- Integrity offload is enabled starting from **ConnectX-6 Dx**.
- Verification bits provided by the hardware are ``l3_ok``, ``ipv4_csum_ok``, ``l4_ok``, ``l4_csum_ok``.
- ``level`` value 0 references outer headers.
+ - Negative integrity item verification is not supported.
- Multiple integrity items not supported in a single flow rule.
- Flow rule items supplied by application must explicitly specify network headers referred by integrity item.
For example, if integrity item mask sets ``l4_ok`` or ``l4_csum_ok`` bits, reference to L4 network header,
TCP or UDP, must be in the rule pattern as well::
flow create 0 ingress pattern integrity level is 0 value mask l3_ok value spec l3_ok / eth / ipv6 / end …
- or
- flow create 0 ingress pattern integrity level is 0 value mask l4_ok value spec 0 / eth / ipv4 proto is udp / end …
+
+ flow create 0 ingress pattern integrity level is 0 value mask l4_ok value spec l4_ok / eth / ipv4 proto is udp / end …
- Connection tracking:
RTE_FLOW_ERROR_TYPE_ITEM,
integrity_item,
"unsupported integrity filter");
+ if ((mask->l3_ok & !spec->l3_ok) || (mask->l4_ok & !spec->l4_ok) ||
+ (mask->ipv4_csum_ok & !spec->ipv4_csum_ok) ||
+ (mask->l4_csum_ok & !spec->l4_csum_ok))
+ return rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ITEM,
+ NULL, "negative integrity flow is not supported");
if (spec->level > 1) {
if (pattern_flags & MLX5_FLOW_ITEM_INNER_INTEGRITY)
return rte_flow_error_set