From: Archana Muniganti Date: Thu, 30 Sep 2021 12:58:30 +0000 (+0530) Subject: security: add SA config option for inner checksum X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=03ab51eafda992874a48c392ca66ffb577fe2b71;p=dpdk.git security: add SA config option for inner checksum Add inner packet IPv4 hdr and L4 checksum enable options in conf. These will be used in case of protocol offload. Per SA, application could specify whether the checksum(compute/verify) can be offloaded to security device. Signed-off-by: Archana Muniganti Acked-by: Konstantin Ananyev Acked-by: Akhil Goyal --- diff --git a/doc/guides/cryptodevs/features/default.ini b/doc/guides/cryptodevs/features/default.ini index c24814de98..96d95ddc81 100644 --- a/doc/guides/cryptodevs/features/default.ini +++ b/doc/guides/cryptodevs/features/default.ini @@ -33,6 +33,7 @@ Non-Byte aligned data = Sym raw data path API = Cipher multiple data units = Cipher wrapped key = +Inner checksum = ; ; Supported crypto algorithms of a default crypto driver. diff --git a/doc/guides/rel_notes/deprecation.rst b/doc/guides/rel_notes/deprecation.rst index 97823a9564..a4e86b31f5 100644 --- a/doc/guides/rel_notes/deprecation.rst +++ b/doc/guides/rel_notes/deprecation.rst @@ -209,8 +209,8 @@ Deprecation Notices IPsec payload MSS (Maximum Segment Size), and ESN (Extended Sequence Number). * security: The IPsec SA config options ``struct rte_security_ipsec_sa_options`` - will be updated with new fields to support new features like IPsec inner - checksum, TSO in case of protocol offload. + will be updated with new fields to support new features like TSO in case of + protocol offload. * ipsec: The structure ``rte_ipsec_sa_prm`` will be extended with a new field ``hdr_l3_len`` to configure tunnel L3 header length. diff --git a/doc/guides/rel_notes/release_21_11.rst b/doc/guides/rel_notes/release_21_11.rst index 0dbf924b67..aad7b1ff20 100644 --- a/doc/guides/rel_notes/release_21_11.rst +++ b/doc/guides/rel_notes/release_21_11.rst @@ -258,6 +258,11 @@ ABI Changes ``rte_security_ipsec_xform`` to allow applications to configure SA soft and hard expiry limits. Limits can be either in number of packets or bytes. +* security: The new options ``ip_csum_enable`` and ``l4_csum_enable`` were added + in structure ``rte_security_ipsec_sa_options`` to indicate whether inner + packet IPv4 header checksum and L4 checksum need to be offloaded to + security device. + * bbdev: Added capability related to more comprehensive CRC options, shifting values of the ``enum rte_bbdev_op_ldpcdec_flag_bitmasks``. diff --git a/lib/cryptodev/rte_cryptodev.h b/lib/cryptodev/rte_cryptodev.h index d43905c46f..cdd7168fba 100644 --- a/lib/cryptodev/rte_cryptodev.h +++ b/lib/cryptodev/rte_cryptodev.h @@ -479,6 +479,8 @@ rte_cryptodev_asym_get_xform_enum(enum rte_crypto_asym_xform_type *xform_enum, /**< Support operations on multiple data-units message */ #define RTE_CRYPTODEV_FF_CIPHER_WRAPPED_KEY (1ULL << 26) /**< Support wrapped key in cipher xform */ +#define RTE_CRYPTODEV_FF_SECURITY_INNER_CSUM (1ULL << 27) +/**< Support inner checksum computation/verification */ /** * Get the name of a crypto device feature flag diff --git a/lib/security/rte_security.h b/lib/security/rte_security.h index 7b066e758b..7eb9f109ae 100644 --- a/lib/security/rte_security.h +++ b/lib/security/rte_security.h @@ -227,6 +227,37 @@ struct rte_security_ipsec_sa_options { * * 0: Do not match UDP ports */ uint32_t udp_ports_verify : 1; + + /** Compute/verify inner packet IPv4 header checksum in tunnel mode + * + * * 1: For outbound, compute inner packet IPv4 header checksum + * before tunnel encapsulation and for inbound, verify after + * tunnel decapsulation. + * * 0: Inner packet IP header checksum is not computed/verified. + * + * The checksum verification status would be set in mbuf using + * PKT_RX_IP_CKSUM_xxx flags. + * + * Inner IP checksum computation can also be enabled(per operation) + * by setting the flag PKT_TX_IP_CKSUM in mbuf. + */ + uint32_t ip_csum_enable : 1; + + /** Compute/verify inner packet L4 checksum in tunnel mode + * + * * 1: For outbound, compute inner packet L4 checksum before + * tunnel encapsulation and for inbound, verify after + * tunnel decapsulation. + * * 0: Inner packet L4 checksum is not computed/verified. + * + * The checksum verification status would be set in mbuf using + * PKT_RX_L4_CKSUM_xxx flags. + * + * Inner L4 checksum computation can also be enabled(per operation) + * by setting the flags PKT_TX_TCP_CKSUM or PKT_TX_SCTP_CKSUM or + * PKT_TX_UDP_CKSUM or PKT_TX_L4_MASK in mbuf. + */ + uint32_t l4_csum_enable : 1; }; /** IPSec security association direction */