* [PATCH 1/3] net/ice/base: add ipv4 fragment related field
2025-01-22 8:23 [PATCH 0/3] flexible IPv4 fragment action Mingjin Ye
@ 2025-01-22 8:23 ` Mingjin Ye
2025-01-22 8:23 ` [PATCH 2/3] net/ice: FDIR support IPv4 fragment masks Mingjin Ye
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Mingjin Ye @ 2025-01-22 8:23 UTC (permalink / raw)
To: dev; +Cc: Mingjin Ye, Bruce Richardson, Anatoly Burakov
Added support for the Flags and Fragment Offset fields of ipv4 fragments.
Field definitions are the same as in rte_ipv4_hdr.
Signed-off-by: Mingjin Ye <mingjinx.ye@intel.com>
---
drivers/net/ice/base/ice_fdir.h | 2 ++
drivers/net/ice/base/ice_flow.c | 5 +++++
drivers/net/ice/base/ice_flow.h | 1 +
3 files changed, 8 insertions(+)
diff --git a/drivers/net/ice/base/ice_fdir.h b/drivers/net/ice/base/ice_fdir.h
index 1bb8a14a5d..3461f8dfba 100644
--- a/drivers/net/ice/base/ice_fdir.h
+++ b/drivers/net/ice/base/ice_fdir.h
@@ -56,6 +56,7 @@
#define ICE_IPV4_TOS_OFFSET 15
#define ICE_IPV4_ID_OFFSET 18
#define ICE_IPV4_TTL_OFFSET 22
+#define ICE_IPV4_FRAGMENT_OFFSET 20
#define ICE_IPV6_TC_OFFSET 14
#define ICE_IPV6_HLIM_OFFSET 21
#define ICE_IPV6_PROTO_OFFSET 20
@@ -181,6 +182,7 @@ struct ice_fdir_v4 {
u8 proto;
u8 ttl;
__be16 packet_id;
+ __be16 fragment_offset;
};
#define ICE_IPV6_ADDR_LEN_AS_U32 4
diff --git a/drivers/net/ice/base/ice_flow.c b/drivers/net/ice/base/ice_flow.c
index 0d64a5bb1e..60d640a26f 100644
--- a/drivers/net/ice/base/ice_flow.c
+++ b/drivers/net/ice/base/ice_flow.c
@@ -21,6 +21,7 @@
#define ICE_FLOW_FLD_SZ_SCTP_CHKSUM 4
#define ICE_FLOW_FLD_SZ_IP_DSCP 1
#define ICE_FLOW_FLD_SZ_IP_TTL 1
+#define ICE_FLOW_FLD_SZ_IP_FLAGS 2
#define ICE_FLOW_FLD_SZ_IP_PROT 1
#define ICE_FLOW_FLD_SZ_PORT 2
#define ICE_FLOW_FLD_SZ_TCP_FLAGS 1
@@ -87,6 +88,9 @@ struct ice_flow_field_info ice_flds_info[ICE_FLOW_FIELD_IDX_MAX] = {
/* ICE_FLOW_FIELD_IDX_IPV4_TTL */
ICE_FLOW_FLD_INFO_MSK(ICE_FLOW_SEG_HDR_NONE, 8,
ICE_FLOW_FLD_SZ_IP_TTL, 0xff00),
+ /* ICE_FLOW_FIELD_IDX_IPV4_OFFSET */
+ ICE_FLOW_FLD_INFO_MSK(ICE_FLOW_SEG_HDR_IPV_FRAG, 6,
+ ICE_FLOW_FLD_SZ_IP_FLAGS, 0x3fff),
/* ICE_FLOW_FIELD_IDX_IPV4_PROT */
ICE_FLOW_FLD_INFO_MSK(ICE_FLOW_SEG_HDR_NONE, 8,
ICE_FLOW_FLD_SZ_IP_PROT, 0x00ff),
@@ -1459,6 +1463,7 @@ ice_flow_xtract_fld(struct ice_hw *hw, struct ice_flow_prof_params *params,
prot_id = ICE_PROT_IPV4_IL_IL;
break;
case ICE_FLOW_FIELD_IDX_IPV4_ID:
+ case ICE_FLOW_FIELD_IDX_IPV4_OFFSET:
prot_id = ICE_PROT_IPV4_OF_OR_S;
break;
case ICE_FLOW_FIELD_IDX_IPV6_SA:
diff --git a/drivers/net/ice/base/ice_flow.h b/drivers/net/ice/base/ice_flow.h
index 65b261beca..a87c0e4567 100644
--- a/drivers/net/ice/base/ice_flow.h
+++ b/drivers/net/ice/base/ice_flow.h
@@ -239,6 +239,7 @@ enum ice_flow_field {
ICE_FLOW_FIELD_IDX_IPV4_DSCP,
ICE_FLOW_FIELD_IDX_IPV6_DSCP,
ICE_FLOW_FIELD_IDX_IPV4_TTL,
+ ICE_FLOW_FIELD_IDX_IPV4_OFFSET,
ICE_FLOW_FIELD_IDX_IPV4_PROT,
ICE_FLOW_FIELD_IDX_IPV6_TTL,
ICE_FLOW_FIELD_IDX_IPV6_PROT,
--
2.25.1
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 2/3] net/ice: FDIR support IPv4 fragment masks
2025-01-22 8:23 [PATCH 0/3] flexible IPv4 fragment action Mingjin Ye
2025-01-22 8:23 ` [PATCH 1/3] net/ice/base: add ipv4 fragment related field Mingjin Ye
@ 2025-01-22 8:23 ` Mingjin Ye
2025-01-22 8:23 ` [PATCH 3/3] net/ice: ACL filter support for IPv4 fragment Mingjin Ye
2025-01-22 11:23 ` [PATCH 0/3] flexible IPv4 fragment action Bruce Richardson
3 siblings, 0 replies; 5+ messages in thread
From: Mingjin Ye @ 2025-01-22 8:23 UTC (permalink / raw)
To: dev; +Cc: Mingjin Ye, Bruce Richardson, Anatoly Burakov
This patch supports enabling masks for IPv4 fragments in FDIR.
Flow rule can be created by the following command:
flow create 0 ingress group 2 pattern eth /
ipv4 fragment_offset spec 0x2000 fragment_offset mask 0x3FFF /
end <actions>
Signed-off-by: Mingjin Ye <mingjinx.ye@intel.com>
---
drivers/net/ice/ice_fdir_filter.c | 15 +++++++++++----
drivers/net/ice/ice_generic_flow.h | 2 ++
2 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ice/ice_fdir_filter.c b/drivers/net/ice/ice_fdir_filter.c
index 406918fed5..247f55118a 100644
--- a/drivers/net/ice/ice_fdir_filter.c
+++ b/drivers/net/ice/ice_fdir_filter.c
@@ -24,7 +24,8 @@
#define ICE_FDIR_INSET_ETH_IPV4 (\
ICE_FDIR_INSET_ETH | \
ICE_INSET_IPV4_SRC | ICE_INSET_IPV4_DST | ICE_INSET_IPV4_TOS | \
- ICE_INSET_IPV4_TTL | ICE_INSET_IPV4_PROTO | ICE_INSET_IPV4_PKID)
+ ICE_INSET_IPV4_TTL | ICE_INSET_IPV4_PROTO | ICE_INSET_IPV4_PKID | \
+ ICE_INSET_IPV4_OFFSET)
#define ICE_FDIR_INSET_ETH_IPV4_UDP (\
ICE_FDIR_INSET_ETH_IPV4 | \
@@ -930,6 +931,7 @@ ice_fdir_input_set_parse(uint64_t inset, enum ice_flow_field *field)
{ICE_INSET_IPV4_TTL, ICE_FLOW_FIELD_IDX_IPV4_TTL},
{ICE_INSET_IPV4_PROTO, ICE_FLOW_FIELD_IDX_IPV4_PROT},
{ICE_INSET_IPV4_PKID, ICE_FLOW_FIELD_IDX_IPV4_ID},
+ {ICE_INSET_IPV4_OFFSET, ICE_FLOW_FIELD_IDX_IPV4_OFFSET},
{ICE_INSET_IPV6_SRC, ICE_FLOW_FIELD_IDX_IPV6_SA},
{ICE_INSET_IPV6_DST, ICE_FLOW_FIELD_IDX_IPV6_DA},
{ICE_INSET_IPV6_TC, ICE_FLOW_FIELD_IDX_IPV6_DSCP},
@@ -2022,7 +2024,8 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
ipv4_last->hdr.next_proto_id ||
ipv4_last->hdr.hdr_checksum ||
ipv4_last->hdr.src_addr ||
- ipv4_last->hdr.dst_addr)) {
+ ipv4_last->hdr.dst_addr ||
+ ipv4_last->hdr.fragment_offset)) {
rte_flow_error_set(error, EINVAL,
RTE_FLOW_ERROR_TYPE_ITEM,
item, "Invalid IPv4 last.");
@@ -2047,19 +2050,23 @@ ice_fdir_parse_pattern(__rte_unused struct ice_adapter *ad,
*input_set |= ICE_INSET_IPV4_PROTO;
if (ipv4_mask->hdr.type_of_service == UINT8_MAX)
*input_set |= ICE_INSET_IPV4_TOS;
+ if ((ipv4_mask->hdr.fragment_offset &
+ rte_cpu_to_be_16(0x1FFF)) != 0)
+ *input_set |= ICE_INSET_IPV4_OFFSET;
p_v4->dst_ip = ipv4_spec->hdr.dst_addr;
p_v4->src_ip = ipv4_spec->hdr.src_addr;
p_v4->ttl = ipv4_spec->hdr.time_to_live;
p_v4->proto = ipv4_spec->hdr.next_proto_id;
p_v4->tos = ipv4_spec->hdr.type_of_service;
+ p_v4->fragment_offset = ipv4_spec->hdr.fragment_offset;
/* fragment Ipv4:
* spec is 0x2000, mask is 0x2000
*/
- if (ipv4_spec->hdr.fragment_offset ==
+ if (ipv4_spec->hdr.fragment_offset &
rte_cpu_to_be_16(RTE_IPV4_HDR_MF_FLAG) &&
- ipv4_mask->hdr.fragment_offset ==
+ ipv4_mask->hdr.fragment_offset &
rte_cpu_to_be_16(RTE_IPV4_HDR_MF_FLAG)) {
/* all IPv4 fragment packet has the same
* ethertype, if the spec and mask is valid,
diff --git a/drivers/net/ice/ice_generic_flow.h b/drivers/net/ice/ice_generic_flow.h
index 391d615b9a..509eb4b705 100644
--- a/drivers/net/ice/ice_generic_flow.h
+++ b/drivers/net/ice/ice_generic_flow.h
@@ -54,6 +54,7 @@
#define ICE_PFCP_SEID BIT_ULL(42)
#define ICE_PFCP_S_FIELD BIT_ULL(41)
#define ICE_IP_PK_ID BIT_ULL(40)
+#define ICE_IP_OFFSET BIT_ULL(39)
/* input set */
@@ -72,6 +73,7 @@
#define ICE_INSET_IPV4_PROTO (ICE_PROT_IPV4 | ICE_IP_PROTO)
#define ICE_INSET_IPV4_TTL (ICE_PROT_IPV4 | ICE_IP_TTL)
#define ICE_INSET_IPV4_PKID (ICE_PROT_IPV4 | ICE_IP_PK_ID)
+#define ICE_INSET_IPV4_OFFSET (ICE_PROT_IPV4 | ICE_IP_OFFSET)
#define ICE_INSET_IPV6_SRC (ICE_PROT_IPV6 | ICE_IP_SRC)
#define ICE_INSET_IPV6_DST (ICE_PROT_IPV6 | ICE_IP_DST)
#define ICE_INSET_IPV6_NEXT_HDR (ICE_PROT_IPV6 | ICE_IP_PROTO)
--
2.25.1
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 3/3] net/ice: ACL filter support for IPv4 fragment
2025-01-22 8:23 [PATCH 0/3] flexible IPv4 fragment action Mingjin Ye
2025-01-22 8:23 ` [PATCH 1/3] net/ice/base: add ipv4 fragment related field Mingjin Ye
2025-01-22 8:23 ` [PATCH 2/3] net/ice: FDIR support IPv4 fragment masks Mingjin Ye
@ 2025-01-22 8:23 ` Mingjin Ye
2025-01-22 11:23 ` [PATCH 0/3] flexible IPv4 fragment action Bruce Richardson
3 siblings, 0 replies; 5+ messages in thread
From: Mingjin Ye @ 2025-01-22 8:23 UTC (permalink / raw)
To: dev; +Cc: Mingjin Ye, Bruce Richardson, Anatoly Burakov
Enable ACL filter on PF. Add support for FRAG_IPV4 pattern and queue
action.
Flow rule can be created by the following command:
flow create 0 ingress group 1 pattern eth /
ipv4 fragment_offset spec 0x2000 fragment_offset mask 0x3FFF /
end actions queue index <queue id> / end
Signed-off-by: Mingjin Ye <mingjinx.ye@intel.com>
---
drivers/net/ice/ice_acl_filter.c | 61 +++++++++++++++++++++++++++++---
drivers/net/ice/ice_ethdev.c | 1 -
2 files changed, 56 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ice/ice_acl_filter.c b/drivers/net/ice/ice_acl_filter.c
index 63a525b363..df2cc01b2d 100644
--- a/drivers/net/ice/ice_acl_filter.c
+++ b/drivers/net/ice/ice_acl_filter.c
@@ -30,7 +30,8 @@
#define ICE_ACL_INSET_ETH_IPV4 ( \
ICE_INSET_SMAC | ICE_INSET_DMAC | \
- ICE_INSET_IPV4_SRC | ICE_INSET_IPV4_DST)
+ ICE_INSET_IPV4_SRC | ICE_INSET_IPV4_DST | \
+ ICE_INSET_IPV4_OFFSET)
#define ICE_ACL_INSET_ETH_IPV4_UDP ( \
ICE_ACL_INSET_ETH_IPV4 | \
ICE_INSET_UDP_SRC_PORT | ICE_INSET_UDP_DST_PORT)
@@ -214,6 +215,7 @@ ice_acl_prof_init(struct ice_pf *pf)
{
struct ice_hw *hw = ICE_PF_TO_HW(pf);
struct ice_flow_prof *prof_ipv4 = NULL;
+ struct ice_flow_prof *prof_ipv4_frag = NULL;
struct ice_flow_prof *prof_ipv4_udp = NULL;
struct ice_flow_prof *prof_ipv4_tcp = NULL;
struct ice_flow_prof *prof_ipv4_sctp = NULL;
@@ -234,6 +236,15 @@ ice_acl_prof_init(struct ice_pf *pf)
if (ret)
goto err_add_prof;
+ ice_memset(seg, 0, sizeof(*seg), ICE_NONDMA_MEM);
+ ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_IPV_FRAG);
+ acl_add_prof_prepare(hw, seg, false, 0, 0);
+ ret = ice_flow_add_prof(hw, ICE_BLK_ACL, ICE_FLOW_RX,
+ ICE_FLTR_PTYPE_FRAG_IPV4,
+ seg, 1, NULL, 0, &prof_ipv4_frag);
+ if (ret)
+ goto err_add_prof_ipv4_udp_frag;
+
ice_memset(seg, 0, sizeof(*seg), ICE_NONDMA_MEM);
ICE_FLOW_SET_HDRS(seg, ICE_FLOW_SEG_HDR_UDP | ICE_FLOW_SEG_HDR_IPV4);
acl_add_prof_prepare(hw, seg, true,
@@ -272,6 +283,10 @@ ice_acl_prof_init(struct ice_pf *pf)
if (ret)
goto err_assoc_prof;
+ ret = ice_flow_assoc_prof(hw, ICE_BLK_ACL, prof_ipv4_frag, i);
+ if (ret)
+ goto err_assoc_prof;
+
ret = ice_flow_assoc_prof(hw, ICE_BLK_ACL, prof_ipv4_udp, i);
if (ret)
goto err_assoc_prof;
@@ -293,6 +308,8 @@ ice_acl_prof_init(struct ice_pf *pf)
err_add_prof_ipv4_tcp:
ice_flow_rem_prof(hw, ICE_BLK_ACL, ICE_FLTR_PTYPE_NONF_IPV4_UDP);
err_add_prof_ipv4_udp:
+ ice_flow_rem_prof(hw, ICE_BLK_ACL, ICE_FLTR_PTYPE_FRAG_IPV4);
+err_add_prof_ipv4_udp_frag:
ice_flow_rem_prof(hw, ICE_BLK_ACL, ICE_FLTR_PTYPE_NONF_IPV4_OTHER);
err_add_prof:
ice_free(hw, seg);
@@ -353,6 +370,7 @@ ice_acl_set_input_set(struct ice_acl_conf *filter, struct ice_fdir_fltr *input)
ICE_NONDMA_TO_NONDMA);
break;
+ case ICE_FLTR_PTYPE_FRAG_IPV4:
case ICE_FLTR_PTYPE_NONF_IPV4_OTHER:
ice_memcpy(&input->ip.v4, &filter->input.ip.v4,
sizeof(struct ice_fdir_v4),
@@ -519,6 +537,12 @@ ice_acl_create_filter(struct ice_adapter *ad,
acts[0].data.acl_act.mdid = ICE_MDID_RX_PKT_DROP;
acts[0].data.acl_act.prio = 0x3;
acts[0].data.acl_act.value = CPU_TO_LE16(0x1);
+ } else if (filter->input.dest_ctl ==
+ ICE_FLTR_PRGM_DESC_DEST_DIRECT_PKT_QINDEX) {
+ acts[0].type = ICE_FLOW_ACT_FWD_QUEUE;
+ acts[0].data.acl_act.mdid = ICE_MDID_RX_DST_Q;
+ acts[0].data.acl_act.prio = 0x3;
+ acts[0].data.acl_act.value = CPU_TO_LE16(input->q_index);
}
input->acl_fltr = true;
@@ -531,7 +555,8 @@ ice_acl_create_filter(struct ice_adapter *ad,
return ret;
}
- if (flow_type == ICE_FLTR_PTYPE_NONF_IPV4_OTHER) {
+ if (flow_type == ICE_FLTR_PTYPE_NONF_IPV4_OTHER ||
+ flow_type == ICE_FLTR_PTYPE_FRAG_IPV4) {
ret = ice_acl_hw_set_conf(pf, input, acts, rule,
ICE_FLTR_PTYPE_NONF_IPV4_UDP, 1);
if (ret)
@@ -576,6 +601,7 @@ ice_acl_destroy_filter(struct ice_adapter *ad,
int ret = 0;
switch (rule->flow_type) {
+ case ICE_FLTR_PTYPE_FRAG_IPV4:
case ICE_FLTR_PTYPE_NONF_IPV4_OTHER:
for (i = 0; i < 4; i++) {
entry_id = rule->entry_id[i];
@@ -617,6 +643,8 @@ ice_acl_parse_action(__rte_unused struct ice_adapter *ad,
struct rte_flow_error *error,
struct ice_acl_conf *filter)
{
+ struct ice_pf *pf = &ad->pf;
+ const struct rte_flow_action_queue *act_q;
uint32_t dest_num = 0;
for (; actions->type != RTE_FLOW_ACTION_TYPE_END; actions++) {
@@ -629,6 +657,22 @@ ice_acl_parse_action(__rte_unused struct ice_adapter *ad,
filter->input.dest_ctl =
ICE_FLTR_PRGM_DESC_DEST_DROP_PKT;
break;
+ case RTE_FLOW_ACTION_TYPE_QUEUE:
+ dest_num++;
+
+ act_q = actions->conf;
+ filter->input.q_index = act_q->index;
+ if (filter->input.q_index >=
+ pf->dev_data->nb_rx_queues) {
+ rte_flow_error_set(error, EINVAL,
+ RTE_FLOW_ERROR_TYPE_ACTION,
+ actions,
+ "Invalid queue for FDIR.");
+ return -rte_errno;
+ }
+ filter->input.dest_ctl =
+ ICE_FLTR_PRGM_DESC_DEST_DIRECT_PKT_QINDEX;
+ break;
default:
rte_flow_error_set(error, EINVAL,
RTE_FLOW_ERROR_TYPE_ACTION, actions,
@@ -713,12 +757,12 @@ ice_acl_parse_pattern(__rte_unused struct ice_adapter *ad,
ipv4_spec = item->spec;
ipv4_mask = item->mask;
+ flow_type = ICE_FLTR_PTYPE_NONF_IPV4_OTHER;
if (ipv4_spec && ipv4_mask) {
/* Check IPv4 mask and update input set */
if (ipv4_mask->hdr.version_ihl ||
ipv4_mask->hdr.total_length ||
ipv4_mask->hdr.packet_id ||
- ipv4_mask->hdr.fragment_offset ||
ipv4_mask->hdr.hdr_checksum) {
rte_flow_error_set(error, EINVAL,
RTE_FLOW_ERROR_TYPE_ITEM,
@@ -753,9 +797,16 @@ ice_acl_parse_pattern(__rte_unused struct ice_adapter *ad,
input_set |= ICE_INSET_IPV4_DST;
}
- }
- flow_type = ICE_FLTR_PTYPE_NONF_IPV4_OTHER;
+ if (ipv4_mask->hdr.fragment_offset) {
+ filter->input.ip.v4.fragment_offset =
+ ipv4_spec->hdr.fragment_offset;
+ filter->input.mask.v4.fragment_offset =
+ ipv4_mask->hdr.fragment_offset;
+ flow_type = ICE_FLTR_PTYPE_FRAG_IPV4;
+ input_set |= ICE_INSET_IPV4_OFFSET;
+ }
+ }
break;
case RTE_FLOW_ITEM_TYPE_TCP:
tcp_spec = item->spec;
diff --git a/drivers/net/ice/ice_ethdev.c b/drivers/net/ice/ice_ethdev.c
index 93a6308a86..a57bcaf36e 100644
--- a/drivers/net/ice/ice_ethdev.c
+++ b/drivers/net/ice/ice_ethdev.c
@@ -2684,7 +2684,6 @@ ice_dev_init(struct rte_eth_dev *dev)
}
if (!ad->is_safe_mode) {
- ad->disabled_engine_mask |= BIT(ICE_FLOW_ENGINE_ACL);
ret = ice_flow_init(ad);
if (ret) {
PMD_INIT_LOG(ERR, "Failed to initialize flow");
--
2.25.1
^ permalink raw reply [flat|nested] 5+ messages in thread