[PATCH v2 0/3] flexible IPv4 fragment action

[PATCH v2 0/3] flexible IPv4 fragment action

[Mingjin Ye]

Support for distributing the first and other segments of an IPv4
segmented packet to different RX queues.
---
V2: All names standardised to *_IPV4_FRAG_OFS.

Mingjin Ye (3):
  net/ice/base: add ipv4 fragment related field
  net/ice: FDIR support IPv4 fragment masks
  net/ice: ACL filter support for IPv4 fragment

 drivers/net/ice/base/ice_fdir.h    |  2 +
 drivers/net/ice/base/ice_flow.c    |  5 +++
 drivers/net/ice/base/ice_flow.h    |  1 +
 drivers/net/ice/ice_acl_filter.c   | 61 +++++++++++++++++++++++++++---
 drivers/net/ice/ice_ethdev.c       |  1 -
 drivers/net/ice/ice_fdir_filter.c  | 15 ++++++--
 drivers/net/ice/ice_generic_flow.h |  2 +
 7 files changed, 77 insertions(+), 10 deletions(-)

-- 
2.25.1

[PATCH v2 1/3] net/ice/base: add ipv4 fragment related field

[Mingjin Ye]

Added support for the Flags and Fragment Offset fields of ipv4 fragments.

Field definitions are the same as in rte_ipv4_hdr.

Signed-off-by: Mingjin Ye <mingjinx.ye@intel.com>
---
V2: All names standardised to *_IPV4_FRAG_OFS.
---
 drivers/net/ice/base/ice_fdir.h | 2 ++
 drivers/net/ice/base/ice_flow.c | 5 +++++
 drivers/net/ice/base/ice_flow.h | 1 +
 3 files changed, 8 insertions(+)

diff --git a/drivers/net/ice/base/ice_fdir.h b/drivers/net/ice/base/ice_fdir.h
index 1bb8a14a5d..3dd03f93f7 100644
--- a/drivers/net/ice/base/ice_fdir.h
+++ b/drivers/net/ice/base/ice_fdir.h
@@ -56,6 +56,7 @@
 #define ICE_IPV4_TOS_OFFSET		15
 #define ICE_IPV4_ID_OFFSET		18
 #define ICE_IPV4_TTL_OFFSET		22
+#define ICE_IPV4_FRAG_OFS		20
 #define ICE_IPV6_TC_OFFSET		14
 #define ICE_IPV6_HLIM_OFFSET		21
 #define ICE_IPV6_PROTO_OFFSET		20
@@ -181,6 +182,7 @@ struct ice_fdir_v4 {
 	u8 proto;
 	u8 ttl;
 	__be16 packet_id;
+	__be16 fragment_offset;
 };
 
 #define ICE_IPV6_ADDR_LEN_AS_U32		4
diff --git a/drivers/net/ice/base/ice_flow.c b/drivers/net/ice/base/ice_flow.c
index 0d64a5bb1e..cdc9ee26c5 100644
--- a/drivers/net/ice/base/ice_flow.c
+++ b/drivers/net/ice/base/ice_flow.c
@@ -19,6 +19,7 @@
 #define ICE_FLOW_FLD_SZ_TCP_CHKSUM	2
 #define ICE_FLOW_FLD_SZ_UDP_CHKSUM	2
 #define ICE_FLOW_FLD_SZ_SCTP_CHKSUM	4
+#define ICE_FLOW_FLD_SZ_IPV4_FRAG_OFS	2
 #define ICE_FLOW_FLD_SZ_IP_DSCP		1
 #define ICE_FLOW_FLD_SZ_IP_TTL		1
 #define ICE_FLOW_FLD_SZ_IP_PROT		1
@@ -87,6 +88,9 @@ struct ice_flow_field_info ice_flds_info[ICE_FLOW_FIELD_IDX_MAX] = {
 	/* ICE_FLOW_FIELD_IDX_IPV4_TTL */
 	ICE_FLOW_FLD_INFO_MSK(ICE_FLOW_SEG_HDR_NONE, 8,
 			      ICE_FLOW_FLD_SZ_IP_TTL, 0xff00),
+	/* ICE_FLOW_FIELD_IDX_IPV4_FRAG_OFS */
+	ICE_FLOW_FLD_INFO_MSK(ICE_FLOW_SEG_HDR_IPV_FRAG, 6,
+			      ICE_FLOW_FLD_SZ_IPV4_FRAG_OFS, 0x3fff),
 	/* ICE_FLOW_FIELD_IDX_IPV4_PROT */
 	ICE_FLOW_FLD_INFO_MSK(ICE_FLOW_SEG_HDR_NONE, 8,
 			      ICE_FLOW_FLD_SZ_IP_PROT, 0x00ff),
@@ -1459,6 +1463,7 @@ ice_flow_xtract_fld(struct ice_hw *hw, struct ice_flow_prof_params *params,
 			prot_id = ICE_PROT_IPV4_IL_IL;
 		break;
 	case ICE_FLOW_FIELD_IDX_IPV4_ID:
+	case ICE_FLOW_FIELD_IDX_IPV4_FRAG_OFS:
 		prot_id = ICE_PROT_IPV4_OF_OR_S;
 		break;
 	case ICE_FLOW_FIELD_IDX_IPV6_SA:
diff --git a/drivers/net/ice/base/ice_flow.h b/drivers/net/ice/base/ice_flow.h
index 65b261beca..6cbddef8c8 100644
--- a/drivers/net/ice/base/ice_flow.h
+++ b/drivers/net/ice/base/ice_flow.h
@@ -239,6 +239,7 @@ enum ice_flow_field {
 	ICE_FLOW_FIELD_IDX_IPV4_DSCP,
 	ICE_FLOW_FIELD_IDX_IPV6_DSCP,
 	ICE_FLOW_FIELD_IDX_IPV4_TTL,
+	ICE_FLOW_FIELD_IDX_IPV4_FRAG_OFS,
 	ICE_FLOW_FIELD_IDX_IPV4_PROT,
 	ICE_FLOW_FIELD_IDX_IPV6_TTL,
 	ICE_FLOW_FIELD_IDX_IPV6_PROT,
-- 
2.25.1

[PATCH v2 2/3] net/ice: FDIR support IPv4 fragment masks

[Mingjin Ye]

This patch supports enabling masks for IPv4 fragments in FDIR.

Flow rule can be created by the following command:
   flow create 0 ingress group 2 pattern eth /
   ipv4 fragment_offset spec 0x2000 fragment_offset mask 0x3FFF /
   end <actions>

Signed-off-by: Mingjin Ye <mingjinx.ye@intel.com>
---
 drivers/net/ice/ice_fdir_filter.c  | 15 +++++++++++----
 drivers/net/ice/ice_generic_flow.h |  2 ++
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ice/ice_fdir_filter.c b/drivers/net/ice/ice_fdir_filter.c
index 406918fed5..940fe171b6 100644
--- a/drivers/net/ice/ice_fdir_filter.c
+++ b/drivers/net/ice/ice_fdir_filter.c
@@ -24,7 +24,8 @@
 #define ICE_FDIR_INSET_ETH_IPV4 (\
 	ICE_FDIR_INSET_ETH | \
 	ICE_INSET_IPV4_SRC | ICE_INSET_IPV4_DST | ICE_INSET_IPV4_TOS | \
-	ICE_INSET_IPV4_TTL | ICE_INSET_IPV4_PROTO | ICE_INSET_IPV4_PKID)
+	ICE_INSET_IPV4_TTL | ICE_INSET_IPV4_PROTO | ICE_INSET_IPV4_PKID | \
+	ICE_INSET_IPV4_FRAG_OFS)
 
 #define ICE_FDIR_INSET_ETH_IPV4_UDP (\
 	ICE_FDIR_INSET_ETH_IPV4 | \
@@ -930,6 +931,7 @@ ice_fdir_input_set_parse(uint64_t inset, enum ice_flow_field *field)
 		{ICE_INSET_IPV4_TTL, ICE_FLOW_FIELD_IDX_IPV4_TTL},
 		{ICE_INSET_IPV4_PROTO, ICE_FLOW_FIELD_IDX_IPV4_PROT},
 		{ICE_INSET_IPV4_PKID, ICE_FLOW_FIELD_IDX_IPV4_ID},
+		{ICE_INSET_IPV4_FRAG_OFS, ICE_FLOW_FIELD_IDX_IPV4_FRAG_OFS},
 		{ICE_INSET_IPV6_SRC, ICE_FLOW_FIELD_IDX_IPV6_SA},
 		{ICE_INSET_IPV6_DST, ICE_FLOW_FIELD_IDX_IPV6_DA},
 		{ICE_INSET_IPV6_TC, ICE_FLOW_FIELD_IDX_IPV6_DSCP},
@@ -2022,7 +2024,8 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 			     ipv4_last->hdr.next_proto_id ||
 			     ipv4_last->hdr.hdr_checksum ||
 			     ipv4_last->hdr.src_addr ||
-			     ipv4_last->hdr.dst_addr)) {
+			     ipv4_last->hdr.dst_addr ||
+			     ipv4_last->hdr.fragment_offset)) {
 				rte_flow_error_set(error, EINVAL,
 						   RTE_FLOW_ERROR_TYPE_ITEM,
 						   item, "Invalid IPv4 last.");
@@ -2047,19 +2050,23 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
 				*input_set |= ICE_INSET_IPV4_PROTO;
 			if (ipv4_mask->hdr.type_of_service == UINT8_MAX)
 				*input_set |= ICE_INSET_IPV4_TOS;
+			if ((ipv4_mask->hdr.fragment_offset &
+				rte_cpu_to_be_16(0x1FFF)) != 0)
+				*input_set |= ICE_INSET_IPV4_FRAG_OFS;
 
 			p_v4->dst_ip = ipv4_spec->hdr.dst_addr;
 			p_v4->src_ip = ipv4_spec->hdr.src_addr;
 			p_v4->ttl = ipv4_spec->hdr.time_to_live;
 			p_v4->proto = ipv4_spec->hdr.next_proto_id;
 			p_v4->tos = ipv4_spec->hdr.type_of_service;
+			p_v4->fragment_offset = ipv4_spec->hdr.fragment_offset;
 
 			/* fragment Ipv4:
 			 * spec is 0x2000, mask is 0x2000
 			 */
-			if (ipv4_spec->hdr.fragment_offset ==
+			if (ipv4_spec->hdr.fragment_offset &
 			    rte_cpu_to_be_16(RTE_IPV4_HDR_MF_FLAG) &&
-			    ipv4_mask->hdr.fragment_offset ==
+			    ipv4_mask->hdr.fragment_offset &
 			    rte_cpu_to_be_16(RTE_IPV4_HDR_MF_FLAG)) {
 				/* all IPv4 fragment packet has the same
 				 * ethertype, if the spec and mask is valid,
diff --git a/drivers/net/ice/ice_generic_flow.h b/drivers/net/ice/ice_generic_flow.h
index 391d615b9a..54bbb47398 100644
--- a/drivers/net/ice/ice_generic_flow.h
+++ b/drivers/net/ice/ice_generic_flow.h
@@ -54,6 +54,7 @@
 #define ICE_PFCP_SEID			BIT_ULL(42)
 #define ICE_PFCP_S_FIELD		BIT_ULL(41)
 #define ICE_IP_PK_ID		    BIT_ULL(40)
+#define ICE_IP_FRAG_OFS			BIT_ULL(39)
 
 /* input set */
 
@@ -72,6 +73,7 @@
 #define ICE_INSET_IPV4_PROTO		(ICE_PROT_IPV4 | ICE_IP_PROTO)
 #define ICE_INSET_IPV4_TTL		(ICE_PROT_IPV4 | ICE_IP_TTL)
 #define ICE_INSET_IPV4_PKID		(ICE_PROT_IPV4 | ICE_IP_PK_ID)
+#define ICE_INSET_IPV4_FRAG_OFS	(ICE_PROT_IPV4 | ICE_IP_FRAG_OFS)
 #define ICE_INSET_IPV6_SRC		(ICE_PROT_IPV6 | ICE_IP_SRC)
 #define ICE_INSET_IPV6_DST		(ICE_PROT_IPV6 | ICE_IP_DST)
 #define ICE_INSET_IPV6_NEXT_HDR		(ICE_PROT_IPV6 | ICE_IP_PROTO)
-- 
2.25.1

[PATCH v2 3/3] net/ice: ACL filter support for IPv4 fragment

[Mingjin Ye]

Enable ACL filter on PF. Add support for FRAG_IPV4 pattern and queue
action.

Flow rule can be created by the following command:
   flow create 0 ingress group 1 pattern eth /
   ipv4 fragment_offset spec 0x2000 fragment_offset mask 0x3FFF /
   end actions queue index <queue id> / end

Signed-off-by: Mingjin Ye <mingjinx.ye@intel.com>
---
 drivers/net/ice/ice_acl_filter.c | 61 +++++++++++++++++++++++++++++---
 drivers/net/ice/ice_ethdev.c     |  1 -
 2 files changed, 56 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ice/ice_acl_filter.c b/drivers/net/ice/ice_acl_filter.c
index 63a525b363..04c17a98ed 100644
--- a/drivers/net/ice/ice_acl_filter.c
+++ b/drivers/net/ice/ice_acl_filter.c
@@ -30,7 +30,8 @@
 
 #define ICE_ACL_INSET_ETH_IPV4 ( \
 	ICE_INSET_SMAC | ICE_INSET_DMAC | \
-	ICE_INSET_IPV4_SRC | ICE_INSET_IPV4_DST)
+	ICE_INSET_IPV4_SRC | ICE_INSET_IPV4_DST | \
+	ICE_INSET_IPV4_FRAG_OFS)
 #define ICE_ACL_INSET_ETH_IPV4_UDP ( \
 	ICE_ACL_INSET_ETH_IPV4 | \
 	ICE_INSET_UDP_SRC_PORT | ICE_INSET_UDP_DST_PORT)
@@ -214,6 +215,7 @@ ice_acl_prof_init(struct ice_pf *pf)
 {
 	struct ice_hw *hw = ICE_PF_TO_HW(pf);
 	struct ice_flow_prof *prof_ipv4 = NULL;
+	struct ice_flow_prof *prof_ipv4_frag = NULL;
 	struct ice_flow_prof *prof_ipv4_udp = NULL;
 	struct ice_flow_prof *prof_ipv4_tcp = NULL;
 	struct ice_flow_prof *prof_ipv4_sctp = NULL;
@@ -234,6 +236,15 @@ ice_acl_prof_init(struct ice_pf *pf)
 	if (ret)
 		goto err_add_prof;
 
+	ice_memset(seg, 0, sizeof(*seg), ICE_NONDMA_MEM);
+	ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_IPV_FRAG);
+	acl_add_prof_prepare(hw, seg, false, 0, 0);
+	ret = ice_flow_add_prof(hw, ICE_BLK_ACL, ICE_FLOW_RX,
+				ICE_FLTR_PTYPE_FRAG_IPV4,
+				seg, 1, NULL, 0, &prof_ipv4_frag);
+	if (ret)
+		goto err_add_prof_ipv4_udp_frag;
+
 	ice_memset(seg, 0, sizeof(*seg), ICE_NONDMA_MEM);
 	ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_UDP | ICE_FLOW_SEG_HDR_IPV4);
 	acl_add_prof_prepare(hw, seg, true,
@@ -272,6 +283,10 @@ ice_acl_prof_init(struct ice_pf *pf)
 		if (ret)
 			goto err_assoc_prof;
 
+		ret = ice_flow_assoc_prof(hw, ICE_BLK_ACL, prof_ipv4_frag, i);
+		if (ret)
+			goto err_assoc_prof;
+
 		ret = ice_flow_assoc_prof(hw, ICE_BLK_ACL, prof_ipv4_udp, i);
 		if (ret)
 			goto err_assoc_prof;
@@ -293,6 +308,8 @@ ice_acl_prof_init(struct ice_pf *pf)
 err_add_prof_ipv4_tcp:
 	ice_flow_rem_prof(hw, ICE_BLK_ACL, ICE_FLTR_PTYPE_NONF_IPV4_UDP);
 err_add_prof_ipv4_udp:
+	ice_flow_rem_prof(hw, ICE_BLK_ACL, ICE_FLTR_PTYPE_FRAG_IPV4);
+err_add_prof_ipv4_udp_frag:
 	ice_flow_rem_prof(hw, ICE_BLK_ACL, ICE_FLTR_PTYPE_NONF_IPV4_OTHER);
 err_add_prof:
 	ice_free(hw, seg);
@@ -353,6 +370,7 @@ ice_acl_set_input_set(struct ice_acl_conf *filter, struct ice_fdir_fltr *input)
 			   ICE_NONDMA_TO_NONDMA);
 
 		break;
+	case ICE_FLTR_PTYPE_FRAG_IPV4:
 	case ICE_FLTR_PTYPE_NONF_IPV4_OTHER:
 		ice_memcpy(&input->ip.v4, &filter->input.ip.v4,
 			   sizeof(struct ice_fdir_v4),
@@ -519,6 +537,12 @@ ice_acl_create_filter(struct ice_adapter *ad,
 		acts[0].data.acl_act.mdid = ICE_MDID_RX_PKT_DROP;
 		acts[0].data.acl_act.prio = 0x3;
 		acts[0].data.acl_act.value = CPU_TO_LE16(0x1);
+	} else if (filter->input.dest_ctl ==
+		ICE_FLTR_PRGM_DESC_DEST_DIRECT_PKT_QINDEX) {
+		acts[0].type = ICE_FLOW_ACT_FWD_QUEUE;
+		acts[0].data.acl_act.mdid = ICE_MDID_RX_DST_Q;
+		acts[0].data.acl_act.prio = 0x3;
+		acts[0].data.acl_act.value = CPU_TO_LE16(input->q_index);
 	}
 
 	input->acl_fltr = true;
@@ -531,7 +555,8 @@ ice_acl_create_filter(struct ice_adapter *ad,
 		return ret;
 	}
 
-	if (flow_type == ICE_FLTR_PTYPE_NONF_IPV4_OTHER) {
+	if (flow_type == ICE_FLTR_PTYPE_NONF_IPV4_OTHER ||
+		flow_type == ICE_FLTR_PTYPE_FRAG_IPV4) {
 		ret = ice_acl_hw_set_conf(pf, input, acts, rule,
 					  ICE_FLTR_PTYPE_NONF_IPV4_UDP, 1);
 		if (ret)
@@ -576,6 +601,7 @@ ice_acl_destroy_filter(struct ice_adapter *ad,
 	int ret = 0;
 
 	switch (rule->flow_type) {
+	case ICE_FLTR_PTYPE_FRAG_IPV4:
 	case ICE_FLTR_PTYPE_NONF_IPV4_OTHER:
 		for (i = 0; i < 4; i++) {
 			entry_id = rule->entry_id[i];
@@ -617,6 +643,8 @@ ice_acl_parse_action(__rte_unused struct ice_adapter *ad,
 		     struct rte_flow_error *error,
 		     struct ice_acl_conf *filter)
 {
+	struct ice_pf *pf = &ad->pf;
+	const struct rte_flow_action_queue *act_q;
 	uint32_t dest_num = 0;
 
 	for (; actions->type != RTE_FLOW_ACTION_TYPE_END; actions++) {
@@ -629,6 +657,22 @@ ice_acl_parse_action(__rte_unused struct ice_adapter *ad,
 			filter->input.dest_ctl =
 				ICE_FLTR_PRGM_DESC_DEST_DROP_PKT;
 			break;
+		case RTE_FLOW_ACTION_TYPE_QUEUE:
+			dest_num++;
+
+			act_q = actions->conf;
+			filter->input.q_index = act_q->index;
+			if (filter->input.q_index >=
+					pf->dev_data->nb_rx_queues) {
+				rte_flow_error_set(error, EINVAL,
+						   RTE_FLOW_ERROR_TYPE_ACTION,
+						   actions,
+						   "Invalid queue for FDIR.");
+				return -rte_errno;
+			}
+			filter->input.dest_ctl =
+				ICE_FLTR_PRGM_DESC_DEST_DIRECT_PKT_QINDEX;
+			break;
 		default:
 			rte_flow_error_set(error, EINVAL,
 				   RTE_FLOW_ERROR_TYPE_ACTION, actions,
@@ -713,12 +757,12 @@ ice_acl_parse_pattern(__rte_unused struct ice_adapter *ad,
 			ipv4_spec = item->spec;
 			ipv4_mask = item->mask;
 
+			flow_type = ICE_FLTR_PTYPE_NONF_IPV4_OTHER;
 			if (ipv4_spec && ipv4_mask) {
 				/* Check IPv4 mask and update input set */
 				if (ipv4_mask->hdr.version_ihl ||
 				    ipv4_mask->hdr.total_length ||
 				    ipv4_mask->hdr.packet_id ||
-				    ipv4_mask->hdr.fragment_offset ||
 				    ipv4_mask->hdr.hdr_checksum) {
 					rte_flow_error_set(error, EINVAL,
 						RTE_FLOW_ERROR_TYPE_ITEM,
@@ -753,9 +797,16 @@ ice_acl_parse_pattern(__rte_unused struct ice_adapter *ad,
 
 					input_set |= ICE_INSET_IPV4_DST;
 				}
-			}
 
-			flow_type = ICE_FLTR_PTYPE_NONF_IPV4_OTHER;
+				if (ipv4_mask->hdr.fragment_offset) {
+					filter->input.ip.v4.fragment_offset =
+						ipv4_spec->hdr.fragment_offset;
+					filter->input.mask.v4.fragment_offset =
+						ipv4_mask->hdr.fragment_offset;
+					flow_type = ICE_FLTR_PTYPE_FRAG_IPV4;
+					input_set |= ICE_INSET_IPV4_FRAG_OFS;
+				}
+			}
 			break;
 		case RTE_FLOW_ITEM_TYPE_TCP:
 			tcp_spec = item->spec;
diff --git a/drivers/net/ice/ice_ethdev.c b/drivers/net/ice/ice_ethdev.c
index 93a6308a86..a57bcaf36e 100644
--- a/drivers/net/ice/ice_ethdev.c
+++ b/drivers/net/ice/ice_ethdev.c
@@ -2684,7 +2684,6 @@ ice_dev_init(struct rte_eth_dev *dev)
 	}
 
 	if (!ad->is_safe_mode) {
-		ad->disabled_engine_mask |= BIT(ICE_FLOW_ENGINE_ACL);
 		ret = ice_flow_init(ad);
 		if (ret) {
 			PMD_INIT_LOG(ERR, "Failed to initialize flow");
-- 
2.25.1

RE: [PATCH v2 3/3] net/ice: ACL filter support for IPv4 fragment

[Jiale, SongX]

> -----Original Message-----
> From: Mingjin Ye <mingjinx.ye@intel.com>
> Sent: Friday, January 24, 2025 5:13 PM
> To: dev@dpdk.org
> Cc: Ye, MingjinX <mingjinx.ye@intel.com>; Richardson, Bruce
> <bruce.richardson@intel.com>; Burakov, Anatoly
> <anatoly.burakov@intel.com>
> Subject: [PATCH v2 3/3] net/ice: ACL filter support for IPv4 fragment
> 
> Enable ACL filter on PF. Add support for FRAG_IPV4 pattern and queue action.
> 
> Flow rule can be created by the following command:
>    flow create 0 ingress group 1 pattern eth /
>    ipv4 fragment_offset spec 0x2000 fragment_offset mask 0x3FFF /
>    end actions queue index <queue id> / end
> 
> Signed-off-by: Mingjin Ye <mingjinx.ye@intel.com>
> ---
Tested-by: Jiale Song <songx.jiale@intel.com>