From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id B387DA0562; Fri, 3 Apr 2020 07:14:09 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 119A41BFC1; Fri, 3 Apr 2020 07:14:09 +0200 (CEST) Received: from mx0b-0016f401.pphosted.com (mx0b-0016f401.pphosted.com [67.231.156.173]) by dpdk.org (Postfix) with ESMTP id 00F9C1BFBA for ; Fri, 3 Apr 2020 07:14:07 +0200 (CEST) Received: from pps.filterd (m0045851.ppops.net [127.0.0.1]) by mx0b-0016f401.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id 0335C8e5021201; Thu, 2 Apr 2020 22:14:07 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-transfer-encoding : mime-version; s=pfpt0818; bh=OXY92cK8Y6p/IZqinz5COeY0mnYCpp19Qf1PD23sLU4=; b=hEHaZjWb7SoXrDVzuoY8BA//YRhYdY9DUPnZzwpizV4naXe8x1onkSffitivieE2/OmW rXfxk1tspwWWnva8Ki+Y9Mizy/xCcanrm3vwZP5VbGS8SW+6pKsMYSv2YJJmGWLahS4G I/vabaLGjBYFuid9T6Bgp3wCCT/EaL5LB+tgXcf/hvJcL0GdHu5h7X4gDgCdc+FhxSht kWUPleVUDgUg4Hh/Sg/bwrkNER2MIaAAuhERb4+2f/Gp5e9QP+08AguUqNeViGruvkUG bbtsNffxc30WJsuDXqx1oUQ3bUrpBRcIQ4OF/UJphOPfjE/ObIoASXxmapSkyN7idAa1 3Q== Received: from sc-exch03.marvell.com ([199.233.58.183]) by mx0b-0016f401.pphosted.com with ESMTP id 3046h65grn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Thu, 02 Apr 2020 22:14:07 -0700 Received: from SC-EXCH02.marvell.com (10.93.176.82) by SC-EXCH03.marvell.com (10.93.176.83) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Thu, 2 Apr 2020 22:14:04 -0700 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (104.47.55.168) by SC-EXCH02.marvell.com (10.93.176.82) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Thu, 2 Apr 2020 22:14:04 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=VK+vuLP0WA4z9hv/NLCzve6bKDY0rKziENzp3rUUsEigRfvqcAezwr/FWIF0/avdzPXhr4tVNRCsOyFJMdg9JhDK8PsL4Y82lX9o0OHGpG55jRUZFaIuxNwsfloixbzNBwLKFVHnT4G37AzRu+xdE+rwMOO0PmufId221rN1iJkZ0PTcazQizIWPm3WepGBNmWC8+TynAgk3FyvG7sfrOO2BCZlyf11qwO2n65fLOzOSYJE5sUmydgKoUK3+qh4sWXSfzsH+ACIkbqfDoa+/yu4+25H5bmqAmjNvmMaOxOzXdkFtv37uj+kO95rYH4kGegboI88uaTgm9pRZnFbhWQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OXY92cK8Y6p/IZqinz5COeY0mnYCpp19Qf1PD23sLU4=; b=I8ezdvrHppNqwKn4jIWXxQ+slWW7sl5DAnVmRGKBPKRX//STy0ytgS5D6zwWXhcZR28RKdPdJ96bltrZ9qTGDicYafUSDW3S7oUFXCayRL3ZLVug3wQ1Wiwj9kplqhlYU81o8jcoyinyJQiwTVthg5uG8pNWwJ/+iug/WQyd5KiIjBj3j31qbnm12u3p/bfIiqSd0A9j8fUxNMu670PL2iS6eFb4dLLwysQarPPQDH/GH3Rnhy+LOTm2L6ZPazqdxaxh6YUH+bCAhS+/zez9ECv8/MbW3owR1LqrE295DN6d5TlcyeVoseHw4c2o6BEr222LiqIM+XT0RT1CyjeiBQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=marvell.com; dmarc=pass action=none header.from=marvell.com; dkim=pass header.d=marvell.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.onmicrosoft.com; s=selector1-marvell-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OXY92cK8Y6p/IZqinz5COeY0mnYCpp19Qf1PD23sLU4=; b=k96izK25s/tT0rrdbJqkwyDGKxqKE1GnGIl4sQ5atBIm3CITKqbicmfVv6bwX2jZ3gGGwHjPIJiubPrVBiBUlsSLl5EqsNQCXa4okh3WL9kKnvwZMbIAH/nhmhn+Dt4xhIGuGM9+p6aDpkf1Ldd60MIuMd6L+d0y1rVDYJkd0XY= Received: from MN2PR18MB2877.namprd18.prod.outlook.com (2603:10b6:208:3b::26) by MN2PR18MB3559.namprd18.prod.outlook.com (2603:10b6:208:265::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2814.18; Fri, 3 Apr 2020 05:14:02 +0000 Received: from MN2PR18MB2877.namprd18.prod.outlook.com ([fe80::648f:e7fa:f95e:191b]) by MN2PR18MB2877.namprd18.prod.outlook.com ([fe80::648f:e7fa:f95e:191b%2]) with mapi id 15.20.2878.016; Fri, 3 Apr 2020 05:14:02 +0000 From: Anoob Joseph To: "Shetty, Praveen" , "dev@dpdk.org" , "Doherty, Declan" , Akhil Goyal CC: "Iremonger, Bernard" , "Ananyev, Konstantin" Thread-Topic: [EXT] [PATCH v3] examples/ipsec-secgw: support flow director feature Thread-Index: AQHWB1yomOe+1JBZ9km8ZL+21y33gqhlzcFQgABTswCAALv1gA== Date: Fri, 3 Apr 2020 05:14:02 +0000 Message-ID: References: <20200319162145.28906-1-praveen.shetty@intel.com> <20200331130211.24761-1-praveen.shetty@intel.com> In-Reply-To: Accept-Language: en-IN, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [27.34.244.203] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f290f69a-7bcb-4150-6d8e-08d7d78dd30b x-ms-traffictypediagnostic: MN2PR18MB3559: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:2803; x-forefront-prvs: 0362BF9FDB x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MN2PR18MB2877.namprd18.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(10009020)(4636009)(396003)(39860400002)(366004)(136003)(376002)(346002)(33656002)(9686003)(186003)(55016002)(316002)(30864003)(26005)(86362001)(54906003)(71200400001)(52536014)(66556008)(66946007)(110136005)(8936002)(4326008)(478600001)(64756008)(2906002)(53546011)(7696005)(76116006)(5660300002)(81156014)(6506007)(81166006)(66446008)(8676002)(66476007); DIR:OUT; SFP:1101; received-spf: None (protection.outlook.com: marvell.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: yBAKQzXDaiQK3IVosjWNKYV7yzvUK/i1XTxTPi9lqyqPGGHi+wV4JnVsc3vb+6AUKmjJ6axjjqSsz/O9E8Is2iVnCQq2UjP2plaS/HTKBtpxTfNKuuMl+eADcH7iKEHC1rEzwnu9N97IQntolrWSrJP8jd9K6oE6JIrWepZwuY1DIygtJS71QyaGVYjFAxm7wZXNtNYOHZK7pU4+TdsV1XZ6ZXO1rpdI4QWGdCQq3egChu2Xor3/jTPaxDVnJ72G7xmYdCwc7FWf0djRmIpTvp9F1amn6oE0WIQeUBtO3tbNbfHeunglZ721dOzFBG8TsSPKd1P4vHW3HT2/AgyBzZ7olinIHjo/b4YMy/+joBwhGcHw6nU1H25qFnfIJT3DbDZUF72+c954OZAg5TMdP3F3bt3lkiYRe84ZSgt67KGcHNvhHjVJX/Eh9tBlXsHP x-ms-exchange-antispam-messagedata: mdbx6Ud4z+I4JN8/LIMqG45UthnwKsOyhNaL+OowItDOv36AxVJL7OkcUNJbCE62ZZ0QIUkPiO8tPfxsowBcAzXkUky8benLHgkxa7tUh9eA1qGAlJKI4d/nKRa30/vRr/0QjsvhLopAuOUcGbijYA== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: f290f69a-7bcb-4150-6d8e-08d7d78dd30b X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Apr 2020 05:14:02.5167 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 70e1fb47-1155-421d-87fc-2e58f638b6e0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: IHcZjgPIqZFNImiEB/Yq4iHAiK6FYrn7zCdKwENFT/OSjio2Z4RPGdi1RvoxPQFxcF6tmfscN/TwX1W/FTYcHA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR18MB3559 X-OriginatorOrg: marvell.com X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138, 18.0.676 definitions=2020-04-03_02:2020-04-02, 2020-04-02 signatures=0 Subject: Re: [dpdk-dev] [EXT] [PATCH v3] examples/ipsec-secgw: support flow director feature X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Hi Praveen, Please see inline. Thanks, Anoob > -----Original Message----- > From: Shetty, Praveen > Sent: Thursday, April 2, 2020 11:27 PM > To: Anoob Joseph ; dev@dpdk.org; Doherty, Declan > ; Akhil Goyal > Cc: Iremonger, Bernard ; Ananyev, Konstantin > > Subject: RE: [EXT] [PATCH v3] examples/ipsec-secgw: support flow director > feature >=20 >=20 > Hi Anoob, >=20 > See my response inline. >=20 > Regards, > Praveen >=20 > -----Original Message----- > From: Anoob Joseph > Sent: Thursday, April 2, 2020 7:09 PM > To: Shetty, Praveen ; dev@dpdk.org; Doherty, > Declan > Cc: Iremonger, Bernard ; Ananyev, Konstantin > > Subject: RE: [EXT] [PATCH v3] examples/ipsec-secgw: support flow director > feature >=20 > Hi Praveen, >=20 > I've few minor comments. Please see inline. >=20 > Thanks, > Anoob >=20 > > -----Original Message----- > > From: Praveen Shetty > > Sent: Tuesday, March 31, 2020 6:32 PM > > To: dev@dpdk.org; declan.doherty@intel.com; Anoob Joseph > > > > Cc: bernard.iremonger@intel.com; konstantin.ananyev@intel.com > > Subject: [EXT] [PATCH v3] examples/ipsec-secgw: support flow director > > feature > > > > External Email > > > > ---------------------------------------------------------------------- > > Support load distribution in security gateway application using NIC > > load distribution feature(Flow Director). > > Flow Director is used to redirect the specified inbound ipsec flow to > > a specified queue.This is achieved by extending the SA rule syntax to > > support specification by adding new action_type of to > > a specified . > > > > Signed-off-by: Praveen Shetty > > --- > > v3 changes: > > Incorporated Anoob review comments on v2. > > > > examples/ipsec-secgw/ep0.cfg | 11 +++++ > > examples/ipsec-secgw/ipsec-secgw.c | 55 +++++++++++++++++++++++ > > examples/ipsec-secgw/ipsec.c | 67 +++++++++++++++++++++++++++ > > examples/ipsec-secgw/ipsec.h | 9 ++++ > > examples/ipsec-secgw/sa.c | 72 ++++++++++++++++++++++++++++-- > > 5 files changed, 211 insertions(+), 3 deletions(-) > > > > diff --git a/examples/ipsec-secgw/ep0.cfg > > b/examples/ipsec-secgw/ep0.cfg index dfd4aca7d..6f8d5aa53 100644 > > --- a/examples/ipsec-secgw/ep0.cfg > > +++ b/examples/ipsec-secgw/ep0.cfg > > @@ -29,6 +29,7 @@ sp ipv4 in esp protect 111 pri 1 dst > > 192.168.186.0/24 sport > > 0:65535 dport 0:6553 sp ipv4 in esp protect 115 pri 1 dst > > 192.168.210.0/24 sport > > 0:65535 dport 0:65535 sp ipv4 in esp protect 116 pri 1 dst > > 192.168.211.0/24 sport 0:65535 dport 0:65535 sp ipv4 in esp protect > > 115 pri 1 dst > > 192.168.210.0/24 sport 0:65535 dport 0:65535 > > +sp ipv4 in esp protect 117 pri 1 dst 192.168.212.0/24 sport 0:65535 > > +dport 0:65535 > > sp ipv4 in esp protect 125 pri 1 dst 192.168.65.0/24 sport 0:65535 > > dport 0:65535 sp ipv4 in esp protect 125 pri 1 dst 192.168.65.0/24 > > sport 0:65535 dport 0:65535 sp ipv4 in esp protect 126 pri 1 dst > > 192.168.66.0/24 sport 0:65535 dport 0:65535 @@ -61,6 +62,8 @@ sp ipv6 > > in esp protect 125 pri 1 dst > > ffff:0000:0000:0000:aaaa:aaaa:0000:0000/96 > > sport 0:65535 dport 0:65535 > > sp ipv6 in esp protect 126 pri 1 dst > > ffff:0000:0000:0000:bbbb:bbbb:0000:0000/96 \ sport 0:65535 dport > > 0:65535 > > +sp ipv6 in esp protect 127 pri 1 dst > > +ffff:0000:0000:0000:cccc:dddd:0000:0000/96 \ sport 0:65535 dport > > +0:65535 > > > > #SA rules > > sa out 5 cipher_algo aes-128-cbc cipher_key > > 0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0 \ @@ -118,6 +121,9 @@ dst 172.16.1.5 > > > > sa in 116 cipher_algo null auth_algo null mode ipv4-tunnel src > > 172.16.2.6 dst > > 172.16.1.6 > > > > +sa in 117 cipher_algo null auth_algo null mode ipv4-tunnel src > > +172.16.2.7 \ dst 172.16.1.7 flow-direction 0 2 > > + > > sa in 125 cipher_algo aes-128-cbc cipher_key > > c3:c3:c3:c3:c3:c3:c3:c3:c3:c3:c3:\ > > c3:c3:c3:c3:c3 auth_algo sha1-hmac auth_key > > c3:c3:c3:c3:c3:c3:c3:c3:c3:c3:c3:\ > > c3:c3:c3:c3:c3:c3:c3:c3:c3 mode ipv6-tunnel \ @@ -130,6 +136,11 @@ sa > > in > > 126 cipher_algo aes-128-cbc cipher_key > > 4d:4d:4d:4d:4d:4d:4d:4d:4d:4d:4d:\ > > src 2222:2222:2222:2222:2222:2222:2222:6666 \ dst > > 1111:1111:1111:1111:1111:1111:1111:6666 > > > > +sa in 127 cipher_algo null auth_algo null mode ipv6-tunnel \ src > > +2222:2222:2222:2222:2222:2222:2222:7777 \ dst > > +1111:1111:1111:1111:1111:1111:1111:7777 \ flow-direction 0 3 > > + > > #Routing rules > > rt ipv4 dst 172.16.2.5/32 port 0 > > rt ipv4 dst 172.16.2.6/32 port 1 > > diff --git a/examples/ipsec-secgw/ipsec-secgw.c b/examples/ipsec- > > secgw/ipsec-secgw.c index ce36e6d9c..4400b075c 100644 > > --- a/examples/ipsec-secgw/ipsec-secgw.c > > +++ b/examples/ipsec-secgw/ipsec-secgw.c > > @@ -246,6 +246,30 @@ static struct rte_eth_conf port_conf =3D { > > .txmode =3D { > > .mq_mode =3D ETH_MQ_TX_NONE, > > }, > > + .fdir_conf =3D { > > + .mode =3D RTE_FDIR_MODE_NONE, > > + .pballoc =3D RTE_FDIR_PBALLOC_64K, > > + .status =3D RTE_FDIR_REPORT_STATUS, > > + .mask =3D { > > + .vlan_tci_mask =3D 0xFFEF, > > + .ipv4_mask =3D { > > + .src_ip =3D 0xFFFFFFFF, > > + .dst_ip =3D 0xFFFFFFFF, > > + }, > > + .ipv6_mask =3D { > > + .src_ip =3D {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, > > + 0xFFFFFFFF}, > > + .dst_ip =3D {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, > > + 0xFFFFFFFF}, > > + }, > > + .src_port_mask =3D 0xFFFF, > > + .dst_port_mask =3D 0xFFFF, > > + .mac_addr_byte_mask =3D 0xFF, > > + .tunnel_type_mask =3D 1, > > + .tunnel_id_mask =3D 0xFFFFFFFF, > > + }, > > + .drop_queue =3D 127, > > + } > > }; > > > > struct socket_ctx socket_ctx[NB_SOCKETS]; @@ -1183,6 +1207,28 @@ > > ipsec_poll_mode_worker(void) > > } > > } > > > > +int > > +check_flow_params(uint16_t fdir_portid, uint8_t fdir_qid) { > > + uint16_t i; > > + uint16_t portid; > > + uint8_t queueid; > > + > > + for (i =3D 0; i < nb_lcore_params; ++i) { > > + portid =3D lcore_params_array[i].port_id; > > + if (portid =3D=3D fdir_portid) { > > + queueid =3D lcore_params_array[i].queue_id; > > + if (queueid =3D=3D fdir_qid) > > + break; > > + } > > + > > + if (i =3D=3D nb_lcore_params - 1) > > + return -1; > > + } > > + > > + return 1; > > +} > > + > > static int32_t > > check_poll_mode_params(struct eh_conf *eh_conf) { @@ -2813,6 > > +2859,15 @@ main(int32_t argc, char **argv) > > > > sa_check_offloads(portid, &req_rx_offloads[portid], > > &req_tx_offloads[portid]); > > + /* check if FDIR is configured on the port */ > > + if (check_fdir_configured(portid)) { > > + /* Enable FDIR */ > > + port_conf.fdir_conf.mode =3D > > RTE_FDIR_MODE_PERFECT; > > + /* Disable RSS */ > > + port_conf.rxmode.mq_mode =3D ETH_MQ_RX_NONE; > > + port_conf.rx_adv_conf.rss_conf.rss_hf =3D 0; > > + port_conf.rx_adv_conf.rss_conf.rss_key =3D NULL; > > + } > > port_init(portid, req_rx_offloads[portid], > > req_tx_offloads[portid]); > > } > > diff --git a/examples/ipsec-secgw/ipsec.c > > b/examples/ipsec-secgw/ipsec.c index d40657102..76ee9dbcf 100644 > > --- a/examples/ipsec-secgw/ipsec.c > > +++ b/examples/ipsec-secgw/ipsec.c > > @@ -418,6 +418,73 @@ create_inline_session(struct socket_ctx *skt_ctx, > > struct ipsec_sa *sa, > > return 0; > > } > > > > +int > > +create_ipsec_esp_flow(struct ipsec_sa *sa) { > > + int ret =3D 0; > > + struct rte_flow_error err; > > + if (sa->direction =3D=3D RTE_SECURITY_IPSEC_SA_DIR_EGRESS) > > + return 0; /* No Flow director rules for Egress traffic */ >=20 > [Anoob] Any reason why this is not relevant for Egress. >=20 > [Praveen] we don't see an use case for load distribution across ingress q= ueues > for outbound IPsec traffic therefore we have limited this configuration t= o > inbound IPsec processing, as this is the only use case we can verify. [Anoob] Why do you say load distribution for ingress queues is not required= but is required for egress? I would say the use case is the same in either= direction. Said that, adding just egress should be fine. I leave this to Akhil's judge= ment. >=20 > As for the code I would suggest something like, > /* No flow director rules for Egress traffic */ > if (sa->direction =3D=3D RTE_SECURITY_IPSEC_SA_DIR_EGRESS) > return 0; >=20 > ... >=20 > > + if (sa->flags =3D=3D TRANSPORT) { > > + RTE_LOG(ERR, IPSEC, > > + "No Flow director rule for transport mode:"); >=20 > [Anoob] Is the ending : required in the line above? And do might need a \= n? >=20 > [Praveen] Will fix this in v4. >=20 > Also, why is one case returning 0 (EGRESS) and another (TRANSPORT) is > returning -1? One is treated as error and other is not? >=20 > [Praveen] It should be -1(error) for both the cases , will fix this in v4= . >=20 >=20 > > + return -1; > > + } > > + sa->action[0].type =3D RTE_FLOW_ACTION_TYPE_QUEUE; > > + sa->pattern[0].type =3D RTE_FLOW_ITEM_TYPE_ETH; > > + sa->action[0].conf =3D > > + &(struct rte_flow_action_queue){ > > + .index =3D sa->fdir_qid, > > + }; > > + sa->attr.egress =3D 0; > > + sa->attr.ingress =3D 1; > > + if (IS_IP6(sa->flags)) { > > + sa->pattern[1].mask =3D &rte_flow_item_ipv6_mask; > > + sa->pattern[1].type =3D RTE_FLOW_ITEM_TYPE_IPV6; > > + sa->pattern[1].spec =3D &sa->ipv6_spec; > > + memcpy(sa->ipv6_spec.hdr.dst_addr, > > + sa->dst.ip.ip6.ip6_b, sizeof(sa->dst.ip.ip6.ip6_b)); > > + memcpy(sa->ipv6_spec.hdr.src_addr, > > + sa->src.ip.ip6.ip6_b, sizeof(sa->src.ip.ip6.ip6_b)); > > + sa->pattern[2].type =3D RTE_FLOW_ITEM_TYPE_ESP; > > + sa->pattern[2].spec =3D &sa->esp_spec; > > + sa->pattern[2].mask =3D &rte_flow_item_esp_mask; > > + sa->esp_spec.hdr.spi =3D rte_cpu_to_be_32(sa->spi); > > + sa->pattern[3].type =3D RTE_FLOW_ITEM_TYPE_END; > > + } else if (IS_IP4(sa->flags)) { > > + sa->pattern[1].mask =3D &rte_flow_item_ipv4_mask; > > + sa->pattern[1].type =3D RTE_FLOW_ITEM_TYPE_IPV4; > > + sa->pattern[1].spec =3D &sa->ipv4_spec; > > + sa->ipv4_spec.hdr.dst_addr =3D sa->dst.ip.ip4; > > + sa->ipv4_spec.hdr.src_addr =3D sa->src.ip.ip4; > > + sa->pattern[2].type =3D RTE_FLOW_ITEM_TYPE_ESP; > > + sa->pattern[2].spec =3D &sa->esp_spec; > > + sa->pattern[2].mask =3D &rte_flow_item_esp_mask; > > + sa->esp_spec.hdr.spi =3D rte_cpu_to_be_32(sa->spi); > > + sa->pattern[3].type =3D RTE_FLOW_ITEM_TYPE_END; > > + } > > + sa->action[1].type =3D RTE_FLOW_ACTION_TYPE_END; > > + > > + ret =3D rte_flow_validate(sa->portid, &sa->attr, > > + sa->pattern, sa->action, > > + &err); > > + if (ret < 0) { > > + RTE_LOG(ERR, IPSEC, > > + "Flow Validation failed\n"); >=20 > [Anoob] The above should fit into one line. Also V should be small. >=20 > [Praveen] Okay. Will fix this in v4. >=20 > > + return ret; > > + } > > + sa->flow =3D rte_flow_create(sa->portid, > > + &sa->attr, sa->pattern, sa->action, > > + &err); >=20 > [Anoob] Start breaking into multiple lines when you exceed 80 char limits= . In the > earlier line, &sa->attr should fit into the line above. >=20 > Also, having a blank line above rte_flow_create() line would be good. >=20 > [Praveen] Okay. Will fix it in v4 >=20 > > + if (!sa->flow) { > > + RTE_LOG(ERR, IPSEC, > > + "Flow Creation failed\n"); >=20 > [Anoob] Above should fit into one line. Also C should be small. >=20 > [Praveen] okay. Will fix this in v4. >=20 > > + return -1; > > + } > > + > > + return 0; > > +} > > + > > /* > > * queue crypto-ops into PMD queue. > > */ > > diff --git a/examples/ipsec-secgw/ipsec.h > > b/examples/ipsec-secgw/ipsec.h index f8f29f9b1..b0e9f45cb 100644 > > --- a/examples/ipsec-secgw/ipsec.h > > +++ b/examples/ipsec-secgw/ipsec.h > > @@ -144,6 +144,8 @@ struct ipsec_sa { > > }; > > enum rte_security_ipsec_sa_direction direction; > > uint16_t portid; > > + uint8_t fdir_qid; > > + uint8_t fdir_flag; > > > > #define MAX_RTE_FLOW_PATTERN (4) > > #define MAX_RTE_FLOW_ACTIONS (3) > > @@ -408,5 +410,12 @@ create_lookaside_session(struct ipsec_ctx > > *ipsec_ctx, struct ipsec_sa *sa, int create_inline_session(struct > > socket_ctx *skt_ctx, struct ipsec_sa *sa, > > struct rte_ipsec_session *ips); > > +int > > +check_flow_params(uint16_t fdir_portid, uint8_t fdir_qid); > > + > > +int > > +create_ipsec_esp_flow(struct ipsec_sa *sa); > > > > +int > > +check_fdir_configured(uint16_t portid); > > #endif /* __IPSEC_H__ */ > > diff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c > > index > > 0eb52d141..ddd275142 100644 > > --- a/examples/ipsec-secgw/sa.c > > +++ b/examples/ipsec-secgw/sa.c > > @@ -271,6 +271,7 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, > > uint32_t type_p =3D 0; > > uint32_t portid_p =3D 0; > > uint32_t fallback_p =3D 0; > > + int16_t status_p =3D 0; > > > > if (strcmp(tokens[0], "in") =3D=3D 0) { > > ri =3D &nb_sa_in; > > @@ -295,6 +296,7 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, > > if (atoi(tokens[1]) =3D=3D INVALID_SPI) > > return; > > rule->spi =3D atoi(tokens[1]); > > + rule->portid =3D UINT16_MAX; > > ips =3D ipsec_get_primary_session(rule); > > > > for (ti =3D 2; ti < n_tokens; ti++) { > > @@ -636,9 +638,14 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, > > INCREMENT_TOKEN_INDEX(ti, n_tokens, status); > > if (status->status < 0) > > return; > > - rule->portid =3D atoi(tokens[ti]); > > - if (status->status < 0) > > + if (rule->portid =3D=3D UINT16_MAX) > > + rule->portid =3D atoi(tokens[ti]); > > + else if (rule->portid !=3D atoi(tokens[ti])) { > > + APP_CHECK(0, status, "portid %s " > > + "not matching with already assigned portid > > %u", > > + tokens[ti], rule->portid); > > return; >=20 > [Anoob] Alignment for APP_CHECK's broken up parts are not following the > convention. >=20 > [Praveen] Will fix this in v4. >=20 > > + } > > portid_p =3D 1; > > continue; > > } > > @@ -681,6 +688,43 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, > > fallback_p =3D 1; > > continue; > > } > > + if (strcmp(tokens[ti], "flow-direction") =3D=3D 0) { > > + if (ips->type =3D=3D > > + > > RTE_SECURITY_ACTION_TYPE_INLINE_PROTOCOL || > > + ips->type =3D=3D > > + > > RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL || > > + ips->type =3D=3D > > + > > RTE_SECURITY_ACTION_TYPE_INLINE_CRYPTO) { > > + APP_CHECK(0, status, "Flow Director not " > > + "supported for security session " > > + "type:%d", ips->type); > > + return; > > + } > > + rule->fdir_flag =3D 1; > > + INCREMENT_TOKEN_INDEX(ti, n_tokens, status); > > + if (status->status < 0) > > + return; > > + if (rule->portid =3D=3D UINT16_MAX) > > + rule->portid =3D atoi(tokens[ti]); > > + else if (rule->portid !=3D atoi(tokens[ti])) { > > + APP_CHECK(0, status, "portid %s " > > + "not matching with already assigned portid > > %u", > > + tokens[ti], rule->portid); > > + return; > > + } > > + INCREMENT_TOKEN_INDEX(ti, n_tokens, status); > > + if (status->status < 0) > > + return; > > + rule->fdir_qid =3D atoi(tokens[ti]); > > + /* validating portid and queueid */ > > + status_p =3D check_flow_params(rule->portid, > > + rule->fdir_qid); > > + if (status_p < 0) { > > + printf("port id %u / queue id %u is not valid\n", > > + rule->portid, rule->fdir_qid); > > + } > > + continue; > > + } > > > > /* unrecognizeable input */ > > APP_CHECK(0, status, "unrecognized input \"%s\"", @@ -719,7 > > +763,6 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, > > if (!type_p || (!portid_p && ips->type !=3D > > RTE_SECURITY_ACTION_TYPE_CPU_CRYPTO)) { > > ips->type =3D RTE_SECURITY_ACTION_TYPE_NONE; > > - rule->portid =3D -1; > > } > > > > *ri =3D *ri + 1; > > @@ -823,6 +866,9 @@ print_one_sa_rule(const struct ipsec_sa *sa, int > > inbound) > > break; > > } > > } > > + if (sa->fdir_flag =3D=3D 1) > > + printf("flow-direction %d %d", sa->portid, sa->fdir_qid); > > + > > printf("\n"); > > } > > > > @@ -1141,6 +1187,12 @@ sa_add_rules(struct sa_ctx *sa_ctx, const > > struct ipsec_sa entries[], > > } > > } > > > > + if (sa->fdir_flag && inbound) { > > + rc =3D create_ipsec_esp_flow(sa); > > + if (rc !=3D 0) > > + RTE_LOG(ERR, IPSEC_ESP, > > + "create_ipsec_esp flow failed\n"); >=20 > [Anoob] Instead of function name, can you give the description of what ac= tually > failed? >=20 > [Praveen] Can be done , will do it in v4. >=20 > > + } > > print_one_sa_rule(sa, inbound); > > } > > > > @@ -1243,6 +1295,20 @@ fill_ipsec_session(struct rte_ipsec_session > > *ss, struct rte_ipsec_sa *sa) > > return rc; > > } > > > > +int > > +check_fdir_configured(uint16_t portid) { > > + struct ipsec_sa *sa =3D NULL; > > + uint32_t idx_sa =3D 0; > > + > > + for (idx_sa =3D 0; idx_sa < nb_sa_in; idx_sa++) { > > + sa =3D &sa_in[idx_sa]; > > + if (sa->portid =3D=3D portid) > > + return sa->fdir_flag; > > + } > > + return 0; > > +} > > + > > /* > > * Initialise related rte_ipsec_sa object. > > */ > > -- > > 2.17.1