1 /*- 2 * BSD LICENSE 3 * 4 * Copyright(c) 2010-2017 Intel Corporation. All rights reserved. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * * Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * * Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in 15 * the documentation and/or other materials provided with the 16 * distribution. 17 * * Neither the name of Intel Corporation nor the names of its 18 * contributors may be used to endorse or promote products derived 19 * from this software without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 22 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 23 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 24 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 25 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 26 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 27 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 31 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 32 */ 33 34 #ifndef IXGBE_IPSEC_H_ 35 #define IXGBE_IPSEC_H_ 36 37 #include <rte_security.h> 38 39 #define IPSRXIDX_RX_EN 0x00000001 40 #define IPSRXIDX_TABLE_IP 0x00000002 41 #define IPSRXIDX_TABLE_SPI 0x00000004 42 #define IPSRXIDX_TABLE_KEY 0x00000006 43 #define IPSRXIDX_WRITE 0x80000000 44 #define IPSRXIDX_READ 0x40000000 45 #define IPSRXMOD_VALID 0x00000001 46 #define IPSRXMOD_PROTO 0x00000004 47 #define IPSRXMOD_DECRYPT 0x00000008 48 #define IPSRXMOD_IPV6 0x00000010 49 #define IXGBE_ADVTXD_POPTS_IPSEC 0x00000400 50 #define IXGBE_ADVTXD_TUCMD_IPSEC_TYPE_ESP 0x00002000 51 #define IXGBE_ADVTXD_TUCMD_IPSEC_ENCRYPT_EN 0x00004000 52 #define IXGBE_RXDADV_IPSEC_STATUS_SECP 0x00020000 53 #define IXGBE_RXDADV_IPSEC_ERROR_BIT_MASK 0x18000000 54 #define IXGBE_RXDADV_IPSEC_ERROR_INVALID_PROTOCOL 0x08000000 55 #define IXGBE_RXDADV_IPSEC_ERROR_INVALID_LENGTH 0x10000000 56 #define IXGBE_RXDADV_IPSEC_ERROR_AUTHENTICATION_FAILED 0x18000000 57 58 #define IPSEC_MAX_RX_IP_COUNT 128 59 #define IPSEC_MAX_SA_COUNT 1024 60 61 #define ESP_ICV_SIZE 16 62 #define ESP_TRAILER_SIZE 2 63 64 enum ixgbe_operation { 65 IXGBE_OP_AUTHENTICATED_ENCRYPTION, 66 IXGBE_OP_AUTHENTICATED_DECRYPTION 67 }; 68 69 enum ixgbe_gcm_key { 70 IXGBE_GCM_KEY_128, 71 IXGBE_GCM_KEY_256 72 }; 73 74 /** 75 * Generic IP address structure 76 * TODO: Find better location for this rte_net.h possibly. 77 **/ 78 struct ipaddr { 79 enum ipaddr_type { 80 IPv4, 81 IPv6 82 } type; 83 /**< IP Address Type - IPv4/IPv6 */ 84 85 union { 86 uint32_t ipv4; 87 uint32_t ipv6[4]; 88 }; 89 }; 90 91 /** inline crypto crypto private session structure */ 92 struct ixgbe_crypto_session { 93 enum ixgbe_operation op; 94 uint8_t *key; 95 uint32_t salt; 96 uint32_t sa_index; 97 uint32_t spi; 98 struct ipaddr src_ip; 99 struct ipaddr dst_ip; 100 struct rte_eth_dev *dev; 101 } __rte_cache_aligned; 102 103 struct ixgbe_crypto_rx_ip_table { 104 struct ipaddr ip; 105 uint16_t ref_count; 106 }; 107 struct ixgbe_crypto_rx_sa_table { 108 uint32_t spi; 109 uint32_t ip_index; 110 uint32_t key[4]; 111 uint32_t salt; 112 uint8_t mode; 113 uint8_t used; 114 }; 115 116 struct ixgbe_crypto_tx_sa_table { 117 uint32_t spi; 118 uint32_t key[4]; 119 uint32_t salt; 120 uint8_t used; 121 }; 122 123 union ixgbe_crypto_tx_desc_md { 124 uint64_t data; 125 struct { 126 /**< SA table index */ 127 uint32_t sa_idx; 128 /**< ICV and ESP trailer length */ 129 uint8_t pad_len; 130 /**< enable encryption */ 131 uint8_t enc; 132 }; 133 }; 134 135 struct ixgbe_ipsec { 136 struct ixgbe_crypto_rx_ip_table rx_ip_tbl[IPSEC_MAX_RX_IP_COUNT]; 137 struct ixgbe_crypto_rx_sa_table rx_sa_tbl[IPSEC_MAX_SA_COUNT]; 138 struct ixgbe_crypto_tx_sa_table tx_sa_tbl[IPSEC_MAX_SA_COUNT]; 139 }; 140 141 142 struct rte_security_ctx * 143 ixgbe_ipsec_ctx_create(struct rte_eth_dev *dev); 144 int ixgbe_crypto_enable_ipsec(struct rte_eth_dev *dev); 145 int ixgbe_crypto_add_ingress_sa_from_flow(const void *sess, 146 const void *ip_spec, 147 uint8_t is_ipv6); 148 149 150 151 #endif /*IXGBE_IPSEC_H_*/ 152