[PATCH 12/20] net/cnxk: fix inline device RQ tag mask

[PATCH 12/20] net/cnxk: fix inline device RQ tag mask

[Nithin Dabilpuram]

Fix inline device rq tagmask to get packets with receive errors
as type ETHDEV packets to callback handler so that packet buffers
can get freed. Currently only ipsec denied packets get the right
tag mask.

Fixes: ee48f711f3b0 ("common/cnxk: support NIX inline inbound and outbound setup")
Cc: stable@dpdk.org

Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
---
 drivers/common/cnxk/roc_nix_inl.c | 2 +-
 drivers/net/cnxk/cnxk_ethdev.c    | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/common/cnxk/roc_nix_inl.c b/drivers/common/cnxk/roc_nix_inl.c
index 003f972..11a1691 100644
--- a/drivers/common/cnxk/roc_nix_inl.c
+++ b/drivers/common/cnxk/roc_nix_inl.c
@@ -584,7 +584,7 @@ roc_nix_inl_dev_rq_get(struct roc_nix_rq *rq)
 
 	inl_rq->flow_tag_width = 20;
 	/* Special tag mask */
-	inl_rq->tag_mask = 0xFFF00000;
+	inl_rq->tag_mask = rq->tag_mask;
 	inl_rq->tt = SSO_TT_ORDERED;
 	inl_rq->hwgrp = 0;
 	inl_rq->wqe_skip = inl_dev->wqe_skip;
diff --git a/drivers/net/cnxk/cnxk_ethdev.c b/drivers/net/cnxk/cnxk_ethdev.c
index 53dfb5e..9ede66e 100644
--- a/drivers/net/cnxk/cnxk_ethdev.c
+++ b/drivers/net/cnxk/cnxk_ethdev.c
@@ -3,6 +3,8 @@
  */
 #include <cnxk_ethdev.h>
 
+#include <rte_eventdev.h>
+
 static inline uint64_t
 nix_get_rx_offload_capa(struct cnxk_eth_dev *dev)
 {
@@ -597,6 +599,13 @@ cnxk_nix_rx_queue_setup(struct rte_eth_dev *eth_dev, uint16_t qid,
 	rxq_sp->qconf.mp = mp;
 
 	if (dev->rx_offloads & RTE_ETH_RX_OFFLOAD_SECURITY) {
+		/* Pass a tagmask used to handle error packets in inline device.
+		 * Ethdev rq's tag_mask field will be overwritten later
+		 * when sso is setup.
+		 */
+		rq->tag_mask =
+			0x0FF00000 | ((uint32_t)RTE_EVENT_TYPE_ETHDEV << 28);
+
 		/* Setup rq reference for inline dev if present */
 		rc = roc_nix_inl_dev_rq_get(rq);
 		if (rc)
-- 
2.8.4

[PATCH 13/20] net/cnxk: register callback early to handle initial packets

[Nithin Dabilpuram]

Register callback early to handle initial error packets from
inline device.

Fixes: 69daa9e5022b ("net/cnxk: support inline security setup for cn10k")
Cc: stable@dpdk.org

Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
---
 drivers/net/cnxk/cn10k_ethdev.c     | 6 ++++++
 drivers/net/cnxk/cn10k_ethdev.h     | 3 +++
 drivers/net/cnxk/cn10k_ethdev_sec.c | 5 +----
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/net/cnxk/cn10k_ethdev.c b/drivers/net/cnxk/cn10k_ethdev.c
index 169e70e..af4fa75 100644
--- a/drivers/net/cnxk/cn10k_ethdev.c
+++ b/drivers/net/cnxk/cn10k_ethdev.c
@@ -316,6 +316,12 @@ cn10k_nix_configure(struct rte_eth_dev *eth_dev)
 	if (rc)
 		return rc;
 
+	if (dev->tx_offloads & RTE_ETH_TX_OFFLOAD_SECURITY ||
+	    dev->rx_offloads & RTE_ETH_RX_OFFLOAD_SECURITY) {
+		/* Register callback to handle security error work */
+		roc_nix_inl_cb_register(cn10k_eth_sec_sso_work_cb, NULL);
+	}
+
 	/* Update offload flags */
 	dev->rx_offload_flags = nix_rx_offload_flags(eth_dev);
 	dev->tx_offload_flags = nix_tx_offload_flags(eth_dev);
diff --git a/drivers/net/cnxk/cn10k_ethdev.h b/drivers/net/cnxk/cn10k_ethdev.h
index 0982158..13403e1 100644
--- a/drivers/net/cnxk/cn10k_ethdev.h
+++ b/drivers/net/cnxk/cn10k_ethdev.h
@@ -82,6 +82,9 @@ void cn10k_eth_set_tx_function(struct rte_eth_dev *eth_dev);
 /* Security context setup */
 void cn10k_eth_sec_ops_override(void);
 
+/* SSO Work callback */
+void cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args);
+
 #define LMT_OFF(lmt_addr, lmt_num, offset)                                     \
 	(void *)((uintptr_t)(lmt_addr) +                                       \
 		 ((uint64_t)(lmt_num) << ROC_LMT_LINE_SIZE_LOG2) + (offset))
diff --git a/drivers/net/cnxk/cn10k_ethdev_sec.c b/drivers/net/cnxk/cn10k_ethdev_sec.c
index 6fbf444..ac45056 100644
--- a/drivers/net/cnxk/cn10k_ethdev_sec.c
+++ b/drivers/net/cnxk/cn10k_ethdev_sec.c
@@ -138,7 +138,7 @@ static const struct rte_security_capability cn10k_eth_sec_capabilities[] = {
 	}
 };
 
-static void
+void
 cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args)
 {
 	struct rte_eth_event_ipsec_desc desc;
@@ -251,9 +251,6 @@ cn10k_eth_sec_session_create(void *device,
 	if (rte_security_dynfield_register() < 0)
 		return -ENOTSUP;
 
-	if (rte_eal_process_type() == RTE_PROC_PRIMARY)
-		roc_nix_inl_cb_register(cn10k_eth_sec_sso_work_cb, NULL);
-
 	ipsec = &conf->ipsec;
 	crypto = conf->crypto_xform;
 	inbound = !!(ipsec->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS);
-- 
2.8.4

[PATCH 15/20] net/cnxk: use raw mbuf free on inline sec err

[Nithin Dabilpuram]

Use raw mbuf free on inline sec error to simulate
HW NPA free instead of doing rte_pktmbuf_free(). This
is needed as the callback will not be called from
DPDK lcore.

Fixes: 69daa9e5022b ("net/cnxk: support inline security setup for cn10k")
Cc: stable@dpdk.org

Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
---
 drivers/net/cnxk/cn10k_ethdev_sec.c | 37 ++++++++++++++++++++++++++++++++-----
 1 file changed, 32 insertions(+), 5 deletions(-)

diff --git a/drivers/net/cnxk/cn10k_ethdev_sec.c b/drivers/net/cnxk/cn10k_ethdev_sec.c
index ac45056..044b20c 100644
--- a/drivers/net/cnxk/cn10k_ethdev_sec.c
+++ b/drivers/net/cnxk/cn10k_ethdev_sec.c
@@ -138,6 +138,20 @@ static const struct rte_security_capability cn10k_eth_sec_capabilities[] = {
 	}
 };
 
+static inline void
+cnxk_pktmbuf_free_no_cache(struct rte_mbuf *mbuf)
+{
+	struct rte_mbuf *next;
+
+	if (!mbuf)
+		return;
+	do {
+		next = mbuf->next;
+		roc_npa_aura_op_free(mbuf->pool->pool_id, 1, (rte_iova_t)mbuf);
+		mbuf = next;
+	} while (mbuf != NULL);
+}
+
 void
 cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args)
 {
@@ -148,6 +162,7 @@ cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args)
 	struct cpt_cn10k_res_s *res;
 	struct rte_eth_dev *eth_dev;
 	struct cnxk_eth_dev *dev;
+	static uint64_t warn_cnt;
 	uint16_t dlen_adj, rlen;
 	struct rte_mbuf *mbuf;
 	uintptr_t sa_base;
@@ -161,7 +176,7 @@ cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args)
 		/* Event from inbound inline dev due to IPSEC packet bad L4 */
 		mbuf = (struct rte_mbuf *)(gw[1] - sizeof(struct rte_mbuf));
 		plt_nix_dbg("Received mbuf %p from inline dev inbound", mbuf);
-		rte_pktmbuf_free(mbuf);
+		cnxk_pktmbuf_free_no_cache(mbuf);
 		return;
 	case RTE_EVENT_TYPE_CPU:
 		/* Check for subtype */
@@ -212,17 +227,29 @@ cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args)
 	case ROC_IE_OT_UCC_ERR_SA_OVERFLOW:
 		desc.subtype = RTE_ETH_EVENT_IPSEC_ESN_OVERFLOW;
 		break;
+	case ROC_IE_OT_UCC_ERR_PKT_IP:
+		warn_cnt++;
+		if (warn_cnt % 10000 == 0)
+			plt_warn("Outbound error, bad ip pkt, mbuf %p,"
+				 " sa_index %u (total warnings %" PRIu64 ")",
+				 mbuf, sess_priv.sa_idx, warn_cnt);
+		desc.subtype = RTE_ETH_EVENT_IPSEC_UNKNOWN;
+		break;
 	default:
-		plt_warn("Outbound error, mbuf %p, sa_index %u, "
-			 "compcode %x uc %x", mbuf, sess_priv.sa_idx,
-			 res->compcode, res->uc_compcode);
+		warn_cnt++;
+		if (warn_cnt % 10000 == 0)
+			plt_warn("Outbound error, mbuf %p, sa_index %u,"
+				 " compcode %x uc %x,"
+				 " (total warnings %" PRIu64 ")",
+				 mbuf, sess_priv.sa_idx, res->compcode,
+				 res->uc_compcode, warn_cnt);
 		desc.subtype = RTE_ETH_EVENT_IPSEC_UNKNOWN;
 		break;
 	}
 
 	desc.metadata = (uint64_t)priv->userdata;
 	rte_eth_dev_callback_process(eth_dev, RTE_ETH_EVENT_IPSEC, &desc);
-	rte_pktmbuf_free(mbuf);
+	cnxk_pktmbuf_free_no_cache(mbuf);
 }
 
 static int
-- 
2.8.4

Re: [PATCH 15/20] net/cnxk: use raw mbuf free on inline sec err

[Jerin Jacob]

On Mon, Feb 7, 2022 at 1:01 PM Nithin Dabilpuram
<ndabilpuram@marvell.com> wrote:

You could change the subject as net/cnxk: fix inline IPsec security
error handling

>
> Use raw mbuf free on inline sec error to simulate

sec- > security

> HW NPA free instead of doing rte_pktmbuf_free(). This
> is needed as the callback will not be called from
> DPDK lcore.
>
> Fixes: 69daa9e5022b ("net/cnxk: support inline security setup for cn10k")
> Cc: stable@dpdk.org
>
> Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
> ---
>  drivers/net/cnxk/cn10k_ethdev_sec.c | 37 ++++++++++++++++++++++++++++++++-----
>  1 file changed, 32 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/net/cnxk/cn10k_ethdev_sec.c b/drivers/net/cnxk/cn10k_ethdev_sec.c
> index ac45056..044b20c 100644
> --- a/drivers/net/cnxk/cn10k_ethdev_sec.c
> +++ b/drivers/net/cnxk/cn10k_ethdev_sec.c
> @@ -138,6 +138,20 @@ static const struct rte_security_capability cn10k_eth_sec_capabilities[] = {
>         }
>  };
>
> +static inline void
> +cnxk_pktmbuf_free_no_cache(struct rte_mbuf *mbuf)
> +{
> +       struct rte_mbuf *next;
> +
> +       if (!mbuf)
> +               return;
> +       do {
> +               next = mbuf->next;
> +               roc_npa_aura_op_free(mbuf->pool->pool_id, 1, (rte_iova_t)mbuf);
> +               mbuf = next;
> +       } while (mbuf != NULL);
> +}
> +
>  void
>  cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args)
>  {
> @@ -148,6 +162,7 @@ cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args)
>         struct cpt_cn10k_res_s *res;
>         struct rte_eth_dev *eth_dev;
>         struct cnxk_eth_dev *dev;
> +       static uint64_t warn_cnt;
>         uint16_t dlen_adj, rlen;
>         struct rte_mbuf *mbuf;
>         uintptr_t sa_base;
> @@ -161,7 +176,7 @@ cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args)
>                 /* Event from inbound inline dev due to IPSEC packet bad L4 */
>                 mbuf = (struct rte_mbuf *)(gw[1] - sizeof(struct rte_mbuf));
>                 plt_nix_dbg("Received mbuf %p from inline dev inbound", mbuf);
> -               rte_pktmbuf_free(mbuf);
> +               cnxk_pktmbuf_free_no_cache(mbuf);
>                 return;
>         case RTE_EVENT_TYPE_CPU:
>                 /* Check for subtype */
> @@ -212,17 +227,29 @@ cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args)
>         case ROC_IE_OT_UCC_ERR_SA_OVERFLOW:
>                 desc.subtype = RTE_ETH_EVENT_IPSEC_ESN_OVERFLOW;
>                 break;
> +       case ROC_IE_OT_UCC_ERR_PKT_IP:
> +               warn_cnt++;
> +               if (warn_cnt % 10000 == 0)
> +                       plt_warn("Outbound error, bad ip pkt, mbuf %p,"
> +                                " sa_index %u (total warnings %" PRIu64 ")",
> +                                mbuf, sess_priv.sa_idx, warn_cnt);
> +               desc.subtype = RTE_ETH_EVENT_IPSEC_UNKNOWN;
> +               break;
>         default:
> -               plt_warn("Outbound error, mbuf %p, sa_index %u, "
> -                        "compcode %x uc %x", mbuf, sess_priv.sa_idx,
> -                        res->compcode, res->uc_compcode);
> +               warn_cnt++;
> +               if (warn_cnt % 10000 == 0)
> +                       plt_warn("Outbound error, mbuf %p, sa_index %u,"
> +                                " compcode %x uc %x,"
> +                                " (total warnings %" PRIu64 ")",
> +                                mbuf, sess_priv.sa_idx, res->compcode,
> +                                res->uc_compcode, warn_cnt);
>                 desc.subtype = RTE_ETH_EVENT_IPSEC_UNKNOWN;
>                 break;
>         }
>
>         desc.metadata = (uint64_t)priv->userdata;
>         rte_eth_dev_callback_process(eth_dev, RTE_ETH_EVENT_IPSEC, &desc);
> -       rte_pktmbuf_free(mbuf);
> +       cnxk_pktmbuf_free_no_cache(mbuf);
>  }
>
>  static int
> --
> 2.8.4
>

[PATCH v2 12/21] net/cnxk: fix inline device RQ tag mask

[Nithin Dabilpuram]

Fix inline device rq tagmask to get packets with receive errors
as type ETHDEV packets to callback handler so that packet buffers
can get freed. Currently only ipsec denied packets get the right
tag mask.

Fixes: ee48f711f3b0 ("common/cnxk: support NIX inline inbound and outbound setup")
Cc: stable@dpdk.org

Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
---
 drivers/common/cnxk/roc_nix_inl.c | 2 +-
 drivers/net/cnxk/cnxk_ethdev.c    | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/common/cnxk/roc_nix_inl.c b/drivers/common/cnxk/roc_nix_inl.c
index 003f972..11a1691 100644
--- a/drivers/common/cnxk/roc_nix_inl.c
+++ b/drivers/common/cnxk/roc_nix_inl.c
@@ -584,7 +584,7 @@ roc_nix_inl_dev_rq_get(struct roc_nix_rq *rq)
 
 	inl_rq->flow_tag_width = 20;
 	/* Special tag mask */
-	inl_rq->tag_mask = 0xFFF00000;
+	inl_rq->tag_mask = rq->tag_mask;
 	inl_rq->tt = SSO_TT_ORDERED;
 	inl_rq->hwgrp = 0;
 	inl_rq->wqe_skip = inl_dev->wqe_skip;
diff --git a/drivers/net/cnxk/cnxk_ethdev.c b/drivers/net/cnxk/cnxk_ethdev.c
index 3468aab..b272ede 100644
--- a/drivers/net/cnxk/cnxk_ethdev.c
+++ b/drivers/net/cnxk/cnxk_ethdev.c
@@ -3,6 +3,8 @@
  */
 #include <cnxk_ethdev.h>
 
+#include <rte_eventdev.h>
+
 static inline uint64_t
 nix_get_rx_offload_capa(struct cnxk_eth_dev *dev)
 {
@@ -597,6 +599,13 @@ cnxk_nix_rx_queue_setup(struct rte_eth_dev *eth_dev, uint16_t qid,
 	rxq_sp->qconf.mp = mp;
 
 	if (dev->rx_offloads & RTE_ETH_RX_OFFLOAD_SECURITY) {
+		/* Pass a tagmask used to handle error packets in inline device.
+		 * Ethdev rq's tag_mask field will be overwritten later
+		 * when sso is setup.
+		 */
+		rq->tag_mask =
+			0x0FF00000 | ((uint32_t)RTE_EVENT_TYPE_ETHDEV << 28);
+
 		/* Setup rq reference for inline dev if present */
 		rc = roc_nix_inl_dev_rq_get(rq);
 		if (rc)
-- 
2.8.4

[PATCH v2 13/21] net/cnxk: register callback early to handle initial packets

[Nithin Dabilpuram]

Register callback early to handle initial error packets from
inline device.

Fixes: 69daa9e5022b ("net/cnxk: support inline security setup for cn10k")
Cc: stable@dpdk.org

Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
---
 drivers/net/cnxk/cn10k_ethdev.c     | 6 ++++++
 drivers/net/cnxk/cn10k_ethdev.h     | 3 +++
 drivers/net/cnxk/cn10k_ethdev_sec.c | 5 +----
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/net/cnxk/cn10k_ethdev.c b/drivers/net/cnxk/cn10k_ethdev.c
index 6bf8275..e47e04d 100644
--- a/drivers/net/cnxk/cn10k_ethdev.c
+++ b/drivers/net/cnxk/cn10k_ethdev.c
@@ -294,6 +294,12 @@ cn10k_nix_configure(struct rte_eth_dev *eth_dev)
 	if (rc)
 		return rc;
 
+	if (dev->tx_offloads & RTE_ETH_TX_OFFLOAD_SECURITY ||
+	    dev->rx_offloads & RTE_ETH_RX_OFFLOAD_SECURITY) {
+		/* Register callback to handle security error work */
+		roc_nix_inl_cb_register(cn10k_eth_sec_sso_work_cb, NULL);
+	}
+
 	/* Update offload flags */
 	dev->rx_offload_flags = nix_rx_offload_flags(eth_dev);
 	dev->tx_offload_flags = nix_tx_offload_flags(eth_dev);
diff --git a/drivers/net/cnxk/cn10k_ethdev.h b/drivers/net/cnxk/cn10k_ethdev.h
index ec40e53..fd72730 100644
--- a/drivers/net/cnxk/cn10k_ethdev.h
+++ b/drivers/net/cnxk/cn10k_ethdev.h
@@ -81,6 +81,9 @@ void cn10k_eth_set_tx_function(struct rte_eth_dev *eth_dev);
 /* Security context setup */
 void cn10k_eth_sec_ops_override(void);
 
+/* SSO Work callback */
+void cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args);
+
 #define LMT_OFF(lmt_addr, lmt_num, offset)                                     \
 	(void *)((uintptr_t)(lmt_addr) +                                       \
 		 ((uint64_t)(lmt_num) << ROC_LMT_LINE_SIZE_LOG2) + (offset))
diff --git a/drivers/net/cnxk/cn10k_ethdev_sec.c b/drivers/net/cnxk/cn10k_ethdev_sec.c
index 6fbf444..ac45056 100644
--- a/drivers/net/cnxk/cn10k_ethdev_sec.c
+++ b/drivers/net/cnxk/cn10k_ethdev_sec.c
@@ -138,7 +138,7 @@ static const struct rte_security_capability cn10k_eth_sec_capabilities[] = {
 	}
 };
 
-static void
+void
 cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args)
 {
 	struct rte_eth_event_ipsec_desc desc;
@@ -251,9 +251,6 @@ cn10k_eth_sec_session_create(void *device,
 	if (rte_security_dynfield_register() < 0)
 		return -ENOTSUP;
 
-	if (rte_eal_process_type() == RTE_PROC_PRIMARY)
-		roc_nix_inl_cb_register(cn10k_eth_sec_sso_work_cb, NULL);
-
 	ipsec = &conf->ipsec;
 	crypto = conf->crypto_xform;
 	inbound = !!(ipsec->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS);
-- 
2.8.4

[PATCH v2 15/21] net/cnxk: fix inline IPsec security error handling

[Nithin Dabilpuram]

Use raw mbuf free on inline security error to simulate
HW NPA free instead of doing rte_pktmbuf_free(). This
is needed as the callback will not be called from
DPDK lcore.

Fixes: 69daa9e5022b ("net/cnxk: support inline security setup for cn10k")
Cc: stable@dpdk.org

Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
---
 drivers/net/cnxk/cn10k_ethdev_sec.c | 37 ++++++++++++++++++++++++++++++++-----
 1 file changed, 32 insertions(+), 5 deletions(-)

diff --git a/drivers/net/cnxk/cn10k_ethdev_sec.c b/drivers/net/cnxk/cn10k_ethdev_sec.c
index ac45056..044b20c 100644
--- a/drivers/net/cnxk/cn10k_ethdev_sec.c
+++ b/drivers/net/cnxk/cn10k_ethdev_sec.c
@@ -138,6 +138,20 @@ static const struct rte_security_capability cn10k_eth_sec_capabilities[] = {
 	}
 };
 
+static inline void
+cnxk_pktmbuf_free_no_cache(struct rte_mbuf *mbuf)
+{
+	struct rte_mbuf *next;
+
+	if (!mbuf)
+		return;
+	do {
+		next = mbuf->next;
+		roc_npa_aura_op_free(mbuf->pool->pool_id, 1, (rte_iova_t)mbuf);
+		mbuf = next;
+	} while (mbuf != NULL);
+}
+
 void
 cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args)
 {
@@ -148,6 +162,7 @@ cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args)
 	struct cpt_cn10k_res_s *res;
 	struct rte_eth_dev *eth_dev;
 	struct cnxk_eth_dev *dev;
+	static uint64_t warn_cnt;
 	uint16_t dlen_adj, rlen;
 	struct rte_mbuf *mbuf;
 	uintptr_t sa_base;
@@ -161,7 +176,7 @@ cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args)
 		/* Event from inbound inline dev due to IPSEC packet bad L4 */
 		mbuf = (struct rte_mbuf *)(gw[1] - sizeof(struct rte_mbuf));
 		plt_nix_dbg("Received mbuf %p from inline dev inbound", mbuf);
-		rte_pktmbuf_free(mbuf);
+		cnxk_pktmbuf_free_no_cache(mbuf);
 		return;
 	case RTE_EVENT_TYPE_CPU:
 		/* Check for subtype */
@@ -212,17 +227,29 @@ cn10k_eth_sec_sso_work_cb(uint64_t *gw, void *args)
 	case ROC_IE_OT_UCC_ERR_SA_OVERFLOW:
 		desc.subtype = RTE_ETH_EVENT_IPSEC_ESN_OVERFLOW;
 		break;
+	case ROC_IE_OT_UCC_ERR_PKT_IP:
+		warn_cnt++;
+		if (warn_cnt % 10000 == 0)
+			plt_warn("Outbound error, bad ip pkt, mbuf %p,"
+				 " sa_index %u (total warnings %" PRIu64 ")",
+				 mbuf, sess_priv.sa_idx, warn_cnt);
+		desc.subtype = RTE_ETH_EVENT_IPSEC_UNKNOWN;
+		break;
 	default:
-		plt_warn("Outbound error, mbuf %p, sa_index %u, "
-			 "compcode %x uc %x", mbuf, sess_priv.sa_idx,
-			 res->compcode, res->uc_compcode);
+		warn_cnt++;
+		if (warn_cnt % 10000 == 0)
+			plt_warn("Outbound error, mbuf %p, sa_index %u,"
+				 " compcode %x uc %x,"
+				 " (total warnings %" PRIu64 ")",
+				 mbuf, sess_priv.sa_idx, res->compcode,
+				 res->uc_compcode, warn_cnt);
 		desc.subtype = RTE_ETH_EVENT_IPSEC_UNKNOWN;
 		break;
 	}
 
 	desc.metadata = (uint64_t)priv->userdata;
 	rte_eth_dev_callback_process(eth_dev, RTE_ETH_EVENT_IPSEC, &desc);
-	rte_pktmbuf_free(mbuf);
+	cnxk_pktmbuf_free_no_cache(mbuf);
 }
 
 static int
-- 
2.8.4