From: Rahul Bhansali <rbhansali@marvell.com>
To: <dev@dpdk.org>, Nithin Dabilpuram <ndabilpuram@marvell.com>,
Kiran Kumar K <kirankumark@marvell.com>,
Sunil Kumar Kori <skori@marvell.com>,
Satha Rao <skoteshwar@marvell.com>,
Harman Kalra <hkalra@marvell.com>
Cc: <jerinj@marvell.com>, Rahul Bhansali <rbhansali@marvell.com>
Subject: [PATCH v2 6/8] net/cnxk: update SA context push size
Date: Thu, 26 Feb 2026 18:47:13 +0530 [thread overview]
Message-ID: <20260226131715.2851091-6-rbhansali@marvell.com> (raw)
In-Reply-To: <20260226131715.2851091-1-rbhansali@marvell.com>
Reduce SA context push size to 128 byte for AES_GCM encryption
for CPT performance improvement on CN20k platform.
Also, corrects few macros for cn20k specific.
Signed-off-by: Rahul Bhansali <rbhansali@marvell.com>
---
Changes in v2: SA context push size change on security session update APIs also.
drivers/net/cnxk/cn20k_ethdev_sec.c | 107 +++++++++++++++++++++++++---
1 file changed, 98 insertions(+), 9 deletions(-)
diff --git a/drivers/net/cnxk/cn20k_ethdev_sec.c b/drivers/net/cnxk/cn20k_ethdev_sec.c
index e406f0e879..eab06be68f 100644
--- a/drivers/net/cnxk/cn20k_ethdev_sec.c
+++ b/drivers/net/cnxk/cn20k_ethdev_sec.c
@@ -655,16 +655,71 @@ outb_dbg_iv_update(struct roc_ow_ipsec_outb_sa *outb_sa, const char *__iv_str)
}
/* Update source of IV */
- outb_sa->w2.s.iv_src = ROC_IE_OT_SA_IV_SRC_FROM_SA;
+ outb_sa->w2.s.iv_src = ROC_IE_OW_SA_IV_SRC_FROM_SA;
free(iv_str);
}
+static void
+cn20k_eth_sec_inb_sa_misc_fill(struct roc_ow_ipsec_inb_sa *sa,
+ struct rte_security_ipsec_xform *ipsec_xfrm)
+{
+ struct roc_ow_ipsec_inb_ctx_update_reg *ctx;
+ size_t offset;
+
+ if (sa->w2.s.enc_type != ROC_IE_SA_ENC_AES_GCM)
+ return;
+
+ /* Update ctx push size for AES GCM */
+ offset = offsetof(struct roc_ow_ipsec_inb_sa, hmac_opad_ipad);
+ ctx = (struct roc_ow_ipsec_inb_ctx_update_reg *)((uint8_t *)sa + offset);
+ sa->w0.s.hw_ctx_off = offset / 8;
+ sa->w0.s.ctx_push_size = sa->w0.s.hw_ctx_off + 1;
+
+ if (ipsec_xfrm->life.bytes_soft_limit)
+ ctx->soft_life = ipsec_xfrm->life.bytes_soft_limit + 1;
+
+ if (ipsec_xfrm->life.packets_soft_limit)
+ ctx->soft_life = ipsec_xfrm->life.packets_soft_limit + 1;
+
+ if (ipsec_xfrm->life.bytes_hard_limit)
+ ctx->hard_life = ipsec_xfrm->life.bytes_hard_limit + 1;
+
+ if (ipsec_xfrm->life.packets_hard_limit)
+ ctx->hard_life = ipsec_xfrm->life.packets_hard_limit + 1;
+}
+
static int
cn20k_eth_sec_outb_sa_misc_fill(struct roc_nix *roc_nix, struct roc_ow_ipsec_outb_sa *sa,
void *sa_cptr, struct rte_security_ipsec_xform *ipsec_xfrm,
uint32_t sa_idx)
{
+ struct roc_ow_ipsec_outb_ctx_update_reg *ctx;
uint64_t *ring_base, ring_addr;
+ size_t offset;
+
+ if (sa->w2.s.enc_type == ROC_IE_SA_ENC_AES_GCM) {
+ offset = offsetof(struct roc_ow_ipsec_outb_sa, hmac_opad_ipad);
+ ctx = (struct roc_ow_ipsec_outb_ctx_update_reg *)((uint8_t *)sa + offset);
+ sa->w0.s.hw_ctx_off = offset / 8;
+ sa->w0.s.ctx_push_size = sa->w0.s.hw_ctx_off + 1;
+
+ if (ipsec_xfrm->esn.value)
+ ctx->esn_val = ipsec_xfrm->esn.value - 1;
+
+ if (ipsec_xfrm->life.bytes_soft_limit)
+ ctx->soft_life = ipsec_xfrm->life.bytes_soft_limit + 1;
+
+ if (ipsec_xfrm->life.packets_soft_limit)
+ ctx->soft_life = ipsec_xfrm->life.packets_soft_limit + 1;
+
+ if (ipsec_xfrm->life.bytes_hard_limit)
+ ctx->hard_life = ipsec_xfrm->life.bytes_hard_limit + 1;
+
+ if (ipsec_xfrm->life.packets_hard_limit)
+ ctx->hard_life = ipsec_xfrm->life.packets_hard_limit + 1;
+ } else {
+ ctx = &sa->ctx;
+ }
if (roc_nix_inl_is_cq_ena(roc_nix))
goto done;
@@ -675,8 +730,8 @@ cn20k_eth_sec_outb_sa_misc_fill(struct roc_nix *roc_nix, struct roc_ow_ipsec_out
return -ENOTSUP;
ring_addr = ring_base[sa_idx >> ROC_NIX_SOFT_EXP_ERR_RING_MAX_ENTRY_LOG2];
- sa->ctx.err_ctl.s.mode = ROC_IE_OT_ERR_CTL_MODE_RING;
- sa->ctx.err_ctl.s.address = ring_addr >> 3;
+ ctx->err_ctl.s.mode = ROC_IE_OW_ERR_CTL_MODE_RING;
+ ctx->err_ctl.s.address = ring_addr >> 3;
sa->w0.s.ctx_id = ((uintptr_t)sa_cptr >> 51) & 0x1ff;
}
done:
@@ -751,7 +806,7 @@ cn20k_eth_sec_session_create(void *device, struct rte_security_session_conf *con
uintptr_t sa;
PLT_STATIC_ASSERT(sizeof(struct cn20k_inb_priv_data) <
- ROC_NIX_INL_OT_IPSEC_INB_SW_RSVD);
+ ROC_NIX_INL_OW_IPSEC_INB_SW_RSVD);
spi_mask = roc_nix_inl_inb_spi_range(nix, inl_dev, NULL, NULL);
@@ -796,6 +851,8 @@ cn20k_eth_sec_session_create(void *device, struct rte_security_session_conf *con
goto err;
}
+ cn20k_eth_sec_inb_sa_misc_fill(inb_sa_dptr, ipsec);
+
inb_priv = roc_nix_inl_ow_ipsec_inb_sa_sw_rsvd(inb_sa);
/* Back pointer to get eth_sec */
inb_priv->eth_sec = eth_sec;
@@ -856,7 +913,7 @@ cn20k_eth_sec_session_create(void *device, struct rte_security_session_conf *con
uint32_t sa_idx;
PLT_STATIC_ASSERT(sizeof(struct cn20k_outb_priv_data) <
- ROC_NIX_INL_OT_IPSEC_OUTB_SW_RSVD);
+ ROC_NIX_INL_OW_IPSEC_OUTB_SW_RSVD);
/* Alloc an sa index */
rc = cnxk_eth_outb_sa_idx_get(dev, &sa_idx, ipsec->spi);
@@ -1065,6 +1122,9 @@ cn20k_eth_sec_session_update(void *device, struct rte_security_session *sess,
rc = cnxk_ow_ipsec_inb_sa_fill(inb_sa_dptr, ipsec, crypto, 0);
if (rc)
return -EINVAL;
+
+ cn20k_eth_sec_inb_sa_misc_fill(inb_sa_dptr, ipsec);
+
/* Use cookie for original data */
inb_sa_dptr->w1.s.cookie = inb_sa->w1.s.cookie;
@@ -1096,6 +1156,14 @@ cn20k_eth_sec_session_update(void *device, struct rte_security_session *sess,
if (rc)
return -EINVAL;
+ /* Fill outbound sa misc params */
+ rc = cn20k_eth_sec_outb_sa_misc_fill(&dev->nix, outb_sa_dptr, outb_sa, ipsec,
+ eth_sec->sa_idx);
+ if (rc) {
+ plt_err("Failed to init outb sa misc params, rc=%d", rc);
+ return rc;
+ }
+
/* Save rlen info */
cnxk_ipsec_outb_rlens_get(rlens, ipsec, crypto);
@@ -1138,6 +1206,7 @@ cn20k_eth_sec_session_stats_get(void *device, struct rte_security_session *sess,
struct rte_eth_dev *eth_dev = (struct rte_eth_dev *)device;
struct cnxk_eth_dev *dev = cnxk_eth_pmd_priv(eth_dev);
struct cnxk_eth_sec_sess *eth_sec;
+ size_t offset;
int rc;
eth_sec = cnxk_eth_sec_sess_get_by_sess(dev, sess);
@@ -1152,11 +1221,31 @@ cn20k_eth_sec_session_stats_get(void *device, struct rte_security_session *sess,
stats->protocol = RTE_SECURITY_PROTOCOL_IPSEC;
if (eth_sec->inb) {
- stats->ipsec.ipackets = ((struct roc_ow_ipsec_inb_sa *)eth_sec->sa)->ctx.mib_pkts;
- stats->ipsec.ibytes = ((struct roc_ow_ipsec_inb_sa *)eth_sec->sa)->ctx.mib_octs;
+ struct roc_ow_ipsec_inb_sa *sa = (struct roc_ow_ipsec_inb_sa *)eth_sec->sa;
+ struct roc_ow_ipsec_inb_ctx_update_reg *ctx;
+
+ if (sa->w2.s.enc_type == ROC_IE_SA_ENC_AES_GCM) {
+ offset = offsetof(struct roc_ow_ipsec_inb_sa, hmac_opad_ipad);
+ ctx = (struct roc_ow_ipsec_inb_ctx_update_reg *)((uint8_t *)sa + offset);
+ } else {
+ ctx = &sa->ctx;
+ }
+
+ stats->ipsec.ipackets = ctx->mib_pkts;
+ stats->ipsec.ibytes = ctx->mib_octs;
} else {
- stats->ipsec.opackets = ((struct roc_ow_ipsec_outb_sa *)eth_sec->sa)->ctx.mib_pkts;
- stats->ipsec.obytes = ((struct roc_ow_ipsec_outb_sa *)eth_sec->sa)->ctx.mib_octs;
+ struct roc_ow_ipsec_outb_sa *sa = (struct roc_ow_ipsec_outb_sa *)eth_sec->sa;
+ struct roc_ow_ipsec_outb_ctx_update_reg *ctx;
+
+ if (sa->w2.s.enc_type == ROC_IE_SA_ENC_AES_GCM) {
+ offset = offsetof(struct roc_ow_ipsec_outb_sa, hmac_opad_ipad);
+ ctx = (struct roc_ow_ipsec_outb_ctx_update_reg *)((uint8_t *)sa + offset);
+ } else {
+ ctx = &sa->ctx;
+ }
+
+ stats->ipsec.opackets = ctx->mib_pkts;
+ stats->ipsec.obytes = ctx->mib_octs;
}
return 0;
--
2.34.1
next prev parent reply other threads:[~2026-02-26 13:18 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-19 9:08 [PATCH 1/8] net/cnxk: support of plain packet reassembly Rahul Bhansali
2026-02-19 9:08 ` [PATCH 2/8] net/cnxk: support IPsec Rx inject for cn20k Rahul Bhansali
2026-02-19 9:08 ` [PATCH 3/8] common/cnxk: update platform features Rahul Bhansali
2026-02-19 9:08 ` [PATCH 4/8] common/cnxk: add RQ PB and WQE cache config Rahul Bhansali
2026-02-19 9:08 ` [PATCH 5/8] net/cnxk: config RQ PB and WQE caching Rahul Bhansali
2026-02-19 9:08 ` [PATCH 6/8] net/cnxk: update SA context push size Rahul Bhansali
2026-02-19 9:08 ` [PATCH 7/8] net/cnxk: flow rule update for non-in-place IPsec Rahul Bhansali
2026-02-19 9:08 ` [PATCH 8/8] common/cnxk: enable CPT CQ for inline IPSec inbound Rahul Bhansali
2026-02-26 5:05 ` Jerin Jacob
2026-02-19 18:58 ` [PATCH 1/8] net/cnxk: support of plain packet reassembly Stephen Hemminger
2026-02-26 13:17 ` [PATCH v2 " Rahul Bhansali
2026-02-26 13:17 ` [PATCH v2 2/8] net/cnxk: support IPsec Rx inject for cn20k Rahul Bhansali
2026-02-26 13:17 ` [PATCH v2 3/8] common/cnxk: update platform features Rahul Bhansali
2026-02-26 13:17 ` [PATCH v2 4/8] common/cnxk: add RQ PB and WQE cache config Rahul Bhansali
2026-02-26 13:17 ` [PATCH v2 5/8] net/cnxk: config RQ PB and WQE caching Rahul Bhansali
2026-02-26 13:17 ` Rahul Bhansali [this message]
2026-02-26 13:17 ` [PATCH v2 7/8] net/cnxk: flow rule update for non-in-place IPsec Rahul Bhansali
2026-02-26 13:17 ` [PATCH v2 8/8] common/cnxk: enable CPT CQ for inline IPsec inbound Rahul Bhansali
2026-02-27 4:37 ` [PATCH v3 1/8] net/cnxk: support of plain packet reassembly Rahul Bhansali
2026-02-27 4:37 ` [PATCH v3 2/8] net/cnxk: support IPsec Rx inject for cn20k Rahul Bhansali
2026-02-27 4:37 ` [PATCH v3 3/8] common/cnxk: update platform features Rahul Bhansali
2026-02-27 4:37 ` [PATCH v3 4/8] common/cnxk: add RQ PB and WQE cache config Rahul Bhansali
2026-02-27 4:37 ` [PATCH v3 5/8] net/cnxk: config RQ PB and WQE caching Rahul Bhansali
2026-02-27 4:37 ` [PATCH v3 6/8] net/cnxk: update SA context push size Rahul Bhansali
2026-02-27 4:37 ` [PATCH v3 7/8] net/cnxk: flow rule update for non-in-place IPsec Rahul Bhansali
2026-02-27 4:37 ` [PATCH v3 8/8] common/cnxk: enable CPT CQ for inline IPsec inbound Rahul Bhansali
2026-03-02 6:36 ` Jerin Jacob
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260226131715.2851091-6-rbhansali@marvell.com \
--to=rbhansali@marvell.com \
--cc=dev@dpdk.org \
--cc=hkalra@marvell.com \
--cc=jerinj@marvell.com \
--cc=kirankumark@marvell.com \
--cc=ndabilpuram@marvell.com \
--cc=skori@marvell.com \
--cc=skoteshwar@marvell.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox