From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 28F6AA0547; Wed, 29 Sep 2021 13:39:13 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 99F95410EA; Wed, 29 Sep 2021 13:39:12 +0200 (CEST) Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) by mails.dpdk.org (Postfix) with ESMTP id F103B410E5 for ; Wed, 29 Sep 2021 13:39:10 +0200 (CEST) X-IronPort-AV: E=McAfee;i="6200,9189,10121"; a="285935178" X-IronPort-AV: E=Sophos;i="5.85,332,1624345200"; d="scan'208";a="285935178" Received: from orsmga005.jf.intel.com ([10.7.209.41]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 Sep 2021 04:39:09 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.85,332,1624345200"; d="scan'208";a="655464616" Received: from fmsmsx603.amr.corp.intel.com ([10.18.126.83]) by orsmga005.jf.intel.com with ESMTP; 29 Sep 2021 04:39:09 -0700 Received: from fmsmsx611.amr.corp.intel.com (10.18.126.91) by fmsmsx603.amr.corp.intel.com (10.18.126.83) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.12; Wed, 29 Sep 2021 04:39:08 -0700 Received: from FMSEDG603.ED.cps.intel.com (10.1.192.133) by fmsmsx611.amr.corp.intel.com (10.18.126.91) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.12 via Frontend Transport; Wed, 29 Sep 2021 04:39:08 -0700 Received: from NAM10-MW2-obe.outbound.protection.outlook.com (104.47.55.106) by edgegateway.intel.com (192.55.55.68) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2242.12; Wed, 29 Sep 2021 04:39:08 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=FuZJethRMJ9kR5+50gkTl4drh20z7jw9V6e5bcyOKpqCk+xobkqwVZkBblyaCaa9eGe7peYDXV268rhur2qetokCa+uihnXEfK6a/OypwZTpDL5pU/gBOfanx4hwiKurVeDYIjX2QQGBZsS+A3aYDe+VN+Bxda0WvPjB1HtJqaRT8IqbWbzmQrPhT4hUiRW0qzA2OPgCd36gin2+cCXSdbLhUKJmSDK3dw3YyrQpArw3LIzvN7kpqwpELjKeYuJLorr6J9Usfz6leKNDofXWdRksqwvZDmA0MqVJb5x2SXfkEfNdF3GNAy83xvkt6zyLzwyNscFYnwr6EH31k2Z0bg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=M3HiTaWNgtNCFcseY0pWa9daeEQ3yPVoEe7Ti5VL+vY=; b=H7lxBc67PfhXMnKmCT9GZQvf0hXM0Hflp7LSbxZ0YaaDlsMIIfzgdwwjsNIILFRM3ol/WPylW9OwjLg1tGZUC38L12dOH6tUNJQ1iGjIKK5f+Egx+Ji3JMgfRfXQiEbaIqlJQfIV3ehNdn8MLgMK69A/Q4Ibw1ZlWfiQOEJfPl8DZB8LrURY4ZksXb8fDMXSgS/WtJPnu92VmCUQMKtgtAL2M74MeNKqa0C9Qm8W/31s25LUNyPTmvoLf/wztc4xtBt2qpR+hJ9ybiUoryePR2NdRgbO6YUwv8AXfPSlkYgX1VKIG+qOEiLS/Ww+lihnfG65VYFMVc1fuP5hBHRNxw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel.onmicrosoft.com; s=selector2-intel-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=M3HiTaWNgtNCFcseY0pWa9daeEQ3yPVoEe7Ti5VL+vY=; b=mnvtFTwuNHZby7vjgycbPmSb7RLHLrmYf83CJ7WlKod6fST3Hk9V0huogi2SiZO15Qy/lY4z19hM+IjuFtzVGD9LUIxgeOGHyTREWW1V39ivrDx2B6IP9HFYU5NUSCTE/mfTZfSLKHE32oGLNdC2qvBnXb9epejVfsszrr9eGrw= Received: from DM6PR11MB4491.namprd11.prod.outlook.com (2603:10b6:5:204::19) by DM6PR11MB4106.namprd11.prod.outlook.com (2603:10b6:5:19f::31) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4544.15; Wed, 29 Sep 2021 11:39:07 +0000 Received: from DM6PR11MB4491.namprd11.prod.outlook.com ([fe80::740e:126e:c785:c8fd]) by DM6PR11MB4491.namprd11.prod.outlook.com ([fe80::740e:126e:c785:c8fd%4]) with mapi id 15.20.4566.014; Wed, 29 Sep 2021 11:39:07 +0000 From: "Ananyev, Konstantin" To: Anoob Joseph , Archana Muniganti , Akhil Goyal , "Nicolau, Radu" , "Zhang, Roy Fan" , "hemant.agrawal@nxp.com" CC: Tejasree Kondoj , Ankur Dwivedi , Jerin Jacob Kollanukkaran , "dev@dpdk.org" Thread-Topic: [PATCH v2 1/3] security: add SA config option for inner pkt csum Thread-Index: AQHXtRGeCPn6nQ6nNUGVM+AYjgaWFau61TOggAAD3ACAAAmhMA== Date: Wed, 29 Sep 2021 11:39:07 +0000 Message-ID: References: <20210929090811.21030-1-marchana@marvell.com> <20210929090811.21030-2-marchana@marvell.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-reaction: no-action dlp-version: 11.6.200.16 authentication-results: marvell.com; dkim=none (message not signed) header.d=none;marvell.com; dmarc=none action=none header.from=intel.com; x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b6b85537-1a85-452f-96f4-08d9833dbf64 x-ms-traffictypediagnostic: DM6PR11MB4106: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6790; x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: Tb0VZIweMP/UkoW8CK5NMDPGXQZHuhtXk2juLXPwKGYW91pKvlk/gVPSPLvEgNLwUn/tFVo1Hvn1W0fQtjhlih5cLGx8Z7lKtY8grnqeqll4y1fcbhBkToA73+uc5MwDgLGFZapiHXXIyxwwP1yaZFN+YE2b6VOXUu8sKQoG4rMFnYkLyk7uzGFybMxiyl433Btnpzi/Vkr5haz0EkB0Ofpz8+74whw5ZwCnuDkwKSwHSRW77KEXao23dRZvbS8RT4QkqIysDvgNyx8kFZ8p+IWYeCERGNb+v9WEqH7Gnz4A0RxBFaLBjR8tw0ztc5ip5VsU7U+rfZjRVIgw7hodpqVhJyQOzkOPK93uLX7lfNW/LdywruiX0xCl3xmQZ/d08T7DTbboZQtq44RnvbuTTFRq7JXmKzTdEFeY8KyvXG37i/oAWkZbsQl4v6FCTlgiKFDQ8xMPEpkxwEMeUaib8WmZjnDi6mO5bpVhf5TVRAKPBCgo9u8ME9FQhM1MK7yYnsKzOjoZ2G1zgYbl+WcQCJNuxt1/yp9tiGwhAuWszfMTfNnQOm/5VdT0k3y21Ofh737F709oBPHgNbgrPit847z10M78O/JH5raYcz2mCekdJpsAlaBeLut2tXtow+M19iUFIUUJ6G8lCFc188q2YhOSnFCgNwaEc1DiOmpyy9qAnHnFAjeSf8PPlbFSwveyS5bXGu7TgAlcaCybHXb3Hg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR11MB4491.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(366004)(38070700005)(86362001)(8936002)(316002)(64756008)(66446008)(9686003)(83380400001)(76116006)(71200400001)(55016002)(66946007)(66556008)(66476007)(53546011)(8676002)(5660300002)(4326008)(54906003)(52536014)(2906002)(15650500001)(6506007)(38100700002)(110136005)(26005)(55236004)(508600001)(186003)(33656002)(7696005)(122000001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?DHM3NlILj2LXmHwHV8Xjpgk+Dih9FQ22OyxVi7M1ZPRIHAmgnYvFL7XUu2OH?= =?us-ascii?Q?gW/Uiz4LbEutgORaffd804Am13a7BVy+ZRZCb6HyAYVYgnl7c+hh7AJRl10Q?= =?us-ascii?Q?gbwzKiZWZmGcL7angJ9dFcRR4TT3TwNifbsLf0BGCrg5t/1Ii0nu5WHH9oUL?= =?us-ascii?Q?lBVpFF3py6aR1AaaXT9/yP5MFotI8sILjOizakUlO7QQKvyYd2A4JyKn3Jzw?= =?us-ascii?Q?XxdvyowLzXBFodr6fIwQXsgm5IIml4UeaRqptmYmS0K8mPzMBYexaKuv/Ihx?= =?us-ascii?Q?8N/K6xAY82UH84YFs+6dAKCLjUUKDsr+YPWj8YnPHUvnapeV27JOG5Cbay8t?= =?us-ascii?Q?qxXrpRKKqK4xn1dtHcui5GHmvygkquFdqOKjRSBBPcKfmel3dzPq2xUAow02?= =?us-ascii?Q?pce0hHXqYc8HbzKGpsrOFQXICXHAsnl7LZ2anoOSTqlTkf55cD0yIuFdj07s?= =?us-ascii?Q?m0QH1hESRWlYGGcibJRQKYY72O+uG6ZSjV2QADZ8CfN3ujHILPGrWWkOo/o4?= =?us-ascii?Q?r1vZQFrVnSmw8EpsxGb66Ng0H9Ia+O2Ncoj3cDB6BQnXtHBirg0hkMMSmOZx?= =?us-ascii?Q?/ODd+NXIS4gvzlTP12582kaxTmjFFh+sd1yFKNUineGjMnc5f4Zi9/KhQzkE?= =?us-ascii?Q?Tq6Z0hG1JO5e1gCy/0pFHZ3VtWC1E1xL27dUhCRhLUQlLsT/Mhc5YPIiEX8y?= =?us-ascii?Q?EI5gFQjdi5SsIEiXqYd/2LIj1lO0zMutFEsIecaLGEAPrHelfc/04vPUzj4s?= =?us-ascii?Q?IAUAUiKdUNwaCP3PCji3VRS1mzlHqG38PeLnu75Teurz6bcisRGz1Oq/yMsa?= =?us-ascii?Q?d73iDB8+JghwtDaEDdjk0E6R5gLXtsnRq56enRQXQlX7GjaLzLHJF3yc9MFi?= =?us-ascii?Q?g5PNAr7gGix09dBZFaGcbhHoajQ3lUbO6WAqvK1bQN3hFfe9Q4+24glWj9Q8?= =?us-ascii?Q?qvyEUEOwx8iq67R34WTDbJcUnmWYQ65ogHrAUZWDTL0V/8FBSaeuYs+P7o6o?= =?us-ascii?Q?vdDFwGvCZvohofVtOp66bwYfCnYvnbjLp6Jjv+TckGYTyhe/aylZ4uOCqJVy?= =?us-ascii?Q?vPuk30q8f9ybKPsC4fLM//Fel7xgXKk5mtHUDRs3IfpsY6uE+DWJ5G8CLe+1?= =?us-ascii?Q?VSpE0NC6TO9zSqZIdEad6Yg2uuBP9uy8wyq1mcY4UCrgvWHFa7PpNQaNx4Hs?= =?us-ascii?Q?qx55/P9mt8tsJQHPuWaFNh5JV4eSIr7AOIdPShZV4lOWUrW4Ysf4RT30h6RG?= =?us-ascii?Q?UdLR5xOVHwcPG4lgRm8Q8s6TlHte/piAAp9PKH9ivMj0ZIAotoZ2MsuI9032?= =?us-ascii?Q?WfBmvpjplu2XHv1ili7iUnMk?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR11MB4491.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: b6b85537-1a85-452f-96f4-08d9833dbf64 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Sep 2021 11:39:07.5560 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: jPAaudYsnGGNTj13jr41NziJRRFBdfmXYBefQHp9o9DtWqnYHgrQMAnlGZQU+04xgwpKYaTwbkgp7YMWy4EutwtjxS7FRIgGyW1W9lvkjCw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB4106 X-OriginatorOrg: intel.com Subject: Re: [dpdk-dev] [PATCH v2 1/3] security: add SA config option for inner pkt csum X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Hi Anoob, > Hi Konstanin, >=20 > Please see inline. >=20 > Thanks, > Anoob >=20 > > -----Original Message----- > > From: Ananyev, Konstantin > > Sent: Wednesday, September 29, 2021 4:26 PM > > To: Archana Muniganti ; Akhil Goyal > > ; Nicolau, Radu ; Zhang, Ro= y > > Fan ; hemant.agrawal@nxp.com > > Cc: Anoob Joseph ; Tejasree Kondoj > > ; Ankur Dwivedi ; Jerin Ja= cob > > Kollanukkaran ; dev@dpdk.org > > Subject: [EXT] RE: [PATCH v2 1/3] security: add SA config option for in= ner pkt > > csum > > > > External Email > > > > ---------------------------------------------------------------------- > > > Add inner packet IPv4 hdr and L4 checksum enable options in conf. > > > These will be used in case of protocol offload. > > > Per SA, application could specify whether the > > > checksum(compute/verify) can be offloaded to security device. > > > > > > Signed-off-by: Archana Muniganti > > > --- > > > doc/guides/cryptodevs/features/default.ini | 1 + > > > doc/guides/rel_notes/deprecation.rst | 4 ++-- > > > doc/guides/rel_notes/release_21_11.rst | 4 ++++ > > > lib/cryptodev/rte_cryptodev.h | 2 ++ > > > lib/security/rte_security.h | 18 ++++++++++++++++++ > > > 5 files changed, 27 insertions(+), 2 deletions(-) > > > > > > diff --git a/doc/guides/cryptodevs/features/default.ini > > > b/doc/guides/cryptodevs/features/default.ini > > > index c24814de98..96d95ddc81 100644 > > > --- a/doc/guides/cryptodevs/features/default.ini > > > +++ b/doc/guides/cryptodevs/features/default.ini > > > @@ -33,6 +33,7 @@ Non-Byte aligned data =3D Sym raw data path API = =3D > > > Cipher multiple data units =3D > > > Cipher wrapped key =3D > > > +Inner checksum =3D > > > > > > ; > > > ; Supported crypto algorithms of a default crypto driver. > > > diff --git a/doc/guides/rel_notes/deprecation.rst > > > b/doc/guides/rel_notes/deprecation.rst > > > index 05fc2fdee7..8308e00ed4 100644 > > > --- a/doc/guides/rel_notes/deprecation.rst > > > +++ b/doc/guides/rel_notes/deprecation.rst > > > @@ -232,8 +232,8 @@ Deprecation Notices > > > IPsec payload MSS (Maximum Segment Size), and ESN (Extended Sequen= ce > > Number). > > > > > > * security: The IPsec SA config options ``struct > > > rte_security_ipsec_sa_options`` > > > - will be updated with new fields to support new features like IPsec > > > inner > > > - checksum, TSO in case of protocol offload. > > > + will be updated with new fields to support new features like TSO i= n > > > + case of protocol offload. > > > > > > * ipsec: The structure ``rte_ipsec_sa_prm`` will be extended with a = new field > > > ``hdr_l3_len`` to configure tunnel L3 header length. > > > diff --git a/doc/guides/rel_notes/release_21_11.rst > > > b/doc/guides/rel_notes/release_21_11.rst > > > index 8da851cccc..93d1b36889 100644 > > > --- a/doc/guides/rel_notes/release_21_11.rst > > > +++ b/doc/guides/rel_notes/release_21_11.rst > > > @@ -194,6 +194,10 @@ ABI Changes > > > ``rte_security_ipsec_xform`` to allow applications to configure SA= soft > > > and hard expiry limits. Limits can be either in number of packets = or bytes. > > > > > > +* security: The new options ``ip_csum_enable`` and ``l4_csum_enable`= ` > > > +were added > > > + in structure ``rte_security_ipsec_sa_options`` to indicate whether > > > +inner > > > + packet IPv4 header checksum and L4 checksum need to be offloaded t= o > > > + security device. > > > > > > Known Issues > > > ------------ > > > diff --git a/lib/cryptodev/rte_cryptodev.h > > > b/lib/cryptodev/rte_cryptodev.h index bb01f0f195..d9271a6c45 100644 > > > --- a/lib/cryptodev/rte_cryptodev.h > > > +++ b/lib/cryptodev/rte_cryptodev.h > > > @@ -479,6 +479,8 @@ rte_cryptodev_asym_get_xform_enum(enum > > > rte_crypto_asym_xform_type *xform_enum, /**< Support operations on > > multiple data-units message */ > > > #define RTE_CRYPTODEV_FF_CIPHER_WRAPPED_KEY (1ULL << 26) > > > /**< Support wrapped key in cipher xform */ > > > +#define RTE_CRYPTODEV_FF_SECURITY_INNER_CSUM (1ULL > > << 27) > > > +/**< Support inner checksum computation/verification */ > > > > > > /** > > > * Get the name of a crypto device feature flag diff --git > > > a/lib/security/rte_security.h b/lib/security/rte_security.h index > > > ab1a6e1f65..945f45ad76 100644 > > > --- a/lib/security/rte_security.h > > > +++ b/lib/security/rte_security.h > > > @@ -230,6 +230,24 @@ struct rte_security_ipsec_sa_options { > > > * * 0: Do not match UDP ports > > > */ > > > uint32_t udp_ports_verify : 1; > > > + > > > + /** Compute/verify inner packet IPv4 header checksum in tunnel mode > > > + * > > > + * * 1: For outbound, compute inner packet IPv4 header checksum > > > + * before tunnel encapsulation and for inbound, verify after > > > + * tunnel decapsulation. > > > + * * 0: Inner packet IP header checksum is not computed/verified. > > > + */ > > > + uint32_t ip_csum_enable : 1; > > > + > > > + /** Compute/verify inner packet L4 checksum in tunnel mode > > > + * > > > + * * 1: For outbound, compute inner packet L4 checksum before > > > + * tunnel encapsulation and for inbound, verify after > > > + * tunnel decapsulation. > > > + * * 0: Inner packet L4 checksum is not computed/verified. > > > + */ > > > + uint32_t l4_csum_enable : 1; > > > > As I understand these 2 new flags serve two purposes: > > 1. report HW/PMD ability to perform these offloads. > > 2. allow user to enable/disable this offload on SA basis. >=20 > [Anoob] Correct >=20 > > > > One question I have - how it will work on data-path? > > Would decision to perform these offloads be based on mbuf->ol_flags val= ue > > (same as we doing for ethdev TX offloads)? > > Or some other approach is implied? >=20 > [Anoob] There will be two settings. It can enabled per SA or enabled per = packet. Ok, will it be documented somewhere? Or probably it already is, and I just missed/forgot it somehow? > > > > > }; > > > > > > /** IPSec security association direction */ > > > -- > > > 2.22.0