xref: /dpdk/examples/l2fwd-crypto/main.c (revision bdce2564dbf78e1fecc0db438b562ae19f0c057c)
1 /* SPDX-License-Identifier: BSD-3-Clause
2  * Copyright(c) 2015-2016 Intel Corporation
3  */
4 
5 #include <time.h>
6 #include <stdio.h>
7 #include <stdlib.h>
8 #include <string.h>
9 #include <stdint.h>
10 #include <inttypes.h>
11 #include <sys/types.h>
12 #include <sys/queue.h>
13 #include <netinet/in.h>
14 #include <setjmp.h>
15 #include <stdarg.h>
16 #include <ctype.h>
17 #include <errno.h>
18 #include <getopt.h>
19 #include <fcntl.h>
20 #include <unistd.h>
21 #include <signal.h>
22 
23 #include <rte_string_fns.h>
24 #include <rte_branch_prediction.h>
25 #include <rte_common.h>
26 #include <rte_cryptodev.h>
27 #include <rte_cycles.h>
28 #include <rte_debug.h>
29 #include <rte_eal.h>
30 #include <rte_ether.h>
31 #include <rte_ethdev.h>
32 #include <rte_interrupts.h>
33 #include <rte_ip.h>
34 #include <rte_launch.h>
35 #include <rte_lcore.h>
36 #include <rte_log.h>
37 #include <rte_malloc.h>
38 #include <rte_mbuf.h>
39 #include <rte_memcpy.h>
40 #include <rte_memory.h>
41 #include <rte_mempool.h>
42 #include <rte_per_lcore.h>
43 #include <rte_prefetch.h>
44 #include <rte_random.h>
45 #include <rte_hexdump.h>
46 #ifdef RTE_CRYPTO_SCHEDULER
47 #include <rte_cryptodev_scheduler.h>
48 #endif
49 
50 enum cdev_type {
51 	CDEV_TYPE_ANY,
52 	CDEV_TYPE_HW,
53 	CDEV_TYPE_SW
54 };
55 
56 #define RTE_LOGTYPE_L2FWD RTE_LOGTYPE_USER1
57 
58 #define NB_MBUF   8192
59 
60 #define MAX_STR_LEN 32
61 #define MAX_KEY_SIZE 128
62 #define MAX_IV_SIZE 16
63 #define MAX_AAD_SIZE 65535
64 #define MAX_PKT_BURST 32
65 #define BURST_TX_DRAIN_US 100 /* TX drain every ~100us */
66 #define SESSION_POOL_CACHE_SIZE 0
67 
68 #define MAXIMUM_IV_LENGTH	16
69 #define IV_OFFSET		(sizeof(struct rte_crypto_op) + \
70 				sizeof(struct rte_crypto_sym_op))
71 
72 /*
73  * Configurable number of RX/TX ring descriptors
74  */
75 #define RTE_TEST_RX_DESC_DEFAULT 1024
76 #define RTE_TEST_TX_DESC_DEFAULT 1024
77 
78 static uint16_t nb_rxd = RTE_TEST_RX_DESC_DEFAULT;
79 static uint16_t nb_txd = RTE_TEST_TX_DESC_DEFAULT;
80 
81 /* ethernet addresses of ports */
82 static struct rte_ether_addr l2fwd_ports_eth_addr[RTE_MAX_ETHPORTS];
83 
84 /* mask of enabled ports */
85 static uint64_t l2fwd_enabled_port_mask;
86 static uint64_t l2fwd_enabled_crypto_mask;
87 
88 /* list of enabled ports */
89 static uint16_t l2fwd_dst_ports[RTE_MAX_ETHPORTS];
90 
91 
92 struct pkt_buffer {
93 	unsigned len;
94 	struct rte_mbuf *buffer[MAX_PKT_BURST];
95 };
96 
97 struct op_buffer {
98 	unsigned len;
99 	struct rte_crypto_op *buffer[MAX_PKT_BURST];
100 };
101 
102 #define MAX_RX_QUEUE_PER_LCORE 16
103 #define MAX_TX_QUEUE_PER_PORT 16
104 
105 enum l2fwd_crypto_xform_chain {
106 	L2FWD_CRYPTO_CIPHER_HASH,
107 	L2FWD_CRYPTO_HASH_CIPHER,
108 	L2FWD_CRYPTO_CIPHER_ONLY,
109 	L2FWD_CRYPTO_HASH_ONLY,
110 	L2FWD_CRYPTO_AEAD
111 };
112 
113 struct l2fwd_key {
114 	uint8_t *data;
115 	uint32_t length;
116 	rte_iova_t phys_addr;
117 };
118 
119 struct l2fwd_iv {
120 	uint8_t *data;
121 	uint16_t length;
122 };
123 
124 /** l2fwd crypto application command line options */
125 struct l2fwd_crypto_options {
126 	unsigned portmask;
127 	unsigned nb_ports_per_lcore;
128 	unsigned refresh_period;
129 	unsigned single_lcore:1;
130 
131 	enum cdev_type type;
132 	unsigned sessionless:1;
133 
134 	enum l2fwd_crypto_xform_chain xform_chain;
135 
136 	struct rte_crypto_sym_xform cipher_xform;
137 	unsigned ckey_param;
138 	int ckey_random_size;
139 	uint8_t cipher_key[MAX_KEY_SIZE];
140 
141 	struct l2fwd_iv cipher_iv;
142 	unsigned int cipher_iv_param;
143 	int cipher_iv_random_size;
144 
145 	struct rte_crypto_sym_xform auth_xform;
146 	uint8_t akey_param;
147 	int akey_random_size;
148 	uint8_t auth_key[MAX_KEY_SIZE];
149 
150 	struct l2fwd_iv auth_iv;
151 	unsigned int auth_iv_param;
152 	int auth_iv_random_size;
153 
154 	struct rte_crypto_sym_xform aead_xform;
155 	unsigned int aead_key_param;
156 	int aead_key_random_size;
157 	uint8_t aead_key[MAX_KEY_SIZE];
158 
159 	struct l2fwd_iv aead_iv;
160 	unsigned int aead_iv_param;
161 	int aead_iv_random_size;
162 
163 	struct l2fwd_key aad;
164 	unsigned aad_param;
165 	int aad_random_size;
166 
167 	int digest_size;
168 
169 	uint16_t block_size;
170 	char string_type[MAX_STR_LEN];
171 
172 	uint64_t cryptodev_mask;
173 
174 	unsigned int mac_updating;
175 };
176 
177 /** l2fwd crypto lcore params */
178 struct l2fwd_crypto_params {
179 	uint8_t dev_id;
180 	uint8_t qp_id;
181 
182 	unsigned digest_length;
183 	unsigned block_size;
184 
185 	uint32_t cipher_dataunit_len;
186 
187 	struct l2fwd_iv cipher_iv;
188 	struct l2fwd_iv auth_iv;
189 	struct l2fwd_iv aead_iv;
190 	struct l2fwd_key aad;
191 	struct rte_cryptodev_sym_session *session;
192 
193 	uint8_t do_cipher;
194 	uint8_t do_hash;
195 	uint8_t do_aead;
196 	uint8_t hash_verify;
197 
198 	enum rte_crypto_cipher_algorithm cipher_algo;
199 	enum rte_crypto_auth_algorithm auth_algo;
200 	enum rte_crypto_aead_algorithm aead_algo;
201 };
202 
203 /** lcore configuration */
204 struct lcore_queue_conf {
205 	unsigned nb_rx_ports;
206 	uint16_t rx_port_list[MAX_RX_QUEUE_PER_LCORE];
207 
208 	unsigned nb_crypto_devs;
209 	unsigned cryptodev_list[MAX_RX_QUEUE_PER_LCORE];
210 
211 	struct op_buffer op_buf[RTE_CRYPTO_MAX_DEVS];
212 	struct pkt_buffer pkt_buf[RTE_MAX_ETHPORTS];
213 } __rte_cache_aligned;
214 
215 struct lcore_queue_conf lcore_queue_conf[RTE_MAX_LCORE];
216 
217 static struct rte_eth_conf port_conf = {
218 	.rxmode = {
219 		.mq_mode = RTE_ETH_MQ_RX_NONE,
220 		.split_hdr_size = 0,
221 	},
222 	.txmode = {
223 		.mq_mode = RTE_ETH_MQ_TX_NONE,
224 	},
225 };
226 
227 struct rte_mempool *l2fwd_pktmbuf_pool;
228 struct rte_mempool *l2fwd_crypto_op_pool;
229 static struct {
230 	struct rte_mempool *sess_mp;
231 } session_pool_socket[RTE_MAX_NUMA_NODES];
232 
233 /* Per-port statistics struct */
234 struct l2fwd_port_statistics {
235 	uint64_t tx;
236 	uint64_t rx;
237 
238 	uint64_t crypto_enqueued;
239 	uint64_t crypto_dequeued;
240 
241 	uint64_t dropped;
242 } __rte_cache_aligned;
243 
244 struct l2fwd_crypto_statistics {
245 	uint64_t enqueued;
246 	uint64_t dequeued;
247 
248 	uint64_t errors;
249 } __rte_cache_aligned;
250 
251 struct l2fwd_port_statistics port_statistics[RTE_MAX_ETHPORTS];
252 struct l2fwd_crypto_statistics crypto_statistics[RTE_CRYPTO_MAX_DEVS];
253 
254 /* A tsc-based timer responsible for triggering statistics printout */
255 #define TIMER_MILLISECOND (rte_get_tsc_hz() / 1000)
256 #define MAX_TIMER_PERIOD 86400UL /* 1 day max */
257 #define DEFAULT_TIMER_PERIOD 10UL
258 
259 /* Global signal */
260 static volatile bool signal_received;
261 
262 /* Print out statistics on packets dropped */
263 static void
264 print_stats(void)
265 {
266 	uint64_t total_packets_dropped, total_packets_tx, total_packets_rx;
267 	uint64_t total_packets_enqueued, total_packets_dequeued,
268 		total_packets_errors;
269 	uint16_t portid;
270 	uint64_t cdevid;
271 
272 	total_packets_dropped = 0;
273 	total_packets_tx = 0;
274 	total_packets_rx = 0;
275 	total_packets_enqueued = 0;
276 	total_packets_dequeued = 0;
277 	total_packets_errors = 0;
278 
279 	const char clr[] = { 27, '[', '2', 'J', '\0' };
280 	const char topLeft[] = { 27, '[', '1', ';', '1', 'H', '\0' };
281 
282 		/* Clear screen and move to top left */
283 	printf("%s%s", clr, topLeft);
284 
285 	printf("\nPort statistics ====================================");
286 
287 	for (portid = 0; portid < RTE_MAX_ETHPORTS; portid++) {
288 		/* skip disabled ports */
289 		if ((l2fwd_enabled_port_mask & (1 << portid)) == 0)
290 			continue;
291 		printf("\nStatistics for port %u ------------------------------"
292 			   "\nPackets sent: %32"PRIu64
293 			   "\nPackets received: %28"PRIu64
294 			   "\nPackets dropped: %29"PRIu64,
295 			   portid,
296 			   port_statistics[portid].tx,
297 			   port_statistics[portid].rx,
298 			   port_statistics[portid].dropped);
299 
300 		total_packets_dropped += port_statistics[portid].dropped;
301 		total_packets_tx += port_statistics[portid].tx;
302 		total_packets_rx += port_statistics[portid].rx;
303 	}
304 	printf("\nCrypto statistics ==================================");
305 
306 	for (cdevid = 0; cdevid < RTE_CRYPTO_MAX_DEVS; cdevid++) {
307 		/* skip disabled ports */
308 		if ((l2fwd_enabled_crypto_mask & (((uint64_t)1) << cdevid)) == 0)
309 			continue;
310 		printf("\nStatistics for cryptodev %"PRIu64
311 				" -------------------------"
312 			   "\nPackets enqueued: %28"PRIu64
313 			   "\nPackets dequeued: %28"PRIu64
314 			   "\nPackets errors: %30"PRIu64,
315 			   cdevid,
316 			   crypto_statistics[cdevid].enqueued,
317 			   crypto_statistics[cdevid].dequeued,
318 			   crypto_statistics[cdevid].errors);
319 
320 		total_packets_enqueued += crypto_statistics[cdevid].enqueued;
321 		total_packets_dequeued += crypto_statistics[cdevid].dequeued;
322 		total_packets_errors += crypto_statistics[cdevid].errors;
323 	}
324 	printf("\nAggregate statistics ==============================="
325 		   "\nTotal packets received: %22"PRIu64
326 		   "\nTotal packets enqueued: %22"PRIu64
327 		   "\nTotal packets dequeued: %22"PRIu64
328 		   "\nTotal packets sent: %26"PRIu64
329 		   "\nTotal packets dropped: %23"PRIu64
330 		   "\nTotal packets crypto errors: %17"PRIu64,
331 		   total_packets_rx,
332 		   total_packets_enqueued,
333 		   total_packets_dequeued,
334 		   total_packets_tx,
335 		   total_packets_dropped,
336 		   total_packets_errors);
337 	printf("\n====================================================\n");
338 
339 	fflush(stdout);
340 }
341 
342 /* l2fwd_crypto_send_burst 8< */
343 static int
344 l2fwd_crypto_send_burst(struct lcore_queue_conf *qconf, unsigned n,
345 		struct l2fwd_crypto_params *cparams)
346 {
347 	struct rte_crypto_op **op_buffer;
348 	unsigned ret;
349 
350 	op_buffer = (struct rte_crypto_op **)
351 			qconf->op_buf[cparams->dev_id].buffer;
352 
353 	ret = rte_cryptodev_enqueue_burst(cparams->dev_id,
354 			cparams->qp_id,	op_buffer, (uint16_t) n);
355 
356 	crypto_statistics[cparams->dev_id].enqueued += ret;
357 	if (unlikely(ret < n)) {
358 		crypto_statistics[cparams->dev_id].errors += (n - ret);
359 		do {
360 			rte_pktmbuf_free(op_buffer[ret]->sym->m_src);
361 			rte_crypto_op_free(op_buffer[ret]);
362 		} while (++ret < n);
363 	}
364 
365 	return 0;
366 }
367 /* >8 End of l2fwd_crypto_send_burst. */
368 
369 /* Crypto enqueue. 8< */
370 static int
371 l2fwd_crypto_enqueue(struct rte_crypto_op *op,
372 		struct l2fwd_crypto_params *cparams)
373 {
374 	unsigned lcore_id, len;
375 	struct lcore_queue_conf *qconf;
376 
377 	lcore_id = rte_lcore_id();
378 
379 	qconf = &lcore_queue_conf[lcore_id];
380 	len = qconf->op_buf[cparams->dev_id].len;
381 	qconf->op_buf[cparams->dev_id].buffer[len] = op;
382 	len++;
383 
384 	/* enough ops to be sent */
385 	if (len == MAX_PKT_BURST) {
386 		l2fwd_crypto_send_burst(qconf, MAX_PKT_BURST, cparams);
387 		len = 0;
388 	}
389 
390 	qconf->op_buf[cparams->dev_id].len = len;
391 	return 0;
392 }
393 /* >8 End of crypto enqueue. */
394 
395 static int
396 l2fwd_simple_crypto_enqueue(struct rte_mbuf *m,
397 		struct rte_crypto_op *op,
398 		struct l2fwd_crypto_params *cparams)
399 {
400 	struct rte_ether_hdr *eth_hdr;
401 	struct rte_ipv4_hdr *ip_hdr;
402 
403 	uint32_t ipdata_offset, data_len;
404 	uint32_t pad_len = 0;
405 	char *padding;
406 
407 	eth_hdr = rte_pktmbuf_mtod(m, struct rte_ether_hdr *);
408 
409 	if (eth_hdr->ether_type != rte_cpu_to_be_16(RTE_ETHER_TYPE_IPV4))
410 		return -1;
411 
412 	ipdata_offset = sizeof(struct rte_ether_hdr);
413 
414 	ip_hdr = (struct rte_ipv4_hdr *)(rte_pktmbuf_mtod(m, char *) +
415 			ipdata_offset);
416 
417 	ipdata_offset += (ip_hdr->version_ihl & RTE_IPV4_HDR_IHL_MASK)
418 			* RTE_IPV4_IHL_MULTIPLIER;
419 
420 
421 	/* Zero pad data to be crypto'd so it is block aligned */
422 	data_len  = rte_pktmbuf_data_len(m) - ipdata_offset;
423 
424 	if ((cparams->do_hash || cparams->do_aead) && cparams->hash_verify)
425 		data_len -= cparams->digest_length;
426 
427 	if (cparams->do_cipher) {
428 		/*
429 		 * Following algorithms are block cipher algorithms,
430 		 * and might need padding
431 		 */
432 		switch (cparams->cipher_algo) {
433 		case RTE_CRYPTO_CIPHER_AES_CBC:
434 		case RTE_CRYPTO_CIPHER_AES_ECB:
435 		case RTE_CRYPTO_CIPHER_DES_CBC:
436 		case RTE_CRYPTO_CIPHER_3DES_CBC:
437 		case RTE_CRYPTO_CIPHER_3DES_ECB:
438 			if (data_len % cparams->block_size)
439 				pad_len = cparams->block_size -
440 					(data_len % cparams->block_size);
441 			break;
442 		case RTE_CRYPTO_CIPHER_AES_XTS:
443 			if (cparams->cipher_dataunit_len != 0 &&
444 			    (data_len % cparams->cipher_dataunit_len))
445 				pad_len = cparams->cipher_dataunit_len -
446 					(data_len % cparams->cipher_dataunit_len);
447 			break;
448 		default:
449 			pad_len = 0;
450 		}
451 
452 		if (pad_len) {
453 			padding = rte_pktmbuf_append(m, pad_len);
454 			if (unlikely(!padding))
455 				return -1;
456 
457 			data_len += pad_len;
458 			memset(padding, 0, pad_len);
459 		}
460 	}
461 
462 	/* Set crypto operation data parameters */
463 	rte_crypto_op_attach_sym_session(op, cparams->session);
464 
465 	if (cparams->do_hash) {
466 		if (cparams->auth_iv.length) {
467 			uint8_t *iv_ptr = rte_crypto_op_ctod_offset(op,
468 						uint8_t *,
469 						IV_OFFSET +
470 						cparams->cipher_iv.length);
471 			/*
472 			 * Copy IV at the end of the crypto operation,
473 			 * after the cipher IV, if added
474 			 */
475 			rte_memcpy(iv_ptr, cparams->auth_iv.data,
476 					cparams->auth_iv.length);
477 		}
478 		if (!cparams->hash_verify) {
479 			/* Append space for digest to end of packet */
480 			op->sym->auth.digest.data = (uint8_t *)rte_pktmbuf_append(m,
481 				cparams->digest_length);
482 		} else {
483 			op->sym->auth.digest.data = rte_pktmbuf_mtod(m,
484 				uint8_t *) + ipdata_offset + data_len;
485 		}
486 
487 		op->sym->auth.digest.phys_addr = rte_pktmbuf_iova_offset(m,
488 				rte_pktmbuf_pkt_len(m) - cparams->digest_length);
489 
490 		/* For wireless algorithms, offset/length must be in bits */
491 		if (cparams->auth_algo == RTE_CRYPTO_AUTH_SNOW3G_UIA2 ||
492 				cparams->auth_algo == RTE_CRYPTO_AUTH_KASUMI_F9 ||
493 				cparams->auth_algo == RTE_CRYPTO_AUTH_ZUC_EIA3) {
494 			op->sym->auth.data.offset = ipdata_offset << 3;
495 			op->sym->auth.data.length = data_len << 3;
496 		} else {
497 			op->sym->auth.data.offset = ipdata_offset;
498 			op->sym->auth.data.length = data_len;
499 		}
500 	}
501 
502 	if (cparams->do_cipher) {
503 		uint8_t *iv_ptr = rte_crypto_op_ctod_offset(op, uint8_t *,
504 							IV_OFFSET);
505 		/* Copy IV at the end of the crypto operation */
506 		rte_memcpy(iv_ptr, cparams->cipher_iv.data,
507 				cparams->cipher_iv.length);
508 
509 		/* For wireless algorithms, offset/length must be in bits */
510 		if (cparams->cipher_algo == RTE_CRYPTO_CIPHER_SNOW3G_UEA2 ||
511 				cparams->cipher_algo == RTE_CRYPTO_CIPHER_KASUMI_F8 ||
512 				cparams->cipher_algo == RTE_CRYPTO_CIPHER_ZUC_EEA3) {
513 			op->sym->cipher.data.offset = ipdata_offset << 3;
514 			op->sym->cipher.data.length = data_len << 3;
515 		} else {
516 			op->sym->cipher.data.offset = ipdata_offset;
517 			op->sym->cipher.data.length = data_len;
518 		}
519 	}
520 
521 	if (cparams->do_aead) {
522 		uint8_t *iv_ptr = rte_crypto_op_ctod_offset(op, uint8_t *,
523 							IV_OFFSET);
524 		/* Copy IV at the end of the crypto operation */
525 		/*
526 		 * If doing AES-CCM, nonce is copied one byte
527 		 * after the start of IV field
528 		 */
529 		if (cparams->aead_algo == RTE_CRYPTO_AEAD_AES_CCM)
530 			rte_memcpy(iv_ptr + 1, cparams->aead_iv.data,
531 					cparams->aead_iv.length);
532 		else
533 			rte_memcpy(iv_ptr, cparams->aead_iv.data,
534 					cparams->aead_iv.length);
535 
536 		op->sym->aead.data.offset = ipdata_offset;
537 		op->sym->aead.data.length = data_len;
538 
539 		if (!cparams->hash_verify) {
540 			/* Append space for digest to end of packet */
541 			op->sym->aead.digest.data = (uint8_t *)rte_pktmbuf_append(m,
542 				cparams->digest_length);
543 		} else {
544 			op->sym->aead.digest.data = rte_pktmbuf_mtod(m,
545 				uint8_t *) + ipdata_offset + data_len;
546 		}
547 
548 		op->sym->aead.digest.phys_addr = rte_pktmbuf_iova_offset(m,
549 				rte_pktmbuf_pkt_len(m) - cparams->digest_length);
550 
551 		if (cparams->aad.length) {
552 			op->sym->aead.aad.data = cparams->aad.data;
553 			op->sym->aead.aad.phys_addr = cparams->aad.phys_addr;
554 		}
555 	}
556 
557 	op->sym->m_src = m;
558 
559 	return l2fwd_crypto_enqueue(op, cparams);
560 }
561 
562 
563 /* Send the burst of packets on an output interface */
564 static int
565 l2fwd_send_burst(struct lcore_queue_conf *qconf, unsigned n,
566 		uint16_t port)
567 {
568 	struct rte_mbuf **pkt_buffer;
569 	unsigned ret;
570 
571 	pkt_buffer = (struct rte_mbuf **)qconf->pkt_buf[port].buffer;
572 
573 	ret = rte_eth_tx_burst(port, 0, pkt_buffer, (uint16_t)n);
574 	port_statistics[port].tx += ret;
575 	if (unlikely(ret < n)) {
576 		port_statistics[port].dropped += (n - ret);
577 		do {
578 			rte_pktmbuf_free(pkt_buffer[ret]);
579 		} while (++ret < n);
580 	}
581 
582 	return 0;
583 }
584 
585 /* Enqueue packets for TX and prepare them to be sent. 8< */
586 static int
587 l2fwd_send_packet(struct rte_mbuf *m, uint16_t port)
588 {
589 	unsigned lcore_id, len;
590 	struct lcore_queue_conf *qconf;
591 
592 	lcore_id = rte_lcore_id();
593 
594 	qconf = &lcore_queue_conf[lcore_id];
595 	len = qconf->pkt_buf[port].len;
596 	qconf->pkt_buf[port].buffer[len] = m;
597 	len++;
598 
599 	/* enough pkts to be sent */
600 	if (unlikely(len == MAX_PKT_BURST)) {
601 		l2fwd_send_burst(qconf, MAX_PKT_BURST, port);
602 		len = 0;
603 	}
604 
605 	qconf->pkt_buf[port].len = len;
606 	return 0;
607 }
608 /* >8 End of Enqueuing packets for TX. */
609 
610 static void
611 l2fwd_mac_updating(struct rte_mbuf *m, uint16_t dest_portid)
612 {
613 	struct rte_ether_hdr *eth;
614 	void *tmp;
615 
616 	eth = rte_pktmbuf_mtod(m, struct rte_ether_hdr *);
617 
618 	/* 02:00:00:00:00:xx */
619 	tmp = &eth->dst_addr.addr_bytes[0];
620 	*((uint64_t *)tmp) = 0x000000000002 + ((uint64_t)dest_portid << 40);
621 
622 	/* src addr */
623 	rte_ether_addr_copy(&l2fwd_ports_eth_addr[dest_portid], &eth->src_addr);
624 }
625 
626 static void
627 l2fwd_simple_forward(struct rte_mbuf *m, uint16_t portid,
628 		struct l2fwd_crypto_options *options)
629 {
630 	uint16_t dst_port;
631 	uint32_t pad_len;
632 	struct rte_ipv4_hdr *ip_hdr;
633 	uint32_t ipdata_offset = sizeof(struct rte_ether_hdr);
634 
635 	ip_hdr = (struct rte_ipv4_hdr *)(rte_pktmbuf_mtod(m, char *) +
636 					 ipdata_offset);
637 	dst_port = l2fwd_dst_ports[portid];
638 
639 	if (options->mac_updating)
640 		l2fwd_mac_updating(m, dst_port);
641 
642 	if (options->auth_xform.auth.op == RTE_CRYPTO_AUTH_OP_VERIFY)
643 		rte_pktmbuf_trim(m, options->auth_xform.auth.digest_length);
644 
645 	if (options->cipher_xform.cipher.op == RTE_CRYPTO_CIPHER_OP_DECRYPT) {
646 		pad_len = m->pkt_len - rte_be_to_cpu_16(ip_hdr->total_length) -
647 			  ipdata_offset;
648 		rte_pktmbuf_trim(m, pad_len);
649 	}
650 
651 	l2fwd_send_packet(m, dst_port);
652 }
653 
654 /** Generate random key */
655 static void
656 generate_random_key(uint8_t *key, unsigned length)
657 {
658 	int fd;
659 	int ret;
660 
661 	fd = open("/dev/urandom", O_RDONLY);
662 	if (fd < 0)
663 		rte_exit(EXIT_FAILURE, "Failed to generate random key\n");
664 
665 	ret = read(fd, key, length);
666 	close(fd);
667 
668 	if (ret != (signed)length)
669 		rte_exit(EXIT_FAILURE, "Failed to generate random key\n");
670 }
671 
672 /* Session is created and is later attached to the crypto operation. 8< */
673 static struct rte_cryptodev_sym_session *
674 initialize_crypto_session(struct l2fwd_crypto_options *options, uint8_t cdev_id)
675 {
676 	struct rte_crypto_sym_xform *first_xform;
677 	int retval = rte_cryptodev_socket_id(cdev_id);
678 
679 	if (retval < 0)
680 		return NULL;
681 
682 	uint8_t socket_id = (uint8_t) retval;
683 
684 	if (options->xform_chain == L2FWD_CRYPTO_AEAD) {
685 		first_xform = &options->aead_xform;
686 	} else if (options->xform_chain == L2FWD_CRYPTO_CIPHER_HASH) {
687 		first_xform = &options->cipher_xform;
688 		first_xform->next = &options->auth_xform;
689 	} else if (options->xform_chain == L2FWD_CRYPTO_HASH_CIPHER) {
690 		first_xform = &options->auth_xform;
691 		first_xform->next = &options->cipher_xform;
692 	} else if (options->xform_chain == L2FWD_CRYPTO_CIPHER_ONLY) {
693 		first_xform = &options->cipher_xform;
694 	} else {
695 		first_xform = &options->auth_xform;
696 	}
697 
698 	return rte_cryptodev_sym_session_create(cdev_id, first_xform,
699 			session_pool_socket[socket_id].sess_mp);
700 }
701 /* >8 End of creation of session. */
702 
703 static void
704 l2fwd_crypto_options_print(struct l2fwd_crypto_options *options);
705 
706 /* main processing loop */
707 static void
708 l2fwd_main_loop(struct l2fwd_crypto_options *options)
709 {
710 	struct rte_mbuf *m, *pkts_burst[MAX_PKT_BURST];
711 	struct rte_crypto_op *ops_burst[MAX_PKT_BURST];
712 
713 	unsigned lcore_id = rte_lcore_id();
714 	uint64_t prev_tsc = 0, diff_tsc, cur_tsc, timer_tsc = 0;
715 	unsigned int i, j, nb_rx, len;
716 	uint16_t portid;
717 	struct lcore_queue_conf *qconf = &lcore_queue_conf[lcore_id];
718 	const uint64_t drain_tsc = (rte_get_tsc_hz() + US_PER_S - 1) /
719 			US_PER_S * BURST_TX_DRAIN_US;
720 	struct l2fwd_crypto_params *cparams;
721 	struct l2fwd_crypto_params port_cparams[qconf->nb_crypto_devs];
722 	struct rte_cryptodev_sym_session *session;
723 
724 	if (qconf->nb_rx_ports == 0) {
725 		RTE_LOG(INFO, L2FWD, "lcore %u has nothing to do\n", lcore_id);
726 		return;
727 	}
728 
729 	RTE_LOG(INFO, L2FWD, "entering main loop on lcore %u\n", lcore_id);
730 
731 	for (i = 0; i < qconf->nb_rx_ports; i++) {
732 
733 		portid = qconf->rx_port_list[i];
734 		RTE_LOG(INFO, L2FWD, " -- lcoreid=%u portid=%u\n", lcore_id,
735 			portid);
736 	}
737 
738 	for (i = 0; i < qconf->nb_crypto_devs; i++) {
739 		port_cparams[i].do_cipher = 0;
740 		port_cparams[i].do_hash = 0;
741 		port_cparams[i].do_aead = 0;
742 
743 		switch (options->xform_chain) {
744 		case L2FWD_CRYPTO_AEAD:
745 			port_cparams[i].do_aead = 1;
746 			break;
747 		case L2FWD_CRYPTO_CIPHER_HASH:
748 		case L2FWD_CRYPTO_HASH_CIPHER:
749 			port_cparams[i].do_cipher = 1;
750 			port_cparams[i].do_hash = 1;
751 			break;
752 		case L2FWD_CRYPTO_HASH_ONLY:
753 			port_cparams[i].do_hash = 1;
754 			break;
755 		case L2FWD_CRYPTO_CIPHER_ONLY:
756 			port_cparams[i].do_cipher = 1;
757 			break;
758 		}
759 
760 		port_cparams[i].dev_id = qconf->cryptodev_list[i];
761 		port_cparams[i].qp_id = 0;
762 
763 		port_cparams[i].block_size = options->block_size;
764 
765 		if (port_cparams[i].do_hash) {
766 			port_cparams[i].auth_iv.data = options->auth_iv.data;
767 			port_cparams[i].auth_iv.length = options->auth_iv.length;
768 			if (!options->auth_iv_param)
769 				generate_random_key(port_cparams[i].auth_iv.data,
770 						port_cparams[i].auth_iv.length);
771 			if (options->auth_xform.auth.op == RTE_CRYPTO_AUTH_OP_VERIFY)
772 				port_cparams[i].hash_verify = 1;
773 			else
774 				port_cparams[i].hash_verify = 0;
775 
776 			port_cparams[i].auth_algo = options->auth_xform.auth.algo;
777 			port_cparams[i].digest_length =
778 					options->auth_xform.auth.digest_length;
779 			/* Set IV parameters */
780 			if (options->auth_iv.length) {
781 				options->auth_xform.auth.iv.offset =
782 					IV_OFFSET + options->cipher_iv.length;
783 				options->auth_xform.auth.iv.length =
784 					options->auth_iv.length;
785 			}
786 		}
787 
788 		if (port_cparams[i].do_aead) {
789 			port_cparams[i].aead_iv.data = options->aead_iv.data;
790 			port_cparams[i].aead_iv.length = options->aead_iv.length;
791 			if (!options->aead_iv_param)
792 				generate_random_key(port_cparams[i].aead_iv.data,
793 						port_cparams[i].aead_iv.length);
794 			port_cparams[i].aead_algo = options->aead_xform.aead.algo;
795 			port_cparams[i].digest_length =
796 					options->aead_xform.aead.digest_length;
797 			if (options->aead_xform.aead.aad_length) {
798 				port_cparams[i].aad.data = options->aad.data;
799 				port_cparams[i].aad.phys_addr = options->aad.phys_addr;
800 				port_cparams[i].aad.length = options->aad.length;
801 				if (!options->aad_param)
802 					generate_random_key(port_cparams[i].aad.data,
803 						port_cparams[i].aad.length);
804 				/*
805 				 * If doing AES-CCM, first 18 bytes has to be reserved,
806 				 * and actual AAD should start from byte 18
807 				 */
808 				if (port_cparams[i].aead_algo == RTE_CRYPTO_AEAD_AES_CCM)
809 					memmove(port_cparams[i].aad.data + 18,
810 							port_cparams[i].aad.data,
811 							port_cparams[i].aad.length);
812 
813 			} else
814 				port_cparams[i].aad.length = 0;
815 
816 			if (options->aead_xform.aead.op == RTE_CRYPTO_AEAD_OP_DECRYPT)
817 				port_cparams[i].hash_verify = 1;
818 			else
819 				port_cparams[i].hash_verify = 0;
820 
821 			/* Set IV parameters */
822 			options->aead_xform.aead.iv.offset = IV_OFFSET;
823 			options->aead_xform.aead.iv.length = options->aead_iv.length;
824 		}
825 
826 		if (port_cparams[i].do_cipher) {
827 			port_cparams[i].cipher_iv.data = options->cipher_iv.data;
828 			port_cparams[i].cipher_iv.length = options->cipher_iv.length;
829 			if (!options->cipher_iv_param)
830 				generate_random_key(port_cparams[i].cipher_iv.data,
831 						port_cparams[i].cipher_iv.length);
832 
833 			port_cparams[i].cipher_algo = options->cipher_xform.cipher.algo;
834 			port_cparams[i].cipher_dataunit_len =
835 				options->cipher_xform.cipher.dataunit_len;
836 			/* Set IV parameters */
837 			options->cipher_xform.cipher.iv.offset = IV_OFFSET;
838 			options->cipher_xform.cipher.iv.length =
839 						options->cipher_iv.length;
840 		}
841 
842 		session = initialize_crypto_session(options,
843 				port_cparams[i].dev_id);
844 		if (session == NULL)
845 			rte_exit(EXIT_FAILURE, "Failed to initialize crypto session\n");
846 
847 		port_cparams[i].session = session;
848 
849 		RTE_LOG(INFO, L2FWD, " -- lcoreid=%u cryptoid=%u\n", lcore_id,
850 				port_cparams[i].dev_id);
851 	}
852 
853 	l2fwd_crypto_options_print(options);
854 
855 	/*
856 	 * Initialize previous tsc timestamp before the loop,
857 	 * to avoid showing the port statistics immediately,
858 	 * so user can see the crypto information.
859 	 */
860 	prev_tsc = rte_rdtsc();
861 	while (1) {
862 
863 		cur_tsc = rte_rdtsc();
864 
865 		/*
866 		 * Crypto device/TX burst queue drain
867 		 */
868 		diff_tsc = cur_tsc - prev_tsc;
869 		if (unlikely(diff_tsc > drain_tsc)) {
870 			/* Enqueue all crypto ops remaining in buffers */
871 			for (i = 0; i < qconf->nb_crypto_devs; i++) {
872 				cparams = &port_cparams[i];
873 				len = qconf->op_buf[cparams->dev_id].len;
874 				l2fwd_crypto_send_burst(qconf, len, cparams);
875 				qconf->op_buf[cparams->dev_id].len = 0;
876 			}
877 			/* Transmit all packets remaining in buffers */
878 			for (portid = 0; portid < RTE_MAX_ETHPORTS; portid++) {
879 				if (qconf->pkt_buf[portid].len == 0)
880 					continue;
881 				l2fwd_send_burst(&lcore_queue_conf[lcore_id],
882 						 qconf->pkt_buf[portid].len,
883 						 portid);
884 				qconf->pkt_buf[portid].len = 0;
885 			}
886 
887 			/* if timer is enabled */
888 			if (options->refresh_period > 0) {
889 
890 				/* advance the timer */
891 				timer_tsc += diff_tsc;
892 
893 				/* if timer has reached its timeout */
894 				if (unlikely(timer_tsc >=
895 						options->refresh_period)) {
896 
897 					/* do this only on main core */
898 					if (lcore_id == rte_get_main_lcore()) {
899 						print_stats();
900 						timer_tsc = 0;
901 					}
902 				}
903 			}
904 
905 			prev_tsc = cur_tsc;
906 		}
907 
908 		/*
909 		 * Read packet from RX queues
910 		 */
911 		for (i = 0; i < qconf->nb_rx_ports; i++) {
912 			portid = qconf->rx_port_list[i];
913 
914 			cparams = &port_cparams[i];
915 
916 			nb_rx = rte_eth_rx_burst(portid, 0,
917 						 pkts_burst, MAX_PKT_BURST);
918 			if (unlikely(signal_received))
919 				return;
920 
921 			port_statistics[portid].rx += nb_rx;
922 
923 			/* Allocate and fillcrypto operations. 8< */
924 			if (nb_rx) {
925 				/*
926 				 * If we can't allocate a crypto_ops, then drop
927 				 * the rest of the burst and dequeue and
928 				 * process the packets to free offload structs
929 				 */
930 				if (rte_crypto_op_bulk_alloc(
931 						l2fwd_crypto_op_pool,
932 						RTE_CRYPTO_OP_TYPE_SYMMETRIC,
933 						ops_burst, nb_rx) !=
934 								nb_rx) {
935 					for (j = 0; j < nb_rx; j++)
936 						rte_pktmbuf_free(pkts_burst[j]);
937 
938 					nb_rx = 0;
939 				}
940 				/* >8 End of crypto operation allocated and filled. */
941 
942 				/* Enqueue packets from Crypto device*/
943 				for (j = 0; j < nb_rx; j++) {
944 					m = pkts_burst[j];
945 
946 					l2fwd_simple_crypto_enqueue(m,
947 							ops_burst[j], cparams);
948 				}
949 			}
950 
951 			/* Dequeue packets from Crypto device. 8< */
952 			do {
953 				nb_rx = rte_cryptodev_dequeue_burst(
954 						cparams->dev_id, cparams->qp_id,
955 						ops_burst, MAX_PKT_BURST);
956 
957 				crypto_statistics[cparams->dev_id].dequeued +=
958 						nb_rx;
959 
960 				/* Forward crypto'd packets */
961 				for (j = 0; j < nb_rx; j++) {
962 					m = ops_burst[j]->sym->m_src;
963 
964 					rte_crypto_op_free(ops_burst[j]);
965 					l2fwd_simple_forward(m, portid,
966 							options);
967 				}
968 			} while (nb_rx == MAX_PKT_BURST);
969 			/* >8 End of dequeue packets from crypto device. */
970 		}
971 	}
972 }
973 
974 static int
975 l2fwd_launch_one_lcore(void *arg)
976 {
977 	l2fwd_main_loop((struct l2fwd_crypto_options *)arg);
978 	return 0;
979 }
980 
981 /* Display command line arguments usage */
982 static void
983 l2fwd_crypto_usage(const char *prgname)
984 {
985 	printf("%s [EAL options] --\n"
986 		"  -p PORTMASK: hexadecimal bitmask of ports to configure\n"
987 		"  -q NQ: number of queue (=ports) per lcore (default is 1)\n"
988 		"  -s manage all ports from single lcore\n"
989 		"  -T PERIOD: statistics will be refreshed each PERIOD seconds"
990 		" (0 to disable, 10 default, 86400 maximum)\n"
991 
992 		"  --cdev_type HW / SW / ANY\n"
993 		"  --chain HASH_CIPHER / CIPHER_HASH / CIPHER_ONLY /"
994 		" HASH_ONLY / AEAD\n"
995 
996 		"  --cipher_algo ALGO\n"
997 		"  --cipher_op ENCRYPT / DECRYPT\n"
998 		"  --cipher_key KEY (bytes separated with \":\")\n"
999 		"  --cipher_key_random_size SIZE: size of cipher key when generated randomly\n"
1000 		"  --cipher_iv IV (bytes separated with \":\")\n"
1001 		"  --cipher_iv_random_size SIZE: size of cipher IV when generated randomly\n"
1002 		"  --cipher_dataunit_len SIZE: length of the algorithm data-unit\n"
1003 
1004 		"  --auth_algo ALGO\n"
1005 		"  --auth_op GENERATE / VERIFY\n"
1006 		"  --auth_key KEY (bytes separated with \":\")\n"
1007 		"  --auth_key_random_size SIZE: size of auth key when generated randomly\n"
1008 		"  --auth_iv IV (bytes separated with \":\")\n"
1009 		"  --auth_iv_random_size SIZE: size of auth IV when generated randomly\n"
1010 
1011 		"  --aead_algo ALGO\n"
1012 		"  --aead_op ENCRYPT / DECRYPT\n"
1013 		"  --aead_key KEY (bytes separated with \":\")\n"
1014 		"  --aead_key_random_size SIZE: size of AEAD key when generated randomly\n"
1015 		"  --aead_iv IV (bytes separated with \":\")\n"
1016 		"  --aead_iv_random_size SIZE: size of AEAD IV when generated randomly\n"
1017 		"  --aad AAD (bytes separated with \":\")\n"
1018 		"  --aad_random_size SIZE: size of AAD when generated randomly\n"
1019 
1020 		"  --digest_size SIZE: size of digest to be generated/verified\n"
1021 
1022 		"  --sessionless\n"
1023 		"  --cryptodev_mask MASK: hexadecimal bitmask of crypto devices to configure\n"
1024 
1025 		"  --[no-]mac-updating: Enable or disable MAC addresses updating (enabled by default)\n"
1026 		"      When enabled:\n"
1027 		"       - The source MAC address is replaced by the TX port MAC address\n"
1028 		"       - The destination MAC address is replaced by 02:00:00:00:00:TX_PORT_ID\n",
1029 	       prgname);
1030 }
1031 
1032 /** Parse crypto device type command line argument */
1033 static int
1034 parse_cryptodev_type(enum cdev_type *type, char *optarg)
1035 {
1036 	if (strcmp("HW", optarg) == 0) {
1037 		*type = CDEV_TYPE_HW;
1038 		return 0;
1039 	} else if (strcmp("SW", optarg) == 0) {
1040 		*type = CDEV_TYPE_SW;
1041 		return 0;
1042 	} else if (strcmp("ANY", optarg) == 0) {
1043 		*type = CDEV_TYPE_ANY;
1044 		return 0;
1045 	}
1046 
1047 	return -1;
1048 }
1049 
1050 /** Parse crypto chain xform command line argument */
1051 static int
1052 parse_crypto_opt_chain(struct l2fwd_crypto_options *options, char *optarg)
1053 {
1054 	if (strcmp("CIPHER_HASH", optarg) == 0) {
1055 		options->xform_chain = L2FWD_CRYPTO_CIPHER_HASH;
1056 		return 0;
1057 	} else if (strcmp("HASH_CIPHER", optarg) == 0) {
1058 		options->xform_chain = L2FWD_CRYPTO_HASH_CIPHER;
1059 		return 0;
1060 	} else if (strcmp("CIPHER_ONLY", optarg) == 0) {
1061 		options->xform_chain = L2FWD_CRYPTO_CIPHER_ONLY;
1062 		return 0;
1063 	} else if (strcmp("HASH_ONLY", optarg) == 0) {
1064 		options->xform_chain = L2FWD_CRYPTO_HASH_ONLY;
1065 		return 0;
1066 	} else if (strcmp("AEAD", optarg) == 0) {
1067 		options->xform_chain = L2FWD_CRYPTO_AEAD;
1068 		return 0;
1069 	}
1070 
1071 	return -1;
1072 }
1073 
1074 /** Parse crypto cipher algo option command line argument */
1075 static int
1076 parse_cipher_algo(enum rte_crypto_cipher_algorithm *algo, char *optarg)
1077 {
1078 
1079 	if (rte_cryptodev_get_cipher_algo_enum(algo, optarg) < 0) {
1080 		RTE_LOG(ERR, USER1, "Cipher algorithm specified "
1081 				"not supported!\n");
1082 		return -1;
1083 	}
1084 
1085 	return 0;
1086 }
1087 
1088 /** Parse crypto cipher operation command line argument */
1089 static int
1090 parse_cipher_op(enum rte_crypto_cipher_operation *op, char *optarg)
1091 {
1092 	if (strcmp("ENCRYPT", optarg) == 0) {
1093 		*op = RTE_CRYPTO_CIPHER_OP_ENCRYPT;
1094 		return 0;
1095 	} else if (strcmp("DECRYPT", optarg) == 0) {
1096 		*op = RTE_CRYPTO_CIPHER_OP_DECRYPT;
1097 		return 0;
1098 	}
1099 
1100 	printf("Cipher operation not supported!\n");
1101 	return -1;
1102 }
1103 
1104 /** Parse bytes from command line argument */
1105 static int
1106 parse_bytes(uint8_t *data, char *input_arg, uint16_t max_size)
1107 {
1108 	unsigned byte_count;
1109 	char *token;
1110 
1111 	errno = 0;
1112 	for (byte_count = 0, token = strtok(input_arg, ":");
1113 			(byte_count < max_size) && (token != NULL);
1114 			token = strtok(NULL, ":")) {
1115 
1116 		int number = (int)strtol(token, NULL, 16);
1117 
1118 		if (errno == EINVAL || errno == ERANGE || number > 0xFF)
1119 			return -1;
1120 
1121 		data[byte_count++] = (uint8_t)number;
1122 	}
1123 
1124 	return byte_count;
1125 }
1126 
1127 /** Parse size param*/
1128 static int
1129 parse_size(int *size, const char *q_arg)
1130 {
1131 	char *end = NULL;
1132 	unsigned long n;
1133 
1134 	/* parse hexadecimal string */
1135 	n = strtoul(q_arg, &end, 10);
1136 	if ((q_arg[0] == '\0') || (end == NULL) || (*end != '\0'))
1137 		n = 0;
1138 
1139 	if (n == 0) {
1140 		printf("invalid size\n");
1141 		return -1;
1142 	}
1143 
1144 	*size = n;
1145 	return 0;
1146 }
1147 
1148 /** Parse crypto cipher operation command line argument */
1149 static int
1150 parse_auth_algo(enum rte_crypto_auth_algorithm *algo, char *optarg)
1151 {
1152 	if (rte_cryptodev_get_auth_algo_enum(algo, optarg) < 0) {
1153 		RTE_LOG(ERR, USER1, "Authentication algorithm specified "
1154 				"not supported!\n");
1155 		return -1;
1156 	}
1157 
1158 	return 0;
1159 }
1160 
1161 static int
1162 parse_auth_op(enum rte_crypto_auth_operation *op, char *optarg)
1163 {
1164 	if (strcmp("VERIFY", optarg) == 0) {
1165 		*op = RTE_CRYPTO_AUTH_OP_VERIFY;
1166 		return 0;
1167 	} else if (strcmp("GENERATE", optarg) == 0) {
1168 		*op = RTE_CRYPTO_AUTH_OP_GENERATE;
1169 		return 0;
1170 	}
1171 
1172 	printf("Authentication operation specified not supported!\n");
1173 	return -1;
1174 }
1175 
1176 static int
1177 parse_aead_algo(enum rte_crypto_aead_algorithm *algo, char *optarg)
1178 {
1179 	if (rte_cryptodev_get_aead_algo_enum(algo, optarg) < 0) {
1180 		RTE_LOG(ERR, USER1, "AEAD algorithm specified "
1181 				"not supported!\n");
1182 		return -1;
1183 	}
1184 
1185 	return 0;
1186 }
1187 
1188 static int
1189 parse_aead_op(enum rte_crypto_aead_operation *op, char *optarg)
1190 {
1191 	if (strcmp("ENCRYPT", optarg) == 0) {
1192 		*op = RTE_CRYPTO_AEAD_OP_ENCRYPT;
1193 		return 0;
1194 	} else if (strcmp("DECRYPT", optarg) == 0) {
1195 		*op = RTE_CRYPTO_AEAD_OP_DECRYPT;
1196 		return 0;
1197 	}
1198 
1199 	printf("AEAD operation specified not supported!\n");
1200 	return -1;
1201 }
1202 static int
1203 parse_cryptodev_mask(struct l2fwd_crypto_options *options,
1204 		const char *q_arg)
1205 {
1206 	char *end = NULL;
1207 	uint64_t pm;
1208 
1209 	/* parse hexadecimal string */
1210 	pm = strtoul(q_arg, &end, 16);
1211 	if ((pm == '\0') || (end == NULL) || (*end != '\0'))
1212 		pm = 0;
1213 
1214 	options->cryptodev_mask = pm;
1215 	if (options->cryptodev_mask == 0) {
1216 		printf("invalid cryptodev_mask specified\n");
1217 		return -1;
1218 	}
1219 
1220 	return 0;
1221 }
1222 
1223 /** Parse long options */
1224 static int
1225 l2fwd_crypto_parse_args_long_options(struct l2fwd_crypto_options *options,
1226 		struct option *lgopts, int option_index)
1227 {
1228 	int retval;
1229 	int val;
1230 
1231 	if (strcmp(lgopts[option_index].name, "cdev_type") == 0) {
1232 		retval = parse_cryptodev_type(&options->type, optarg);
1233 		if (retval == 0)
1234 			strlcpy(options->string_type, optarg, MAX_STR_LEN);
1235 		return retval;
1236 	}
1237 
1238 	else if (strcmp(lgopts[option_index].name, "chain") == 0)
1239 		return parse_crypto_opt_chain(options, optarg);
1240 
1241 	/* Cipher options */
1242 	else if (strcmp(lgopts[option_index].name, "cipher_algo") == 0)
1243 		return parse_cipher_algo(&options->cipher_xform.cipher.algo,
1244 				optarg);
1245 
1246 	else if (strcmp(lgopts[option_index].name, "cipher_op") == 0)
1247 		return parse_cipher_op(&options->cipher_xform.cipher.op,
1248 				optarg);
1249 
1250 	else if (strcmp(lgopts[option_index].name, "cipher_key") == 0) {
1251 		options->ckey_param = 1;
1252 		options->cipher_xform.cipher.key.length =
1253 			parse_bytes(options->cipher_key, optarg, MAX_KEY_SIZE);
1254 		if (options->cipher_xform.cipher.key.length > 0)
1255 			return 0;
1256 		else
1257 			return -1;
1258 	}
1259 
1260 	else if (strcmp(lgopts[option_index].name, "cipher_dataunit_len") == 0) {
1261 		retval = parse_size(&val, optarg);
1262 		if (retval == 0 && val >= 0) {
1263 			options->cipher_xform.cipher.dataunit_len =
1264 								(uint32_t)val;
1265 			return 0;
1266 		} else
1267 			return -1;
1268 	}
1269 
1270 	else if (strcmp(lgopts[option_index].name, "cipher_key_random_size") == 0)
1271 		return parse_size(&options->ckey_random_size, optarg);
1272 
1273 	else if (strcmp(lgopts[option_index].name, "cipher_iv") == 0) {
1274 		options->cipher_iv_param = 1;
1275 		options->cipher_iv.length =
1276 			parse_bytes(options->cipher_iv.data, optarg, MAX_IV_SIZE);
1277 		if (options->cipher_iv.length > 0)
1278 			return 0;
1279 		else
1280 			return -1;
1281 	}
1282 
1283 	else if (strcmp(lgopts[option_index].name, "cipher_iv_random_size") == 0)
1284 		return parse_size(&options->cipher_iv_random_size, optarg);
1285 
1286 	/* Authentication options */
1287 	else if (strcmp(lgopts[option_index].name, "auth_algo") == 0) {
1288 		return parse_auth_algo(&options->auth_xform.auth.algo,
1289 				optarg);
1290 	}
1291 
1292 	else if (strcmp(lgopts[option_index].name, "auth_op") == 0)
1293 		return parse_auth_op(&options->auth_xform.auth.op,
1294 				optarg);
1295 
1296 	else if (strcmp(lgopts[option_index].name, "auth_key") == 0) {
1297 		options->akey_param = 1;
1298 		options->auth_xform.auth.key.length =
1299 			parse_bytes(options->auth_key, optarg, MAX_KEY_SIZE);
1300 		if (options->auth_xform.auth.key.length > 0)
1301 			return 0;
1302 		else
1303 			return -1;
1304 	}
1305 
1306 	else if (strcmp(lgopts[option_index].name, "auth_key_random_size") == 0) {
1307 		return parse_size(&options->akey_random_size, optarg);
1308 	}
1309 
1310 	else if (strcmp(lgopts[option_index].name, "auth_iv") == 0) {
1311 		options->auth_iv_param = 1;
1312 		options->auth_iv.length =
1313 			parse_bytes(options->auth_iv.data, optarg, MAX_IV_SIZE);
1314 		if (options->auth_iv.length > 0)
1315 			return 0;
1316 		else
1317 			return -1;
1318 	}
1319 
1320 	else if (strcmp(lgopts[option_index].name, "auth_iv_random_size") == 0)
1321 		return parse_size(&options->auth_iv_random_size, optarg);
1322 
1323 	/* AEAD options */
1324 	else if (strcmp(lgopts[option_index].name, "aead_algo") == 0) {
1325 		return parse_aead_algo(&options->aead_xform.aead.algo,
1326 				optarg);
1327 	}
1328 
1329 	else if (strcmp(lgopts[option_index].name, "aead_op") == 0)
1330 		return parse_aead_op(&options->aead_xform.aead.op,
1331 				optarg);
1332 
1333 	else if (strcmp(lgopts[option_index].name, "aead_key") == 0) {
1334 		options->aead_key_param = 1;
1335 		options->aead_xform.aead.key.length =
1336 			parse_bytes(options->aead_key, optarg, MAX_KEY_SIZE);
1337 		if (options->aead_xform.aead.key.length > 0)
1338 			return 0;
1339 		else
1340 			return -1;
1341 	}
1342 
1343 	else if (strcmp(lgopts[option_index].name, "aead_key_random_size") == 0)
1344 		return parse_size(&options->aead_key_random_size, optarg);
1345 
1346 
1347 	else if (strcmp(lgopts[option_index].name, "aead_iv") == 0) {
1348 		options->aead_iv_param = 1;
1349 		options->aead_iv.length =
1350 			parse_bytes(options->aead_iv.data, optarg, MAX_IV_SIZE);
1351 		if (options->aead_iv.length > 0)
1352 			return 0;
1353 		else
1354 			return -1;
1355 	}
1356 
1357 	else if (strcmp(lgopts[option_index].name, "aead_iv_random_size") == 0)
1358 		return parse_size(&options->aead_iv_random_size, optarg);
1359 
1360 	else if (strcmp(lgopts[option_index].name, "aad") == 0) {
1361 		options->aad_param = 1;
1362 		options->aad.length =
1363 			parse_bytes(options->aad.data, optarg, MAX_AAD_SIZE);
1364 		if (options->aad.length > 0)
1365 			return 0;
1366 		else
1367 			return -1;
1368 	}
1369 
1370 	else if (strcmp(lgopts[option_index].name, "aad_random_size") == 0) {
1371 		return parse_size(&options->aad_random_size, optarg);
1372 	}
1373 
1374 	else if (strcmp(lgopts[option_index].name, "digest_size") == 0) {
1375 		return parse_size(&options->digest_size, optarg);
1376 	}
1377 
1378 	else if (strcmp(lgopts[option_index].name, "sessionless") == 0) {
1379 		options->sessionless = 1;
1380 		return 0;
1381 	}
1382 
1383 	else if (strcmp(lgopts[option_index].name, "cryptodev_mask") == 0)
1384 		return parse_cryptodev_mask(options, optarg);
1385 
1386 	else if (strcmp(lgopts[option_index].name, "mac-updating") == 0) {
1387 		options->mac_updating = 1;
1388 		return 0;
1389 	}
1390 
1391 	else if (strcmp(lgopts[option_index].name, "no-mac-updating") == 0) {
1392 		options->mac_updating = 0;
1393 		return 0;
1394 	}
1395 
1396 	return -1;
1397 }
1398 
1399 /** Parse port mask */
1400 static int
1401 l2fwd_crypto_parse_portmask(struct l2fwd_crypto_options *options,
1402 		const char *q_arg)
1403 {
1404 	char *end = NULL;
1405 	unsigned long pm;
1406 
1407 	/* parse hexadecimal string */
1408 	pm = strtoul(q_arg, &end, 16);
1409 	if ((pm == '\0') || (end == NULL) || (*end != '\0'))
1410 		pm = 0;
1411 
1412 	options->portmask = pm;
1413 	if (options->portmask == 0) {
1414 		printf("invalid portmask specified\n");
1415 		return -1;
1416 	}
1417 
1418 	return pm;
1419 }
1420 
1421 /** Parse number of queues */
1422 static int
1423 l2fwd_crypto_parse_nqueue(struct l2fwd_crypto_options *options,
1424 		const char *q_arg)
1425 {
1426 	char *end = NULL;
1427 	unsigned long n;
1428 
1429 	/* parse hexadecimal string */
1430 	n = strtoul(q_arg, &end, 10);
1431 	if ((q_arg[0] == '\0') || (end == NULL) || (*end != '\0'))
1432 		n = 0;
1433 	else if (n >= MAX_RX_QUEUE_PER_LCORE)
1434 		n = 0;
1435 
1436 	options->nb_ports_per_lcore = n;
1437 	if (options->nb_ports_per_lcore == 0) {
1438 		printf("invalid number of ports selected\n");
1439 		return -1;
1440 	}
1441 
1442 	return 0;
1443 }
1444 
1445 /** Parse timer period */
1446 static int
1447 l2fwd_crypto_parse_timer_period(struct l2fwd_crypto_options *options,
1448 		const char *q_arg)
1449 {
1450 	char *end = NULL;
1451 	unsigned long n;
1452 
1453 	/* parse number string */
1454 	n = (unsigned)strtol(q_arg, &end, 10);
1455 	if ((q_arg[0] == '\0') || (end == NULL) || (*end != '\0'))
1456 		n = 0;
1457 
1458 	if (n >= MAX_TIMER_PERIOD) {
1459 		printf("Warning refresh period specified %lu is greater than "
1460 				"max value %lu! using max value",
1461 				n, MAX_TIMER_PERIOD);
1462 		n = MAX_TIMER_PERIOD;
1463 	}
1464 
1465 	options->refresh_period = n * 1000 * TIMER_MILLISECOND;
1466 
1467 	return 0;
1468 }
1469 
1470 /** Generate default options for application */
1471 static void
1472 l2fwd_crypto_default_options(struct l2fwd_crypto_options *options)
1473 {
1474 	options->portmask = 0xffffffff;
1475 	options->nb_ports_per_lcore = 1;
1476 	options->refresh_period = DEFAULT_TIMER_PERIOD *
1477 					TIMER_MILLISECOND * 1000;
1478 	options->single_lcore = 0;
1479 	options->sessionless = 0;
1480 
1481 	options->xform_chain = L2FWD_CRYPTO_CIPHER_HASH;
1482 
1483 	/* Cipher Data */
1484 	options->cipher_xform.type = RTE_CRYPTO_SYM_XFORM_CIPHER;
1485 	options->cipher_xform.next = NULL;
1486 	options->ckey_param = 0;
1487 	options->ckey_random_size = -1;
1488 	options->cipher_xform.cipher.key.length = 0;
1489 	options->cipher_iv_param = 0;
1490 	options->cipher_iv_random_size = -1;
1491 	options->cipher_iv.length = 0;
1492 
1493 	options->cipher_xform.cipher.algo = RTE_CRYPTO_CIPHER_AES_CBC;
1494 	options->cipher_xform.cipher.op = RTE_CRYPTO_CIPHER_OP_ENCRYPT;
1495 	options->cipher_xform.cipher.dataunit_len = 0;
1496 
1497 	/* Authentication Data */
1498 	options->auth_xform.type = RTE_CRYPTO_SYM_XFORM_AUTH;
1499 	options->auth_xform.next = NULL;
1500 	options->akey_param = 0;
1501 	options->akey_random_size = -1;
1502 	options->auth_xform.auth.key.length = 0;
1503 	options->auth_iv_param = 0;
1504 	options->auth_iv_random_size = -1;
1505 	options->auth_iv.length = 0;
1506 
1507 	options->auth_xform.auth.algo = RTE_CRYPTO_AUTH_SHA1_HMAC;
1508 	options->auth_xform.auth.op = RTE_CRYPTO_AUTH_OP_GENERATE;
1509 
1510 	/* AEAD Data */
1511 	options->aead_xform.type = RTE_CRYPTO_SYM_XFORM_AEAD;
1512 	options->aead_xform.next = NULL;
1513 	options->aead_key_param = 0;
1514 	options->aead_key_random_size = -1;
1515 	options->aead_xform.aead.key.length = 0;
1516 	options->aead_iv_param = 0;
1517 	options->aead_iv_random_size = -1;
1518 	options->aead_iv.length = 0;
1519 
1520 	options->aead_xform.aead.algo = RTE_CRYPTO_AEAD_AES_GCM;
1521 	options->aead_xform.aead.op = RTE_CRYPTO_AEAD_OP_ENCRYPT;
1522 
1523 	options->aad_param = 0;
1524 	options->aad_random_size = -1;
1525 	options->aad.length = 0;
1526 
1527 	options->digest_size = -1;
1528 
1529 	options->type = CDEV_TYPE_ANY;
1530 	options->cryptodev_mask = UINT64_MAX;
1531 
1532 	options->mac_updating = 1;
1533 }
1534 
1535 static void
1536 display_cipher_info(struct l2fwd_crypto_options *options)
1537 {
1538 	printf("\n---- Cipher information ---\n");
1539 	printf("Algorithm: %s\n",
1540 		rte_crypto_cipher_algorithm_strings[options->cipher_xform.cipher.algo]);
1541 	rte_hexdump(stdout, "Cipher key:",
1542 			options->cipher_xform.cipher.key.data,
1543 			options->cipher_xform.cipher.key.length);
1544 	rte_hexdump(stdout, "IV:", options->cipher_iv.data, options->cipher_iv.length);
1545 }
1546 
1547 static void
1548 display_auth_info(struct l2fwd_crypto_options *options)
1549 {
1550 	printf("\n---- Authentication information ---\n");
1551 	printf("Algorithm: %s\n",
1552 		rte_crypto_auth_algorithm_strings[options->auth_xform.auth.algo]);
1553 	rte_hexdump(stdout, "Auth key:",
1554 			options->auth_xform.auth.key.data,
1555 			options->auth_xform.auth.key.length);
1556 	rte_hexdump(stdout, "IV:", options->auth_iv.data, options->auth_iv.length);
1557 }
1558 
1559 static void
1560 display_aead_info(struct l2fwd_crypto_options *options)
1561 {
1562 	printf("\n---- AEAD information ---\n");
1563 	printf("Algorithm: %s\n",
1564 		rte_crypto_aead_algorithm_strings[options->aead_xform.aead.algo]);
1565 	rte_hexdump(stdout, "AEAD key:",
1566 			options->aead_xform.aead.key.data,
1567 			options->aead_xform.aead.key.length);
1568 	rte_hexdump(stdout, "IV:", options->aead_iv.data, options->aead_iv.length);
1569 	rte_hexdump(stdout, "AAD:", options->aad.data, options->aad.length);
1570 }
1571 
1572 static void
1573 l2fwd_crypto_options_print(struct l2fwd_crypto_options *options)
1574 {
1575 	char string_cipher_op[MAX_STR_LEN];
1576 	char string_auth_op[MAX_STR_LEN];
1577 	char string_aead_op[MAX_STR_LEN];
1578 
1579 	if (options->cipher_xform.cipher.op == RTE_CRYPTO_CIPHER_OP_ENCRYPT)
1580 		strcpy(string_cipher_op, "Encrypt");
1581 	else
1582 		strcpy(string_cipher_op, "Decrypt");
1583 
1584 	if (options->auth_xform.auth.op == RTE_CRYPTO_AUTH_OP_GENERATE)
1585 		strcpy(string_auth_op, "Auth generate");
1586 	else
1587 		strcpy(string_auth_op, "Auth verify");
1588 
1589 	if (options->aead_xform.aead.op == RTE_CRYPTO_AEAD_OP_ENCRYPT)
1590 		strcpy(string_aead_op, "Authenticated encryption");
1591 	else
1592 		strcpy(string_aead_op, "Authenticated decryption");
1593 
1594 
1595 	printf("Options:-\nn");
1596 	printf("portmask: %x\n", options->portmask);
1597 	printf("ports per lcore: %u\n", options->nb_ports_per_lcore);
1598 	printf("refresh period : %u\n", options->refresh_period);
1599 	printf("single lcore mode: %s\n",
1600 			options->single_lcore ? "enabled" : "disabled");
1601 	printf("stats_printing: %s\n",
1602 			options->refresh_period == 0 ? "disabled" : "enabled");
1603 
1604 	printf("sessionless crypto: %s\n",
1605 			options->sessionless ? "enabled" : "disabled");
1606 
1607 	if (options->ckey_param && (options->ckey_random_size != -1))
1608 		printf("Cipher key already parsed, ignoring size of random key\n");
1609 
1610 	if (options->akey_param && (options->akey_random_size != -1))
1611 		printf("Auth key already parsed, ignoring size of random key\n");
1612 
1613 	if (options->cipher_iv_param && (options->cipher_iv_random_size != -1))
1614 		printf("Cipher IV already parsed, ignoring size of random IV\n");
1615 
1616 	if (options->auth_iv_param && (options->auth_iv_random_size != -1))
1617 		printf("Auth IV already parsed, ignoring size of random IV\n");
1618 
1619 	if (options->aad_param && (options->aad_random_size != -1))
1620 		printf("AAD already parsed, ignoring size of random AAD\n");
1621 
1622 	printf("\nCrypto chain: ");
1623 	switch (options->xform_chain) {
1624 	case L2FWD_CRYPTO_AEAD:
1625 		printf("Input --> %s --> Output\n", string_aead_op);
1626 		display_aead_info(options);
1627 		break;
1628 	case L2FWD_CRYPTO_CIPHER_HASH:
1629 		printf("Input --> %s --> %s --> Output\n",
1630 			string_cipher_op, string_auth_op);
1631 		display_cipher_info(options);
1632 		display_auth_info(options);
1633 		break;
1634 	case L2FWD_CRYPTO_HASH_CIPHER:
1635 		printf("Input --> %s --> %s --> Output\n",
1636 			string_auth_op, string_cipher_op);
1637 		display_cipher_info(options);
1638 		display_auth_info(options);
1639 		break;
1640 	case L2FWD_CRYPTO_HASH_ONLY:
1641 		printf("Input --> %s --> Output\n", string_auth_op);
1642 		display_auth_info(options);
1643 		break;
1644 	case L2FWD_CRYPTO_CIPHER_ONLY:
1645 		printf("Input --> %s --> Output\n", string_cipher_op);
1646 		display_cipher_info(options);
1647 		break;
1648 	}
1649 }
1650 
1651 /* Parse the argument given in the command line of the application */
1652 static int
1653 l2fwd_crypto_parse_args(struct l2fwd_crypto_options *options,
1654 		int argc, char **argv)
1655 {
1656 	int opt, retval, option_index;
1657 	char **argvopt = argv, *prgname = argv[0];
1658 
1659 	static struct option lgopts[] = {
1660 			{ "sessionless", no_argument, 0, 0 },
1661 
1662 			{ "cdev_type", required_argument, 0, 0 },
1663 			{ "chain", required_argument, 0, 0 },
1664 
1665 			{ "cipher_algo", required_argument, 0, 0 },
1666 			{ "cipher_op", required_argument, 0, 0 },
1667 			{ "cipher_key", required_argument, 0, 0 },
1668 			{ "cipher_key_random_size", required_argument, 0, 0 },
1669 			{ "cipher_iv", required_argument, 0, 0 },
1670 			{ "cipher_iv_random_size", required_argument, 0, 0 },
1671 			{ "cipher_dataunit_len", required_argument, 0, 0},
1672 
1673 			{ "auth_algo", required_argument, 0, 0 },
1674 			{ "auth_op", required_argument, 0, 0 },
1675 			{ "auth_key", required_argument, 0, 0 },
1676 			{ "auth_key_random_size", required_argument, 0, 0 },
1677 			{ "auth_iv", required_argument, 0, 0 },
1678 			{ "auth_iv_random_size", required_argument, 0, 0 },
1679 
1680 			{ "aead_algo", required_argument, 0, 0 },
1681 			{ "aead_op", required_argument, 0, 0 },
1682 			{ "aead_key", required_argument, 0, 0 },
1683 			{ "aead_key_random_size", required_argument, 0, 0 },
1684 			{ "aead_iv", required_argument, 0, 0 },
1685 			{ "aead_iv_random_size", required_argument, 0, 0 },
1686 
1687 			{ "aad", required_argument, 0, 0 },
1688 			{ "aad_random_size", required_argument, 0, 0 },
1689 
1690 			{ "digest_size", required_argument, 0, 0 },
1691 
1692 			{ "sessionless", no_argument, 0, 0 },
1693 			{ "cryptodev_mask", required_argument, 0, 0},
1694 
1695 			{ "mac-updating", no_argument, 0, 0},
1696 			{ "no-mac-updating", no_argument, 0, 0},
1697 
1698 			{ NULL, 0, 0, 0 }
1699 	};
1700 
1701 	l2fwd_crypto_default_options(options);
1702 
1703 	while ((opt = getopt_long(argc, argvopt, "p:q:sT:", lgopts,
1704 			&option_index)) != EOF) {
1705 		switch (opt) {
1706 		/* long options */
1707 		case 0:
1708 			retval = l2fwd_crypto_parse_args_long_options(options,
1709 					lgopts, option_index);
1710 			if (retval < 0) {
1711 				l2fwd_crypto_usage(prgname);
1712 				return -1;
1713 			}
1714 			break;
1715 
1716 		/* portmask */
1717 		case 'p':
1718 			retval = l2fwd_crypto_parse_portmask(options, optarg);
1719 			if (retval < 0) {
1720 				l2fwd_crypto_usage(prgname);
1721 				return -1;
1722 			}
1723 			break;
1724 
1725 		/* nqueue */
1726 		case 'q':
1727 			retval = l2fwd_crypto_parse_nqueue(options, optarg);
1728 			if (retval < 0) {
1729 				l2fwd_crypto_usage(prgname);
1730 				return -1;
1731 			}
1732 			break;
1733 
1734 		/* single  */
1735 		case 's':
1736 			options->single_lcore = 1;
1737 
1738 			break;
1739 
1740 		/* timer period */
1741 		case 'T':
1742 			retval = l2fwd_crypto_parse_timer_period(options,
1743 					optarg);
1744 			if (retval < 0) {
1745 				l2fwd_crypto_usage(prgname);
1746 				return -1;
1747 			}
1748 			break;
1749 
1750 		default:
1751 			l2fwd_crypto_usage(prgname);
1752 			return -1;
1753 		}
1754 	}
1755 
1756 
1757 	if (optind >= 0)
1758 		argv[optind-1] = prgname;
1759 
1760 	retval = optind-1;
1761 	optind = 1; /* reset getopt lib */
1762 
1763 	return retval;
1764 }
1765 
1766 /* Check the link status of all ports in up to 9s, and print them finally */
1767 static void
1768 check_all_ports_link_status(uint32_t port_mask)
1769 {
1770 #define CHECK_INTERVAL 100 /* 100ms */
1771 #define MAX_CHECK_TIME 90 /* 9s (90 * 100ms) in total */
1772 	uint16_t portid;
1773 	uint8_t count, all_ports_up, print_flag = 0;
1774 	struct rte_eth_link link;
1775 	int ret;
1776 	char link_status_text[RTE_ETH_LINK_MAX_STR_LEN];
1777 
1778 	printf("\nChecking link status");
1779 	fflush(stdout);
1780 	for (count = 0; count <= MAX_CHECK_TIME; count++) {
1781 		all_ports_up = 1;
1782 		RTE_ETH_FOREACH_DEV(portid) {
1783 			if ((port_mask & (1 << portid)) == 0)
1784 				continue;
1785 			memset(&link, 0, sizeof(link));
1786 			ret = rte_eth_link_get_nowait(portid, &link);
1787 			if (ret < 0) {
1788 				all_ports_up = 0;
1789 				if (print_flag == 1)
1790 					printf("Port %u link get failed: %s\n",
1791 						portid, rte_strerror(-ret));
1792 				continue;
1793 			}
1794 			/* print link status if flag set */
1795 			if (print_flag == 1) {
1796 				rte_eth_link_to_str(link_status_text,
1797 					sizeof(link_status_text), &link);
1798 				printf("Port %d %s\n", portid,
1799 					link_status_text);
1800 				continue;
1801 			}
1802 			/* clear all_ports_up flag if any link down */
1803 			if (link.link_status == RTE_ETH_LINK_DOWN) {
1804 				all_ports_up = 0;
1805 				break;
1806 			}
1807 		}
1808 		/* after finally printing all link status, get out */
1809 		if (print_flag == 1)
1810 			break;
1811 
1812 		if (all_ports_up == 0) {
1813 			printf(".");
1814 			fflush(stdout);
1815 			rte_delay_ms(CHECK_INTERVAL);
1816 		}
1817 
1818 		/* set the print_flag if all ports up or timeout */
1819 		if (all_ports_up == 1 || count == (MAX_CHECK_TIME - 1)) {
1820 			print_flag = 1;
1821 			printf("done\n");
1822 		}
1823 	}
1824 }
1825 
1826 /* Check if device has to be HW/SW or any */
1827 static int
1828 check_type(const struct l2fwd_crypto_options *options,
1829 		const struct rte_cryptodev_info *dev_info)
1830 {
1831 	if (options->type == CDEV_TYPE_HW &&
1832 			(dev_info->feature_flags & RTE_CRYPTODEV_FF_HW_ACCELERATED))
1833 		return 0;
1834 	if (options->type == CDEV_TYPE_SW &&
1835 			!(dev_info->feature_flags & RTE_CRYPTODEV_FF_HW_ACCELERATED))
1836 		return 0;
1837 	if (options->type == CDEV_TYPE_ANY)
1838 		return 0;
1839 
1840 	return -1;
1841 }
1842 
1843 static const struct rte_cryptodev_capabilities *
1844 check_device_support_cipher_algo(const struct l2fwd_crypto_options *options,
1845 		const struct rte_cryptodev_info *dev_info,
1846 		uint8_t cdev_id)
1847 {
1848 	unsigned int i = 0;
1849 	const struct rte_cryptodev_capabilities *cap = &dev_info->capabilities[0];
1850 	enum rte_crypto_cipher_algorithm cap_cipher_algo;
1851 	enum rte_crypto_cipher_algorithm opt_cipher_algo =
1852 					options->cipher_xform.cipher.algo;
1853 
1854 	while (cap->op != RTE_CRYPTO_OP_TYPE_UNDEFINED) {
1855 		cap_cipher_algo = cap->sym.cipher.algo;
1856 		if (cap->sym.xform_type == RTE_CRYPTO_SYM_XFORM_CIPHER) {
1857 			if (cap_cipher_algo == opt_cipher_algo) {
1858 				if (check_type(options, dev_info) == 0)
1859 					break;
1860 			}
1861 		}
1862 		cap = &dev_info->capabilities[++i];
1863 	}
1864 
1865 	if (cap->op == RTE_CRYPTO_OP_TYPE_UNDEFINED) {
1866 		printf("Algorithm %s not supported by cryptodev %u"
1867 			" or device not of preferred type (%s)\n",
1868 			rte_crypto_cipher_algorithm_strings[opt_cipher_algo],
1869 			cdev_id,
1870 			options->string_type);
1871 		return NULL;
1872 	}
1873 
1874 	return cap;
1875 }
1876 
1877 static const struct rte_cryptodev_capabilities *
1878 check_device_support_auth_algo(const struct l2fwd_crypto_options *options,
1879 		const struct rte_cryptodev_info *dev_info,
1880 		uint8_t cdev_id)
1881 {
1882 	unsigned int i = 0;
1883 	const struct rte_cryptodev_capabilities *cap = &dev_info->capabilities[0];
1884 	enum rte_crypto_auth_algorithm cap_auth_algo;
1885 	enum rte_crypto_auth_algorithm opt_auth_algo =
1886 					options->auth_xform.auth.algo;
1887 
1888 	while (cap->op != RTE_CRYPTO_OP_TYPE_UNDEFINED) {
1889 		cap_auth_algo = cap->sym.auth.algo;
1890 		if (cap->sym.xform_type == RTE_CRYPTO_SYM_XFORM_AUTH) {
1891 			if (cap_auth_algo == opt_auth_algo) {
1892 				if (check_type(options, dev_info) == 0)
1893 					break;
1894 			}
1895 		}
1896 		cap = &dev_info->capabilities[++i];
1897 	}
1898 
1899 	if (cap->op == RTE_CRYPTO_OP_TYPE_UNDEFINED) {
1900 		printf("Algorithm %s not supported by cryptodev %u"
1901 			" or device not of preferred type (%s)\n",
1902 			rte_crypto_auth_algorithm_strings[opt_auth_algo],
1903 			cdev_id,
1904 			options->string_type);
1905 		return NULL;
1906 	}
1907 
1908 	return cap;
1909 }
1910 
1911 static const struct rte_cryptodev_capabilities *
1912 check_device_support_aead_algo(const struct l2fwd_crypto_options *options,
1913 		const struct rte_cryptodev_info *dev_info,
1914 		uint8_t cdev_id)
1915 {
1916 	unsigned int i = 0;
1917 	const struct rte_cryptodev_capabilities *cap = &dev_info->capabilities[0];
1918 	enum rte_crypto_aead_algorithm cap_aead_algo;
1919 	enum rte_crypto_aead_algorithm opt_aead_algo =
1920 					options->aead_xform.aead.algo;
1921 
1922 	while (cap->op != RTE_CRYPTO_OP_TYPE_UNDEFINED) {
1923 		cap_aead_algo = cap->sym.aead.algo;
1924 		if (cap->sym.xform_type == RTE_CRYPTO_SYM_XFORM_AEAD) {
1925 			if (cap_aead_algo == opt_aead_algo) {
1926 				if (check_type(options, dev_info) == 0)
1927 					break;
1928 			}
1929 		}
1930 		cap = &dev_info->capabilities[++i];
1931 	}
1932 
1933 	if (cap->op == RTE_CRYPTO_OP_TYPE_UNDEFINED) {
1934 		printf("Algorithm %s not supported by cryptodev %u"
1935 			" or device not of preferred type (%s)\n",
1936 			rte_crypto_aead_algorithm_strings[opt_aead_algo],
1937 			cdev_id,
1938 			options->string_type);
1939 		return NULL;
1940 	}
1941 
1942 	return cap;
1943 }
1944 
1945 /* Check if the device is enabled by cryptodev_mask */
1946 static int
1947 check_cryptodev_mask(struct l2fwd_crypto_options *options,
1948 		uint8_t cdev_id)
1949 {
1950 	if (options->cryptodev_mask & (1 << cdev_id))
1951 		return 0;
1952 
1953 	return -1;
1954 }
1955 
1956 static inline int
1957 check_supported_size(uint16_t length, uint16_t min, uint16_t max,
1958 		uint16_t increment)
1959 {
1960 	uint16_t supp_size;
1961 
1962 	/* Single value */
1963 	if (increment == 0) {
1964 		if (length == min)
1965 			return 0;
1966 		else
1967 			return -1;
1968 	}
1969 
1970 	/* Range of values */
1971 	for (supp_size = min; supp_size <= max; supp_size += increment) {
1972 		if (length == supp_size)
1973 			return 0;
1974 	}
1975 
1976 	return -1;
1977 }
1978 
1979 static int
1980 check_iv_param(const struct rte_crypto_param_range *iv_range_size,
1981 		unsigned int iv_param, int iv_random_size,
1982 		uint16_t iv_length)
1983 {
1984 	/*
1985 	 * Check if length of provided IV is supported
1986 	 * by the algorithm chosen.
1987 	 */
1988 	if (iv_param) {
1989 		if (check_supported_size(iv_length,
1990 				iv_range_size->min,
1991 				iv_range_size->max,
1992 				iv_range_size->increment)
1993 					!= 0)
1994 			return -1;
1995 	/*
1996 	 * Check if length of IV to be randomly generated
1997 	 * is supported by the algorithm chosen.
1998 	 */
1999 	} else if (iv_random_size != -1) {
2000 		if (check_supported_size(iv_random_size,
2001 				iv_range_size->min,
2002 				iv_range_size->max,
2003 				iv_range_size->increment)
2004 					!= 0)
2005 			return -1;
2006 	}
2007 
2008 	return 0;
2009 }
2010 
2011 static int
2012 check_capabilities(struct l2fwd_crypto_options *options, uint8_t cdev_id)
2013 {
2014 	struct rte_cryptodev_info dev_info;
2015 	const struct rte_cryptodev_capabilities *cap;
2016 
2017 	rte_cryptodev_info_get(cdev_id, &dev_info);
2018 
2019 	/* Set AEAD parameters */
2020 	if (options->xform_chain == L2FWD_CRYPTO_AEAD) {
2021 		/* Check if device supports AEAD algo */
2022 		cap = check_device_support_aead_algo(options, &dev_info,
2023 						cdev_id);
2024 		if (cap == NULL)
2025 			return -1;
2026 
2027 		if (check_iv_param(&cap->sym.aead.iv_size,
2028 				options->aead_iv_param,
2029 				options->aead_iv_random_size,
2030 				options->aead_iv.length) != 0) {
2031 			RTE_LOG(DEBUG, USER1,
2032 				"Device %u does not support IV length\n",
2033 				cdev_id);
2034 			return -1;
2035 		}
2036 
2037 		/*
2038 		 * Check if length of provided AEAD key is supported
2039 		 * by the algorithm chosen.
2040 		 */
2041 		if (options->aead_key_param) {
2042 			if (check_supported_size(
2043 					options->aead_xform.aead.key.length,
2044 					cap->sym.aead.key_size.min,
2045 					cap->sym.aead.key_size.max,
2046 					cap->sym.aead.key_size.increment)
2047 						!= 0) {
2048 				RTE_LOG(DEBUG, USER1,
2049 					"Device %u does not support "
2050 					"AEAD key length\n",
2051 					cdev_id);
2052 				return -1;
2053 			}
2054 		/*
2055 		 * Check if length of the aead key to be randomly generated
2056 		 * is supported by the algorithm chosen.
2057 		 */
2058 		} else if (options->aead_key_random_size != -1) {
2059 			if (check_supported_size(options->aead_key_random_size,
2060 					cap->sym.aead.key_size.min,
2061 					cap->sym.aead.key_size.max,
2062 					cap->sym.aead.key_size.increment)
2063 						!= 0) {
2064 				RTE_LOG(DEBUG, USER1,
2065 					"Device %u does not support "
2066 					"AEAD key length\n",
2067 					cdev_id);
2068 				return -1;
2069 			}
2070 		}
2071 
2072 
2073 		/*
2074 		 * Check if length of provided AAD is supported
2075 		 * by the algorithm chosen.
2076 		 */
2077 		if (options->aad_param) {
2078 			if (check_supported_size(options->aad.length,
2079 					cap->sym.aead.aad_size.min,
2080 					cap->sym.aead.aad_size.max,
2081 					cap->sym.aead.aad_size.increment)
2082 						!= 0) {
2083 				RTE_LOG(DEBUG, USER1,
2084 					"Device %u does not support "
2085 					"AAD length\n",
2086 					cdev_id);
2087 				return -1;
2088 			}
2089 		/*
2090 		 * Check if length of AAD to be randomly generated
2091 		 * is supported by the algorithm chosen.
2092 		 */
2093 		} else if (options->aad_random_size != -1) {
2094 			if (check_supported_size(options->aad_random_size,
2095 					cap->sym.aead.aad_size.min,
2096 					cap->sym.aead.aad_size.max,
2097 					cap->sym.aead.aad_size.increment)
2098 						!= 0) {
2099 				RTE_LOG(DEBUG, USER1,
2100 					"Device %u does not support "
2101 					"AAD length\n",
2102 					cdev_id);
2103 				return -1;
2104 			}
2105 		}
2106 
2107 		/* Check if digest size is supported by the algorithm. */
2108 		if (options->digest_size != -1) {
2109 			if (check_supported_size(options->digest_size,
2110 					cap->sym.aead.digest_size.min,
2111 					cap->sym.aead.digest_size.max,
2112 					cap->sym.aead.digest_size.increment)
2113 						!= 0) {
2114 				RTE_LOG(DEBUG, USER1,
2115 					"Device %u does not support "
2116 					"digest length\n",
2117 					cdev_id);
2118 				return -1;
2119 			}
2120 		}
2121 	}
2122 
2123 	/* Set cipher parameters */
2124 	if (options->xform_chain == L2FWD_CRYPTO_CIPHER_HASH ||
2125 			options->xform_chain == L2FWD_CRYPTO_HASH_CIPHER ||
2126 			options->xform_chain == L2FWD_CRYPTO_CIPHER_ONLY) {
2127 
2128 		/* Check if device supports cipher algo. 8< */
2129 		cap = check_device_support_cipher_algo(options, &dev_info,
2130 						cdev_id);
2131 		if (cap == NULL)
2132 			return -1;
2133 
2134 		if (check_iv_param(&cap->sym.cipher.iv_size,
2135 				options->cipher_iv_param,
2136 				options->cipher_iv_random_size,
2137 				options->cipher_iv.length) != 0) {
2138 			RTE_LOG(DEBUG, USER1,
2139 				"Device %u does not support IV length\n",
2140 				cdev_id);
2141 			return -1;
2142 		}
2143 		/* >8 End of check if device supports cipher algo. */
2144 
2145 		/* Check if capable cipher is supported. 8< */
2146 
2147 		/*
2148 		 * Check if length of provided cipher key is supported
2149 		 * by the algorithm chosen.
2150 		 */
2151 		if (options->ckey_param) {
2152 			if (check_supported_size(
2153 					options->cipher_xform.cipher.key.length,
2154 					cap->sym.cipher.key_size.min,
2155 					cap->sym.cipher.key_size.max,
2156 					cap->sym.cipher.key_size.increment)
2157 						!= 0) {
2158 				if (dev_info.feature_flags &
2159 				    RTE_CRYPTODEV_FF_CIPHER_WRAPPED_KEY) {
2160 					RTE_LOG(DEBUG, USER1,
2161 					"Key length does not match the device "
2162 					"%u capability. Key may be wrapped\n",
2163 					cdev_id);
2164 				} else {
2165 					RTE_LOG(DEBUG, USER1,
2166 					"Key length does not match the device "
2167 					"%u capability\n",
2168 					cdev_id);
2169 					return -1;
2170 				}
2171 			}
2172 
2173 		/*
2174 		 * Check if length of the cipher key to be randomly generated
2175 		 * is supported by the algorithm chosen.
2176 		 */
2177 		} else if (options->ckey_random_size != -1) {
2178 			if (check_supported_size(options->ckey_random_size,
2179 					cap->sym.cipher.key_size.min,
2180 					cap->sym.cipher.key_size.max,
2181 					cap->sym.cipher.key_size.increment)
2182 						!= 0) {
2183 				RTE_LOG(DEBUG, USER1,
2184 					"Device %u does not support cipher "
2185 					"key length\n",
2186 					cdev_id);
2187 				return -1;
2188 			}
2189 		}
2190 
2191 		if (options->cipher_xform.cipher.dataunit_len > 0) {
2192 			if (!(dev_info.feature_flags &
2193 				RTE_CRYPTODEV_FF_CIPHER_MULTIPLE_DATA_UNITS)) {
2194 				RTE_LOG(DEBUG, USER1,
2195 					"Device %u does not support "
2196 					"cipher multiple data units\n",
2197 					cdev_id);
2198 				return -1;
2199 			}
2200 			if (cap->sym.cipher.dataunit_set != 0) {
2201 				int ret = 0;
2202 
2203 				switch (options->cipher_xform.cipher.dataunit_len) {
2204 				case 512:
2205 					if (!(cap->sym.cipher.dataunit_set &
2206 						RTE_CRYPTO_CIPHER_DATA_UNIT_LEN_512_BYTES))
2207 						ret = -1;
2208 					break;
2209 				case 4096:
2210 					if (!(cap->sym.cipher.dataunit_set &
2211 						RTE_CRYPTO_CIPHER_DATA_UNIT_LEN_4096_BYTES))
2212 						ret = -1;
2213 					break;
2214 				case 1048576:
2215 					if (!(cap->sym.cipher.dataunit_set &
2216 						RTE_CRYPTO_CIPHER_DATA_UNIT_LEN_1_MEGABYTES))
2217 						ret = -1;
2218 					break;
2219 				default:
2220 					ret = -1;
2221 				}
2222 				if (ret == -1) {
2223 					RTE_LOG(DEBUG, USER1,
2224 						"Device %u does not support "
2225 						"data-unit length %u\n",
2226 						cdev_id,
2227 						options->cipher_xform.cipher.dataunit_len);
2228 					return -1;
2229 				}
2230 			}
2231 		}
2232 		/* >8 End of checking if cipher is supported. */
2233 	}
2234 
2235 	/* Set auth parameters */
2236 	if (options->xform_chain == L2FWD_CRYPTO_CIPHER_HASH ||
2237 			options->xform_chain == L2FWD_CRYPTO_HASH_CIPHER ||
2238 			options->xform_chain == L2FWD_CRYPTO_HASH_ONLY) {
2239 		/* Check if device supports auth algo */
2240 		cap = check_device_support_auth_algo(options, &dev_info,
2241 						cdev_id);
2242 		if (cap == NULL)
2243 			return -1;
2244 
2245 		if (check_iv_param(&cap->sym.auth.iv_size,
2246 				options->auth_iv_param,
2247 				options->auth_iv_random_size,
2248 				options->auth_iv.length) != 0) {
2249 			RTE_LOG(DEBUG, USER1,
2250 				"Device %u does not support IV length\n",
2251 				cdev_id);
2252 			return -1;
2253 		}
2254 		/*
2255 		 * Check if length of provided auth key is supported
2256 		 * by the algorithm chosen.
2257 		 */
2258 		if (options->akey_param) {
2259 			if (check_supported_size(
2260 					options->auth_xform.auth.key.length,
2261 					cap->sym.auth.key_size.min,
2262 					cap->sym.auth.key_size.max,
2263 					cap->sym.auth.key_size.increment)
2264 						!= 0) {
2265 				RTE_LOG(DEBUG, USER1,
2266 					"Device %u does not support auth "
2267 					"key length\n",
2268 					cdev_id);
2269 				return -1;
2270 			}
2271 		/*
2272 		 * Check if length of the auth key to be randomly generated
2273 		 * is supported by the algorithm chosen.
2274 		 */
2275 		} else if (options->akey_random_size != -1) {
2276 			if (check_supported_size(options->akey_random_size,
2277 					cap->sym.auth.key_size.min,
2278 					cap->sym.auth.key_size.max,
2279 					cap->sym.auth.key_size.increment)
2280 						!= 0) {
2281 				RTE_LOG(DEBUG, USER1,
2282 					"Device %u does not support auth "
2283 					"key length\n",
2284 					cdev_id);
2285 				return -1;
2286 			}
2287 		}
2288 
2289 		/* Check if digest size is supported by the algorithm. */
2290 		if (options->digest_size != -1) {
2291 			if (check_supported_size(options->digest_size,
2292 					cap->sym.auth.digest_size.min,
2293 					cap->sym.auth.digest_size.max,
2294 					cap->sym.auth.digest_size.increment)
2295 						!= 0) {
2296 				RTE_LOG(DEBUG, USER1,
2297 					"Device %u does not support "
2298 					"digest length\n",
2299 					cdev_id);
2300 				return -1;
2301 			}
2302 		}
2303 	}
2304 
2305 	return 0;
2306 }
2307 
2308 static int
2309 initialize_cryptodevs(struct l2fwd_crypto_options *options, unsigned nb_ports,
2310 		uint8_t *enabled_cdevs)
2311 {
2312 	uint8_t cdev_id, cdev_count, enabled_cdev_count = 0;
2313 	const struct rte_cryptodev_capabilities *cap;
2314 	unsigned int sess_sz, max_sess_sz = 0;
2315 	uint32_t sessions_needed = 0;
2316 	int retval;
2317 
2318 	cdev_count = rte_cryptodev_count();
2319 	if (cdev_count == 0) {
2320 		printf("No crypto devices available\n");
2321 		return -1;
2322 	}
2323 
2324 	for (cdev_id = 0; cdev_id < cdev_count && enabled_cdev_count < nb_ports;
2325 			cdev_id++) {
2326 		if (check_cryptodev_mask(options, cdev_id) < 0)
2327 			continue;
2328 
2329 		if (check_capabilities(options, cdev_id) < 0)
2330 			continue;
2331 
2332 		sess_sz = rte_cryptodev_sym_get_private_session_size(cdev_id);
2333 		if (sess_sz > max_sess_sz)
2334 			max_sess_sz = sess_sz;
2335 
2336 		l2fwd_enabled_crypto_mask |= (((uint64_t)1) << cdev_id);
2337 
2338 		enabled_cdevs[cdev_id] = 1;
2339 		enabled_cdev_count++;
2340 	}
2341 
2342 	for (cdev_id = 0; cdev_id < cdev_count; cdev_id++) {
2343 		struct rte_cryptodev_qp_conf qp_conf;
2344 		struct rte_cryptodev_info dev_info;
2345 
2346 		if (enabled_cdevs[cdev_id] == 0)
2347 			continue;
2348 
2349 		if (check_cryptodev_mask(options, cdev_id) < 0)
2350 			continue;
2351 
2352 		if (check_capabilities(options, cdev_id) < 0)
2353 			continue;
2354 
2355 		retval = rte_cryptodev_socket_id(cdev_id);
2356 
2357 		if (retval < 0) {
2358 			printf("Invalid crypto device id used\n");
2359 			return -1;
2360 		}
2361 
2362 		uint8_t socket_id = (uint8_t) retval;
2363 
2364 		struct rte_cryptodev_config conf = {
2365 			.nb_queue_pairs = 1,
2366 			.socket_id = socket_id,
2367 			.ff_disable = RTE_CRYPTODEV_FF_SECURITY,
2368 		};
2369 
2370 		rte_cryptodev_info_get(cdev_id, &dev_info);
2371 
2372 		if (!strcmp(dev_info.driver_name, "crypto_scheduler")) {
2373 #ifdef RTE_CRYPTO_SCHEDULER
2374 			/* scheduler session header + 1 session per worker */
2375 			uint32_t nb_workers = 1 +
2376 				rte_cryptodev_scheduler_workers_get(cdev_id,
2377 								NULL);
2378 
2379 			sessions_needed = enabled_cdev_count * nb_workers;
2380 #endif
2381 		} else
2382 			sessions_needed = enabled_cdev_count;
2383 
2384 		if (session_pool_socket[socket_id].sess_mp == NULL) {
2385 			char mp_name[RTE_MEMPOOL_NAMESIZE];
2386 			snprintf(mp_name, RTE_MEMPOOL_NAMESIZE,
2387 				"sess_mp_%u", socket_id);
2388 
2389 			session_pool_socket[socket_id].sess_mp =
2390 				rte_cryptodev_sym_session_pool_create(
2391 					mp_name, sessions_needed, max_sess_sz,
2392 					0, 0, socket_id);
2393 			if (session_pool_socket[socket_id].sess_mp == NULL) {
2394 				printf("Cannot create pool on socket %d\n",
2395 					socket_id);
2396 				return -ENOMEM;
2397 			}
2398 
2399 			printf("Allocated pool \"%s\" on socket %d\n",
2400 				mp_name, socket_id);
2401 		}
2402 
2403 		/* Set AEAD parameters */
2404 		if (options->xform_chain == L2FWD_CRYPTO_AEAD) {
2405 			cap = check_device_support_aead_algo(options, &dev_info,
2406 							cdev_id);
2407 
2408 			options->block_size = cap->sym.aead.block_size;
2409 
2410 			/* Set IV if not provided from command line */
2411 			if (options->aead_iv_param == 0) {
2412 				if (options->aead_iv_random_size != -1)
2413 					options->aead_iv.length =
2414 						options->aead_iv_random_size;
2415 				/* No size provided, use minimum size. */
2416 				else
2417 					options->aead_iv.length =
2418 						cap->sym.aead.iv_size.min;
2419 			}
2420 
2421 			/* Set key if not provided from command line */
2422 			if (options->aead_key_param == 0) {
2423 				if (options->aead_key_random_size != -1)
2424 					options->aead_xform.aead.key.length =
2425 						options->aead_key_random_size;
2426 				/* No size provided, use minimum size. */
2427 				else
2428 					options->aead_xform.aead.key.length =
2429 						cap->sym.aead.key_size.min;
2430 
2431 				generate_random_key(options->aead_key,
2432 					options->aead_xform.aead.key.length);
2433 			}
2434 
2435 			/* Set AAD if not provided from command line */
2436 			if (options->aad_param == 0) {
2437 				if (options->aad_random_size != -1)
2438 					options->aad.length =
2439 						options->aad_random_size;
2440 				/* No size provided, use minimum size. */
2441 				else
2442 					options->aad.length =
2443 						cap->sym.auth.aad_size.min;
2444 			}
2445 
2446 			options->aead_xform.aead.aad_length =
2447 						options->aad.length;
2448 
2449 			/* Set digest size if not provided from command line */
2450 			if (options->digest_size != -1)
2451 				options->aead_xform.aead.digest_length =
2452 							options->digest_size;
2453 				/* No size provided, use minimum size. */
2454 			else
2455 				options->aead_xform.aead.digest_length =
2456 						cap->sym.aead.digest_size.min;
2457 		}
2458 
2459 		/* Set cipher parameters */
2460 		if (options->xform_chain == L2FWD_CRYPTO_CIPHER_HASH ||
2461 				options->xform_chain == L2FWD_CRYPTO_HASH_CIPHER ||
2462 				options->xform_chain == L2FWD_CRYPTO_CIPHER_ONLY) {
2463 			cap = check_device_support_cipher_algo(options, &dev_info,
2464 							cdev_id);
2465 			options->block_size = cap->sym.cipher.block_size;
2466 
2467 			/* Set IV if not provided from command line */
2468 			if (options->cipher_iv_param == 0) {
2469 				if (options->cipher_iv_random_size != -1)
2470 					options->cipher_iv.length =
2471 						options->cipher_iv_random_size;
2472 				/* No size provided, use minimum size. */
2473 				else
2474 					options->cipher_iv.length =
2475 						cap->sym.cipher.iv_size.min;
2476 			}
2477 
2478 			/* Set key if not provided from command line */
2479 			if (options->ckey_param == 0) {
2480 				if (options->ckey_random_size != -1)
2481 					options->cipher_xform.cipher.key.length =
2482 						options->ckey_random_size;
2483 				/* No size provided, use minimum size. */
2484 				else
2485 					options->cipher_xform.cipher.key.length =
2486 						cap->sym.cipher.key_size.min;
2487 
2488 				generate_random_key(options->cipher_key,
2489 					options->cipher_xform.cipher.key.length);
2490 			}
2491 		}
2492 
2493 		/* Set auth parameters */
2494 		if (options->xform_chain == L2FWD_CRYPTO_CIPHER_HASH ||
2495 				options->xform_chain == L2FWD_CRYPTO_HASH_CIPHER ||
2496 				options->xform_chain == L2FWD_CRYPTO_HASH_ONLY) {
2497 			cap = check_device_support_auth_algo(options, &dev_info,
2498 							cdev_id);
2499 
2500 			/* Set IV if not provided from command line */
2501 			if (options->auth_iv_param == 0) {
2502 				if (options->auth_iv_random_size != -1)
2503 					options->auth_iv.length =
2504 						options->auth_iv_random_size;
2505 				/* No size provided, use minimum size. */
2506 				else
2507 					options->auth_iv.length =
2508 						cap->sym.auth.iv_size.min;
2509 			}
2510 
2511 			/* Set key if not provided from command line */
2512 			if (options->akey_param == 0) {
2513 				if (options->akey_random_size != -1)
2514 					options->auth_xform.auth.key.length =
2515 						options->akey_random_size;
2516 				/* No size provided, use minimum size. */
2517 				else
2518 					options->auth_xform.auth.key.length =
2519 						cap->sym.auth.key_size.min;
2520 
2521 				generate_random_key(options->auth_key,
2522 					options->auth_xform.auth.key.length);
2523 			}
2524 
2525 			/* Set digest size if not provided from command line */
2526 			if (options->digest_size != -1)
2527 				options->auth_xform.auth.digest_length =
2528 							options->digest_size;
2529 				/* No size provided, use minimum size. */
2530 			else
2531 				options->auth_xform.auth.digest_length =
2532 						cap->sym.auth.digest_size.min;
2533 		}
2534 
2535 		retval = rte_cryptodev_configure(cdev_id, &conf);
2536 		if (retval < 0) {
2537 			printf("Failed to configure cryptodev %u", cdev_id);
2538 			return -1;
2539 		}
2540 
2541 		qp_conf.nb_descriptors = 2048;
2542 		qp_conf.mp_session = session_pool_socket[socket_id].sess_mp;
2543 
2544 		retval = rte_cryptodev_queue_pair_setup(cdev_id, 0, &qp_conf,
2545 				socket_id);
2546 		if (retval < 0) {
2547 			printf("Failed to setup queue pair %u on cryptodev %u",
2548 					0, cdev_id);
2549 			return -1;
2550 		}
2551 
2552 		retval = rte_cryptodev_start(cdev_id);
2553 		if (retval < 0) {
2554 			printf("Failed to start device %u: error %d\n",
2555 					cdev_id, retval);
2556 			return -1;
2557 		}
2558 	}
2559 
2560 	return enabled_cdev_count;
2561 }
2562 
2563 static int
2564 initialize_ports(struct l2fwd_crypto_options *options)
2565 {
2566 	uint16_t last_portid = 0, portid;
2567 	unsigned enabled_portcount = 0;
2568 	unsigned nb_ports = rte_eth_dev_count_avail();
2569 
2570 	if (nb_ports == 0) {
2571 		printf("No Ethernet ports - bye\n");
2572 		return -1;
2573 	}
2574 
2575 	/* Reset l2fwd_dst_ports */
2576 	for (portid = 0; portid < RTE_MAX_ETHPORTS; portid++)
2577 		l2fwd_dst_ports[portid] = 0;
2578 
2579 	RTE_ETH_FOREACH_DEV(portid) {
2580 		int retval;
2581 		struct rte_eth_dev_info dev_info;
2582 		struct rte_eth_rxconf rxq_conf;
2583 		struct rte_eth_txconf txq_conf;
2584 		struct rte_eth_conf local_port_conf = port_conf;
2585 
2586 		/* Skip ports that are not enabled */
2587 		if ((options->portmask & (1 << portid)) == 0)
2588 			continue;
2589 
2590 		/* init port */
2591 		printf("Initializing port %u... ", portid);
2592 		fflush(stdout);
2593 
2594 		retval = rte_eth_dev_info_get(portid, &dev_info);
2595 		if (retval != 0) {
2596 			printf("Error during getting device (port %u) info: %s\n",
2597 					portid, strerror(-retval));
2598 			return retval;
2599 		}
2600 
2601 		if (dev_info.tx_offload_capa & RTE_ETH_TX_OFFLOAD_MBUF_FAST_FREE)
2602 			local_port_conf.txmode.offloads |=
2603 				RTE_ETH_TX_OFFLOAD_MBUF_FAST_FREE;
2604 		retval = rte_eth_dev_configure(portid, 1, 1, &local_port_conf);
2605 		if (retval < 0) {
2606 			printf("Cannot configure device: err=%d, port=%u\n",
2607 				  retval, portid);
2608 			return -1;
2609 		}
2610 
2611 		retval = rte_eth_dev_adjust_nb_rx_tx_desc(portid, &nb_rxd,
2612 							  &nb_txd);
2613 		if (retval < 0) {
2614 			printf("Cannot adjust number of descriptors: err=%d, port=%u\n",
2615 				retval, portid);
2616 			return -1;
2617 		}
2618 
2619 		/* init one RX queue */
2620 		fflush(stdout);
2621 		rxq_conf = dev_info.default_rxconf;
2622 		rxq_conf.offloads = local_port_conf.rxmode.offloads;
2623 		retval = rte_eth_rx_queue_setup(portid, 0, nb_rxd,
2624 					     rte_eth_dev_socket_id(portid),
2625 					     &rxq_conf, l2fwd_pktmbuf_pool);
2626 		if (retval < 0) {
2627 			printf("rte_eth_rx_queue_setup:err=%d, port=%u\n",
2628 					retval, portid);
2629 			return -1;
2630 		}
2631 
2632 		/* init one TX queue on each port */
2633 		fflush(stdout);
2634 		txq_conf = dev_info.default_txconf;
2635 		txq_conf.offloads = local_port_conf.txmode.offloads;
2636 		retval = rte_eth_tx_queue_setup(portid, 0, nb_txd,
2637 				rte_eth_dev_socket_id(portid),
2638 				&txq_conf);
2639 		if (retval < 0) {
2640 			printf("rte_eth_tx_queue_setup:err=%d, port=%u\n",
2641 				retval, portid);
2642 
2643 			return -1;
2644 		}
2645 
2646 		/* Start device */
2647 		retval = rte_eth_dev_start(portid);
2648 		if (retval < 0) {
2649 			printf("rte_eth_dev_start:err=%d, port=%u\n",
2650 					retval, portid);
2651 			return -1;
2652 		}
2653 
2654 		retval = rte_eth_promiscuous_enable(portid);
2655 		if (retval != 0) {
2656 			printf("rte_eth_promiscuous_enable:err=%s, port=%u\n",
2657 				rte_strerror(-retval), portid);
2658 			return -1;
2659 		}
2660 
2661 		retval = rte_eth_macaddr_get(portid,
2662 					     &l2fwd_ports_eth_addr[portid]);
2663 		if (retval < 0) {
2664 			printf("rte_eth_macaddr_get :err=%d, port=%u\n",
2665 					retval, portid);
2666 			return -1;
2667 		}
2668 
2669 		printf("Port %u, MAC address: " RTE_ETHER_ADDR_PRT_FMT "\n\n",
2670 			portid,
2671 			RTE_ETHER_ADDR_BYTES(&l2fwd_ports_eth_addr[portid]));
2672 
2673 		/* initialize port stats */
2674 		memset(&port_statistics, 0, sizeof(port_statistics));
2675 
2676 		/* Setup port forwarding table */
2677 		if (enabled_portcount % 2) {
2678 			l2fwd_dst_ports[portid] = last_portid;
2679 			l2fwd_dst_ports[last_portid] = portid;
2680 		} else {
2681 			last_portid = portid;
2682 		}
2683 
2684 		l2fwd_enabled_port_mask |= (1ULL << portid);
2685 		enabled_portcount++;
2686 	}
2687 
2688 	if (enabled_portcount == 1) {
2689 		l2fwd_dst_ports[last_portid] = last_portid;
2690 	} else if (enabled_portcount % 2) {
2691 		printf("odd number of ports in portmask- bye\n");
2692 		return -1;
2693 	}
2694 
2695 	check_all_ports_link_status(l2fwd_enabled_port_mask);
2696 
2697 	return enabled_portcount;
2698 }
2699 
2700 static void
2701 reserve_key_memory(struct l2fwd_crypto_options *options)
2702 {
2703 	options->cipher_xform.cipher.key.data = options->cipher_key;
2704 
2705 	options->auth_xform.auth.key.data = options->auth_key;
2706 
2707 	options->aead_xform.aead.key.data = options->aead_key;
2708 
2709 	options->cipher_iv.data = rte_malloc("cipher iv", MAX_KEY_SIZE, 0);
2710 	if (options->cipher_iv.data == NULL)
2711 		rte_exit(EXIT_FAILURE, "Failed to allocate memory for cipher IV");
2712 
2713 	options->auth_iv.data = rte_malloc("auth iv", MAX_KEY_SIZE, 0);
2714 	if (options->auth_iv.data == NULL)
2715 		rte_exit(EXIT_FAILURE, "Failed to allocate memory for auth IV");
2716 
2717 	options->aead_iv.data = rte_malloc("aead_iv", MAX_KEY_SIZE, 0);
2718 	if (options->aead_iv.data == NULL)
2719 		rte_exit(EXIT_FAILURE, "Failed to allocate memory for AEAD iv");
2720 
2721 	options->aad.data = rte_malloc("aad", MAX_KEY_SIZE, 0);
2722 	if (options->aad.data == NULL)
2723 		rte_exit(EXIT_FAILURE, "Failed to allocate memory for AAD");
2724 	options->aad.phys_addr = rte_malloc_virt2iova(options->aad.data);
2725 }
2726 
2727 static void
2728 raise_signal(int signum)
2729 {
2730 	if (signum == SIGINT || signum == SIGTERM)
2731 		signal_received = true;
2732 }
2733 
2734 int
2735 main(int argc, char **argv)
2736 {
2737 	struct lcore_queue_conf *qconf = NULL;
2738 	struct l2fwd_crypto_options options;
2739 
2740 	uint8_t nb_cryptodevs, cdev_id;
2741 	uint16_t portid;
2742 	unsigned lcore_id, rx_lcore_id = 0;
2743 	int ret, enabled_cdevcount, enabled_portcount;
2744 	uint8_t enabled_cdevs[RTE_CRYPTO_MAX_DEVS] = {0};
2745 
2746 	signal(SIGINT, raise_signal);
2747 	signal(SIGTERM, raise_signal);
2748 
2749 	/* init EAL */
2750 	ret = rte_eal_init(argc, argv);
2751 	if (ret < 0)
2752 		rte_exit(EXIT_FAILURE, "Invalid EAL arguments\n");
2753 	argc -= ret;
2754 	argv += ret;
2755 
2756 	/* reserve memory for Cipher/Auth key and IV */
2757 	reserve_key_memory(&options);
2758 
2759 	/* parse application arguments (after the EAL ones) */
2760 	ret = l2fwd_crypto_parse_args(&options, argc, argv);
2761 	if (ret < 0)
2762 		rte_exit(EXIT_FAILURE, "Invalid L2FWD-CRYPTO arguments\n");
2763 
2764 	printf("MAC updating %s\n",
2765 			options.mac_updating ? "enabled" : "disabled");
2766 
2767 	/* create the mbuf pool */
2768 	l2fwd_pktmbuf_pool = rte_pktmbuf_pool_create("mbuf_pool", NB_MBUF, 512,
2769 			RTE_ALIGN(sizeof(struct rte_crypto_op),
2770 				RTE_CACHE_LINE_SIZE),
2771 			RTE_MBUF_DEFAULT_BUF_SIZE, rte_socket_id());
2772 	if (l2fwd_pktmbuf_pool == NULL)
2773 		rte_exit(EXIT_FAILURE, "Cannot create mbuf pool\n");
2774 
2775 	/* create crypto op pool */
2776 	l2fwd_crypto_op_pool = rte_crypto_op_pool_create("crypto_op_pool",
2777 			RTE_CRYPTO_OP_TYPE_SYMMETRIC, NB_MBUF, 128, MAXIMUM_IV_LENGTH,
2778 			rte_socket_id());
2779 	if (l2fwd_crypto_op_pool == NULL)
2780 		rte_exit(EXIT_FAILURE, "Cannot create crypto op pool\n");
2781 
2782 	/* Enable Ethernet ports */
2783 	enabled_portcount = initialize_ports(&options);
2784 	if (enabled_portcount < 1)
2785 		rte_exit(EXIT_FAILURE, "Failed to initial Ethernet ports\n");
2786 
2787 	/* Initialize the port/queue configuration of each logical core */
2788 	RTE_ETH_FOREACH_DEV(portid) {
2789 
2790 		/* skip ports that are not enabled */
2791 		if ((options.portmask & (1 << portid)) == 0)
2792 			continue;
2793 
2794 		if (options.single_lcore && qconf == NULL) {
2795 			while (rte_lcore_is_enabled(rx_lcore_id) == 0) {
2796 				rx_lcore_id++;
2797 				if (rx_lcore_id >= RTE_MAX_LCORE)
2798 					rte_exit(EXIT_FAILURE,
2799 							"Not enough cores\n");
2800 			}
2801 		} else if (!options.single_lcore) {
2802 			/* get the lcore_id for this port */
2803 			while (rte_lcore_is_enabled(rx_lcore_id) == 0 ||
2804 			       lcore_queue_conf[rx_lcore_id].nb_rx_ports ==
2805 			       options.nb_ports_per_lcore) {
2806 				rx_lcore_id++;
2807 				if (rx_lcore_id >= RTE_MAX_LCORE)
2808 					rte_exit(EXIT_FAILURE,
2809 							"Not enough cores\n");
2810 			}
2811 		}
2812 
2813 		/* Assigned a new logical core in the loop above. */
2814 		if (qconf != &lcore_queue_conf[rx_lcore_id])
2815 			qconf = &lcore_queue_conf[rx_lcore_id];
2816 
2817 		qconf->rx_port_list[qconf->nb_rx_ports] = portid;
2818 		qconf->nb_rx_ports++;
2819 
2820 		printf("Lcore %u: RX port %u\n", rx_lcore_id, portid);
2821 	}
2822 
2823 	/* Enable Crypto devices */
2824 	enabled_cdevcount = initialize_cryptodevs(&options, enabled_portcount,
2825 			enabled_cdevs);
2826 	if (enabled_cdevcount < 0)
2827 		rte_exit(EXIT_FAILURE, "Failed to initialize crypto devices\n");
2828 
2829 	if (enabled_cdevcount < enabled_portcount)
2830 		rte_exit(EXIT_FAILURE, "Number of capable crypto devices (%d) "
2831 				"has to be more or equal to number of ports (%d)\n",
2832 				enabled_cdevcount, enabled_portcount);
2833 
2834 	nb_cryptodevs = rte_cryptodev_count();
2835 
2836 	/* Initialize the port/cryptodev configuration of each logical core */
2837 	for (rx_lcore_id = 0, qconf = NULL, cdev_id = 0;
2838 			cdev_id < nb_cryptodevs && enabled_cdevcount;
2839 			cdev_id++) {
2840 		/* Crypto op not supported by crypto device */
2841 		if (!enabled_cdevs[cdev_id])
2842 			continue;
2843 
2844 		if (options.single_lcore && qconf == NULL) {
2845 			while (rte_lcore_is_enabled(rx_lcore_id) == 0) {
2846 				rx_lcore_id++;
2847 				if (rx_lcore_id >= RTE_MAX_LCORE)
2848 					rte_exit(EXIT_FAILURE,
2849 							"Not enough cores\n");
2850 			}
2851 		} else if (!options.single_lcore) {
2852 			/* get the lcore_id for this port */
2853 			while (rte_lcore_is_enabled(rx_lcore_id) == 0 ||
2854 			       lcore_queue_conf[rx_lcore_id].nb_crypto_devs ==
2855 			       options.nb_ports_per_lcore) {
2856 				rx_lcore_id++;
2857 				if (rx_lcore_id >= RTE_MAX_LCORE)
2858 					rte_exit(EXIT_FAILURE,
2859 							"Not enough cores\n");
2860 			}
2861 		}
2862 
2863 		/* Assigned a new logical core in the loop above. */
2864 		if (qconf != &lcore_queue_conf[rx_lcore_id])
2865 			qconf = &lcore_queue_conf[rx_lcore_id];
2866 
2867 		qconf->cryptodev_list[qconf->nb_crypto_devs] = cdev_id;
2868 		qconf->nb_crypto_devs++;
2869 
2870 		enabled_cdevcount--;
2871 
2872 		printf("Lcore %u: cryptodev %u\n", rx_lcore_id,
2873 				(unsigned)cdev_id);
2874 	}
2875 
2876 	/* launch per-lcore init on every lcore */
2877 	rte_eal_mp_remote_launch(l2fwd_launch_one_lcore, (void *)&options,
2878 			CALL_MAIN);
2879 	RTE_LCORE_FOREACH_WORKER(lcore_id) {
2880 		if (rte_eal_wait_lcore(lcore_id) < 0)
2881 			return -1;
2882 	}
2883 
2884 	/* clean up the EAL */
2885 	rte_eal_cleanup();
2886 
2887 	return 0;
2888 }
2889