crypto: introduce async crypto infra

[vpp.git] / src / vnet / ipsec / ipsec.c

diff --git a/src/vnet/ipsec/ipsec.c b/src/vnet/ipsec/ipsec.c
index e7cb615..6b31926 100644 (file)
--- a/src/vnet/ipsec/ipsec.c
+++ b/src/vnet/ipsec/ipsec.c
@@ -26,6 +26,8 @@
 #include <vnet/ipsec/ah.h>
 
 ipsec_main_t ipsec_main;
+esp_async_post_next_t esp_encrypt_async_next;
+esp_async_post_next_t esp_decrypt_async_next;
 
 static clib_error_t *
 ipsec_check_ah_support (ipsec_sa_t * sa)
@@ -173,7 +175,8 @@ ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im,
                            const char *esp6_decrypt_node_name,
                            const char *esp6_decrypt_tun_node_name,
                            check_support_cb_t esp_check_support_cb,
-                           add_del_sa_sess_cb_t esp_add_del_sa_sess_cb)
+                           add_del_sa_sess_cb_t esp_add_del_sa_sess_cb,
+                           enable_disable_cb_t enable_disable_cb)
 {
   ipsec_esp_backend_t *b;
 
@@ -206,6 +209,8 @@ ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im,
 
   b->check_support_cb = esp_check_support_cb;
   b->add_del_sa_sess_cb = esp_add_del_sa_sess_cb;
+  b->enable_disable_cb = enable_disable_cb;
+
   return b - im->esp_backends;
 }
 
@@ -253,6 +258,18 @@ ipsec_select_esp_backend (ipsec_main_t * im, u32 backend_idx)
   if (pool_is_free_index (im->esp_backends, backend_idx))
     return VNET_API_ERROR_INVALID_VALUE;
 
+  /* disable current backend */
+  if (im->esp_current_backend != ~0)
+    {
+      ipsec_esp_backend_t *cb = pool_elt_at_index (im->esp_backends,
+                                                  im->esp_current_backend);
+      if (cb->enable_disable_cb)
+       {
+         if ((cb->enable_disable_cb) (0) != 0)
+           return -1;
+       }
+    }
+
   ipsec_esp_backend_t *b = pool_elt_at_index (im->esp_backends, backend_idx);
   im->esp_current_backend = backend_idx;
   im->esp4_encrypt_node_index = b->esp4_encrypt_node_index;
@@ -273,9 +290,64 @@ ipsec_select_esp_backend (ipsec_main_t * im, u32 backend_idx)
   im->esp46_encrypt_tun_feature_index = b->esp46_encrypt_tun_feature_index;
   im->esp66_encrypt_tun_feature_index = b->esp66_encrypt_tun_feature_index;
 
+  if (b->enable_disable_cb)
+    {
+      if ((b->enable_disable_cb) (1) != 0)
+       return -1;
+    }
   return 0;
 }
 
+void
+ipsec_set_async_mode (u32 is_enabled)
+{
+  ipsec_main_t *im = &ipsec_main;
+  ipsec_sa_t *sa;
+
+  /* lock all SAs before change im->async_mode */
+  pool_foreach (sa, im->sad, (
+                              {
+                              fib_node_lock (&sa->node);
+                              }));
+
+  im->async_mode = is_enabled;
+
+  /* change SA crypto op data before unlock them */
+  pool_foreach (sa, im->sad, (
+                              {
+                              sa->crypto_op_data = is_enabled ?
+                              sa->async_op_data.data : sa->sync_op_data.data;
+                              fib_node_unlock (&sa->node);
+                              }));
+}
+
+static void
+crypto_engine_backend_register_post_node (vlib_main_t * vm)
+{
+  esp_async_post_next_t *eit;
+  esp_async_post_next_t *dit;
+
+  eit = &esp_encrypt_async_next;
+  eit->esp4_post_next =
+    vnet_crypto_register_post_node (vm, "esp4-encrypt-post");
+  eit->esp6_post_next =
+    vnet_crypto_register_post_node (vm, "esp6-encrypt-post");
+  eit->esp4_tun_post_next =
+    vnet_crypto_register_post_node (vm, "esp4-encrypt-tun-post");
+  eit->esp6_tun_post_next =
+    vnet_crypto_register_post_node (vm, "esp6-encrypt-tun-post");
+
+  dit = &esp_decrypt_async_next;
+  dit->esp4_post_next =
+    vnet_crypto_register_post_node (vm, "esp4-decrypt-post");
+  dit->esp6_post_next =
+    vnet_crypto_register_post_node (vm, "esp6-decrypt-post");
+  dit->esp4_tun_post_next =
+    vnet_crypto_register_post_node (vm, "esp4-decrypt-tun-post");
+  dit->esp6_tun_post_next =
+    vnet_crypto_register_post_node (vm, "esp6-decrypt-tun-post");
+}
+
 static clib_error_t *
 ipsec_init (vlib_main_t * vm)
 {
@@ -298,6 +370,9 @@ ipsec_init (vlib_main_t * vm)
   ASSERT (node);
   im->error_drop_node_index = node->index;
 
+  im->ah_current_backend = ~0;
+  im->esp_current_backend = ~0;
+
   u32 idx = ipsec_register_ah_backend (vm, im, "crypto engine backend",
                                       "ah4-encrypt",
                                       "ah4-decrypt",
@@ -320,7 +395,8 @@ ipsec_init (vlib_main_t * vm)
                                    "esp6-encrypt-tun",
                                    "esp6-decrypt",
                                    "esp6-decrypt-tun",
-                                   ipsec_check_esp_support, NULL);
+                                   ipsec_check_esp_support,
+                                   NULL, crypto_dispatch_enable_disable);
   im->esp_default_backend = idx;
 
   rv = ipsec_select_esp_backend (im, idx);
@@ -454,6 +530,9 @@ ipsec_init (vlib_main_t * vm)
   im->esp6_dec_tun_fq_index =
     vlib_frame_queue_main_init (esp6_decrypt_tun_node.index, 0);
 
+  im->async_mode = 0;
+  crypto_engine_backend_register_post_node (vm);
+
   return 0;
 }