing can be specified by
+ ``ipsec_in_min_spi`` ``devargs`` parameter.
+
+ For example::
+
+ -a 0002:1d:00.0,ipsec_in_min_spi=6
+
+ With the above configuration, application can enable inline IPsec processing
+ for inbound SA with min SPI of 6 for traffic aggregated on inline device.
+
- ``Max SPI for inbound inline IPsec`` (default ``255``)
Max SPI supported for inbound inline IPsec processing can be specified by
-a 0002:1d:00.0,ipsec_in_max_spi=128
With the above configuration, application can enable inline IPsec processing
- for 128 inbound SAs (SPI 0-127) for traffic aggregated on inline device.
+ for inbound SA with max SPI of 128 for traffic aggregated on inline device.
Debugging Options
uint8_t lock_rx_ctx;
uint32_t outb_nb_desc;
uint16_t outb_nb_crypto_qs;
- uint16_t ipsec_in_max_spi;
- uint16_t ipsec_out_max_sa;
+ uint32_t ipsec_in_min_spi;
+ uint32_t ipsec_in_max_spi;
+ uint32_t ipsec_out_max_sa;
bool ipsec_out_sso_pffunc;
/* End of input parameters */
/* LMT line base for "Per Core Tx LMT line" mode*/
static int
nix_inl_inb_sa_tbl_setup(struct roc_nix *roc_nix)
{
- uint16_t ipsec_in_max_spi = roc_nix->ipsec_in_max_spi;
+ uint32_t ipsec_in_min_spi = roc_nix->ipsec_in_min_spi;
+ uint32_t ipsec_in_max_spi = roc_nix->ipsec_in_max_spi;
struct nix *nix = roc_nix_to_nix_priv(roc_nix);
struct roc_nix_ipsec_cfg cfg;
+ uint64_t max_sa, i;
size_t inb_sa_sz;
- int rc, i;
void *sa;
+ int rc;
+
+ max_sa = plt_align32pow2(ipsec_in_max_spi - ipsec_in_min_spi + 1);
/* CN9K SA size is different */
if (roc_model_is_cn9k())
/* Alloc contiguous memory for Inbound SA's */
nix->inb_sa_sz = inb_sa_sz;
- nix->inb_sa_base = plt_zmalloc(inb_sa_sz * ipsec_in_max_spi,
+ nix->inb_spi_mask = max_sa - 1;
+ nix->inb_sa_base = plt_zmalloc(inb_sa_sz * max_sa,
ROC_NIX_INL_SA_BASE_ALIGN);
if (!nix->inb_sa_base) {
plt_err("Failed to allocate memory for Inbound SA");
return -ENOMEM;
}
if (roc_model_is_cn10k()) {
- for (i = 0; i < ipsec_in_max_spi; i++) {
+ for (i = 0; i < max_sa; i++) {
sa = ((uint8_t *)nix->inb_sa_base) + (i * inb_sa_sz);
roc_ot_ipsec_inb_sa_init(sa, true);
}
memset(&cfg, 0, sizeof(cfg));
cfg.sa_size = inb_sa_sz;
cfg.iova = (uintptr_t)nix->inb_sa_base;
- cfg.max_sa = ipsec_in_max_spi + 1;
+ cfg.max_sa = max_sa;
cfg.tt = SSO_TT_ORDERED;
/* Setup device specific inb SA table */
}
uint32_t
-roc_nix_inl_inb_sa_max_spi(struct roc_nix *roc_nix, bool inb_inl_dev)
+roc_nix_inl_inb_spi_range(struct roc_nix *roc_nix, bool inb_inl_dev,
+ uint32_t *min_spi, uint32_t *max_spi)
{
struct idev_cfg *idev = idev_get_cfg();
+ uint32_t min = 0, max = 0, mask = 0;
struct nix_inl_dev *inl_dev;
- struct nix *nix;
+ struct nix *nix = NULL;
if (idev == NULL)
return 0;
if (!inb_inl_dev && roc_nix == NULL)
return -EINVAL;
- if (roc_nix) {
+ inl_dev = idev->nix_inl_dev;
+ if (inb_inl_dev) {
+ min = inl_dev->ipsec_in_min_spi;
+ max = inl_dev->ipsec_in_max_spi;
+ mask = inl_dev->inb_spi_mask;
+ } else {
nix = roc_nix_to_nix_priv(roc_nix);
if (!nix->inl_inb_ena)
- return 0;
- }
-
- if (inb_inl_dev) {
- inl_dev = idev->nix_inl_dev;
- if (inl_dev)
- return inl_dev->ipsec_in_max_spi;
- return 0;
- }
-
- return roc_nix->ipsec_in_max_spi;
+ goto exit;
+ min = roc_nix->ipsec_in_min_spi;
+ max = roc_nix->ipsec_in_max_spi;
+ mask = nix->inb_spi_mask;
+ }
+exit:
+ if (min_spi)
+ *min_spi = min;
+ if (max_spi)
+ *max_spi = max;
+ return mask;
}
uint32_t
uintptr_t
roc_nix_inl_inb_sa_get(struct roc_nix *roc_nix, bool inb_inl_dev, uint32_t spi)
{
+ uint32_t max_spi, min_spi, mask;
uintptr_t sa_base;
- uint32_t max_spi;
uint64_t sz;
sa_base = roc_nix_inl_inb_sa_base_get(roc_nix, inb_inl_dev);
return 0;
/* Check if SPI is in range */
- max_spi = roc_nix_inl_inb_sa_max_spi(roc_nix, inb_inl_dev);
- if (spi > max_spi) {
- plt_err("Inbound SA SPI %u exceeds max %u", spi, max_spi);
- return 0;
- }
+ mask = roc_nix_inl_inb_spi_range(roc_nix, inb_inl_dev, &min_spi,
+ &max_spi);
+ if (spi > max_spi || spi < min_spi)
+ plt_warn("Inbound SA SPI %u not in range (%u..%u)", spi,
+ min_spi, max_spi);
/* Get SA size */
sz = roc_nix_inl_inb_sa_sz(roc_nix, inb_inl_dev);
return 0;
/* Basic logic of SPI->SA for now */
- return (sa_base + (spi * sz));
+ return (sa_base + ((spi & mask) * sz));
}
int
struct nix_inl_dev *inl_dev;
uint16_t sso_pffunc;
uint8_t eng_grpmask;
- uint64_t blkaddr;
+ uint64_t blkaddr, i;
uint16_t nb_lf;
void *sa_base;
size_t sa_sz;
- int i, j, rc;
+ int j, rc;
void *sa;
if (idev == NULL)
memset(&cfg, 0, sizeof(cfg));
cfg.sa_size = nix->inb_sa_sz;
cfg.iova = (uintptr_t)nix->inb_sa_base;
- cfg.max_sa = roc_nix->ipsec_in_max_spi + 1;
+ cfg.max_sa = nix->inb_spi_mask + 1;
cfg.tt = tt;
cfg.tag_const = tag_const;
struct roc_nix_inl_dev {
/* Input parameters */
struct plt_pci_device *pci_dev;
- uint16_t ipsec_in_max_spi;
+ uint32_t ipsec_in_min_spi;
+ uint32_t ipsec_in_max_spi;
bool selftest;
bool is_multi_channel;
uint16_t channel;
bool __roc_api roc_nix_inl_inb_is_enabled(struct roc_nix *roc_nix);
uintptr_t __roc_api roc_nix_inl_inb_sa_base_get(struct roc_nix *roc_nix,
bool inl_dev_sa);
-uint32_t __roc_api roc_nix_inl_inb_sa_max_spi(struct roc_nix *roc_nix,
- bool inl_dev_sa);
+uint32_t __roc_api roc_nix_inl_inb_spi_range(struct roc_nix *roc_nix,
+ bool inl_dev_sa, uint32_t *min,
+ uint32_t *max);
uint32_t __roc_api roc_nix_inl_inb_sa_sz(struct roc_nix *roc_nix,
bool inl_dev_sa);
uintptr_t __roc_api roc_nix_inl_inb_sa_get(struct roc_nix *roc_nix,
{
struct nix_inline_ipsec_lf_cfg *lf_cfg;
struct mbox *mbox = (&inl_dev->dev)->mbox;
+ uint64_t max_sa;
uint32_t sa_w;
lf_cfg = mbox_alloc_msg_nix_inline_ipsec_lf_cfg(mbox);
return -ENOSPC;
if (ena) {
- sa_w = plt_align32pow2(inl_dev->ipsec_in_max_spi + 1);
- sa_w = plt_log2_u32(sa_w);
+
+ max_sa = inl_dev->inb_spi_mask + 1;
+ sa_w = plt_log2_u32(max_sa);
lf_cfg->enable = 1;
lf_cfg->sa_base_addr = (uintptr_t)inl_dev->inb_sa_base;
lf_cfg->ipsec_cfg0.lenm1_max = NIX_CN9K_MAX_HW_FRS - 1;
else
lf_cfg->ipsec_cfg0.lenm1_max = NIX_RPM_MAX_HW_FRS - 1;
- lf_cfg->ipsec_cfg1.sa_idx_max = inl_dev->ipsec_in_max_spi;
+ lf_cfg->ipsec_cfg1.sa_idx_max = max_sa - 1;
lf_cfg->ipsec_cfg0.sa_pow2_size =
plt_log2_u32(inl_dev->inb_sa_sz);
static int
nix_inl_nix_setup(struct nix_inl_dev *inl_dev)
{
- uint16_t ipsec_in_max_spi = inl_dev->ipsec_in_max_spi;
+ uint32_t ipsec_in_min_spi = inl_dev->ipsec_in_min_spi;
+ uint32_t ipsec_in_max_spi = inl_dev->ipsec_in_max_spi;
struct dev *dev = &inl_dev->dev;
struct mbox *mbox = dev->mbox;
struct nix_lf_alloc_rsp *rsp;
struct nix_lf_alloc_req *req;
struct nix_hw_info *hw_info;
+ uint64_t max_sa, i;
size_t inb_sa_sz;
- int i, rc = -ENOSPC;
+ int rc = -ENOSPC;
void *sa;
+ max_sa = plt_align32pow2(ipsec_in_max_spi - ipsec_in_min_spi + 1);
+
/* Alloc NIX LF needed for single RQ */
req = mbox_alloc_msg_nix_lf_alloc(mbox);
if (req == NULL)
/* Alloc contiguous memory for Inbound SA's */
inl_dev->inb_sa_sz = inb_sa_sz;
- inl_dev->inb_sa_base = plt_zmalloc(inb_sa_sz * ipsec_in_max_spi,
+ inl_dev->inb_spi_mask = max_sa - 1;
+ inl_dev->inb_sa_base = plt_zmalloc(inb_sa_sz * max_sa,
ROC_NIX_INL_SA_BASE_ALIGN);
if (!inl_dev->inb_sa_base) {
plt_err("Failed to allocate memory for Inbound SA");
}
if (roc_model_is_cn10k()) {
- for (i = 0; i < ipsec_in_max_spi; i++) {
+ for (i = 0; i < max_sa; i++) {
sa = ((uint8_t *)inl_dev->inb_sa_base) +
(i * inb_sa_sz);
roc_ot_ipsec_inb_sa_init(sa, true);
memset(inl_dev, 0, sizeof(*inl_dev));
inl_dev->pci_dev = pci_dev;
+ inl_dev->ipsec_in_min_spi = roc_inl_dev->ipsec_in_min_spi;
inl_dev->ipsec_in_max_spi = roc_inl_dev->ipsec_in_max_spi;
inl_dev->selftest = roc_inl_dev->selftest;
inl_dev->is_multi_channel = roc_inl_dev->is_multi_channel;
uint16_t channel;
uint16_t chan_mask;
bool is_multi_channel;
- uint16_t ipsec_in_max_spi;
+ uint32_t ipsec_in_min_spi;
+ uint32_t ipsec_in_max_spi;
+ uint32_t inb_spi_mask;
bool attach_cptlf;
bool wqe_skip;
};
bool inl_outb_ena;
void *inb_sa_base;
size_t inb_sa_sz;
+ uint32_t inb_spi_mask;
void *outb_sa_base;
size_t outb_sa_sz;
uint16_t outb_err_sso_pffunc;
roc_nix_inl_inb_init;
roc_nix_inl_inb_sa_base_get;
roc_nix_inl_inb_sa_get;
- roc_nix_inl_inb_sa_max_spi;
+ roc_nix_inl_inb_spi_range;
roc_nix_inl_inb_sa_sz;
roc_nix_inl_inb_tag_update;
roc_nix_inl_inb_fini;
struct cn10k_sec_sess_priv sess_priv;
struct rte_crypto_sym_xform *crypto;
struct cnxk_eth_sec_sess *eth_sec;
+ struct roc_nix *nix = &dev->nix;
bool inbound, inl_dev;
rte_spinlock_t *lock;
char tbuf[128] = {0};
if (inbound) {
struct roc_ot_ipsec_inb_sa *inb_sa, *inb_sa_dptr;
struct cn10k_inb_priv_data *inb_priv;
+ uint32_t spi_mask;
uintptr_t sa;
PLT_STATIC_ASSERT(sizeof(struct cn10k_inb_priv_data) <
ROC_NIX_INL_OT_IPSEC_INB_SW_RSVD);
+ spi_mask = roc_nix_inl_inb_spi_range(nix, inl_dev, NULL, NULL);
+
/* Get Inbound SA from NIX_RX_IPSEC_SA_BASE */
- sa = roc_nix_inl_inb_sa_get(&dev->nix, inl_dev, ipsec->spi);
+ sa = roc_nix_inl_inb_sa_get(nix, inl_dev, ipsec->spi);
if (!sa && dev->inb.inl_dev) {
snprintf(tbuf, sizeof(tbuf),
"Failed to create ingress sa, inline dev "
inb_priv->userdata = conf->userdata;
/* Save SA index/SPI in cookie for now */
- inb_sa_dptr->w1.s.cookie = rte_cpu_to_be_32(ipsec->spi);
+ inb_sa_dptr->w1.s.cookie =
+ rte_cpu_to_be_32(ipsec->spi & spi_mask);
/* Prepare session priv */
sess_priv.inb_sa = 1;
- sess_priv.sa_idx = ipsec->spi;
+ sess_priv.sa_idx = ipsec->spi & spi_mask;
/* Pointer from eth_sec -> inb_sa */
eth_sec->sa = inb_sa;
eth_sec->sess = sess;
- eth_sec->sa_idx = ipsec->spi;
+ eth_sec->sa_idx = ipsec->spi & spi_mask;
eth_sec->spi = ipsec->spi;
eth_sec->inl_dev = !!dev->inb.inl_dev;
eth_sec->inb = true;
struct cn9k_sec_sess_priv sess_priv;
struct rte_crypto_sym_xform *crypto;
struct cnxk_eth_sec_sess *eth_sec;
+ struct roc_nix *nix = &dev->nix;
rte_spinlock_t *lock;
char tbuf[128] = {0};
bool inbound;
if (inbound) {
struct cn9k_inb_priv_data *inb_priv;
struct roc_onf_ipsec_inb_sa *inb_sa;
+ uint32_t spi_mask;
PLT_STATIC_ASSERT(sizeof(struct cn9k_inb_priv_data) <
ROC_NIX_INL_ONF_IPSEC_INB_SW_RSVD);
+ spi_mask = roc_nix_inl_inb_spi_range(nix, false, NULL, NULL);
+
/* Get Inbound SA from NIX_RX_IPSEC_SA_BASE. Assume no inline
* device always for CN9K.
*/
inb_sa = (struct roc_onf_ipsec_inb_sa *)
- roc_nix_inl_inb_sa_get(&dev->nix, false, ipsec->spi);
+ roc_nix_inl_inb_sa_get(nix, false, ipsec->spi);
if (!inb_sa) {
snprintf(tbuf, sizeof(tbuf),
"Failed to create ingress sa");
/* Prepare session priv */
sess_priv.inb_sa = 1;
- sess_priv.sa_idx = ipsec->spi;
+ sess_priv.sa_idx = ipsec->spi & spi_mask;
/* Pointer from eth_sec -> inb_sa */
eth_sec->sa = inb_sa;
eth_sec->sess = sess;
- eth_sec->sa_idx = ipsec->spi;
+ eth_sec->sa_idx = ipsec->spi & spi_mask;
eth_sec->spi = ipsec->spi;
eth_sec->inb = true;
}
static int
-parse_ipsec_in_max_spi(const char *key, const char *value, void *extra_args)
+parse_ipsec_in_spi_range(const char *key, const char *value, void *extra_args)
{
RTE_SET_USED(key);
uint32_t val;
- val = atoi(value);
+ errno = 0;
+ val = strtoul(value, NULL, 0);
+ if (errno)
+ val = 0;
- *(uint16_t *)extra_args = val;
+ *(uint32_t *)extra_args = val;
return 0;
}
RTE_SET_USED(key);
uint32_t val;
- val = atoi(value);
+ errno = 0;
+ val = strtoul(value, NULL, 0);
+ if (errno)
+ val = 0;
*(uint16_t *)extra_args = val;
#define CNXK_SWITCH_HEADER_TYPE "switch_header"
#define CNXK_RSS_TAG_AS_XOR "tag_as_xor"
#define CNXK_LOCK_RX_CTX "lock_rx_ctx"
+#define CNXK_IPSEC_IN_MIN_SPI "ipsec_in_min_spi"
#define CNXK_IPSEC_IN_MAX_SPI "ipsec_in_max_spi"
#define CNXK_IPSEC_OUT_MAX_SA "ipsec_out_max_sa"
#define CNXK_OUTB_NB_DESC "outb_nb_desc"
uint16_t reta_sz = ROC_NIX_RSS_RETA_SZ_64;
uint16_t sqb_count = CNXK_NIX_TX_MAX_SQB;
struct flow_pre_l2_size_info pre_l2_info;
- uint16_t ipsec_in_max_spi = BIT(8) - 1;
- uint16_t ipsec_out_max_sa = BIT(12);
+ uint32_t ipsec_in_max_spi = BIT(8) - 1;
+ uint32_t ipsec_out_max_sa = BIT(12);
uint16_t flow_prealloc_size = 1;
uint16_t switch_header_type = 0;
uint16_t flow_max_priority = 3;
uint16_t force_inb_inl_dev = 0;
uint16_t outb_nb_crypto_qs = 1;
+ uint32_t ipsec_in_min_spi = 0;
uint16_t outb_nb_desc = 8200;
struct sdp_channel sdp_chan;
uint16_t rss_tag_as_xor = 0;
rte_kvargs_process(kvlist, CNXK_RSS_TAG_AS_XOR, &parse_flag,
&rss_tag_as_xor);
rte_kvargs_process(kvlist, CNXK_LOCK_RX_CTX, &parse_flag, &lock_rx_ctx);
+ rte_kvargs_process(kvlist, CNXK_IPSEC_IN_MIN_SPI,
+ &parse_ipsec_in_spi_range, &ipsec_in_min_spi);
rte_kvargs_process(kvlist, CNXK_IPSEC_IN_MAX_SPI,
- &parse_ipsec_in_max_spi, &ipsec_in_max_spi);
+ &parse_ipsec_in_spi_range, &ipsec_in_max_spi);
rte_kvargs_process(kvlist, CNXK_IPSEC_OUT_MAX_SA,
&parse_ipsec_out_max_sa, &ipsec_out_max_sa);
rte_kvargs_process(kvlist, CNXK_OUTB_NB_DESC, &parse_outb_nb_desc,
dev->outb.max_sa = ipsec_out_max_sa;
dev->outb.nb_desc = outb_nb_desc;
dev->outb.nb_crypto_qs = outb_nb_crypto_qs;
+ dev->nix.ipsec_in_min_spi = ipsec_in_min_spi;
dev->nix.ipsec_in_max_spi = ipsec_in_max_spi;
dev->nix.ipsec_out_max_sa = ipsec_out_max_sa;
dev->nix.rss_tag_as_xor = !!rss_tag_as_xor;
#include <cnxk_ethdev.h>
#define CNXK_NIX_INL_SELFTEST "selftest"
+#define CNXK_NIX_INL_IPSEC_IN_MIN_SPI "ipsec_in_min_spi"
#define CNXK_NIX_INL_IPSEC_IN_MAX_SPI "ipsec_in_max_spi"
#define CNXK_INL_CPT_CHANNEL "inl_cpt_channel"
};
static int
-parse_ipsec_in_max_spi(const char *key, const char *value, void *extra_args)
+parse_ipsec_in_spi_range(const char *key, const char *value, void *extra_args)
{
RTE_SET_USED(key);
uint32_t val;
- val = atoi(value);
+ errno = 0;
+ val = strtoul(value, NULL, 0);
+ if (errno)
+ val = 0;
- *(uint16_t *)extra_args = val;
+ *(uint32_t *)extra_args = val;
return 0;
}
struct roc_nix_inl_dev *inl_dev)
{
uint32_t ipsec_in_max_spi = BIT(8) - 1;
+ uint32_t ipsec_in_min_spi = 0;
struct inl_cpt_channel cpt_channel;
struct rte_kvargs *kvlist;
uint8_t selftest = 0;
rte_kvargs_process(kvlist, CNXK_NIX_INL_SELFTEST, &parse_selftest,
&selftest);
+ rte_kvargs_process(kvlist, CNXK_NIX_INL_IPSEC_IN_MIN_SPI,
+ &parse_ipsec_in_spi_range, &ipsec_in_min_spi);
rte_kvargs_process(kvlist, CNXK_NIX_INL_IPSEC_IN_MAX_SPI,
- &parse_ipsec_in_max_spi, &ipsec_in_max_spi);
+ &parse_ipsec_in_spi_range, &ipsec_in_max_spi);
rte_kvargs_process(kvlist, CNXK_INL_CPT_CHANNEL, &parse_inl_cpt_channel,
&cpt_channel);
rte_kvargs_free(kvlist);
null_devargs:
+ inl_dev->ipsec_in_min_spi = ipsec_in_min_spi;
inl_dev->ipsec_in_max_spi = ipsec_in_max_spi;
inl_dev->selftest = selftest;
inl_dev->channel = cpt_channel.channel;
if (!sa_base)
return -ENOTSUP;
- sa_w = plt_log2_u32(dev->nix.ipsec_in_max_spi + 1);
+ sa_w = plt_log2_u32(dev->nix.ipsec_in_max_spi + 1 -
+ dev->nix.ipsec_in_min_spi);
/* Set SA Base in lookup mem */
sa_base_tbl = (uintptr_t)lookup_mem;
git.droids-corp.org / dpdk.git / commitdiff