1 /* SPDX-License-Identifier: BSD-3-Clause 2 * Copyright 2017,2019-2020 NXP 3 * Copyright(c) 2017-2020 Intel Corporation. 4 */ 5 6 #ifndef _RTE_SECURITY_H_ 7 #define _RTE_SECURITY_H_ 8 9 /** 10 * @file rte_security.h 11 * 12 * RTE Security Common Definitions 13 * 14 */ 15 16 #ifdef __cplusplus 17 extern "C" { 18 #endif 19 20 #include <sys/types.h> 21 22 #include <rte_compat.h> 23 #include <rte_common.h> 24 #include <rte_crypto.h> 25 #include <rte_ip.h> 26 #include <rte_mbuf.h> 27 #include <rte_mbuf_dyn.h> 28 #include <rte_memory.h> 29 #include <rte_mempool.h> 30 31 /** IPSec protocol mode */ 32 enum rte_security_ipsec_sa_mode { 33 RTE_SECURITY_IPSEC_SA_MODE_TRANSPORT = 1, 34 /**< IPSec Transport mode */ 35 RTE_SECURITY_IPSEC_SA_MODE_TUNNEL, 36 /**< IPSec Tunnel mode */ 37 }; 38 39 /** IPSec Protocol */ 40 enum rte_security_ipsec_sa_protocol { 41 RTE_SECURITY_IPSEC_SA_PROTO_AH = 1, 42 /**< AH protocol */ 43 RTE_SECURITY_IPSEC_SA_PROTO_ESP, 44 /**< ESP protocol */ 45 }; 46 47 /** IPSEC tunnel type */ 48 enum rte_security_ipsec_tunnel_type { 49 RTE_SECURITY_IPSEC_TUNNEL_IPV4 = 1, 50 /**< Outer header is IPv4 */ 51 RTE_SECURITY_IPSEC_TUNNEL_IPV6, 52 /**< Outer header is IPv6 */ 53 }; 54 55 /** 56 * IPSEC tunnel header verification mode 57 * 58 * Controls how outer IP header is verified in inbound. 59 */ 60 #define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR 0x1 61 #define RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR 0x2 62 63 /** 64 * Security context for crypto/eth devices 65 * 66 * Security instance for each driver to register security operations. 67 * The application can get the security context from the crypto/eth device id 68 * using the APIs rte_cryptodev_get_sec_ctx()/rte_eth_dev_get_sec_ctx() 69 * This structure is used to identify the device(crypto/eth) for which the 70 * security operations need to be performed. 71 */ 72 struct rte_security_ctx { 73 void *device; 74 /**< Crypto/ethernet device attached */ 75 const struct rte_security_ops *ops; 76 /**< Pointer to security ops for the device */ 77 uint16_t sess_cnt; 78 /**< Number of sessions attached to this context */ 79 uint32_t flags; 80 /**< Flags for security context */ 81 }; 82 83 #define RTE_SEC_CTX_F_FAST_SET_MDATA 0x00000001 84 /**< Driver uses fast metadata update without using driver specific callback */ 85 86 #define RTE_SEC_CTX_F_FAST_GET_UDATA 0x00000002 87 /**< Driver provides udata using fast method without using driver specific 88 * callback. For fast mdata and udata, mbuf dynamic field would be registered 89 * by driver via rte_security_dynfield_register(). 90 */ 91 92 /** 93 * IPSEC tunnel parameters 94 * 95 * These parameters are used to build outbound tunnel headers. 96 */ 97 struct rte_security_ipsec_tunnel_param { 98 enum rte_security_ipsec_tunnel_type type; 99 /**< Tunnel type: IPv4 or IPv6 */ 100 RTE_STD_C11 101 union { 102 struct { 103 struct in_addr src_ip; 104 /**< IPv4 source address */ 105 struct in_addr dst_ip; 106 /**< IPv4 destination address */ 107 uint8_t dscp; 108 /**< IPv4 Differentiated Services Code Point */ 109 uint8_t df; 110 /**< IPv4 Don't Fragment bit */ 111 uint8_t ttl; 112 /**< IPv4 Time To Live */ 113 } ipv4; 114 /**< IPv4 header parameters */ 115 struct { 116 struct in6_addr src_addr; 117 /**< IPv6 source address */ 118 struct in6_addr dst_addr; 119 /**< IPv6 destination address */ 120 uint8_t dscp; 121 /**< IPv6 Differentiated Services Code Point */ 122 uint32_t flabel; 123 /**< IPv6 flow label */ 124 uint8_t hlimit; 125 /**< IPv6 hop limit */ 126 } ipv6; 127 /**< IPv6 header parameters */ 128 }; 129 }; 130 131 /** 132 * IPsec Security Association option flags 133 */ 134 struct rte_security_ipsec_sa_options { 135 /** Extended Sequence Numbers (ESN) 136 * 137 * * 1: Use extended (64 bit) sequence numbers 138 * * 0: Use normal sequence numbers 139 */ 140 uint32_t esn : 1; 141 142 /** UDP encapsulation 143 * 144 * * 1: Do UDP encapsulation/decapsulation so that IPSEC packets can 145 * traverse through NAT boxes. 146 * * 0: No UDP encapsulation 147 */ 148 uint32_t udp_encap : 1; 149 150 /** Copy DSCP bits 151 * 152 * * 1: Copy IPv4 or IPv6 DSCP bits from inner IP header to 153 * the outer IP header in encapsulation, and vice versa in 154 * decapsulation. 155 * * 0: Do not change DSCP field. 156 */ 157 uint32_t copy_dscp : 1; 158 159 /** Copy IPv6 Flow Label 160 * 161 * * 1: Copy IPv6 flow label from inner IPv6 header to the 162 * outer IPv6 header. 163 * * 0: Outer header is not modified. 164 */ 165 uint32_t copy_flabel : 1; 166 167 /** Copy IPv4 Don't Fragment bit 168 * 169 * * 1: Copy the DF bit from the inner IPv4 header to the outer 170 * IPv4 header. 171 * * 0: Outer header is not modified. 172 */ 173 uint32_t copy_df : 1; 174 175 /** Decrement inner packet Time To Live (TTL) field 176 * 177 * * 1: In tunnel mode, decrement inner packet IPv4 TTL or 178 * IPv6 Hop Limit after tunnel decapsulation, or before tunnel 179 * encapsulation. 180 * * 0: Inner packet is not modified. 181 */ 182 uint32_t dec_ttl : 1; 183 184 /** Explicit Congestion Notification (ECN) 185 * 186 * * 1: In tunnel mode, enable outer header ECN Field copied from 187 * inner header in tunnel encapsulation, or inner header ECN 188 * field construction in decapsulation. 189 * * 0: Inner/outer header are not modified. 190 */ 191 uint32_t ecn : 1; 192 193 /** Security statistics 194 * 195 * * 1: Enable per session security statistics collection for 196 * this SA, if supported by the driver. 197 * * 0: Disable per session security statistics collection for this SA. 198 */ 199 uint32_t stats : 1; 200 201 /** Disable IV generation in PMD 202 * 203 * * 1: Disable IV generation in PMD. When disabled, IV provided in 204 * rte_crypto_op will be used by the PMD. 205 * 206 * * 0: Enable IV generation in PMD. When enabled, PMD generated random 207 * value would be used and application is not required to provide 208 * IV. 209 * 210 * Note: For inline cases, IV generation would always need to be handled 211 * by the PMD. 212 */ 213 uint32_t iv_gen_disable : 1; 214 215 /** Verify tunnel header in inbound 216 * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_DST_ADDR``: Verify destination 217 * IP address. 218 * 219 * * ``RTE_SECURITY_IPSEC_TUNNEL_VERIFY_SRC_DST_ADDR``: Verify both 220 * source and destination IP addresses. 221 */ 222 uint32_t tunnel_hdr_verify : 2; 223 224 /** Verify UDP encapsulation ports in inbound 225 * 226 * * 1: Match UDP source and destination ports 227 * * 0: Do not match UDP ports 228 */ 229 uint32_t udp_ports_verify : 1; 230 }; 231 232 /** IPSec security association direction */ 233 enum rte_security_ipsec_sa_direction { 234 RTE_SECURITY_IPSEC_SA_DIR_EGRESS, 235 /**< Encrypt and generate digest */ 236 RTE_SECURITY_IPSEC_SA_DIR_INGRESS, 237 /**< Verify digest and decrypt */ 238 }; 239 240 /** 241 * Configure soft and hard lifetime of an IPsec SA 242 * 243 * Lifetime of an IPsec SA would specify the maximum number of packets or bytes 244 * that can be processed. IPsec operations would start failing once any hard 245 * limit is reached. 246 * 247 * Soft limits can be specified to generate notification when the SA is 248 * approaching hard limits for lifetime. For inline operations, reaching soft 249 * expiry limit would result in raising an eth event for the same. For lookaside 250 * operations, this would result in a warning returned in 251 * ``rte_crypto_op.aux_flags``. 252 */ 253 struct rte_security_ipsec_lifetime { 254 uint64_t packets_soft_limit; 255 /**< Soft expiry limit in number of packets */ 256 uint64_t bytes_soft_limit; 257 /**< Soft expiry limit in bytes */ 258 uint64_t packets_hard_limit; 259 /**< Soft expiry limit in number of packets */ 260 uint64_t bytes_hard_limit; 261 /**< Soft expiry limit in bytes */ 262 }; 263 264 /** 265 * IPsec security association configuration data. 266 * 267 * This structure contains data required to create an IPsec SA security session. 268 */ 269 struct rte_security_ipsec_xform { 270 uint32_t spi; 271 /**< SA security parameter index */ 272 uint32_t salt; 273 /**< SA salt */ 274 struct rte_security_ipsec_sa_options options; 275 /**< various SA options */ 276 enum rte_security_ipsec_sa_direction direction; 277 /**< IPSec SA Direction - Egress/Ingress */ 278 enum rte_security_ipsec_sa_protocol proto; 279 /**< IPsec SA Protocol - AH/ESP */ 280 enum rte_security_ipsec_sa_mode mode; 281 /**< IPsec SA Mode - transport/tunnel */ 282 struct rte_security_ipsec_tunnel_param tunnel; 283 /**< Tunnel parameters, NULL for transport mode */ 284 struct rte_security_ipsec_lifetime life; 285 /**< IPsec SA lifetime */ 286 uint32_t replay_win_sz; 287 /**< Anti replay window size to enable sequence replay attack handling. 288 * replay checking is disabled if the window size is 0. 289 */ 290 }; 291 292 /** 293 * MACsec security session configuration 294 */ 295 struct rte_security_macsec_xform { 296 /** To be Filled */ 297 int dummy; 298 }; 299 300 /** 301 * PDCP Mode of session 302 */ 303 enum rte_security_pdcp_domain { 304 RTE_SECURITY_PDCP_MODE_CONTROL, /**< PDCP control plane */ 305 RTE_SECURITY_PDCP_MODE_DATA, /**< PDCP data plane */ 306 RTE_SECURITY_PDCP_MODE_SHORT_MAC, /**< PDCP short mac */ 307 }; 308 309 /** PDCP Frame direction */ 310 enum rte_security_pdcp_direction { 311 RTE_SECURITY_PDCP_UPLINK, /**< Uplink */ 312 RTE_SECURITY_PDCP_DOWNLINK, /**< Downlink */ 313 }; 314 315 /** PDCP Sequence Number Size selectors */ 316 enum rte_security_pdcp_sn_size { 317 /** PDCP_SN_SIZE_5: 5bit sequence number */ 318 RTE_SECURITY_PDCP_SN_SIZE_5 = 5, 319 /** PDCP_SN_SIZE_7: 7bit sequence number */ 320 RTE_SECURITY_PDCP_SN_SIZE_7 = 7, 321 /** PDCP_SN_SIZE_12: 12bit sequence number */ 322 RTE_SECURITY_PDCP_SN_SIZE_12 = 12, 323 /** PDCP_SN_SIZE_15: 15bit sequence number */ 324 RTE_SECURITY_PDCP_SN_SIZE_15 = 15, 325 /** PDCP_SN_SIZE_18: 18bit sequence number */ 326 RTE_SECURITY_PDCP_SN_SIZE_18 = 18 327 }; 328 329 /** 330 * PDCP security association configuration data. 331 * 332 * This structure contains data required to create a PDCP security session. 333 */ 334 struct rte_security_pdcp_xform { 335 int8_t bearer; /**< PDCP bearer ID */ 336 /** Enable in order delivery, this field shall be set only if 337 * driver/HW is capable. See RTE_SECURITY_PDCP_ORDERING_CAP. 338 */ 339 uint8_t en_ordering; 340 /** Notify driver/HW to detect and remove duplicate packets. 341 * This field should be set only when driver/hw is capable. 342 * See RTE_SECURITY_PDCP_DUP_DETECT_CAP. 343 */ 344 uint8_t remove_duplicates; 345 /** PDCP mode of operation: Control or data */ 346 enum rte_security_pdcp_domain domain; 347 /** PDCP Frame Direction 0:UL 1:DL */ 348 enum rte_security_pdcp_direction pkt_dir; 349 /** Sequence number size, 5/7/12/15/18 */ 350 enum rte_security_pdcp_sn_size sn_size; 351 /** Starting Hyper Frame Number to be used together with the SN 352 * from the PDCP frames 353 */ 354 uint32_t hfn; 355 /** HFN Threshold for key renegotiation */ 356 uint32_t hfn_threshold; 357 /** HFN can be given as a per packet value also. 358 * As we do not have IV in case of PDCP, and HFN is 359 * used to generate IV. IV field can be used to get the 360 * per packet HFN while enq/deq. 361 * If hfn_ovrd field is set, user is expected to set the 362 * per packet HFN in place of IV. PMDs will extract the HFN 363 * and perform operations accordingly. 364 */ 365 uint8_t hfn_ovrd; 366 /** In case of 5G NR, a new protocol (SDAP) header may be set 367 * inside PDCP payload which should be authenticated but not 368 * encrypted. Hence, driver should be notified if SDAP is 369 * enabled or not, so that SDAP header is not encrypted. 370 */ 371 uint8_t sdap_enabled; 372 /** Reserved for future */ 373 uint16_t reserved; 374 }; 375 376 /** DOCSIS direction */ 377 enum rte_security_docsis_direction { 378 RTE_SECURITY_DOCSIS_UPLINK, 379 /**< Uplink 380 * - Decryption, followed by CRC Verification 381 */ 382 RTE_SECURITY_DOCSIS_DOWNLINK, 383 /**< Downlink 384 * - CRC Generation, followed by Encryption 385 */ 386 }; 387 388 /** 389 * DOCSIS security session configuration. 390 * 391 * This structure contains data required to create a DOCSIS security session. 392 */ 393 struct rte_security_docsis_xform { 394 enum rte_security_docsis_direction direction; 395 /**< DOCSIS direction */ 396 }; 397 398 /** 399 * Security session action type. 400 */ 401 enum rte_security_session_action_type { 402 RTE_SECURITY_ACTION_TYPE_NONE, 403 /**< No security actions */ 404 RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO, 405 /**< Crypto processing for security protocol is processed inline 406 * during transmission 407 */ 408 RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL, 409 /**< All security protocol processing is performed inline during 410 * transmission 411 */ 412 RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL, 413 /**< All security protocol processing including crypto is performed 414 * on a lookaside accelerator 415 */ 416 RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO 417 /**< Similar to ACTION_TYPE_NONE but crypto processing for security 418 * protocol is processed synchronously by a CPU. 419 */ 420 }; 421 422 /** Security session protocol definition */ 423 enum rte_security_session_protocol { 424 RTE_SECURITY_PROTOCOL_IPSEC = 1, 425 /**< IPsec Protocol */ 426 RTE_SECURITY_PROTOCOL_MACSEC, 427 /**< MACSec Protocol */ 428 RTE_SECURITY_PROTOCOL_PDCP, 429 /**< PDCP Protocol */ 430 RTE_SECURITY_PROTOCOL_DOCSIS, 431 /**< DOCSIS Protocol */ 432 }; 433 434 /** 435 * Security session configuration 436 */ 437 struct rte_security_session_conf { 438 enum rte_security_session_action_type action_type; 439 /**< Type of action to be performed on the session */ 440 enum rte_security_session_protocol protocol; 441 /**< Security protocol to be configured */ 442 RTE_STD_C11 443 union { 444 struct rte_security_ipsec_xform ipsec; 445 struct rte_security_macsec_xform macsec; 446 struct rte_security_pdcp_xform pdcp; 447 struct rte_security_docsis_xform docsis; 448 }; 449 /**< Configuration parameters for security session */ 450 struct rte_crypto_sym_xform *crypto_xform; 451 /**< Security Session Crypto Transformations */ 452 void *userdata; 453 /**< Application specific userdata to be saved with session */ 454 }; 455 456 struct rte_security_session { 457 void *sess_private_data; 458 /**< Private session material */ 459 uint64_t opaque_data; 460 /**< Opaque user defined data */ 461 }; 462 463 /** 464 * Create security session as specified by the session configuration 465 * 466 * @param instance security instance 467 * @param conf session configuration parameters 468 * @param mp mempool to allocate session objects from 469 * @param priv_mp mempool to allocate session private data objects from 470 * @return 471 * - On success, pointer to session 472 * - On failure, NULL 473 */ 474 struct rte_security_session * 475 rte_security_session_create(struct rte_security_ctx *instance, 476 struct rte_security_session_conf *conf, 477 struct rte_mempool *mp, 478 struct rte_mempool *priv_mp); 479 480 /** 481 * Update security session as specified by the session configuration 482 * 483 * @param instance security instance 484 * @param sess session to update parameters 485 * @param conf update configuration parameters 486 * @return 487 * - On success returns 0 488 * - On failure returns a negative errno value. 489 */ 490 __rte_experimental 491 int 492 rte_security_session_update(struct rte_security_ctx *instance, 493 struct rte_security_session *sess, 494 struct rte_security_session_conf *conf); 495 496 /** 497 * Get the size of the security session data for a device. 498 * 499 * @param instance security instance. 500 * 501 * @return 502 * - Size of the private data, if successful 503 * - 0 if device is invalid or does not support the operation. 504 */ 505 unsigned int 506 rte_security_session_get_size(struct rte_security_ctx *instance); 507 508 /** 509 * Free security session header and the session private data and 510 * return it to its original mempool. 511 * 512 * @param instance security instance 513 * @param sess security session to be freed 514 * 515 * @return 516 * - 0 if successful. 517 * - -EINVAL if session or context instance is NULL. 518 * - -EBUSY if not all device private data has been freed. 519 * - -ENOTSUP if destroying private data is not supported. 520 * - other negative values in case of freeing private data errors. 521 */ 522 int 523 rte_security_session_destroy(struct rte_security_ctx *instance, 524 struct rte_security_session *sess); 525 526 /** Device-specific metadata field type */ 527 typedef uint64_t rte_security_dynfield_t; 528 /** Dynamic mbuf field for device-specific metadata */ 529 extern int rte_security_dynfield_offset; 530 531 /** 532 * @warning 533 * @b EXPERIMENTAL: this API may change without prior notice 534 * 535 * Get pointer to mbuf field for device-specific metadata. 536 * 537 * For performance reason, no check is done, 538 * the dynamic field may not be registered. 539 * @see rte_security_dynfield_is_registered 540 * 541 * @param mbuf packet to access 542 * @return pointer to mbuf field 543 */ 544 __rte_experimental 545 static inline rte_security_dynfield_t * 546 rte_security_dynfield(struct rte_mbuf *mbuf) 547 { 548 return RTE_MBUF_DYNFIELD(mbuf, 549 rte_security_dynfield_offset, 550 rte_security_dynfield_t *); 551 } 552 553 /** 554 * @warning 555 * @b EXPERIMENTAL: this API may change without prior notice 556 * 557 * Check whether the dynamic field is registered. 558 * 559 * @return true if rte_security_dynfield_register() has been called. 560 */ 561 __rte_experimental 562 static inline bool rte_security_dynfield_is_registered(void) 563 { 564 return rte_security_dynfield_offset >= 0; 565 } 566 567 /** Function to call PMD specific function pointer set_pkt_metadata() */ 568 __rte_experimental 569 extern int __rte_security_set_pkt_metadata(struct rte_security_ctx *instance, 570 struct rte_security_session *sess, 571 struct rte_mbuf *m, void *params); 572 573 /** 574 * Updates the buffer with device-specific defined metadata 575 * 576 * @param instance security instance 577 * @param sess security session 578 * @param mb packet mbuf to set metadata on. 579 * @param params device-specific defined parameters 580 * required for metadata 581 * 582 * @return 583 * - On success, zero. 584 * - On failure, a negative value. 585 */ 586 static inline int 587 rte_security_set_pkt_metadata(struct rte_security_ctx *instance, 588 struct rte_security_session *sess, 589 struct rte_mbuf *mb, void *params) 590 { 591 /* Fast Path */ 592 if (instance->flags & RTE_SEC_CTX_F_FAST_SET_MDATA) { 593 *rte_security_dynfield(mb) = 594 (rte_security_dynfield_t)(sess->sess_private_data); 595 return 0; 596 } 597 598 /* Jump to PMD specific function pointer */ 599 return __rte_security_set_pkt_metadata(instance, sess, mb, params); 600 } 601 602 /** Function to call PMD specific function pointer get_userdata() */ 603 __rte_experimental 604 extern void *__rte_security_get_userdata(struct rte_security_ctx *instance, 605 uint64_t md); 606 607 /** 608 * Get userdata associated with the security session. Device specific metadata 609 * provided would be used to uniquely identify the security session being 610 * referred to. This userdata would be registered while creating the session, 611 * and application can use this to identify the SA etc. 612 * 613 * Device specific metadata would be set in mbuf for inline processed inbound 614 * packets. In addition, the same metadata would be set for IPsec events 615 * reported by rte_eth_event framework. 616 * 617 * @param instance security instance 618 * @param md device-specific metadata 619 * 620 * @return 621 * - On success, userdata 622 * - On failure, NULL 623 */ 624 __rte_experimental 625 static inline void * 626 rte_security_get_userdata(struct rte_security_ctx *instance, uint64_t md) 627 { 628 /* Fast Path */ 629 if (instance->flags & RTE_SEC_CTX_F_FAST_GET_UDATA) 630 return (void *)(uintptr_t)md; 631 632 /* Jump to PMD specific function pointer */ 633 return __rte_security_get_userdata(instance, md); 634 } 635 636 /** 637 * Attach a session to a symmetric crypto operation 638 * 639 * @param sym_op crypto operation 640 * @param sess security session 641 */ 642 static inline int 643 __rte_security_attach_session(struct rte_crypto_sym_op *sym_op, 644 struct rte_security_session *sess) 645 { 646 sym_op->sec_session = sess; 647 648 return 0; 649 } 650 651 static inline void * 652 get_sec_session_private_data(const struct rte_security_session *sess) 653 { 654 return sess->sess_private_data; 655 } 656 657 static inline void 658 set_sec_session_private_data(struct rte_security_session *sess, 659 void *private_data) 660 { 661 sess->sess_private_data = private_data; 662 } 663 664 /** 665 * Attach a session to a crypto operation. 666 * This API is needed only in case of RTE_SECURITY_SESS_CRYPTO_PROTO_OFFLOAD 667 * For other rte_security_session_action_type, ol_flags in rte_mbuf may be 668 * defined to perform security operations. 669 * 670 * @param op crypto operation 671 * @param sess security session 672 */ 673 static inline int 674 rte_security_attach_session(struct rte_crypto_op *op, 675 struct rte_security_session *sess) 676 { 677 if (unlikely(op->type != RTE_CRYPTO_OP_TYPE_SYMMETRIC)) 678 return -EINVAL; 679 680 op->sess_type = RTE_CRYPTO_OP_SECURITY_SESSION; 681 682 return __rte_security_attach_session(op->sym, sess); 683 } 684 685 struct rte_security_macsec_stats { 686 uint64_t reserved; 687 }; 688 689 struct rte_security_ipsec_stats { 690 uint64_t ipackets; /**< Successfully received IPsec packets. */ 691 uint64_t opackets; /**< Successfully transmitted IPsec packets.*/ 692 uint64_t ibytes; /**< Successfully received IPsec bytes. */ 693 uint64_t obytes; /**< Successfully transmitted IPsec bytes. */ 694 uint64_t ierrors; /**< IPsec packets receive/decrypt errors. */ 695 uint64_t oerrors; /**< IPsec packets transmit/encrypt errors. */ 696 uint64_t reserved1; /**< Reserved for future use. */ 697 uint64_t reserved2; /**< Reserved for future use. */ 698 }; 699 700 struct rte_security_pdcp_stats { 701 uint64_t reserved; 702 }; 703 704 struct rte_security_docsis_stats { 705 uint64_t reserved; 706 }; 707 708 struct rte_security_stats { 709 enum rte_security_session_protocol protocol; 710 /**< Security protocol to be configured */ 711 712 RTE_STD_C11 713 union { 714 struct rte_security_macsec_stats macsec; 715 struct rte_security_ipsec_stats ipsec; 716 struct rte_security_pdcp_stats pdcp; 717 struct rte_security_docsis_stats docsis; 718 }; 719 }; 720 721 /** 722 * Get security session statistics 723 * 724 * @param instance security instance 725 * @param sess security session 726 * If security session is NULL then global (per security instance) statistics 727 * will be retrieved, if supported. Global statistics collection is not 728 * dependent on the per session statistics configuration. 729 * @param stats statistics 730 * @return 731 * - On success, return 0 732 * - On failure, a negative value 733 */ 734 __rte_experimental 735 int 736 rte_security_session_stats_get(struct rte_security_ctx *instance, 737 struct rte_security_session *sess, 738 struct rte_security_stats *stats); 739 740 /** 741 * Security capability definition 742 */ 743 struct rte_security_capability { 744 enum rte_security_session_action_type action; 745 /**< Security action type*/ 746 enum rte_security_session_protocol protocol; 747 /**< Security protocol */ 748 RTE_STD_C11 749 union { 750 struct { 751 enum rte_security_ipsec_sa_protocol proto; 752 /**< IPsec SA protocol */ 753 enum rte_security_ipsec_sa_mode mode; 754 /**< IPsec SA mode */ 755 enum rte_security_ipsec_sa_direction direction; 756 /**< IPsec SA direction */ 757 struct rte_security_ipsec_sa_options options; 758 /**< IPsec SA supported options */ 759 uint32_t replay_win_sz_max; 760 /**< IPsec Anti Replay Window Size. A '0' value 761 * indicates that Anti Replay is not supported. 762 */ 763 } ipsec; 764 /**< IPsec capability */ 765 struct { 766 /* To be Filled */ 767 int dummy; 768 } macsec; 769 /**< MACsec capability */ 770 struct { 771 enum rte_security_pdcp_domain domain; 772 /**< PDCP mode of operation: Control or data */ 773 uint32_t capa_flags; 774 /**< Capability flags, see RTE_SECURITY_PDCP_* */ 775 } pdcp; 776 /**< PDCP capability */ 777 struct { 778 enum rte_security_docsis_direction direction; 779 /**< DOCSIS direction */ 780 } docsis; 781 /**< DOCSIS capability */ 782 }; 783 784 const struct rte_cryptodev_capabilities *crypto_capabilities; 785 /**< Corresponding crypto capabilities for security capability */ 786 787 uint32_t ol_flags; 788 /**< Device offload flags */ 789 }; 790 791 /** Underlying Hardware/driver which support PDCP may or may not support 792 * packet ordering. Set RTE_SECURITY_PDCP_ORDERING_CAP if it support. 793 * If it is not set, driver/HW assumes packets received are in order 794 * and it will be application's responsibility to maintain ordering. 795 */ 796 #define RTE_SECURITY_PDCP_ORDERING_CAP 0x00000001 797 798 /** Underlying Hardware/driver which support PDCP may or may not detect 799 * duplicate packet. Set RTE_SECURITY_PDCP_DUP_DETECT_CAP if it support. 800 * If it is not set, driver/HW assumes there is no duplicate packet received. 801 */ 802 #define RTE_SECURITY_PDCP_DUP_DETECT_CAP 0x00000002 803 804 #define RTE_SECURITY_TX_OLOAD_NEED_MDATA 0x00000001 805 /**< HW needs metadata update, see rte_security_set_pkt_metadata(). 806 */ 807 808 #define RTE_SECURITY_TX_HW_TRAILER_OFFLOAD 0x00000002 809 /**< HW constructs trailer of packets 810 * Transmitted packets will have the trailer added to them 811 * by hardware. The next protocol field will be based on 812 * the mbuf->inner_esp_next_proto field. 813 */ 814 #define RTE_SECURITY_RX_HW_TRAILER_OFFLOAD 0x00010000 815 /**< HW removes trailer of packets 816 * Received packets have no trailer, the next protocol field 817 * is supplied in the mbuf->inner_esp_next_proto field. 818 * Inner packet is not modified. 819 */ 820 821 /** 822 * Security capability index used to query a security instance for a specific 823 * security capability 824 */ 825 struct rte_security_capability_idx { 826 enum rte_security_session_action_type action; 827 enum rte_security_session_protocol protocol; 828 829 RTE_STD_C11 830 union { 831 struct { 832 enum rte_security_ipsec_sa_protocol proto; 833 enum rte_security_ipsec_sa_mode mode; 834 enum rte_security_ipsec_sa_direction direction; 835 } ipsec; 836 struct { 837 enum rte_security_pdcp_domain domain; 838 uint32_t capa_flags; 839 } pdcp; 840 struct { 841 enum rte_security_docsis_direction direction; 842 } docsis; 843 }; 844 }; 845 846 /** 847 * Returns array of security instance capabilities 848 * 849 * @param instance Security instance. 850 * 851 * @return 852 * - Returns array of security capabilities. 853 * - Return NULL if no capabilities available. 854 */ 855 const struct rte_security_capability * 856 rte_security_capabilities_get(struct rte_security_ctx *instance); 857 858 /** 859 * Query if a specific capability is available on security instance 860 * 861 * @param instance security instance. 862 * @param idx security capability index to match against 863 * 864 * @return 865 * - Returns pointer to security capability on match of capability 866 * index criteria. 867 * - Return NULL if the capability not matched on security instance. 868 */ 869 const struct rte_security_capability * 870 rte_security_capability_get(struct rte_security_ctx *instance, 871 struct rte_security_capability_idx *idx); 872 873 #ifdef __cplusplus 874 } 875 #endif 876 877 #endif /* _RTE_SECURITY_H_ */ 878