LXR dpdk/lib/librte_ipsec/ipsec

   1/* SPDX-License-Identifier: BSD-3-Clause
   2 * Copyright(c) 2019 Intel Corporation
   3 */
   4
   5#include <string.h>
   6
   7#include <rte_eal_memconfig.h>
   8#include <rte_errno.h>
   9#include <rte_hash.h>
  10#include <rte_hash_crc.h>
  11#include <rte_malloc.h>
  12#include <rte_random.h>
  13#include <rte_rwlock.h>
  14#include <rte_tailq.h>
  15
  16#include "rte_ipsec_sad.h"
  17
  18/*
  19 * Rules are stored in three hash tables depending on key_type.
  20 * Each rule will also be stored in SPI_ONLY table.
  21 * for each data entry within this table last two bits are reserved to
  22 * indicate presence of entries with the same SPI in DIP and DIP+SIP tables.
  23 */
  24
  25#define SAD_PREFIX              "SAD_"
  26/* "SAD_<name>" */
  27#define SAD_FORMAT              SAD_PREFIX "%s"
  28
  29#define DEFAULT_HASH_FUNC       rte_hash_crc
  30#define MIN_HASH_ENTRIES        8U /* From rte_cuckoo_hash.h */
  31
  32struct hash_cnt {
  33        uint32_t cnt_dip;
  34        uint32_t cnt_dip_sip;
  35};
  36
  37struct rte_ipsec_sad {
  38        char name[RTE_IPSEC_SAD_NAMESIZE];
  39        struct rte_hash *hash[RTE_IPSEC_SAD_KEY_TYPE_MASK];
  40        uint32_t keysize[RTE_IPSEC_SAD_KEY_TYPE_MASK];
  41        uint32_t init_val;
  42        /* Array to track number of more specific rules
  43         * (spi_dip or spi_dip_sip). Used only in add/delete
  44         * as a helper struct.
  45         */
  46        __extension__ struct hash_cnt cnt_arr[];
  47};
  48
  49TAILQ_HEAD(rte_ipsec_sad_list, rte_tailq_entry);
  50static struct rte_tailq_elem rte_ipsec_sad_tailq = {
  51        .name = "RTE_IPSEC_SAD",
  52};
  53EAL_REGISTER_TAILQ(rte_ipsec_sad_tailq)
  54
  55#define SET_BIT(ptr, bit)       (void *)((uintptr_t)(ptr) | (uintptr_t)(bit))
  56#define CLEAR_BIT(ptr, bit)     (void *)((uintptr_t)(ptr) & ~(uintptr_t)(bit))
  57#define GET_BIT(ptr, bit)       (void *)((uintptr_t)(ptr) & (uintptr_t)(bit))
  58
  59/*
  60 * @internal helper function
  61 * Add a rule of type SPI_DIP or SPI_DIP_SIP.
  62 * Inserts a rule into an appropriate hash table,
  63 * updates the value for a given SPI in SPI_ONLY hash table
  64 * reflecting presence of more specific rule type in two LSBs.
  65 * Updates a counter that reflects the number of rules whith the same SPI.
  66 */
  67static inline int
  68add_specific(struct rte_ipsec_sad *sad, const void *key,
  69                int key_type, void *sa)
  70{
  71        void *tmp_val;
  72        int ret, notexist;
  73
  74        /* Check if the key is present in the table.
  75         * Need for further accaunting in cnt_arr
  76         */
  77        ret = rte_hash_lookup_with_hash(sad->hash[key_type], key,
  78                rte_hash_crc(key, sad->keysize[key_type], sad->init_val));
  79        notexist = (ret == -ENOENT);
  80
  81        /* Add an SA to the corresponding table.*/
  82        ret = rte_hash_add_key_with_hash_data(sad->hash[key_type], key,
  83                rte_hash_crc(key, sad->keysize[key_type], sad->init_val), sa);
  84        if (ret != 0)
  85                return ret;
  86
  87        /* Check if there is an entry in SPI only table with the same SPI */
  88        ret = rte_hash_lookup_with_hash_data(sad->hash[RTE_IPSEC_SAD_SPI_ONLY],
  89                key, rte_hash_crc(key, sad->keysize[RTE_IPSEC_SAD_SPI_ONLY],
  90                sad->init_val), &tmp_val);
  91        if (ret < 0)
  92                tmp_val = NULL;
  93        tmp_val = SET_BIT(tmp_val, key_type);
  94
  95        /* Add an entry into SPI only table */
  96        ret = rte_hash_add_key_with_hash_data(
  97                sad->hash[RTE_IPSEC_SAD_SPI_ONLY], key,
  98                rte_hash_crc(key, sad->keysize[RTE_IPSEC_SAD_SPI_ONLY],
  99                sad->init_val), tmp_val);
 100        if (ret != 0)
 101                return ret;
 102
 103        /* Update a counter for a given SPI */
 104        ret = rte_hash_lookup_with_hash(sad->hash[RTE_IPSEC_SAD_SPI_ONLY], key,
 105                rte_hash_crc(key, sad->keysize[RTE_IPSEC_SAD_SPI_ONLY],
 106                sad->init_val));
 107        if (ret < 0)
 108                return ret;
 109        if (key_type == RTE_IPSEC_SAD_SPI_DIP)
 110                sad->cnt_arr[ret].cnt_dip += notexist;
 111        else
 112                sad->cnt_arr[ret].cnt_dip_sip += notexist;
 113
 114        return 0;
 115}
 116
 117int
 118rte_ipsec_sad_add(struct rte_ipsec_sad *sad,
 119                const union rte_ipsec_sad_key *key,
 120                int key_type, void *sa)
 121{
 122        void *tmp_val;
 123        int ret;
 124
 125        if ((sad == NULL) || (key == NULL) || (sa == NULL) ||
 126                        /* sa must be 4 byte aligned */
 127                        (GET_BIT(sa, RTE_IPSEC_SAD_KEY_TYPE_MASK) != 0))
 128                return -EINVAL;
 129
 130        /*
 131         * Rules are stored in three hash tables depending on key_type.
 132         * All rules will also have an entry in SPI_ONLY table, with entry
 133         * value's two LSB's also indicating presence of rule with this SPI
 134         * in other tables.
 135         */
 136        switch (key_type) {
 137        case(RTE_IPSEC_SAD_SPI_ONLY):
 138                ret = rte_hash_lookup_with_hash_data(sad->hash[key_type],
 139                        key, rte_hash_crc(key, sad->keysize[key_type],
 140                        sad->init_val), &tmp_val);
 141                if (ret >= 0)
 142                        tmp_val = SET_BIT(sa, GET_BIT(tmp_val,
 143                                RTE_IPSEC_SAD_KEY_TYPE_MASK));
 144                else
 145                        tmp_val = sa;
 146                ret = rte_hash_add_key_with_hash_data(sad->hash[key_type],
 147                        key, rte_hash_crc(key, sad->keysize[key_type],
 148                        sad->init_val), tmp_val);
 149                return ret;
 150        case(RTE_IPSEC_SAD_SPI_DIP):
 151        case(RTE_IPSEC_SAD_SPI_DIP_SIP):
 152                return add_specific(sad, key, key_type, sa);
 153        default:
 154                return -EINVAL;
 155        }
 156}
 157
 158/*
 159 * @internal helper function
 160 * Delete a rule of type SPI_DIP or SPI_DIP_SIP.
 161 * Deletes an entry from an appropriate hash table and decrements
 162 * an entry counter for given SPI.
 163 * If entry to remove is the last one with given SPI within the table,
 164 * then it will also update related entry in SPI_ONLY table.
 165 * Removes an entry from SPI_ONLY hash table if there no rule left
 166 * for this SPI in any table.
 167 */
 168static inline int
 169del_specific(struct rte_ipsec_sad *sad, const void *key, int key_type)
 170{
 171        void *tmp_val;
 172        int ret;
 173        uint32_t *cnt;
 174
 175        /* Remove an SA from the corresponding table.*/
 176        ret = rte_hash_del_key_with_hash(sad->hash[key_type], key,
 177                rte_hash_crc(key, sad->keysize[key_type], sad->init_val));
 178        if (ret < 0)
 179                return ret;
 180
 181        /* Get an index of cnt_arr entry for a given SPI */
 182        ret = rte_hash_lookup_with_hash_data(sad->hash[RTE_IPSEC_SAD_SPI_ONLY],
 183                key, rte_hash_crc(key, sad->keysize[RTE_IPSEC_SAD_SPI_ONLY],
 184                sad->init_val), &tmp_val);
 185        if (ret < 0)
 186                return ret;
 187        cnt = (key_type == RTE_IPSEC_SAD_SPI_DIP) ?
 188                        &sad->cnt_arr[ret].cnt_dip :
 189                        &sad->cnt_arr[ret].cnt_dip_sip;
 190        if (--(*cnt) != 0)
 191                return 0;
 192
 193        /* corresponding counter is 0, clear the bit indicating
 194         * the presence of more specific rule for a given SPI.
 195         */
 196        tmp_val = CLEAR_BIT(tmp_val, key_type);
 197
 198        /* if there are no rules left with same SPI,
 199         * remove an entry from SPI_only table
 200         */
 201        if (tmp_val == NULL)
 202                ret = rte_hash_del_key_with_hash(
 203                        sad->hash[RTE_IPSEC_SAD_SPI_ONLY], key,
 204                        rte_hash_crc(key, sad->keysize[RTE_IPSEC_SAD_SPI_ONLY],
 205                        sad->init_val));
 206        else
 207                ret = rte_hash_add_key_with_hash_data(
 208                        sad->hash[RTE_IPSEC_SAD_SPI_ONLY], key,
 209                        rte_hash_crc(key, sad->keysize[RTE_IPSEC_SAD_SPI_ONLY],
 210                        sad->init_val), tmp_val);
 211        if (ret < 0)
 212                return ret;
 213        return 0;
 214}
 215
 216int
 217rte_ipsec_sad_del(struct rte_ipsec_sad *sad,
 218                const union rte_ipsec_sad_key *key,
 219                int key_type)
 220{
 221        void *tmp_val;
 222        int ret;
 223
 224        if ((sad == NULL) || (key == NULL))
 225                return -EINVAL;
 226        switch (key_type) {
 227        case(RTE_IPSEC_SAD_SPI_ONLY):
 228                ret = rte_hash_lookup_with_hash_data(sad->hash[key_type],
 229                        key, rte_hash_crc(key, sad->keysize[key_type],
 230                        sad->init_val), &tmp_val);
 231                if (ret < 0)
 232                        return ret;
 233                if (GET_BIT(tmp_val, RTE_IPSEC_SAD_KEY_TYPE_MASK) == 0) {
 234                        ret = rte_hash_del_key_with_hash(sad->hash[key_type],
 235                                key, rte_hash_crc(key, sad->keysize[key_type],
 236                                sad->init_val));
 237                        ret = ret < 0 ? ret : 0;
 238                } else {
 239                        tmp_val = GET_BIT(tmp_val,
 240                                RTE_IPSEC_SAD_KEY_TYPE_MASK);
 241                        ret = rte_hash_add_key_with_hash_data(
 242                                sad->hash[key_type], key,
 243                                rte_hash_crc(key, sad->keysize[key_type],
 244                                sad->init_val), tmp_val);
 245                }
 246                return ret;
 247        case(RTE_IPSEC_SAD_SPI_DIP):
 248        case(RTE_IPSEC_SAD_SPI_DIP_SIP):
 249                return del_specific(sad, key, key_type);
 250        default:
 251                return -EINVAL;
 252        }
 253}
 254
 255struct rte_ipsec_sad *
 256rte_ipsec_sad_create(const char *name, const struct rte_ipsec_sad_conf *conf)
 257{
 258        char hash_name[RTE_HASH_NAMESIZE];
 259        char sad_name[RTE_IPSEC_SAD_NAMESIZE];
 260        struct rte_tailq_entry *te;
 261        struct rte_ipsec_sad_list *sad_list;
 262        struct rte_ipsec_sad *sad, *tmp_sad = NULL;
 263        struct rte_hash_parameters hash_params = {0};
 264        int ret;
 265        uint32_t sa_sum;
 266
 267        RTE_BUILD_BUG_ON(RTE_IPSEC_SAD_KEY_TYPE_MASK != 3);
 268
 269        if ((name == NULL) || (conf == NULL) ||
 270                        ((conf->max_sa[RTE_IPSEC_SAD_SPI_ONLY] == 0) &&
 271                        (conf->max_sa[RTE_IPSEC_SAD_SPI_DIP] == 0) &&
 272                        (conf->max_sa[RTE_IPSEC_SAD_SPI_DIP_SIP] == 0))) {
 273                rte_errno = EINVAL;
 274                return NULL;
 275        }
 276
 277        ret = snprintf(sad_name, RTE_IPSEC_SAD_NAMESIZE, SAD_FORMAT, name);
 278        if (ret < 0 || ret >= RTE_IPSEC_SAD_NAMESIZE) {
 279                rte_errno = ENAMETOOLONG;
 280                return NULL;
 281        }
 282
 283        /** Init SAD*/
 284        sa_sum = RTE_MAX(MIN_HASH_ENTRIES,
 285                conf->max_sa[RTE_IPSEC_SAD_SPI_ONLY]) +
 286                RTE_MAX(MIN_HASH_ENTRIES,
 287                conf->max_sa[RTE_IPSEC_SAD_SPI_DIP]) +
 288                RTE_MAX(MIN_HASH_ENTRIES,
 289                conf->max_sa[RTE_IPSEC_SAD_SPI_DIP_SIP]);
 290        sad = rte_zmalloc_socket(NULL, sizeof(*sad) +
 291                (sizeof(struct hash_cnt) * sa_sum),
 292                RTE_CACHE_LINE_SIZE, conf->socket_id);
 293        if (sad == NULL) {
 294                rte_errno = ENOMEM;
 295                return NULL;
 296        }
 297        memcpy(sad->name, sad_name, sizeof(sad_name));
 298
 299        hash_params.hash_func = DEFAULT_HASH_FUNC;
 300        hash_params.hash_func_init_val = rte_rand();
 301        sad->init_val = hash_params.hash_func_init_val;
 302        hash_params.socket_id = conf->socket_id;
 303        hash_params.name = hash_name;
 304        if (conf->flags & RTE_IPSEC_SAD_FLAG_RW_CONCURRENCY)
 305                hash_params.extra_flag = RTE_HASH_EXTRA_FLAGS_RW_CONCURRENCY;
 306
 307        /** Init hash[RTE_IPSEC_SAD_SPI_ONLY] for SPI only */
 308        snprintf(hash_name, sizeof(hash_name), "sad_1_%p", sad);
 309        hash_params.key_len = sizeof(((struct rte_ipsec_sadv4_key *)0)->spi);
 310        sad->keysize[RTE_IPSEC_SAD_SPI_ONLY] = hash_params.key_len;
 311        hash_params.entries = sa_sum;
 312        sad->hash[RTE_IPSEC_SAD_SPI_ONLY] = rte_hash_create(&hash_params);
 313        if (sad->hash[RTE_IPSEC_SAD_SPI_ONLY] == NULL) {
 314                rte_ipsec_sad_destroy(sad);
 315                return NULL;
 316        }
 317
 318        /** Init hash[RTE_IPSEC_SAD_SPI_DIP] for SPI + DIP */
 319        snprintf(hash_name, sizeof(hash_name), "sad_2_%p", sad);
 320        if (conf->flags & RTE_IPSEC_SAD_FLAG_IPV6)
 321                hash_params.key_len +=
 322                        sizeof(((struct rte_ipsec_sadv6_key *)0)->dip);
 323        else
 324                hash_params.key_len +=
 325                        sizeof(((struct rte_ipsec_sadv4_key *)0)->dip);
 326        sad->keysize[RTE_IPSEC_SAD_SPI_DIP] = hash_params.key_len;
 327        hash_params.entries = RTE_MAX(MIN_HASH_ENTRIES,
 328                        conf->max_sa[RTE_IPSEC_SAD_SPI_DIP]);
 329        sad->hash[RTE_IPSEC_SAD_SPI_DIP] = rte_hash_create(&hash_params);
 330        if (sad->hash[RTE_IPSEC_SAD_SPI_DIP] == NULL) {
 331                rte_ipsec_sad_destroy(sad);
 332                return NULL;
 333        }
 334
 335        /** Init hash[[RTE_IPSEC_SAD_SPI_DIP_SIP] for SPI + DIP + SIP */
 336        snprintf(hash_name, sizeof(hash_name), "sad_3_%p", sad);
 337        if (conf->flags & RTE_IPSEC_SAD_FLAG_IPV6)
 338                hash_params.key_len +=
 339                        sizeof(((struct rte_ipsec_sadv6_key *)0)->sip);
 340        else
 341                hash_params.key_len +=
 342                        sizeof(((struct rte_ipsec_sadv4_key *)0)->sip);
 343        sad->keysize[RTE_IPSEC_SAD_SPI_DIP_SIP] = hash_params.key_len;
 344        hash_params.entries = RTE_MAX(MIN_HASH_ENTRIES,
 345                        conf->max_sa[RTE_IPSEC_SAD_SPI_DIP_SIP]);
 346        sad->hash[RTE_IPSEC_SAD_SPI_DIP_SIP] = rte_hash_create(&hash_params);
 347        if (sad->hash[RTE_IPSEC_SAD_SPI_DIP_SIP] == NULL) {
 348                rte_ipsec_sad_destroy(sad);
 349                return NULL;
 350        }
 351
 352        sad_list = RTE_TAILQ_CAST(rte_ipsec_sad_tailq.head,
 353                        rte_ipsec_sad_list);
 354        rte_mcfg_tailq_write_lock();
 355        /* guarantee there's no existing */
 356        TAILQ_FOREACH(te, sad_list, next) {
 357                tmp_sad = (struct rte_ipsec_sad *)te->data;
 358                if (strncmp(sad_name, tmp_sad->name,
 359                                RTE_IPSEC_SAD_NAMESIZE) == 0)
 360                        break;
 361        }
 362        if (te != NULL) {
 363                rte_mcfg_tailq_write_unlock();
 364                rte_errno = EEXIST;
 365                rte_ipsec_sad_destroy(sad);
 366                return NULL;
 367        }
 368
 369        /* allocate tailq entry */
 370        te = rte_zmalloc("IPSEC_SAD_TAILQ_ENTRY", sizeof(*te), 0);
 371        if (te == NULL) {
 372                rte_mcfg_tailq_write_unlock();
 373                rte_errno = ENOMEM;
 374                rte_ipsec_sad_destroy(sad);
 375                return NULL;
 376        }
 377
 378        te->data = (void *)sad;
 379        TAILQ_INSERT_TAIL(sad_list, te, next);
 380        rte_mcfg_tailq_write_unlock();
 381        return sad;
 382}
 383
 384struct rte_ipsec_sad *
 385rte_ipsec_sad_find_existing(const char *name)
 386{
 387        char sad_name[RTE_IPSEC_SAD_NAMESIZE];
 388        struct rte_ipsec_sad *sad = NULL;
 389        struct rte_tailq_entry *te;
 390        struct rte_ipsec_sad_list *sad_list;
 391        int ret;
 392
 393        ret = snprintf(sad_name, RTE_IPSEC_SAD_NAMESIZE, SAD_FORMAT, name);
 394        if (ret < 0 || ret >= RTE_IPSEC_SAD_NAMESIZE) {
 395                rte_errno = ENAMETOOLONG;
 396                return NULL;
 397        }
 398
 399        sad_list = RTE_TAILQ_CAST(rte_ipsec_sad_tailq.head,
 400                rte_ipsec_sad_list);
 401
 402        rte_mcfg_tailq_read_lock();
 403        TAILQ_FOREACH(te, sad_list, next) {
 404                sad = (struct rte_ipsec_sad *) te->data;
 405                if (strncmp(sad_name, sad->name, RTE_IPSEC_SAD_NAMESIZE) == 0)
 406                        break;
 407        }
 408        rte_mcfg_tailq_read_unlock();
 409
 410        if (te == NULL) {
 411                rte_errno = ENOENT;
 412                return NULL;
 413        }
 414
 415        return sad;
 416}
 417
 418void
 419rte_ipsec_sad_destroy(struct rte_ipsec_sad *sad)
 420{
 421        struct rte_tailq_entry *te;
 422        struct rte_ipsec_sad_list *sad_list;
 423
 424        if (sad == NULL)
 425                return;
 426
 427        sad_list = RTE_TAILQ_CAST(rte_ipsec_sad_tailq.head,
 428                        rte_ipsec_sad_list);
 429        rte_mcfg_tailq_write_lock();
 430        TAILQ_FOREACH(te, sad_list, next) {
 431                if (te->data == (void *)sad)
 432                        break;
 433        }
 434        if (te != NULL)
 435                TAILQ_REMOVE(sad_list, te, next);
 436
 437        rte_mcfg_tailq_write_unlock();
 438
 439        rte_hash_free(sad->hash[RTE_IPSEC_SAD_SPI_ONLY]);
 440        rte_hash_free(sad->hash[RTE_IPSEC_SAD_SPI_DIP]);
 441        rte_hash_free(sad->hash[RTE_IPSEC_SAD_SPI_DIP_SIP]);
 442        rte_free(sad);
 443        if (te != NULL)
 444                rte_free(te);
 445}
 446
 447/*
 448 * @internal helper function
 449 * Lookup a batch of keys in three hash tables.
 450 * First lookup key in SPI_ONLY table.
 451 * If there is an entry for the corresponding SPI check its value.
 452 * Two least significant bits of the value indicate
 453 * the presence of more specific rule in other tables.
 454 * Perform additional lookup in corresponding hash tables
 455 * and update the value if lookup succeeded.
 456 */
 457static int
 458__ipsec_sad_lookup(const struct rte_ipsec_sad *sad,
 459                const union rte_ipsec_sad_key *keys[], void *sa[], uint32_t n)
 460{
 461        const void *keys_2[RTE_HASH_LOOKUP_BULK_MAX];
 462        const void *keys_3[RTE_HASH_LOOKUP_BULK_MAX];
 463        void *vals_2[RTE_HASH_LOOKUP_BULK_MAX] = {NULL};
 464        void *vals_3[RTE_HASH_LOOKUP_BULK_MAX] = {NULL};
 465        uint32_t idx_2[RTE_HASH_LOOKUP_BULK_MAX];
 466        uint32_t idx_3[RTE_HASH_LOOKUP_BULK_MAX];
 467        uint64_t mask_1, mask_2, mask_3;
 468        uint64_t map, map_spec;
 469        uint32_t n_2 = 0;
 470        uint32_t n_3 = 0;
 471        uint32_t i;
 472        int found = 0;
 473        hash_sig_t hash_sig[RTE_HASH_LOOKUP_BULK_MAX];
 474        hash_sig_t hash_sig_2[RTE_HASH_LOOKUP_BULK_MAX];
 475        hash_sig_t hash_sig_3[RTE_HASH_LOOKUP_BULK_MAX];
 476
 477        for (i = 0; i < n; i++) {
 478                sa[i] = NULL;
 479                hash_sig[i] = rte_hash_crc_4byte(keys[i]->v4.spi,
 480                        sad->init_val);
 481        }
 482
 483        /*
 484         * Lookup keys in SPI only hash table first.
 485         */
 486        rte_hash_lookup_with_hash_bulk_data(sad->hash[RTE_IPSEC_SAD_SPI_ONLY],
 487                (const void **)keys, hash_sig, n, &mask_1, sa);
 488        for (map = mask_1; map; map &= (map - 1)) {
 489                i = rte_bsf64(map);
 490                /*
 491                 * if returned value indicates presence of a rule in other
 492                 * tables save a key for further lookup.
 493                 */
 494                if ((uintptr_t)sa[i] & RTE_IPSEC_SAD_SPI_DIP_SIP) {
 495                        idx_3[n_3] = i;
 496                        hash_sig_3[n_3] = rte_hash_crc(keys[i],
 497                                sad->keysize[RTE_IPSEC_SAD_SPI_DIP_SIP],
 498                                sad->init_val);
 499                        keys_3[n_3++] = keys[i];
 500                }
 501                if ((uintptr_t)sa[i] & RTE_IPSEC_SAD_SPI_DIP) {
 502                        idx_2[n_2] = i;
 503                        hash_sig_2[n_2] = rte_hash_crc(keys[i],
 504                                sad->keysize[RTE_IPSEC_SAD_SPI_DIP],
 505                                sad->init_val);
 506                        keys_2[n_2++] = keys[i];
 507                }
 508                /* clear 2 LSB's which indicate the presence
 509                 * of more specific rules
 510                 */
 511                sa[i] = CLEAR_BIT(sa[i], RTE_IPSEC_SAD_KEY_TYPE_MASK);
 512        }
 513
 514        /* Lookup for more specific rules in SPI_DIP table */
 515        if (n_2 != 0) {
 516                rte_hash_lookup_with_hash_bulk_data(
 517                        sad->hash[RTE_IPSEC_SAD_SPI_DIP],
 518                        keys_2, hash_sig_2, n_2, &mask_2, vals_2);
 519                for (map_spec = mask_2; map_spec; map_spec &= (map_spec - 1)) {
 520                        i = rte_bsf64(map_spec);
 521                        sa[idx_2[i]] = vals_2[i];
 522                }
 523        }
 524        /* Lookup for more specific rules in SPI_DIP_SIP table */
 525        if (n_3 != 0) {
 526                rte_hash_lookup_with_hash_bulk_data(
 527                        sad->hash[RTE_IPSEC_SAD_SPI_DIP_SIP],
 528                        keys_3, hash_sig_3, n_3, &mask_3, vals_3);
 529                for (map_spec = mask_3; map_spec; map_spec &= (map_spec - 1)) {
 530                        i = rte_bsf64(map_spec);
 531                        sa[idx_3[i]] = vals_3[i];
 532                }
 533        }
 534
 535        for (i = 0; i < n; i++)
 536                found += (sa[i] != NULL);
 537
 538        return found;
 539}
 540
 541int
 542rte_ipsec_sad_lookup(const struct rte_ipsec_sad *sad,
 543                const union rte_ipsec_sad_key *keys[], void *sa[], uint32_t n)
 544{
 545        uint32_t num, i = 0;
 546        int found = 0;
 547
 548        if (unlikely((sad == NULL) || (keys == NULL) || (sa == NULL)))
 549                return -EINVAL;
 550
 551        do {
 552                num = RTE_MIN(n - i, (uint32_t)RTE_HASH_LOOKUP_BULK_MAX);
 553                found += __ipsec_sad_lookup(sad,
 554                        &keys[i], &sa[i], num);
 555                i += num;
 556        } while (i != n);
 557
 558        return found;
 559}
 560