[dpdk-dev] [PATCH 0/2] net/ice: support FDIR ESP and NATT to match outer IP

[dpdk-dev] [PATCH 0/2] net/ice: support FDIR ESP and NATT to match outer IP

[Simei Su]

[PATCH 1/2] enable FDIR ESP for matching outer IPV4/IPV6 SRC/DST field.
[PATCH 2/2] add IPV4/IPV6 SRC/DST input set for ESP/NAT_T_ESP.

Simei Su (2):
  net/ice/base: support FDIR ESP for outer IP match
  net/ice: support FDIR ESP and NATT to match outer IP

 drivers/net/ice/base/ice_fdir.c   |  8 +++++
 drivers/net/ice/ice_fdir_filter.c | 73 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 81 insertions(+)

-- 
2.9.5

[dpdk-dev] [PATCH 1/2] net/ice/base: support FDIR ESP for outer IP match

[Simei Su]

Enable FDIR ESP for matching outer IPV4/IPV6 SRC/DST field.

Signed-off-by: Simei Su <simei.su@intel.com>
---
 drivers/net/ice/base/ice_fdir.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/ice/base/ice_fdir.c b/drivers/net/ice/base/ice_fdir.c
index 1805082..926f9c5 100644
--- a/drivers/net/ice/base/ice_fdir.c
+++ b/drivers/net/ice/base/ice_fdir.c
@@ -1733,10 +1733,18 @@ ice_fdir_get_gen_prgm_pkt(struct ice_hw *hw, struct ice_fdir_fltr *input,
 				   input->l2tpv3_data.session_id);
 		break;
 	case ICE_FLTR_PTYPE_NONF_IPV4_ESP:
+		ice_pkt_insert_u32(loc, ICE_IPV4_DST_ADDR_OFFSET,
+				   input->ip.v4.src_ip);
+		ice_pkt_insert_u32(loc, ICE_IPV4_SRC_ADDR_OFFSET,
+				   input->ip.v4.dst_ip);
 		ice_pkt_insert_u32(loc, ICE_IPV4_ESP_SPI_OFFSET,
 				   input->ip.v4.sec_parm_idx);
 		break;
 	case ICE_FLTR_PTYPE_NONF_IPV6_ESP:
+		ice_pkt_insert_ipv6_addr(loc, ICE_IPV6_DST_ADDR_OFFSET,
+					 input->ip.v6.src_ip);
+		ice_pkt_insert_ipv6_addr(loc, ICE_IPV6_SRC_ADDR_OFFSET,
+					 input->ip.v6.dst_ip);
 		ice_pkt_insert_u32(loc, ICE_IPV6_ESP_SPI_OFFSET,
 				   input->ip.v6.sec_parm_idx);
 		break;
-- 
2.9.5

[dpdk-dev] [PATCH 2/2] net/ice: support FDIR ESP and NATT to match outer IP

[Simei Su]

This patch adds IPV4/IPV6 SRC/DST input set for ESP/NAT_T_ESP to
support outer IP match.

Signed-off-by: Simei Su <simei.su@intel.com>
---
 drivers/net/ice/ice_fdir_filter.c | 73 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)

diff --git a/drivers/net/ice/ice_fdir_filter.c b/drivers/net/ice/ice_fdir_filter.c
index 092c704..8afe65a 100644
--- a/drivers/net/ice/ice_fdir_filter.c
+++ b/drivers/net/ice/ice_fdir_filter.c
@@ -90,6 +90,22 @@
 	ICE_INSET_IPV6_SRC | ICE_INSET_IPV6_DST | \
 	ICE_INSET_GTPU_TEID | ICE_INSET_GTPU_QFI)
 
+#define ICE_FDIR_INSET_IPV4_ESP (\
+	ICE_INSET_IPV4_SRC | ICE_INSET_IPV4_DST | \
+	ICE_INSET_ESP_SPI)
+
+#define ICE_FDIR_INSET_IPV6_ESP (\
+	ICE_INSET_IPV6_SRC | ICE_INSET_IPV6_DST | \
+	ICE_INSET_ESP_SPI)
+
+#define ICE_FDIR_INSET_IPV4_NATT_ESP (\
+	ICE_INSET_IPV4_SRC | ICE_INSET_IPV4_DST | \
+	ICE_INSET_ESP_SPI)
+
+#define ICE_FDIR_INSET_IPV6_NATT_ESP (\
+	ICE_INSET_IPV6_SRC | ICE_INSET_IPV6_DST | \
+	ICE_INSET_ESP_SPI)
+
 static struct ice_pattern_match_item ice_fdir_pattern_list[] = {
 	{pattern_ethertype,				ICE_FDIR_INSET_ETH,		ICE_INSET_NONE,			ICE_INSET_NONE},
 	{pattern_eth_ipv4,				ICE_FDIR_INSET_ETH_IPV4,	ICE_INSET_NONE,			ICE_INSET_NONE},
@@ -101,6 +117,10 @@ static struct ice_pattern_match_item ice_fdir_pattern_list[] = {
 	{pattern_eth_ipv6_udp,				ICE_FDIR_INSET_ETH_IPV6_UDP,	ICE_INSET_NONE,			ICE_INSET_NONE},
 	{pattern_eth_ipv6_tcp,				ICE_FDIR_INSET_ETH_IPV6_TCP,	ICE_INSET_NONE,			ICE_INSET_NONE},
 	{pattern_eth_ipv6_sctp,				ICE_FDIR_INSET_ETH_IPV6_SCTP,	ICE_INSET_NONE,			ICE_INSET_NONE},
+	{pattern_eth_ipv4_esp,				ICE_FDIR_INSET_IPV4_ESP,	ICE_INSET_NONE,			ICE_INSET_NONE},
+	{pattern_eth_ipv4_udp_esp,			ICE_FDIR_INSET_IPV4_NATT_ESP,	ICE_INSET_NONE,			ICE_INSET_NONE},
+	{pattern_eth_ipv6_esp,				ICE_FDIR_INSET_IPV6_ESP,	ICE_INSET_NONE,			ICE_INSET_NONE},
+	{pattern_eth_ipv6_udp_esp,			ICE_FDIR_INSET_IPV6_NATT_ESP,	ICE_INSET_NONE,			ICE_INSET_NONE},
 	{pattern_eth_ipv4_udp_vxlan_ipv4,		ICE_FDIR_INSET_ETH_IPV4_VXLAN,	ICE_FDIR_INSET_IPV4,		ICE_INSET_NONE},
 	{pattern_eth_ipv4_udp_vxlan_ipv4_udp,		ICE_FDIR_INSET_ETH_IPV4_VXLAN,	ICE_FDIR_INSET_IPV4_UDP,	ICE_INSET_NONE},
 	{pattern_eth_ipv4_udp_vxlan_ipv4_tcp,		ICE_FDIR_INSET_ETH_IPV4_VXLAN,	ICE_FDIR_INSET_IPV4_TCP,	ICE_INSET_NONE},
@@ -999,6 +1019,26 @@ ice_fdir_input_set_hdrs(enum ice_fltr_ptype flow, struct ice_flow_seg_info *seg)
 	case ICE_FLTR_PTYPE_NON_IP_L2:
 		ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_ETH_NON_IP);
 		break;
+	case ICE_FLTR_PTYPE_NONF_IPV4_ESP:
+		ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_ESP |
+				  ICE_FLOW_SEG_HDR_IPV4 |
+				  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
+	case ICE_FLTR_PTYPE_NONF_IPV6_ESP:
+		ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_ESP |
+				  ICE_FLOW_SEG_HDR_IPV6 |
+				  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
+	case ICE_FLTR_PTYPE_NONF_IPV4_NAT_T_ESP:
+		ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_NAT_T_ESP |
+				  ICE_FLOW_SEG_HDR_IPV4 |
+				  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
+	case ICE_FLTR_PTYPE_NONF_IPV6_NAT_T_ESP:
+		ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_NAT_T_ESP |
+				  ICE_FLOW_SEG_HDR_IPV6 |
+				  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
 	default:
 		PMD_DRV_LOG(ERR, "not supported filter type.");
 		break;
@@ -1610,6 +1650,7 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 	const struct rte_flow_item *item = pattern;
 	enum rte_flow_item_type item_type;
 	enum rte_flow_item_type l3 = RTE_FLOW_ITEM_TYPE_END;
+	enum rte_flow_item_type l4 = RTE_FLOW_ITEM_TYPE_END;
 	enum ice_fdir_tunnel_type tunnel_type = ICE_FDIR_TUNNEL_TYPE_NONE;
 	const struct rte_flow_item_eth *eth_spec, *eth_mask;
 	const struct rte_flow_item_ipv4 *ipv4_spec, *ipv4_last, *ipv4_mask;
@@ -1622,6 +1663,7 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 	const struct rte_flow_item_vxlan *vxlan_spec, *vxlan_mask;
 	const struct rte_flow_item_gtp *gtp_spec, *gtp_mask;
 	const struct rte_flow_item_gtp_psc *gtp_psc_spec, *gtp_psc_mask;
+	const struct rte_flow_item_esp *esp_spec, *esp_mask;
 	uint64_t input_set_i = ICE_INSET_NONE; /* only for tunnel inner */
 	uint64_t input_set_o = ICE_INSET_NONE; /* non-tunnel and tunnel outer */
 	uint64_t *input_set;
@@ -1915,6 +1957,7 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 			}
 			break;
 		case RTE_FLOW_ITEM_TYPE_UDP:
+			l4 = RTE_FLOW_ITEM_TYPE_UDP;
 			if (l3 == RTE_FLOW_ITEM_TYPE_IPV4)
 				flow_type = ICE_FLTR_PTYPE_NONF_IPV4_UDP;
 			if (l3 == RTE_FLOW_ITEM_TYPE_IPV6)
@@ -2052,6 +2095,36 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 			filter->input.gtpu_data.qfi =
 				gtp_psc_spec->qfi;
 			break;
+		case RTE_FLOW_ITEM_TYPE_ESP:
+			if (l3 == RTE_FLOW_ITEM_TYPE_IPV4 &&
+			    l4 == RTE_FLOW_ITEM_TYPE_UDP)
+				flow_type = ICE_FLTR_PTYPE_NONF_IPV4_NAT_T_ESP;
+			else if (l3 == RTE_FLOW_ITEM_TYPE_IPV6 &&
+				 l4 == RTE_FLOW_ITEM_TYPE_UDP)
+				flow_type = ICE_FLTR_PTYPE_NONF_IPV6_NAT_T_ESP;
+			else if (l3 == RTE_FLOW_ITEM_TYPE_IPV4 &&
+				 l4 == RTE_FLOW_ITEM_TYPE_END)
+				flow_type = ICE_FLTR_PTYPE_NONF_IPV4_ESP;
+			else if (l3 == RTE_FLOW_ITEM_TYPE_IPV6 &&
+				 l4 == RTE_FLOW_ITEM_TYPE_END)
+				flow_type = ICE_FLTR_PTYPE_NONF_IPV6_ESP;
+
+			esp_spec = item->spec;
+			esp_mask = item->mask;
+
+			if (!(esp_spec && esp_mask))
+				break;
+
+			if (esp_mask->hdr.spi == UINT32_MAX)
+				*input_set |= ICE_INSET_ESP_SPI;
+
+			if (l3 == RTE_FLOW_ITEM_TYPE_IPV4)
+				filter->input.ip.v4.sec_parm_idx =
+					esp_spec->hdr.spi;
+			else if (l3 == RTE_FLOW_ITEM_TYPE_IPV6)
+				filter->input.ip.v6.sec_parm_idx =
+					esp_spec->hdr.spi;
+			break;
 		default:
 			rte_flow_error_set(error, EINVAL,
 					   RTE_FLOW_ERROR_TYPE_ITEM,
-- 
2.9.5

[dpdk-dev] [PATCH v2 0/3] net/ice: support FDIR ESP and NATT to match outer IP

[Simei Su]

[PATCH v2 1/3] enable FDIR ESP to match outer IPV4/IPV6 SRC/DST field in DPDK AVF.
[PATCH v2 2/3] add IPV4/IPV6 SRC/DST input set for ESP/NAT_T_ESP in share code.
[PATCH v2 3/3] enable FDIR ESP/NAT_T_ESP match outer IPV4/IPV6 SRC/DST field in DPDK PF.

v2:
* Combine patch for "FDIR ESP support in DPDK AVF" with this patchset.

Simei Su (3):
  net/iavf: add FDIR ESP support to match outer IP
  net/ice/base: support FDIR ESP for outer IP match
  net/ice: support FDIR ESP and NATT to match outer IP

 drivers/net/iavf/iavf_fdir.c      | 11 ++++--
 drivers/net/ice/base/ice_fdir.c   |  8 +++++
 drivers/net/ice/ice_fdir_filter.c | 73 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 89 insertions(+), 3 deletions(-)

-- 
2.9.5

[dpdk-dev] [PATCH v2 1/3] net/iavf: add FDIR ESP support to match outer IP

[Simei Su]

This patch adds IPV4/IPV6 SRC/DST input set for ESP to support
outer IP match.

Signed-off-by: Simei Su <simei.su@intel.com>
---
 drivers/net/iavf/iavf_fdir.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/net/iavf/iavf_fdir.c b/drivers/net/iavf/iavf_fdir.c
index f238a83..43460e4 100644
--- a/drivers/net/iavf/iavf_fdir.c
+++ b/drivers/net/iavf/iavf_fdir.c
@@ -119,7 +119,12 @@
 #define IAVF_FDIR_INSET_L2TPV3OIP (\
 	IAVF_L2TPV3OIP_SESSION_ID)
 
-#define IAVF_FDIR_INSET_ESP (\
+#define IAVF_FDIR_INSET_IPV4_ESP (\
+	IAVF_INSET_IPV4_SRC | IAVF_INSET_IPV4_DST | \
+	IAVF_INSET_ESP_SPI)
+
+#define IAVF_FDIR_INSET_IPV6_ESP (\
+	IAVF_INSET_IPV6_SRC | IAVF_INSET_IPV6_DST | \
 	IAVF_INSET_ESP_SPI)
 
 #define IAVF_FDIR_INSET_AH (\
@@ -168,8 +173,8 @@ static struct iavf_pattern_match_item iavf_fdir_pattern[] = {
 	{iavf_pattern_eth_ipv6_gtpu_eh,		 IAVF_FDIR_INSET_IPV6_GTPU_EH,	IAVF_INSET_NONE},
 	{iavf_pattern_eth_ipv4_l2tpv3,		 IAVF_FDIR_INSET_L2TPV3OIP,	IAVF_INSET_NONE},
 	{iavf_pattern_eth_ipv6_l2tpv3,		 IAVF_FDIR_INSET_L2TPV3OIP,	IAVF_INSET_NONE},
-	{iavf_pattern_eth_ipv4_esp,		 IAVF_FDIR_INSET_ESP,		IAVF_INSET_NONE},
-	{iavf_pattern_eth_ipv6_esp,		 IAVF_FDIR_INSET_ESP,		IAVF_INSET_NONE},
+	{iavf_pattern_eth_ipv4_esp,		 IAVF_FDIR_INSET_IPV4_ESP,	IAVF_INSET_NONE},
+	{iavf_pattern_eth_ipv6_esp,		 IAVF_FDIR_INSET_IPV6_ESP,	IAVF_INSET_NONE},
 	{iavf_pattern_eth_ipv4_ah,		 IAVF_FDIR_INSET_AH,		IAVF_INSET_NONE},
 	{iavf_pattern_eth_ipv6_ah,		 IAVF_FDIR_INSET_AH,		IAVF_INSET_NONE},
 	{iavf_pattern_eth_ipv4_udp_esp,		 IAVF_FDIR_INSET_IPV4_NATT_ESP,	IAVF_INSET_NONE},
-- 
2.9.5

[dpdk-dev] [PATCH v2 2/3] net/ice/base: support FDIR ESP for outer IP match

[Simei Su]

Enable FDIR ESP for matching outer IPV4/IPV6 SRC/DST field.

Signed-off-by: Simei Su <simei.su@intel.com>
---
 drivers/net/ice/base/ice_fdir.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/ice/base/ice_fdir.c b/drivers/net/ice/base/ice_fdir.c
index 1805082..926f9c5 100644
--- a/drivers/net/ice/base/ice_fdir.c
+++ b/drivers/net/ice/base/ice_fdir.c
@@ -1733,10 +1733,18 @@ ice_fdir_get_gen_prgm_pkt(struct ice_hw *hw, struct ice_fdir_fltr *input,
 				   input->l2tpv3_data.session_id);
 		break;
 	case ICE_FLTR_PTYPE_NONF_IPV4_ESP:
+		ice_pkt_insert_u32(loc, ICE_IPV4_DST_ADDR_OFFSET,
+				   input->ip.v4.src_ip);
+		ice_pkt_insert_u32(loc, ICE_IPV4_SRC_ADDR_OFFSET,
+				   input->ip.v4.dst_ip);
 		ice_pkt_insert_u32(loc, ICE_IPV4_ESP_SPI_OFFSET,
 				   input->ip.v4.sec_parm_idx);
 		break;
 	case ICE_FLTR_PTYPE_NONF_IPV6_ESP:
+		ice_pkt_insert_ipv6_addr(loc, ICE_IPV6_DST_ADDR_OFFSET,
+					 input->ip.v6.src_ip);
+		ice_pkt_insert_ipv6_addr(loc, ICE_IPV6_SRC_ADDR_OFFSET,
+					 input->ip.v6.dst_ip);
 		ice_pkt_insert_u32(loc, ICE_IPV6_ESP_SPI_OFFSET,
 				   input->ip.v6.sec_parm_idx);
 		break;
-- 
2.9.5

[dpdk-dev] [PATCH v2 3/3] net/ice: support FDIR ESP and NATT to match outer IP

[Simei Su]

This patch adds IPV4/IPV6 SRC/DST input set for ESP/NAT_T_ESP to
support outer IP match.

Signed-off-by: Simei Su <simei.su@intel.com>
---
 drivers/net/ice/ice_fdir_filter.c | 73 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)

diff --git a/drivers/net/ice/ice_fdir_filter.c b/drivers/net/ice/ice_fdir_filter.c
index 0577907..a1d602a 100644
--- a/drivers/net/ice/ice_fdir_filter.c
+++ b/drivers/net/ice/ice_fdir_filter.c
@@ -90,6 +90,22 @@
 	ICE_INSET_IPV6_SRC | ICE_INSET_IPV6_DST | \
 	ICE_INSET_GTPU_TEID | ICE_INSET_GTPU_QFI)
 
+#define ICE_FDIR_INSET_IPV4_ESP (\
+	ICE_INSET_IPV4_SRC | ICE_INSET_IPV4_DST | \
+	ICE_INSET_ESP_SPI)
+
+#define ICE_FDIR_INSET_IPV6_ESP (\
+	ICE_INSET_IPV6_SRC | ICE_INSET_IPV6_DST | \
+	ICE_INSET_ESP_SPI)
+
+#define ICE_FDIR_INSET_IPV4_NATT_ESP (\
+	ICE_INSET_IPV4_SRC | ICE_INSET_IPV4_DST | \
+	ICE_INSET_ESP_SPI)
+
+#define ICE_FDIR_INSET_IPV6_NATT_ESP (\
+	ICE_INSET_IPV6_SRC | ICE_INSET_IPV6_DST | \
+	ICE_INSET_ESP_SPI)
+
 static struct ice_pattern_match_item ice_fdir_pattern_list[] = {
 	{pattern_ethertype,				ICE_FDIR_INSET_ETH,		ICE_INSET_NONE,			ICE_INSET_NONE},
 	{pattern_eth_ipv4,				ICE_FDIR_INSET_ETH_IPV4,	ICE_INSET_NONE,			ICE_INSET_NONE},
@@ -101,6 +117,10 @@ static struct ice_pattern_match_item ice_fdir_pattern_list[] = {
 	{pattern_eth_ipv6_udp,				ICE_FDIR_INSET_ETH_IPV6_UDP,	ICE_INSET_NONE,			ICE_INSET_NONE},
 	{pattern_eth_ipv6_tcp,				ICE_FDIR_INSET_ETH_IPV6_TCP,	ICE_INSET_NONE,			ICE_INSET_NONE},
 	{pattern_eth_ipv6_sctp,				ICE_FDIR_INSET_ETH_IPV6_SCTP,	ICE_INSET_NONE,			ICE_INSET_NONE},
+	{pattern_eth_ipv4_esp,				ICE_FDIR_INSET_IPV4_ESP,	ICE_INSET_NONE,			ICE_INSET_NONE},
+	{pattern_eth_ipv4_udp_esp,			ICE_FDIR_INSET_IPV4_NATT_ESP,	ICE_INSET_NONE,			ICE_INSET_NONE},
+	{pattern_eth_ipv6_esp,				ICE_FDIR_INSET_IPV6_ESP,	ICE_INSET_NONE,			ICE_INSET_NONE},
+	{pattern_eth_ipv6_udp_esp,			ICE_FDIR_INSET_IPV6_NATT_ESP,	ICE_INSET_NONE,			ICE_INSET_NONE},
 	{pattern_eth_ipv4_udp_vxlan_ipv4,		ICE_FDIR_INSET_ETH_IPV4_VXLAN,	ICE_FDIR_INSET_IPV4,		ICE_INSET_NONE},
 	{pattern_eth_ipv4_udp_vxlan_ipv4_udp,		ICE_FDIR_INSET_ETH_IPV4_VXLAN,	ICE_FDIR_INSET_IPV4_UDP,	ICE_INSET_NONE},
 	{pattern_eth_ipv4_udp_vxlan_ipv4_tcp,		ICE_FDIR_INSET_ETH_IPV4_VXLAN,	ICE_FDIR_INSET_IPV4_TCP,	ICE_INSET_NONE},
@@ -999,6 +1019,26 @@ ice_fdir_input_set_hdrs(enum ice_fltr_ptype flow, struct ice_flow_seg_info *seg)
 	case ICE_FLTR_PTYPE_NON_IP_L2:
 		ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_ETH_NON_IP);
 		break;
+	case ICE_FLTR_PTYPE_NONF_IPV4_ESP:
+		ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_ESP |
+				  ICE_FLOW_SEG_HDR_IPV4 |
+				  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
+	case ICE_FLTR_PTYPE_NONF_IPV6_ESP:
+		ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_ESP |
+				  ICE_FLOW_SEG_HDR_IPV6 |
+				  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
+	case ICE_FLTR_PTYPE_NONF_IPV4_NAT_T_ESP:
+		ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_NAT_T_ESP |
+				  ICE_FLOW_SEG_HDR_IPV4 |
+				  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
+	case ICE_FLTR_PTYPE_NONF_IPV6_NAT_T_ESP:
+		ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_NAT_T_ESP |
+				  ICE_FLOW_SEG_HDR_IPV6 |
+				  ICE_FLOW_SEG_HDR_IPV_OTHER);
+		break;
 	default:
 		PMD_DRV_LOG(ERR, "not supported filter type.");
 		break;
@@ -1610,6 +1650,7 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 	const struct rte_flow_item *item = pattern;
 	enum rte_flow_item_type item_type;
 	enum rte_flow_item_type l3 = RTE_FLOW_ITEM_TYPE_END;
+	enum rte_flow_item_type l4 = RTE_FLOW_ITEM_TYPE_END;
 	enum ice_fdir_tunnel_type tunnel_type = ICE_FDIR_TUNNEL_TYPE_NONE;
 	const struct rte_flow_item_eth *eth_spec, *eth_mask;
 	const struct rte_flow_item_ipv4 *ipv4_spec, *ipv4_last, *ipv4_mask;
@@ -1622,6 +1663,7 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 	const struct rte_flow_item_vxlan *vxlan_spec, *vxlan_mask;
 	const struct rte_flow_item_gtp *gtp_spec, *gtp_mask;
 	const struct rte_flow_item_gtp_psc *gtp_psc_spec, *gtp_psc_mask;
+	const struct rte_flow_item_esp *esp_spec, *esp_mask;
 	uint64_t input_set_i = ICE_INSET_NONE; /* only for tunnel inner */
 	uint64_t input_set_o = ICE_INSET_NONE; /* non-tunnel and tunnel outer */
 	uint64_t *input_set;
@@ -1916,6 +1958,7 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 			}
 			break;
 		case RTE_FLOW_ITEM_TYPE_UDP:
+			l4 = RTE_FLOW_ITEM_TYPE_UDP;
 			if (l3 == RTE_FLOW_ITEM_TYPE_IPV4)
 				flow_type = ICE_FLTR_PTYPE_NONF_IPV4_UDP;
 			if (l3 == RTE_FLOW_ITEM_TYPE_IPV6)
@@ -2053,6 +2096,36 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 			filter->input.gtpu_data.qfi =
 				gtp_psc_spec->qfi;
 			break;
+		case RTE_FLOW_ITEM_TYPE_ESP:
+			if (l3 == RTE_FLOW_ITEM_TYPE_IPV4 &&
+			    l4 == RTE_FLOW_ITEM_TYPE_UDP)
+				flow_type = ICE_FLTR_PTYPE_NONF_IPV4_NAT_T_ESP;
+			else if (l3 == RTE_FLOW_ITEM_TYPE_IPV6 &&
+				 l4 == RTE_FLOW_ITEM_TYPE_UDP)
+				flow_type = ICE_FLTR_PTYPE_NONF_IPV6_NAT_T_ESP;
+			else if (l3 == RTE_FLOW_ITEM_TYPE_IPV4 &&
+				 l4 == RTE_FLOW_ITEM_TYPE_END)
+				flow_type = ICE_FLTR_PTYPE_NONF_IPV4_ESP;
+			else if (l3 == RTE_FLOW_ITEM_TYPE_IPV6 &&
+				 l4 == RTE_FLOW_ITEM_TYPE_END)
+				flow_type = ICE_FLTR_PTYPE_NONF_IPV6_ESP;
+
+			esp_spec = item->spec;
+			esp_mask = item->mask;
+
+			if (!(esp_spec && esp_mask))
+				break;
+
+			if (esp_mask->hdr.spi == UINT32_MAX)
+				*input_set |= ICE_INSET_ESP_SPI;
+
+			if (l3 == RTE_FLOW_ITEM_TYPE_IPV4)
+				filter->input.ip.v4.sec_parm_idx =
+					esp_spec->hdr.spi;
+			else if (l3 == RTE_FLOW_ITEM_TYPE_IPV6)
+				filter->input.ip.v6.sec_parm_idx =
+					esp_spec->hdr.spi;
+			break;
 		default:
 			rte_flow_error_set(error, EINVAL,
 					   RTE_FLOW_ERROR_TYPE_ITEM,
-- 
2.9.5

Re: [dpdk-dev] [PATCH v2 0/3] net/ice: support FDIR ESP and NATT to match outer IP

[Zhang, Qi Z]

> -----Original Message-----
> From: Su, Simei <simei.su@intel.com>
> Sent: Wednesday, June 9, 2021 10:50 AM
> To: Zhang, Qi Z <qi.z.zhang@intel.com>
> Cc: dev@dpdk.org; Guo, Junfeng <junfeng.guo@intel.com>; Cao, Yahui
> <yahui.cao@intel.com>; Su, Simei <simei.su@intel.com>
> Subject: [PATCH v2 0/3] net/ice: support FDIR ESP and NATT to match outer IP
> 
> [PATCH v2 1/3] enable FDIR ESP to match outer IPV4/IPV6 SRC/DST field in
> DPDK AVF.
> [PATCH v2 2/3] add IPV4/IPV6 SRC/DST input set for ESP/NAT_T_ESP in share
> code.
> [PATCH v2 3/3] enable FDIR ESP/NAT_T_ESP match outer IPV4/IPV6 SRC/DST
> field in DPDK PF.
> 
> v2:
> * Combine patch for "FDIR ESP support in DPDK AVF" with this patchset.
> 
> Simei Su (3):
>   net/iavf: add FDIR ESP support to match outer IP
>   net/ice/base: support FDIR ESP for outer IP match
>   net/ice: support FDIR ESP and NATT to match outer IP
> 
>  drivers/net/iavf/iavf_fdir.c      | 11 ++++--
>  drivers/net/ice/base/ice_fdir.c   |  8 +++++
>  drivers/net/ice/ice_fdir_filter.c | 73
> +++++++++++++++++++++++++++++++++++++++
>  3 files changed, 89 insertions(+), 3 deletions(-)
> 
> --
> 2.9.5

Acked-by: Qi Zhang <qi.z.zhang@intel.com>

Applied to dpdk-next-net-intel.

Thanks
Qi