From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id B1B96A0567; Fri, 13 Mar 2020 13:21:40 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id D308F1BF97; Fri, 13 Mar 2020 13:21:39 +0100 (CET) Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by dpdk.org (Postfix) with ESMTP id 6ED262BE3 for ; Fri, 13 Mar 2020 13:21:37 +0100 (CET) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 13 Mar 2020 05:21:36 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,548,1574150400"; d="scan'208";a="354361060" Received: from orsmsx104.amr.corp.intel.com ([10.22.225.131]) by fmsmga001.fm.intel.com with ESMTP; 13 Mar 2020 05:21:36 -0700 Received: from orsmsx601.amr.corp.intel.com (10.22.229.14) by ORSMSX104.amr.corp.intel.com (10.22.225.131) with Microsoft SMTP Server (TLS) id 14.3.439.0; Fri, 13 Mar 2020 05:21:35 -0700 Received: from orsmsx608.amr.corp.intel.com (10.22.229.21) by ORSMSX601.amr.corp.intel.com (10.22.229.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1713.5; Fri, 13 Mar 2020 05:21:34 -0700 Received: from ORSEDG001.ED.cps.intel.com (10.7.248.4) by orsmsx608.amr.corp.intel.com (10.22.229.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.1.1713.5 via Frontend Transport; Fri, 13 Mar 2020 05:21:34 -0700 Received: from NAM12-DM6-obe.outbound.protection.outlook.com (104.47.59.175) by edgegateway.intel.com (134.134.137.100) with Microsoft SMTP Server (TLS) id 14.3.439.0; Fri, 13 Mar 2020 05:21:34 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Y6b0RqE16JwGr3nzAEYG9DfPBZeIVWYY4r224BxDOHUSHIIg4/GY9QniAafjkrCeXxM8O6l3UNZvz8C4QSYiIEJczalf2xPrBqcD65OW1Lz4Nloj8nyNQjC1gGPeIWNxaAui5+OrEW463bOqu2zu+SQRI34xZ491qBcPqVInMCu72eFlhdaA0eep2bNQU+BUimVAgH9euN92ZzRPxsS+9YN+TNeYo8IUj5mzPeNJmXyWuqqF+BjqqKJ0DFxK30d/Xl47wXNCdeA7+/OMJ0a82yJ/t/ZHn/Ug057b/wlqghvaSWIcxeiP8nQu5O5wAZq8TcK5uanNXlXbJLrfAEC/AQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=A/y0KzkHYGo4na9Cwm7IBWEz0sGnMlK12v+SAAdDQGc=; b=gdldVlcmSxuPHVyNjpx3UEF9Z0b8qzyRNzBUnIGu67Dp90WcJzEE982apCW9e3p8lhB/1tvznPXdVl1Fo4m4UwKctvtvhfIqyIxKErRrL8RgxUlby9eVg0Hr4KvYOkggBAjgIwOILuBK+P8UBnl+SvFZA164AqmxTqp4oQKJAl296xV5mSfVVB6iTnzxuN8y0zW3t/eJXz3iumIMsV6v71mZu4Iq7x+TCI3GUzuy9jJUShoU3Hk0XBt7hXTTY3K3l1dedf9T9HHbVwmfsHla4IdJIpgxnQs/nBjBuFD0qnK2La+cPFOrCyLbhQ+4ABvDdroemR6tKWs/ZUr6YgudVw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intel.onmicrosoft.com; s=selector2-intel-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=A/y0KzkHYGo4na9Cwm7IBWEz0sGnMlK12v+SAAdDQGc=; b=I6KxZ7dj/T17MsOBzJGN43IJGyqxUqxJzkOrpYjgpmKAQ9mWWXIuvP1yeQxKiCQKWDIjLhPo2X87Bb/7mSAPQgwRJDm9mAjbgN9Kcx2MGRgyF1UXMxhBCmiptnR+iKyErFgXhE38h8EAzuyA9UUKpHMEKz1kylB8WyXkoRiojDg= Received: from BN7PR11MB2531.namprd11.prod.outlook.com (52.135.243.22) by BN7PR11MB2580.namprd11.prod.outlook.com (52.135.246.155) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2793.15; Fri, 13 Mar 2020 12:21:30 +0000 Received: from BN7PR11MB2531.namprd11.prod.outlook.com ([fe80::6c63:49a2:665:cd8c]) by BN7PR11MB2531.namprd11.prod.outlook.com ([fe80::6c63:49a2:665:cd8c%6]) with mapi id 15.20.2814.007; Fri, 13 Mar 2020 12:21:30 +0000 From: "Shetty, Praveen" To: Anoob Joseph , "Doherty, Declan" , "Ananyev, Konstantin" , "Iremonger, Bernard" , "dev@dpdk.org" Thread-Topic: [dpdk-dev] [PATCH v1] examples/ipsec-secgw: support flow director feature Thread-Index: AQHV97U+oNWqhhg8hEGUKXk6ZC1tBKhEy5SAgAAuy4CAACWAkIAAID0QgADS81CAAEg9AIAAEFnw Date: Fri, 13 Mar 2020 12:21:29 +0000 Message-ID: References: <20200311145529.40221-1-praveen.shetty@intel.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiNzI2NDNmMDgtODZmZS00ZTIxLWEyOGEtNzhmMjk3NTNjZDAyIiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiNnNPaGdueE9YNmNyb21aK2wyVjZXWTdYczRqWVM3N2hoYjBDdThRZ2hQZGdvRHk3ZjhmMnp4UVZkaUpEbHRiNCJ9 dlp-product: dlpe-windows dlp-reaction: no-action dlp-version: 11.2.0.6 x-ctpclassification: CTP_NT authentication-results: spf=none (sender IP is ) smtp.mailfrom=praveen.shetty@intel.com; x-originating-ip: [192.55.79.122] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 6a904e9b-dd1a-4cf2-a617-08d7c7490f8a x-ms-traffictypediagnostic: BN7PR11MB2580: x-ld-processed: 46c98d88-e344-4ed4-8496-4ed7712e255d,ExtAddr x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 034119E4F6 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(346002)(396003)(136003)(366004)(39860400002)(199004)(6506007)(52536014)(53546011)(71200400001)(7696005)(9686003)(64756008)(66556008)(66946007)(76116006)(66446008)(66476007)(55016002)(30864003)(26005)(110136005)(316002)(5660300002)(186003)(478600001)(2906002)(33656002)(8936002)(81156014)(86362001)(81166006); DIR:OUT; SFP:1102; SCL:1; SRVR:BN7PR11MB2580; H:BN7PR11MB2531.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 4jQpTE4EvdCrcOd5RcY0bgVef2t5Y6Lei/rYJ9Ppb9DHu+s/wqPudGqIUfrEnPn0FgudzAdW0pFmV4A4oiNW98vUBPVfqNUvE0xj3apDzMfJiGhbCIsTTjfr3U8drVeJGxHB5YssD4lQar+1L6mtOrs1+FzCP0f4tbOi1DOabE24U20UzCQX6GDZE9xB7hGCGEUWXxkUMv4jfHb7+EAAqkbSRT/3+p9uVpo+E8D+2KEdH96Dfa4fvTihirWGJJmv0HB2H4FdaTLFFF2Yvc4dSpZL9UA9RqzHcc/XwoE8vQxwq/Ic1E3VWGblRA8GRsSvmE8utREXAkex/GmjxfhKHaieH4d22Iq7Bllq21g3VnQohQ8i5whhHTyDpdB0bg1q2g5U89FnaMQ7z1gooLEqNbj+s7c5PsUV/OgvOtEMdSYGLwCBy2oG0TaIEeDl2elA x-ms-exchange-antispam-messagedata: mRo4a4d70XOUWm8UxFOvEQ/m+DmsMOGSTmzWTSIN7CyLigMlf1kc9V1RNwFQGHFb/Hj7EwwsHWYsQTv2HnhNzwvtRKSLlxv8uvAnw9TYNc0hREQwb+8p8q2ESCJg9WExDPugr9QxbB8CN4pIJg9vGw== Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 6a904e9b-dd1a-4cf2-a617-08d7c7490f8a X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Mar 2020 12:21:29.6233 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: jY7mJjWDGbEIMqV7e3wmzFzQSdt/w/XFm60Iz+0ztO31kNsDQLqLaKHLc0c8HPpOKW7FDF/KzoPaxvvDqpijBZuq7wKzDVJH+9u1zQUfbig= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR11MB2580 X-OriginatorOrg: intel.com Subject: Re: [dpdk-dev] [PATCH v1] examples/ipsec-secgw: support flow director feature X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Hi Anoob, Please see my response inline. Regards, Praveen -----Original Message----- From: Anoob Joseph =20 Sent: Friday, March 13, 2020 4:22 PM To: Shetty, Praveen ; Doherty, Declan ; Ananyev, Konstantin ; Iremon= ger, Bernard ; dev@dpdk.org Subject: RE: [dpdk-dev] [PATCH v1] examples/ipsec-secgw: support flow direc= tor feature Hi Praveen, Please see inline. Thanks, Anoob > -----Original Message----- > From: Shetty, Praveen > Sent: Friday, March 13, 2020 12:36 PM > To: Anoob Joseph ; Doherty, Declan=20 > ; Ananyev, Konstantin=20 > ; Iremonger, Bernard=20 > ; dev@dpdk.org > Subject: [EXT] RE: [dpdk-dev] [PATCH v1] examples/ipsec-secgw: support=20 > flow director feature >=20 > External Email >=20 > ---------------------------------------------------------------------- > Hi Anoob, >=20 > Thank you. >=20 > Please see my answers below. >=20 > Regards, > Praveen >=20 > -----Original Message----- > From: Anoob Joseph > Sent: Thursday, March 12, 2020 4:31 PM > To: Shetty, Praveen ; dev@dpdk.org; Doherty,=20 > Declan ; Iremonger, Bernard=20 > ; Ananyev, Konstantin=20 > > Subject: RE: [dpdk-dev] [PATCH v1] examples/ipsec-secgw: support flow=20 > director feature >=20 > Hi Praveen, >=20 > I do have some review comments on the code. Before that, can you give=20 > a brief overview of what is being targeted? My understanding is that=20 > the primary objective is to use rte_flow (or flow director) to=20 > redirect a specific flow(/SA) to a specific queue. Can you confirm? >=20 > >>>> Yes, your understanding is correct, the main objective is to=20 > >>>> support load > distribution in ipsec-secgw application. > >>>> flow director and RSS features are used achieve the load distributio= n. > >>>> flow director is used to redirect the specified inbound ipsec=20 > >>>> flow to a > specified queue. [Anoob] May be update the commit description with some more such details. A= nd I think it's better to use 'rte_flow' rather than flow director. I see t= hat i40e PMD talks about flow director, but overall the feature is usage of= rte_flow. =20 [Praveen] Yeah Sure , I will add more such details in v2.=20 >=20 > Couple of questions, > 1. I would assume the new option of "flow-direction" is optional and=20 > is determined per SA. In that case, can I assume that RSS would be=20 > active for the other flows (or SAs). Let's say, I just want to add a=20 > SA for which I would like to enable "flow-direction" but leave the rest a= s is. How is that handled? >=20 > [Praveen] >=20 > >>>> We are using fdir_flag to differentiate the mix of SA's(SA's with=20 > >>>> and > without flow-direction). > >>>> fdir_flag will be "set" for the SA which has configured with=20 > >>>> flow-direction > option(SA rule syntax is extended to add new options > ). > >>>> flow creation is called only for the SA's with fdir_flag is set. [Anoob] I've few questions on this. I'll send this along with my code revie= w. =20 >=20 > 2. I see that the changes are only applicable for LOOKASIDE_PROTOCOL.=20 > The same feature would be useful for other modes as well, right? >=20 > [Praveen] > >>>> We are adding this feature for i40e NIC and the i40e NIC=20 > >>>> doesn't support > either encryption or decryption, that's why we used only=20 > LOOKASIDE_PROTOCOL in this case. [Anoob] I meant LOOKASIDE_NONE (LOOKASIDE_CRYPTO) case. I would assume that= can be early supported. [Praveen] Yes , it was a copy & paste error , what I meant was LOOKASIDE_N= ONE. Will fix this in v2. =20 >=20 > 3. I'm not sure "flow-direction" is the right wording for the option.=20 > This is just specifying the "rx-queue" per SA. @Akhil, Konstantin, commen= ts? >=20 > >>>> @Declan, @Konstantin , @Bernard, @Akhil Could you please=20 > suggest a name on which we can all agree upon? >=20 > Thanks, > Anoob >=20 > > -----Original Message----- > > From: dev On Behalf Of Praveen Shetty > > Sent: Wednesday, March 11, 2020 8:25 PM > > To: dev@dpdk.org; declan.doherty@intel.com;=20 > > bernard.iremonger@intel.com; konstantin.ananyev@intel.com > > Subject: [dpdk-dev] [PATCH v1] examples/ipsec-secgw: support flow=20 > > director feature > > > > Modified Secuirty gateway application to support configuration of=20 > > flow director rule to direct inbound IPsec SA to a specified queue. > > > > Signed-off-by: Praveen Shetty > > --- > > examples/ipsec-secgw/ep0.cfg | 11 +++++ > > examples/ipsec-secgw/ipsec-secgw.c | 56 ++++++++++++++++++++++++- > > examples/ipsec-secgw/ipsec.c | 67 ++++++++++++++++++++++++++++++ > > examples/ipsec-secgw/ipsec.h | 11 +++++ > > examples/ipsec-secgw/sa.c | 50 +++++++++++++++++++++- > > 5 files changed, 192 insertions(+), 3 deletions(-) > > > > diff --git a/examples/ipsec-secgw/ep0.cfg=20 > > b/examples/ipsec-secgw/ep0.cfg index dfd4aca7d..c9f80e81b 100644 > > --- a/examples/ipsec-secgw/ep0.cfg > > +++ b/examples/ipsec-secgw/ep0.cfg > > @@ -29,6 +29,7 @@ sp ipv4 in esp protect 111 pri 1 dst > > 192.168.186.0/24 sport > > 0:65535 dport 0:6553 sp ipv4 in esp protect 115 pri 1 dst > > 192.168.210.0/24 sport > > 0:65535 dport 0:65535 sp ipv4 in esp protect 116 pri 1 dst > > 192.168.211.0/24 sport 0:65535 dport 0:65535 sp ipv4 in esp protect > > 115 pri 1 dst > > 192.168.210.0/24 sport 0:65535 dport 0:65535 > > +sp ipv4 in esp protect 117 pri 1 dst 192.168.212.0/24 sport 0:65535=20 > > +dport 0:65535 > > sp ipv4 in esp protect 125 pri 1 dst 192.168.65.0/24 sport 0:65535=20 > > dport 0:65535 sp ipv4 in esp protect 125 pri 1 dst 192.168.65.0/24=20 > > sport 0:65535 dport 0:65535 sp ipv4 in esp protect 126 pri 1 dst > > 192.168.66.0/24 sport 0:65535 dport 0:65535 @@ -61,6 +62,8 @@ sp=20 > > ipv6 in esp protect 125 pri 1 dst > > ffff:0000:0000:0000:aaaa:aaaa:0000:0000/96 > > sport 0:65535 dport 0:65535 > > sp ipv6 in esp protect 126 pri 1 dst > > ffff:0000:0000:0000:bbbb:bbbb:0000:0000/96 \ sport 0:65535 dport > > 0:65535 > > +sp ipv6 in esp protect 127 pri 1 dst > > +ffff:0000:0000:0000:cccc:dddd:0000:0000/96 \ sport 0:65535 dport > > +0:65535 > > > > #SA rules > > sa out 5 cipher_algo aes-128-cbc cipher_key > > 0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0 \ @@ -118,6 +121,9 @@ dst 172.16.1.5 > > > > sa in 116 cipher_algo null auth_algo null mode ipv4-tunnel src > > 172.16.2.6 dst > > 172.16.1.6 > > > > +sa in 117 cipher_algo null auth_algo null mode ipv4-tunnel src > > +172.16.2.7 \ dst 172.16.1.7 flow-direction 0 2 port_id 0 type=20 > > +lookaside-protocol-offload > > + > > sa in 125 cipher_algo aes-128-cbc cipher_key=20 > > c3:c3:c3:c3:c3:c3:c3:c3:c3:c3:c3:\ > > c3:c3:c3:c3:c3 auth_algo sha1-hmac auth_key=20 > > c3:c3:c3:c3:c3:c3:c3:c3:c3:c3:c3:\ > > c3:c3:c3:c3:c3:c3:c3:c3:c3 mode ipv6-tunnel \ @@ -130,6 +136,11 @@=20 > > sa in > > 126 cipher_algo aes-128-cbc cipher_key=20 > > 4d:4d:4d:4d:4d:4d:4d:4d:4d:4d:4d:\ > > src 2222:2222:2222:2222:2222:2222:2222:6666 \ dst > > 1111:1111:1111:1111:1111:1111:1111:6666 > > > > +sa in 127 cipher_algo null auth_algo null mode ipv6-tunnel \ src > > +2222:2222:2222:2222:2222:2222:2222:7777 \ dst > > +1111:1111:1111:1111:1111:1111:1111:7777 \ flow-direction 0 3=20 > > +port_id > > +0 type lookaside-protocol-offload > > + > > #Routing rules > > rt ipv4 dst 172.16.2.5/32 port 0 > > rt ipv4 dst 172.16.2.6/32 port 1 > > diff --git a/examples/ipsec-secgw/ipsec-secgw.c b/examples/ipsec-=20 > > secgw/ipsec-secgw.c index 4799bc90c..132484422 100644 > > --- a/examples/ipsec-secgw/ipsec-secgw.c > > +++ b/examples/ipsec-secgw/ipsec-secgw.c > > @@ -166,7 +166,6 @@ static const struct option lgopts[] =3D { > > {CMD_LINE_OPT_FRAG_TTL, 1, 0, CMD_LINE_OPT_FRAG_TTL_NUM}, > > {NULL, 0, 0, 0} > > }; > > - > > /* mask of enabled ports */ > > static uint32_t enabled_port_mask; > > static uint64_t enabled_cryptodev_mask =3D UINT64_MAX; @@ -259,6 > > +258,30 @@ static struct rte_eth_conf port_conf =3D { > > .txmode =3D { > > .mq_mode =3D ETH_MQ_TX_NONE, > > }, > > + .fdir_conf =3D { > > + .mode =3D RTE_FDIR_MODE_NONE, > > + .pballoc =3D RTE_FDIR_PBALLOC_64K, > > + .status =3D RTE_FDIR_REPORT_STATUS, > > + .mask =3D { > > + .vlan_tci_mask =3D 0xFFEF, > > + .ipv4_mask =3D { > > + .src_ip =3D 0xFFFFFFFF, > > + .dst_ip =3D 0xFFFFFFFF, > > + }, > > + .ipv6_mask =3D { > > + .src_ip =3D {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, > > + 0xFFFFFFFF}, > > + .dst_ip =3D {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, > > + 0xFFFFFFFF}, > > + }, > > + .src_port_mask =3D 0xFFFF, > > + .dst_port_mask =3D 0xFFFF, > > + .mac_addr_byte_mask =3D 0xFF, > > + .tunnel_type_mask =3D 1, > > + .tunnel_id_mask =3D 0xFFFFFFFF, > > + }, > > + .drop_queue =3D 127, > > + } > > }; > > > > static struct socket_ctx socket_ctx[NB_SOCKETS]; @@ -1184,7 +1207,6=20 > > @@ > > main_loop(__attribute__((unused)) void *dummy) > > > > if (nb_rx > 0) > > process_pkts(qconf, pkts, nb_rx, portid); > > - > > /* dequeue and process completed crypto-ops */ > > if (UNPROTECTED_PORT(portid)) > > drain_inbound_crypto_queues(qconf, > > @@ -1196,6 +1218,27 @@ main_loop(__attribute__((unused)) void *dummy) > > } > > } > > > > +int check_flow_params(uint16_t fdir_portid, uint8_t fdir_qid) { > > + uint16_t i; > > + uint16_t portid; > > + uint8_t queueid; > > + > > + for (i =3D 0; i < nb_lcore_params; ++i) { > > + portid =3D lcore_params_array[i].port_id; > > + if (portid =3D=3D fdir_portid) { > > + queueid =3D lcore_params_array[i].queue_id; > > + if (queueid =3D=3D fdir_qid) > > + break; > > + } > > + > > + if (i =3D=3D nb_lcore_params - 1) > > + return -1; > > + } > > + > > + return 1; > > +} > > + > > static int32_t > > check_params(void) > > { > > @@ -2503,6 +2546,15 @@ main(int32_t argc, char **argv) > > continue; > > > > sa_check_offloads(portid, &req_rx_offloads, > &req_tx_offloads); > > + /* check if FDIR is configured on the port */ > > + if (check_fdir_configured(portid)) { > > + /* Enable FDIR */ > > + port_conf.fdir_conf.mode =3D > > RTE_FDIR_MODE_PERFECT; > > + /* Disable RSS */ > > + port_conf.rxmode.mq_mode =3D ETH_MQ_RX_NONE; > > + port_conf.rx_adv_conf.rss_conf.rss_hf =3D 0; > > + port_conf.rx_adv_conf.rss_conf.rss_key =3D NULL; > > + } > > port_init(portid, req_rx_offloads, req_tx_offloads); > > } > > > > diff --git a/examples/ipsec-secgw/ipsec.c=20 > > b/examples/ipsec-secgw/ipsec.c index 6e8120702..363809cfd 100644 > > --- a/examples/ipsec-secgw/ipsec.c > > +++ b/examples/ipsec-secgw/ipsec.c > > @@ -415,6 +415,73 @@ create_inline_session(struct socket_ctx=20 > > *skt_ctx, struct ipsec_sa *sa, > > return 0; > > } > > > > +int > > +create_ipsec_esp_flow(struct ipsec_sa *sa) { > > + int ret =3D 0; > > + struct rte_flow_error err; > > + if (sa->direction =3D=3D RTE_SECURITY_IPSEC_SA_DIR_EGRESS) > > + return 0; /* No Flow director rules for Egress traffic */ > > + if (sa->flags =3D=3D TRANSPORT) { > > + RTE_LOG(ERR, IPSEC, > > + "No Flow director rule for transport mode:"); > > + return -1; > > + } > > + sa->action[0].type =3D RTE_FLOW_ACTION_TYPE_QUEUE; > > + sa->pattern[0].type =3D RTE_FLOW_ITEM_TYPE_ETH; > > + sa->action[0].conf =3D > > + &(struct rte_flow_action_queue){ > > + .index =3D sa->fdir_qid, > > + }; > > + sa->attr.egress =3D 0; > > + sa->attr.ingress =3D 1; > > + if (IS_IP6(sa->flags)) { > > + sa->pattern[1].mask =3D &rte_flow_item_ipv6_mask; > > + sa->pattern[1].type =3D RTE_FLOW_ITEM_TYPE_IPV6; > > + sa->pattern[1].spec =3D &sa->ipv6_spec; > > + memcpy(sa->ipv6_spec.hdr.dst_addr, > > + sa->dst.ip.ip6.ip6_b, IPV6_ADDR_LEN); > > + memcpy(sa->ipv6_spec.hdr.src_addr, > > + sa->src.ip.ip6.ip6_b, IPV6_ADDR_LEN); > > + sa->pattern[2].type =3D RTE_FLOW_ITEM_TYPE_ESP; > > + sa->pattern[2].spec =3D &sa->esp_spec; > > + sa->pattern[2].mask =3D &rte_flow_item_esp_mask; > > + sa->esp_spec.hdr.spi =3D rte_cpu_to_be_32(sa->spi); > > + sa->pattern[3].type =3D RTE_FLOW_ITEM_TYPE_END; > > + } else if (IS_IP4(sa->flags)) { > > + sa->pattern[1].mask =3D &rte_flow_item_ipv4_mask; > > + sa->pattern[1].type =3D RTE_FLOW_ITEM_TYPE_IPV4; > > + sa->pattern[1].spec =3D &sa->ipv4_spec; > > + sa->ipv4_spec.hdr.dst_addr =3D sa->dst.ip.ip4; > > + sa->ipv4_spec.hdr.src_addr =3D sa->src.ip.ip4; > > + sa->pattern[2].type =3D RTE_FLOW_ITEM_TYPE_ESP; > > + sa->pattern[2].spec =3D &sa->esp_spec; > > + sa->pattern[2].mask =3D &rte_flow_item_esp_mask; > > + sa->esp_spec.hdr.spi =3D rte_cpu_to_be_32(sa->spi); > > + sa->pattern[3].type =3D RTE_FLOW_ITEM_TYPE_END; > > + } > > + sa->action[1].type =3D RTE_FLOW_ACTION_TYPE_END; > > + > > + ret =3D rte_flow_validate(sa->fdir_portid, &sa->attr, > > + sa->pattern, sa->action, > > + &err); > > + if (ret < 0) { > > + RTE_LOG(ERR, IPSEC, > > + "Flow Validation failed\n"); > > + return ret; > > + } > > + sa->flow =3D rte_flow_create(sa->fdir_portid, > > + &sa->attr, sa->pattern, sa->action, > > + &err); > > + if (!sa->flow) { > > + RTE_LOG(ERR, IPSEC, > > + "Flow Creation failed\n"); > > + return -1; > > + } > > + > > + return 0; > > +} > > + > > /* > > * queue crypto-ops into PMD queue. > > */ > > diff --git a/examples/ipsec-secgw/ipsec.h=20 > > b/examples/ipsec-secgw/ipsec.h index 4f2fd6184..00147895a 100644 > > --- a/examples/ipsec-secgw/ipsec.h > > +++ b/examples/ipsec-secgw/ipsec.h > > @@ -46,6 +46,8 @@ > > > > #define IP6_VERSION (6) > > > > +#define IPV6_ADDR_LEN 16 > > + > > struct rte_crypto_xform; > > struct ipsec_xform; > > struct rte_mbuf; > > @@ -138,6 +140,9 @@ struct ipsec_sa { > > }; > > enum rte_security_ipsec_sa_direction direction; > > uint16_t portid; > > + uint16_t fdir_portid; > > + uint8_t fdir_qid; > > + uint8_t fdir_flag; > > > > #define MAX_RTE_FLOW_PATTERN (4) > > #define MAX_RTE_FLOW_ACTIONS (3) > > @@ -383,5 +388,11 @@ create_lookaside_session(struct ipsec_ctx=20 > > *ipsec_ctx, struct ipsec_sa *sa, int create_inline_session(struct=20 > > socket_ctx *skt_ctx, struct ipsec_sa *sa, > > struct rte_ipsec_session *ips); > > +int > > +check_flow_params(uint16_t fdir_portid, uint8_t fdir_qid); > > + > > +int > > +create_ipsec_esp_flow(struct ipsec_sa *sa); > > > > +int check_fdir_configured(uint16_t portid); > > #endif /* __IPSEC_H__ */ > > diff --git a/examples/ipsec-secgw/sa.c b/examples/ipsec-secgw/sa.c=20 > > index 4822d6bda..9955dfcbe 100644 > > --- a/examples/ipsec-secgw/sa.c > > +++ b/examples/ipsec-secgw/sa.c > > @@ -20,6 +20,9 @@ > > #include > > #include > > #include > > +#include > > +#include > > +#include > > > > #include "ipsec.h" > > #include "esp.h" > > @@ -271,6 +274,7 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, > > uint32_t type_p =3D 0; > > uint32_t portid_p =3D 0; > > uint32_t fallback_p =3D 0; > > + int16_t status_p =3D 0; > > > > if (strcmp(tokens[0], "in") =3D=3D 0) { > > ri =3D &nb_sa_in; > > @@ -681,6 +685,25 @@ parse_sa_tokens(char **tokens, uint32_t n_tokens, > > fallback_p =3D 1; > > continue; > > } > > + if (strcmp(tokens[ti], "flow-direction") =3D=3D 0) { > > + rule->fdir_flag =3D 1; > > + INCREMENT_TOKEN_INDEX(ti, n_tokens, status); > > + if (status->status < 0) > > + return; > > + rule->fdir_portid =3D atoi(tokens[ti]); > > + INCREMENT_TOKEN_INDEX(ti, n_tokens, status); > > + if (status->status < 0) > > + return; > > + rule->fdir_qid =3D atoi(tokens[ti]); > > + /* validating portid and queueid */ > > + status_p =3D check_flow_params(rule->fdir_portid, > > + rule->fdir_qid); > > + if (status_p < 0) { > > + printf("port id %u / queue id %u is not valid\n", > > + rule->fdir_portid, rule->fdir_qid); > > + } > > + continue; > > + } > > > > /* unrecognizeable input */ > > APP_CHECK(0, status, "unrecognized input \"%s\"", @@ -823,6 > > +846,9 @@ print_one_sa_rule(const struct ipsec_sa *sa, int inbound) > > break; > > } > > } > > + if (sa->fdir_flag =3D=3D 1) > > + printf("flow-direction %d %d", sa->fdir_portid, sa->fdir_qid); > > + > > printf("\n"); > > } > > > > @@ -1153,7 +1179,15 @@ sa_add_rules(struct sa_ctx *sa_ctx, const=20 > > struct ipsec_sa entries[], > > return -EINVAL; > > } > > } > > - > > + if (sa->fdir_flag && > > + ips->type =3D=3D > > + RTE_SECURITY_ACTION_TYPE_LOOKASIDE_PROTOCOL > > && > > + inbound) { > > + rc =3D create_ipsec_esp_flow(sa); > > + if (rc !=3D 0) > > + RTE_LOG(ERR, IPSEC_ESP, > > + "create_ipsec_esp flow failed\n"); > > + } > > print_one_sa_rule(sa, inbound); > > } > > > > @@ -1256,6 +1290,20 @@ fill_ipsec_session(struct rte_ipsec_session=20 > > *ss, struct rte_ipsec_sa *sa) > > return rc; > > } > > > > +int > > +check_fdir_configured(uint16_t portid) { > > + struct ipsec_sa *sa =3D NULL; > > + uint32_t idx_sa =3D 0; > > + > > + for (idx_sa =3D 0; idx_sa < nb_sa_in; idx_sa++) { > > + sa =3D &sa_in[idx_sa]; > > + if (sa->fdir_portid =3D=3D portid) > > + return sa->fdir_flag; > > + } > > + return 0; > > +} > > + > > /* > > * Initialise related rte_ipsec_sa object. > > */ > > -- > > 2.17.1