From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 13E6DA0C41; Thu, 30 Sep 2021 11:11:27 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id E1BD341181; Thu, 30 Sep 2021 11:09:43 +0200 (CEST) Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by mails.dpdk.org (Postfix) with ESMTP id F142C410F1 for ; Thu, 30 Sep 2021 11:09:39 +0200 (CEST) X-IronPort-AV: E=McAfee;i="6200,9189,10122"; a="247678908" X-IronPort-AV: E=Sophos;i="5.85,335,1624345200"; d="scan'208";a="247678908" Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Sep 2021 02:09:39 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.85,335,1624345200"; d="scan'208";a="563970505" Received: from orsmsx606.amr.corp.intel.com ([10.22.229.19]) by fmsmga002.fm.intel.com with ESMTP; 30 Sep 2021 02:09:38 -0700 Received: from orsmsx610.amr.corp.intel.com (10.22.229.23) by ORSMSX606.amr.corp.intel.com (10.22.229.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.12; Thu, 30 Sep 2021 02:09:38 -0700 Received: from orsmsx604.amr.corp.intel.com (10.22.229.17) by ORSMSX610.amr.corp.intel.com (10.22.229.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.12; Thu, 30 Sep 2021 02:09:37 -0700 Received: from ORSEDG602.ED.cps.intel.com (10.7.248.7) by orsmsx604.amr.corp.intel.com (10.22.229.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.12 via Frontend Transport; Thu, 30 Sep 2021 02:09:37 -0700 Received: from NAM02-SN1-obe.outbound.protection.outlook.com (104.47.57.41) by edgegateway.intel.com (134.134.137.103) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2242.12; Thu, 30 Sep 2021 02:09:37 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Dbu8FetNIRyh6c1g99zaT84KG1W+laXUlt11KgtyhkF2E/VcwFGKfaoBB/rTI/xSGt3e4HidDzLtqzNAKFHjhVdVOYU/nSKh39hVA/EctnEI0C/ITBgBp/ZshnM9jWUpSbkpcwAERo2+vv3U1JgIW0NGpzRIOSaCLsG/+3ralKVHVu5qjeAnkRhPfc74ulMQqwK2HAK3LzUlhQzM6Q7aAju7KzTlgE+73fhlrxzF9E2vFRB69CmVNxxNGH4fmAIvzO+zpyTcEIhvDjop/a7IqSKsQVo5TrnZcVzraXqhWVu5RJXcsCBApsdi8+qtIFf1MIZeaXkQj3Bs+PA74xg5NQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=+dBlZjLDHRlLkOX5a9ZtaedWvwf67hdMTJUWMxDyNW0=; b=nDz09R4FUBU+CjzfUEETcfvZb+hQSFNa9xnUi/GjS9m2LDmxzYzmQ/pTqDq94HqtwXKRsIUXBZaM4xwChVeLM4O9XD4usQCXS5QVGl/nGjJxMVxJGM6Uy4ZiFXJsMqD1yko5dsEqfIjSjrRitklsFhG7LiDunHmHSrrGvTj1Ym5UOKBFauEpiMeSvd5V3EfH3SVkT3qsSWfIBi46Qdo9SPSDNC2yx6qRUIWvoTE5DVCjo8V+rqhuetkqSimTHHeI2w1N0nWIW+vqpVFZEzK/LxZo3nFZqR152pBGhRhPlAHSijkmzNIK00gPVIYCtqsWMecqEzGNtGocrHS3ElJQug== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel.onmicrosoft.com; s=selector2-intel-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+dBlZjLDHRlLkOX5a9ZtaedWvwf67hdMTJUWMxDyNW0=; b=rCJ9F2J1wm3m4/wFRT5EtaV7CLsp2YMgf5pnnWf+7bNOC/QMoCpup+WObYXByLO+AC8gfDcj6ZKDrq1JPnoS3lYTzZNwMRMO5bGOvXvxjoprFLEI34pS/3GQ5rOfUoYHRu+9p3pGXkIBOccrgEuzXlsdr8iyKa51I4dj+9NJ7AM= Received: from DM6PR11MB4491.namprd11.prod.outlook.com (2603:10b6:5:204::19) by DM4PR11MB5470.namprd11.prod.outlook.com (2603:10b6:5:39c::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4566.13; Thu, 30 Sep 2021 09:09:36 +0000 Received: from DM6PR11MB4491.namprd11.prod.outlook.com ([fe80::740e:126e:c785:c8fd]) by DM6PR11MB4491.namprd11.prod.outlook.com ([fe80::740e:126e:c785:c8fd%4]) with mapi id 15.20.4566.014; Thu, 30 Sep 2021 09:09:36 +0000 From: "Ananyev, Konstantin" To: Anoob Joseph , Archana Muniganti , Akhil Goyal , "Nicolau, Radu" , "Zhang, Roy Fan" , "hemant.agrawal@nxp.com" CC: Tejasree Kondoj , Ankur Dwivedi , Jerin Jacob Kollanukkaran , "dev@dpdk.org" Thread-Topic: [PATCH v2 1/3] security: add SA config option for inner pkt csum Thread-Index: AQHXtRGeCPn6nQ6nNUGVM+AYjgaWFau61TOggAAD3ACAAAmhMIABJKCAgABECxA= Date: Thu, 30 Sep 2021 09:09:36 +0000 Message-ID: References: <20210929090811.21030-1-marchana@marvell.com> <20210929090811.21030-2-marchana@marvell.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-reaction: no-action dlp-version: 11.6.200.16 authentication-results: marvell.com; dkim=none (message not signed) header.d=none;marvell.com; dmarc=none action=none header.from=intel.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 8b01548a-bad0-4954-5118-08d983f20694 x-ms-traffictypediagnostic: DM4PR11MB5470: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6790; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: +mzYNkqaJ6XXkzzOCeHVB4VnVPEvkZjB0spFighPz2aQapl2Dd3+GvVgIWJBdh7JJWmffOIg+PvftcZ1Mo8F4bqAfiYaEl/uKAq5guBddUviiYgJXrltyxEYn+6Vgne7OnNxgP2AFkTh00XWnthJRM1sY2OVUn8b2RM1yJIXFL9wXdHPi1D5+ej7T27EpNLZUUwoxz/qNRjFRQkCq+nXA7NpsBm5XkOWq6pymtRN5K/ERtrq9nmJyRDx619S3n7GkE1z8YtHGIeZtGmks4YE0oGbRLTxh36YTPnI3U7VEvoDqN75lQm8nPpH2hsXsIoEUJ8tEuaC9lNTRl/UZ8Ez8YCP2RVc7Gmot9X6jzAx8n01uH+Wdh+v4jfP5JoB9+uNNJoof5KN9VpJj02ovhny2JDXPZG4IN7DaTel/uRtxi704ePxbyWhMBfbQsQi16+lFuFp6TSkav1nVUzaG51gl59KFgrdhXfhzYrZZS6kiqb46ijck4+wbOlmBaEjjoEqtcMzrdeoKHf1rnCvkjATG8NXCTBtgzopIS5P0i5SOiaT8fTPJrZ1i6pg7vvX5x0oraeCV/NxpMAvLsffcx12KBC/NNsKzxPhyabkpt5HIy3mpMTzwYyOXQN0aUVFm8Oa1ClFErWr32nlRT9I6DPYeAOI/SPepw/06AZKa3D/sHcLaTuApt1g8zYkQWwSWF03cuMZ7sPvzXQACjBZp3BeVA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR11MB4491.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(366004)(53546011)(33656002)(6506007)(186003)(38070700005)(66476007)(4326008)(8936002)(66946007)(2906002)(66556008)(38100700002)(7696005)(66446008)(64756008)(76116006)(5660300002)(55016002)(122000001)(15650500001)(52536014)(26005)(55236004)(86362001)(71200400001)(9686003)(8676002)(83380400001)(54906003)(508600001)(316002)(110136005); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?fZ3rJ1Zb2gFlWKwkZrTySAXk4EsWBD+Svauln0SMxLeokCNvXEkKNKgf/nGh?= =?us-ascii?Q?dq/a7fTD5RxGNwcOBqpV2bYFTaBURlSFqO+kMAwnqSh74qAb++aDPtSCFPXP?= =?us-ascii?Q?snvi2ElOlb2OFdjFqI0q0ZofZUQkRAivwJc5S1v1bfkVnvMVzOde+Ae25yhY?= =?us-ascii?Q?h4Z4ZcJeKBlU5WBbbOmTngIswTazZApbkvQDJ1qjTWfi9E/5RzmQ0hhmLgrY?= =?us-ascii?Q?EmoROaJLmVUEDKARIpRiFgXZ1C2IavrPFXtXwHAFAQvvK4APMc+pwOHc+HRM?= =?us-ascii?Q?GAJX7vsGiUn98zTl0LjBtiRDYOUdsSEr5yLlFHxeoO9xHNIRNkjMuw7qwMBR?= =?us-ascii?Q?f3BBtWB0HWeDA6YBe852mVL8aqi1Osf5t3xWviXwcGnNW/s2sO9IEDwTEbrQ?= =?us-ascii?Q?+32gl7tJhM5vubht+nHJaAybReny3bTG5MUgcAPhyBI+hkzPajj8uqtTncWi?= =?us-ascii?Q?P8T1rqr+4SQ5rxAY8g4P2MsVFUMNO7sDkS9+RoGQQ0XBwbllFRfzTpxU7gK7?= =?us-ascii?Q?6A9FUbwJ7yVGW5BiwzMBz5ssv5nto991W2eF461XS7CJbO7854DEmvFOtJ7s?= =?us-ascii?Q?avqVqcQqQVBk+pqtBWB9HYBt7rJjAVPYo0eKSiRN4J+2FP2WnDOIEDnDX8MZ?= =?us-ascii?Q?PnB449lISY4zt3YQTEYG34lkUD/TFIJxfcLb4cz7icp5tL8IkroeTSZm81dy?= =?us-ascii?Q?qxj7yrkRK4qsAASqc11kFdyOnVuDcWfcYNjIhc3vZfE5eBr9B3idnQzsMz/y?= =?us-ascii?Q?L/kcWBDzgyYLBbCm1M5NsIU156f6lt8jRl6L/WLgBiiOc43Y2Qy9P0UKK68h?= =?us-ascii?Q?2gtmoh/SP9Q+MERze2qLTEHrQ5xNUjpCNpywxLJzJSoglh8gGpEw5vhLzTyk?= =?us-ascii?Q?D9X1BdvwB+S0OjLRDJaC3uBaGAPsDfG1Ub7pZjWZpIVDyTDnAR74IcWgAoQ3?= =?us-ascii?Q?2sVQrrQ3nrCUzOSl78bNL5+bbgBBVUE52RUBCph1K6TvcpnUrlkQtys8lE06?= =?us-ascii?Q?z/Mc9YXVDVl69dFtT9sYG430RGdRVVwS5SqI9KHRPBCzQpfOAssRcRz3lgHh?= =?us-ascii?Q?lCFGiJAWYOrHvkF3Vn+KRCjvGaNLX6q6yK09i7NfI8ikzhSFBsBdRlygMYuQ?= =?us-ascii?Q?u62qA4j0j71dwscDofH06VZJ1EC9fK2mMgDOoPgoYZij/uOarHdJvxSWOPhM?= =?us-ascii?Q?CwEcKdm0NIN/5+1FKKKr5YNqrAfPy/Xr/py+Ypvtleoxcz3dIEgLq17Kviue?= =?us-ascii?Q?SWQL4jTTl5cch9WTwYjkCtfYIYppXAf0edOKP9oRxajiKJspRmzq3gGVKd3V?= =?us-ascii?Q?LsEskzklIo/HtTq1/TGDIHlJ?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR11MB4491.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8b01548a-bad0-4954-5118-08d983f20694 X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Sep 2021 09:09:36.3924 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: PzoiGY75XTS27FEv5r+pyv901+FRNUxixZQ+oAzA+q+asLKI9vSOamPASkGpZN7v+cNk06RQPhG6pLy95zecd3OrBQmsGxMq5MUAcdZGSZU= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR11MB5470 X-OriginatorOrg: intel.com Subject: Re: [dpdk-dev] [PATCH v2 1/3] security: add SA config option for inner pkt csum X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Hi Anoob, > > > > External Email > > > > ---------------------------------------------------------------------- > > Hi Anoob, > > > > > Hi Konstanin, > > > > > > Please see inline. > > > > > > Thanks, > > > Anoob > > > > > > > -----Original Message----- > > > > From: Ananyev, Konstantin > > > > Sent: Wednesday, September 29, 2021 4:26 PM > > > > To: Archana Muniganti ; Akhil Goyal > > > > ; Nicolau, Radu ; Zhang= , > > > > Roy Fan ; hemant.agrawal@nxp.com > > > > Cc: Anoob Joseph ; Tejasree Kondoj > > > > ; Ankur Dwivedi ; Jeri= n > > > > Jacob Kollanukkaran ; dev@dpdk.org > > > > Subject: [EXT] RE: [PATCH v2 1/3] security: add SA config option fo= r > > > > inner pkt csum > > > > > > > > External Email > > > > > > > > -------------------------------------------------------------------= - > > > > -- > > > > > Add inner packet IPv4 hdr and L4 checksum enable options in conf. > > > > > These will be used in case of protocol offload. > > > > > Per SA, application could specify whether the > > > > > checksum(compute/verify) can be offloaded to security device. > > > > > > > > > > Signed-off-by: Archana Muniganti > > > > > --- > > > > > doc/guides/cryptodevs/features/default.ini | 1 + > > > > > doc/guides/rel_notes/deprecation.rst | 4 ++-- > > > > > doc/guides/rel_notes/release_21_11.rst | 4 ++++ > > > > > lib/cryptodev/rte_cryptodev.h | 2 ++ > > > > > lib/security/rte_security.h | 18 ++++++++++++++++= ++ > > > > > 5 files changed, 27 insertions(+), 2 deletions(-) > > > > > > > > > > diff --git a/doc/guides/cryptodevs/features/default.ini > > > > > b/doc/guides/cryptodevs/features/default.ini > > > > > index c24814de98..96d95ddc81 100644 > > > > > --- a/doc/guides/cryptodevs/features/default.ini > > > > > +++ b/doc/guides/cryptodevs/features/default.ini > > > > > @@ -33,6 +33,7 @@ Non-Byte aligned data =3D Sym raw data path A= PI > > > > > =3D Cipher multiple data units =3D > > > > > Cipher wrapped key =3D > > > > > +Inner checksum =3D > > > > > > > > > > ; > > > > > ; Supported crypto algorithms of a default crypto driver. > > > > > diff --git a/doc/guides/rel_notes/deprecation.rst > > > > > b/doc/guides/rel_notes/deprecation.rst > > > > > index 05fc2fdee7..8308e00ed4 100644 > > > > > --- a/doc/guides/rel_notes/deprecation.rst > > > > > +++ b/doc/guides/rel_notes/deprecation.rst > > > > > @@ -232,8 +232,8 @@ Deprecation Notices > > > > > IPsec payload MSS (Maximum Segment Size), and ESN (Extended > > > > > Sequence > > > > Number). > > > > > > > > > > * security: The IPsec SA config options ``struct > > > > > rte_security_ipsec_sa_options`` > > > > > - will be updated with new fields to support new features like > > > > > IPsec inner > > > > > - checksum, TSO in case of protocol offload. > > > > > + will be updated with new fields to support new features like > > > > > + TSO in case of protocol offload. > > > > > > > > > > * ipsec: The structure ``rte_ipsec_sa_prm`` will be extended wit= h a new > > field > > > > > ``hdr_l3_len`` to configure tunnel L3 header length. > > > > > diff --git a/doc/guides/rel_notes/release_21_11.rst > > > > > b/doc/guides/rel_notes/release_21_11.rst > > > > > index 8da851cccc..93d1b36889 100644 > > > > > --- a/doc/guides/rel_notes/release_21_11.rst > > > > > +++ b/doc/guides/rel_notes/release_21_11.rst > > > > > @@ -194,6 +194,10 @@ ABI Changes > > > > > ``rte_security_ipsec_xform`` to allow applications to configur= e SA soft > > > > > and hard expiry limits. Limits can be either in number of pack= ets or bytes. > > > > > > > > > > +* security: The new options ``ip_csum_enable`` and > > > > > +``l4_csum_enable`` were added > > > > > + in structure ``rte_security_ipsec_sa_options`` to indicate > > > > > +whether inner > > > > > + packet IPv4 header checksum and L4 checksum need to be > > > > > +offloaded to > > > > > + security device. > > > > > > > > > > Known Issues > > > > > ------------ > > > > > diff --git a/lib/cryptodev/rte_cryptodev.h > > > > > b/lib/cryptodev/rte_cryptodev.h index bb01f0f195..d9271a6c45 > > > > > 100644 > > > > > --- a/lib/cryptodev/rte_cryptodev.h > > > > > +++ b/lib/cryptodev/rte_cryptodev.h > > > > > @@ -479,6 +479,8 @@ rte_cryptodev_asym_get_xform_enum(enum > > > > > rte_crypto_asym_xform_type *xform_enum, /**< Support operations > > > > > on > > > > multiple data-units message */ > > > > > #define RTE_CRYPTODEV_FF_CIPHER_WRAPPED_KEY (1ULL > > << 26) > > > > > /**< Support wrapped key in cipher xform */ > > > > > +#define RTE_CRYPTODEV_FF_SECURITY_INNER_CSUM (1ULL > > > > << 27) > > > > > +/**< Support inner checksum computation/verification */ > > > > > > > > > > /** > > > > > * Get the name of a crypto device feature flag diff --git > > > > > a/lib/security/rte_security.h b/lib/security/rte_security.h index > > > > > ab1a6e1f65..945f45ad76 100644 > > > > > --- a/lib/security/rte_security.h > > > > > +++ b/lib/security/rte_security.h > > > > > @@ -230,6 +230,24 @@ struct rte_security_ipsec_sa_options { > > > > > * * 0: Do not match UDP ports > > > > > */ > > > > > uint32_t udp_ports_verify : 1; > > > > > + > > > > > + /** Compute/verify inner packet IPv4 header checksum in tunnel = mode > > > > > + * > > > > > + * * 1: For outbound, compute inner packet IPv4 header checksum > > > > > + * before tunnel encapsulation and for inbound, verify aft= er > > > > > + * tunnel decapsulation. > > > > > + * * 0: Inner packet IP header checksum is not computed/verifie= d. > > > > > + */ > > > > > + uint32_t ip_csum_enable : 1; > > > > > + > > > > > + /** Compute/verify inner packet L4 checksum in tunnel mode > > > > > + * > > > > > + * * 1: For outbound, compute inner packet L4 checksum before > > > > > + * tunnel encapsulation and for inbound, verify after > > > > > + * tunnel decapsulation. > > > > > + * * 0: Inner packet L4 checksum is not computed/verified. > > > > > + */ > > > > > + uint32_t l4_csum_enable : 1; > > > > > > > > As I understand these 2 new flags serve two purposes: > > > > 1. report HW/PMD ability to perform these offloads. > > > > 2. allow user to enable/disable this offload on SA basis. > > > > > > [Anoob] Correct > > > > > > > > > > > One question I have - how it will work on data-path? > > > > Would decision to perform these offloads be based on mbuf->ol_flags > > > > value (same as we doing for ethdev TX offloads)? > > > > Or some other approach is implied? > > > > > > [Anoob] There will be two settings. It can enabled per SA or enabled = per > > packet. > > > > Ok, will it be documented somewhere? > > Or probably it already is, and I just missed/forgot it somehow? >=20 > [Anoob] Looks like we missed documenting this. Will update in the next ve= rsion. Should we add documentation around SA options or around > TX offload flags? I think it's better around SA options.=20 Same thought here. Thanks