1 /* SPDX-License-Identifier: BSD-3-Clause
2 * Copyright(C) 2021 Marvell.
3 */
4
5 #ifndef __CN9K_IPSEC_LA_OPS_H__
6 #define __CN9K_IPSEC_LA_OPS_H__
7
8 #include <rte_crypto_sym.h>
9 #include <rte_esp.h>
10 #include <rte_security.h>
11
12 #include "cn9k_ipsec.h"
13 #include "cnxk_security_ar.h"
14
15 static __rte_always_inline int32_t
ipsec_po_out_rlen_get(struct cn9k_ipsec_sa * sa,uint32_t plen)16 ipsec_po_out_rlen_get(struct cn9k_ipsec_sa *sa, uint32_t plen)
17 {
18 uint32_t enc_payload_len;
19
20 enc_payload_len = RTE_ALIGN_CEIL(plen + sa->rlens.roundup_len,
21 sa->rlens.roundup_byte);
22
23 return sa->rlens.partial_len + enc_payload_len;
24 }
25
26 static __rte_always_inline int
ipsec_antireplay_check(struct cn9k_ipsec_sa * sa,uint32_t win_sz,struct rte_mbuf * m)27 ipsec_antireplay_check(struct cn9k_ipsec_sa *sa, uint32_t win_sz,
28 struct rte_mbuf *m)
29 {
30 uint32_t esn_low = 0, esn_hi = 0, seql = 0, seqh = 0;
31 struct roc_ie_on_common_sa *common_sa;
32 struct roc_ie_on_inb_sa *in_sa;
33 struct roc_ie_on_sa_ctl *ctl;
34 uint64_t seq_in_sa, seq = 0;
35 struct rte_esp_hdr *esp;
36 uint8_t esn;
37 int ret;
38
39 in_sa = &sa->in_sa;
40 common_sa = &in_sa->common_sa;
41 ctl = &common_sa->ctl;
42
43 esn = ctl->esn_en;
44 esn_low = rte_be_to_cpu_32(common_sa->esn_low);
45 esn_hi = rte_be_to_cpu_32(common_sa->esn_hi);
46
47 esp = rte_pktmbuf_mtod_offset(m, void *, sizeof(struct rte_ipv4_hdr));
48 seql = rte_be_to_cpu_32(esp->seq);
49
50 if (!esn) {
51 seq = (uint64_t)seql;
52 } else {
53 seqh = cnxk_on_anti_replay_get_seqh(win_sz, seql, esn_hi,
54 esn_low);
55 seq = ((uint64_t)seqh << 32) | seql;
56 }
57
58 if (unlikely(seq == 0))
59 return IPSEC_ANTI_REPLAY_FAILED;
60
61 ret = cnxk_on_anti_replay_check(seq, &sa->ar, win_sz);
62 if (esn && !ret) {
63 seq_in_sa = ((uint64_t)esn_hi << 32) | esn_low;
64 if (seq > seq_in_sa) {
65 common_sa->esn_low = rte_cpu_to_be_32(seql);
66 common_sa->esn_hi = rte_cpu_to_be_32(seqh);
67 }
68 }
69
70 return ret;
71 }
72
73 static __rte_always_inline int
process_outb_sa(struct rte_crypto_op * cop,struct cn9k_ipsec_sa * sa,struct cpt_inst_s * inst)74 process_outb_sa(struct rte_crypto_op *cop, struct cn9k_ipsec_sa *sa,
75 struct cpt_inst_s *inst)
76 {
77 const unsigned int hdr_len = sa->custom_hdr_len;
78 struct rte_crypto_sym_op *sym_op = cop->sym;
79 struct rte_mbuf *m_src = sym_op->m_src;
80 struct roc_ie_on_outb_sa *out_sa;
81 struct roc_ie_on_outb_hdr *hdr;
82 uint32_t dlen, rlen;
83 int32_t extend_tail;
84
85 out_sa = &sa->out_sa;
86
87 dlen = rte_pktmbuf_pkt_len(m_src) + hdr_len;
88 rlen = ipsec_po_out_rlen_get(sa, dlen - hdr_len);
89
90 extend_tail = rlen - dlen;
91 if (unlikely(extend_tail > rte_pktmbuf_tailroom(m_src))) {
92 plt_dp_err("Not enough tail room (required: %d, available: %d",
93 extend_tail, rte_pktmbuf_tailroom(m_src));
94 return -ENOMEM;
95 }
96
97 m_src->data_len += extend_tail;
98 m_src->pkt_len += extend_tail;
99
100 hdr = (struct roc_ie_on_outb_hdr *)rte_pktmbuf_prepend(m_src, hdr_len);
101 if (unlikely(hdr == NULL)) {
102 plt_dp_err("Not enough head room");
103 return -ENOMEM;
104 }
105
106 #ifdef LA_IPSEC_DEBUG
107 if (sa->inst.w4 & ROC_IE_ON_PER_PKT_IV) {
108 memcpy(&hdr->iv[0],
109 rte_crypto_op_ctod_offset(cop, uint8_t *,
110 sa->cipher_iv_off),
111 sa->cipher_iv_len);
112 }
113 #endif
114
115 hdr->seq = rte_cpu_to_be_32(sa->seq_lo);
116 hdr->ip_id = rte_cpu_to_be_32(sa->ip_id);
117
118 out_sa->common_sa.esn_hi = sa->seq_hi;
119
120 sa->ip_id++;
121 sa->esn++;
122
123 /* Prepare CPT instruction */
124 inst->w4.u64 = sa->inst.w4 | dlen;
125 inst->dptr = rte_pktmbuf_iova(m_src);
126 inst->rptr = inst->dptr;
127 inst->w7.u64 = sa->inst.w7;
128
129 return 0;
130 }
131
132 static __rte_always_inline int
process_inb_sa(struct rte_crypto_op * cop,struct cn9k_ipsec_sa * sa,struct cpt_inst_s * inst)133 process_inb_sa(struct rte_crypto_op *cop, struct cn9k_ipsec_sa *sa,
134 struct cpt_inst_s *inst)
135 {
136 struct rte_crypto_sym_op *sym_op = cop->sym;
137 struct rte_mbuf *m_src = sym_op->m_src;
138 int ret;
139
140 if (sa->replay_win_sz) {
141 ret = ipsec_antireplay_check(sa, sa->replay_win_sz, m_src);
142 if (unlikely(ret)) {
143 /* Use PASSTHROUGH op for failed antireplay packet */
144 inst->w4.u64 = 0;
145 inst->w4.s.opcode_major = ROC_SE_MAJOR_OP_MISC;
146 inst->w4.s.opcode_minor =
147 ROC_SE_MISC_MINOR_OP_PASSTHROUGH;
148 inst->w4.s.param1 = 1;
149 /* Send out completion code only */
150 inst->w4.s.param2 =
151 (ROC_IE_ON_SWCC_ANTI_REPLAY << 8) | 0x1;
152 inst->w4.s.dlen = 1;
153 inst->dptr = rte_pktmbuf_iova(m_src);
154 inst->rptr = inst->dptr;
155 inst->w7.u64 = sa->inst.w7;
156 return 0;
157 }
158 }
159
160 /* Prepare CPT instruction */
161 inst->w4.u64 = sa->inst.w4 | rte_pktmbuf_pkt_len(m_src);
162 inst->dptr = rte_pktmbuf_iova(m_src);
163 inst->rptr = inst->dptr;
164 inst->w7.u64 = sa->inst.w7;
165
166 return 0;
167 }
168 #endif /* __CN9K_IPSEC_LA_OPS_H__ */
169