From: Gregory Etelson <getelson@nvidia.com>
To: <dev@dpdk.org>
Cc: <getelson@nvidia.com>, <mkashani@nvidia.com>,
<rasland@nvidia.com>, "Hamdan Igbaria" <hamdani@nvidia.com>,
Alex Vesker <valex@nvidia.com>, Matan Azrad <matan@nvidia.com>,
Viacheslav Ovsiienko <viacheslavo@nvidia.com>,
Ori Kam <orika@nvidia.com>, Suanming Mou <suanmingm@nvidia.com>
Subject: [PATCH 16/30] net/mlx5/hws: support IPsec encryption/decryption action
Date: Sun, 29 Oct 2023 18:31:48 +0200 [thread overview]
Message-ID: <20231029163202.216450-16-getelson@nvidia.com> (raw)
In-Reply-To: <20231029163202.216450-1-getelson@nvidia.com>
From: Hamdan Igbaria <hamdani@nvidia.com>
Support crypto action creation, this action allows encryption/decryption
of the packet according a specific security crypto protocol.
For now we support encryption/decryption according ipsec protocol.
ipsec encryption handles the encoding of the data.
ipsec decryption handles the decoding of the data and a decryption result
status will be placed in the ipsec_syndrome field.
Both operations should be used only for packets that have esp header and
ipsec trailer.
Signed-off-by: Hamdan Igbaria <hamdani@nvidia.com>
Reviewed-by: Alex Vesker <valex@nvidia.com>
Acked-by: Matan Azrad <matan@nvidia.com>
---
drivers/common/mlx5/mlx5_prm.h | 12 ++
drivers/net/mlx5/hws/mlx5dr.h | 42 +++++++
drivers/net/mlx5/hws/mlx5dr_action.c | 172 +++++++++++++++++++++++++-
drivers/net/mlx5/hws/mlx5dr_action.h | 44 ++++---
drivers/net/mlx5/hws/mlx5dr_cmd.c | 8 ++
drivers/net/mlx5/hws/mlx5dr_cmd.h | 2 +-
drivers/net/mlx5/hws/mlx5dr_debug.c | 2 +
drivers/net/mlx5/hws/mlx5dr_matcher.c | 5 +
8 files changed, 266 insertions(+), 21 deletions(-)
diff --git a/drivers/common/mlx5/mlx5_prm.h b/drivers/common/mlx5/mlx5_prm.h
index 2b499666f8..0eecf0691b 100644
--- a/drivers/common/mlx5/mlx5_prm.h
+++ b/drivers/common/mlx5/mlx5_prm.h
@@ -3498,6 +3498,8 @@ enum mlx5_ifc_stc_action_type {
MLX5_IFC_STC_ACTION_TYPE_HEADER_INSERT = 0x0b,
MLX5_IFC_STC_ACTION_TYPE_TAG = 0x0c,
MLX5_IFC_STC_ACTION_TYPE_ACC_MODIFY_LIST = 0x0e,
+ MLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_ENCRYPTION = 0x10,
+ MLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_DECRYPTION = 0x11,
MLX5_IFC_STC_ACTION_TYPE_ASO = 0x12,
MLX5_IFC_STC_ACTION_TYPE_COUNTER = 0x14,
MLX5_IFC_STC_ACTION_TYPE_ADD_FIELD = 0x1b,
@@ -3546,6 +3548,14 @@ struct mlx5_ifc_stc_ste_param_execute_aso_bits {
u8 reserved_at_28[0x18];
};
+struct mlx5_ifc_stc_ste_param_ipsec_encrypt_bits {
+ u8 ipsec_object_id[0x20];
+};
+
+struct mlx5_ifc_stc_ste_param_ipsec_decrypt_bits {
+ u8 ipsec_object_id[0x20];
+};
+
struct mlx5_ifc_stc_ste_param_header_modify_list_bits {
u8 header_modify_pattern_id[0x20];
u8 header_modify_argument_id[0x20];
@@ -3612,6 +3622,8 @@ union mlx5_ifc_stc_param_bits {
struct mlx5_ifc_set_action_in_bits set;
struct mlx5_ifc_copy_action_in_bits copy;
struct mlx5_ifc_stc_ste_param_vport_bits vport;
+ struct mlx5_ifc_stc_ste_param_ipsec_encrypt_bits ipsec_encrypt;
+ struct mlx5_ifc_stc_ste_param_ipsec_decrypt_bits ipsec_decrypt;
u8 reserved_at_0[0x80];
};
diff --git a/drivers/net/mlx5/hws/mlx5dr.h b/drivers/net/mlx5/hws/mlx5dr.h
index 39d902e762..74d05229c7 100644
--- a/drivers/net/mlx5/hws/mlx5dr.h
+++ b/drivers/net/mlx5/hws/mlx5dr.h
@@ -45,6 +45,8 @@ enum mlx5dr_action_type {
MLX5DR_ACTION_TYP_PUSH_VLAN,
MLX5DR_ACTION_TYP_ASO_METER,
MLX5DR_ACTION_TYP_ASO_CT,
+ MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT,
+ MLX5DR_ACTION_TYP_CRYPTO_DECRYPT,
MLX5DR_ACTION_TYP_DEST_ROOT,
MLX5DR_ACTION_TYP_DEST_ARRAY,
MLX5DR_ACTION_TYP_MAX,
@@ -176,6 +178,22 @@ struct mlx5dr_action_mh_pattern {
__be64 *data;
};
+enum mlx5dr_action_crypto_op {
+ MLX5DR_ACTION_CRYPTO_OP_NONE,
+ MLX5DR_ACTION_CRYPTO_OP_ENCRYPT,
+ MLX5DR_ACTION_CRYPTO_OP_DECRYPT,
+};
+
+enum mlx5dr_action_crypto_type {
+ MLX5DR_ACTION_CRYPTO_TYPE_NISP,
+ MLX5DR_ACTION_CRYPTO_TYPE_IPSEC,
+};
+
+struct mlx5dr_action_crypto_attr {
+ enum mlx5dr_action_crypto_type crypto_type;
+ enum mlx5dr_action_crypto_op op;
+};
+
/* In actions that take offset, the offset is unique, pointing to a single
* resource and the user should not reuse the same index because data changing
* is not atomic.
@@ -216,6 +234,10 @@ struct mlx5dr_rule_action {
uint32_t offset;
enum mlx5dr_action_aso_ct_flags direction;
} aso_ct;
+
+ struct {
+ uint32_t offset;
+ } crypto;
};
};
@@ -691,6 +713,26 @@ mlx5dr_action_create_dest_root(struct mlx5dr_context *ctx,
uint16_t priority,
uint32_t flags);
+/* Create crypto action, this action will create specific security protocol
+ * encryption/decryption, for now we only support IPSec protocol.
+ *
+ * @param[in] ctx
+ * The context in which the new action will be created.
+ * @param[in] devx_obj
+ * The SADB corresponding devx obj
+ * @param[in] attr
+ * attributes: specifies if to encrypt/decrypt,
+ * also specifies the crypto security protocol.
+ * @param[in] flags
+ * Action creation flags. (enum mlx5dr_action_flags)
+ * @return pointer to mlx5dr_action on success NULL otherwise.
+ */
+struct mlx5dr_action *
+mlx5dr_action_create_crypto(struct mlx5dr_context *ctx,
+ struct mlx5dr_devx_obj *devx_obj,
+ struct mlx5dr_action_crypto_attr *attr,
+ uint32_t flags);
+
/* Destroy direct rule action.
*
* @param[in] action
diff --git a/drivers/net/mlx5/hws/mlx5dr_action.c b/drivers/net/mlx5/hws/mlx5dr_action.c
index 11a7c58925..4910b4f730 100644
--- a/drivers/net/mlx5/hws/mlx5dr_action.c
+++ b/drivers/net/mlx5/hws/mlx5dr_action.c
@@ -9,11 +9,12 @@
#define MLX5DR_ACTION_METER_INIT_COLOR_OFFSET 1
/* This is the maximum allowed action order for each table type:
- * TX: POP_VLAN, CTR, ASO_METER, AS_CT, PUSH_VLAN, MODIFY, ENCAP, Term
- * RX: TAG, DECAP, POP_VLAN, CTR, ASO_METER, ASO_CT, PUSH_VLAN, MODIFY,
- * ENCAP, Term
- * FDB: DECAP, POP_VLAN, CTR, ASO_METER, ASO_CT, PUSH_VLAN, MODIFY,
- * ENCAP, Term
+ * TX: POP_VLAN, CTR, ASO_METER, AS_CT, PUSH_VLAN, MODIFY, ENCAP, ENCRYPT,
+ * Term
+ * RX: TAG, DECAP, POP_VLAN, CTR, DECRYPT, ASO_METER, ASO_CT, PUSH_VLAN,
+ * MODIFY, ENCAP, Term
+ * FDB: DECAP, POP_VLAN, CTR, DECRYPT, ASO_METER, ASO_CT, PUSH_VLAN, MODIFY,
+ * ENCAP, ENCRYPT, Term
*/
static const uint32_t action_order_arr[MLX5DR_TABLE_TYPE_MAX][MLX5DR_ACTION_TYP_MAX] = {
[MLX5DR_TABLE_TYPE_NIC_RX] = {
@@ -23,6 +24,7 @@ static const uint32_t action_order_arr[MLX5DR_TABLE_TYPE_MAX][MLX5DR_ACTION_TYP_
BIT(MLX5DR_ACTION_TYP_POP_VLAN),
BIT(MLX5DR_ACTION_TYP_POP_VLAN),
BIT(MLX5DR_ACTION_TYP_CTR),
+ BIT(MLX5DR_ACTION_TYP_CRYPTO_DECRYPT),
BIT(MLX5DR_ACTION_TYP_ASO_METER),
BIT(MLX5DR_ACTION_TYP_ASO_CT),
BIT(MLX5DR_ACTION_TYP_PUSH_VLAN),
@@ -49,6 +51,7 @@ static const uint32_t action_order_arr[MLX5DR_TABLE_TYPE_MAX][MLX5DR_ACTION_TYP_
BIT(MLX5DR_ACTION_TYP_MODIFY_HDR),
BIT(MLX5DR_ACTION_TYP_REFORMAT_L2_TO_TNL_L2) |
BIT(MLX5DR_ACTION_TYP_REFORMAT_L2_TO_TNL_L3),
+ BIT(MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT),
BIT(MLX5DR_ACTION_TYP_TBL) |
BIT(MLX5DR_ACTION_TYP_MISS) |
BIT(MLX5DR_ACTION_TYP_DROP) |
@@ -61,6 +64,7 @@ static const uint32_t action_order_arr[MLX5DR_TABLE_TYPE_MAX][MLX5DR_ACTION_TYP_
BIT(MLX5DR_ACTION_TYP_POP_VLAN),
BIT(MLX5DR_ACTION_TYP_POP_VLAN),
BIT(MLX5DR_ACTION_TYP_CTR),
+ BIT(MLX5DR_ACTION_TYP_CRYPTO_DECRYPT),
BIT(MLX5DR_ACTION_TYP_ASO_METER),
BIT(MLX5DR_ACTION_TYP_ASO_CT),
BIT(MLX5DR_ACTION_TYP_PUSH_VLAN),
@@ -68,6 +72,7 @@ static const uint32_t action_order_arr[MLX5DR_TABLE_TYPE_MAX][MLX5DR_ACTION_TYP_
BIT(MLX5DR_ACTION_TYP_MODIFY_HDR),
BIT(MLX5DR_ACTION_TYP_REFORMAT_L2_TO_TNL_L2) |
BIT(MLX5DR_ACTION_TYP_REFORMAT_L2_TO_TNL_L3),
+ BIT(MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT),
BIT(MLX5DR_ACTION_TYP_TBL) |
BIT(MLX5DR_ACTION_TYP_MISS) |
BIT(MLX5DR_ACTION_TYP_VPORT) |
@@ -266,6 +271,41 @@ bool mlx5dr_action_check_combo(enum mlx5dr_action_type *user_actions,
return valid_combo;
}
+bool mlx5dr_action_check_restrictions(struct mlx5dr_matcher *matcher,
+ enum mlx5dr_action_type *actions)
+{
+ uint32_t restricted_bits;
+ uint8_t idx = 0;
+
+ /* Check for restricted actions, these actions are restricted
+ * to RX or TX only in FDB domain.
+ * if one of these actions presented require correct optimize_flow_src.
+ */
+ if (matcher->tbl->type != MLX5DR_TABLE_TYPE_FDB)
+ return false;
+
+ switch (matcher->attr.optimize_flow_src) {
+ case MLX5DR_MATCHER_FLOW_SRC_WIRE:
+ restricted_bits = BIT(MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT);
+ break;
+ case MLX5DR_MATCHER_FLOW_SRC_VPORT:
+ restricted_bits = BIT(MLX5DR_ACTION_TYP_CRYPTO_DECRYPT);
+ break;
+ default:
+ restricted_bits = BIT(MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT) |
+ BIT(MLX5DR_ACTION_TYP_CRYPTO_DECRYPT);
+ }
+
+ while (actions[idx] != MLX5DR_ACTION_TYP_LAST) {
+ if (BIT(actions[idx++]) & restricted_bits) {
+ DR_LOG(ERR, "Invalid actions combination containing restricted actions was provided");
+ return true;
+ }
+ }
+
+ return false;
+}
+
int mlx5dr_action_root_build_attr(struct mlx5dr_rule_action rule_actions[],
uint32_t num_actions,
struct mlx5dv_flow_action_attr *attr)
@@ -383,6 +423,24 @@ mlx5dr_action_fixup_stc_attr(struct mlx5dr_context *ctx,
use_fixup = true;
break;
+ case MLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_ENCRYPTION:
+ if (fw_tbl_type == FS_FT_FDB_RX) {
+ fixup_stc_attr->action_type = MLX5_IFC_STC_ACTION_TYPE_NOP;
+ fixup_stc_attr->action_offset = stc_attr->action_offset;
+ fixup_stc_attr->stc_offset = stc_attr->stc_offset;
+ use_fixup = true;
+ }
+ break;
+
+ case MLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_DECRYPTION:
+ if (fw_tbl_type == FS_FT_FDB_TX) {
+ fixup_stc_attr->action_type = MLX5_IFC_STC_ACTION_TYPE_NOP;
+ fixup_stc_attr->action_offset = stc_attr->action_offset;
+ fixup_stc_attr->stc_offset = stc_attr->stc_offset;
+ use_fixup = true;
+ }
+ break;
+
default:
break;
}
@@ -605,6 +663,16 @@ static void mlx5dr_action_fill_stc_attr(struct mlx5dr_action *action,
attr->insert_header.insert_offset = MLX5DR_ACTION_HDR_LEN_L2_MACS;
attr->insert_header.header_size = MLX5DR_ACTION_HDR_LEN_L2_VLAN;
break;
+ case MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT:
+ attr->action_type = MLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_ENCRYPTION;
+ attr->action_offset = MLX5DR_ACTION_OFFSET_DW5;
+ attr->id = obj->id;
+ break;
+ case MLX5DR_ACTION_TYP_CRYPTO_DECRYPT:
+ attr->action_type = MLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_DECRYPTION;
+ attr->action_offset = MLX5DR_ACTION_OFFSET_DW5;
+ attr->id = obj->id;
+ break;
default:
DR_LOG(ERR, "Invalid action type %d", action->type);
assert(false);
@@ -1943,6 +2011,55 @@ mlx5dr_action_create_dest_root(struct mlx5dr_context *ctx,
return NULL;
}
+struct mlx5dr_action *
+mlx5dr_action_create_crypto(struct mlx5dr_context *ctx,
+ struct mlx5dr_devx_obj *devx_obj,
+ struct mlx5dr_action_crypto_attr *attr,
+ uint32_t flags)
+{
+ enum mlx5dr_action_type action_type;
+ struct mlx5dr_action *action;
+
+ if (mlx5dr_action_is_root_flags(flags)) {
+ DR_LOG(ERR, "Action flags must be only non root (HWS)");
+ rte_errno = ENOTSUP;
+ return NULL;
+ }
+
+ if (attr->crypto_type != MLX5DR_ACTION_CRYPTO_TYPE_IPSEC) {
+ rte_errno = ENOTSUP;
+ return NULL;
+ }
+
+ if (attr->op == MLX5DR_ACTION_CRYPTO_OP_ENCRYPT) {
+ if (flags & MLX5DR_ACTION_FLAG_HWS_RX) {
+ rte_errno = EINVAL;
+ return NULL;
+ }
+ action_type = MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT;
+ } else if (attr->op == MLX5DR_ACTION_CRYPTO_OP_DECRYPT) {
+ if (flags & MLX5DR_ACTION_FLAG_HWS_TX) {
+ rte_errno = EINVAL;
+ return NULL;
+ }
+ action_type = MLX5DR_ACTION_TYP_CRYPTO_DECRYPT;
+ } else {
+ rte_errno = ENOTSUP;
+ return NULL;
+ }
+
+ action = mlx5dr_action_create_generic(ctx, flags, action_type);
+ if (!action)
+ return NULL;
+
+ if (mlx5dr_action_create_stcs(action, devx_obj)) {
+ simple_free(action);
+ return NULL;
+ }
+
+ return action;
+}
+
static void mlx5dr_action_destroy_hws(struct mlx5dr_action *action)
{
struct mlx5dr_devx_obj *obj = NULL;
@@ -1963,6 +2080,8 @@ static void mlx5dr_action_destroy_hws(struct mlx5dr_action *action)
case MLX5DR_ACTION_TYP_ASO_METER:
case MLX5DR_ACTION_TYP_ASO_CT:
case MLX5DR_ACTION_TYP_PUSH_VLAN:
+ case MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT:
+ case MLX5DR_ACTION_TYP_CRYPTO_DECRYPT:
mlx5dr_action_destroy_stcs(action);
break;
case MLX5DR_ACTION_TYP_DEST_ROOT:
@@ -2460,6 +2579,33 @@ mlx5dr_action_setter_common_decap(struct mlx5dr_actions_apply_data *apply,
MLX5DR_CONTEXT_SHARED_STC_DECAP));
}
+static void
+mlx5dr_action_setter_crypto_encryption(struct mlx5dr_actions_apply_data *apply,
+ struct mlx5dr_actions_wqe_setter *setter)
+{
+ struct mlx5dr_rule_action *rule_action;
+
+ rule_action = &apply->rule_action[setter->idx_single];
+ apply->wqe_data[MLX5DR_ACTION_OFFSET_DW5] = htobe32(rule_action->crypto.offset);
+ mlx5dr_action_apply_stc(apply, MLX5DR_ACTION_STC_IDX_DW5, setter->idx_single);
+}
+
+static void
+mlx5dr_action_setter_crypto_decryption(struct mlx5dr_actions_apply_data *apply,
+ struct mlx5dr_actions_wqe_setter *setter)
+{
+ struct mlx5dr_rule_action *rule_action;
+
+ rule_action = &apply->rule_action[setter->idx_triple];
+
+ mlx5dr_action_apply_stc(apply, MLX5DR_ACTION_STC_IDX_DW5, setter->idx_triple);
+ apply->wqe_ctrl->stc_ix[MLX5DR_ACTION_STC_IDX_DW6] = 0;
+ apply->wqe_ctrl->stc_ix[MLX5DR_ACTION_STC_IDX_DW7] = 0;
+ apply->wqe_data[MLX5DR_ACTION_OFFSET_DW5] = htobe32(rule_action->crypto.offset);
+ apply->wqe_data[MLX5DR_ACTION_OFFSET_DW6] = 0;
+ apply->wqe_data[MLX5DR_ACTION_OFFSET_DW7] = 0;
+}
+
int mlx5dr_action_template_process(struct mlx5dr_action_template *at)
{
struct mlx5dr_actions_wqe_setter *start_setter = at->setters + 1;
@@ -2594,6 +2740,22 @@ int mlx5dr_action_template_process(struct mlx5dr_action_template *at)
setter->idx_ctr = i;
break;
+ case MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT:
+ /* Single encryption action, consume triple due to HW limitations */
+ setter = mlx5dr_action_setter_find_first(last_setter, ASF_TRIPLE);
+ setter->flags |= ASF_TRIPLE;
+ setter->set_single = &mlx5dr_action_setter_crypto_encryption;
+ setter->idx_single = i;
+ break;
+
+ case MLX5DR_ACTION_TYP_CRYPTO_DECRYPT:
+ /* Triple decryption action */
+ setter = mlx5dr_action_setter_find_first(last_setter, ASF_TRIPLE);
+ setter->flags |= ASF_TRIPLE;
+ setter->set_triple = &mlx5dr_action_setter_crypto_decryption;
+ setter->idx_triple = i;
+ break;
+
default:
DR_LOG(ERR, "Unsupported action type: %d", action_type[i]);
rte_errno = ENOTSUP;
diff --git a/drivers/net/mlx5/hws/mlx5dr_action.h b/drivers/net/mlx5/hws/mlx5dr_action.h
index 582a38bebc..6bfa0bcc4a 100644
--- a/drivers/net/mlx5/hws/mlx5dr_action.h
+++ b/drivers/net/mlx5/hws/mlx5dr_action.h
@@ -21,6 +21,8 @@ enum mlx5dr_action_stc_idx {
MLX5DR_ACTION_STC_IDX_LAST_COMBO1 = 3,
/* STC combo2: CTR, 3 x SINGLE, Hit */
MLX5DR_ACTION_STC_IDX_LAST_COMBO2 = 4,
+ /* STC combo2: CTR, TRIPLE, Hit */
+ MLX5DR_ACTION_STC_IDX_LAST_COMBO3 = 2,
};
enum mlx5dr_action_offset {
@@ -52,6 +54,7 @@ enum mlx5dr_action_setter_flag {
ASF_SINGLE2 = 1 << 1,
ASF_SINGLE3 = 1 << 2,
ASF_DOUBLE = ASF_SINGLE2 | ASF_SINGLE3,
+ ASF_TRIPLE = ASF_SINGLE1 | ASF_DOUBLE,
ASF_REPARSE = 1 << 3,
ASF_REMOVE = 1 << 4,
ASF_MODIFY = 1 << 5,
@@ -94,10 +97,12 @@ typedef void (*mlx5dr_action_setter_fp)
struct mlx5dr_actions_wqe_setter {
mlx5dr_action_setter_fp set_single;
mlx5dr_action_setter_fp set_double;
+ mlx5dr_action_setter_fp set_triple;
mlx5dr_action_setter_fp set_hit;
mlx5dr_action_setter_fp set_ctr;
uint8_t idx_single;
uint8_t idx_double;
+ uint8_t idx_triple;
uint8_t idx_ctr;
uint8_t idx_hit;
uint8_t flags;
@@ -183,6 +188,9 @@ int mlx5dr_action_template_process(struct mlx5dr_action_template *at);
bool mlx5dr_action_check_combo(enum mlx5dr_action_type *user_actions,
enum mlx5dr_table_type table_type);
+bool mlx5dr_action_check_restrictions(struct mlx5dr_matcher *matcher,
+ enum mlx5dr_action_type *actions);
+
int mlx5dr_action_alloc_single_stc(struct mlx5dr_context *ctx,
struct mlx5dr_cmd_stc_modify_attr *stc_attr,
uint32_t table_type,
@@ -230,26 +238,32 @@ mlx5dr_action_apply_setter(struct mlx5dr_actions_apply_data *apply,
uint8_t num_of_actions;
/* Set control counter */
- if (setter->flags & ASF_CTR)
+ if (setter->set_ctr)
setter->set_ctr(apply, setter);
else
mlx5dr_action_setter_default_ctr(apply, setter);
- /* Set single and double on match */
if (!is_jumbo) {
- if (setter->flags & ASF_SINGLE1)
- setter->set_single(apply, setter);
- else
- mlx5dr_action_setter_default_single(apply, setter);
-
- if (setter->flags & ASF_DOUBLE)
- setter->set_double(apply, setter);
- else
- mlx5dr_action_setter_default_double(apply, setter);
-
- num_of_actions = setter->flags & ASF_DOUBLE ?
- MLX5DR_ACTION_STC_IDX_LAST_COMBO1 :
- MLX5DR_ACTION_STC_IDX_LAST_COMBO2;
+ if (unlikely(setter->set_triple)) {
+ /* Set triple on match */
+ setter->set_triple(apply, setter);
+ num_of_actions = MLX5DR_ACTION_STC_IDX_LAST_COMBO3;
+ } else {
+ /* Set single and double on match */
+ if (setter->set_single)
+ setter->set_single(apply, setter);
+ else
+ mlx5dr_action_setter_default_single(apply, setter);
+
+ if (setter->set_double)
+ setter->set_double(apply, setter);
+ else
+ mlx5dr_action_setter_default_double(apply, setter);
+
+ num_of_actions = setter->set_double ?
+ MLX5DR_ACTION_STC_IDX_LAST_COMBO1 :
+ MLX5DR_ACTION_STC_IDX_LAST_COMBO2;
+ }
} else {
apply->wqe_data[MLX5DR_ACTION_OFFSET_DW5] = 0;
apply->wqe_data[MLX5DR_ACTION_OFFSET_DW6] = 0;
diff --git a/drivers/net/mlx5/hws/mlx5dr_cmd.c b/drivers/net/mlx5/hws/mlx5dr_cmd.c
index c52cdd0767..3b3690699d 100644
--- a/drivers/net/mlx5/hws/mlx5dr_cmd.c
+++ b/drivers/net/mlx5/hws/mlx5dr_cmd.c
@@ -541,6 +541,14 @@ mlx5dr_cmd_stc_modify_set_stc_param(struct mlx5dr_cmd_stc_modify_attr *stc_attr,
MLX5_SET(stc_ste_param_remove_words, stc_parm,
remove_size, stc_attr->remove_words.num_of_words);
break;
+ case MLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_ENCRYPTION:
+ MLX5_SET(stc_ste_param_ipsec_encrypt, stc_parm, ipsec_object_id,
+ stc_attr->id);
+ break;
+ case MLX5_IFC_STC_ACTION_TYPE_CRYPTO_IPSEC_DECRYPTION:
+ MLX5_SET(stc_ste_param_ipsec_decrypt, stc_parm, ipsec_object_id,
+ stc_attr->id);
+ break;
default:
DR_LOG(ERR, "Not supported type %d", stc_attr->action_type);
rte_errno = EINVAL;
diff --git a/drivers/net/mlx5/hws/mlx5dr_cmd.h b/drivers/net/mlx5/hws/mlx5dr_cmd.h
index 03db62e2e2..7bbb684dbd 100644
--- a/drivers/net/mlx5/hws/mlx5dr_cmd.h
+++ b/drivers/net/mlx5/hws/mlx5dr_cmd.h
@@ -100,7 +100,7 @@ struct mlx5dr_cmd_stc_modify_attr {
uint8_t action_offset;
enum mlx5_ifc_stc_action_type action_type;
union {
- uint32_t id; /* TIRN, TAG, FT ID, STE ID */
+ uint32_t id; /* TIRN, TAG, FT ID, STE ID, CRYPTO */
struct {
uint8_t decap;
uint16_t start_anchor;
diff --git a/drivers/net/mlx5/hws/mlx5dr_debug.c b/drivers/net/mlx5/hws/mlx5dr_debug.c
index e7b1f2cc32..8cf3909606 100644
--- a/drivers/net/mlx5/hws/mlx5dr_debug.c
+++ b/drivers/net/mlx5/hws/mlx5dr_debug.c
@@ -24,6 +24,8 @@ const char *mlx5dr_debug_action_type_str[] = {
[MLX5DR_ACTION_TYP_ASO_CT] = "ASO_CT",
[MLX5DR_ACTION_TYP_DEST_ROOT] = "DEST_ROOT",
[MLX5DR_ACTION_TYP_DEST_ARRAY] = "DEST_ARRAY",
+ [MLX5DR_ACTION_TYP_CRYPTO_ENCRYPT] = "CRYPTO_ENCRYPT",
+ [MLX5DR_ACTION_TYP_CRYPTO_DECRYPT] = "CRYPTO_DECRYPT",
};
static_assert(ARRAY_SIZE(mlx5dr_debug_action_type_str) == MLX5DR_ACTION_TYP_MAX,
diff --git a/drivers/net/mlx5/hws/mlx5dr_matcher.c b/drivers/net/mlx5/hws/mlx5dr_matcher.c
index a82c182460..6f74cf3677 100644
--- a/drivers/net/mlx5/hws/mlx5dr_matcher.c
+++ b/drivers/net/mlx5/hws/mlx5dr_matcher.c
@@ -714,6 +714,11 @@ static int mlx5dr_matcher_check_and_process_at(struct mlx5dr_matcher *matcher,
return rte_errno;
}
+ if (mlx5dr_action_check_restrictions(matcher, at->action_type_arr)) {
+ rte_errno = EINVAL;
+ return rte_errno;
+ }
+
/* Process action template to setters */
ret = mlx5dr_action_template_process(at);
if (ret) {
--
2.39.2
next prev parent reply other threads:[~2023-10-29 16:34 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-29 16:31 [PATCH 01/30] net/mlx5/hws: Definer, add mlx5dr context to definer_conv_data Gregory Etelson
2023-10-29 16:31 ` [PATCH 02/30] net/mlx5: add flow_hw_get_reg_id_from_ctx() Gregory Etelson
2023-10-29 16:31 ` [PATCH 03/30] net/mlx5/hws: Definer, use flow_hw_get_reg_id_from_ctx function call Gregory Etelson
2023-10-29 16:31 ` [PATCH 04/30] net/mlx5: add rte_device parameter to locate HWS registers Gregory Etelson
2023-11-05 20:27 ` Thomas Monjalon
2023-10-29 16:31 ` [PATCH 05/30] net/mlx5: separate port REG_C registers usage Gregory Etelson
2023-10-29 16:31 ` [PATCH 06/30] net/mlx5: merge REG_C aliases Gregory Etelson
2023-10-29 16:31 ` [PATCH 07/30] net/mlx5: initialize HWS flow tags registers in shared dev context Gregory Etelson
2023-10-29 16:31 ` [PATCH 08/30] net/mlx5/hws: adding method to query rule hash Gregory Etelson
2023-10-29 16:31 ` [PATCH 09/30] net/mlx5: add support for calc hash Gregory Etelson
2023-10-29 16:31 ` [PATCH 10/30] net/mlx5: fix insert by index Gregory Etelson
2023-10-29 16:31 ` [PATCH 11/30] net/mlx5: fix query for NIC flow cap Gregory Etelson
2023-10-29 16:31 ` [PATCH 12/30] net/mlx5: add support for more registers Gregory Etelson
2023-10-29 16:31 ` [PATCH 13/30] net/mlx5: add validation support for tags Gregory Etelson
2023-10-29 16:31 ` [PATCH 14/30] net/mlx5: reuse reformat and modify header actions in a table Gregory Etelson
2023-10-29 16:31 ` [PATCH 15/30] net/mlx5/hws: check the rule status on rule update Gregory Etelson
2023-10-29 16:31 ` Gregory Etelson [this message]
2023-10-29 16:31 ` [PATCH 17/30] net/mlx5/hws: support ASO IPsec action Gregory Etelson
2023-10-29 16:31 ` [PATCH 18/30] net/mlx5/hws: support reformat trailer action Gregory Etelson
2023-10-29 16:31 ` [PATCH 19/30] net/mlx5/hws: support ASO first hit action Gregory Etelson
2023-10-29 16:31 ` [PATCH 20/30] net/mlx5/hws: support insert header action Gregory Etelson
2023-10-29 16:31 ` [PATCH 21/30] net/mlx5/hws: support remove " Gregory Etelson
2023-10-29 16:31 ` [PATCH 22/30] net/mlx5/hws: allow jump to TIR over FDB Gregory Etelson
2023-10-29 16:31 ` [PATCH 23/30] net/mlx5/hws: support dynamic re-parse Gregory Etelson
2023-10-29 16:31 ` [PATCH 24/30] net/mlx5/hws: dynamic re-parse for modify header Gregory Etelson
2023-10-29 16:31 ` [PATCH 25/30] net/mlx5: sample the srv6 last segment Gregory Etelson
2023-10-29 16:31 ` [PATCH 26/30] net/mlx5/hws: fix potential wrong errno value Gregory Etelson
2023-10-29 16:31 ` [PATCH 27/30] net/mlx5/hws: add IPv6 routing extension push remove actions Gregory Etelson
2023-10-29 16:32 ` [PATCH 28/30] net/mlx5/hws: add setter for IPv6 routing push remove Gregory Etelson
2023-10-29 16:32 ` [PATCH 29/30] net/mlx5: implement " Gregory Etelson
2023-10-29 16:32 ` [PATCH 30/30] net/mlx5/hws: add stc reparse support for srv6 push pop Gregory Etelson
2023-11-05 18:49 ` [PATCH 01/30] net/mlx5/hws: Definer, add mlx5dr context to definer_conv_data Thomas Monjalon
2023-11-06 7:32 ` Etelson, Gregory
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231029163202.216450-16-getelson@nvidia.com \
--to=getelson@nvidia.com \
--cc=dev@dpdk.org \
--cc=hamdani@nvidia.com \
--cc=matan@nvidia.com \
--cc=mkashani@nvidia.com \
--cc=orika@nvidia.com \
--cc=rasland@nvidia.com \
--cc=suanmingm@nvidia.com \
--cc=valex@nvidia.com \
--cc=viacheslavo@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.