Adding new features and improvements in cnxk crypto PMD

index 6ebf0846f5..035d61180a 100644
@@ -500,8 +500,10 @@ cnxk_ot_ipsec_outb_sa_fill(struct roc_ot_ipsec_outb_sa *sa,
 	offset = offsetof(struct roc_ot_ipsec_outb_sa, ctx);
 	/* Word offset for HW managed SA field */
 	sa->w0.s.hw_ctx_off = offset / 8;
-	/* Context push size is up to hmac_opad_ipad */
-	sa->w0.s.ctx_push_size = sa->w0.s.hw_ctx_off;
+
+	/* Context push size is up to err ctl in HW ctx */
+	sa->w0.s.ctx_push_size = sa->w0.s.hw_ctx_off + 1;
+
 	/* Entire context size in 128B units */
 	offset = sizeof(struct roc_ot_ipsec_outb_sa);
 	sa->w0.s.ctx_size = (PLT_ALIGN_CEIL(offset, ROC_CTX_UNIT_128B) /

index 923656f4a5..c502c7983f 100644
@@ -153,6 +153,13 @@ enum {
 	ROC_IE_OT_REAS_STS_L3P_ERR = 8,
 	ROC_IE_OT_REAS_STS_MAX = 9
 };
+
+enum {
+	ROC_IE_OT_ERR_CTL_MODE_NONE = 0,
+	ROC_IE_OT_ERR_CTL_MODE_CLEAR = 1,
+	ROC_IE_OT_ERR_CTL_MODE_RING = 2,
+};
+
 /* Context units in bytes */
 #define ROC_CTX_UNIT_8B		  8
 #define ROC_CTX_UNIT_128B	  128

@@ -235,7 +242,15 @@ union roc_ot_ipsec_outb_iv {
 };
 
 struct roc_ot_ipsec_outb_ctx_update_reg {
-	uint64_t rsvd;
+	union {
+		struct {
+			uint64_t reserved_0_2 : 3;
+			uint64_t address : 57;
+			uint64_t mode : 4;
+		} s;
+		uint64_t u64;
+	} err_ctl;
+
 	uint64_t esn_val;
 	uint64_t hard_life;
 	uint64_t soft_life;

index 035d61180a..718983d892 100644
@@ -492,6 +492,9 @@ cnxk_ot_ipsec_outb_sa_fill(struct roc_ot_ipsec_outb_sa *sa,
 	/* ESN */
 	sa->w0.s.esn_en = !!ipsec_xfrm->options.esn;
 
+	if (ipsec_xfrm->esn.value)
+		sa->ctx.esn_val = ipsec_xfrm->esn.value - 1;
+
 	if (ipsec_xfrm->options.udp_encap) {
 		sa->w10.s.udp_src_port = 4500;
 		sa->w10.s.udp_dst_port = 4500;

index 3ec4c296c2..deb38db0d0 100644
@@ -13,7 +13,7 @@
 
 /* u64 array size to fit anti replay window bits */
 #define AR_WIN_ARR_SZ                                                          \
-	(PLT_ALIGN_CEIL(CNXK_ON_AR_WIN_SIZE_MAX, BITS_PER_LONG_LONG) /        \
+	(PLT_ALIGN_CEIL(CNXK_ON_AR_WIN_SIZE_MAX + 1, BITS_PER_LONG_LONG) /     \
 	 BITS_PER_LONG_LONG)
 
 #define WORD_SHIFT 6

index aaad87243f..638b02062d 100644
@@ -18,6 +18,8 @@ enum roc_ie_on_ucc_ipsec {
 	ROC_IE_ON_UCC_SUCCESS = 0,
 	ROC_IE_ON_AUTH_UNSUPPORTED = 0xB0,
 	ROC_IE_ON_ENCRYPT_UNSUPPORTED = 0xB1,
+	/* Software defined completion code for anti-replay failed packets */
+	ROC_IE_ON_SWCC_ANTI_REPLAY = 0xE7,
 };
 
 /* Helper macros */

index 7f4ccaff99..c95c57a84d 100644
@@ -239,7 +239,7 @@ cn10k_ipsec_inb_sa_create(struct roc_cpt *roc_cpt, struct roc_cpt_lf *lf,
 	}
 
 	/* Trigger CTX flush so that data is written back to DRAM */
-	roc_cpt_lf_ctx_flush(lf, in_sa, false);
+	roc_cpt_lf_ctx_flush(lf, in_sa, true);
 
 	plt_atomic_thread_fence(__ATOMIC_SEQ_CST);
 

@@ -410,6 +410,39 @@ cn10k_sec_session_stats_get(void *device, struct rte_security_session *sess,
 	return 0;
 }
 
+static int
+cn10k_sec_session_update(void *device, struct rte_security_session *sess,
+			 struct rte_security_session_conf *conf)
+{
+	struct rte_cryptodev *crypto_dev = device;
+	struct cn10k_sec_session *priv;
+	struct roc_cpt *roc_cpt;
+	struct cnxk_cpt_qp *qp;
+	struct cnxk_cpt_vf *vf;
+	int ret;
+
+	priv = get_sec_session_private_data(sess);
+	if (priv == NULL)
+		return -EINVAL;
+
+	qp = crypto_dev->data->queue_pairs[0];
+	if (qp == NULL)
+		return -EINVAL;
+
+	if (conf->ipsec.direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
+		return -ENOTSUP;
+
+	ret = cnxk_ipsec_xform_verify(&conf->ipsec, conf->crypto_xform);
+	if (ret)
+		return ret;
+
+	vf = crypto_dev->data->dev_private;
+	roc_cpt = &vf->cpt;
+
+	return cn10k_ipsec_outb_sa_create(roc_cpt, &qp->lf, &conf->ipsec,
+					  conf->crypto_xform, sess);
+}
+
 /* Update platform specific security ops */
 void
 cn10k_sec_ops_override(void)

@@ -419,4 +452,5 @@ cn10k_sec_ops_override(void)
 	cnxk_sec_ops.session_destroy = cn10k_sec_session_destroy;
 	cnxk_sec_ops.session_get_size = cn10k_sec_session_get_size;
 	cnxk_sec_ops.session_stats_get = cn10k_sec_session_stats_get;
+	cnxk_sec_ops.session_update = cn10k_sec_session_update;
 }

71 lines not on this page · raw message

index 9a1e217042..df89aaca4e 100644
@@ -140,8 +140,20 @@ process_inb_sa(struct rte_crypto_op *cop, struct cn9k_ipsec_sa *sa,
 	if (sa->replay_win_sz) {
 		ret = ipsec_antireplay_check(sa, sa->replay_win_sz, m_src);
 		if (unlikely(ret)) {
-			plt_dp_err("Anti replay check failed");
-			return ret;
+			/* Use PASSTHROUGH op for failed antireplay packet */
+			inst->w4.u64 = 0;
+			inst->w4.s.opcode_major = ROC_SE_MAJOR_OP_MISC;
+			inst->w4.s.opcode_minor =
+				ROC_SE_MISC_MINOR_OP_PASSTHROUGH;
+			inst->w4.s.param1 = 1;
+			/* Send out completion code only */
+			inst->w4.s.param2 =
+				(ROC_IE_ON_SWCC_ANTI_REPLAY << 8) | 0x1;
+			inst->w4.s.dlen = 1;
+			inst->dptr = rte_pktmbuf_iova(m_src);
+			inst->rptr = inst->dptr;
+			inst->w7.u64 = sa->inst.w7;
+			return 0;
 		}
 	}
 

index f8c007e320..04402a4b46 100644
@@ -9,6 +9,7 @@
 
 #include "cnxk_cryptodev.h"
 #include "cnxk_cryptodev_capabilities.h"
+#include "cnxk_security_ar.h"
 
 #define CPT_CAPS_ADD(cnxk_caps, cur_pos, hw_caps, name)                        \
 	do {                                                                   \

@@ -1161,6 +1162,8 @@ cn10k_sec_caps_update(struct rte_security_capability *sec_cap)
 	sec_cap->ipsec.options.ip_csum_enable = 1;
 	sec_cap->ipsec.options.l4_csum_enable = 1;
 	sec_cap->ipsec.options.stats = 1;
+	sec_cap->ipsec.options.esn = 1;
+	sec_cap->ipsec.replay_win_sz_max = ROC_AR_WIN_SIZE_MAX;
 }
 
 static void

@@ -1171,6 +1174,7 @@ cn9k_sec_caps_update(struct rte_security_capability *sec_cap)
 		sec_cap->ipsec.options.iv_gen_disable = 1;
 #endif
 	}
+	sec_cap->ipsec.replay_win_sz_max = CNXK_ON_AR_WIN_SIZE_MAX;
 }
 
 void

index 5f78823642..38e2087a26 100644
@@ -4,8 +4,9 @@
 #ifndef _ROC_CONSTANTS_H_
 #define _ROC_CONSTANTS_H_
 
-/* Alignment */
-#define ROC_ALIGN 128
+/* ROC Cache */
+#define ROC_CACHE_LINE_SZ 128
+#define ROC_ALIGN	  ROC_CACHE_LINE_SZ
 
 /* LMTST constants */
 /* [CN10K, .) */

index e521f07585..0656ba9675 100644
@@ -40,7 +40,9 @@ struct cpt_inflight_req {
 	void *mdata;
 	uint8_t op_flags;
 	void *qp;
-} __rte_aligned(16);
+} __rte_aligned(ROC_ALIGN);
+
+PLT_STATIC_ASSERT(sizeof(struct cpt_inflight_req) == ROC_CACHE_LINE_SZ);
 
 struct pending_queue {
 	/** Array of pending requests */

index 1bc7a29ef9..4e24850366 100644
@@ -568,9 +568,6 @@ cpt_lf_init(struct roc_cpt_lf *lf)
 	if (lf->nb_desc == 0 || lf->nb_desc > CPT_LF_MAX_NB_DESC)
 		lf->nb_desc = CPT_LF_DEFAULT_NB_DESC;
 
-	/* Update nb_desc to next power of 2 to aid in pending queue checks */
-	lf->nb_desc = plt_align32pow2(lf->nb_desc);
-
 	/* Allocate memory for instruction queue for CPT LF. */
 	iq_mem = plt_zmalloc(cpt_lf_iq_mem_calc(lf->nb_desc), ROC_ALIGN);
 	if (iq_mem == NULL)

index 67a2d9b08e..a5fb68da02 100644
@@ -361,6 +361,7 @@ cnxk_cpt_queue_pair_setup(struct rte_cryptodev *dev, uint16_t qp_id,
 	struct roc_cpt *roc_cpt = &vf->cpt;
 	struct rte_pci_device *pci_dev;
 	struct cnxk_cpt_qp *qp;
+	uint32_t nb_desc;
 	int ret;
 
 	if (dev->data->queue_pairs[qp_id] != NULL)

@@ -373,14 +374,17 @@ cnxk_cpt_queue_pair_setup(struct rte_cryptodev *dev, uint16_t qp_id,
 		return -EIO;
 	}
 
-	qp = cnxk_cpt_qp_create(dev, qp_id, conf->nb_descriptors);
+	/* Update nb_desc to next power of 2 to aid in pending queue checks */
+	nb_desc = plt_align32pow2(conf->nb_descriptors);
+
+	qp = cnxk_cpt_qp_create(dev, qp_id, nb_desc);
 	if (qp == NULL) {
 		plt_err("Could not create queue pair %d", qp_id);
 		return -ENOMEM;
 	}
 
 	qp->lf.lf_id = qp_id;
-	qp->lf.nb_desc = conf->nb_descriptors;
+	qp->lf.nb_desc = nb_desc;
 
 	ret = roc_cpt_lf_init(roc_cpt, &qp->lf);
 	if (ret < 0) {