examples/ipsec-secgw: support TCP TSO

Add support to allow user to specific MSS for TCP TSO offload on a per SA
basis. MSS configuration in the context of IPsec is only supported for
outbound SA's in the context of an inline IPsec Crypto offload.

Signed-off-by: Declan Doherty <declan.doherty@intel.com>
Signed-off-by: Radu Nicolau <radu.nicolau@intel.com>
Acked-by: Konstantin Ananyev <konstantin.ananyev@intel.com>
Acked-by: Akhil Goyal <gakhil@marvell.com>

diff --git a/doc/guides/rel_notes/release_21_11.rst b/doc/guides/rel_notes/release_21_11.rst
index ba40c396bedcf0b73079a3aa7bab7a6e46f4e935..f62c7c4ca3189d0af4e3a023736ae3c18182c5db 100644 (file)
--- a/doc/guides/rel_notes/release_21_11.rst
+++ b/doc/guides/rel_notes/release_21_11.rst
@@ -352,6 +352,10 @@ New Features
   * Added tests to verify inner checksum.
   * Added tests for CHACHA20_POLY1305 PMD, including a new testcase for SGL OOP.
 
+* **Updated IPsec Security Gateway sample application with new features.**
+
+  * Added support for TSO (only for inline crypto TCP packets).
+
 * **Revised packet capture framework.**
 
   * New dpdk-dumpcap program that has most of the features

diff --git a/doc/guides/sample_app_ug/ipsec_secgw.rst b/doc/guides/sample_app_ug/ipsec_secgw.rst
index 782574dd39d5ac94676c67a73e2ab2b23a8f22fe..639d309a6e6a9b0d9f18b2f6bead619e1b85ec16 100644 (file)
--- a/doc/guides/sample_app_ug/ipsec_secgw.rst
+++ b/doc/guides/sample_app_ug/ipsec_secgw.rst
@@ -720,6 +720,17 @@ where each options means:
 
    * *udp-encap*
 
+ ``<mss>``
+
+ * Maximum segment size for TSO offload, available for egress SAs only.
+
+ * Optional: Yes, TSO offload not set by default
+
+ * Syntax:
+
+   * *mss N* N is the segment size in bytes
+
+
 Example SA rules:
 
 .. code-block:: console

diff --git a/examples/ipsec-secgw/ipsec-secgw.c b/examples/ipsec-secgw/ipsec-secgw.c
index 4bdf99b62bbc3e4f9b96cb8ff5542e0e6396c748..5fcf424efedd52f5c3fca34c09e8c243fdf5f21b 100644 (file)
--- a/examples/ipsec-secgw/ipsec-secgw.c
+++ b/examples/ipsec-secgw/ipsec-secgw.c
@@ -398,6 +398,10 @@ prepare_one_packet(struct rte_mbuf *pkt, struct ipsec_traffic *t)
                pkt->l2_len = 0;
                pkt->l3_len = sizeof(*iph4);
                pkt->packet_type |= RTE_PTYPE_L3_IPV4;
+               if  (pkt->packet_type & RTE_PTYPE_L4_TCP)
+                       pkt->l4_len = sizeof(struct rte_tcp_hdr);
+               else if (pkt->packet_type & RTE_PTYPE_L4_UDP)
+                       pkt->l4_len = sizeof(struct rte_udp_hdr);
        } else if (eth->ether_type == rte_cpu_to_be_16(RTE_ETHER_TYPE_IPV6)) {
                int next_proto;
                size_t l3len, ext_len;

diff --git a/examples/ipsec-secgw/ipsec.h b/examples/ipsec-secgw/ipsec.h
index 8405c481714fee105a120d6b83a60758731063ee..2c3640833d00755a2b52c66f64bb9aae6875ed24 100644 (file)
--- a/examples/ipsec-secgw/ipsec.h
+++ b/examples/ipsec-secgw/ipsec.h
@@ -137,6 +137,7 @@ struct ipsec_sa {
        enum rte_security_ipsec_sa_direction direction;
        uint8_t udp_encap;
        uint16_t portid;
+       uint16_t mss;
        uint8_t fdir_qid;
        uint8_t fdir_flag;
 

diff --git a/examples/ipsec-secgw/ipsec_process.c b/examples/ipsec-secgw/ipsec_process.c
index 5012e1a6a4cdad158f629a8d664720fce71fc5e8..9d888d4bc69789d33e594eba6171fbb7134bb4c4 100644 (file)
--- a/examples/ipsec-secgw/ipsec_process.c
+++ b/examples/ipsec-secgw/ipsec_process.c
@@ -222,6 +222,29 @@ prep_process_group(void *sa, struct rte_mbuf *mb[], uint32_t cnt)
        for (j = 0; j != cnt; j++) {
                priv = get_priv(mb[j]);
                priv->sa = sa;
+               /* setup TSO related fields if TSO enabled*/
+               if (priv->sa->mss) {
+                       uint32_t ptype = mb[j]->packet_type;
+                       /* only TCP is supported */
+                       if ((ptype & RTE_PTYPE_L4_MASK) == RTE_PTYPE_L4_TCP) {
+                               mb[j]->tso_segsz = priv->sa->mss;
+                               if ((IS_TUNNEL(priv->sa->flags))) {
+                                       mb[j]->outer_l3_len = mb[j]->l3_len;
+                                       mb[j]->outer_l2_len = mb[j]->l2_len;
+                                       mb[j]->ol_flags |=
+                                       (RTE_MBUF_F_TX_OUTER_IP_CKSUM |
+                                               RTE_MBUF_F_TX_TUNNEL_ESP);
+                               }
+                               mb[j]->ol_flags |= (RTE_MBUF_F_TX_TCP_SEG |
+                                               RTE_MBUF_F_TX_TCP_CKSUM);
+                               if (RTE_ETH_IS_IPV4_HDR(ptype))
+                                       mb[j]->ol_flags |=
+                                               RTE_MBUF_F_TX_OUTER_IPV4;
+                               else
+                                       mb[j]->ol_flags |=
+                                               RTE_MBUF_F_TX_OUTER_IPV6;
+                       }
+               }
        }
 }
 

diff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c
index 88dd30464fef201f7c564eaad4b9dcdfce8694ca..97f265cc7ba6abe2cacc187cde1160b42b883e08 100644 (file)
--- a/examples/ipsec-secgw/sa.c
+++ b/examples/ipsec-secgw/sa.c
@@ -677,6 +677,16 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens,
                        continue;
                }
 
+               if (strcmp(tokens[ti], "mss") == 0) {
+                       INCREMENT_TOKEN_INDEX(ti, n_tokens, status);
+                       if (status->status < 0)
+                               return;
+                       rule->mss = atoi(tokens[ti]);
+                       if (status->status < 0)
+                               return;
+                       continue;
+               }
+
                if (strcmp(tokens[ti], "fallback") == 0) {
                        struct rte_ipsec_session *fb;
 
@@ -970,7 +980,7 @@ sa_create(const char *name, int32_t socket_id, uint32_t nb_sa)
 }
 
 static int
-check_eth_dev_caps(uint16_t portid, uint32_t inbound)
+check_eth_dev_caps(uint16_t portid, uint32_t inbound, uint32_t tso)
 {
        struct rte_eth_dev_info dev_info;
        int retval;
@@ -999,6 +1009,12 @@ check_eth_dev_caps(uint16_t portid, uint32_t inbound)
                                "hardware TX IPSec offload is not supported\n");
                        return -EINVAL;
                }
+               if (tso && (dev_info.tx_offload_capa &
+                               RTE_ETH_TX_OFFLOAD_TCP_TSO) == 0) {
+                       RTE_LOG(WARNING, PORT,
+                               "hardware TCP TSO offload is not supported\n");
+                       return -EINVAL;
+               }
        }
        return 0;
 }
@@ -1127,7 +1143,7 @@ sa_add_rules(struct sa_ctx *sa_ctx, const struct ipsec_sa entries[],
 
                if (ips->type == RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL ||
                        ips->type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO) {
-                       if (check_eth_dev_caps(sa->portid, inbound))
+                       if (check_eth_dev_caps(sa->portid, inbound, sa->mss))
                                return -EINVAL;
                }
 
@@ -1638,8 +1654,11 @@ sa_check_offloads(uint16_t port_id, uint64_t *rx_offloads,
                if ((rule_type == RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO ||
                                rule_type ==
                                RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL)
-                               && rule->portid == port_id)
+                               && rule->portid == port_id) {
                        *tx_offloads |= RTE_ETH_TX_OFFLOAD_SECURITY;
+                       if (rule->mss)
+                               *tx_offloads |= RTE_ETH_TX_OFFLOAD_TCP_TSO;
+               }
        }
        return 0;
 }