[PATCH 19/20] net/cnxk: add dev args for min-max spi

[Nithin Dabilpuram <ndabilpuram@marvell.com>]

Add support for inline inbound SPI range via devargs
instead of just max SPI value and range being 0..max.

Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
---
 doc/guides/nics/cnxk.rst               | 28 +++++++++++++-
 drivers/common/cnxk/roc_nix.h          |  5 ++-
 drivers/common/cnxk/roc_nix_inl.c      | 68 ++++++++++++++++++++--------------
 drivers/common/cnxk/roc_nix_inl.h      |  8 ++--
 drivers/common/cnxk/roc_nix_inl_dev.c  | 22 +++++++----
 drivers/common/cnxk/roc_nix_inl_priv.h |  4 +-
 drivers/common/cnxk/roc_nix_priv.h     |  1 +
 drivers/common/cnxk/version.map        |  2 +-
 drivers/net/cnxk/cn10k_ethdev_sec.c    | 13 +++++--
 drivers/net/cnxk/cn9k_ethdev_sec.c     | 10 +++--
 drivers/net/cnxk/cnxk_ethdev_devargs.c | 25 +++++++++----
 drivers/net/cnxk/cnxk_ethdev_sec.c     | 16 ++++++--
 drivers/net/cnxk/cnxk_lookup.c         |  3 +-
 13 files changed, 142 insertions(+), 63 deletions(-)

diff --git a/doc/guides/nics/cnxk.rst b/doc/guides/nics/cnxk.rst
index 27a9420..e7c5ea5 100644
--- a/doc/guides/nics/cnxk.rst
+++ b/doc/guides/nics/cnxk.rst
@@ -214,6 +214,18 @@ Runtime Config Options
 
       -a 0002:02:00.0,tag_as_xor=1
 
+- ``Min SPI for inbound inline IPsec`` (default ``0``)
+
+   Min SPI supported for inbound inline IPsec processing can be specified by
+   ``ipsec_in_min_spi`` ``devargs`` parameter.
+
+   For example::
+
+      -a 0002:02:00.0,ipsec_in_min_spi=6
+
+   With the above configuration, application can enable inline IPsec processing
+   for inbound SA with min SPI of 6.
+
 - ``Max SPI for inbound inline IPsec`` (default ``255``)
 
    Max SPI supported for inbound inline IPsec processing can be specified by
@@ -224,7 +236,7 @@ Runtime Config Options
       -a 0002:02:00.0,ipsec_in_max_spi=128
 
    With the above configuration, application can enable inline IPsec processing
-   for 128 inbound SAs (SPI 0-127).
+   with max SPI of 128.
 
 - ``Max SA's for outbound inline IPsec`` (default ``4096``)
 
@@ -413,6 +425,18 @@ VF ``177D:A0F1``.
 Runtime Config Options for inline device
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
+- ``Min SPI for inbound inline IPsec`` (default ``0``)
+
+   Min SPI supported for inbound inline IPsec processing can be specified by
+   ``ipsec_in_min_spi`` ``devargs`` parameter.
+
+   For example::
+
+      -a 0002:1d:00.0,ipsec_in_min_spi=6
+
+   With the above configuration, application can enable inline IPsec processing
+   for inbound SA with min SPI of 6 for traffic aggregated on inline device.
+
 - ``Max SPI for inbound inline IPsec`` (default ``255``)
 
    Max SPI supported for inbound inline IPsec processing can be specified by
@@ -423,7 +447,7 @@ Runtime Config Options for inline device
       -a 0002:1d:00.0,ipsec_in_max_spi=128
 
    With the above configuration, application can enable inline IPsec processing
-   for 128 inbound SAs (SPI 0-127) for traffic aggregated on inline device.
+   for inbound SA with max SPI of 128 for traffic aggregated on inline device.
 
 
 Debugging Options
diff --git a/drivers/common/cnxk/roc_nix.h b/drivers/common/cnxk/roc_nix.h
index 57a595f..ea58e06 100644
--- a/drivers/common/cnxk/roc_nix.h
+++ b/drivers/common/cnxk/roc_nix.h
@@ -384,8 +384,9 @@ struct roc_nix {
 	uint8_t lock_rx_ctx;
 	uint32_t outb_nb_desc;
 	uint16_t outb_nb_crypto_qs;
-	uint16_t ipsec_in_max_spi;
-	uint16_t ipsec_out_max_sa;
+	uint32_t ipsec_in_min_spi;
+	uint32_t ipsec_in_max_spi;
+	uint32_t ipsec_out_max_sa;
 	bool ipsec_out_sso_pffunc;
 	/* End of input parameters */
 	/* LMT line base for "Per Core Tx LMT line" mode*/
diff --git a/drivers/common/cnxk/roc_nix_inl.c b/drivers/common/cnxk/roc_nix_inl.c
index 11a1691..7bf89a4 100644
--- a/drivers/common/cnxk/roc_nix_inl.c
+++ b/drivers/common/cnxk/roc_nix_inl.c
@@ -19,12 +19,16 @@ PLT_STATIC_ASSERT(ROC_NIX_INL_OT_IPSEC_OUTB_SA_SZ ==
 static int
 nix_inl_inb_sa_tbl_setup(struct roc_nix *roc_nix)
 {
-	uint16_t ipsec_in_max_spi = roc_nix->ipsec_in_max_spi;
+	uint32_t ipsec_in_min_spi = roc_nix->ipsec_in_min_spi;
+	uint32_t ipsec_in_max_spi = roc_nix->ipsec_in_max_spi;
 	struct nix *nix = roc_nix_to_nix_priv(roc_nix);
 	struct roc_nix_ipsec_cfg cfg;
+	uint64_t max_sa, i;
 	size_t inb_sa_sz;
-	int rc, i;
 	void *sa;
+	int rc;
+
+	max_sa = plt_align32pow2(ipsec_in_max_spi - ipsec_in_min_spi + 1);
 
 	/* CN9K SA size is different */
 	if (roc_model_is_cn9k())
@@ -34,14 +38,15 @@ nix_inl_inb_sa_tbl_setup(struct roc_nix *roc_nix)
 
 	/* Alloc contiguous memory for Inbound SA's */
 	nix->inb_sa_sz = inb_sa_sz;
-	nix->inb_sa_base = plt_zmalloc(inb_sa_sz * ipsec_in_max_spi,
+	nix->inb_spi_mask = max_sa - 1;
+	nix->inb_sa_base = plt_zmalloc(inb_sa_sz * max_sa,
 				       ROC_NIX_INL_SA_BASE_ALIGN);
 	if (!nix->inb_sa_base) {
 		plt_err("Failed to allocate memory for Inbound SA");
 		return -ENOMEM;
 	}
 	if (roc_model_is_cn10k()) {
-		for (i = 0; i < ipsec_in_max_spi; i++) {
+		for (i = 0; i < max_sa; i++) {
 			sa = ((uint8_t *)nix->inb_sa_base) + (i * inb_sa_sz);
 			roc_ot_ipsec_inb_sa_init(sa, true);
 		}
@@ -50,7 +55,7 @@ nix_inl_inb_sa_tbl_setup(struct roc_nix *roc_nix)
 	memset(&cfg, 0, sizeof(cfg));
 	cfg.sa_size = inb_sa_sz;
 	cfg.iova = (uintptr_t)nix->inb_sa_base;
-	cfg.max_sa = ipsec_in_max_spi + 1;
+	cfg.max_sa = max_sa;
 	cfg.tt = SSO_TT_ORDERED;
 
 	/* Setup device specific inb SA table */
@@ -135,11 +140,13 @@ roc_nix_inl_inb_sa_base_get(struct roc_nix *roc_nix, bool inb_inl_dev)
 }
 
 uint32_t
-roc_nix_inl_inb_sa_max_spi(struct roc_nix *roc_nix, bool inb_inl_dev)
+roc_nix_inl_inb_spi_range(struct roc_nix *roc_nix, bool inb_inl_dev,
+			  uint32_t *min_spi, uint32_t *max_spi)
 {
 	struct idev_cfg *idev = idev_get_cfg();
+	uint32_t min = 0, max = 0, mask = 0;
 	struct nix_inl_dev *inl_dev;
-	struct nix *nix;
+	struct nix *nix = NULL;
 
 	if (idev == NULL)
 		return 0;
@@ -147,20 +154,25 @@ roc_nix_inl_inb_sa_max_spi(struct roc_nix *roc_nix, bool inb_inl_dev)
 	if (!inb_inl_dev && roc_nix == NULL)
 		return -EINVAL;
 
-	if (roc_nix) {
+	inl_dev = idev->nix_inl_dev;
+	if (inb_inl_dev) {
+		min = inl_dev->ipsec_in_min_spi;
+		max = inl_dev->ipsec_in_max_spi;
+		mask = inl_dev->inb_spi_mask;
+	} else {
 		nix = roc_nix_to_nix_priv(roc_nix);
 		if (!nix->inl_inb_ena)
-			return 0;
+			goto exit;
+		min = roc_nix->ipsec_in_min_spi;
+		max = roc_nix->ipsec_in_max_spi;
+		mask = nix->inb_spi_mask;
 	}
-
-	if (inb_inl_dev) {
-		inl_dev = idev->nix_inl_dev;
-		if (inl_dev)
-			return inl_dev->ipsec_in_max_spi;
-		return 0;
-	}
-
-	return roc_nix->ipsec_in_max_spi;
+exit:
+	if (min_spi)
+		*min_spi = min;
+	if (max_spi)
+		*max_spi = max;
+	return mask;
 }
 
 uint32_t
@@ -194,8 +206,8 @@ roc_nix_inl_inb_sa_sz(struct roc_nix *roc_nix, bool inl_dev_sa)
 uintptr_t
 roc_nix_inl_inb_sa_get(struct roc_nix *roc_nix, bool inb_inl_dev, uint32_t spi)
 {
+	uint32_t max_spi, min_spi, mask;
 	uintptr_t sa_base;
-	uint32_t max_spi;
 	uint64_t sz;
 
 	sa_base = roc_nix_inl_inb_sa_base_get(roc_nix, inb_inl_dev);
@@ -204,11 +216,11 @@ roc_nix_inl_inb_sa_get(struct roc_nix *roc_nix, bool inb_inl_dev, uint32_t spi)
 		return 0;
 
 	/* Check if SPI is in range */
-	max_spi = roc_nix_inl_inb_sa_max_spi(roc_nix, inb_inl_dev);
-	if (spi > max_spi) {
-		plt_err("Inbound SA SPI %u exceeds max %u", spi, max_spi);
-		return 0;
-	}
+	mask = roc_nix_inl_inb_spi_range(roc_nix, inb_inl_dev, &min_spi,
+					 &max_spi);
+	if (spi > max_spi || spi < min_spi)
+		plt_warn("Inbound SA SPI %u not in range (%u..%u)", spi,
+			 min_spi, max_spi);
 
 	/* Get SA size */
 	sz = roc_nix_inl_inb_sa_sz(roc_nix, inb_inl_dev);
@@ -216,7 +228,7 @@ roc_nix_inl_inb_sa_get(struct roc_nix *roc_nix, bool inb_inl_dev, uint32_t spi)
 		return 0;
 
 	/* Basic logic of SPI->SA for now */
-	return (sa_base + (spi * sz));
+	return (sa_base + ((spi & mask) * sz));
 }
 
 int
@@ -295,11 +307,11 @@ roc_nix_inl_outb_init(struct roc_nix *roc_nix)
 	struct nix_inl_dev *inl_dev;
 	uint16_t sso_pffunc;
 	uint8_t eng_grpmask;
-	uint64_t blkaddr;
+	uint64_t blkaddr, i;
 	uint16_t nb_lf;
 	void *sa_base;
 	size_t sa_sz;
-	int i, j, rc;
+	int j, rc;
 	void *sa;
 
 	if (idev == NULL)
@@ -775,7 +787,7 @@ roc_nix_inl_inb_tag_update(struct roc_nix *roc_nix, uint32_t tag_const,
 	memset(&cfg, 0, sizeof(cfg));
 	cfg.sa_size = nix->inb_sa_sz;
 	cfg.iova = (uintptr_t)nix->inb_sa_base;
-	cfg.max_sa = roc_nix->ipsec_in_max_spi + 1;
+	cfg.max_sa = nix->inb_spi_mask + 1;
 	cfg.tt = tt;
 	cfg.tag_const = tag_const;
 
diff --git a/drivers/common/cnxk/roc_nix_inl.h b/drivers/common/cnxk/roc_nix_inl.h
index 728225b..5eb1a81 100644
--- a/drivers/common/cnxk/roc_nix_inl.h
+++ b/drivers/common/cnxk/roc_nix_inl.h
@@ -105,7 +105,8 @@ typedef void (*roc_nix_inl_sso_work_cb_t)(uint64_t *gw, void *args);
 struct roc_nix_inl_dev {
 	/* Input parameters */
 	struct plt_pci_device *pci_dev;
-	uint16_t ipsec_in_max_spi;
+	uint32_t ipsec_in_min_spi;
+	uint32_t ipsec_in_max_spi;
 	bool selftest;
 	bool is_multi_channel;
 	uint16_t channel;
@@ -136,8 +137,9 @@ int __roc_api roc_nix_inl_inb_fini(struct roc_nix *roc_nix);
 bool __roc_api roc_nix_inl_inb_is_enabled(struct roc_nix *roc_nix);
 uintptr_t __roc_api roc_nix_inl_inb_sa_base_get(struct roc_nix *roc_nix,
 						bool inl_dev_sa);
-uint32_t __roc_api roc_nix_inl_inb_sa_max_spi(struct roc_nix *roc_nix,
-					      bool inl_dev_sa);
+uint32_t __roc_api roc_nix_inl_inb_spi_range(struct roc_nix *roc_nix,
+					     bool inl_dev_sa, uint32_t *min,
+					     uint32_t *max);
 uint32_t __roc_api roc_nix_inl_inb_sa_sz(struct roc_nix *roc_nix,
 					 bool inl_dev_sa);
 uintptr_t __roc_api roc_nix_inl_inb_sa_get(struct roc_nix *roc_nix,
diff --git a/drivers/common/cnxk/roc_nix_inl_dev.c b/drivers/common/cnxk/roc_nix_inl_dev.c
index 4c1d85a..aeec406 100644
--- a/drivers/common/cnxk/roc_nix_inl_dev.c
+++ b/drivers/common/cnxk/roc_nix_inl_dev.c
@@ -120,6 +120,7 @@ nix_inl_nix_ipsec_cfg(struct nix_inl_dev *inl_dev, bool ena)
 {
 	struct nix_inline_ipsec_lf_cfg *lf_cfg;
 	struct mbox *mbox = (&inl_dev->dev)->mbox;
+	uint64_t max_sa;
 	uint32_t sa_w;
 
 	lf_cfg = mbox_alloc_msg_nix_inline_ipsec_lf_cfg(mbox);
@@ -127,8 +128,9 @@ nix_inl_nix_ipsec_cfg(struct nix_inl_dev *inl_dev, bool ena)
 		return -ENOSPC;
 
 	if (ena) {
-		sa_w = plt_align32pow2(inl_dev->ipsec_in_max_spi + 1);
-		sa_w = plt_log2_u32(sa_w);
+
+		max_sa = inl_dev->inb_spi_mask + 1;
+		sa_w = plt_log2_u32(max_sa);
 
 		lf_cfg->enable = 1;
 		lf_cfg->sa_base_addr = (uintptr_t)inl_dev->inb_sa_base;
@@ -138,7 +140,7 @@ nix_inl_nix_ipsec_cfg(struct nix_inl_dev *inl_dev, bool ena)
 			lf_cfg->ipsec_cfg0.lenm1_max = NIX_CN9K_MAX_HW_FRS - 1;
 		else
 			lf_cfg->ipsec_cfg0.lenm1_max = NIX_RPM_MAX_HW_FRS - 1;
-		lf_cfg->ipsec_cfg1.sa_idx_max = inl_dev->ipsec_in_max_spi;
+		lf_cfg->ipsec_cfg1.sa_idx_max = max_sa - 1;
 		lf_cfg->ipsec_cfg0.sa_pow2_size =
 			plt_log2_u32(inl_dev->inb_sa_sz);
 
@@ -319,16 +321,20 @@ nix_inl_sso_release(struct nix_inl_dev *inl_dev)
 static int
 nix_inl_nix_setup(struct nix_inl_dev *inl_dev)
 {
-	uint16_t ipsec_in_max_spi = inl_dev->ipsec_in_max_spi;
+	uint32_t ipsec_in_min_spi = inl_dev->ipsec_in_min_spi;
+	uint32_t ipsec_in_max_spi = inl_dev->ipsec_in_max_spi;
 	struct dev *dev = &inl_dev->dev;
 	struct mbox *mbox = dev->mbox;
 	struct nix_lf_alloc_rsp *rsp;
 	struct nix_lf_alloc_req *req;
 	struct nix_hw_info *hw_info;
+	uint64_t max_sa, i;
 	size_t inb_sa_sz;
-	int i, rc = -ENOSPC;
+	int rc = -ENOSPC;
 	void *sa;
 
+	max_sa = plt_align32pow2(ipsec_in_max_spi - ipsec_in_min_spi + 1);
+
 	/* Alloc NIX LF needed for single RQ */
 	req = mbox_alloc_msg_nix_lf_alloc(mbox);
 	if (req == NULL)
@@ -387,7 +393,8 @@ nix_inl_nix_setup(struct nix_inl_dev *inl_dev)
 
 	/* Alloc contiguous memory for Inbound SA's */
 	inl_dev->inb_sa_sz = inb_sa_sz;
-	inl_dev->inb_sa_base = plt_zmalloc(inb_sa_sz * ipsec_in_max_spi,
+	inl_dev->inb_spi_mask = max_sa - 1;
+	inl_dev->inb_sa_base = plt_zmalloc(inb_sa_sz * max_sa,
 					   ROC_NIX_INL_SA_BASE_ALIGN);
 	if (!inl_dev->inb_sa_base) {
 		plt_err("Failed to allocate memory for Inbound SA");
@@ -396,7 +403,7 @@ nix_inl_nix_setup(struct nix_inl_dev *inl_dev)
 	}
 
 	if (roc_model_is_cn10k()) {
-		for (i = 0; i < ipsec_in_max_spi; i++) {
+		for (i = 0; i < max_sa; i++) {
 			sa = ((uint8_t *)inl_dev->inb_sa_base) +
 			     (i * inb_sa_sz);
 			roc_ot_ipsec_inb_sa_init(sa, true);
@@ -657,6 +664,7 @@ roc_nix_inl_dev_init(struct roc_nix_inl_dev *roc_inl_dev)
 	memset(inl_dev, 0, sizeof(*inl_dev));
 
 	inl_dev->pci_dev = pci_dev;
+	inl_dev->ipsec_in_min_spi = roc_inl_dev->ipsec_in_min_spi;
 	inl_dev->ipsec_in_max_spi = roc_inl_dev->ipsec_in_max_spi;
 	inl_dev->selftest = roc_inl_dev->selftest;
 	inl_dev->is_multi_channel = roc_inl_dev->is_multi_channel;
diff --git a/drivers/common/cnxk/roc_nix_inl_priv.h b/drivers/common/cnxk/roc_nix_inl_priv.h
index b6d8602..24dabbc 100644
--- a/drivers/common/cnxk/roc_nix_inl_priv.h
+++ b/drivers/common/cnxk/roc_nix_inl_priv.h
@@ -58,7 +58,9 @@ struct nix_inl_dev {
 	uint16_t channel;
 	uint16_t chan_mask;
 	bool is_multi_channel;
-	uint16_t ipsec_in_max_spi;
+	uint32_t ipsec_in_min_spi;
+	uint32_t ipsec_in_max_spi;
+	uint32_t inb_spi_mask;
 	bool attach_cptlf;
 	bool wqe_skip;
 };
diff --git a/drivers/common/cnxk/roc_nix_priv.h b/drivers/common/cnxk/roc_nix_priv.h
index ec6f106..51b022e 100644
--- a/drivers/common/cnxk/roc_nix_priv.h
+++ b/drivers/common/cnxk/roc_nix_priv.h
@@ -174,6 +174,7 @@ struct nix {
 	bool inl_outb_ena;
 	void *inb_sa_base;
 	size_t inb_sa_sz;
+	uint32_t inb_spi_mask;
 	void *outb_sa_base;
 	size_t outb_sa_sz;
 	uint16_t outb_err_sso_pffunc;
diff --git a/drivers/common/cnxk/version.map b/drivers/common/cnxk/version.map
index 0f990d3..2a64090 100644
--- a/drivers/common/cnxk/version.map
+++ b/drivers/common/cnxk/version.map
@@ -142,7 +142,7 @@ INTERNAL {
 	roc_nix_inl_inb_init;
 	roc_nix_inl_inb_sa_base_get;
 	roc_nix_inl_inb_sa_get;
-	roc_nix_inl_inb_sa_max_spi;
+	roc_nix_inl_inb_spi_range;
 	roc_nix_inl_inb_sa_sz;
 	roc_nix_inl_inb_tag_update;
 	roc_nix_inl_inb_fini;
diff --git a/drivers/net/cnxk/cn10k_ethdev_sec.c b/drivers/net/cnxk/cn10k_ethdev_sec.c
index 044b20c..a2a53c1 100644
--- a/drivers/net/cnxk/cn10k_ethdev_sec.c
+++ b/drivers/net/cnxk/cn10k_ethdev_sec.c
@@ -264,6 +264,7 @@ cn10k_eth_sec_session_create(void *device,
 	struct cn10k_sec_sess_priv sess_priv;
 	struct rte_crypto_sym_xform *crypto;
 	struct cnxk_eth_sec_sess *eth_sec;
+	struct roc_nix *nix = &dev->nix;
 	bool inbound, inl_dev;
 	rte_spinlock_t *lock;
 	char tbuf[128] = {0};
@@ -308,13 +309,16 @@ cn10k_eth_sec_session_create(void *device,
 	if (inbound) {
 		struct roc_ot_ipsec_inb_sa *inb_sa, *inb_sa_dptr;
 		struct cn10k_inb_priv_data *inb_priv;
+		uint32_t spi_mask;
 		uintptr_t sa;
 
 		PLT_STATIC_ASSERT(sizeof(struct cn10k_inb_priv_data) <
 				  ROC_NIX_INL_OT_IPSEC_INB_SW_RSVD);
 
+		spi_mask = roc_nix_inl_inb_spi_range(nix, inl_dev, NULL, NULL);
+
 		/* Get Inbound SA from NIX_RX_IPSEC_SA_BASE */
-		sa = roc_nix_inl_inb_sa_get(&dev->nix, inl_dev, ipsec->spi);
+		sa = roc_nix_inl_inb_sa_get(nix, inl_dev, ipsec->spi);
 		if (!sa && dev->inb.inl_dev) {
 			snprintf(tbuf, sizeof(tbuf),
 				 "Failed to create ingress sa, inline dev "
@@ -358,16 +362,17 @@ cn10k_eth_sec_session_create(void *device,
 		inb_priv->userdata = conf->userdata;
 
 		/* Save SA index/SPI in cookie for now */
-		inb_sa_dptr->w1.s.cookie = rte_cpu_to_be_32(ipsec->spi);
+		inb_sa_dptr->w1.s.cookie =
+			rte_cpu_to_be_32(ipsec->spi & spi_mask);
 
 		/* Prepare session priv */
 		sess_priv.inb_sa = 1;
-		sess_priv.sa_idx = ipsec->spi;
+		sess_priv.sa_idx = ipsec->spi & spi_mask;
 
 		/* Pointer from eth_sec -> inb_sa */
 		eth_sec->sa = inb_sa;
 		eth_sec->sess = sess;
-		eth_sec->sa_idx = ipsec->spi;
+		eth_sec->sa_idx = ipsec->spi & spi_mask;
 		eth_sec->spi = ipsec->spi;
 		eth_sec->inl_dev = !!dev->inb.inl_dev;
 		eth_sec->inb = true;
diff --git a/drivers/net/cnxk/cn9k_ethdev_sec.c b/drivers/net/cnxk/cn9k_ethdev_sec.c
index 27930d1..fa72424 100644
--- a/drivers/net/cnxk/cn9k_ethdev_sec.c
+++ b/drivers/net/cnxk/cn9k_ethdev_sec.c
@@ -146,6 +146,7 @@ cn9k_eth_sec_session_create(void *device,
 	struct cn9k_sec_sess_priv sess_priv;
 	struct rte_crypto_sym_xform *crypto;
 	struct cnxk_eth_sec_sess *eth_sec;
+	struct roc_nix *nix = &dev->nix;
 	rte_spinlock_t *lock;
 	char tbuf[128] = {0};
 	bool inbound;
@@ -185,15 +186,18 @@ cn9k_eth_sec_session_create(void *device,
 	if (inbound) {
 		struct cn9k_inb_priv_data *inb_priv;
 		struct roc_onf_ipsec_inb_sa *inb_sa;
+		uint32_t spi_mask;
 
 		PLT_STATIC_ASSERT(sizeof(struct cn9k_inb_priv_data) <
 				  ROC_NIX_INL_ONF_IPSEC_INB_SW_RSVD);
 
+		spi_mask = roc_nix_inl_inb_spi_range(nix, false, NULL, NULL);
+
 		/* Get Inbound SA from NIX_RX_IPSEC_SA_BASE. Assume no inline
 		 * device always for CN9K.
 		 */
 		inb_sa = (struct roc_onf_ipsec_inb_sa *)
-			 roc_nix_inl_inb_sa_get(&dev->nix, false, ipsec->spi);
+			 roc_nix_inl_inb_sa_get(nix, false, ipsec->spi);
 		if (!inb_sa) {
 			snprintf(tbuf, sizeof(tbuf),
 				 "Failed to create ingress sa");
@@ -236,12 +240,12 @@ cn9k_eth_sec_session_create(void *device,
 
 		/* Prepare session priv */
 		sess_priv.inb_sa = 1;
-		sess_priv.sa_idx = ipsec->spi;
+		sess_priv.sa_idx = ipsec->spi & spi_mask;
 
 		/* Pointer from eth_sec -> inb_sa */
 		eth_sec->sa = inb_sa;
 		eth_sec->sess = sess;
-		eth_sec->sa_idx = ipsec->spi;
+		eth_sec->sa_idx = ipsec->spi & spi_mask;
 		eth_sec->spi = ipsec->spi;
 		eth_sec->inb = true;
 
diff --git a/drivers/net/cnxk/cnxk_ethdev_devargs.c b/drivers/net/cnxk/cnxk_ethdev_devargs.c
index 157b27d..8a71644 100644
--- a/drivers/net/cnxk/cnxk_ethdev_devargs.c
+++ b/drivers/net/cnxk/cnxk_ethdev_devargs.c
@@ -49,14 +49,17 @@ parse_outb_nb_crypto_qs(const char *key, const char *value, void *extra_args)
 }
 
 static int
-parse_ipsec_in_max_spi(const char *key, const char *value, void *extra_args)
+parse_ipsec_in_spi_range(const char *key, const char *value, void *extra_args)
 {
 	RTE_SET_USED(key);
 	uint32_t val;
 
-	val = atoi(value);
+	errno = 0;
+	val = strtoul(value, NULL, 0);
+	if (errno)
+		val = 0;
 
-	*(uint16_t *)extra_args = val;
+	*(uint32_t *)extra_args = val;
 
 	return 0;
 }
@@ -67,7 +70,10 @@ parse_ipsec_out_max_sa(const char *key, const char *value, void *extra_args)
 	RTE_SET_USED(key);
 	uint32_t val;
 
-	val = atoi(value);
+	errno = 0;
+	val = strtoul(value, NULL, 0);
+	if (errno)
+		val = 0;
 
 	*(uint16_t *)extra_args = val;
 
@@ -231,6 +237,7 @@ parse_sdp_channel_mask(const char *key, const char *value, void *extra_args)
 #define CNXK_SWITCH_HEADER_TYPE "switch_header"
 #define CNXK_RSS_TAG_AS_XOR	"tag_as_xor"
 #define CNXK_LOCK_RX_CTX	"lock_rx_ctx"
+#define CNXK_IPSEC_IN_MIN_SPI	"ipsec_in_min_spi"
 #define CNXK_IPSEC_IN_MAX_SPI	"ipsec_in_max_spi"
 #define CNXK_IPSEC_OUT_MAX_SA	"ipsec_out_max_sa"
 #define CNXK_OUTB_NB_DESC	"outb_nb_desc"
@@ -245,13 +252,14 @@ cnxk_ethdev_parse_devargs(struct rte_devargs *devargs, struct cnxk_eth_dev *dev)
 	uint16_t reta_sz = ROC_NIX_RSS_RETA_SZ_64;
 	uint16_t sqb_count = CNXK_NIX_TX_MAX_SQB;
 	struct flow_pre_l2_size_info pre_l2_info;
-	uint16_t ipsec_in_max_spi = BIT(8) - 1;
-	uint16_t ipsec_out_max_sa = BIT(12);
+	uint32_t ipsec_in_max_spi = BIT(8) - 1;
+	uint32_t ipsec_out_max_sa = BIT(12);
 	uint16_t flow_prealloc_size = 1;
 	uint16_t switch_header_type = 0;
 	uint16_t flow_max_priority = 3;
 	uint16_t force_inb_inl_dev = 0;
 	uint16_t outb_nb_crypto_qs = 1;
+	uint32_t ipsec_in_min_spi = 0;
 	uint16_t outb_nb_desc = 8200;
 	struct sdp_channel sdp_chan;
 	uint16_t rss_tag_as_xor = 0;
@@ -284,8 +292,10 @@ cnxk_ethdev_parse_devargs(struct rte_devargs *devargs, struct cnxk_eth_dev *dev)
 	rte_kvargs_process(kvlist, CNXK_RSS_TAG_AS_XOR, &parse_flag,
 			   &rss_tag_as_xor);
 	rte_kvargs_process(kvlist, CNXK_LOCK_RX_CTX, &parse_flag, &lock_rx_ctx);
+	rte_kvargs_process(kvlist, CNXK_IPSEC_IN_MIN_SPI,
+			   &parse_ipsec_in_spi_range, &ipsec_in_min_spi);
 	rte_kvargs_process(kvlist, CNXK_IPSEC_IN_MAX_SPI,
-			   &parse_ipsec_in_max_spi, &ipsec_in_max_spi);
+			   &parse_ipsec_in_spi_range, &ipsec_in_max_spi);
 	rte_kvargs_process(kvlist, CNXK_IPSEC_OUT_MAX_SA,
 			   &parse_ipsec_out_max_sa, &ipsec_out_max_sa);
 	rte_kvargs_process(kvlist, CNXK_OUTB_NB_DESC, &parse_outb_nb_desc,
@@ -307,6 +317,7 @@ cnxk_ethdev_parse_devargs(struct rte_devargs *devargs, struct cnxk_eth_dev *dev)
 	dev->outb.max_sa = ipsec_out_max_sa;
 	dev->outb.nb_desc = outb_nb_desc;
 	dev->outb.nb_crypto_qs = outb_nb_crypto_qs;
+	dev->nix.ipsec_in_min_spi = ipsec_in_min_spi;
 	dev->nix.ipsec_in_max_spi = ipsec_in_max_spi;
 	dev->nix.ipsec_out_max_sa = ipsec_out_max_sa;
 	dev->nix.rss_tag_as_xor = !!rss_tag_as_xor;
diff --git a/drivers/net/cnxk/cnxk_ethdev_sec.c b/drivers/net/cnxk/cnxk_ethdev_sec.c
index ea204ca..3831889 100644
--- a/drivers/net/cnxk/cnxk_ethdev_sec.c
+++ b/drivers/net/cnxk/cnxk_ethdev_sec.c
@@ -5,6 +5,7 @@
 #include <cnxk_ethdev.h>
 
 #define CNXK_NIX_INL_SELFTEST	      "selftest"
+#define CNXK_NIX_INL_IPSEC_IN_MIN_SPI "ipsec_in_min_spi"
 #define CNXK_NIX_INL_IPSEC_IN_MAX_SPI "ipsec_in_max_spi"
 #define CNXK_INL_CPT_CHANNEL	      "inl_cpt_channel"
 
@@ -119,14 +120,17 @@ struct rte_security_ops cnxk_eth_sec_ops = {
 };
 
 static int
-parse_ipsec_in_max_spi(const char *key, const char *value, void *extra_args)
+parse_ipsec_in_spi_range(const char *key, const char *value, void *extra_args)
 {
 	RTE_SET_USED(key);
 	uint32_t val;
 
-	val = atoi(value);
+	errno = 0;
+	val = strtoul(value, NULL, 0);
+	if (errno)
+		val = 0;
 
-	*(uint16_t *)extra_args = val;
+	*(uint32_t *)extra_args = val;
 
 	return 0;
 }
@@ -169,6 +173,7 @@ nix_inl_parse_devargs(struct rte_devargs *devargs,
 		      struct roc_nix_inl_dev *inl_dev)
 {
 	uint32_t ipsec_in_max_spi = BIT(8) - 1;
+	uint32_t ipsec_in_min_spi = 0;
 	struct inl_cpt_channel cpt_channel;
 	struct rte_kvargs *kvlist;
 	uint8_t selftest = 0;
@@ -184,13 +189,16 @@ nix_inl_parse_devargs(struct rte_devargs *devargs,
 
 	rte_kvargs_process(kvlist, CNXK_NIX_INL_SELFTEST, &parse_selftest,
 			   &selftest);
+	rte_kvargs_process(kvlist, CNXK_NIX_INL_IPSEC_IN_MIN_SPI,
+			   &parse_ipsec_in_spi_range, &ipsec_in_min_spi);
 	rte_kvargs_process(kvlist, CNXK_NIX_INL_IPSEC_IN_MAX_SPI,
-			   &parse_ipsec_in_max_spi, &ipsec_in_max_spi);
+			   &parse_ipsec_in_spi_range, &ipsec_in_max_spi);
 	rte_kvargs_process(kvlist, CNXK_INL_CPT_CHANNEL, &parse_inl_cpt_channel,
 			   &cpt_channel);
 	rte_kvargs_free(kvlist);
 
 null_devargs:
+	inl_dev->ipsec_in_min_spi = ipsec_in_min_spi;
 	inl_dev->ipsec_in_max_spi = ipsec_in_max_spi;
 	inl_dev->selftest = selftest;
 	inl_dev->channel = cpt_channel.channel;
diff --git a/drivers/net/cnxk/cnxk_lookup.c b/drivers/net/cnxk/cnxk_lookup.c
index 4eb1ecf..f36fb8f 100644
--- a/drivers/net/cnxk/cnxk_lookup.c
+++ b/drivers/net/cnxk/cnxk_lookup.c
@@ -337,7 +337,8 @@ cnxk_nix_lookup_mem_sa_base_set(struct cnxk_eth_dev *dev)
 	if (!sa_base)
 		return -ENOTSUP;
 
-	sa_w = plt_log2_u32(dev->nix.ipsec_in_max_spi + 1);
+	sa_w = plt_log2_u32(dev->nix.ipsec_in_max_spi + 1 -
+			    dev->nix.ipsec_in_min_spi);
 
 	/* Set SA Base in lookup mem */
 	sa_base_tbl = (uintptr_t)lookup_mem;
-- 
2.8.4