X-Git-Url: https://gerrit.fd.io/r/gitweb?a=blobdiff_plain;f=src%2Fvnet%2Fipsec%2Fipsec.c;h=6b31926be4f2e56ce5c415a2f89477403c7fbd8d;hb=f539578bac8b64886b57c460c9d74273e6613f8b;hp=e7cb615f957c1ee526a99f6d0223c615e86cdc36;hpb=162330f25aeec09694fffaaa31ba9b318620eb9c;p=vpp.git

diff --git a/src/vnet/ipsec/ipsec.c b/src/vnet/ipsec/ipsec.c
index e7cb615f957..6b31926be4f 100644
--- a/src/vnet/ipsec/ipsec.c
+++ b/src/vnet/ipsec/ipsec.c
@@ -26,6 +26,8 @@
 #include <vnet/ipsec/ah.h>
 
 ipsec_main_t ipsec_main;
+esp_async_post_next_t esp_encrypt_async_next;
+esp_async_post_next_t esp_decrypt_async_next;
 
 static clib_error_t *
 ipsec_check_ah_support (ipsec_sa_t * sa)
@@ -173,7 +175,8 @@ ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im,
 			    const char *esp6_decrypt_node_name,
 			    const char *esp6_decrypt_tun_node_name,
 			    check_support_cb_t esp_check_support_cb,
-			    add_del_sa_sess_cb_t esp_add_del_sa_sess_cb)
+			    add_del_sa_sess_cb_t esp_add_del_sa_sess_cb,
+			    enable_disable_cb_t enable_disable_cb)
 {
   ipsec_esp_backend_t *b;
 
@@ -206,6 +209,8 @@ ipsec_register_esp_backend (vlib_main_t * vm, ipsec_main_t * im,
 
   b->check_support_cb = esp_check_support_cb;
   b->add_del_sa_sess_cb = esp_add_del_sa_sess_cb;
+  b->enable_disable_cb = enable_disable_cb;
+
   return b - im->esp_backends;
 }
 
@@ -253,6 +258,18 @@ ipsec_select_esp_backend (ipsec_main_t * im, u32 backend_idx)
   if (pool_is_free_index (im->esp_backends, backend_idx))
     return VNET_API_ERROR_INVALID_VALUE;
 
+  /* disable current backend */
+  if (im->esp_current_backend != ~0)
+    {
+      ipsec_esp_backend_t *cb = pool_elt_at_index (im->esp_backends,
+						   im->esp_current_backend);
+      if (cb->enable_disable_cb)
+	{
+	  if ((cb->enable_disable_cb) (0) != 0)
+	    return -1;
+	}
+    }
+
   ipsec_esp_backend_t *b = pool_elt_at_index (im->esp_backends, backend_idx);
   im->esp_current_backend = backend_idx;
   im->esp4_encrypt_node_index = b->esp4_encrypt_node_index;
@@ -273,9 +290,64 @@ ipsec_select_esp_backend (ipsec_main_t * im, u32 backend_idx)
   im->esp46_encrypt_tun_feature_index = b->esp46_encrypt_tun_feature_index;
   im->esp66_encrypt_tun_feature_index = b->esp66_encrypt_tun_feature_index;
 
+  if (b->enable_disable_cb)
+    {
+      if ((b->enable_disable_cb) (1) != 0)
+	return -1;
+    }
   return 0;
 }
 
+void
+ipsec_set_async_mode (u32 is_enabled)
+{
+  ipsec_main_t *im = &ipsec_main;
+  ipsec_sa_t *sa;
+
+  /* lock all SAs before change im->async_mode */
+  pool_foreach (sa, im->sad, (
+			       {
+			       fib_node_lock (&sa->node);
+			       }));
+
+  im->async_mode = is_enabled;
+
+  /* change SA crypto op data before unlock them */
+  pool_foreach (sa, im->sad, (
+			       {
+			       sa->crypto_op_data = is_enabled ?
+			       sa->async_op_data.data : sa->sync_op_data.data;
+			       fib_node_unlock (&sa->node);
+			       }));
+}
+
+static void
+crypto_engine_backend_register_post_node (vlib_main_t * vm)
+{
+  esp_async_post_next_t *eit;
+  esp_async_post_next_t *dit;
+
+  eit = &esp_encrypt_async_next;
+  eit->esp4_post_next =
+    vnet_crypto_register_post_node (vm, "esp4-encrypt-post");
+  eit->esp6_post_next =
+    vnet_crypto_register_post_node (vm, "esp6-encrypt-post");
+  eit->esp4_tun_post_next =
+    vnet_crypto_register_post_node (vm, "esp4-encrypt-tun-post");
+  eit->esp6_tun_post_next =
+    vnet_crypto_register_post_node (vm, "esp6-encrypt-tun-post");
+
+  dit = &esp_decrypt_async_next;
+  dit->esp4_post_next =
+    vnet_crypto_register_post_node (vm, "esp4-decrypt-post");
+  dit->esp6_post_next =
+    vnet_crypto_register_post_node (vm, "esp6-decrypt-post");
+  dit->esp4_tun_post_next =
+    vnet_crypto_register_post_node (vm, "esp4-decrypt-tun-post");
+  dit->esp6_tun_post_next =
+    vnet_crypto_register_post_node (vm, "esp6-decrypt-tun-post");
+}
+
 static clib_error_t *
 ipsec_init (vlib_main_t * vm)
 {
@@ -298,6 +370,9 @@ ipsec_init (vlib_main_t * vm)
   ASSERT (node);
   im->error_drop_node_index = node->index;
 
+  im->ah_current_backend = ~0;
+  im->esp_current_backend = ~0;
+
   u32 idx = ipsec_register_ah_backend (vm, im, "crypto engine backend",
 				       "ah4-encrypt",
 				       "ah4-decrypt",
@@ -320,7 +395,8 @@ ipsec_init (vlib_main_t * vm)
 				    "esp6-encrypt-tun",
 				    "esp6-decrypt",
 				    "esp6-decrypt-tun",
-				    ipsec_check_esp_support, NULL);
+				    ipsec_check_esp_support,
+				    NULL, crypto_dispatch_enable_disable);
   im->esp_default_backend = idx;
 
   rv = ipsec_select_esp_backend (im, idx);
@@ -454,6 +530,9 @@ ipsec_init (vlib_main_t * vm)
   im->esp6_dec_tun_fq_index =
     vlib_frame_queue_main_init (esp6_decrypt_tun_node.index, 0);
 
+  im->async_mode = 0;
+  crypto_engine_backend_register_post_node (vm);
+
   return 0;
 }