DPDK-dev Archive on lore.kernel.org
 help / color / Atom feed
From: Anoob Joseph <anoobj@marvell.com>
To: Akhil Goyal <akhil.goyal@nxp.com>,
	Adrien Mazarguil <adrien.mazarguil@6wind.com>,
	Declan Doherty <declan.doherty@intel.com>,
	Pablo de Lara <pablo.de.lara.guarch@intel.com>,
	Thomas Monjalon <thomas@monjalon.net>
Cc: Anoob Joseph <anoobj@marvell.com>,
	Jerin Jacob <jerinj@marvell.com>,
	Narayana Prasad <pathreya@marvell.com>,
	Ankur Dwivedi <adwivedi@marvell.com>,
	Shahaf Shuler <shahafs@mellanox.com>,
	Hemant Agrawal <hemant.agrawal@nxp.com>,
	Matan Azrad <matan@mellanox.com>,
	Yongseok Koh <yskoh@mellanox.com>,
	Wenzhuo Lu <wenzhuo.lu@intel.com>,
	Konstantin Ananyev <konstantin.ananyev@intel.com>,
	Radu Nicolau <radu.nicolau@intel.com>, <dev@dpdk.org>
Subject: [dpdk-dev] [RFC] ethdev: allow multiple security sessions to use one rte flow
Date: Wed, 24 Jul 2019 19:47:28 +0530
Message-ID: <1563977848-30101-1-git-send-email-anoobj@marvell.com> (raw)

The rte_security API which enables inline protocol/crypto feature
mandates that for every security session an rte_flow is created. This
would internally translate to a rule in the hardware which would do
packet classification.

In rte_securty, one SA would be one security session. And if an rte_flow
need to be created for every session, the number of SAs supported by an
inline implementation would be limited by the number of rte_flows the
PMD would be able to support.

If the fields SPI & IP addresses are allowed to be a range, then this
limitation can be overcome. Multiple flows will be able to use one rule
for SECURITY processing. In this case, the security session provided as
conf would be NULL.

Application should do an rte_flow_validate() to make sure the flow is
supported on the PMD.

Signed-off-by: Anoob Joseph <anoobj@marvell.com>
 lib/librte_ethdev/rte_flow.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/librte_ethdev/rte_flow.h b/lib/librte_ethdev/rte_flow.h
index f3a8fb1..4977d3c 100644
--- a/lib/librte_ethdev/rte_flow.h
+++ b/lib/librte_ethdev/rte_flow.h
@@ -1879,6 +1879,12 @@ struct rte_flow_action_meter {
  * direction.
  * Multiple flows can be configured to use the same security session.
+ *
+ * The NULL value is allowed for security session. If security session is NULL,
+ * then SPI field in ESP flow item and IP addresses in flow items 'IPv4' and
+ * 'IPv6' will be allowed to be a range. The rule thus created can enable
+ * SECURITY processing on multiple flows.
+ *
 struct rte_flow_action_security {
 	void *security_session; /**< Pointer to security session structure. */

             reply index

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-07-24 14:17 Anoob Joseph [this message]
2019-08-02  5:35 ` Anoob Joseph
2019-08-14  9:22   ` Anoob Joseph
2019-08-14 11:07     ` Akhil Goyal
2019-08-15  6:49       ` Anoob Joseph
2019-08-15  9:48         ` Ananyev, Konstantin
2019-08-16  3:24           ` Anoob Joseph
2019-08-16  8:32         ` Akhil Goyal
2019-08-16 10:12           ` Anoob Joseph
2019-08-19  7:09             ` Akhil Goyal
2019-10-08 13:00               ` Yigit, Ferruh
2019-10-09 10:55                 ` [dpdk-dev] [EXT] " Anoob Joseph
2019-12-03  5:32                   ` Anoob Joseph

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1563977848-30101-1-git-send-email-anoobj@marvell.com \
    --to=anoobj@marvell.com \
    --cc=adrien.mazarguil@6wind.com \
    --cc=adwivedi@marvell.com \
    --cc=akhil.goyal@nxp.com \
    --cc=declan.doherty@intel.com \
    --cc=dev@dpdk.org \
    --cc=hemant.agrawal@nxp.com \
    --cc=jerinj@marvell.com \
    --cc=konstantin.ananyev@intel.com \
    --cc=matan@mellanox.com \
    --cc=pablo.de.lara.guarch@intel.com \
    --cc=pathreya@marvell.com \
    --cc=radu.nicolau@intel.com \
    --cc=shahafs@mellanox.com \
    --cc=thomas@monjalon.net \
    --cc=wenzhuo.lu@intel.com \
    --cc=yskoh@mellanox.com \


* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

DPDK-dev Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/dpdk-dev/0 dpdk-dev/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 dpdk-dev dpdk-dev/ https://lore.kernel.org/dpdk-dev \
	public-inbox-index dpdk-dev

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone https://public-inbox.org/public-inbox.git