ipsec: move the IPSec SA pool out of ipsec_main

[vpp.git] / src / plugins / dpdk / ipsec / esp_decrypt.c

diff --git a/src/plugins/dpdk/ipsec/esp_decrypt.c b/src/plugins/dpdk/ipsec/esp_decrypt.c
index d781710..9a782ab 100644 (file)
--- a/src/plugins/dpdk/ipsec/esp_decrypt.c
+++ b/src/plugins/dpdk/ipsec/esp_decrypt.c
@@ -45,7 +45,7 @@ typedef enum
  _(REPLAY, "SA replayed packet")                \
  _(NOT_IP, "Not IP packet (dropped)")           \
  _(ENQ_FAIL, "Enqueue decrypt failed (queue full)")     \
- _(DISCARD, "Not enough crypto operations, discarding frame")  \
+ _(DISCARD, "Not enough crypto operations")      \
  _(BAD_LEN, "Invalid ciphertext length")         \
  _(SESSION, "Failed to get crypto session")      \
  _(NOSUP, "Cipher/Auth not supported")
@@ -98,7 +98,6 @@ dpdk_esp_decrypt_inline (vlib_main_t * vm,
                         vlib_frame_t * from_frame, int is_ip6)
 {
   u32 n_left_from, *from, *to_next, next_index, thread_index;
-  ipsec_main_t *im = &ipsec_main;
   u32 thread_idx = vlib_get_thread_index ();
   dpdk_crypto_main_t *dcm = &dpdk_crypto_main;
   crypto_resource_t *res = 0;
@@ -121,11 +120,12 @@ dpdk_esp_decrypt_inline (vlib_main_t * vm,
     {
       if (is_ip6)
        vlib_node_increment_counter (vm, dpdk_esp6_decrypt_node.index,
-                                    ESP_DECRYPT_ERROR_DISCARD, 1);
+                                    ESP_DECRYPT_ERROR_DISCARD, n_left_from);
       else
        vlib_node_increment_counter (vm, dpdk_esp4_decrypt_node.index,
-                                    ESP_DECRYPT_ERROR_DISCARD, 1);
+                                    ESP_DECRYPT_ERROR_DISCARD, n_left_from);
       /* Discard whole frame */
+      vlib_buffer_free (vm, from, n_left_from);
       return n_left_from;
     }
 
@@ -180,7 +180,7 @@ dpdk_esp_decrypt_inline (vlib_main_t * vm,
 
          if (sa_index0 != last_sa_index)
            {
-             sa0 = pool_elt_at_index (im->sad, sa_index0);
+             sa0 = ipsec_sa_get (sa_index0);
 
              cipher_alg =
                vec_elt_at_index (dcm->cipher_algs, sa0->crypto_alg);
@@ -307,8 +307,7 @@ dpdk_esp_decrypt_inline (vlib_main_t * vm,
          cipher_len = payload_len;
 
          u8 *digest = vlib_buffer_get_tail (b0) - trunc_size;
-         u64 digest_paddr =
-           mb0->buf_physaddr + digest - ((u8 *) mb0->buf_addr);
+         u64 digest_paddr = mb0->buf_iova + digest - ((u8 *) mb0->buf_addr);
 
          if (!is_aead && cipher_alg->alg == RTE_CRYPTO_CIPHER_AES_CBC)
            clib_memcpy_fast (icb, iv, 16);
@@ -498,7 +497,6 @@ dpdk_esp_decrypt_post_inline (vlib_main_t * vm,
   u32 n_left_from, *from, *to_next = 0, next_index;
   ipsec_sa_t *sa0;
   u32 sa_index0 = ~0;
-  ipsec_main_t *im = &ipsec_main;
   dpdk_crypto_main_t *dcm = &dpdk_crypto_main;
 
   from = vlib_frame_vector_args (from_frame);
@@ -535,7 +533,7 @@ dpdk_esp_decrypt_post_inline (vlib_main_t * vm,
          esp0 = vlib_buffer_get_current (b0);
 
          sa_index0 = vnet_buffer (b0)->ipsec.sad_index;
-         sa0 = pool_elt_at_index (im->sad, sa_index0);
+         sa0 = ipsec_sa_get (sa_index0);
 
          to_next[0] = bi0;
          to_next += 1;