[dpdk-dev] [PATCH v2 1/2] lib/security: add support for get metadata

[Radu Nicolau]

On 11/22/2017 11:52 AM, Anoob wrote:
> Hi,
>
> See inline.
>
>
> Thanks,
> Anoob
>
> On 11/22/2017 04:59 PM, Radu Nicolau wrote:
>>
>>
>> On 11/22/2017 6:55 AM, Anoob Joseph wrote:
>>> In case of inline protocol processed ingress traffic, the packet may 
>>> not
>>> have enough information to determine the security parameters with which
>>> the packet was processed. For such cases, application could register a
>>> 64 bit metadata in security session, which could be retrieved from the
>>> packet using "rte_security_get_pkt_metadata" API. Application can use
>>> this metadata to identify the parameters it need.
>>>
>>> Application can choose what it should register as the metadata. It can
>>> register SPI or a pointer to SA.
>>>
>>> Signed-off-by: Anoob Joseph <anoob.joseph at caviumnetworks.com>
>>> ---
>>> v2:
>>> * Replaced get_session and get_cookie APIs with get_pkt_metadata API
>>>
>>>   lib/librte_security/rte_security.c        | 13 +++++++++++++
>>>   lib/librte_security/rte_security.h        | 19 +++++++++++++++++++
>>>   lib/librte_security/rte_security_driver.h | 16 ++++++++++++++++
>>>   3 files changed, 48 insertions(+)
>>>
>>> diff --git a/lib/librte_security/rte_security.c 
>>> b/lib/librte_security/rte_security.c
>>> index 1227fca..804f11f 100644
>>> --- a/lib/librte_security/rte_security.c
>>> +++ b/lib/librte_security/rte_security.c
>>> @@ -108,6 +108,19 @@ rte_security_set_pkt_metadata(struct 
>>> rte_security_ctx *instance,
>>>                              sess, m, params);
>>>   }
>>>   +uint64_t
>>> +rte_security_get_pkt_metadata(struct rte_security_ctx *instance,
>>> +                  struct rte_mbuf *pkt)
>>> +{
>>> +    uint64_t mdata = 0;
>>> +
>>> + RTE_FUNC_PTR_OR_ERR_RET(*instance->ops->get_pkt_metadata, 0);
>>> +    if (instance->ops->get_pkt_metadata(instance->device, pkt, 
>>> &mdata))
>>> +        return 0;
>>> +
>>> +    return mdata;
>>> +}
>>> +
>> Can you change the returned type to void *?
> Will do that.
>>>   const struct rte_security_capability *
>>>   rte_security_capabilities_get(struct rte_security_ctx *instance)
>>>   {
>>> diff --git a/lib/librte_security/rte_security.h 
>>> b/lib/librte_security/rte_security.h
>>> index 653929b..aa3a471 100644
>>> --- a/lib/librte_security/rte_security.h
>>> +++ b/lib/librte_security/rte_security.h
>>> @@ -274,6 +274,8 @@ struct rte_security_session_conf {
>>>       /**< Configuration parameters for security session */
>>>       struct rte_crypto_sym_xform *crypto_xform;
>>>       /**< Security Session Crypto Transformations */
>>> +    uint64_t metadata;
>>> +    /**< Metadata registered by application */
>>>   };
>> Can you rename it to userdata?
> Will do it. Thought it would be confusing, as this will be returned by 
> rte_security_get_pkt_metadata. So get_metadata would give userdata of 
> the security session. I can document it that way and proceed, right?
Also make it a pointer please.
You should document it in the PMD documentation, as this is a PMD 
specific behavior. Your PMD returns just the userdata pointer set in the 
security_conf struct, but other PMDs can return different things.
>>>     struct rte_security_session {
>>> @@ -346,6 +348,23 @@ rte_security_set_pkt_metadata(struct 
>>> rte_security_ctx *instance,
>>>                     struct rte_mbuf *mb, void *params);
>>>     /**
>>> + * Get metadata from the packet. This is an application registered 
>>> 64 bit
>>> + * value, associated with the security session which processed the 
>>> packet.
>>> + *
>>> + * This is valid only for inline processed ingress packets.
>>> + *
>>> + * @param   instance    security instance
>>> + * @param   pkt        packet mbuf
>>> + *
>>> + * @return
>>> + *  - On success, metadata
>>> + *  - On failure, 0
>>> + */
>>> +uint64_t
>>> +rte_security_get_pkt_metadata(struct rte_security_ctx *instance,
>>> +                  struct rte_mbuf *pkt);
>>> +
>>> +/**
>>>    * Attach a session to a symmetric crypto operation
>>>    *
>>>    * @param    sym_op    crypto operation
>>> diff --git a/lib/librte_security/rte_security_driver.h 
>>> b/lib/librte_security/rte_security_driver.h
>>> index 997fbe7..da0ebf4 100644
>>> --- a/lib/librte_security/rte_security_driver.h
>>> +++ b/lib/librte_security/rte_security_driver.h
>>> @@ -122,6 +122,20 @@ typedef int (*security_set_pkt_metadata_t)(void 
>>> *device,
>>>           void *params);
>>>     /**
>>> + * Get application interpretable metadata from the packet.
>>> + *
>>> + * @param    device        Crypto/eth device pointer
>>> + * @param    pkt        Packet mbuf
>>> + * @param    mt        Pointer to receive metadata
>>> + *
>>> + * @return
>>> + *  - Returns 0 if metadata is retrieved successfully.
>>> + *  - Returns -ve value for errors.
>>> + */
>>> +typedef int (*security_get_pkt_metadata_t)(void *device,
>>> +        struct rte_mbuf *pkt, uint64_t *mt);
>>> +
>>> +/**
>>>    * Get security capabilities of the device.
>>>    *
>>>    * @param    device        crypto/eth device pointer
>>> @@ -145,6 +159,8 @@ struct rte_security_ops {
>>>       /**< Clear a security sessions private data. */
>>>       security_set_pkt_metadata_t set_pkt_metadata;
>>>       /**< Update mbuf metadata. */
>>> +    security_get_pkt_metadata_t get_pkt_metadata;
>>> +    /**< Get metadata from packet. */
>>>       security_capabilities_get_t capabilities_get;
>>>       /**< Get security capabilities. */
>>>   };
>>
>