ipsec_accel: handle TSO if supported

[kib]

Summary

Allow for TSO to operate if network interface supports ipsec inline
offload and supports TSO over it.

Sponsored by:   NVIDIA networking

[tuexen]

I guess we need also similar tweaks for the RACK stack...
Is there a description available, how this feature can be tested?
Which card is needed for testing? Is something like

mlx5_core0: <mlx5_core> mem 0x14082000000-0x14083ffffff at device 0.0 on pci1
mlx5: Mellanox Core driver 3.7.1 (November 2021)ugen0.1: <Synopsys XHCI root HUB> at usbus0

good enough?

[kib]

The pasted lines do not provide the card model. Perhaps look at the pciconf -vl output for your mce0_core. It might work for Connect-X 6DX, but we practically tested Connect-X 7 only. CX-4 and 5, or smaller 6 do not support the offload.

The way to test is to config IPSEC with supported SA and enable offload, the watch for TSO. E.g. run iperf and see that large plain-text TCP packets seen on Tx, but are segmented and encrypted on wire.

[tuexen]

In D44222#1008887, @kib wrote:

The pasted lines do not provide the card model. Perhaps look at the pciconf -vl output for your mce0_core. It might work for Connect-X 6DX, but we practically tested Connect-X 7 only. CX-4 and 5, or smaller 6 do not support the offload.

mlx5_core0@pci0:1:0:0:	class=0x020000 rev=0x00 hdr=0x00 vendor=0x15b3 device=0x1015 subvendor=0x15b3 subdevice=0x0003
    vendor     = 'Mellanox Technologies'
    device     = 'MT27710 Family [ConnectX-4 Lx]'
    class      = network
    subclass   = ethernet
mlx5_core1@pci0:1:0:1:	class=0x020000 rev=0x00 hdr=0x00 vendor=0x15b3 device=0x1015 subvendor=0x15b3 subdevice=0x0003
    vendor     = 'Mellanox Technologies'
    device     = 'MT27710 Family [ConnectX-4 Lx]'
    class      = network
    subclass   = ethernet

So unfortunately, I'm not able to test.

The way to test is to config IPSEC with supported SA and enable offload, the watch for TSO. E.g. run iperf and see that large plain-text TCP packets seen on Tx, but are segmented and encrypted on wire.

[kib]

Rebase

[rrs]

sys/netinet/tcp_output.c

553–554

Why are we getting rid of the IPSEC/IPSEC_SUPPORT ifdef's?

[kib]

sys/netinet/tcp_output.c

553–554

The new condition to allow (to try enable) TSO on the flow is ipoptlen == ipsec_optlen. I tried to wrap it in the style of existing maze of #ifdef's, but this quickly appeared unmaintainable mess.

I decided that having these two local variables and the better code readability is the better approach to structure the code.

[tuexen]

sys/netinet/tcp_output.c

553–554

So are you proposing to get rid of the #ifdefs in general and always compile IPSEC stuff in?

[kib]

sys/netinet/tcp_output.c

553–554

Where do you see such proposal? Or even a move in this direction?

[tuexen]

sys/netinet/tcp_output.c

553–554

I just wanted to make sure we keep the #ifdef stuff in general and just have an exception here. Thanks for clarifying.

[tuexen]

Can't test it, but it looks OK.

[kib]

rebase