[v4,1/3] security: add SA config option for inner pkt csum

Message ID 20210930125832.15807-2-marchana@marvell.com (mailing list archive)
State Accepted, archived
Delegated to: akhil goyal
Headers
Series add SA config option for inner pkt csum |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/iol-testing warning apply patch failure

Commit Message

Archana Muniganti Sept. 30, 2021, 12:58 p.m. UTC
  Add inner packet IPv4 hdr and L4 checksum enable options
in conf. These will be used in case of protocol offload.
Per SA, application could specify whether the
checksum(compute/verify) can be offloaded to security device.

Signed-off-by: Archana Muniganti <marchana@marvell.com>
---
 doc/guides/cryptodevs/features/default.ini |  1 +
 doc/guides/rel_notes/deprecation.rst       |  4 +--
 doc/guides/rel_notes/release_21_11.rst     |  4 +++
 lib/cryptodev/rte_cryptodev.h              |  2 ++
 lib/security/rte_security.h                | 31 ++++++++++++++++++++++
 5 files changed, 40 insertions(+), 2 deletions(-)
  

Comments

Ananyev, Konstantin Oct. 3, 2021, 9:09 p.m. UTC | #1
> 
> Add inner packet IPv4 hdr and L4 checksum enable options
> in conf. These will be used in case of protocol offload.
> Per SA, application could specify whether the
> checksum(compute/verify) can be offloaded to security device.
> 
> Signed-off-by: Archana Muniganti <marchana@marvell.com>
> ---
>  doc/guides/cryptodevs/features/default.ini |  1 +
>  doc/guides/rel_notes/deprecation.rst       |  4 +--
>  doc/guides/rel_notes/release_21_11.rst     |  4 +++
>  lib/cryptodev/rte_cryptodev.h              |  2 ++
>  lib/security/rte_security.h                | 31 ++++++++++++++++++++++
>  5 files changed, 40 insertions(+), 2 deletions(-)
> 
> diff --git a/doc/guides/cryptodevs/features/default.ini b/doc/guides/cryptodevs/features/default.ini
> index c24814de98..96d95ddc81 100644
> --- a/doc/guides/cryptodevs/features/default.ini
> +++ b/doc/guides/cryptodevs/features/default.ini
> @@ -33,6 +33,7 @@ Non-Byte aligned data  =
>  Sym raw data path API  =
>  Cipher multiple data units =
>  Cipher wrapped key     =
> +Inner checksum         =
> 
>  ;
>  ; Supported crypto algorithms of a default crypto driver.
> diff --git a/doc/guides/rel_notes/deprecation.rst b/doc/guides/rel_notes/deprecation.rst
> index 05fc2fdee7..8308e00ed4 100644
> --- a/doc/guides/rel_notes/deprecation.rst
> +++ b/doc/guides/rel_notes/deprecation.rst
> @@ -232,8 +232,8 @@ Deprecation Notices
>    IPsec payload MSS (Maximum Segment Size), and ESN (Extended Sequence Number).
> 
>  * security: The IPsec SA config options ``struct rte_security_ipsec_sa_options``
> -  will be updated with new fields to support new features like IPsec inner
> -  checksum, TSO in case of protocol offload.
> +  will be updated with new fields to support new features like TSO in case of
> +  protocol offload.
> 
>  * ipsec: The structure ``rte_ipsec_sa_prm`` will be extended with a new field
>    ``hdr_l3_len`` to configure tunnel L3 header length.
> diff --git a/doc/guides/rel_notes/release_21_11.rst b/doc/guides/rel_notes/release_21_11.rst
> index 3ade7fe5ac..5480f05a99 100644
> --- a/doc/guides/rel_notes/release_21_11.rst
> +++ b/doc/guides/rel_notes/release_21_11.rst
> @@ -196,6 +196,10 @@ ABI Changes
>    ``rte_security_ipsec_xform`` to allow applications to configure SA soft
>    and hard expiry limits. Limits can be either in number of packets or bytes.
> 
> +* security: The new options ``ip_csum_enable`` and ``l4_csum_enable`` were added
> +  in structure ``rte_security_ipsec_sa_options`` to indicate whether inner
> +  packet IPv4 header checksum and L4 checksum need to be offloaded to
> +  security device.
> 
>  Known Issues
>  ------------
> diff --git a/lib/cryptodev/rte_cryptodev.h b/lib/cryptodev/rte_cryptodev.h
> index bb01f0f195..d9271a6c45 100644
> --- a/lib/cryptodev/rte_cryptodev.h
> +++ b/lib/cryptodev/rte_cryptodev.h
> @@ -479,6 +479,8 @@ rte_cryptodev_asym_get_xform_enum(enum rte_crypto_asym_xform_type *xform_enum,
>  /**< Support operations on multiple data-units message */
>  #define RTE_CRYPTODEV_FF_CIPHER_WRAPPED_KEY		(1ULL << 26)
>  /**< Support wrapped key in cipher xform  */
> +#define RTE_CRYPTODEV_FF_SECURITY_INNER_CSUM		(1ULL << 27)
> +/**< Support inner checksum computation/verification */
> 
>  /**
>   * Get the name of a crypto device feature flag
> diff --git a/lib/security/rte_security.h b/lib/security/rte_security.h
> index ab1a6e1f65..0c5636377e 100644
> --- a/lib/security/rte_security.h
> +++ b/lib/security/rte_security.h
> @@ -230,6 +230,37 @@ struct rte_security_ipsec_sa_options {
>  	 * * 0: Do not match UDP ports
>  	 */
>  	uint32_t udp_ports_verify : 1;
> +
> +	/** Compute/verify inner packet IPv4 header checksum in tunnel mode
> +	 *
> +	 * * 1: For outbound, compute inner packet IPv4 header checksum
> +	 *      before tunnel encapsulation and for inbound, verify after
> +	 *      tunnel decapsulation.
> +	 * * 0: Inner packet IP header checksum is not computed/verified.
> +	 *
> +	 * The checksum verification status would be set in mbuf using
> +	 * PKT_RX_IP_CKSUM_xxx flags.
> +	 *
> +	 * Inner IP checksum computation can also be enabled(per operation)
> +	 * by setting the flag PKT_TX_IP_CKSUM in mbuf.
> +	 */
> +	uint32_t ip_csum_enable : 1;
> +
> +	/** Compute/verify inner packet L4 checksum in tunnel mode
> +	 *
> +	 * * 1: For outbound, compute inner packet L4 checksum before
> +	 *      tunnel encapsulation and for inbound, verify after
> +	 *      tunnel decapsulation.
> +	 * * 0: Inner packet L4 checksum is not computed/verified.
> +	 *
> +	 * The checksum verification status would be set in mbuf using
> +	 * PKT_RX_L4_CKSUM_xxx flags.
> +	 *
> +	 * Inner L4 checksum computation can also be enabled(per operation)
> +	 * by setting the flags PKT_TX_TCP_CKSUM or PKT_TX_SCTP_CKSUM or
> +	 * PKT_TX_UDP_CKSUM or PKT_TX_L4_MASK in mbuf.
> +	 */
> +	uint32_t l4_csum_enable : 1;
>  };
> 
>  /** IPSec security association direction */
> --

Acked-by: Konstantin Ananyev <konstantin.ananyev@intel.com>

> 2.22.0
  

Patch

diff --git a/doc/guides/cryptodevs/features/default.ini b/doc/guides/cryptodevs/features/default.ini
index c24814de98..96d95ddc81 100644
--- a/doc/guides/cryptodevs/features/default.ini
+++ b/doc/guides/cryptodevs/features/default.ini
@@ -33,6 +33,7 @@  Non-Byte aligned data  =
 Sym raw data path API  =
 Cipher multiple data units =
 Cipher wrapped key     =
+Inner checksum         =
 
 ;
 ; Supported crypto algorithms of a default crypto driver.
diff --git a/doc/guides/rel_notes/deprecation.rst b/doc/guides/rel_notes/deprecation.rst
index 05fc2fdee7..8308e00ed4 100644
--- a/doc/guides/rel_notes/deprecation.rst
+++ b/doc/guides/rel_notes/deprecation.rst
@@ -232,8 +232,8 @@  Deprecation Notices
   IPsec payload MSS (Maximum Segment Size), and ESN (Extended Sequence Number).
 
 * security: The IPsec SA config options ``struct rte_security_ipsec_sa_options``
-  will be updated with new fields to support new features like IPsec inner
-  checksum, TSO in case of protocol offload.
+  will be updated with new fields to support new features like TSO in case of
+  protocol offload.
 
 * ipsec: The structure ``rte_ipsec_sa_prm`` will be extended with a new field
   ``hdr_l3_len`` to configure tunnel L3 header length.
diff --git a/doc/guides/rel_notes/release_21_11.rst b/doc/guides/rel_notes/release_21_11.rst
index 3ade7fe5ac..5480f05a99 100644
--- a/doc/guides/rel_notes/release_21_11.rst
+++ b/doc/guides/rel_notes/release_21_11.rst
@@ -196,6 +196,10 @@  ABI Changes
   ``rte_security_ipsec_xform`` to allow applications to configure SA soft
   and hard expiry limits. Limits can be either in number of packets or bytes.
 
+* security: The new options ``ip_csum_enable`` and ``l4_csum_enable`` were added
+  in structure ``rte_security_ipsec_sa_options`` to indicate whether inner
+  packet IPv4 header checksum and L4 checksum need to be offloaded to
+  security device.
 
 Known Issues
 ------------
diff --git a/lib/cryptodev/rte_cryptodev.h b/lib/cryptodev/rte_cryptodev.h
index bb01f0f195..d9271a6c45 100644
--- a/lib/cryptodev/rte_cryptodev.h
+++ b/lib/cryptodev/rte_cryptodev.h
@@ -479,6 +479,8 @@  rte_cryptodev_asym_get_xform_enum(enum rte_crypto_asym_xform_type *xform_enum,
 /**< Support operations on multiple data-units message */
 #define RTE_CRYPTODEV_FF_CIPHER_WRAPPED_KEY		(1ULL << 26)
 /**< Support wrapped key in cipher xform  */
+#define RTE_CRYPTODEV_FF_SECURITY_INNER_CSUM		(1ULL << 27)
+/**< Support inner checksum computation/verification */
 
 /**
  * Get the name of a crypto device feature flag
diff --git a/lib/security/rte_security.h b/lib/security/rte_security.h
index ab1a6e1f65..0c5636377e 100644
--- a/lib/security/rte_security.h
+++ b/lib/security/rte_security.h
@@ -230,6 +230,37 @@  struct rte_security_ipsec_sa_options {
 	 * * 0: Do not match UDP ports
 	 */
 	uint32_t udp_ports_verify : 1;
+
+	/** Compute/verify inner packet IPv4 header checksum in tunnel mode
+	 *
+	 * * 1: For outbound, compute inner packet IPv4 header checksum
+	 *      before tunnel encapsulation and for inbound, verify after
+	 *      tunnel decapsulation.
+	 * * 0: Inner packet IP header checksum is not computed/verified.
+	 *
+	 * The checksum verification status would be set in mbuf using
+	 * PKT_RX_IP_CKSUM_xxx flags.
+	 *
+	 * Inner IP checksum computation can also be enabled(per operation)
+	 * by setting the flag PKT_TX_IP_CKSUM in mbuf.
+	 */
+	uint32_t ip_csum_enable : 1;
+
+	/** Compute/verify inner packet L4 checksum in tunnel mode
+	 *
+	 * * 1: For outbound, compute inner packet L4 checksum before
+	 *      tunnel encapsulation and for inbound, verify after
+	 *      tunnel decapsulation.
+	 * * 0: Inner packet L4 checksum is not computed/verified.
+	 *
+	 * The checksum verification status would be set in mbuf using
+	 * PKT_RX_L4_CKSUM_xxx flags.
+	 *
+	 * Inner L4 checksum computation can also be enabled(per operation)
+	 * by setting the flags PKT_TX_TCP_CKSUM or PKT_TX_SCTP_CKSUM or
+	 * PKT_TX_UDP_CKSUM or PKT_TX_L4_MASK in mbuf.
+	 */
+	uint32_t l4_csum_enable : 1;
 };
 
 /** IPSec security association direction */