Re: [dpdk-dev] [PATCH v3 5/9] net/i40e: process ESP flows

["Zhang, Qi Z" <qi.z.zhang@intel.com>]

Hi Bernard:

> -----Original Message-----
> From: Iremonger, Bernard <bernard.iremonger@intel.com>
> Sent: Thursday, January 9, 2020 8:17 PM
> To: dev@dpdk.org; Xing, Beilei <beilei.xing@intel.com>; Zhang, Qi Z
> <qi.z.zhang@intel.com>; Doherty, Declan <declan.doherty@intel.com>
> Cc: Ananyev, Konstantin <konstantin.ananyev@intel.com>; Byrne, Stephen1
> <stephen1.byrne@intel.com>; Zhang, Helin <helin.zhang@intel.com>;
> Iremonger, Bernard <bernard.iremonger@intel.com>
> Subject: [PATCH v3 5/9] net/i40e: process ESP flows
> 
> Process ESP flows on Flow Director and RSS.
> 
> add eth/ipv4/esp and eth/ipv6/esp patterns add eth/ipv4/udp/esp and
> eth/ipv6/esp/udp patterns add flow structures for above patterns update
> i40e_flow_parse_fdir_filter() add i40e_flow_set_filter_spi() add fill_ip6_head()
> add oip_type in filter add is_udp in filter use tenant_id in filter for spi handle ESP
> and AH pctypes in ESP-AH profile update customized code for ESP hardcode udp
> destination port to 4500

Looks like the patch could be separate into 3 parts for easy review.

One is for the DDP package process,  (rte_pmd_i40e_process_ddp_package -> i40e_update_customized_info -> i40e_update_customized_pctype
One is for fdir related - training packet construction .. etc.
And one for adding all rte_flow parser

Regards
Qi

> 
> Signed-off-by: Bernard Iremonger <bernard.iremonger@intel.com>
> ---
>  drivers/net/i40e/i40e_ethdev.c |  44 +++++++++++++-
> drivers/net/i40e/i40e_ethdev.h |  38 ++++++++++++
>  drivers/net/i40e/i40e_fdir.c   | 128
> +++++++++++++++++++++++++++++++++++---
>  drivers/net/i40e/i40e_flow.c   | 135
> ++++++++++++++++++++++++++++++++++++++++-
>  4 files changed, 332 insertions(+), 13 deletions(-)
> 
> diff --git a/drivers/net/i40e/i40e_ethdev.c b/drivers/net/i40e/i40e_ethdev.c
> index 5f1cf8a..a462eba 100644
> --- a/drivers/net/i40e/i40e_ethdev.c
> +++ b/drivers/net/i40e/i40e_ethdev.c
> @@ -1106,6 +1106,7 @@ i40e_init_customized_info(struct i40e_pf *pf)
>  	}
> 
>  	pf->gtp_support = false;
> +	pf->esp_support = false;
>  }
> 
>  void
> @@ -12337,6 +12338,7 @@ i40e_update_customized_pctype(struct
> rte_eth_dev *dev, uint8_t *pkg,
>  			}
>  		}
>  		name[strlen(name) - 1] = '\0';
> +		PMD_DRV_LOG(INFO, "name = %s\n", name);
>  		if (!strcmp(name, "GTPC"))
>  			new_pctype =
>  				i40e_find_customized_pctype(pf,
> @@ -12353,6 +12355,30 @@ i40e_update_customized_pctype(struct
> rte_eth_dev *dev, uint8_t *pkg,
>  			new_pctype =
>  				i40e_find_customized_pctype(pf,
>  						      I40E_CUSTOMIZED_GTPU);
> +		else if (!strcmp(name, "IPV4_ESP"))
> +			new_pctype =
> +				i40e_find_customized_pctype(pf,
> +						I40E_CUSTOMIZED_ESP_IPV4);
> +		else if (!strcmp(name, "IPV6_ESP"))
> +			new_pctype =
> +				i40e_find_customized_pctype(pf,
> +						I40E_CUSTOMIZED_ESP_IPV6);
> +		else if (!strcmp(name, "IPV4_UDP_ESP"))
> +			new_pctype =
> +				i40e_find_customized_pctype(pf,
> +						I40E_CUSTOMIZED_ESP_IPV4_UDP);
> +		else if (!strcmp(name, "IPV6_UDP_ESP"))
> +			new_pctype =
> +				i40e_find_customized_pctype(pf,
> +						I40E_CUSTOMIZED_ESP_IPV6_UDP);
> +		else if (!strcmp(name, "IPV4_AH"))
> +			new_pctype =
> +				i40e_find_customized_pctype(pf,
> +						I40E_CUSTOMIZED_AH_IPV4);
> +		else if (!strcmp(name, "IPV6_AH"))
> +			new_pctype =
> +				i40e_find_customized_pctype(pf,
> +						I40E_CUSTOMIZED_AH_IPV6);
>  		if (new_pctype) {
>  			if (op == RTE_PMD_I40E_PKG_OP_WR_ADD) {
>  				new_pctype->pctype = pctype_value;
> @@ -12448,6 +12474,7 @@ i40e_update_customized_ptype(struct
> rte_eth_dev *dev, uint8_t *pkg,
>  					continue;
>  				memset(name, 0, sizeof(name));
>  				strcpy(name, proto[n].name);
> +				PMD_DRV_LOG(INFO, "name = %s\n", name);
>  				if (!strncasecmp(name, "PPPOE", 5))
>  					ptype_mapping[i].sw_ptype |=
>  						RTE_PTYPE_L2_ETHER_PPPOE;
> @@ -12541,6 +12568,10 @@ i40e_update_customized_ptype(struct
> rte_eth_dev *dev, uint8_t *pkg,
>  					ptype_mapping[i].sw_ptype |=
>  						RTE_PTYPE_TUNNEL_GTPU;
>  					in_tunnel = true;
> +				} else if (!strncasecmp(name, "ESP", 3)) {
> +					ptype_mapping[i].sw_ptype |=
> +						RTE_PTYPE_TUNNEL_ESP;
> +					in_tunnel = true;
>  				} else if (!strncasecmp(name, "GRENAT", 6)) {
>  					ptype_mapping[i].sw_ptype |=
>  						RTE_PTYPE_TUNNEL_GRENAT;
> @@ -12560,7 +12591,7 @@ i40e_update_customized_ptype(struct
> rte_eth_dev *dev, uint8_t *pkg,
>  	ret = rte_pmd_i40e_ptype_mapping_update(port_id, ptype_mapping,
>  						ptype_num, 0);
>  	if (ret)
> -		PMD_DRV_LOG(ERR, "Failed to update mapping table.");
> +		PMD_DRV_LOG(ERR, "Failed to update ptype mapping table.");
> 
>  	rte_free(ptype_mapping);
>  	rte_free(ptype);
> @@ -12625,6 +12656,17 @@ i40e_update_customized_info(struct
> rte_eth_dev *dev, uint8_t *pkg,
>  		}
>  	}
> 
> +	/* Check if ESP is supported. */
> +	for (i = 0; i < proto_num; i++) {
> +		if (!strncmp(proto[i].name, "ESP", 3)) {
> +			if (op == RTE_PMD_I40E_PKG_OP_WR_ADD)
> +				pf->esp_support = true;
> +			else
> +				pf->esp_support = false;
> +			break;
> +		}
> +	}
> +
>  	/* Update customized pctype info */
>  	ret = i40e_update_customized_pctype(dev, pkg, pkg_size,
>  					    proto_num, proto, op);
> diff --git a/drivers/net/i40e/i40e_ethdev.h b/drivers/net/i40e/i40e_ethdev.h
> index 295ad59..792a047 100644
> --- a/drivers/net/i40e/i40e_ethdev.h
> +++ b/drivers/net/i40e/i40e_ethdev.h
> @@ -501,6 +501,29 @@ struct i40e_gtp_ipv6_flow {
>  	struct rte_eth_ipv6_flow ip6;
>  };
> 
> +/* A structure used to define the input for ESP IPV4 flow */ struct
> +i40e_esp_ipv4_flow {
> +	struct rte_eth_ipv4_flow ipv4;
> +	uint32_t spi;	/* SPI in big endian. */
> +};
> +
> +/* A structure used to define the input for ESP IPV6 flow */ struct
> +i40e_esp_ipv6_flow {
> +	struct rte_eth_ipv6_flow ipv6;
> +	uint32_t spi;	/* SPI in big endian. */
> +};
> +/* A structure used to define the input for ESP IPV4 UDP flow */ struct
> +i40e_esp_ipv4_udp_flow {
> +	struct rte_eth_udpv4_flow udp;
> +	uint32_t spi;	/* SPI in big endian. */
> +};
> +
> +/* A structure used to define the input for ESP IPV6 UDP flow */ struct
> +i40e_esp_ipv6_udp_flow {
> +	struct rte_eth_udpv6_flow udp;
> +	uint32_t spi;	/* SPI in big endian. */
> +};
> +
>  /* A structure used to define the input for raw type flow */  struct
> i40e_raw_flow {
>  	uint16_t pctype;
> @@ -526,6 +549,10 @@ union i40e_fdir_flow {
>  	struct i40e_gtp_ipv4_flow  gtp_ipv4_flow;
>  	struct i40e_gtp_ipv6_flow  gtp_ipv6_flow;
>  	struct i40e_raw_flow       raw_flow;
> +	struct i40e_esp_ipv4_flow  esp_ipv4_flow;
> +	struct i40e_esp_ipv6_flow  esp_ipv6_flow;
> +	struct i40e_esp_ipv4_udp_flow  esp_ipv4_udp_flow;
> +	struct i40e_esp_ipv6_udp_flow  esp_ipv6_udp_flow;
>  };
> 
>  enum i40e_fdir_ip_type {
> @@ -542,8 +569,10 @@ struct i40e_fdir_flow_ext {
>  	uint16_t dst_id; /* VF ID, available when is_vf is 1*/
>  	bool inner_ip;   /* If there is inner ip */
>  	enum i40e_fdir_ip_type iip_type; /* ip type for inner ip */
> +	enum i40e_fdir_ip_type oip_type; /* ip type for outer ip */
>  	bool customized_pctype; /* If customized pctype is used */
>  	bool pkt_template; /* If raw packet template is used */
> +	bool is_udp; /* ipv4|ipv6 udp flow */
>  };
> 
>  /* A structure used to define the input for a flow director filter entry */ @@
> -769,6 +798,8 @@ enum i40e_tunnel_type {
>  	I40E_TUNNEL_TYPE_QINQ,
>  	I40E_TUNNEL_TYPE_GTPC,
>  	I40E_TUNNEL_TYPE_GTPU,
> +	I40E_TUNNEL_TYPE_ESPoUDP,
> +	I40E_TUNNEL_TYPE_ESPoIP,
>  	I40E_TUNNEL_TYPE_MAX,
>  };
> 
> @@ -897,6 +928,12 @@ enum i40e_new_pctype {
>  	I40E_CUSTOMIZED_GTPU_IPV4,
>  	I40E_CUSTOMIZED_GTPU_IPV6,
>  	I40E_CUSTOMIZED_GTPU,
> +	I40E_CUSTOMIZED_ESP_IPV4,
> +	I40E_CUSTOMIZED_ESP_IPV6,
> +	I40E_CUSTOMIZED_ESP_IPV4_UDP,
> +	I40E_CUSTOMIZED_ESP_IPV6_UDP,
> +	I40E_CUSTOMIZED_AH_IPV4,
> +	I40E_CUSTOMIZED_AH_IPV6,
>  	I40E_CUSTOMIZED_MAX,
>  };
> 
> @@ -1001,6 +1038,7 @@ struct i40e_pf {
> 
>  	/* Dynamic Device Personalization */
>  	bool gtp_support; /* 1 - support GTP-C and GTP-U */
> +	bool esp_support; /* 1 - support ESP SPI */
>  	/* customer customized pctype */
>  	struct i40e_customized_pctype
> customized_pctype[I40E_CUSTOMIZED_MAX];
>  	/* Switch Domain Id */
> diff --git a/drivers/net/i40e/i40e_fdir.c b/drivers/net/i40e/i40e_fdir.c index
> dee007d..3fa6297 100644
> --- a/drivers/net/i40e/i40e_fdir.c
> +++ b/drivers/net/i40e/i40e_fdir.c
> @@ -54,6 +54,8 @@
>  #define I40E_FDIR_GTP_MSG_TYPE_0X01         0x01
>  #define I40E_FDIR_GTP_MSG_TYPE_0XFF         0xFF
> 
> +#define I40E_FDIR_ESP_DST_PORT              4500
> +
>  /* Wait time for fdir filter programming */  #define
> I40E_FDIR_MAX_WAIT_US 10000
> 
> @@ -971,6 +973,37 @@ i40e_flow_fdir_find_customized_pctype(struct
> i40e_pf *pf, uint8_t pctype)  }
> 
>  static inline int
> +fill_ip6_head(const struct i40e_fdir_input *fdir_input, unsigned char
> *raw_pkt,
> +		uint8_t next_proto, uint8_t len, uint16_t *ether_type) {
> +	struct rte_ipv6_hdr *ip6;
> +
> +	ip6 = (struct rte_ipv6_hdr *)raw_pkt;
> +
> +	*ether_type = rte_cpu_to_be_16(RTE_ETHER_TYPE_IPV6);
> +	ip6->vtc_flow = rte_cpu_to_be_32(I40E_FDIR_IPv6_DEFAULT_VTC_FLOW
> |
> +		(fdir_input->flow.ipv6_flow.tc << I40E_FDIR_IPv6_TC_OFFSET));
> +	ip6->payload_len = rte_cpu_to_be_16(I40E_FDIR_IPv6_PAYLOAD_LEN);
> +	ip6->proto = fdir_input->flow.ipv6_flow.proto ?
> +		fdir_input->flow.ipv6_flow.proto : next_proto;
> +	ip6->hop_limits = fdir_input->flow.ipv6_flow.hop_limits ?
> +		fdir_input->flow.ipv6_flow.hop_limits :
> +		I40E_FDIR_IPv6_DEFAULT_HOP_LIMITS;
> +	/**
> +	 * The source and destination fields in the transmitted packet
> +	 * need to be presented in a reversed order with respect
> +	 * to the expected received packets.
> +	 */
> +	rte_memcpy(&ip6->src_addr, &fdir_input->flow.ipv6_flow.dst_ip,
> +		IPV6_ADDR_LEN);
> +	rte_memcpy(&ip6->dst_addr, &fdir_input->flow.ipv6_flow.src_ip,
> +		IPV6_ADDR_LEN);
> +	len += sizeof(struct rte_ipv6_hdr);
> +
> +	return len;
> +}
> +
> +static inline int
>  i40e_flow_fdir_fill_eth_ip_head(struct i40e_pf *pf,
>  				const struct i40e_fdir_input *fdir_input,
>  				unsigned char *raw_pkt,
> @@ -1045,16 +1078,29 @@ i40e_flow_fdir_fill_eth_ip_head(struct i40e_pf
> *pf,
>  		ip->src_addr = fdir_input->flow.ip4_flow.dst_ip;
>  		ip->dst_addr = fdir_input->flow.ip4_flow.src_ip;
> 
> -		if (!is_customized_pctype)
> +		if (!is_customized_pctype) {
>  			ip->next_proto_id = fdir_input->flow.ip4_flow.proto ?
>  				fdir_input->flow.ip4_flow.proto :
>  				next_proto[fdir_input->pctype];
> -		else if (cus_pctype->index == I40E_CUSTOMIZED_GTPC ||
> +			len += sizeof(struct rte_ipv4_hdr);
> +		} else if (cus_pctype->index == I40E_CUSTOMIZED_GTPC ||
>  			 cus_pctype->index == I40E_CUSTOMIZED_GTPU_IPV4 ||
>  			 cus_pctype->index == I40E_CUSTOMIZED_GTPU_IPV6 ||
> -			 cus_pctype->index == I40E_CUSTOMIZED_GTPU)
> +			 cus_pctype->index == I40E_CUSTOMIZED_GTPU) {
>  			ip->next_proto_id = IPPROTO_UDP;
> -		len += sizeof(struct rte_ipv4_hdr);
> +			len += sizeof(struct rte_ipv4_hdr);
> +		} else if (cus_pctype->index == I40E_CUSTOMIZED_ESP_IPV4) {
> +			ip->next_proto_id = IPPROTO_ESP;
> +			len += sizeof(struct rte_ipv4_hdr);
> +		} else if (cus_pctype->index == I40E_CUSTOMIZED_ESP_IPV4_UDP) {
> +			ip->next_proto_id = IPPROTO_UDP;
> +			len += sizeof(struct rte_ipv4_hdr);
> +		} else if (cus_pctype->index == I40E_CUSTOMIZED_ESP_IPV6)
> +			len = fill_ip6_head(fdir_input, raw_pkt, IPPROTO_ESP,
> +					len, ether_type);
> +		else if (cus_pctype->index == I40E_CUSTOMIZED_ESP_IPV6_UDP)
> +			len = fill_ip6_head(fdir_input, raw_pkt, IPPROTO_UDP,
> +					len, ether_type);
>  	} else if (pctype == I40E_FILTER_PCTYPE_NONF_IPV6_TCP ||
>  		   pctype == I40E_FILTER_PCTYPE_NONF_IPV6_UDP ||
>  		   pctype == I40E_FILTER_PCTYPE_NONF_IPV6_SCTP || @@
> -1088,8 +1134,7 @@ i40e_flow_fdir_fill_eth_ip_head(struct i40e_pf *pf,
>  			   IPV6_ADDR_LEN);
>  		len += sizeof(struct rte_ipv6_hdr);
>  	} else {
> -		PMD_DRV_LOG(ERR, "unknown pctype %u.",
> -			    fdir_input->pctype);
> +		PMD_DRV_LOG(ERR, "unknown pctype %u.", fdir_input->pctype);
>  		return -1;
>  	}
> 
> @@ -1115,6 +1160,10 @@ i40e_flow_fdir_construct_pkt(struct i40e_pf *pf,
>  	struct rte_flow_item_gtp *gtp;
>  	struct rte_ipv4_hdr *gtp_ipv4;
>  	struct rte_ipv6_hdr *gtp_ipv6;
> +	struct rte_flow_item_esp *esp;
> +	struct rte_ipv4_hdr *esp_ipv4;
> +	struct rte_ipv6_hdr *esp_ipv6;
> +
>  	uint8_t size, dst = 0;
>  	uint8_t i, pit_idx, set_idx = I40E_FLXPLD_L4_IDX; /* use l4 by default*/
>  	int len;
> @@ -1285,10 +1334,71 @@ i40e_flow_fdir_construct_pkt(struct i40e_pf *pf,
>  			} else
>  				payload = (unsigned char *)gtp +
>  					sizeof(struct rte_flow_item_gtp);
> +		} else if (cus_pctype->index == I40E_CUSTOMIZED_ESP_IPV4 ||
> +			cus_pctype->index == I40E_CUSTOMIZED_ESP_IPV6 ||
> +			cus_pctype->index == I40E_CUSTOMIZED_ESP_IPV4_UDP ||
> +			cus_pctype->index == I40E_CUSTOMIZED_ESP_IPV6_UDP) {
> +			if (cus_pctype->index == I40E_CUSTOMIZED_ESP_IPV4) {
> +				esp_ipv4 = (struct rte_ipv4_hdr *)
> +					(raw_pkt + len);
> +				esp = (struct rte_flow_item_esp *)esp_ipv4;
> +				esp->hdr.spi =
> +					fdir_input->flow.esp_ipv4_flow.spi;
> +				payload = (unsigned char *)esp +
> +					sizeof(struct rte_esp_hdr);
> +				len += sizeof(struct rte_esp_hdr);
> +			} else if (cus_pctype->index ==
> +					I40E_CUSTOMIZED_ESP_IPV4_UDP) {
> +				esp_ipv4 = (struct rte_ipv4_hdr *)
> +					(raw_pkt + len);
> +				udp = (struct rte_udp_hdr *)esp_ipv4;
> +				udp->dst_port = rte_cpu_to_be_16
> +					(I40E_FDIR_ESP_DST_PORT);
> +
> +				udp->dgram_len = rte_cpu_to_be_16
> +						(I40E_FDIR_UDP_DEFAULT_LEN);
> +				esp = (struct rte_flow_item_esp *)
> +					((unsigned char *)esp_ipv4 +
> +						sizeof(struct rte_udp_hdr));
> +				esp->hdr.spi =
> +					fdir_input->flow.esp_ipv4_udp_flow.spi;
> +				payload = (unsigned char *)esp +
> +					sizeof(struct rte_esp_hdr);
> +				len += sizeof(struct rte_udp_hdr) +
> +						sizeof(struct rte_esp_hdr);
> +			} else if (cus_pctype->index ==
> +					I40E_CUSTOMIZED_ESP_IPV6) {
> +				esp_ipv6 = (struct rte_ipv6_hdr *)
> +					(raw_pkt + len);
> +				esp = (struct rte_flow_item_esp *)esp_ipv6;
> +				esp->hdr.spi =
> +					fdir_input->flow.esp_ipv6_flow.spi;
> +				payload = (unsigned char *)esp +
> +					sizeof(struct rte_esp_hdr);
> +				len += sizeof(struct rte_esp_hdr);
> +			} else if (cus_pctype->index ==
> +					I40E_CUSTOMIZED_ESP_IPV6_UDP) {
> +				esp_ipv6 = (struct rte_ipv6_hdr *)
> +					(raw_pkt + len);
> +				udp = (struct rte_udp_hdr *)esp_ipv6;
> +				udp->dst_port =	rte_cpu_to_be_16
> +					(I40E_FDIR_ESP_DST_PORT);
> +
> +				udp->dgram_len = rte_cpu_to_be_16
> +					(I40E_FDIR_UDP_DEFAULT_LEN);
> +				esp = (struct rte_flow_item_esp *)
> +					((unsigned char *)esp_ipv6 +
> +						sizeof(struct rte_udp_hdr));
> +				esp->hdr.spi =
> +					fdir_input->flow.esp_ipv6_udp_flow.spi;
> +				payload = (unsigned char *)esp +
> +					sizeof(struct rte_esp_hdr);
> +				len += sizeof(struct rte_udp_hdr) +
> +						sizeof(struct rte_esp_hdr);
> +			}
>  		}
>  	} else {
> -		PMD_DRV_LOG(ERR, "unknown pctype %u.",
> -			    fdir_input->pctype);
> +		PMD_DRV_LOG(ERR, "unknown pctype %u.", fdir_input->pctype);
>  		return -1;
>  	}
> 
> @@ -1305,7 +1415,7 @@ i40e_flow_fdir_construct_pkt(struct i40e_pf *pf,
>  				 &fdir_input->flow_ext.flexbytes[dst],
>  				 size * sizeof(uint16_t));
>  	}
> -
> +	rte_hexdump(stdout, NULL, raw_pkt, len);
>  	return 0;
>  }
> 
> diff --git a/drivers/net/i40e/i40e_flow.c b/drivers/net/i40e/i40e_flow.c index
> 6102103..c585d8b 100644
> --- a/drivers/net/i40e/i40e_flow.c
> +++ b/drivers/net/i40e/i40e_flow.c
> @@ -110,8 +110,7 @@ static int i40e_flow_destroy_tunnel_filter(struct
> i40e_pf *pf,  static int i40e_flow_flush_fdir_filter(struct i40e_pf *pf);  static
> int i40e_flow_flush_ethertype_filter(struct i40e_pf *pf);  static int
> i40e_flow_flush_tunnel_filter(struct i40e_pf *pf); -static int
> -i40e_flow_flush_rss_filter(struct rte_eth_dev *dev);
> +static int i40e_flow_flush_rss_filter(struct rte_eth_dev *dev);
>  static int
>  i40e_flow_parse_qinq_filter(struct rte_eth_dev *dev,
>  			      const struct rte_flow_attr *attr, @@ -1615,6 +1614,36
> @@ static enum rte_flow_item_type pattern_qinq_1[] = {
>  	RTE_FLOW_ITEM_TYPE_END,
>  };
> 
> +static enum rte_flow_item_type pattern_fdir_ipv4_esp[] = {
> +	RTE_FLOW_ITEM_TYPE_ETH,
> +	RTE_FLOW_ITEM_TYPE_IPV4,
> +	RTE_FLOW_ITEM_TYPE_ESP,
> +	RTE_FLOW_ITEM_TYPE_END,
> +};
> +
> +static enum rte_flow_item_type pattern_fdir_ipv6_esp[] = {
> +	RTE_FLOW_ITEM_TYPE_ETH,
> +	RTE_FLOW_ITEM_TYPE_IPV6,
> +	RTE_FLOW_ITEM_TYPE_ESP,
> +	RTE_FLOW_ITEM_TYPE_END,
> +};
> +
> +static enum rte_flow_item_type pattern_fdir_ipv4_udp_esp[] = {
> +	RTE_FLOW_ITEM_TYPE_ETH,
> +	RTE_FLOW_ITEM_TYPE_IPV4,
> +	RTE_FLOW_ITEM_TYPE_UDP,
> +	RTE_FLOW_ITEM_TYPE_ESP,
> +	RTE_FLOW_ITEM_TYPE_END,
> +};
> +
> +static enum rte_flow_item_type pattern_fdir_ipv6_udp_esp[] = {
> +	RTE_FLOW_ITEM_TYPE_ETH,
> +	RTE_FLOW_ITEM_TYPE_IPV6,
> +	RTE_FLOW_ITEM_TYPE_UDP,
> +	RTE_FLOW_ITEM_TYPE_ESP,
> +	RTE_FLOW_ITEM_TYPE_END,
> +};
> +
>  static struct i40e_valid_pattern i40e_supported_patterns[] = {
>  	/* Ethertype */
>  	{ pattern_ethertype, i40e_flow_parse_ethertype_filter }, @@ -1628,6
> +1657,8 @@ static struct i40e_valid_pattern i40e_supported_patterns[] = {
>  	{ pattern_fdir_ipv4_gtpu, i40e_flow_parse_fdir_filter },
>  	{ pattern_fdir_ipv4_gtpu_ipv4, i40e_flow_parse_fdir_filter },
>  	{ pattern_fdir_ipv4_gtpu_ipv6, i40e_flow_parse_fdir_filter },
> +	{ pattern_fdir_ipv4_esp, i40e_flow_parse_fdir_filter },
> +	{ pattern_fdir_ipv4_udp_esp, i40e_flow_parse_fdir_filter },
>  	{ pattern_fdir_ipv6, i40e_flow_parse_fdir_filter },
>  	{ pattern_fdir_ipv6_udp, i40e_flow_parse_fdir_filter },
>  	{ pattern_fdir_ipv6_tcp, i40e_flow_parse_fdir_filter }, @@ -1636,6
> +1667,8 @@ static struct i40e_valid_pattern i40e_supported_patterns[] = {
>  	{ pattern_fdir_ipv6_gtpu, i40e_flow_parse_fdir_filter },
>  	{ pattern_fdir_ipv6_gtpu_ipv4, i40e_flow_parse_fdir_filter },
>  	{ pattern_fdir_ipv6_gtpu_ipv6, i40e_flow_parse_fdir_filter },
> +	{ pattern_fdir_ipv6_esp, i40e_flow_parse_fdir_filter },
> +	{ pattern_fdir_ipv6_udp_esp, i40e_flow_parse_fdir_filter },
>  	/* FDIR - support default flow type with flexible payload */
>  	{ pattern_fdir_ethertype_raw_1, i40e_flow_parse_fdir_filter },
>  	{ pattern_fdir_ethertype_raw_2, i40e_flow_parse_fdir_filter }, @@
> -2420,6 +2453,28 @@ i40e_flow_fdir_get_pctype_value(struct i40e_pf *pf,
>  			cus_pctype = i40e_find_customized_pctype(pf,
>  						 I40E_CUSTOMIZED_GTPU_IPV6);
>  		break;
> +	case RTE_FLOW_ITEM_TYPE_ESP:
> +		if (!filter->input.flow_ext.is_udp) {
> +			if (filter->input.flow_ext.oip_type ==
> +				I40E_FDIR_IPTYPE_IPV4)
> +				cus_pctype = i40e_find_customized_pctype(pf,
> +						I40E_CUSTOMIZED_ESP_IPV4);
> +			else if (filter->input.flow_ext.oip_type ==
> +				I40E_FDIR_IPTYPE_IPV6)
> +				cus_pctype = i40e_find_customized_pctype(pf,
> +						I40E_CUSTOMIZED_ESP_IPV6);
> +		} else {
> +			if (filter->input.flow_ext.oip_type ==
> +				I40E_FDIR_IPTYPE_IPV4)
> +				cus_pctype = i40e_find_customized_pctype(pf,
> +						I40E_CUSTOMIZED_ESP_IPV4_UDP);
> +			else if (filter->input.flow_ext.oip_type ==
> +					I40E_FDIR_IPTYPE_IPV6)
> +				cus_pctype = i40e_find_customized_pctype(pf,
> +						I40E_CUSTOMIZED_ESP_IPV6_UDP);
> +			filter->input.flow_ext.is_udp = false;
> +		}
> +		break;
>  	default:
>  		PMD_DRV_LOG(ERR, "Unsupported item type");
>  		break;
> @@ -2431,6 +2486,30 @@ i40e_flow_fdir_get_pctype_value(struct i40e_pf
> *pf,
>  	return I40E_FILTER_PCTYPE_INVALID;
>  }
> 
> +static void
> +i40e_flow_set_filter_spi(struct i40e_fdir_filter_conf *filter,
> +	const struct rte_flow_item_esp *esp_spec) {
> +	if (filter->input.flow_ext.oip_type ==
> +		I40E_FDIR_IPTYPE_IPV4) {
> +		if (filter->input.flow_ext.is_udp)
> +			filter->input.flow.esp_ipv4_udp_flow.spi =
> +				esp_spec->hdr.spi;
> +		else
> +			filter->input.flow.esp_ipv4_flow.spi =
> +				esp_spec->hdr.spi;
> +	}
> +	if (filter->input.flow_ext.oip_type ==
> +		I40E_FDIR_IPTYPE_IPV6) {
> +		if (filter->input.flow_ext.is_udp)
> +			filter->input.flow.esp_ipv6_udp_flow.spi =
> +				esp_spec->hdr.spi;
> +		else
> +			filter->input.flow.esp_ipv6_flow.spi =
> +				esp_spec->hdr.spi;
> +	}
> +}
> +
>  /* 1. Last in item should be NULL as range is not supported.
>   * 2. Supported patterns: refer to array i40e_supported_patterns.
>   * 3. Default supported flow type and input set: refer to array @@ -2459,6
> +2538,7 @@ i40e_flow_parse_fdir_pattern(struct rte_eth_dev *dev,
>  	const struct rte_flow_item_udp *udp_spec, *udp_mask;
>  	const struct rte_flow_item_sctp *sctp_spec, *sctp_mask;
>  	const struct rte_flow_item_gtp *gtp_spec, *gtp_mask;
> +	const struct rte_flow_item_esp *esp_spec, *esp_mask;
>  	const struct rte_flow_item_raw *raw_spec, *raw_mask;
>  	const struct rte_flow_item_vf *vf_spec;
> 
> @@ -2654,10 +2734,18 @@ i40e_flow_parse_fdir_pattern(struct rte_eth_dev
> *dev,
>  					ipv4_spec->hdr.src_addr;
>  				filter->input.flow.ip4_flow.dst_ip =
>  					ipv4_spec->hdr.dst_addr;
> +
> +				filter->input.flow_ext.inner_ip = false;
> +				filter->input.flow_ext.oip_type =
> +					I40E_FDIR_IPTYPE_IPV4;
>  			} else if (!ipv4_spec && !ipv4_mask && !outer_ip) {
>  				filter->input.flow_ext.inner_ip = true;
>  				filter->input.flow_ext.iip_type =
>  					I40E_FDIR_IPTYPE_IPV4;
> +			} else if (!ipv4_spec && !ipv4_mask && outer_ip) {
> +				filter->input.flow_ext.inner_ip = false;
> +				filter->input.flow_ext.oip_type =
> +					I40E_FDIR_IPTYPE_IPV4;
>  			} else if ((ipv4_spec || ipv4_mask) && !outer_ip) {
>  				rte_flow_error_set(error, EINVAL,
>  						   RTE_FLOW_ERROR_TYPE_ITEM,
> @@ -2716,6 +2804,10 @@ i40e_flow_parse_fdir_pattern(struct rte_eth_dev
> *dev,
>  				filter->input.flow.ipv6_flow.hop_limits =
>  					ipv6_spec->hdr.hop_limits;
> 
> +				filter->input.flow_ext.inner_ip = false;
> +				filter->input.flow_ext.oip_type =
> +					I40E_FDIR_IPTYPE_IPV6;
> +
>  				rte_memcpy(filter->input.flow.ipv6_flow.src_ip,
>  					   ipv6_spec->hdr.src_addr, 16);
>  				rte_memcpy(filter->input.flow.ipv6_flow.dst_ip,
> @@ -2729,6 +2821,10 @@ i40e_flow_parse_fdir_pattern(struct rte_eth_dev
> *dev,
>  				filter->input.flow_ext.inner_ip = true;
>  				filter->input.flow_ext.iip_type =
>  					I40E_FDIR_IPTYPE_IPV6;
> +			} else if (!ipv6_spec && !ipv6_mask && outer_ip) {
> +				filter->input.flow_ext.inner_ip = false;
> +				filter->input.flow_ext.oip_type =
> +					I40E_FDIR_IPTYPE_IPV6;
>  			} else if ((ipv6_spec || ipv6_mask) && !outer_ip) {
>  				rte_flow_error_set(error, EINVAL,
>  						   RTE_FLOW_ERROR_TYPE_ITEM,
> @@ -2828,7 +2924,7 @@ i40e_flow_parse_fdir_pattern(struct rte_eth_dev
> *dev,
>  						udp_spec->hdr.dst_port;
>  				}
>  			}
> -
> +			filter->input.flow_ext.is_udp = true;
>  			layer_idx = I40E_FLXPLD_L4_IDX;
> 
>  			break;
> @@ -2863,6 +2959,39 @@ i40e_flow_parse_fdir_pattern(struct rte_eth_dev
> *dev,
>  				cus_proto = item_type;
>  			}
>  			break;
> +		case RTE_FLOW_ITEM_TYPE_ESP:
> +			if (!pf->esp_support) {
> +				rte_flow_error_set(error, EINVAL,
> +						   RTE_FLOW_ERROR_TYPE_ITEM,
> +						   item,
> +						   "Unsupported ESP protocol");
> +				return -rte_errno;
> +			}
> +
> +			esp_spec = item->spec;
> +			esp_mask = item->mask;
> +
> +			if (!esp_spec || !esp_mask) {
> +				rte_flow_error_set(error, EINVAL,
> +						   RTE_FLOW_ERROR_TYPE_ITEM,
> +						   item,
> +						   "Invalid ESP item");
> +				return -rte_errno;
> +			}
> +
> +			if (esp_spec && esp_mask) {
> +				if (esp_mask->hdr.spi != UINT32_MAX) {
> +					rte_flow_error_set(error, EINVAL,
> +						   RTE_FLOW_ERROR_TYPE_ITEM,
> +						   item,
> +						   "Invalid ESP mask");
> +					return -rte_errno;
> +				}
> +				i40e_flow_set_filter_spi(filter, esp_spec);
> +				filter->input.flow_ext.customized_pctype = true;
> +				cus_proto = item_type;
> +			}
> +			break;
>  		case RTE_FLOW_ITEM_TYPE_SCTP:
>  			sctp_spec = item->spec;
>  			sctp_mask = item->mask;
> --
> 2.7.4