Jay Zhou [Tue, 17 Apr 2018 09:23:18 +0000 (17:23 +0800)]
crypto/virtio: support device init
This patch implements the initialization of the virtio crypto device.
The virtio crypto device conforms to virtio-1.0, so this patch only
supports modern mode operation.
The cryptodev is created at the virtio crypto pci device probing stage.
The function of virtio_crypto_pkt_tx_burst() is used to burst transfer
packets and virtio_crypto_pkt_rx_burst() is used to burst receive packets.
Signed-off-by: Jay Zhou <jianjay.zhou@huawei.com> Reviewed-by: Fan Zhang <roy.fan.zhang@intel.com>
Jay Zhou [Tue, 17 Apr 2018 09:23:17 +0000 (17:23 +0800)]
crypto/virtio: add virtio crypto PMD
The virtio crypto device is a virtual cryptography device
as well as a kind of virtual hardware accelerator for
virtual machines. The linux kernel virtio-crypto driver
has been merged, and this patch introduces virtio crypto
PMD to achieve better performance.
Signed-off-by: Jay Zhou <jianjay.zhou@huawei.com> Reviewed-by: Fan Zhang <roy.fan.zhang@intel.com>
The application may want to store private data along with the
rte_cryptodev that is transparent to the rte_cryptodev layer.
For e.g., If an eventdev based application is submitting a
rte_cryptodev_sym_session operation and wants to indicate event
information required to construct a new event that will be
enqueued to eventdev after completion of the rte_cryptodev_sym_session
operation. This patch provides a mechanism for the application
to associate this information with the rte_cryptodev_sym_session session.
The application can set the private data using
rte_cryptodev_sym_session_set_private_data() and retrieve it using
rte_cryptodev_sym_session_get_private_data().
Signed-off-by: Abhinandan Gujjar <abhinandan.gujjar@intel.com> Signed-off-by: Nikhil Rao <nikhil.rao@intel.com> Acked-by: Akhil Goyal <akhil.goyal@nxp.com> Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
The application may want to store private data along with the
rte_crypto_op that is transparent to the rte_cryptodev layer.
For e.g., If an eventdev based application is submitting a
crypto session-less operation and wants to indicate event
information required to construct a new event that will be
enqueued to eventdev after completion of the crypto
operation. This patch provides a mechanism for the application
to associate this information with the rte_crypto_op in
session-less mode.
Signed-off-by: Abhinandan Gujjar <abhinandan.gujjar@intel.com> Signed-off-by: Nikhil Rao <nikhil.rao@intel.com> Acked-by: Akhil Goyal <akhil.goyal@nxp.com> Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
The current code usages the default mempool ops while
creating the mempool for crypto usages. Adding the support
for best_mempool_ops to enable it for devices using
non default mempools.
Signed-off-by: Ashish Jain <ashish.jain@nxp.com> Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com> Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
crypto/dpaa_sec: move mempool allocation to config
Currently, the context mempools are allocated during device probe. Thus,
even if the DPAA SEC devices are not used, any application would still
allocate the memory required for working with the contexts.
This patch moves the allocation to configuration time so that when the
CAAM devices are configured, this allocation would be done.
Adding a check to do portal configuration if not already
configured before packet enqueue. This check is only done
during dpaa_sec_attach_sess_q for initial packets,
so this change wont affect the data path and hence performance.
Fixes: e79416d10fa3 ("crypto/dpaa_sec: support multiple sessions per queue pair") Cc: stable@dpdk.org Signed-off-by: Ashish Jain <ashish.jain@nxp.com>
Ravi Kumar [Mon, 19 Mar 2018 12:23:51 +0000 (08:23 -0400)]
crypto/ccp: support CPU based MD5 and SHA2 family
Auth operations can be performed on CPU without offloading
to CCP if CONFIG_RTE_LIBRTE_PMD_CCP_CPU_AUTH is enabled in
DPDK configuration. CCP PMD skip offloading auth operations
to hardware engines and perform them using openssl APIs.
Ravi Kumar [Mon, 19 Mar 2018 12:23:40 +0000 (08:23 -0400)]
crypto/ccp: support burst enqueue/dequeue
Added support for burst oriented data path.
CCP PMD selects appropriate CCP engine available
on the platform and schedule the batch of crypto ops to a
selected hardware queue of the respective crypto engine.
Ravi Kumar [Mon, 19 Mar 2018 12:23:39 +0000 (08:23 -0400)]
crypto/ccp: support queue pair related ops
Added crypto queue pair specific crypto ops callback functions
to setup and manage a CCP crypto queue pair object. CCP PMD
exposes only a single crypto queue pair object and handles the
actual hardware queues underneath.
Ravi Kumar [Mon, 19 Mar 2018 12:23:36 +0000 (08:23 -0400)]
crypto/ccp: support device init
CCP PMD is a virtual crypto PMD which schedules a number of available
actual CCP hardware engines underneath. The PMD
manages all devices by its own. The PMD supports CCP_5a and
CCP_5b versions of crypto engines and this patch adds support
to initialize and use such devices.
Removing redundant strncmp in parsing long arguments. The getopt library
provides means to identify long options using the "val" field of
structure option. The existing code gets 0 as "val" for all long
arguments and then uses strncmp to figure out which long option was
being referred to. Fixing this.
In addition, the macros and enums used for long arguments have been
renamed and repositioned adhering to the general convention followed in
various other apps, like l3fwd.
Signed-off-by: Anoob Joseph <anoob.joseph@caviumnetworks.com> Acked-by: Radu Nicolau <radu.nicolau@intel.com>
Marko Kovacevic [Tue, 27 Mar 2018 12:14:30 +0000 (13:14 +0100)]
crypto/aesni_gcm: support IPsec Multi-buffer lib v0.49
Adds support for the v0.49 of the IPsec Multi-buffer lib,
which now gets compiled and installed as a shared object.
Therefore, there is no need to pass the AESNI_MULTI_BUFFER_LIB_PATH
Signed-off-by: Marko Kovacevic <marko.kovacevic@intel.com> Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
Marko Kovacevic [Tue, 27 Mar 2018 12:14:29 +0000 (13:14 +0100)]
crypto/aesni_mb: support IPsec Multi-buffer lib v0.49
Adds support for the v0.49 of the IPsec Multi-buffer lib,
which now gets compiled and installed as a shared object.
Therefore, there is no need to pass the AESNI_MULTI_BUFFER_LIB_PATH
Signed-off-by: Marko Kovacevic <marko.kovacevic@intel.com> Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
Tomasz Duszynski [Wed, 14 Mar 2018 13:12:54 +0000 (14:12 +0100)]
test/crypto: add MRVL to hash test cases
MRVL Crypto PMD supports most of the hash algorithms covered
by test suites thus specific bits should be set in pmd_masks.
Otherwise blockcipher authonly test returns success even though no
real tests have been executed.
Fixes: 84e0ded38ac5 ("test/crypto: add mrvl crypto unit tests") Cc: stable@dpdk.org Signed-off-by: Tomasz Duszynski <tdu@semihalf.com> Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
Fiona Trahe [Fri, 9 Mar 2018 17:44:38 +0000 (17:44 +0000)]
cryptodev: change argument of driver registration
Pass an rte_driver to the RTE_PMD_REGISTER_CRYPTO_DRIVER macro
rather than an unspecified container which holds an rte_driver.
All the macro actually needs is the rte_driver, not the
container holding it.
This paves the way for a later patch in which a driver
will be registered which does not naturally derive from a
container and so avoids having to create an arbitrary container
to pass in the rte_driver.
This patch changes the cryptodev lib macro and all the
PMDs which use it.
Maxime Coquelin [Wed, 14 Mar 2018 16:31:25 +0000 (17:31 +0100)]
vhost: deprecate unsafe GPA translation API
This patch marks rte_vhost_gpa_to_vva() as deprecated because
it is unsafe. Application relying on this API should move
to the new rte_vhost_va_from_guest_pa() API, and check
returned length to avoid out-of-bound accesses.
This issue has been assigned CVE-2018-1059.
Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Maxime Coquelin [Thu, 19 Apr 2018 08:52:33 +0000 (10:52 +0200)]
vhost/crypto: move to safe GPA translation API
This patch uses the new rte_vhost_va_from_guest_pa() API
to ensure all the descriptor buffer is mapped contiguously
in the application virtual address space.
It does not handle buffers discontiguous in host virtual
address space, but only return an error.
This issue has been assigned CVE-2018-1059.
Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Maxime Coquelin [Wed, 14 Mar 2018 15:46:46 +0000 (16:46 +0100)]
examples/vhost_scsi: move to safe GPA translation API
This patch uses the new rte_vhost_va_from_guest_pa() API
to ensure all the descriptor buffer is mapped contiguously
in the application virtual address space.
As the application did not checked return of previous API,
this patch just print an error if the buffer address isn't in
the vhost memory regions or if it is scattered. Ideally, it
should handle scattered buffers gracefully.
This issue has been assigned CVE-2018-1059.
Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Maxime Coquelin [Tue, 13 Mar 2018 18:43:48 +0000 (19:43 +0100)]
examples/vhost: move to safe GPA translation API
This patch uses the new rte_vhost_va_from_guest_pa() API
to ensure the application doesn't perform out-of-bound
accesses either because of a malicious guest providing an
incorrect descriptor length, or because the buffer is
contiguous in guest physical address space but not in the
host process virtual address space.
This issue has been assigned CVE-2018-1059.
Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Maxime Coquelin [Tue, 23 Jan 2018 13:37:50 +0000 (14:37 +0100)]
vhost: introduce safe API for GPA translation
This new rte_vhost_va_from_guest_pa API takes an extra len
parameter, used to specify the size of the range to be mapped.
Effective mapped range is returned via len parameter.
This issue has been assigned CVE-2018-1059.
Reported-by: Yongji Xie <xieyongji@baidu.com> Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Maxime Coquelin [Tue, 23 Jan 2018 13:26:02 +0000 (14:26 +0100)]
vhost: check all range is mapped when translating GPAs
There is currently no check done on the length when translating
guest addresses into host virtual addresses. Also, there is no
guanrantee that the guest addresses range is contiguous in
the host virtual address space.
This patch prepares vhost_iova_to_vva() and its callers to
return and check the mapped size. If the mapped size is smaller
than the requested size, the caller handle it as an error.
This issue has been assigned CVE-2018-1059.
Reported-by: Yongji Xie <xieyongji@baidu.com> Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
This patch fixes the size passed at the indirect descriptor
table translation time, which is the len field of the descriptor,
and not a single descriptor.
This issue has been assigned CVE-2018-1059.
Fixes: 62fdb8255ae7 ("vhost: use the guest IOVA to host VA helper") Signed-off-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Thomas Monjalon [Thu, 19 Apr 2018 23:53:10 +0000 (01:53 +0200)]
mbuf: improve tunnel Tx offloads API doc
Add few details to remind TSO flag, checksum flags and header lengths.
The doxygen syntax for MPLS-in-UDP is fixed.
Fixes: d95188551fa1 ("mbuf: introduce new Tx offload flag for MPLS-in-UDP") Cc: stable@dpdk.org Signed-off-by: Thomas Monjalon <thomas@monjalon.net> Acked-by: Olivier Matz <olivier.matz@6wind.com>
Thomas Monjalon [Thu, 19 Apr 2018 23:39:52 +0000 (01:39 +0200)]
mbuf: fix Tx checksum offload API doc
When introducing rte_eth_tx_prepare(), the constraints on checksum
pre-filling for Tx offloads were relaxed because implemented in
the PMDs with rte_net_intel_cksum_flags_prepare() helper.
As a consequence, these old requirements are removed for:
- PKT_TX_OUTER_IP_CKSUM
- PKT_TX_IP_CKSUM
- PKT_TX_[L4]_CKSUM
- PKT_TX_TCP_SEG
Not sure SCTP offload is properly implemented though.
A reference to rte_eth_tx_prepare() is added in rte_eth_tx_burst() doc.
Fixes: 609dd68ef14f ("mbuf: enhance the API documentation of offload flags") Fixes: 4fb7e803eb1a ("ethdev: add Tx preparation") Cc: stable@dpdk.org Signed-off-by: Thomas Monjalon <thomas@monjalon.net> Acked-by: Olivier Matz <olivier.matz@6wind.com>
Thomas Monjalon [Mon, 23 Apr 2018 01:18:35 +0000 (03:18 +0200)]
maintainers: fix typo and ordering
Fix logical/alphabetical ordering, spacing, and syntax typo.
Fixes: 8fb3b2576025 ("maintainers: call out subtree committers") Signed-off-by: Thomas Monjalon <thomas@monjalon.net> Acked-by: Pablo de Lara <pablo.de.lara.guarch@intel.com>
Tomasz Duszynski [Wed, 11 Apr 2018 11:45:07 +0000 (13:45 +0200)]
net/mvpp2: add to meson build
Add support for building MRVL MVPP2 PMD with meson. To avoid cluttering
the build environment and to keep all relevant settings local to a cross
build we get MUSDK library installation path from a meson option.
Signed-off-by: Tomasz Duszynski <tdu@semihalf.com> Acked-by: Bruce Richardson <bruce.richardson@intel.com>
Jerin Jacob [Mon, 9 Apr 2018 14:39:46 +0000 (20:09 +0530)]
build: fix default arm64 instruction level
The make based build system has crc+crypto instruction
support for the default arm64 build.
http://dpdk.org/browse/dpdk/tree/mk/machine/armv8a/rte.vars.mk#n31
This patch fixes the disparity with meson build flags for armv8.
As a bonus, This patch fixes the following errors with
ip_pipeline example application.
Assembler messages:
Error: selected processor does not support `crc32cx w3,w3,x0'
Fixes: c6e536e38437 ("build: add more implementers IDs and PNs for ARM") Signed-off-by: Jerin Jacob <jerin.jacob@caviumnetworks.com> Tested-by: Bruce Richardson <bruce.richardson@intel.com> Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
Bruce Richardson [Thu, 29 Mar 2018 13:54:36 +0000 (14:54 +0100)]
drivers/dpaa: reduce meson dependency lists
Meson build currently tracks the dependencies between libraries, which
can often make things easier, but has the side-effect of slowing down
the initial meson run if too many duplicated dependencies are provided.
Therefore, we remove dependencies from the dpaa items where other
dependencies already depend on those. This provides a noticable speed-up
in meson configuration runs when lots of sample apps are included in the
build.
Signed-off-by: Bruce Richardson <bruce.richardson@intel.com> Tested-by: Harry van Haaren <harry.van.haaren@intel.com> Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
Bruce Richardson [Thu, 29 Mar 2018 13:54:35 +0000 (14:54 +0100)]
examples: improve error report for missing meson deps
When a required library is missing on a platform, rather than having
meson report an error about the missing variable, catch the problem
earlier and provide a more readable message.
Signed-off-by: Bruce Richardson <bruce.richardson@intel.com> Tested-by: Harry van Haaren <harry.van.haaren@intel.com>
Bruce Richardson [Thu, 29 Mar 2018 13:54:34 +0000 (14:54 +0100)]
examples: allow building all as part of meson build
To test building all relevant example applications as part of a build, we
add support for the "all" keyword to be passed to the "examples" build
option. Since not all examples can actually be built on all systems,
we also add support for the "build" option inside the sub-dirs. However,
in case where "all" is not used, and a particular example is requested
to be built, we will error out if building the requested app is not
possible.
Signed-off-by: Bruce Richardson <bruce.richardson@intel.com> Tested-by: Harry van Haaren <harry.van.haaren@intel.com>
Bruce Richardson [Thu, 29 Mar 2018 13:54:31 +0000 (14:54 +0100)]
examples: add empty meson files for unsupported ones
A number of example apps are not supported by the meson build system yet,
but to allow future testing with "-Dexamples=all" we add in a placeholder
meson.build file indicating that the apps should not be built.
Signed-off-by: Bruce Richardson <bruce.richardson@intel.com> Tested-by: Harry van Haaren <harry.van.haaren@intel.com>
Bruce Richardson [Thu, 29 Mar 2018 13:48:47 +0000 (14:48 +0100)]
build: remove checks for non-optional libraries
Unless a library cannot be built for a specific platform (generally
BSD), it will always be available. Therefore remove checks for IP
fragmentation and ACL libraries, since these are built for all
platforms.
Signed-off-by: Bruce Richardson <bruce.richardson@intel.com>
build: clean up building kernel modules using meson
The meson.build files for building the kernel modules directory could
be improved now that it is extracted from the EAL. For example, no
global processing is necessary inside the kernel folder, just need to
subdir to the appropriate bsd or linux folder to do the actual work.
To avoid potential race conditions with the BSD module builds when
the kernel build system is creating the dev_if.h and other files,
we serialize the kernel module builds (all 2 of them!) by setting
up each module to depend on all the previous.
Signed-off-by: Bruce Richardson <bruce.richardson@intel.com> Tested-by: Hemant Agrawal <hemant.agrawal@nxp.com>
Vipin Varghese [Mon, 26 Feb 2018 06:22:38 +0000 (11:52 +0530)]
app/pdump: check for ports
In case of application build with shared library mode unless
option '-d' is passed, poll mode driver for devices is not
initialized. Notifying the user just after rte_eal_init is
pro active way of intimating the user.
Ferruh Yigit [Mon, 12 Mar 2018 17:53:08 +0000 (17:53 +0000)]
app/testpmd: print Rx/Tx offload values on start
Which per port offloads are enabled is not clear. Printing offloads
values at forwarding start.
CRC strip offload value was printed in more verbose manner, it is
removed since Rx/Tx offload values covers it and printing only CRC one
can cause confusion.
Hexadecimal offloads values are not very user friendly but preferred to
not create to much noise during forwarding start.
Pablo de Lara [Tue, 17 Apr 2018 13:13:42 +0000 (14:13 +0100)]
eventdev: fix build with icc
ICC complains about variable being used before its value is set.
Since the variable is only assigned in the for loop,
its declaration is moved inside and is initialized.
lib/librte_eventdev/rte_event_timer_adapter.c(708): error #592:
variable "ret" is used before its value is set
RTE_SET_USED(ret);
Fixes: 6750b21bd6af ("eventdev: add default software timer adapter") Signed-off-by: Pablo de Lara <pablo.de.lara.guarch@intel.com> Acked-by: Ferruh Yigit <ferruh.yigit@intel.com> Acked-by: Erik Gabriel Carrillo <erik.g.carrillo@intel.com>
Sometimes gcc does not inline the function despite keyword *inline*,
we observe rte_movX is not inline when doing performance profiling,
so use *always_inline* keyword to force gcc to inline the function.
Signed-off-by: Junjie Chen <junjie.j.chen@intel.com> Acked-by: Bruce Richardson <bruce.richardson@intel.com>
Thomas Monjalon [Thu, 5 Apr 2018 15:33:22 +0000 (17:33 +0200)]
ethdev: deprecate port count function
Some DPDK applications wrongly assume these requirements:
- no hotplug, i.e. ports are never detached
- all allocated ports are available to the application
Such application iterates over ports by its own mean.
The most common pattern is to request the port count and
assume ports with index in the range [0..count[ can be used.
In order to fix this common mistake in all external applications,
the function rte_eth_dev_count is deprecated, while introducing
the new functions rte_eth_dev_count_avail and rte_eth_dev_count_total.
Signed-off-by: Thomas Monjalon <thomas@monjalon.net>
Thomas Monjalon [Thu, 5 Apr 2018 15:33:21 +0000 (17:33 +0200)]
fix ethdev port id validation
Some DPDK applications wrongly assume these requirements:
- no hotplug, i.e. ports are never detached
- all allocated ports are available to the application
Such application assume a valid port index is in the range [0..count[.
There are three consequences when using such wrong design:
- new ports having an index higher than the port count won't be valid
- old ports being detached (RTE_ETH_DEV_UNUSED) can be valid
Such mistake will be less common with growing hotplug awareness.
All applications and examples inside this repository - except testpmd -
must be fixed to use the function rte_eth_dev_is_valid_port.
Signed-off-by: Thomas Monjalon <thomas@monjalon.net>
Thomas Monjalon [Thu, 5 Apr 2018 15:33:20 +0000 (17:33 +0200)]
fix ethdev ports enumeration
Some DPDK applications wrongly assume these requirements:
- no hotplug, i.e. ports are never detached
- all allocated ports are available to the application
Such application iterates over ports by its own mean.
The most common pattern is to request the port count and
assume ports with index in the range [0..count[ can be used.
There are three consequences when using such wrong design:
- new ports having an index higher than the port count won't be seen
- old ports being detached (RTE_ETH_DEV_UNUSED) can be seen as ghosts
- failsafe sub-devices (RTE_ETH_DEV_DEFERRED) will be seen by the application
Such mistake will be less common with growing hotplug awareness.
All applications and examples inside this repository - except testpmd -
must be fixed to use the iterator RTE_ETH_FOREACH_DEV.
Signed-off-by: Thomas Monjalon <thomas@monjalon.net>
ring: relax alignment constraint on ring structure
The initial objective of
commit d9f0d3a1ffd4 ("ring: remove split cacheline build setting")
was to add an empty cache line between the producer and consumer
data (on platform with cache line size = 64B), preventing from
having them on adjacent cache lines.
Following discussion on the mailing list, it appears that this
also imposes an alignment constraint that is not required.
This patch removes the extra alignment constraint and adds the
empty cache lines using padding fields in the structure. The
size of rte_ring structure and the offset of the fields remain
the same on platforms with cache line size = 64B:
While debugging startup issues encountered with Clang (see "eal: fix
undefined behavior in fbarray"), I noticed that fbarray stores indices,
sizes and masks on signed integers involved in bitwise operations.
Such operations almost invariably cause undefined behavior with values that
cannot be represented by the result type, as is often the case with
bit-masks and left-shifts.
This patch replaces them with unsigned integers as a safety measure and
promotes a few internal variables to larger types for consistency.
According to GCC documentation [1], the __builtin_clz() family of functions
yield undefined behavior when fed a zero value. There is one instance in
the fbarray code where this can occur.
Clang (at least version 3.8.0-2ubuntu4) seems much more sensitive to this
than GCC and yields random results when compiling optimized code, as shown
below:
#include <stdio.h>
int main(void)
{
volatile unsigned long long moo;
int x;
$ gcc -O3 -o test test.c && ./test
63
$ clang -O3 -o test test.c && ./test 1742715559
$ clang -O0 -o test test.c && ./test
63
Even 63 can be considered an unexpected result given the number of leading
zeroes should be the full width of the underlying type, i.e. 64.
In practice it causes find_next_n() to sometimes return negative values
interpreted as errors by caller functions, which prevents DPDK applications
from starting due to inability to find free memory segments:
Earlier fix for race condition introduced a bug where mutex
wasn't unlocked if message failed to be sent. Fix all of this
by moving locking out of mp_request_sync() altogether.
We are trying to notify sender that response from current process
should be ignored, but we didn't specify which request this response
was for. Fix by copying request name from the original message.
Fixes: 579a4ccc345c ("eal: ignore IPC messages until init is complete") Signed-off-by: Anatoly Burakov <anatoly.burakov@intel.com> Acked-by: Jianfeng Tan <jianfeng.tan@intel.com>
git.droids-corp.org / dpdk.git / log