Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/133589/?format=api
{ "id": 133589, "url": "http://patches.dpdk.org/api/patches/133589/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/patch/20231029163202.216450-16-getelson@nvidia.com/", "project": { "id": 1, "url": "http://patches.dpdk.org/api/projects/1/?format=api", "name": "DPDK", "link_name": "dpdk", "list_id": "dev.dpdk.org", "list_email": "dev@dpdk.org", "web_url": "http://core.dpdk.org", "scm_url": "git://dpdk.org/dpdk", "webscm_url": "http://git.dpdk.org/dpdk", "list_archive_url": "https://inbox.dpdk.org/dev", "list_archive_url_format": "https://inbox.dpdk.org/dev/{}", "commit_url_format": "" }, "msgid": "<20231029163202.216450-16-getelson@nvidia.com>", "list_archive_url": "https://inbox.dpdk.org/dev/20231029163202.216450-16-getelson@nvidia.com", "date": "2023-10-29T16:31:48", "name": "[16/30] net/mlx5/hws: support IPsec encryption/decryption action", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": true, "hash": "d4a0a74dc8fd2f204acbd03e9eea246ceb3bf6e4", "submitter": { "id": 1882, "url": "http://patches.dpdk.org/api/people/1882/?format=api", "name": "Gregory Etelson", "email": "getelson@nvidia.com" }, "delegate": { "id": 3268, "url": "http://patches.dpdk.org/api/users/3268/?format=api", "username": "rasland", "first_name": "Raslan", "last_name": "Darawsheh", "email": "rasland@nvidia.com" }, "mbox": "http://patches.dpdk.org/project/dpdk/patch/20231029163202.216450-16-getelson@nvidia.com/mbox/", "series": [ { "id": 30049, "url": "http://patches.dpdk.org/api/series/30049/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/list/?series=30049", "date": "2023-10-29T16:31:33", "name": "[01/30] net/mlx5/hws: Definer, add mlx5dr context to definer_conv_data", "version": 1, "mbox": "http://patches.dpdk.org/series/30049/mbox/" } ], "comments": "http://patches.dpdk.org/api/patches/133589/comments/", "check": "warning", "checks": "http://patches.dpdk.org/api/patches/133589/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<dev-bounces@dpdk.org>", "X-Original-To": "patchwork@inbox.dpdk.org", "Delivered-To": "patchwork@inbox.dpdk.org", "Received": [ "from mails.dpdk.org (mails.dpdk.org [217.70.189.124])\n\tby inbox.dpdk.org (Postfix) with ESMTP id EF9C043238;\n\tSun, 29 Oct 2023 17:34:46 +0100 (CET)", "from mails.dpdk.org (localhost [127.0.0.1])\n\tby mails.dpdk.org (Postfix) with ESMTP id 484BC40E54;\n\tSun, 29 Oct 2023 17:33:27 +0100 (CET)", "from NAM10-DM6-obe.outbound.protection.outlook.com\n (mail-dm6nam10on2077.outbound.protection.outlook.com [40.107.93.77])\n by mails.dpdk.org (Postfix) with ESMTP id D45C940E54\n for <dev@dpdk.org>; Sun, 29 Oct 2023 17:33:25 +0100 (CET)", "from MN2PR16CA0035.namprd16.prod.outlook.com (2603:10b6:208:134::48)\n by MN2PR12MB4254.namprd12.prod.outlook.com (2603:10b6:208:1d0::17)\n with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6933.26; Sun, 29 Oct\n 2023 16:33:23 +0000", "from BL02EPF0001A0FC.namprd03.prod.outlook.com\n (2603:10b6:208:134:cafe::53) by MN2PR16CA0035.outlook.office365.com\n (2603:10b6:208:134::48) with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6863.36 via Frontend\n Transport; Sun, 29 Oct 2023 16:33:23 +0000", "from mail.nvidia.com (216.228.117.161) by\n BL02EPF0001A0FC.mail.protection.outlook.com (10.167.242.103) with Microsoft\n SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id\n 15.20.6933.15 via Frontend Transport; Sun, 29 Oct 2023 16:33:23 +0000", "from rnnvmail201.nvidia.com (10.129.68.8) by mail.nvidia.com\n (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.41; Sun, 29 Oct\n 2023 09:33:07 -0700", "from nvidia.com (10.126.231.35) by rnnvmail201.nvidia.com\n (10.129.68.8) with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.41; Sun, 29 Oct\n 2023 09:33:04 -0700" ], "ARC-Seal": "i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;\n b=JIKbaodj6+joydXSEXusoOuDdmofXC2FxzEucwU0yfe4l91iQTyVQFWVOUiKq/PCq+fmPFxO0661ZzBkIbT8nsl+AVVVlPGuTW/2oV5b2H1mUw3z3zW3fHHRAsaIj4ME9zGWlDTdfbAKCqpkZ9A9yQ3uIwl7oxZQ1Yp54zjFR8sNbDID+U5IGh30yihImqdMTY1W0ufW747REboZnoiUxrBSd5L1z/2zD6zmGmMbVcmuENEuKpPQRSsPOerzaHVqTjXy3XtysKNlBcQ8BjAIz71M2wRR6XptCUAEFZY9Vj+zaBpuEP/ZwqxoOfC5W2LVYPEOWHQB3bqpkaDssjqMVg==", "ARC-Message-Signature": "i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;\n s=arcselector9901;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;\n bh=RSMsZKVOechGsS8FtSMKl8yi/hBvCQGjscgJOwZwqVM=;\n b=PdhmDawZCYT95XxOR7GieqCSwXHyg4TZGuXN/Bf8m8ZwTI+wj/yRqeP8j3TPTlonJFxzdKvqL804tCQNZm4a6cJ62oF2XcOD4CCRtXfLbYCKUJ0jNWMqlAWYqcKU3qqlrqzfG47Pbd7SEL5OvcUJxVifJfdZV4ZHySgPciQDQCWIsC04MwpxcYlwMKrOBju7vdnTkAxO3DvIng6L/j2ZT1SHBEoIv3ltgQ4Vjv0Tb4ECZYCBy0MxlSqXwnuCq1Rsq+LKn1Gk3rB8E7YqewPgzwzC5Ld/mcoxXVMRNPa2HrPzh95OEX5flCuqQQVeJ5xssBS9q/1y/KAt25B7u8fLlQ==", "ARC-Authentication-Results": "i=1; mx.microsoft.com 1; spf=pass (sender ip is\n 216.228.117.161) smtp.rcpttodomain=dpdk.org smtp.mailfrom=nvidia.com;\n dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com;\n dkim=none (message not signed); arc=none (0)", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com;\n s=selector2;\n h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;\n bh=RSMsZKVOechGsS8FtSMKl8yi/hBvCQGjscgJOwZwqVM=;\n b=r8cR64yDZHSQq1XPyacX9Tn2pDx6pucmw79w6upI2xIDeGipZTbHarDZLRClFga39ELdly9K68P2hMf7UN2clZsXhJ8xqUy7llzrqv9ht3NBRlmYo88kdwUTndOZXOnVDxv5Rgl+P00g6cV5ZAOhb3/Clo1sBTwzPrwIcZFJvQDmgYYl1EIPUyCtzyxefRxP3LEFoW8BC/6B36lMZSCNjvSpvhVvbIdasIHfJ8LYb7GYOmlxIRfkQLDuuEId4m6/kKjxk+92MbNSxEzDRyajJZoNLLn6ByWsMv+yfDTcv0QDxRijRbuCCgqHk7lBcGvTceWOJJzYFcKZsQPJjQH3Mg==", "X-MS-Exchange-Authentication-Results": "spf=pass (sender IP is 216.228.117.161)\n smtp.mailfrom=nvidia.com;\n dkim=none (message not signed)\n header.d=none;dmarc=pass action=none header.from=nvidia.com;", "Received-SPF": "Pass (protection.outlook.com: domain of nvidia.com designates\n 216.228.117.161 as permitted sender) receiver=protection.outlook.com;\n client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C", "From": "Gregory Etelson <getelson@nvidia.com>", "To": "<dev@dpdk.org>", "CC": "<getelson@nvidia.com>, <mkashani@nvidia.com>, <rasland@nvidia.com>,\n \"Hamdan Igbaria\" <hamdani@nvidia.com>, Alex Vesker <valex@nvidia.com>, Matan\n Azrad <matan@nvidia.com>, Viacheslav Ovsiienko <viacheslavo@nvidia.com>, Ori\n Kam <orika@nvidia.com>, Suanming Mou <suanmingm@nvidia.com>", "Subject": "[PATCH 16/30] net/mlx5/hws: support IPsec encryption/decryption\n action", "Date": "Sun, 29 Oct 2023 18:31:48 +0200", "Message-ID": "<20231029163202.216450-16-getelson@nvidia.com>", "X-Mailer": "git-send-email 2.39.2", "In-Reply-To": "<20231029163202.216450-1-getelson@nvidia.com>", "References": "<20231029163202.216450-1-getelson@nvidia.com>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Content-Type": "text/plain", "X-Originating-IP": "[10.126.231.35]", "X-ClientProxiedBy": "rnnvmail203.nvidia.com (10.129.68.9) To\n rnnvmail201.nvidia.com (10.129.68.8)", "X-EOPAttributedMessage": "0", "X-MS-PublicTrafficType": "Email", "X-MS-TrafficTypeDiagnostic": "BL02EPF0001A0FC:EE_|MN2PR12MB4254:EE_", "X-MS-Office365-Filtering-Correlation-Id": "ca743612-e3a7-4624-dd3a-08dbd89cc4e2", "X-MS-Exchange-SenderADCheck": "1", "X-MS-Exchange-AntiSpam-Relay": "0", "X-Microsoft-Antispam": "BCL:0;", "X-Microsoft-Antispam-Message-Info": "\n NGchDy+knkF0GiS7AqvPlZ9T+JIcjDfsD0ArvX1TvvFJUFX9ZOMSWUkXPGKhXOYe3u0UgCA/c0TQ/ihnm1P5dNGcA07OPW38Gf7hLfOc20U0YvCSN/VfcKesC4iK+fj+TeRxFgrmnWVAOEWHbnFqkxLp1qHFzc8V6xmar74o4DkwwfIfjizY+IKSbulHT8RyccQx883+AUJ7BFX95/z3wXfB/FYLbJ4vh5OUsuxyFOEeckdZxiht0HtFjszP3oxipgUnLdvxKxrJ4RFDUCvSvVvimPKep2tqiSgZyfRywZjLhRzEZrYQH8hKSwIgghApQN6YTJ/w01eGfyQPMcBwTvQwl4e5jb9O2Pp27G42/Sg3sL+Vafq3h9Y4muGA/9u+T5s0gBbeoYvy2b75MKfdA50sBJ43bXoeQKITsj4ilQDkc3U84pZNcAvndPJG3z67sq+/vBvyuv2VJMSAl4cadDVV0qA+VIxFr2/3coKHR5Zk9uBsbIOiKpICrNyJVIE9wLDbpOrtj8lEY+Uzvkra+i8qEJ30OWpnBP1NaV+adYuXXsepXHzyWeuVFlm4q7r7B8tjdjg48YOye83ctdMOblNg3PC/YyKt8xahjz2PcuWATNDcyyx8vLJceBRK3j+ZprB+WYsBjerUcMu0zf64gXjSk4XGsSzntA7oSicTWgr/0kRMbJh2SoFTAAWsUMbENUgwHSjsD08RBYqzOdbmSe0+ZeKGq2r6ln1vS397SyQmpfg51PS+c1AKMRy0217J", "X-Forefront-Antispam-Report": "CIP:216.228.117.161; CTRY:US; LANG:en; SCL:1;\n SRV:;\n IPV:NLI; SFV:NSPM; H:mail.nvidia.com; PTR:dc6edge2.nvidia.com; CAT:NONE;\n SFS:(13230031)(4636009)(396003)(39860400002)(136003)(346002)(376002)(230922051799003)(186009)(451199024)(1800799009)(82310400011)(64100799003)(46966006)(40470700004)(36840700001)(40480700001)(40460700003)(55016003)(47076005)(83380400001)(26005)(16526019)(6286002)(107886003)(1076003)(336012)(426003)(356005)(82740400003)(36860700001)(7636003)(70206006)(70586007)(2616005)(316002)(6916009)(5660300002)(54906003)(4326008)(8676002)(8936002)(41300700001)(6666004)(7696005)(2906002)(30864003)(478600001)(36756003)(86362001);\n DIR:OUT; SFP:1101;", "X-OriginatorOrg": "Nvidia.com", "X-MS-Exchange-CrossTenant-OriginalArrivalTime": "29 Oct 2023 16:33:23.0881 (UTC)", "X-MS-Exchange-CrossTenant-Network-Message-Id": "\n ca743612-e3a7-4624-dd3a-08dbd89cc4e2", "X-MS-Exchange-CrossTenant-Id": "43083d15-7273-40c1-b7db-39efd9ccc17a", "X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp": "\n TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a; Ip=[216.228.117.161];\n Helo=[mail.nvidia.com]", "X-MS-Exchange-CrossTenant-AuthSource": "\n BL02EPF0001A0FC.namprd03.prod.outlook.com", "X-MS-Exchange-CrossTenant-AuthAs": "Anonymous", "X-MS-Exchange-CrossTenant-FromEntityHeader": "HybridOnPrem", "X-MS-Exchange-Transport-CrossTenantHeadersStamped": "MN2PR12MB4254", "X-BeenThere": "dev@dpdk.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "DPDK patches and discussions <dev.dpdk.org>", "List-Unsubscribe": "<https://mails.dpdk.org/options/dev>,\n <mailto:dev-request@dpdk.org?subject=unsubscribe>", "List-Archive": "<http://mails.dpdk.org/archives/dev/>", "List-Post": "<mailto:dev@dpdk.org>", "List-Help": "<mailto:dev-request@dpdk.org?subject=help>", "List-Subscribe": "<https://mails.dpdk.org/listinfo/dev>,\n <mailto:dev-request@dpdk.org?subject=subscribe>", "Errors-To": "dev-bounces@dpdk.org" }, "content": "From: Hamdan Igbaria <hamdani@nvidia.com>\n\nSupport crypto action creation, this action allows encryption/decryption\nof the packet according a specific security crypto protocol.\nFor now we support encryption/decryption according ipsec protocol.\nipsec encryption handles the encoding of the data.\nipsec decryption handles the decoding of the data and a decryption result\nstatus will be placed in the ipsec_syndrome field.\nBoth operations should be used only for packets that have esp header and\nipsec trailer.\n\nSigned-off-by: Hamdan Igbaria <hamdani@nvidia.com>\nReviewed-by: Alex Vesker <valex@nvidia.com>\nAcked-by: Matan Azrad <matan@nvidia.com>\n---\n drivers/common/mlx5/mlx5_prm.h | 12 ++\n drivers/net/mlx5/hws/mlx5dr.h | 42 +++++++\n drivers/net/mlx5/hws/mlx5dr_action.c | 172 +++++++++++++++++++++++++-\n drivers/net/mlx5/hws/mlx5dr_action.h | 44 ++++---\n drivers/net/mlx5/hws/mlx5dr_cmd.c | 8 ++\n drivers/net/mlx5/hws/mlx5dr_cmd.h | 2 +-\n drivers/net/mlx5/hws/mlx5dr_debug.c | 2 +\n drivers/net/mlx5/hws/mlx5dr_matcher.c | 5 +\n 8 files changed, 266 insertions(+), 21 deletions(-)", "diff": "diff --git a/drivers/common/mlx5/mlx5_prm.h b/drivers/common/mlx5/mlx5_prm.h\nindex 2b499666f8..0eecf0691b 100644\n--- a/drivers/common/mlx5/mlx5_prm.h\n+++ b/drivers/common/mlx5/mlx5_prm.h\n@@ -3498,6 +3498,8 @@ enum mlx5_ifc_stc_action_type {\n \tMLX5_IFC_STC_ACTION_TYPE_HEADER_INSERT = 0x0b,\n \tMLX5_IFC_STC_ACTION_TYPE_TAG = 0x0c,\n \tMLX5_IFC_STC_ACTION_TYPE_ACC_MODIFY_LIST = 0x0e,\n+\tMLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_ENCRYPTION = 0x10,\n+\tMLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_DECRYPTION = 0x11,\n \tMLX5_IFC_STC_ACTION_TYPE_ASO = 0x12,\n \tMLX5_IFC_STC_ACTION_TYPE_COUNTER = 0x14,\n \tMLX5_IFC_STC_ACTION_TYPE_ADD_FIELD = 0x1b,\n@@ -3546,6 +3548,14 @@ struct mlx5_ifc_stc_ste_param_execute_aso_bits {\n \tu8 reserved_at_28[0x18];\n };\n \n+struct mlx5_ifc_stc_ste_param_ipsec_encrypt_bits {\n+\tu8 ipsec_object_id[0x20];\n+};\n+\n+struct mlx5_ifc_stc_ste_param_ipsec_decrypt_bits {\n+\tu8 ipsec_object_id[0x20];\n+};\n+\n struct mlx5_ifc_stc_ste_param_header_modify_list_bits {\n \tu8 header_modify_pattern_id[0x20];\n \tu8 header_modify_argument_id[0x20];\n@@ -3612,6 +3622,8 @@ union mlx5_ifc_stc_param_bits {\n \tstruct mlx5_ifc_set_action_in_bits set;\n \tstruct mlx5_ifc_copy_action_in_bits copy;\n \tstruct mlx5_ifc_stc_ste_param_vport_bits vport;\n+\tstruct mlx5_ifc_stc_ste_param_ipsec_encrypt_bits ipsec_encrypt;\n+\tstruct mlx5_ifc_stc_ste_param_ipsec_decrypt_bits ipsec_decrypt;\n \tu8 reserved_at_0[0x80];\n };\n \ndiff --git a/drivers/net/mlx5/hws/mlx5dr.h b/drivers/net/mlx5/hws/mlx5dr.h\nindex 39d902e762..74d05229c7 100644\n--- a/drivers/net/mlx5/hws/mlx5dr.h\n+++ b/drivers/net/mlx5/hws/mlx5dr.h\n@@ -45,6 +45,8 @@ enum mlx5dr_action_type {\n \tMLX5DR_ACTION_TYP_PUSH_VLAN,\n \tMLX5DR_ACTION_TYP_ASO_METER,\n \tMLX5DR_ACTION_TYP_ASO_CT,\n+\tMLX5DR_ACTION_TYP_CRYPTO_ENCRYPT,\n+\tMLX5DR_ACTION_TYP_CRYPTO_DECRYPT,\n \tMLX5DR_ACTION_TYP_DEST_ROOT,\n \tMLX5DR_ACTION_TYP_DEST_ARRAY,\n \tMLX5DR_ACTION_TYP_MAX,\n@@ -176,6 +178,22 @@ struct mlx5dr_action_mh_pattern {\n \t__be64 *data;\n };\n \n+enum mlx5dr_action_crypto_op {\n+\tMLX5DR_ACTION_CRYPTO_OP_NONE,\n+\tMLX5DR_ACTION_CRYPTO_OP_ENCRYPT,\n+\tMLX5DR_ACTION_CRYPTO_OP_DECRYPT,\n+};\n+\n+enum mlx5dr_action_crypto_type {\n+\tMLX5DR_ACTION_CRYPTO_TYPE_NISP,\n+\tMLX5DR_ACTION_CRYPTO_TYPE_IPSEC,\n+};\n+\n+struct mlx5dr_action_crypto_attr {\n+\tenum mlx5dr_action_crypto_type crypto_type;\n+\tenum mlx5dr_action_crypto_op op;\n+};\n+\n /* In actions that take offset, the offset is unique, pointing to a single\n * resource and the user should not reuse the same index because data changing\n * is not atomic.\n@@ -216,6 +234,10 @@ struct mlx5dr_rule_action {\n \t\t\tuint32_t offset;\n \t\t\tenum mlx5dr_action_aso_ct_flags direction;\n \t\t} aso_ct;\n+\n+\t\tstruct {\n+\t\t\tuint32_t offset;\n+\t\t} crypto;\n \t};\n };\n \n@@ -691,6 +713,26 @@ mlx5dr_action_create_dest_root(struct mlx5dr_context *ctx,\n \t\t\t\tuint16_t priority,\n \t\t\t\tuint32_t flags);\n \n+/* Create crypto action, this action will create specific security protocol\n+ * encryption/decryption, for now we only support IPSec protocol.\n+ *\n+ * @param[in] ctx\n+ *\tThe context in which the new action will be created.\n+ * @param[in] devx_obj\n+ *\tThe SADB corresponding devx obj\n+ * @param[in] attr\n+ *\tattributes: specifies if to encrypt/decrypt,\n+ *\talso specifies the crypto security protocol.\n+ * @param[in] flags\n+ *\tAction creation flags. (enum mlx5dr_action_flags)\n+ * @return pointer to mlx5dr_action on success NULL otherwise.\n+ */\n+struct mlx5dr_action *\n+mlx5dr_action_create_crypto(struct mlx5dr_context *ctx,\n+\t\t\t struct mlx5dr_devx_obj *devx_obj,\n+\t\t\t struct mlx5dr_action_crypto_attr *attr,\n+\t\t\t uint32_t flags);\n+\n /* Destroy direct rule action.\n *\n * @param[in] action\ndiff --git a/drivers/net/mlx5/hws/mlx5dr_action.c b/drivers/net/mlx5/hws/mlx5dr_action.c\nindex 11a7c58925..4910b4f730 100644\n--- a/drivers/net/mlx5/hws/mlx5dr_action.c\n+++ b/drivers/net/mlx5/hws/mlx5dr_action.c\n@@ -9,11 +9,12 @@\n #define MLX5DR_ACTION_METER_INIT_COLOR_OFFSET 1\n \n /* This is the maximum allowed action order for each table type:\n- *\t TX: POP_VLAN, CTR, ASO_METER, AS_CT, PUSH_VLAN, MODIFY, ENCAP, Term\n- *\t RX: TAG, DECAP, POP_VLAN, CTR, ASO_METER, ASO_CT, PUSH_VLAN, MODIFY,\n- *\t ENCAP, Term\n- *\tFDB: DECAP, POP_VLAN, CTR, ASO_METER, ASO_CT, PUSH_VLAN, MODIFY,\n- *\t ENCAP, Term\n+ *\t TX: POP_VLAN, CTR, ASO_METER, AS_CT, PUSH_VLAN, MODIFY, ENCAP, ENCRYPT,\n+ *\t Term\n+ *\t RX: TAG, DECAP, POP_VLAN, CTR, DECRYPT, ASO_METER, ASO_CT, PUSH_VLAN,\n+ *\t MODIFY, ENCAP, Term\n+ *\tFDB: DECAP, POP_VLAN, CTR, DECRYPT, ASO_METER, ASO_CT, PUSH_VLAN, MODIFY,\n+ *\t ENCAP, ENCRYPT, Term\n */\n static const uint32_t action_order_arr[MLX5DR_TABLE_TYPE_MAX][MLX5DR_ACTION_TYP_MAX] = {\n \t[MLX5DR_TABLE_TYPE_NIC_RX] = {\n@@ -23,6 +24,7 @@ static const uint32_t action_order_arr[MLX5DR_TABLE_TYPE_MAX][MLX5DR_ACTION_TYP_\n \t\tBIT(MLX5DR_ACTION_TYP_POP_VLAN),\n \t\tBIT(MLX5DR_ACTION_TYP_POP_VLAN),\n \t\tBIT(MLX5DR_ACTION_TYP_CTR),\n+\t\tBIT(MLX5DR_ACTION_TYP_CRYPTO_DECRYPT),\n \t\tBIT(MLX5DR_ACTION_TYP_ASO_METER),\n \t\tBIT(MLX5DR_ACTION_TYP_ASO_CT),\n \t\tBIT(MLX5DR_ACTION_TYP_PUSH_VLAN),\n@@ -49,6 +51,7 @@ static const uint32_t action_order_arr[MLX5DR_TABLE_TYPE_MAX][MLX5DR_ACTION_TYP_\n \t\tBIT(MLX5DR_ACTION_TYP_MODIFY_HDR),\n \t\tBIT(MLX5DR_ACTION_TYP_REFORMAT_L2_TO_TNL_L2) |\n \t\tBIT(MLX5DR_ACTION_TYP_REFORMAT_L2_TO_TNL_L3),\n+\t\tBIT(MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT),\n \t\tBIT(MLX5DR_ACTION_TYP_TBL) |\n \t\tBIT(MLX5DR_ACTION_TYP_MISS) |\n \t\tBIT(MLX5DR_ACTION_TYP_DROP) |\n@@ -61,6 +64,7 @@ static const uint32_t action_order_arr[MLX5DR_TABLE_TYPE_MAX][MLX5DR_ACTION_TYP_\n \t\tBIT(MLX5DR_ACTION_TYP_POP_VLAN),\n \t\tBIT(MLX5DR_ACTION_TYP_POP_VLAN),\n \t\tBIT(MLX5DR_ACTION_TYP_CTR),\n+\t\tBIT(MLX5DR_ACTION_TYP_CRYPTO_DECRYPT),\n \t\tBIT(MLX5DR_ACTION_TYP_ASO_METER),\n \t\tBIT(MLX5DR_ACTION_TYP_ASO_CT),\n \t\tBIT(MLX5DR_ACTION_TYP_PUSH_VLAN),\n@@ -68,6 +72,7 @@ static const uint32_t action_order_arr[MLX5DR_TABLE_TYPE_MAX][MLX5DR_ACTION_TYP_\n \t\tBIT(MLX5DR_ACTION_TYP_MODIFY_HDR),\n \t\tBIT(MLX5DR_ACTION_TYP_REFORMAT_L2_TO_TNL_L2) |\n \t\tBIT(MLX5DR_ACTION_TYP_REFORMAT_L2_TO_TNL_L3),\n+\t\tBIT(MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT),\n \t\tBIT(MLX5DR_ACTION_TYP_TBL) |\n \t\tBIT(MLX5DR_ACTION_TYP_MISS) |\n \t\tBIT(MLX5DR_ACTION_TYP_VPORT) |\n@@ -266,6 +271,41 @@ bool mlx5dr_action_check_combo(enum mlx5dr_action_type *user_actions,\n \treturn valid_combo;\n }\n \n+bool mlx5dr_action_check_restrictions(struct mlx5dr_matcher *matcher,\n+\t\t\t\t enum mlx5dr_action_type *actions)\n+{\n+\tuint32_t restricted_bits;\n+\tuint8_t idx = 0;\n+\n+\t/* Check for restricted actions, these actions are restricted\n+\t * to RX or TX only in FDB domain.\n+\t * if one of these actions presented require correct optimize_flow_src.\n+\t */\n+\tif (matcher->tbl->type != MLX5DR_TABLE_TYPE_FDB)\n+\t\treturn false;\n+\n+\tswitch (matcher->attr.optimize_flow_src) {\n+\tcase MLX5DR_MATCHER_FLOW_SRC_WIRE:\n+\t\trestricted_bits = BIT(MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT);\n+\t\tbreak;\n+\tcase MLX5DR_MATCHER_FLOW_SRC_VPORT:\n+\t\trestricted_bits = BIT(MLX5DR_ACTION_TYP_CRYPTO_DECRYPT);\n+\t\tbreak;\n+\tdefault:\n+\t\trestricted_bits = BIT(MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT) |\n+\t\t\t\t BIT(MLX5DR_ACTION_TYP_CRYPTO_DECRYPT);\n+\t}\n+\n+\twhile (actions[idx] != MLX5DR_ACTION_TYP_LAST) {\n+\t\tif (BIT(actions[idx++]) & restricted_bits) {\n+\t\t\tDR_LOG(ERR, \"Invalid actions combination containing restricted actions was provided\");\n+\t\t\treturn true;\n+\t\t}\n+\t}\n+\n+\treturn false;\n+}\n+\n int mlx5dr_action_root_build_attr(struct mlx5dr_rule_action rule_actions[],\n \t\t\t\t uint32_t num_actions,\n \t\t\t\t struct mlx5dv_flow_action_attr *attr)\n@@ -383,6 +423,24 @@ mlx5dr_action_fixup_stc_attr(struct mlx5dr_context *ctx,\n \t\tuse_fixup = true;\n \t\tbreak;\n \n+\tcase MLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_ENCRYPTION:\n+\t\tif (fw_tbl_type == FS_FT_FDB_RX) {\n+\t\t\tfixup_stc_attr->action_type = MLX5_IFC_STC_ACTION_TYPE_NOP;\n+\t\t\tfixup_stc_attr->action_offset = stc_attr->action_offset;\n+\t\t\tfixup_stc_attr->stc_offset = stc_attr->stc_offset;\n+\t\t\tuse_fixup = true;\n+\t\t}\n+\t\tbreak;\n+\n+\tcase MLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_DECRYPTION:\n+\t\tif (fw_tbl_type == FS_FT_FDB_TX) {\n+\t\t\tfixup_stc_attr->action_type = MLX5_IFC_STC_ACTION_TYPE_NOP;\n+\t\t\tfixup_stc_attr->action_offset = stc_attr->action_offset;\n+\t\t\tfixup_stc_attr->stc_offset = stc_attr->stc_offset;\n+\t\t\tuse_fixup = true;\n+\t\t}\n+\t\tbreak;\n+\n \tdefault:\n \t\tbreak;\n \t}\n@@ -605,6 +663,16 @@ static void mlx5dr_action_fill_stc_attr(struct mlx5dr_action *action,\n \t\tattr->insert_header.insert_offset = MLX5DR_ACTION_HDR_LEN_L2_MACS;\n \t\tattr->insert_header.header_size = MLX5DR_ACTION_HDR_LEN_L2_VLAN;\n \t\tbreak;\n+\tcase MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT:\n+\t\tattr->action_type = MLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_ENCRYPTION;\n+\t\tattr->action_offset = MLX5DR_ACTION_OFFSET_DW5;\n+\t\tattr->id = obj->id;\n+\t\tbreak;\n+\tcase MLX5DR_ACTION_TYP_CRYPTO_DECRYPT:\n+\t\tattr->action_type = MLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_DECRYPTION;\n+\t\tattr->action_offset = MLX5DR_ACTION_OFFSET_DW5;\n+\t\tattr->id = obj->id;\n+\t\tbreak;\n \tdefault:\n \t\tDR_LOG(ERR, \"Invalid action type %d\", action->type);\n \t\tassert(false);\n@@ -1943,6 +2011,55 @@ mlx5dr_action_create_dest_root(struct mlx5dr_context *ctx,\n \treturn NULL;\n }\n \n+struct mlx5dr_action *\n+mlx5dr_action_create_crypto(struct mlx5dr_context *ctx,\n+\t\t\t struct mlx5dr_devx_obj *devx_obj,\n+\t\t\t struct mlx5dr_action_crypto_attr *attr,\n+\t\t\t uint32_t flags)\n+{\n+\tenum mlx5dr_action_type action_type;\n+\tstruct mlx5dr_action *action;\n+\n+\tif (mlx5dr_action_is_root_flags(flags)) {\n+\t\tDR_LOG(ERR, \"Action flags must be only non root (HWS)\");\n+\t\trte_errno = ENOTSUP;\n+\t\treturn NULL;\n+\t}\n+\n+\tif (attr->crypto_type != MLX5DR_ACTION_CRYPTO_TYPE_IPSEC) {\n+\t\trte_errno = ENOTSUP;\n+\t\treturn NULL;\n+\t}\n+\n+\tif (attr->op == MLX5DR_ACTION_CRYPTO_OP_ENCRYPT) {\n+\t\tif (flags & MLX5DR_ACTION_FLAG_HWS_RX) {\n+\t\t\trte_errno = EINVAL;\n+\t\t\treturn NULL;\n+\t\t}\n+\t\taction_type = MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT;\n+\t} else if (attr->op == MLX5DR_ACTION_CRYPTO_OP_DECRYPT) {\n+\t\tif (flags & MLX5DR_ACTION_FLAG_HWS_TX) {\n+\t\t\trte_errno = EINVAL;\n+\t\t\treturn NULL;\n+\t\t}\n+\t\taction_type = MLX5DR_ACTION_TYP_CRYPTO_DECRYPT;\n+\t} else {\n+\t\trte_errno = ENOTSUP;\n+\t\treturn NULL;\n+\t}\n+\n+\taction = mlx5dr_action_create_generic(ctx, flags, action_type);\n+\tif (!action)\n+\t\treturn NULL;\n+\n+\tif (mlx5dr_action_create_stcs(action, devx_obj)) {\n+\t\tsimple_free(action);\n+\t\treturn NULL;\n+\t}\n+\n+\treturn action;\n+}\n+\n static void mlx5dr_action_destroy_hws(struct mlx5dr_action *action)\n {\n \tstruct mlx5dr_devx_obj *obj = NULL;\n@@ -1963,6 +2080,8 @@ static void mlx5dr_action_destroy_hws(struct mlx5dr_action *action)\n \tcase MLX5DR_ACTION_TYP_ASO_METER:\n \tcase MLX5DR_ACTION_TYP_ASO_CT:\n \tcase MLX5DR_ACTION_TYP_PUSH_VLAN:\n+\tcase MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT:\n+\tcase MLX5DR_ACTION_TYP_CRYPTO_DECRYPT:\n \t\tmlx5dr_action_destroy_stcs(action);\n \t\tbreak;\n \tcase MLX5DR_ACTION_TYP_DEST_ROOT:\n@@ -2460,6 +2579,33 @@ mlx5dr_action_setter_common_decap(struct mlx5dr_actions_apply_data *apply,\n \t\t\t\t\t\t\t MLX5DR_CONTEXT_SHARED_STC_DECAP));\n }\n \n+static void\n+mlx5dr_action_setter_crypto_encryption(struct mlx5dr_actions_apply_data *apply,\n+\t\t\t\t struct mlx5dr_actions_wqe_setter *setter)\n+{\n+\tstruct mlx5dr_rule_action *rule_action;\n+\n+\trule_action = &apply->rule_action[setter->idx_single];\n+\tapply->wqe_data[MLX5DR_ACTION_OFFSET_DW5] = htobe32(rule_action->crypto.offset);\n+\tmlx5dr_action_apply_stc(apply, MLX5DR_ACTION_STC_IDX_DW5, setter->idx_single);\n+}\n+\n+static void\n+mlx5dr_action_setter_crypto_decryption(struct mlx5dr_actions_apply_data *apply,\n+\t\t\t\t struct mlx5dr_actions_wqe_setter *setter)\n+{\n+\tstruct mlx5dr_rule_action *rule_action;\n+\n+\trule_action = &apply->rule_action[setter->idx_triple];\n+\n+\tmlx5dr_action_apply_stc(apply, MLX5DR_ACTION_STC_IDX_DW5, setter->idx_triple);\n+\tapply->wqe_ctrl->stc_ix[MLX5DR_ACTION_STC_IDX_DW6] = 0;\n+\tapply->wqe_ctrl->stc_ix[MLX5DR_ACTION_STC_IDX_DW7] = 0;\n+\tapply->wqe_data[MLX5DR_ACTION_OFFSET_DW5] = htobe32(rule_action->crypto.offset);\n+\tapply->wqe_data[MLX5DR_ACTION_OFFSET_DW6] = 0;\n+\tapply->wqe_data[MLX5DR_ACTION_OFFSET_DW7] = 0;\n+}\n+\n int mlx5dr_action_template_process(struct mlx5dr_action_template *at)\n {\n \tstruct mlx5dr_actions_wqe_setter *start_setter = at->setters + 1;\n@@ -2594,6 +2740,22 @@ int mlx5dr_action_template_process(struct mlx5dr_action_template *at)\n \t\t\tsetter->idx_ctr = i;\n \t\t\tbreak;\n \n+\t\tcase MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT:\n+\t\t\t/* Single encryption action, consume triple due to HW limitations */\n+\t\t\tsetter = mlx5dr_action_setter_find_first(last_setter, ASF_TRIPLE);\n+\t\t\tsetter->flags |= ASF_TRIPLE;\n+\t\t\tsetter->set_single = &mlx5dr_action_setter_crypto_encryption;\n+\t\t\tsetter->idx_single = i;\n+\t\t\tbreak;\n+\n+\t\tcase MLX5DR_ACTION_TYP_CRYPTO_DECRYPT:\n+\t\t\t/* Triple decryption action */\n+\t\t\tsetter = mlx5dr_action_setter_find_first(last_setter, ASF_TRIPLE);\n+\t\t\tsetter->flags |= ASF_TRIPLE;\n+\t\t\tsetter->set_triple = &mlx5dr_action_setter_crypto_decryption;\n+\t\t\tsetter->idx_triple = i;\n+\t\t\tbreak;\n+\n \t\tdefault:\n \t\t\tDR_LOG(ERR, \"Unsupported action type: %d\", action_type[i]);\n \t\t\trte_errno = ENOTSUP;\ndiff --git a/drivers/net/mlx5/hws/mlx5dr_action.h b/drivers/net/mlx5/hws/mlx5dr_action.h\nindex 582a38bebc..6bfa0bcc4a 100644\n--- a/drivers/net/mlx5/hws/mlx5dr_action.h\n+++ b/drivers/net/mlx5/hws/mlx5dr_action.h\n@@ -21,6 +21,8 @@ enum mlx5dr_action_stc_idx {\n \tMLX5DR_ACTION_STC_IDX_LAST_COMBO1 = 3,\n \t/* STC combo2: CTR, 3 x SINGLE, Hit */\n \tMLX5DR_ACTION_STC_IDX_LAST_COMBO2 = 4,\n+\t/* STC combo2: CTR, TRIPLE, Hit */\n+\tMLX5DR_ACTION_STC_IDX_LAST_COMBO3 = 2,\n };\n \n enum mlx5dr_action_offset {\n@@ -52,6 +54,7 @@ enum mlx5dr_action_setter_flag {\n \tASF_SINGLE2 = 1 << 1,\n \tASF_SINGLE3 = 1 << 2,\n \tASF_DOUBLE = ASF_SINGLE2 | ASF_SINGLE3,\n+\tASF_TRIPLE = ASF_SINGLE1 | ASF_DOUBLE,\n \tASF_REPARSE = 1 << 3,\n \tASF_REMOVE = 1 << 4,\n \tASF_MODIFY = 1 << 5,\n@@ -94,10 +97,12 @@ typedef void (*mlx5dr_action_setter_fp)\n struct mlx5dr_actions_wqe_setter {\n \tmlx5dr_action_setter_fp set_single;\n \tmlx5dr_action_setter_fp set_double;\n+\tmlx5dr_action_setter_fp set_triple;\n \tmlx5dr_action_setter_fp set_hit;\n \tmlx5dr_action_setter_fp set_ctr;\n \tuint8_t idx_single;\n \tuint8_t idx_double;\n+\tuint8_t idx_triple;\n \tuint8_t idx_ctr;\n \tuint8_t idx_hit;\n \tuint8_t flags;\n@@ -183,6 +188,9 @@ int mlx5dr_action_template_process(struct mlx5dr_action_template *at);\n bool mlx5dr_action_check_combo(enum mlx5dr_action_type *user_actions,\n \t\t\t enum mlx5dr_table_type table_type);\n \n+bool mlx5dr_action_check_restrictions(struct mlx5dr_matcher *matcher,\n+\t\t\t\t enum mlx5dr_action_type *actions);\n+\n int mlx5dr_action_alloc_single_stc(struct mlx5dr_context *ctx,\n \t\t\t\t struct mlx5dr_cmd_stc_modify_attr *stc_attr,\n \t\t\t\t uint32_t table_type,\n@@ -230,26 +238,32 @@ mlx5dr_action_apply_setter(struct mlx5dr_actions_apply_data *apply,\n \tuint8_t num_of_actions;\n \n \t/* Set control counter */\n-\tif (setter->flags & ASF_CTR)\n+\tif (setter->set_ctr)\n \t\tsetter->set_ctr(apply, setter);\n \telse\n \t\tmlx5dr_action_setter_default_ctr(apply, setter);\n \n-\t/* Set single and double on match */\n \tif (!is_jumbo) {\n-\t\tif (setter->flags & ASF_SINGLE1)\n-\t\t\tsetter->set_single(apply, setter);\n-\t\telse\n-\t\t\tmlx5dr_action_setter_default_single(apply, setter);\n-\n-\t\tif (setter->flags & ASF_DOUBLE)\n-\t\t\tsetter->set_double(apply, setter);\n-\t\telse\n-\t\t\tmlx5dr_action_setter_default_double(apply, setter);\n-\n-\t\tnum_of_actions = setter->flags & ASF_DOUBLE ?\n-\t\t\tMLX5DR_ACTION_STC_IDX_LAST_COMBO1 :\n-\t\t\tMLX5DR_ACTION_STC_IDX_LAST_COMBO2;\n+\t\tif (unlikely(setter->set_triple)) {\n+\t\t\t/* Set triple on match */\n+\t\t\tsetter->set_triple(apply, setter);\n+\t\t\tnum_of_actions = MLX5DR_ACTION_STC_IDX_LAST_COMBO3;\n+\t\t} else {\n+\t\t\t/* Set single and double on match */\n+\t\t\tif (setter->set_single)\n+\t\t\t\tsetter->set_single(apply, setter);\n+\t\t\telse\n+\t\t\t\tmlx5dr_action_setter_default_single(apply, setter);\n+\n+\t\t\tif (setter->set_double)\n+\t\t\t\tsetter->set_double(apply, setter);\n+\t\t\telse\n+\t\t\t\tmlx5dr_action_setter_default_double(apply, setter);\n+\n+\t\t\tnum_of_actions = setter->set_double ?\n+\t\t\t\tMLX5DR_ACTION_STC_IDX_LAST_COMBO1 :\n+\t\t\t\tMLX5DR_ACTION_STC_IDX_LAST_COMBO2;\n+\t\t}\n \t} else {\n \t\tapply->wqe_data[MLX5DR_ACTION_OFFSET_DW5] = 0;\n \t\tapply->wqe_data[MLX5DR_ACTION_OFFSET_DW6] = 0;\ndiff --git a/drivers/net/mlx5/hws/mlx5dr_cmd.c b/drivers/net/mlx5/hws/mlx5dr_cmd.c\nindex c52cdd0767..3b3690699d 100644\n--- a/drivers/net/mlx5/hws/mlx5dr_cmd.c\n+++ b/drivers/net/mlx5/hws/mlx5dr_cmd.c\n@@ -541,6 +541,14 @@ mlx5dr_cmd_stc_modify_set_stc_param(struct mlx5dr_cmd_stc_modify_attr *stc_attr,\n \t\tMLX5_SET(stc_ste_param_remove_words, stc_parm,\n \t\t\t remove_size, stc_attr->remove_words.num_of_words);\n \t\tbreak;\n+\tcase MLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_ENCRYPTION:\n+\t\tMLX5_SET(stc_ste_param_ipsec_encrypt, stc_parm, ipsec_object_id,\n+\t\t\t stc_attr->id);\n+\t\tbreak;\n+\tcase MLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_DECRYPTION:\n+\t\tMLX5_SET(stc_ste_param_ipsec_decrypt, stc_parm, ipsec_object_id,\n+\t\t\t stc_attr->id);\n+\t\tbreak;\n \tdefault:\n \t\tDR_LOG(ERR, \"Not supported type %d\", stc_attr->action_type);\n \t\trte_errno = EINVAL;\ndiff --git a/drivers/net/mlx5/hws/mlx5dr_cmd.h b/drivers/net/mlx5/hws/mlx5dr_cmd.h\nindex 03db62e2e2..7bbb684dbd 100644\n--- a/drivers/net/mlx5/hws/mlx5dr_cmd.h\n+++ b/drivers/net/mlx5/hws/mlx5dr_cmd.h\n@@ -100,7 +100,7 @@ struct mlx5dr_cmd_stc_modify_attr {\n \tuint8_t action_offset;\n \tenum mlx5_ifc_stc_action_type action_type;\n \tunion {\n-\t\tuint32_t id; /* TIRN, TAG, FT ID, STE ID */\n+\t\tuint32_t id; /* TIRN, TAG, FT ID, STE ID, CRYPTO */\n \t\tstruct {\n \t\t\tuint8_t decap;\n \t\t\tuint16_t start_anchor;\ndiff --git a/drivers/net/mlx5/hws/mlx5dr_debug.c b/drivers/net/mlx5/hws/mlx5dr_debug.c\nindex e7b1f2cc32..8cf3909606 100644\n--- a/drivers/net/mlx5/hws/mlx5dr_debug.c\n+++ b/drivers/net/mlx5/hws/mlx5dr_debug.c\n@@ -24,6 +24,8 @@ const char *mlx5dr_debug_action_type_str[] = {\n \t[MLX5DR_ACTION_TYP_ASO_CT] = \"ASO_CT\",\n \t[MLX5DR_ACTION_TYP_DEST_ROOT] = \"DEST_ROOT\",\n \t[MLX5DR_ACTION_TYP_DEST_ARRAY] = \"DEST_ARRAY\",\n+\t[MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT] = \"CRYPTO_ENCRYPT\",\n+\t[MLX5DR_ACTION_TYP_CRYPTO_DECRYPT] = \"CRYPTO_DECRYPT\",\n };\n \n static_assert(ARRAY_SIZE(mlx5dr_debug_action_type_str) == MLX5DR_ACTION_TYP_MAX,\ndiff --git a/drivers/net/mlx5/hws/mlx5dr_matcher.c b/drivers/net/mlx5/hws/mlx5dr_matcher.c\nindex a82c182460..6f74cf3677 100644\n--- a/drivers/net/mlx5/hws/mlx5dr_matcher.c\n+++ b/drivers/net/mlx5/hws/mlx5dr_matcher.c\n@@ -714,6 +714,11 @@ static int mlx5dr_matcher_check_and_process_at(struct mlx5dr_matcher *matcher,\n \t\treturn rte_errno;\n \t}\n \n+\tif (mlx5dr_action_check_restrictions(matcher, at->action_type_arr)) {\n+\t\trte_errno = EINVAL;\n+\t\treturn rte_errno;\n+\t}\n+\n \t/* Process action template to setters */\n \tret = mlx5dr_action_template_process(at);\n \tif (ret) {\n", "prefixes": [ "16/30" ] }