[PATCH 0/3] flexible IPv4 fragment action

[PATCH 0/3] flexible IPv4 fragment action

[Mingjin Ye]

Support for distributing the first and other segments of an IPv4
segmented packet to different RX queues.

Mingjin Ye (3):
  net/ice/base: add ipv4 fragment related field
  net/ice: FDIR support IPv4 fragment masks
  net/ice: ACL filter support for IPv4 fragment

 drivers/net/ice/base/ice_fdir.h    |  2 +
 drivers/net/ice/base/ice_flow.c    |  5 +++
 drivers/net/ice/base/ice_flow.h    |  1 +
 drivers/net/ice/ice_acl_filter.c   | 61 +++++++++++++++++++++++++++---
 drivers/net/ice/ice_ethdev.c       |  1 -
 drivers/net/ice/ice_fdir_filter.c  | 15 ++++++--
 drivers/net/ice/ice_generic_flow.h |  2 +
 7 files changed, 77 insertions(+), 10 deletions(-)

-- 
2.25.1

[PATCH 1/3] net/ice/base: add ipv4 fragment related field

[Mingjin Ye]

Added support for the Flags and Fragment Offset fields of ipv4 fragments.

Field definitions are the same as in rte_ipv4_hdr.

Signed-off-by: Mingjin Ye <mingjinx.ye@intel.com>
---
 drivers/net/ice/base/ice_fdir.h | 2 ++
 drivers/net/ice/base/ice_flow.c | 5 +++++
 drivers/net/ice/base/ice_flow.h | 1 +
 3 files changed, 8 insertions(+)

diff --git a/drivers/net/ice/base/ice_fdir.h b/drivers/net/ice/base/ice_fdir.h
index 1bb8a14a5d..3461f8dfba 100644
--- a/drivers/net/ice/base/ice_fdir.h
+++ b/drivers/net/ice/base/ice_fdir.h
@@ -56,6 +56,7 @@
 #define ICE_IPV4_TOS_OFFSET		15
 #define ICE_IPV4_ID_OFFSET		18
 #define ICE_IPV4_TTL_OFFSET		22
+#define ICE_IPV4_FRAGMENT_OFFSET	20
 #define ICE_IPV6_TC_OFFSET		14
 #define ICE_IPV6_HLIM_OFFSET		21
 #define ICE_IPV6_PROTO_OFFSET		20
@@ -181,6 +182,7 @@ struct ice_fdir_v4 {
 	u8 proto;
 	u8 ttl;
 	__be16 packet_id;
+	__be16 fragment_offset;
 };
 
 #define ICE_IPV6_ADDR_LEN_AS_U32		4
diff --git a/drivers/net/ice/base/ice_flow.c b/drivers/net/ice/base/ice_flow.c
index 0d64a5bb1e..60d640a26f 100644
--- a/drivers/net/ice/base/ice_flow.c
+++ b/drivers/net/ice/base/ice_flow.c
@@ -21,6 +21,7 @@
 #define ICE_FLOW_FLD_SZ_SCTP_CHKSUM	4
 #define ICE_FLOW_FLD_SZ_IP_DSCP		1
 #define ICE_FLOW_FLD_SZ_IP_TTL		1
+#define ICE_FLOW_FLD_SZ_IP_FLAGS	2
 #define ICE_FLOW_FLD_SZ_IP_PROT		1
 #define ICE_FLOW_FLD_SZ_PORT		2
 #define ICE_FLOW_FLD_SZ_TCP_FLAGS	1
@@ -87,6 +88,9 @@ struct ice_flow_field_info ice_flds_info[ICE_FLOW_FIELD_IDX_MAX] = {
 	/* ICE_FLOW_FIELD_IDX_IPV4_TTL */
 	ICE_FLOW_FLD_INFO_MSK(ICE_FLOW_SEG_HDR_NONE, 8,
 			      ICE_FLOW_FLD_SZ_IP_TTL, 0xff00),
+	/* ICE_FLOW_FIELD_IDX_IPV4_OFFSET */
+	ICE_FLOW_FLD_INFO_MSK(ICE_FLOW_SEG_HDR_IPV_FRAG, 6,
+			      ICE_FLOW_FLD_SZ_IP_FLAGS, 0x3fff),
 	/* ICE_FLOW_FIELD_IDX_IPV4_PROT */
 	ICE_FLOW_FLD_INFO_MSK(ICE_FLOW_SEG_HDR_NONE, 8,
 			      ICE_FLOW_FLD_SZ_IP_PROT, 0x00ff),
@@ -1459,6 +1463,7 @@ ice_flow_xtract_fld(struct ice_hw *hw, struct ice_flow_prof_params *params,
 			prot_id = ICE_PROT_IPV4_IL_IL;
 		break;
 	case ICE_FLOW_FIELD_IDX_IPV4_ID:
+	case ICE_FLOW_FIELD_IDX_IPV4_OFFSET:
 		prot_id = ICE_PROT_IPV4_OF_OR_S;
 		break;
 	case ICE_FLOW_FIELD_IDX_IPV6_SA:
diff --git a/drivers/net/ice/base/ice_flow.h b/drivers/net/ice/base/ice_flow.h
index 65b261beca..a87c0e4567 100644
--- a/drivers/net/ice/base/ice_flow.h
+++ b/drivers/net/ice/base/ice_flow.h
@@ -239,6 +239,7 @@ enum ice_flow_field {
 	ICE_FLOW_FIELD_IDX_IPV4_DSCP,
 	ICE_FLOW_FIELD_IDX_IPV6_DSCP,
 	ICE_FLOW_FIELD_IDX_IPV4_TTL,
+	ICE_FLOW_FIELD_IDX_IPV4_OFFSET,
 	ICE_FLOW_FIELD_IDX_IPV4_PROT,
 	ICE_FLOW_FIELD_IDX_IPV6_TTL,
 	ICE_FLOW_FIELD_IDX_IPV6_PROT,
-- 
2.25.1

[PATCH 2/3] net/ice: FDIR support IPv4 fragment masks

[Mingjin Ye]

This patch supports enabling masks for IPv4 fragments in FDIR.

Flow rule can be created by the following command:
   flow create 0 ingress group 2 pattern eth /
   ipv4 fragment_offset spec 0x2000 fragment_offset mask 0x3FFF /
   end <actions>

Signed-off-by: Mingjin Ye <mingjinx.ye@intel.com>
---
 drivers/net/ice/ice_fdir_filter.c  | 15 +++++++++++----
 drivers/net/ice/ice_generic_flow.h |  2 ++
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ice/ice_fdir_filter.c b/drivers/net/ice/ice_fdir_filter.c
index 406918fed5..247f55118a 100644
--- a/drivers/net/ice/ice_fdir_filter.c
+++ b/drivers/net/ice/ice_fdir_filter.c
@@ -24,7 +24,8 @@
 #define ICE_FDIR_INSET_ETH_IPV4 (\
 	ICE_FDIR_INSET_ETH | \
 	ICE_INSET_IPV4_SRC | ICE_INSET_IPV4_DST | ICE_INSET_IPV4_TOS | \
-	ICE_INSET_IPV4_TTL | ICE_INSET_IPV4_PROTO | ICE_INSET_IPV4_PKID)
+	ICE_INSET_IPV4_TTL | ICE_INSET_IPV4_PROTO | ICE_INSET_IPV4_PKID | \
+	ICE_INSET_IPV4_OFFSET)
 
 #define ICE_FDIR_INSET_ETH_IPV4_UDP (\
 	ICE_FDIR_INSET_ETH_IPV4 | \
@@ -930,6 +931,7 @@ ice_fdir_input_set_parse(uint64_t inset, enum ice_flow_field *field)
 		{ICE_INSET_IPV4_TTL, ICE_FLOW_FIELD_IDX_IPV4_TTL},
 		{ICE_INSET_IPV4_PROTO, ICE_FLOW_FIELD_IDX_IPV4_PROT},
 		{ICE_INSET_IPV4_PKID, ICE_FLOW_FIELD_IDX_IPV4_ID},
+		{ICE_INSET_IPV4_OFFSET, ICE_FLOW_FIELD_IDX_IPV4_OFFSET},
 		{ICE_INSET_IPV6_SRC, ICE_FLOW_FIELD_IDX_IPV6_SA},
 		{ICE_INSET_IPV6_DST, ICE_FLOW_FIELD_IDX_IPV6_DA},
 		{ICE_INSET_IPV6_TC, ICE_FLOW_FIELD_IDX_IPV6_DSCP},
@@ -2022,7 +2024,8 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 			     ipv4_last->hdr.next_proto_id ||
 			     ipv4_last->hdr.hdr_checksum ||
 			     ipv4_last->hdr.src_addr ||
-			     ipv4_last->hdr.dst_addr)) {
+			     ipv4_last->hdr.dst_addr ||
+			     ipv4_last->hdr.fragment_offset)) {
 				rte_flow_error_set(error, EINVAL,
 						   RTE_FLOW_ERROR_TYPE_ITEM,
 						   item, "Invalid IPv4 last.");
@@ -2047,19 +2050,23 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 				*input_set |= ICE_INSET_IPV4_PROTO;
 			if (ipv4_mask->hdr.type_of_service == UINT8_MAX)
 				*input_set |= ICE_INSET_IPV4_TOS;
+			if ((ipv4_mask->hdr.fragment_offset &
+				rte_cpu_to_be_16(0x1FFF)) != 0)
+				*input_set |= ICE_INSET_IPV4_OFFSET;
 
 			p_v4->dst_ip = ipv4_spec->hdr.dst_addr;
 			p_v4->src_ip = ipv4_spec->hdr.src_addr;
 			p_v4->ttl = ipv4_spec->hdr.time_to_live;
 			p_v4->proto = ipv4_spec->hdr.next_proto_id;
 			p_v4->tos = ipv4_spec->hdr.type_of_service;
+			p_v4->fragment_offset = ipv4_spec->hdr.fragment_offset;
 
 			/* fragment Ipv4:
 			 * spec is 0x2000, mask is 0x2000
 			 */
-			if (ipv4_spec->hdr.fragment_offset ==
+			if (ipv4_spec->hdr.fragment_offset &
 			    rte_cpu_to_be_16(RTE_IPV4_HDR_MF_FLAG) &&
-			    ipv4_mask->hdr.fragment_offset ==
+			    ipv4_mask->hdr.fragment_offset &
 			    rte_cpu_to_be_16(RTE_IPV4_HDR_MF_FLAG)) {
 				/* all IPv4 fragment packet has the same
 				 * ethertype, if the spec and mask is valid,
diff --git a/drivers/net/ice/ice_generic_flow.h b/drivers/net/ice/ice_generic_flow.h
index 391d615b9a..509eb4b705 100644
--- a/drivers/net/ice/ice_generic_flow.h
+++ b/drivers/net/ice/ice_generic_flow.h
@@ -54,6 +54,7 @@
 #define ICE_PFCP_SEID			BIT_ULL(42)
 #define ICE_PFCP_S_FIELD		BIT_ULL(41)
 #define ICE_IP_PK_ID		    BIT_ULL(40)
+#define ICE_IP_OFFSET			BIT_ULL(39)
 
 /* input set */
 
@@ -72,6 +73,7 @@
 #define ICE_INSET_IPV4_PROTO		(ICE_PROT_IPV4 | ICE_IP_PROTO)
 #define ICE_INSET_IPV4_TTL		(ICE_PROT_IPV4 | ICE_IP_TTL)
 #define ICE_INSET_IPV4_PKID		(ICE_PROT_IPV4 | ICE_IP_PK_ID)
+#define ICE_INSET_IPV4_OFFSET	(ICE_PROT_IPV4 | ICE_IP_OFFSET)
 #define ICE_INSET_IPV6_SRC		(ICE_PROT_IPV6 | ICE_IP_SRC)
 #define ICE_INSET_IPV6_DST		(ICE_PROT_IPV6 | ICE_IP_DST)
 #define ICE_INSET_IPV6_NEXT_HDR		(ICE_PROT_IPV6 | ICE_IP_PROTO)
-- 
2.25.1

[PATCH 3/3] net/ice: ACL filter support for IPv4 fragment

[Mingjin Ye]

Enable ACL filter on PF. Add support for FRAG_IPV4 pattern and queue
action.

Flow rule can be created by the following command:
   flow create 0 ingress group 1 pattern eth /
   ipv4 fragment_offset spec 0x2000 fragment_offset mask 0x3FFF /
   end actions queue index <queue id> / end

Signed-off-by: Mingjin Ye <mingjinx.ye@intel.com>
---
 drivers/net/ice/ice_acl_filter.c | 61 +++++++++++++++++++++++++++++---
 drivers/net/ice/ice_ethdev.c     |  1 -
 2 files changed, 56 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ice/ice_acl_filter.c b/drivers/net/ice/ice_acl_filter.c
index 63a525b363..df2cc01b2d 100644
--- a/drivers/net/ice/ice_acl_filter.c
+++ b/drivers/net/ice/ice_acl_filter.c
@@ -30,7 +30,8 @@
 
 #define ICE_ACL_INSET_ETH_IPV4 ( \
 	ICE_INSET_SMAC | ICE_INSET_DMAC | \
-	ICE_INSET_IPV4_SRC | ICE_INSET_IPV4_DST)
+	ICE_INSET_IPV4_SRC | ICE_INSET_IPV4_DST | \
+	ICE_INSET_IPV4_OFFSET)
 #define ICE_ACL_INSET_ETH_IPV4_UDP ( \
 	ICE_ACL_INSET_ETH_IPV4 | \
 	ICE_INSET_UDP_SRC_PORT | ICE_INSET_UDP_DST_PORT)
@@ -214,6 +215,7 @@ ice_acl_prof_init(struct ice_pf *pf)
 {
 	struct ice_hw *hw = ICE_PF_TO_HW(pf);
 	struct ice_flow_prof *prof_ipv4 = NULL;
+	struct ice_flow_prof *prof_ipv4_frag = NULL;
 	struct ice_flow_prof *prof_ipv4_udp = NULL;
 	struct ice_flow_prof *prof_ipv4_tcp = NULL;
 	struct ice_flow_prof *prof_ipv4_sctp = NULL;
@@ -234,6 +236,15 @@ ice_acl_prof_init(struct ice_pf *pf)
 	if (ret)
 		goto err_add_prof;
 
+	ice_memset(seg, 0, sizeof(*seg), ICE_NONDMA_MEM);
+	ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_IPV_FRAG);
+	acl_add_prof_prepare(hw, seg, false, 0, 0);
+	ret = ice_flow_add_prof(hw, ICE_BLK_ACL, ICE_FLOW_RX,
+				ICE_FLTR_PTYPE_FRAG_IPV4,
+				seg, 1, NULL, 0, &prof_ipv4_frag);
+	if (ret)
+		goto err_add_prof_ipv4_udp_frag;
+
 	ice_memset(seg, 0, sizeof(*seg), ICE_NONDMA_MEM);
 	ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_UDP | ICE_FLOW_SEG_HDR_IPV4);
 	acl_add_prof_prepare(hw, seg, true,
@@ -272,6 +283,10 @@ ice_acl_prof_init(struct ice_pf *pf)
 		if (ret)
 			goto err_assoc_prof;
 
+		ret = ice_flow_assoc_prof(hw, ICE_BLK_ACL, prof_ipv4_frag, i);
+		if (ret)
+			goto err_assoc_prof;
+
 		ret = ice_flow_assoc_prof(hw, ICE_BLK_ACL, prof_ipv4_udp, i);
 		if (ret)
 			goto err_assoc_prof;
@@ -293,6 +308,8 @@ ice_acl_prof_init(struct ice_pf *pf)
 err_add_prof_ipv4_tcp:
 	ice_flow_rem_prof(hw, ICE_BLK_ACL, ICE_FLTR_PTYPE_NONF_IPV4_UDP);
 err_add_prof_ipv4_udp:
+	ice_flow_rem_prof(hw, ICE_BLK_ACL, ICE_FLTR_PTYPE_FRAG_IPV4);
+err_add_prof_ipv4_udp_frag:
 	ice_flow_rem_prof(hw, ICE_BLK_ACL, ICE_FLTR_PTYPE_NONF_IPV4_OTHER);
 err_add_prof:
 	ice_free(hw, seg);
@@ -353,6 +370,7 @@ ice_acl_set_input_set(struct ice_acl_conf *filter, struct ice_fdir_fltr *input)
 			   ICE_NONDMA_TO_NONDMA);
 
 		break;
+	case ICE_FLTR_PTYPE_FRAG_IPV4:
 	case ICE_FLTR_PTYPE_NONF_IPV4_OTHER:
 		ice_memcpy(&input->ip.v4, &filter->input.ip.v4,
 			   sizeof(struct ice_fdir_v4),
@@ -519,6 +537,12 @@ ice_acl_create_filter(struct ice_adapter *ad,
 		acts[0].data.acl_act.mdid = ICE_MDID_RX_PKT_DROP;
 		acts[0].data.acl_act.prio = 0x3;
 		acts[0].data.acl_act.value = CPU_TO_LE16(0x1);
+	} else if (filter->input.dest_ctl ==
+		ICE_FLTR_PRGM_DESC_DEST_DIRECT_PKT_QINDEX) {
+		acts[0].type = ICE_FLOW_ACT_FWD_QUEUE;
+		acts[0].data.acl_act.mdid = ICE_MDID_RX_DST_Q;
+		acts[0].data.acl_act.prio = 0x3;
+		acts[0].data.acl_act.value = CPU_TO_LE16(input->q_index);
 	}
 
 	input->acl_fltr = true;
@@ -531,7 +555,8 @@ ice_acl_create_filter(struct ice_adapter *ad,
 		return ret;
 	}
 
-	if (flow_type == ICE_FLTR_PTYPE_NONF_IPV4_OTHER) {
+	if (flow_type == ICE_FLTR_PTYPE_NONF_IPV4_OTHER ||
+		flow_type == ICE_FLTR_PTYPE_FRAG_IPV4) {
 		ret = ice_acl_hw_set_conf(pf, input, acts, rule,
 					  ICE_FLTR_PTYPE_NONF_IPV4_UDP, 1);
 		if (ret)
@@ -576,6 +601,7 @@ ice_acl_destroy_filter(struct ice_adapter *ad,
 	int ret = 0;
 
 	switch (rule->flow_type) {
+	case ICE_FLTR_PTYPE_FRAG_IPV4:
 	case ICE_FLTR_PTYPE_NONF_IPV4_OTHER:
 		for (i = 0; i < 4; i++) {
 			entry_id = rule->entry_id[i];
@@ -617,6 +643,8 @@ ice_acl_parse_action(__rte_unused struct ice_adapter *ad,
 		     struct rte_flow_error *error,
 		     struct ice_acl_conf *filter)
 {
+	struct ice_pf *pf = &ad->pf;
+	const struct rte_flow_action_queue *act_q;
 	uint32_t dest_num = 0;
 
 	for (; actions->type != RTE_FLOW_ACTION_TYPE_END; actions++) {
@@ -629,6 +657,22 @@ ice_acl_parse_action(__rte_unused struct ice_adapter *ad,
 			filter->input.dest_ctl =
 				ICE_FLTR_PRGM_DESC_DEST_DROP_PKT;
 			break;
+		case RTE_FLOW_ACTION_TYPE_QUEUE:
+			dest_num++;
+
+			act_q = actions->conf;
+			filter->input.q_index = act_q->index;
+			if (filter->input.q_index >=
+					pf->dev_data->nb_rx_queues) {
+				rte_flow_error_set(error, EINVAL,
+						   RTE_FLOW_ERROR_TYPE_ACTION,
+						   actions,
+						   "Invalid queue for FDIR.");
+				return -rte_errno;
+			}
+			filter->input.dest_ctl =
+				ICE_FLTR_PRGM_DESC_DEST_DIRECT_PKT_QINDEX;
+			break;
 		default:
 			rte_flow_error_set(error, EINVAL,
 				   RTE_FLOW_ERROR_TYPE_ACTION, actions,
@@ -713,12 +757,12 @@ ice_acl_parse_pattern(__rte_unused struct ice_adapter *ad,
 			ipv4_spec = item->spec;
 			ipv4_mask = item->mask;
 
+			flow_type = ICE_FLTR_PTYPE_NONF_IPV4_OTHER;
 			if (ipv4_spec && ipv4_mask) {
 				/* Check IPv4 mask and update input set */
 				if (ipv4_mask->hdr.version_ihl ||
 				    ipv4_mask->hdr.total_length ||
 				    ipv4_mask->hdr.packet_id ||
-				    ipv4_mask->hdr.fragment_offset ||
 				    ipv4_mask->hdr.hdr_checksum) {
 					rte_flow_error_set(error, EINVAL,
 						RTE_FLOW_ERROR_TYPE_ITEM,
@@ -753,9 +797,16 @@ ice_acl_parse_pattern(__rte_unused struct ice_adapter *ad,
 
 					input_set |= ICE_INSET_IPV4_DST;
 				}
-			}
 
-			flow_type = ICE_FLTR_PTYPE_NONF_IPV4_OTHER;
+				if (ipv4_mask->hdr.fragment_offset) {
+					filter->input.ip.v4.fragment_offset =
+						ipv4_spec->hdr.fragment_offset;
+					filter->input.mask.v4.fragment_offset =
+						ipv4_mask->hdr.fragment_offset;
+					flow_type = ICE_FLTR_PTYPE_FRAG_IPV4;
+					input_set |= ICE_INSET_IPV4_OFFSET;
+				}
+			}
 			break;
 		case RTE_FLOW_ITEM_TYPE_TCP:
 			tcp_spec = item->spec;
diff --git a/drivers/net/ice/ice_ethdev.c b/drivers/net/ice/ice_ethdev.c
index 93a6308a86..a57bcaf36e 100644
--- a/drivers/net/ice/ice_ethdev.c
+++ b/drivers/net/ice/ice_ethdev.c
@@ -2684,7 +2684,6 @@ ice_dev_init(struct rte_eth_dev *dev)
 	}
 
 	if (!ad->is_safe_mode) {
-		ad->disabled_engine_mask |= BIT(ICE_FLOW_ENGINE_ACL);
 		ret = ice_flow_init(ad);
 		if (ret) {
 			PMD_INIT_LOG(ERR, "Failed to initialize flow");
-- 
2.25.1

Re: [PATCH 0/3] flexible IPv4 fragment action

[Bruce Richardson]

On Wed, Jan 22, 2025 at 08:23:07AM +0000, Mingjin Ye wrote:
> Support for distributing the first and other segments of an IPv4
> segmented packet to different RX queues.
> 
> Mingjin Ye (3):
>   net/ice/base: add ipv4 fragment related field
>   net/ice: FDIR support IPv4 fragment masks
>   net/ice: ACL filter support for IPv4 fragment
> 
>  drivers/net/ice/base/ice_fdir.h    |  2 +
>  drivers/net/ice/base/ice_flow.c    |  5 +++
>  drivers/net/ice/base/ice_flow.h    |  1 +
>  drivers/net/ice/ice_acl_filter.c   | 61 +++++++++++++++++++++++++++---
>  drivers/net/ice/ice_ethdev.c       |  1 -
>  drivers/net/ice/ice_fdir_filter.c  | 15 ++++++--
>  drivers/net/ice/ice_generic_flow.h |  2 +
>  7 files changed, 77 insertions(+), 10 deletions(-)
> 

This patchset has no documentation updates included in it. Does there not
need to be some documentation for this new feature, or is the ability to
filter segmented packets already covered as a standard flow feature
elsewhere?

/Bruce