[PATCH 01/14] net/cnxk: fix packet length handling

[PATCH 01/14] net/cnxk: fix packet length handling

[Rahul Bhansali]

Fix packet length handling for reassembly failure cases.
Also updated few macros as per cn20k platform.

Fixes: 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx")
Cc: stable@dpdk.org

Signed-off-by: Rahul Bhansali <rbhansali@marvell.com>
---
 drivers/net/cnxk/cn20k_rx.h | 42 +++++++++++++++++++++----------------
 1 file changed, 24 insertions(+), 18 deletions(-)

diff --git a/drivers/net/cnxk/cn20k_rx.h b/drivers/net/cnxk/cn20k_rx.h
index f8fa6de2b9..0e9d562317 100644
--- a/drivers/net/cnxk/cn20k_rx.h
+++ b/drivers/net/cnxk/cn20k_rx.h
@@ -258,8 +258,7 @@ nix_sec_meta_to_mbuf_sc(uint64_t cq_w5, uint64_t cpth, const uint64_t sa_base,
 			*rte_security_dynfield(mbuf) = (uint64_t)inb_priv->userdata;
 	} else {
 		/* Update dynamic field with userdata */
-		if (flags & NIX_RX_REAS_F && inb_priv->userdata)
-			*rte_security_dynfield(mbuf) = (uint64_t)inb_priv->userdata;
+		*rte_security_dynfield(mbuf) = (uint64_t)inb_priv->userdata;
 	}
 
 	*len = ((w3 >> 48) & 0xFFFF) + ((cq_w5 >> 16) & 0xFF) - (cq_w5 & 0xFF);
@@ -346,16 +345,17 @@ nix_cqe_xtract_mseg(const union nix_rx_parse_u *rx, struct rte_mbuf *mbuf, uint6
 	uint16_t rlen = hdr->w3.rlen;
 	const rte_iova_t *iova_list;
 	uint8_t sg_cnt = 1, nb_segs;
+	uint16_t sg_len, data_len;
 	uint16x4_t fsz, sg_swap;
 	uint16_t later_skip = 0;
 	bool reas_fail = false;
+	bool first_frag = true;
 	const rte_iova_t *eol;
 	uint16_t data_off = 0;
 	bool is_oop = false;
 	uint16_t l4_off = 0;
 	uint8_t ts_rx_off;
 	int dyn_off = 0;
-	uint16_t sg_len;
 	int64_t len;
 	uintptr_t p;
 
@@ -403,9 +403,11 @@ nix_cqe_xtract_mseg(const union nix_rx_parse_u *rx, struct rte_mbuf *mbuf, uint6
 				/* Reverse the order of fragment sizes */
 				fsz = vreinterpret_u16_u64(vdup_n_u64(finfo->w1.u64));
 				fsz = vrev64_u16(fsz);
-				fsz_w1 = vget_lane_u64(vreinterpret_u64_u16(fsz), 0) >> 16;
+				fsz_w1 = vget_lane_u64(vreinterpret_u64_u16(fsz), 0);
 				finfo++;
 				l4_off = ((cq_w5 >> 24) & 0xFF) - (cq_w5 & 0xFF);
+				mbuf->pkt_len = l4_off + (fsz_w1 & 0xFFFF) - ts_rx_off;
+				fsz_w1 >>= 16;
 			}
 		}
 
@@ -427,6 +429,7 @@ nix_cqe_xtract_mseg(const union nix_rx_parse_u *rx, struct rte_mbuf *mbuf, uint6
 			return;
 
 		len = rx->pkt_lenm1 + 1;
+		mbuf->pkt_len = len;
 
 		/* Skip SG_S and first IOVA */
 		eol = ((const rte_iova_t *)(rx + 1) + ((rx->desc_sizem1 + 1) << 1));
@@ -434,6 +437,7 @@ nix_cqe_xtract_mseg(const union nix_rx_parse_u *rx, struct rte_mbuf *mbuf, uint6
 	}
 
 	sg_len = sg & 0xFFFF;
+	data_len = sg_len;
 	sg = sg >> 16;
 
 	/* Update data len as per the segment size */
@@ -478,14 +482,16 @@ nix_cqe_xtract_mseg(const union nix_rx_parse_u *rx, struct rte_mbuf *mbuf, uint6
 
 			/* Reset last mbuf next and start new mbuf chain */
 			last_mbuf->next = NULL;
+			head->nb_segs = sg_cnt;
+			head->data_len =
+				(!first_frag && (sg_cnt == 1)) ? data_len + l4_off : data_len;
 			head = mbuf;
 			len = fsz_w1 & 0xFFFF;
 			head->pkt_len = l4_off + len - ts_rx_off;
-			head->nb_segs = sg_cnt;
-			/* later frag size update*/
-			sg_len += l4_off;
+			data_len = sg_len;
 			data_off = rearm & 0xFFFF;
 			sg_cnt = 0;
+			first_frag = false;
 			nxt_frag = nxt_frag >> 1;
 			fsz_w1 = fsz_w1 >> 16;
 			if (--num_frags == 4) {
@@ -568,6 +574,7 @@ nix_cqe_xtract_mseg(const union nix_rx_parse_u *rx, struct rte_mbuf *mbuf, uint6
 
 	/* Update for last failure fragment */
 	if ((flags & NIX_RX_REAS_F) && reas_fail) {
+		head->data_len = (!first_frag && (sg_cnt == 1)) ? data_len + l4_off : data_len;
 		cnxk_ip_reassembly_dynfield(head, dyn_off)->next_frag = NULL;
 		cnxk_ip_reassembly_dynfield(head, dyn_off)->nb_frags = 0;
 	}
@@ -1079,10 +1086,9 @@ nix_sec_meta_to_mbuf(uintptr_t inb_sa, uintptr_t cpth, struct rte_mbuf **inner,
 		*rearm = (*rearm & ~(BIT_ULL(16) - 1)) | inner_m->data_off;
 	} else {
 		/* Get SPI from CPT_PARSE_S's cookie(already swapped) */
-		inb_priv = roc_nix_inl_ot_ipsec_inb_sa_sw_rsvd((void *)inb_sa);
+		inb_priv = roc_nix_inl_ow_ipsec_inb_sa_sw_rsvd((void *)inb_sa);
 		/* Update dynamic field with userdata */
-		if (flags & NIX_RX_REAS_F && inb_priv->userdata)
-			*rte_security_dynfield(inner_m) = (uint64_t)inb_priv->userdata;
+		*rte_security_dynfield(inner_m) = (uint64_t)inb_priv->userdata;
 	}
 
 	/* Clear and update original lower 16 bit of data offset */
@@ -1444,8 +1450,8 @@ cn20k_nix_recv_pkts_vector(void *args, struct rte_mbuf **mbufs, uint16_t pkts, c
 				mask23 = vceqq_u64(sa23, vdupq_n_u64(0xFFFFFFFF));
 			}
 
-			sa01 = vshlq_n_u64(sa01, ROC_NIX_INL_OT_IPSEC_INB_SA_SZ_LOG2);
-			sa23 = vshlq_n_u64(sa23, ROC_NIX_INL_OT_IPSEC_INB_SA_SZ_LOG2);
+			sa01 = vshlq_n_u64(sa01, ROC_NIX_INL_OW_IPSEC_INB_SA_SZ_LOG2);
+			sa23 = vshlq_n_u64(sa23, ROC_NIX_INL_OW_IPSEC_INB_SA_SZ_LOG2);
 			sa01 = vaddq_u64(sa01, vdupq_n_u64(sa_base));
 			sa23 = vaddq_u64(sa23, vdupq_n_u64(sa_base));
 
@@ -1456,23 +1462,23 @@ cn20k_nix_recv_pkts_vector(void *args, struct rte_mbuf **mbufs, uint16_t pkts, c
 
 			const uint8x16x2_t tbl = {{
 				{
-					/* ROC_IE_OT_UCC_SUCCESS_PKT_IP_BADCSUM */
+					/* ROC_IE_OW_UCC_SUCCESS_PKT_IP_BADCSUM */
 					RTE_MBUF_F_RX_IP_CKSUM_BAD >> 1,
-					/* ROC_IE_OT_UCC_SUCCESS_PKT_L4_GOODCSUM */
+					/* ROC_IE_OW_UCC_SUCCESS_PKT_L4_GOODCSUM */
 					(RTE_MBUF_F_RX_IP_CKSUM_GOOD |
 					 RTE_MBUF_F_RX_L4_CKSUM_GOOD) >>
 						1,
-					/* ROC_IE_OT_UCC_SUCCESS_PKT_L4_BADCSUM */
+					/* ROC_IE_OW_UCC_SUCCESS_PKT_L4_BADCSUM */
 					(RTE_MBUF_F_RX_IP_CKSUM_GOOD |
 					 RTE_MBUF_F_RX_L4_CKSUM_BAD) >>
 						1,
 					1,
-					/* ROC_IE_OT_UCC_SUCCESS_PKT_UDPESP_NZCSUM */
+					/* ROC_IE_OW_UCC_SUCCESS_PKT_UDPESP_NZCSUM */
 					(RTE_MBUF_F_RX_IP_CKSUM_GOOD |
 					 RTE_MBUF_F_RX_L4_CKSUM_GOOD) >>
 						1,
 					1,
-					/* ROC_IE_OT_UCC_SUCCESS_PKT_UDP_ZEROCSUM */
+					/* ROC_IE_OW_UCC_SUCCESS_PKT_UDP_ZEROCSUM */
 					(RTE_MBUF_F_RX_IP_CKSUM_GOOD |
 					 RTE_MBUF_F_RX_L4_CKSUM_GOOD) >>
 						1,
@@ -1490,7 +1496,7 @@ cn20k_nix_recv_pkts_vector(void *args, struct rte_mbuf **mbufs, uint16_t pkts, c
 					1,
 					1,
 					1,
-					/* ROC_IE_OT_UCC_SUCCESS_PKT_IP_GOODCSUM */
+					/* ROC_IE_OW_UCC_SUCCESS_PKT_IP_GOODCSUM */
 					RTE_MBUF_F_RX_IP_CKSUM_GOOD >> 1,
 					/* Rest 0 to indicate RTE_MBUF_F_RX_SEC_OFFLOAD_FAILED */
 					0,
-- 
2.34.1

[PATCH 02/14] common/cnxk: disable CPT drop error in CQ

[Rahul Bhansali]

Disable CPT drop error in CQ context for cn20k platform.

Signed-off-by: Rahul Bhansali <rbhansali@marvell.com>
---
 drivers/common/cnxk/roc_nix_queue.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/common/cnxk/roc_nix_queue.c b/drivers/common/cnxk/roc_nix_queue.c
index 075c9c1591..ad8f62f38f 100644
--- a/drivers/common/cnxk/roc_nix_queue.c
+++ b/drivers/common/cnxk/roc_nix_queue.c
@@ -1251,7 +1251,7 @@ roc_nix_cn20k_cq_init(struct roc_nix *roc_nix, struct roc_nix_cq *cq)
 	cq_ctx->cq_err_int_ena |= BIT(NIX_CQERRINT_DOOR_ERR);
 	if (roc_feature_nix_has_late_bp() && roc_nix_inl_inb_is_enabled(roc_nix)) {
 		cq_ctx->cq_err_int_ena |= BIT(NIX_CQERRINT_CPT_DROP);
-		cq_ctx->cpt_drop_err_en = 1;
+		cq_ctx->cpt_drop_err_en = 0;
 		/* Enable Late BP only when non zero CPT BPID */
 		if (cpt_lbpid) {
 			cq_ctx->lbp_ena = 1;
-- 
2.34.1

[PATCH 03/14] common/cnxk: fix NIX QINT count reset

[Rahul Bhansali]

Fix QINT count reset on NIX queue IRQs register and
unregister.
Queue interrupt will be cleared by individual queue
interrupt operation register update.

Fixes: f6d567b03d28 ("common/cnxk: support NIX IRQ")
Fixes: 3c100e0e6b9c ("common/cnxk: support per-port RQ in inline device")
Cc: stable@dpdk.org

Signed-off-by: Rahul Bhansali <rbhansali@marvell.com>
---
 drivers/common/cnxk/roc_nix_inl_dev_irq.c | 21 ++++++++++++---------
 drivers/common/cnxk/roc_nix_irq.c         | 12 ++++++------
 2 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/drivers/common/cnxk/roc_nix_inl_dev_irq.c b/drivers/common/cnxk/roc_nix_inl_dev_irq.c
index 30986e780a..afbf966f78 100644
--- a/drivers/common/cnxk/roc_nix_inl_dev_irq.c
+++ b/drivers/common/cnxk/roc_nix_inl_dev_irq.c
@@ -396,6 +396,7 @@ nix_inl_nix_register_irqs(struct nix_inl_dev *inl_dev)
 	struct nix_inl_qint *qints_mem;
 	int rc, q, ret = 0;
 	uint16_t msixoff;
+	uint64_t cnt;
 	int qints;
 
 	msixoff = inl_dev->nix_msixoff;
@@ -434,8 +435,10 @@ nix_inl_nix_register_irqs(struct nix_inl_dev *inl_dev)
 
 	for (q = 0; q < qints; q++) {
 		/* Clear QINT CNT, interrupt */
-		plt_write64(0, nix_base + NIX_LF_QINTX_CNT(q));
 		plt_write64(~0ull, nix_base + NIX_LF_QINTX_ENA_W1C(q));
+		cnt = plt_read64(nix_base + NIX_LF_QINTX_CNT(q));
+		plt_write64((uint64_t)(-(int64_t)cnt), nix_base + NIX_LF_QINTX_CNT(q));
+		plt_write64(~0ull, nix_base + NIX_LF_QINTX_INT(q));
 
 		/* Register queue irq vector */
 		ret = dev_irq_register(handle, nix_inl_nix_q_irq, &qints_mem[q],
@@ -443,9 +446,7 @@ nix_inl_nix_register_irqs(struct nix_inl_dev *inl_dev)
 		if (ret)
 			break;
 
-		plt_write64(0, nix_base + NIX_LF_QINTX_CNT(q));
-		plt_write64(0, nix_base + NIX_LF_QINTX_INT(q));
-		/* Enable QINT interrupt */
+		/* Enable QINT interrupt (count/INT already drained above) */
 		plt_write64(~0ull, nix_base + NIX_LF_QINTX_ENA_W1S(q));
 
 		qints_mem[q].inl_dev = inl_dev;
@@ -463,6 +464,7 @@ nix_inl_nix_unregister_irqs(struct nix_inl_dev *inl_dev)
 	struct nix_inl_qint *qints_mem = inl_dev->qints_mem;
 	uintptr_t nix_base = inl_dev->nix_base;
 	uint16_t msixoff;
+	uint64_t cnt;
 	int q;
 
 	msixoff = inl_dev->nix_msixoff;
@@ -477,17 +479,18 @@ nix_inl_nix_unregister_irqs(struct nix_inl_dev *inl_dev)
 			   msixoff + NIX_LF_INT_VEC_POISON);
 
 	for (q = 0; q < inl_dev->configured_qints; q++) {
-		/* Clear QINT CNT */
-		plt_write64(0, nix_base + NIX_LF_QINTX_CNT(q));
-		plt_write64(0, nix_base + NIX_LF_QINTX_INT(q));
-
-		/* Disable QINT interrupt */
+		/* Clear QINT CNT, interrupt */
 		plt_write64(~0ull, nix_base + NIX_LF_QINTX_ENA_W1C(q));
 
+		cnt = plt_read64(nix_base + NIX_LF_QINTX_CNT(q));
+		plt_write64((uint64_t)(-(int64_t)cnt), nix_base + NIX_LF_QINTX_CNT(q));
+		plt_write64(~0ull, nix_base + NIX_LF_QINTX_INT(q));
+
 		/* Unregister queue irq vector */
 		dev_irq_unregister(handle, nix_inl_nix_q_irq, &qints_mem[q],
 				   msixoff + NIX_LF_INT_VEC_QINT_START + q);
 	}
+	inl_dev->configured_qints = 0;
 
 	plt_free(inl_dev->qints_mem);
 	inl_dev->qints_mem = NULL;
diff --git a/drivers/common/cnxk/roc_nix_irq.c b/drivers/common/cnxk/roc_nix_irq.c
index 6874435a4e..50a1943411 100644
--- a/drivers/common/cnxk/roc_nix_irq.c
+++ b/drivers/common/cnxk/roc_nix_irq.c
@@ -324,9 +324,6 @@ nix_lf_q_irq(void *param)
 			plt_err("SQ=%d NIX_SQINT_SQB_ALLOC_FAIL", sq);
 	}
 
-	/* Clear interrupt */
-	plt_write64(intr, nix->base + NIX_LF_QINTX_INT(qintx));
-
 	/* Call reset callback */
 	if (intr_cb && dev->ops->q_err_cb)
 		dev->ops->q_err_cb(nix_priv_to_roc_nix(nix), NULL);
@@ -338,6 +335,7 @@ roc_nix_register_queue_irqs(struct roc_nix *roc_nix)
 	int vec, q, sqs, rqs, qs, rc = 0;
 	struct plt_intr_handle *handle;
 	struct nix *nix;
+	int64_t val;
 
 	nix = roc_nix_to_nix_priv(roc_nix);
 	handle = nix->pci_dev->intr_handle;
@@ -358,7 +356,8 @@ roc_nix_register_queue_irqs(struct roc_nix *roc_nix)
 		vec = nix->msixoff + NIX_LF_INT_VEC_QINT_START + q;
 
 		/* Clear QINT CNT */
-		plt_write64(0, nix->base + NIX_LF_QINTX_CNT(q));
+		val = plt_read64(nix->base + NIX_LF_QINTX_CNT(q));
+		plt_write64(-val, nix->base + NIX_LF_QINTX_CNT(q));
 
 		/* Clear interrupt */
 		plt_write64(~0ull, nix->base + NIX_LF_QINTX_ENA_W1C(q));
@@ -375,7 +374,6 @@ roc_nix_register_queue_irqs(struct roc_nix *roc_nix)
 		if (rc)
 			break;
 
-		plt_write64(0, nix->base + NIX_LF_QINTX_CNT(q));
 		plt_write64(0, nix->base + NIX_LF_QINTX_INT(q));
 		/* Enable QINT interrupt */
 		plt_write64(~0ull, nix->base + NIX_LF_QINTX_ENA_W1S(q));
@@ -389,6 +387,7 @@ roc_nix_unregister_queue_irqs(struct roc_nix *roc_nix)
 {
 	struct plt_intr_handle *handle;
 	struct nix *nix;
+	int64_t val;
 	int vec, q;
 
 	nix = roc_nix_to_nix_priv(roc_nix);
@@ -398,7 +397,8 @@ roc_nix_unregister_queue_irqs(struct roc_nix *roc_nix)
 		vec = nix->msixoff + NIX_LF_INT_VEC_QINT_START + q;
 
 		/* Clear QINT CNT */
-		plt_write64(0, nix->base + NIX_LF_QINTX_CNT(q));
+		val = plt_read64(nix->base + NIX_LF_QINTX_CNT(q));
+		plt_write64(-val, nix->base + NIX_LF_QINTX_CNT(q));
 		plt_write64(0, nix->base + NIX_LF_QINTX_INT(q));
 
 		/* Clear interrupt */
-- 
2.34.1

[PATCH 04/14] common/cnxk: update channel mask for cn20k

[Rahul Bhansali]

From: Nithin Dabilpuram <ndabilpuram@marvell.com>

update channel mask for cn20k platform as well.

Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
---
 drivers/common/cnxk/roc_npc_mcam.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/common/cnxk/roc_npc_mcam.c b/drivers/common/cnxk/roc_npc_mcam.c
index 34665f1bc3..613a443c7c 100644
--- a/drivers/common/cnxk/roc_npc_mcam.c
+++ b/drivers/common/cnxk/roc_npc_mcam.c
@@ -761,7 +761,7 @@ npc_mcam_set_channel(struct roc_npc_flow *flow, struct npc_cn20k_mcam_write_entr
 	chan = channel;
 	mask = chan_mask;
 
-	if (roc_model_runtime_is_cn10k()) {
+	if (roc_model_runtime_is_cn10k() || roc_model_is_cn20k()) {
 		if (is_second_pass) {
 			chan = (channel | NIX_CHAN_CPT_CH_START);
 			mask = (chan_mask | NIX_CHAN_CPT_CH_START);
-- 
2.34.1

[PATCH 05/14] common/cnxk: update macro for cn20k

[Rahul Bhansali]

update macro for SA_LIFE_UNIT_OCTETS as per cn20k

Signed-off-by: Rahul Bhansali <rbhansali@marvell.com>
---
 drivers/common/cnxk/cnxk_security.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/common/cnxk/cnxk_security.c b/drivers/common/cnxk/cnxk_security.c
index 228ff2781d..719d4987b1 100644
--- a/drivers/common/cnxk/cnxk_security.c
+++ b/drivers/common/cnxk/cnxk_security.c
@@ -1445,7 +1445,7 @@ ow_ipsec_sa_common_param_fill(union roc_ow_ipsec_sa_word2 *w2, uint8_t *cipher_k
 			plt_err("Expiry tracking with both packets & bytes is not supported");
 			return -EINVAL;
 		}
-		w2->s.life_unit = ROC_IE_OT_SA_LIFE_UNIT_PKTS;
+		w2->s.life_unit = ROC_IE_OW_SA_LIFE_UNIT_PKTS;
 	}
 
 	if (ipsec_xfrm->life.bytes_soft_limit != 0 || ipsec_xfrm->life.bytes_hard_limit != 0) {
@@ -1454,7 +1454,7 @@ ow_ipsec_sa_common_param_fill(union roc_ow_ipsec_sa_word2 *w2, uint8_t *cipher_k
 			plt_err("Expiry tracking with both packets & bytes is not supported");
 			return -EINVAL;
 		}
-		w2->s.life_unit = ROC_IE_OT_SA_LIFE_UNIT_OCTETS;
+		w2->s.life_unit = ROC_IE_OW_SA_LIFE_UNIT_OCTETS;
 	}
 
 	return 0;
-- 
2.34.1

[PATCH 06/14] common/cnxk: fix null deref and irq ack in CPT CQ handler

[Rahul Bhansali]

From: Aarnav JP <ajp@marvell.com>

The CPT CQ interrupt handler (nix_inl_cpt_cq_cb) unconditionally
dereferences lf->dev->roc_nix to obtain roc_nix, nix, and port_id.
For inbound, the CPT LF belongs to the inline device which is not
an ethdev, so roc_nix is NULL and the dereference crashes.

Additionally, error paths returned without writing CPT_LF_DONE_ACK,
leaving CQ entries unacknowledged causing the completion queue to
fill up.

Fix by deferring roc_nix/nix/port_id derivation into the outbound
branch where roc_nix is valid, setting port_id to UINT32_MAX for
inbound, and routing all error paths through a common cq_ack label
that drains entries and writes CPT_LF_DONE_ACK.

Fixes: 3fdf3e53f3c4 ("common/cnxk: enable CPT CQ for inline IPsec inbound")
Cc: stable@dpdk.org

Signed-off-by: Aarnav JP <ajp@marvell.com>
---
 drivers/common/cnxk/roc_nix_inl_dev_irq.c | 48 ++++++++++++++++-------
 1 file changed, 33 insertions(+), 15 deletions(-)

diff --git a/drivers/common/cnxk/roc_nix_inl_dev_irq.c b/drivers/common/cnxk/roc_nix_inl_dev_irq.c
index afbf966f78..f99c32f30b 100644
--- a/drivers/common/cnxk/roc_nix_inl_dev_irq.c
+++ b/drivers/common/cnxk/roc_nix_inl_dev_irq.c
@@ -48,41 +48,57 @@ nix_inl_sso_work_cb(struct nix_inl_dev *inl_dev)
 static void
 nix_inl_cpt_cq_cb(struct roc_cpt_lf *lf)
 {
-	struct roc_nix *roc_nix = (struct roc_nix *)lf->dev->roc_nix;
-	struct nix *nix = roc_nix_to_nix_priv(roc_nix);
 	struct idev_cfg *idev = idev_get_cfg();
-	uint32_t port_id = roc_nix->port_id;
 	struct nix_inl_dev *inl_dev = NULL;
 	enum nix_inl_event_type cq_type;
 	union cpt_lf_cq_base cq_base;
 	union cpt_lf_cq_ptr cq_ptr;
+	struct roc_nix *roc_nix;
 	struct cpt_cq_s *cq_s;
 	uint8_t fmt_msk = 0x3;
 	uint32_t count, head;
+	uint32_t port_id = UINT32_MAX;
 	uint32_t nq_ptr;
+	struct nix *nix;
 	uint64_t i;
 	void *sa;
 
+	/* Read CQ state early so we can always acknowledge the interrupt */
+	head = lf->cq_head;
+	cq_base.u = plt_read64(lf->rbase + CPT_LF_CQ_BASE);
+	cq_ptr.u = plt_read64(lf->rbase + CPT_LF_CQ_PTR);
+	count = cq_ptr.s.count;
+	nq_ptr = cq_ptr.s.nq_ptr;
+
 	if (idev)
 		inl_dev = idev->nix_inl_dev;
 
 	if (!inl_dev) {
 		plt_nix_dbg("Inline Device could not be detected");
-		return;
+		goto cq_ack;
 	}
 
-	head = lf->cq_head;
-	cq_base.u = plt_read64(lf->rbase + CPT_LF_CQ_BASE);
-	cq_ptr.u = plt_read64(lf->rbase + CPT_LF_CQ_PTR);
-	count = cq_ptr.s.count;
-	nq_ptr = cq_ptr.s.nq_ptr;
-
-	if (lf->dev == &inl_dev->dev)
+	if (lf->dev == &inl_dev->dev) {
+		/* Inbound: CPT LF belongs to inline device.
+		 * roc_nix is NULL here as inline dev is not an ethdev.
+		 * port_id will be derived from SA in the PMD work callback.
+		 */
 		cq_type = NIX_INL_INB_CPT_CQ;
-	else if (lf->dev == &nix->dev)
+	} else {
+		/* Outbound: CPT LF belongs to an ethdev */
+		roc_nix = (struct roc_nix *)lf->dev->roc_nix;
+		if (!roc_nix) {
+			plt_nix_dbg("CPT LF dev has no roc_nix");
+			goto cq_ack;
+		}
+		nix = roc_nix_to_nix_priv(roc_nix);
+		if (lf->dev != &nix->dev) {
+			plt_nix_dbg("CPT LF dev mismatch with nix dev");
+			goto cq_ack;
+		}
 		cq_type = NIX_INL_OUTB_CPT_CQ;
-	else
-		return;
+		port_id = roc_nix->port_id;
+	}
 
 	for (i = 0; i < count; i++) {
 		cq_s = (struct cpt_cq_s *)(uintptr_t)(((cq_base.s.addr << 7)) + (head << 5));
@@ -106,11 +122,13 @@ nix_inl_cpt_cq_cb(struct roc_cpt_lf *lf)
 		head = (head + 1) % lf->cq_size;
 	}
 
+cq_ack:
+	/* Drain unprocessed entries and acknowledge the interrupt */
+	head = (lf->cq_head + count) % lf->cq_size;
 	lf->cq_head = head;
 	if (unlikely(nq_ptr != head))
 		plt_err("CPT LF[%d] CQ head %d != NQ ptr %d", lf->lf_id, head, nq_ptr);
 
-	/* Acknowledge the number of completed requests */
 	plt_write64(count, lf->rbase + CPT_LF_DONE_ACK);
 }
 
-- 
2.34.1

[PATCH 07/14] common/cnxk: derive mbuf from CPT CQ in inline IRQ path

[Rahul Bhansali]

From: Rakesh Kudurumalla <rkudurumalla@marvell.com>

Populate mbuf from WQE_PTR_CPTR and CPTR_WQE_PTR completions, handle
WQE_PTR_ANTI_REPLAY and CPTR_ANTI_REPLAY, and pass the mbuf pointer
into the inline device work callback instead of a fixed non-NULL
sentinel.

Signed-off-by: Rakesh Kudurumalla <rkudurumalla@marvell.com>
Signed-off-by: Rahul Bhansali <rbhansali@marvell.com>
---
 drivers/common/cnxk/roc_nix_inl_dev_irq.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/drivers/common/cnxk/roc_nix_inl_dev_irq.c b/drivers/common/cnxk/roc_nix_inl_dev_irq.c
index f99c32f30b..dcf77a29a5 100644
--- a/drivers/common/cnxk/roc_nix_inl_dev_irq.c
+++ b/drivers/common/cnxk/roc_nix_inl_dev_irq.c
@@ -51,13 +51,15 @@ nix_inl_cpt_cq_cb(struct roc_cpt_lf *lf)
 	struct idev_cfg *idev = idev_get_cfg();
 	struct nix_inl_dev *inl_dev = NULL;
 	enum nix_inl_event_type cq_type;
+	uint32_t port_id = UINT32_MAX;
 	union cpt_lf_cq_base cq_base;
 	union cpt_lf_cq_ptr cq_ptr;
+	uint64_t gw[2] = {~0ULL, 0};
 	struct roc_nix *roc_nix;
 	struct cpt_cq_s *cq_s;
 	uint8_t fmt_msk = 0x3;
 	uint32_t count, head;
-	uint32_t port_id = UINT32_MAX;
+	void *wqe = NULL;
 	uint32_t nq_ptr;
 	struct nix *nix;
 	uint64_t i;
@@ -107,16 +109,26 @@ nix_inl_cpt_cq_cb(struct roc_cpt_lf *lf)
 			switch (cq_s->w2.s.fmt & fmt_msk) {
 			case WQE_PTR_CPTR:
 				sa = (void *)cq_s->w1.esn;
+				wqe = (void *)((uintptr_t)cq_s->w3.comp_ptr & ~0x7ULL);
 				break;
 			case CPTR_WQE_PTR:
 				sa = (void *)cq_s->w3.comp_ptr;
+				wqe = (void *)((uintptr_t)cq_s->w1.esn & ~0x7ULL);
+				break;
+			case WQE_PTR_ANTI_REPLAY:
+				sa = NULL;
+				wqe = (void *)((uintptr_t)cq_s->w3.comp_ptr & ~0x7ULL);
+				break;
+			case CPTR_ANTI_REPLAY:
+				sa = (void *)cq_s->w3.comp_ptr;
+				wqe = NULL;
 				break;
 			default:
 				plt_err("Invalid event Received ");
 				goto done;
 			}
-			uint64_t tmp = ~(uint32_t)0x0;
-			inl_dev->work_cb(&tmp, sa, cq_type, (void *)cq_s, port_id);
+			gw[1] = (uint64_t)(uintptr_t)wqe;
+			inl_dev->work_cb(gw, sa, cq_type, (void *)cq_s, port_id);
 		}
 done:
 		head = (head + 1) % lf->cq_size;
-- 
2.34.1

[PATCH 08/14] net/cnxk: resolve mbuf from CPT CQ format in SSO work cb

[Rahul Bhansali]

From: Rakesh Kudurumalla <rkudurumalla@marvell.com>

When handling NIX inline CPT CQ events (type < NIX_INL_SSO), derive the
mbuf from the completion queue word layout using fmt bits: WQE_PTR_CPTR
uses w1.esn; CPTR_WQE_PTR uses w3.comp_ptr shifted left by 3 for the byte
address. Pass the mbuf into cn20k_eth_sec_post_event instead of NULL.
Drop RTE_SET_USED(args) since args is consumed by post_event.

Signed-off-by: Rakesh Kudurumalla <rkudurumalla@marvell.com>
Signed-off-by: Rahul Bhansali <rbhansali@marvell.com>
---
 drivers/net/cnxk/cn20k_ethdev_sec.c | 44 +++++++++++++++++++----------
 1 file changed, 29 insertions(+), 15 deletions(-)

diff --git a/drivers/net/cnxk/cn20k_ethdev_sec.c b/drivers/net/cnxk/cn20k_ethdev_sec.c
index 65f0235a46..b365426065 100644
--- a/drivers/net/cnxk/cn20k_ethdev_sec.c
+++ b/drivers/net/cnxk/cn20k_ethdev_sec.c
@@ -438,7 +438,7 @@ cnxk_pktmbuf_free_no_cache(struct rte_mbuf *mbuf)
 	} while (mbuf != NULL);
 }
 
-static void
+static bool
 cn20k_eth_sec_post_event(struct rte_eth_dev *eth_dev, void *sa, enum nix_inl_event_type type,
 			 uint16_t uc_compcode, uint16_t compcode, struct rte_mbuf *mbuf)
 {
@@ -447,6 +447,7 @@ cn20k_eth_sec_post_event(struct rte_eth_dev *eth_dev, void *sa, enum nix_inl_eve
 	struct cn20k_outb_priv_data *outb_priv;
 	struct cn20k_inb_priv_data *inb_priv;
 	static uint64_t warn_cnt;
+	bool free_mbuf = false;
 	uint64_t life_unit;
 
 	memset(&desc, 0, sizeof(desc));
@@ -454,14 +455,15 @@ cn20k_eth_sec_post_event(struct rte_eth_dev *eth_dev, void *sa, enum nix_inl_eve
 
 	if (type == NIX_INL_INB_CPT_CQ) {
 		struct roc_ow_ipsec_inb_sa *inb_sa = (struct roc_ow_ipsec_inb_sa *)sa;
-		inb_priv = roc_nix_inl_ow_ipsec_inb_sa_sw_rsvd(sa);
-		desc.metadata = (uint64_t)inb_priv->userdata;
-		life_unit = inb_sa->w2.s.life_unit;
+		inb_priv = sa ? roc_nix_inl_ow_ipsec_inb_sa_sw_rsvd(sa) : NULL;
+		desc.metadata = inb_priv ? (uint64_t)inb_priv->userdata : 0;
+		life_unit = inb_sa ? inb_sa->w2.s.life_unit : 0;
 	} else {
 		struct roc_ow_ipsec_outb_sa *outb_sa = (struct roc_ow_ipsec_outb_sa *)sa;
 		outb_priv = roc_nix_inl_ow_ipsec_outb_sa_sw_rsvd(sa);
 		desc.metadata = (uint64_t)outb_priv->userdata;
 		life_unit = outb_sa->w2.s.life_unit;
+		free_mbuf = true;
 	}
 
 	if (mbuf)
@@ -483,6 +485,7 @@ cn20k_eth_sec_post_event(struct rte_eth_dev *eth_dev, void *sa, enum nix_inl_eve
 			desc.subtype = RTE_ETH_EVENT_IPSEC_SA_PKT_EXPIRY;
 		else
 			desc.subtype = RTE_ETH_EVENT_IPSEC_SA_BYTE_EXPIRY;
+		free_mbuf = false;
 		break;
 	case ROC_IE_OW_UCC_ERR_PKT_IP:
 		warn_cnt++;
@@ -503,7 +506,10 @@ cn20k_eth_sec_post_event(struct rte_eth_dev *eth_dev, void *sa, enum nix_inl_eve
 		break;
 	}
 
-	rte_eth_dev_callback_process(eth_dev, RTE_ETH_EVENT_IPSEC, &desc);
+	if (eth_dev)
+		rte_eth_dev_callback_process(eth_dev, RTE_ETH_EVENT_IPSEC, &desc);
+
+	return free_mbuf;
 }
 
 static const char *
@@ -532,13 +538,14 @@ cn20k_eth_sec_sso_work_cb(uint64_t *gw, void *args, enum nix_inl_event_type type
 	struct cn20k_sec_sess_priv sess_priv;
 	struct cn20k_outb_priv_data *outb_priv;
 	struct roc_ow_ipsec_outb_sa *outb_sa;
+	struct rte_eth_dev *eth_dev = NULL;
+	struct rte_mbuf *mbuf = NULL;
 	struct cpt_cn20k_res_s *res;
-	struct rte_eth_dev *eth_dev;
 	struct cnxk_eth_dev *dev;
 	uint16_t dlen_adj, rlen;
-	struct rte_mbuf *mbuf;
 	uintptr_t sa_base;
 	uintptr_t nixtx;
+	bool free_mbuf;
 	uint8_t port;
 
 	plt_nix_dbg("Received %s event", get_inl_event_type(type));
@@ -562,17 +569,19 @@ cn20k_eth_sec_sso_work_cb(uint64_t *gw, void *args, enum nix_inl_event_type type
 		if (type) {
 			struct cpt_cq_s *cqs = (struct cpt_cq_s *)cq_s;
 
-			if (type == NIX_INL_INB_CPT_CQ) {
+			if (type == NIX_INL_INB_CPT_CQ && cqs->w2.s.fmt != WQE_PTR_ANTI_REPLAY) {
 				struct cn20k_inb_priv_data *inb_priv;
 
-				inb_priv = roc_nix_inl_ow_ipsec_inb_sa_sw_rsvd(args);
-				if (inb_priv->eth_sec && inb_priv->eth_sec->eth_dev) {
+				inb_priv = args ? roc_nix_inl_ow_ipsec_inb_sa_sw_rsvd(args) : NULL;
+				if (inb_priv && inb_priv->eth_sec && inb_priv->eth_sec->eth_dev) {
 					eth_dev = inb_priv->eth_sec->eth_dev;
 				} else {
-					plt_err("Inbound CPT CQ event: no eth_dev in SA priv");
+					plt_nix_dbg("Inbound CPT CQ event: cc %x uc_cc %x fmt %x",
+						    cqs->w0.s.compcode, cqs->w0.s.uc_compcode,
+						    cqs->w2.s.fmt);
 					return;
 				}
-			} else {
+			} else if (type != NIX_INL_INB_CPT_CQ) {
 				if (port_id >= RTE_MAX_ETHPORTS) {
 					plt_err("CPT CQ event: invalid port_id %u", port_id);
 					return;
@@ -581,9 +590,14 @@ cn20k_eth_sec_sso_work_cb(uint64_t *gw, void *args, enum nix_inl_event_type type
 			}
 
 			if (type < NIX_INL_SSO) {
-				cn20k_eth_sec_post_event(eth_dev, args, type,
-							 (uint16_t)cqs->w0.s.uc_compcode,
-							 (uint16_t)cqs->w0.s.compcode, NULL);
+				mbuf = (struct rte_mbuf *)(uintptr_t)gw[1];
+
+				free_mbuf = cn20k_eth_sec_post_event(eth_dev, args,
+					    type, (uint16_t)cqs->w0.s.uc_compcode,
+					    (uint16_t)cqs->w0.s.compcode, mbuf);
+
+				if (free_mbuf)
+					cnxk_pktmbuf_free_no_cache(mbuf);
 				return;
 			}
 			if (type == NIX_INL_SOFT_EXPIRY_THRD) {
-- 
2.34.1

[PATCH 09/14] common/cnxk: update bpid config for cn20k

[Rahul Bhansali]

For cn20k, Rx chan bpid config range increased to 10 bit from 8
bits. These extra bits are reserved in cn10k platform so separate
platform specific bpid range mask is not required.

Signed-off-by: Rahul Bhansali <rbhansali@marvell.com>
---
 drivers/common/cnxk/roc_nix_fc.c    | 30 +++++++++++++++--------------
 drivers/common/cnxk/roc_nix_queue.c |  1 +
 2 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/drivers/common/cnxk/roc_nix_fc.c b/drivers/common/cnxk/roc_nix_fc.c
index ddabd15a5d..abf923b722 100644
--- a/drivers/common/cnxk/roc_nix_fc.c
+++ b/drivers/common/cnxk/roc_nix_fc.c
@@ -51,7 +51,7 @@ nix_fc_rxchan_bpid_set(struct roc_nix *roc_nix, bool enable)
 
 		nix->chan_cnt = rsp->chan_cnt;
 		for (i = 0; i < rsp->chan_cnt; i++)
-			nix->bpid[i] = rsp->chan_bpid[i] & 0x1FF;
+			nix->bpid[i] = rsp->chan_bpid[i] & 0x7FF;
 	} else {
 		req = mbox_alloc_msg_nix_bp_disable(mbox);
 		if (req == NULL)
@@ -86,7 +86,7 @@ nix_fc_rxchan_bpid_set(struct roc_nix *roc_nix, bool enable)
 		rc = mbox_process_msg(mbox, (void *)&rsp);
 		if (rc)
 			goto exit;
-		nix->cpt_lbpid = rsp->chan_bpid[0] & 0x1FF;
+		nix->cpt_lbpid = rsp->chan_bpid[0] & 0x7FF;
 	}
 
 	/* CPT to NIX BP on all channels */
@@ -333,6 +333,8 @@ nix_fc_cq_config_set(struct roc_nix *roc_nix, struct roc_nix_fc_cfg *fc_cfg)
 		if (fc_cfg->cq_cfg.enable) {
 			aq->cq.bpid = nix->bpid[fc_cfg->cq_cfg.tc];
 			aq->cq_mask.bpid = ~(aq->cq_mask.bpid);
+			aq->cq.bpid_ext = (nix->bpid[fc_cfg->cq_cfg.tc] >> 9) & 0x3;
+			aq->cq_mask.bpid_ext = ~(aq->cq_mask.bpid_ext);
 			aq->cq.bp = fc_cfg->cq_cfg.cq_bp;
 			aq->cq_mask.bp = ~(aq->cq_mask.bp);
 		}
@@ -903,33 +905,33 @@ roc_nix_chan_bpid_set(struct roc_nix *roc_nix, uint16_t chan, uint64_t bpid, int
 		return rc;
 
 	if (ena) {
-		if ((((cfg >> NIX_BPID1_OFF) & GENMASK_ULL(8, 0)) == bpid) ||
-		    (((cfg >> NIX_BPID2_OFF) & GENMASK_ULL(8, 0)) == bpid) ||
-		    (((cfg >> NIX_BPID3_OFF) & GENMASK_ULL(8, 0)) == bpid))
+		if ((((cfg >> NIX_BPID1_OFF) & GENMASK_ULL(10, 0)) == bpid) ||
+		    (((cfg >> NIX_BPID2_OFF) & GENMASK_ULL(10, 0)) == bpid) ||
+		    (((cfg >> NIX_BPID3_OFF) & GENMASK_ULL(10, 0)) == bpid))
 			return 0;
 
 		if (!(cfg & BIT_ULL(NIX_BPID1_ENA))) {
-			cfg &= ~GENMASK_ULL(NIX_BPID1_OFF + 8, NIX_BPID1_OFF);
+			cfg &= ~GENMASK_ULL(NIX_BPID1_OFF + 10, NIX_BPID1_OFF);
 			cfg |= (((uint64_t)bpid << NIX_BPID1_OFF) | BIT_ULL(NIX_BPID1_ENA));
 		} else if (!(cfg & BIT_ULL(NIX_BPID2_ENA))) {
-			cfg &= ~GENMASK_ULL(NIX_BPID2_OFF + 8, NIX_BPID2_OFF);
+			cfg &= ~GENMASK_ULL(NIX_BPID2_OFF + 10, NIX_BPID2_OFF);
 			cfg |= (((uint64_t)bpid << NIX_BPID2_OFF) | BIT_ULL(NIX_BPID2_ENA));
 		} else if (!(cfg & BIT_ULL(NIX_BPID3_ENA))) {
-			cfg &= ~GENMASK_ULL(NIX_BPID3_OFF + 8, NIX_BPID3_OFF);
+			cfg &= ~GENMASK_ULL(NIX_BPID3_OFF + 10, NIX_BPID3_OFF);
 			cfg |= (((uint64_t)bpid << NIX_BPID3_OFF) | BIT_ULL(NIX_BPID3_ENA));
 		} else {
 			plt_nix_dbg("Exceed maximum BPIDs");
 			return -ENOSPC;
 		}
 	} else {
-		if (((cfg >> NIX_BPID1_OFF) & GENMASK_ULL(8, 0)) == bpid) {
-			cfg &= ~(GENMASK_ULL(NIX_BPID1_OFF + 8, NIX_BPID1_OFF) |
+		if (((cfg >> NIX_BPID1_OFF) & GENMASK_ULL(10, 0)) == bpid) {
+			cfg &= ~(GENMASK_ULL(NIX_BPID1_OFF + 10, NIX_BPID1_OFF) |
 				 BIT_ULL(NIX_BPID1_ENA));
-		} else if (((cfg >> NIX_BPID2_OFF) & GENMASK_ULL(8, 0)) == bpid) {
-			cfg &= ~(GENMASK_ULL(NIX_BPID2_OFF + 8, NIX_BPID2_OFF) |
+		} else if (((cfg >> NIX_BPID2_OFF) & GENMASK_ULL(10, 0)) == bpid) {
+			cfg &= ~(GENMASK_ULL(NIX_BPID2_OFF + 10, NIX_BPID2_OFF) |
 				 BIT_ULL(NIX_BPID2_ENA));
-		} else if (((cfg >> NIX_BPID3_OFF) & GENMASK_ULL(8, 0)) == bpid) {
-			cfg &= ~(GENMASK_ULL(NIX_BPID3_OFF + 8, NIX_BPID3_OFF) |
+		} else if (((cfg >> NIX_BPID3_OFF) & GENMASK_ULL(10, 0)) == bpid) {
+			cfg &= ~(GENMASK_ULL(NIX_BPID3_OFF + 10, NIX_BPID3_OFF) |
 				 BIT_ULL(NIX_BPID3_ENA));
 		} else {
 			plt_nix_dbg("BPID not found");
diff --git a/drivers/common/cnxk/roc_nix_queue.c b/drivers/common/cnxk/roc_nix_queue.c
index ad8f62f38f..8e7e597be2 100644
--- a/drivers/common/cnxk/roc_nix_queue.c
+++ b/drivers/common/cnxk/roc_nix_queue.c
@@ -1258,6 +1258,7 @@ roc_nix_cn20k_cq_init(struct roc_nix *roc_nix, struct roc_nix_cq *cq)
 			cq_ctx->lbpid_low = cpt_lbpid & 0x7;
 			cq_ctx->lbpid_med = (cpt_lbpid >> 3) & 0x7;
 			cq_ctx->lbpid_high = (cpt_lbpid >> 6) & 0x7;
+			cq_ctx->lbpid_ext = (cpt_lbpid >> 9) & 0x3;
 			cq_ctx->lbp_frac = NIX_CQ_LBP_THRESH_FRAC;
 		}
 		drop_thresh = NIX_CQ_SEC_BP_THRESH_LEVEL;
-- 
2.34.1

[PATCH 10/14] net/cnxk: add MSNS inb SA and CN20K CPT result struct

[Rahul Bhansali]

From: Rakesh Kudurumalla <rkudurumalla@marvell.com>

Define the 1KB inbound MSNS SA layout with four packed anti-replay
sub-spaces, the MSNS context update region, and compile-time size
checks. Extend the HW SA union and add the CN20K CPT result format
for inline IPsec custom profile support.

Signed-off-by: Rakesh Kudurumalla <rkudurumalla@marvell.com>
---
 drivers/net/cnxk/cnxk_ethdev_sec.c |   9 +-
 drivers/net/cnxk/rte_pmd_cnxk.h    | 232 +++++++++++++++++++++++++++--
 2 files changed, 230 insertions(+), 11 deletions(-)

diff --git a/drivers/net/cnxk/cnxk_ethdev_sec.c b/drivers/net/cnxk/cnxk_ethdev_sec.c
index 61eb55ba43..d208569168 100644
--- a/drivers/net/cnxk/cnxk_ethdev_sec.c
+++ b/drivers/net/cnxk/cnxk_ethdev_sec.c
@@ -362,7 +362,14 @@ rte_pmd_cnxk_inl_inb_prof_sa_base_get(uint16_t portid, uint16_t profile_id)
 	eth_dev = &rte_eth_devices[portid];
 	dev = cnxk_eth_pmd_priv(eth_dev);
 
-	sa_base = roc_nix_inl_inb_prof_sa_base_get(&dev->nix, !dev->inb.no_inl_dev, profile_id);
+	/* Return IPsec sa base if profile_id is UINT16_MAX, else return the sa base
+	 * for the given profile_id.
+	 */
+	if (profile_id == UINT16_MAX)
+		sa_base = roc_nix_inl_inb_sa_base_get(&dev->nix, dev->inb.inl_dev);
+	else
+		sa_base = roc_nix_inl_inb_prof_sa_base_get(&dev->nix, !dev->inb.no_inl_dev,
+							   profile_id);
 
 	if (!sa_base)
 		return NULL;
diff --git a/drivers/net/cnxk/rte_pmd_cnxk.h b/drivers/net/cnxk/rte_pmd_cnxk.h
index 1960288cef..3ffd608f16 100644
--- a/drivers/net/cnxk/rte_pmd_cnxk.h
+++ b/drivers/net/cnxk/rte_pmd_cnxk.h
@@ -337,6 +337,209 @@ struct rte_pmd_cnxk_ipsec_inb_sa {
 	struct rte_pmd_cnxk_ipsec_inb_ctx_update_reg ctx;
 };
 
+/** Number of MSNS spaces per inbound SA CTX entry */
+#define RTE_PMD_CNXK_IPSEC_INB_MSNS_SPACES 4
+
+/** Anti-replay window size per MSNS space (bits) */
+#define RTE_PMD_CNXK_IPSEC_INB_MSNS_AR_WIN_BITS 1024
+
+/** Anti-replay window size per MSNS space (bytes) */
+#define RTE_PMD_CNXK_IPSEC_INB_MSNS_AR_WIN_BYTES (RTE_PMD_CNXK_IPSEC_INB_MSNS_AR_WIN_BITS / 8)
+
+/** u64 array size to fit MSNS anti-replay window bits per space */
+#define RTE_PMD_CNXK_IPSEC_INB_MSNS_AR_WIN_U64                                                     \
+	(RTE_PMD_CNXK_IPSEC_INB_MSNS_AR_WIN_BYTES / sizeof(uint64_t))
+
+/** Per MSNS space anti-replay base/valid pair (packed contiguously) */
+struct rte_pmd_cnxk_ipsec_msns_ar {
+	/** IPSEC Anti-Replay base */
+	uint64_t ar_base;
+	/** IPSEC Anti-Replay valid */
+	uint64_t ar_valid;
+};
+
+/**
+ * Inbound IPsec MSNS packed context update region (4 spaces).
+ *
+ * Layout: ar_base[0], ar_valid[0], ar_base[1], ar_valid[1], ...
+ */
+struct __rte_aligned(32) rte_pmd_cnxk_ipsec_inb_ctx_msns_reg {
+	/** IPSEC Anti-Replay base/valid per MSNS space */
+	struct rte_pmd_cnxk_ipsec_msns_ar ar[RTE_PMD_CNXK_IPSEC_INB_MSNS_SPACES];
+	/** Hard lifetime */
+	uint64_t hard_life;
+	/** Soft lifetime */
+	uint64_t soft_life;
+	/** MIB byte statistics */
+	uint64_t mib_octs;
+	/** MIB packet statistics */
+	uint64_t mib_pkts;
+	/** IPSEC Anti-Replay window per MSNS space (128B each) */
+	uint64_t ar_winbits[RTE_PMD_CNXK_IPSEC_INB_MSNS_SPACES]
+			   [RTE_PMD_CNXK_IPSEC_INB_MSNS_AR_WIN_U64];
+};
+
+/** Inbound IPsec MSNS SA slot size (1KB) */
+#define RTE_PMD_CNXK_IPSEC_INB_SA_MSNS_SZ 1024
+
+/** Byte offset of MSNS HW ctx region (32-byte aligned, Word32) */
+#define RTE_PMD_CNXK_IPSEC_INB_MSNS_CTX_OFF                                                        \
+	RTE_ALIGN_CEIL(offsetof(struct rte_pmd_cnxk_ipsec_inb_sa, ctx), 32)
+
+/** Pad bytes before MSNS HW ctx to reach RTE_PMD_CNXK_IPSEC_INB_MSNS_CTX_OFF */
+#define RTE_PMD_CNXK_IPSEC_INB_MSNS_CTX_ALIGN_PAD                                                  \
+	(RTE_PMD_CNXK_IPSEC_INB_MSNS_CTX_OFF - offsetof(struct rte_pmd_cnxk_ipsec_inb_sa, ctx))
+
+/** MSNS inbound ctx_push_size: push ends at HW ctx (not hw_ctx_off + 1) */
+#define RTE_PMD_CNXK_IPSEC_INB_MSNS_CTX_PUSH_SZ(hw_ctx_off_words) (hw_ctx_off_words)
+
+/**
+ * Inbound IPsec SA for MSNS with 4 spaces packed in one CTX cache entry.
+ *
+ * Word0 - Word30 match struct rte_pmd_cnxk_ipsec_inb_sa.
+ * Word32+ is the 32-byte aligned MSNS HW context update region.
+ */
+struct rte_pmd_cnxk_ipsec_inb_msns_sa {
+	/** Word0 */
+	union {
+		struct {
+			uint64_t ar_win : 3;
+			uint64_t hard_life_dec : 1;
+			uint64_t soft_life_dec : 1;
+			uint64_t count_glb_octets : 1;
+			uint64_t count_glb_pkts : 1;
+			uint64_t count_mib_bytes : 1;
+			uint64_t count_mib_pkts : 1;
+			uint64_t hw_ctx_off : 7;
+			uint64_t ctx_id : 16;
+			uint64_t orig_pkt_fabs : 1;
+			uint64_t orig_pkt_free : 1;
+			uint64_t pkind : 6;
+			uint64_t rsvd0 : 1;
+			uint64_t et_ovrwr : 1;
+			uint64_t pkt_output : 2;
+			uint64_t pkt_format : 1;
+			uint64_t defrag_opt : 2;
+			uint64_t x2p_dst : 1;
+			uint64_t ctx_push_size : 7;
+			uint64_t rsvd1 : 1;
+			uint64_t ctx_hdr_size : 2;
+			uint64_t aop_valid : 1;
+			uint64_t rsvd2 : 1;
+			uint64_t ctx_size : 4;
+		} s;
+		uint64_t u64;
+	} w0;
+
+	/** Word1 */
+	union {
+		struct {
+			uint64_t orig_pkt_aura : 20;
+			uint64_t rsvd3 : 4;
+			uint64_t orig_pkt_foff : 8;
+			uint64_t cookie : 32;
+		} s;
+		uint64_t u64;
+	} w1;
+
+	/** Word2 */
+	union {
+		struct {
+			uint64_t valid : 1;
+			uint64_t dir : 1;
+			uint64_t rsvd11 : 1;
+			uint64_t rsvd4 : 1;
+			uint64_t ipsec_mode : 1;
+			uint64_t ipsec_protocol : 1;
+			uint64_t aes_key_len : 2;
+			uint64_t enc_type : 3;
+			uint64_t life_unit : 1;
+			uint64_t auth_type : 4;
+			uint64_t encap_type : 2;
+			uint64_t et_ovrwr_ddr_en : 1;
+			uint64_t esn_en : 1;
+			uint64_t tport_l4_incr_csum : 1;
+			uint64_t ip_hdr_verify : 2;
+			uint64_t udp_ports_verify : 1;
+			uint64_t l3hdr_on_err : 1;
+			uint64_t rsvd6 : 6;
+			uint64_t rsvd12 : 1;
+			uint64_t spi : 32;
+		} s;
+		uint64_t u64;
+	} w2;
+
+	/** Word3 */
+	uint64_t rsvd7;
+
+	/** Word4 - Word7 */
+	uint8_t cipher_key[RTE_PMD_CNXK_CTX_MAX_CKEY_LEN];
+
+	/** Word8 - Word9 */
+	union {
+		struct {
+			uint32_t rsvd8;
+			uint8_t salt[4];
+		} s;
+		uint64_t u64;
+	} w8;
+	uint64_t rsvd9;
+
+	/** Word10 */
+	union {
+		struct {
+			uint64_t rsvd10 : 32;
+			uint64_t udp_src_port : 16;
+			uint64_t udp_dst_port : 16;
+		} s;
+		uint64_t u64;
+	} w10;
+
+	/** Word11 - Word14 */
+	union rte_pmd_cnxk_ipsec_outer_ip_hdr outer_hdr;
+
+	/** Word15 - Word30 */
+	uint8_t hmac_opad_ipad[RTE_PMD_CNXK_CTX_MAX_OPAD_IPAD_LEN];
+
+	/** Pad Word31 so MSNS HW ctx region is 32-byte aligned */
+	uint8_t ctx_align_pad[RTE_PMD_CNXK_IPSEC_INB_MSNS_CTX_ALIGN_PAD];
+
+	/** Word32+ MSNS HW context update region (32-byte aligned) */
+	struct rte_pmd_cnxk_ipsec_inb_ctx_msns_reg ctx;
+
+	/** Reserved to pad SA to 1KB */
+	uint8_t rsvd[RTE_PMD_CNXK_IPSEC_INB_SA_MSNS_SZ - RTE_PMD_CNXK_IPSEC_INB_MSNS_CTX_OFF -
+		     sizeof(struct rte_pmd_cnxk_ipsec_inb_ctx_msns_reg)];
+};
+
+static_assert(sizeof(struct rte_pmd_cnxk_ipsec_inb_msns_sa) == RTE_PMD_CNXK_IPSEC_INB_SA_MSNS_SZ,
+	      "rte_pmd_cnxk_ipsec_inb_msns_sa must be 1KB");
+static_assert(RTE_PMD_CNXK_IPSEC_INB_MSNS_CTX_ALIGN_PAD == 8, "msns_sa ctx align pad must be 8B");
+static_assert((offsetof(struct rte_pmd_cnxk_ipsec_inb_msns_sa, ctx) % 32) == 0,
+	      "msns_sa ctx must be 32-byte aligned");
+static_assert(offsetof(struct rte_pmd_cnxk_ipsec_inb_msns_sa, ctx) ==
+		      RTE_PMD_CNXK_IPSEC_INB_MSNS_CTX_OFF,
+	      "msns_sa ctx must start at Word32");
+static_assert((offsetof(struct rte_pmd_cnxk_ipsec_inb_msns_sa, ctx) / 8) <= 32,
+	      "msns_sa hw_ctx_off must be <= 32 without CTX caching");
+static_assert((offsetof(struct rte_pmd_cnxk_ipsec_inb_msns_sa, ctx.ar_winbits) % 32) == 0,
+	      "msns_sa ar_winbits must be 32-byte aligned");
+static_assert(offsetof(struct rte_pmd_cnxk_ipsec_inb_msns_sa, w1) ==
+		      offsetof(struct rte_pmd_cnxk_ipsec_inb_sa, w1),
+	      "msns_sa w1 offset must match inb_sa");
+static_assert(offsetof(struct rte_pmd_cnxk_ipsec_inb_msns_sa, w2) ==
+		      offsetof(struct rte_pmd_cnxk_ipsec_inb_sa, w2),
+	      "msns_sa w2 offset must match inb_sa");
+
+/** @deprecated use struct rte_pmd_cnxk_ipsec_inb_msns_sa */
+typedef struct rte_pmd_cnxk_ipsec_inb_msns_sa rte_pmd_cnxk_ipsec_inb_sa_msns;
+
+/** 1KB-aligned inbound MSNS SA slot size */
+#define RTE_PMD_CNXK_IPSEC_INB_SA_MSNS_SZ_ALIGN RTE_PMD_CNXK_IPSEC_INB_SA_MSNS_SZ
+
+/** HW write size for inbound MSNS SA (push + MSNS ctx, excludes sw priv tail) */
+#define RTE_PMD_CNXK_IPSEC_INB_SA_MSNS_WR_SZ offsetof(struct rte_pmd_cnxk_ipsec_inb_msns_sa, rsvd)
+
 /**
  * Outbound IPsec SA
  */
@@ -485,6 +688,8 @@ union rte_pmd_cnxk_ipsec_hw_sa {
 	struct rte_pmd_cnxk_ipsec_inb_sa inb;
 	/** Outbound SA */
 	struct rte_pmd_cnxk_ipsec_outb_sa outb;
+	/** Inbound MSNS SA (1KB, 4 packed AR spaces) */
+	struct rte_pmd_cnxk_ipsec_inb_msns_sa inb_msns;
 };
 
 /** CPT HW result format */
@@ -506,6 +711,23 @@ union rte_pmd_cnxk_cpt_res_s {
 		uint64_t esn;
 	} cn10k;
 
+	/** CN20K CPT result */
+	struct rte_pmd_cpt_cn20k_res_s {
+		/** Completion code */
+		uint64_t compcode : 7;
+		/** Done interrupt */
+		uint64_t doneint : 1;
+		/** Microcode completion code */
+		uint64_t uc_compcode : 8;
+		/** Result length */
+		uint64_t rlen : 16;
+		/** SPI */
+		uint64_t spi : 32;
+
+		/** Extended sequence number */
+		uint64_t esn;
+	} cn20k;
+
 	/** CN9K CPT result */
 	struct rte_pmd_cpt_cn9k_res_s {
 		/** Completion code */
@@ -745,16 +967,6 @@ struct rte_pmd_cnxk_rx_def_inl_cfg {
  * This structure represents the NIX_AF_RX_INLINE_GEN_CFG(0..7) register fields.
  */
 struct rte_pmd_cnxk_rx_gen_inl_cfg {
-	/** Layer type mask (bits 3:0) */
-	uint64_t ltype_mask;
-	/** Layer type match value (bits 7:4) */
-	uint64_t ltype_match;
-	/** Layer ID (bits 10:8) */
-	uint64_t lid;
-	/** Nibble Offset (bit 11) - 0: IPv4, 1: IPv6 */
-	uint64_t noffset;
-	/** Offset (bits 17:12) - Offset to DSCP field */
-	uint64_t offset;
 	/** PARAM2 (bits 15:0) - CPT_INST_S[PARAM2] */
 	uint64_t param2;
 	/** PARAM1 (bits 31:16) - CPT_INST_S[PARAM1] */
-- 
2.34.1

[PATCH 11/14] common/cnxk: fix CPT CQ base address calculation

[Rahul Bhansali]

From: Alok Mishra <almishra@marvell.com>

In nix_inl_cpt_cq_cb(), the CPT CQ base address is reconstructed by
left-shifting CPT_LF_CQ_BASE.s.addr by 7 bits. Since s.addr is a 46-bit
field, the shift operation truncates the result to 46 bits, discarding
any higher address bits.

This produces an incorrect CQ base address for higher virtual
addresses, causing invalid memory access.

Fixed by casting s.addr to uint64_t before shifting, ensuring the full
64-bit address is preserved.

Fixes: 63b16e267106 ("common/cnxk: fix CPT CQ roll over handling")
Cc: stable@dpdk.org

Signed-off-by: Alok Mishra <almishra@marvell.com>
---
 drivers/common/cnxk/roc_nix_inl_dev_irq.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/common/cnxk/roc_nix_inl_dev_irq.c b/drivers/common/cnxk/roc_nix_inl_dev_irq.c
index dcf77a29a5..977b5e05e2 100644
--- a/drivers/common/cnxk/roc_nix_inl_dev_irq.c
+++ b/drivers/common/cnxk/roc_nix_inl_dev_irq.c
@@ -103,7 +103,8 @@ nix_inl_cpt_cq_cb(struct roc_cpt_lf *lf)
 	}
 
 	for (i = 0; i < count; i++) {
-		cq_s = (struct cpt_cq_s *)(uintptr_t)(((cq_base.s.addr << 7)) + (head << 5));
+		cq_s = (struct cpt_cq_s *)(uintptr_t)((((uint64_t)cq_base.s.addr << 7)) +
+						      (head << 5));
 
 		if (cq_s->w0.s.uc_compcode && cq_s->w0.s.compcode) {
 			switch (cq_s->w2.s.fmt & fmt_msk) {
-- 
2.34.1

[PATCH 12/14] common/cnxk: update mode param for link speed

[Rahul Bhansali]

From: Alok Mishra <almishra@marvell.com>

Populate mode for kernels that uses args.mode for link speed
update.

Signed-off-by: Alok Mishra <almishra@marvell.com>
---
 drivers/common/cnxk/roc_nix_mac.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/common/cnxk/roc_nix_mac.c b/drivers/common/cnxk/roc_nix_mac.c
index 4f856677e0..2c8c9a6443 100644
--- a/drivers/common/cnxk/roc_nix_mac.c
+++ b/drivers/common/cnxk/roc_nix_mac.c
@@ -316,6 +316,7 @@ roc_nix_mac_link_info_set(struct roc_nix *roc_nix,
 	struct dev *dev = &nix->dev;
 	struct mbox *mbox = mbox_get(dev->mbox);
 	struct cgx_set_link_mode_req *req;
+	struct cgx_set_link_mode_rsp *rsp;
 	int rc;
 
 	req = mbox_alloc_msg_cgx_set_link_mode(mbox);
@@ -329,8 +330,14 @@ roc_nix_mac_link_info_set(struct roc_nix *roc_nix,
 	req->args.duplex = link_info->full_duplex;
 	req->args.an = link_info->autoneg;
 
+	/* Populate mode for kernels that select it from args.mode. */
+	if (link_info->advertising)
+		req->args.mode = plt_ctz64(link_info->advertising);
+
 	/* Link mode changes takes more time. */
-	rc = mbox_process_tmo(mbox, mbox->rsp_tmo * 4);
+	rc = mbox_process_msg_tmo(mbox, (void **)&rsp, mbox->rsp_tmo * 4);
+	if (!rc)
+		rc = rsp->status;
 exit:
 	mbox_put(mbox);
 	return rc;
-- 
2.34.1

[PATCH 13/14] common/cnxk: support for cn20k legacy msns mode

[Rahul Bhansali]

From: Nithin Dabilpuram <ndabilpuram@marvell.com>

Update nix_rx_action2_s for legacy msns mode support for cn20k

Signed-off-by: Rakesh Kudurumalla <rkudurumalla@marvell.com>
Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
---
 drivers/common/cnxk/roc_cpt.h                 |  2 +
 drivers/common/cnxk/roc_cpt_debug.c           | 22 ++++++++
 drivers/common/cnxk/roc_nix_debug.c           |  2 +-
 drivers/common/cnxk/roc_nix_inl.c             |  4 +-
 drivers/common/cnxk/roc_npc.c                 | 54 ++++++++++---------
 .../common/cnxk/roc_platform_base_symbols.c   |  1 +
 6 files changed, 56 insertions(+), 29 deletions(-)

diff --git a/drivers/common/cnxk/roc_cpt.h b/drivers/common/cnxk/roc_cpt.h
index 533d194bd4..1673cdb5db 100644
--- a/drivers/common/cnxk/roc_cpt.h
+++ b/drivers/common/cnxk/roc_cpt.h
@@ -260,4 +260,6 @@ int __roc_api roc_cpt_int_misc_cb_unregister(roc_cpt_int_misc_cb_t cb, void *arg
 
 bool roc_cpt_has_ie_engines(void);
 
+void __roc_api roc_cpt_cq_dump(FILE *file, const struct cpt_cq_s *cq);
+
 #endif /* _ROC_CPT_H_ */
diff --git a/drivers/common/cnxk/roc_cpt_debug.c b/drivers/common/cnxk/roc_cpt_debug.c
index 3c1c052e50..91e8cbc30d 100644
--- a/drivers/common/cnxk/roc_cpt_debug.c
+++ b/drivers/common/cnxk/roc_cpt_debug.c
@@ -191,6 +191,28 @@ roc_cpt_parse_hdr_dump(FILE *file, const union cpt_parse_hdr_u *cpth)
 		cpt_cnxk_parse_hdr_dump(file, &cpth->s);
 }
 
+void
+roc_cpt_cq_dump(FILE *file, const struct cpt_cq_s *cq)
+{
+	cpt_dump(file, "CPT_CQ \t%p:", cq);
+
+	/* W0 */
+	cpt_dump(file, "W0: compcode \t0x%x\t\tdoneint \t%u\t", cq->w0.s.compcode,
+		 cq->w0.s.doneint);
+	cpt_dump(file, "W0: uc_compcode \t0x%x\t\tuc_info \t0%" PRIu64, cq->w0.s.uc_compcode,
+		 (uint64_t)cq->w0.s.uc_info);
+
+	/* W1 */
+	cpt_dump(file, "W1: esn \t%" PRIx64 "\t\n", cq->w1.esn);
+
+	/* W2 */
+	cpt_dump(file, "W2: fmt \t0x%x\t\tuc_info2 \t%" PRIu64, cq->w2.s.fmt,
+		 (uint64_t)cq->w2.s.uc_info2);
+
+	/* W3 */
+	cpt_dump(file, "W3: comp_ptr \t0x%" PRIx64 "\t\n", cq->w3.comp_ptr);
+}
+
 static int
 cpt_af_reg_read(struct roc_cpt *roc_cpt, uint64_t reg, uint64_t *val)
 {
diff --git a/drivers/common/cnxk/roc_nix_debug.c b/drivers/common/cnxk/roc_nix_debug.c
index 9c3bc8abe3..4f4e9b0c6c 100644
--- a/drivers/common/cnxk/roc_nix_debug.c
+++ b/drivers/common/cnxk/roc_nix_debug.c
@@ -1087,7 +1087,7 @@ roc_nix_cqe_dump(FILE *file, const struct nix_cqe_hdr_s *cq)
 	nix_dump(file, "W5: vtag0_ptr \t%d\t\tvtag1_ptr \t%d\t\tflow_key_alg \t%d",
 		 rx->vtag0_ptr, rx->vtag1_ptr, rx->flow_key_alg);
 
-	for (i = 0; i < (rx->desc_sizem1 + 1) << 1; i++)
+	for (i = 0; i < ((rx->desc_sizem1 + 1) << 1) + 2; i++)
 		nix_dump(file, "sg[%u] = %p", i, (void *)sgs[i]);
 }
 
diff --git a/drivers/common/cnxk/roc_nix_inl.c b/drivers/common/cnxk/roc_nix_inl.c
index 935dd37778..4c0ddb66ed 100644
--- a/drivers/common/cnxk/roc_nix_inl.c
+++ b/drivers/common/cnxk/roc_nix_inl.c
@@ -2620,11 +2620,9 @@ roc_nix_inl_ctx_write(struct roc_nix *roc_nix, void *sa_dptr, void *sa_cptr,
 		return -EINVAL;
 
 	if (roc_nix) {
-		if (inb && roc_nix->custom_inb_sa && sa_len > ROC_NIX_INL_INB_CUSTOM_SA_SZ) {
+		if (inb && roc_nix->custom_inb_sa && sa_len > ROC_NIX_INL_INB_CUSTOM_SA_SZ)
 			plt_nix_dbg("SA length: %u is more than allocated length: %u", sa_len,
 				    ROC_NIX_INL_INB_CUSTOM_SA_SZ);
-			return -EINVAL;
-		}
 		nix = roc_nix_to_nix_priv(roc_nix);
 		outb_lf = nix->cpt_lf_base;
 
diff --git a/drivers/common/cnxk/roc_npc.c b/drivers/common/cnxk/roc_npc.c
index a8a31c7f6c..f709c71e36 100644
--- a/drivers/common/cnxk/roc_npc.c
+++ b/drivers/common/cnxk/roc_npc.c
@@ -544,49 +544,37 @@ npc_parse_spi_to_sa_action(struct roc_npc *roc_npc, const struct roc_npc_action
 	struct nix_spi_to_sa_add_rsp *rsp;
 	struct nix_inl_dev *inl_dev;
 	struct idev_cfg *idev;
+	uint64_t npc_action2 = 0;
 	union {
 		uint64_t reg;
 		union nix_rx_vtag_action_u act;
-	} vtag_act;
+	} vtag_act = {0};
 	struct mbox *mbox;
+	uint8_t alg = 0;
 	int rc;
 
 	if (roc_npc->roc_nix->custom_sa_action == 0 || roc_model_is_cn9k() == 1 ||
 	    act->conf == NULL || flow->is_validate)
 		return 0;
 
-	*has_spi_to_sa_action = true;
-	sec_action = act->conf;
-
-	vtag_act.reg = 0;
-	vtag_act.act.sa_xor = sec_action->sa_xor;
-	vtag_act.act.sa_hi = sec_action->sa_hi;
-	vtag_act.act.sa_lo = sec_action->sa_lo;
-
 	idev = idev_get_cfg();
 	if (!idev)
 		return -1;
 
 	inl_dev = idev->nix_inl_dev;
 
+	*has_spi_to_sa_action = true;
+	sec_action = act->conf;
+
 	switch (sec_action->alg) {
 	case ROC_NPC_SEC_ACTION_ALG0:
-		break;
 	case ROC_NPC_SEC_ACTION_ALG1:
-		vtag_act.act.vtag1_valid = false;
-		vtag_act.act.vtag1_lid = ROC_NPC_SEC_ACTION_ALG1;
-		break;
 	case ROC_NPC_SEC_ACTION_ALG2:
-		vtag_act.act.vtag1_valid = false;
-		vtag_act.act.vtag1_lid = ROC_NPC_SEC_ACTION_ALG2;
-		break;
 	case ROC_NPC_SEC_ACTION_ALG3:
-		vtag_act.act.vtag1_valid = false;
-		vtag_act.act.vtag1_lid = ROC_NPC_SEC_ACTION_ALG3;
+		alg = sec_action->alg;
 		break;
 	case ROC_NPC_SEC_ACTION_ALG4:
-		vtag_act.act.vtag1_valid = false;
-		vtag_act.act.vtag1_lid = 0;
+		alg = 0;
 		mbox = inl_dev->dev.mbox;
 		req = mbox_alloc_msg_nix_spi_to_sa_add(mbox);
 		if (req == NULL)
@@ -595,7 +583,7 @@ npc_parse_spi_to_sa_action(struct roc_npc *roc_npc, const struct roc_npc_action
 		req->spi_index = plt_be_to_cpu_32(flow->spi_to_sa_info.spi);
 		req->match_id = flow->match_id;
 		req->valid = true;
-		if (roc_model_is_cn20k()) {
+		if (roc_feature_nix_has_inl_profile()) {
 			if (sec_action->use_custom_profile)
 				req->inline_profile_id = sec_action->profile_id;
 			else
@@ -614,7 +602,21 @@ npc_parse_spi_to_sa_action(struct roc_npc *roc_npc, const struct roc_npc_action
 		return -1;
 	}
 
+	if (!roc_feature_nix_has_inl_profile()) {
+		vtag_act.act.sa_xor = sec_action->sa_xor;
+		vtag_act.act.sa_hi = sec_action->sa_hi;
+		vtag_act.act.sa_lo = sec_action->sa_lo;
+		vtag_act.act.vtag1_valid = false;
+		vtag_act.act.vtag1_lid = alg;
+
+	} else {
+		npc_action2 = ((uint64_t)sec_action->sa_xor << 7);
+		npc_action2 |= ((uint64_t)sec_action->sa_hi << 48);
+		npc_action2 |= ((uint64_t)sec_action->sa_lo << 32);
+		npc_action2 |= ((uint64_t)alg << 17);
+	}
 	flow->vtag_action = vtag_act.reg;
+	flow->npc_action2 |= npc_action2;
 
 	return 0;
 }
@@ -679,6 +681,7 @@ npc_parse_actions(struct roc_npc *roc_npc, const struct roc_npc_attr *attr,
 	/* Initialize actions */
 	flow->ctr_id = NPC_COUNTER_NONE;
 	flow->mtr_id = ROC_NIX_MTR_ID_INVALID;
+	flow->npc_action2 = 0;
 	pf_func = npc->pf_func;
 	if (flow->has_rep)
 		pf_func = flow->rep_pf_func;
@@ -988,19 +991,20 @@ npc_parse_actions(struct roc_npc *roc_npc, const struct roc_npc_attr *attr,
 	} else if (req_act & ROC_NPC_ACTION_TYPE_RSS) {
 		flow->npc_action = NIX_RX_ACTIONOP_UCAST;
 	} else if (req_act & ROC_NPC_ACTION_TYPE_SEC) {
-		if (roc_model_is_cn20k()) {
+		if (roc_feature_nix_has_inl_profile()) {
 			const struct roc_npc_sec_action *sa_action = NULL;
 			uint16_t profile_id;
 
-			flow->npc_action = NIX_RX_ACTIONOP_UCAST_CPT;
-			flow->npc_action |= (uint64_t)rq << 20;
 			profile_id = roc_nix_inl_inb_ipsec_profile_id_get(roc_nix, true);
 			if (sec_action && sec_action->conf) {
 				sa_action = (const struct roc_npc_sec_action *)sec_action->conf;
 				if (sa_action->use_custom_profile)
 					profile_id = sa_action->profile_id;
 			}
-			flow->npc_action2 = (is_non_inp ? (1ULL << 15) : 0) | (profile_id << 8);
+			flow->npc_action2 |= (is_non_inp ? (1ULL << 15) : 0) | (profile_id << 8);
+
+			flow->npc_action = NIX_RX_ACTIONOP_UCAST_CPT;
+			flow->npc_action |= (uint64_t)rq << 20;
 		} else {
 			flow->npc_action = NIX_RX_ACTIONOP_UCAST_IPSEC;
 			flow->npc_action |= (uint64_t)rq << 20;
diff --git a/drivers/common/cnxk/roc_platform_base_symbols.c b/drivers/common/cnxk/roc_platform_base_symbols.c
index de8de910f6..440ff13118 100644
--- a/drivers/common/cnxk/roc_platform_base_symbols.c
+++ b/drivers/common/cnxk/roc_platform_base_symbols.c
@@ -63,6 +63,7 @@ RTE_EXPORT_INTERNAL_SYMBOL(roc_cpt_int_misc_cb_unregister)
 RTE_EXPORT_INTERNAL_SYMBOL(roc_cpt_parse_hdr_dump)
 RTE_EXPORT_INTERNAL_SYMBOL(roc_cpt_afs_print)
 RTE_EXPORT_INTERNAL_SYMBOL(roc_cpt_lfs_print)
+RTE_EXPORT_INTERNAL_SYMBOL(roc_cpt_cq_dump)
 RTE_EXPORT_INTERNAL_SYMBOL(roc_dpi_wait_queue_idle)
 RTE_EXPORT_INTERNAL_SYMBOL(roc_dpi_enable)
 RTE_EXPORT_INTERNAL_SYMBOL(roc_dpi_disable)
-- 
2.34.1

[PATCH 14/14] net/cnxk: fix custom inbound SA condition check

[Rahul Bhansali]

From: Rakesh Kudurumalla <rkudurumalla@marvell.com>

Custom inbound SA condition should be check when inbound SA create
and destroy.

Fixes: 7eaa499dd0c2 ("net/cnxk: support CN20K inline IPsec session")
Cc: stable@dpdk.org

Signed-off-by: Rakesh Kudurumalla <rkudurumalla@marvell.com>
---
 drivers/net/cnxk/cn20k_ethdev_sec.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/cnxk/cn20k_ethdev_sec.c b/drivers/net/cnxk/cn20k_ethdev_sec.c
index b365426065..f648340445 100644
--- a/drivers/net/cnxk/cn20k_ethdev_sec.c
+++ b/drivers/net/cnxk/cn20k_ethdev_sec.c
@@ -805,9 +805,6 @@ cn20k_eth_sec_session_create(void *device, struct rte_security_session_conf *con
 	if (conf->protocol != RTE_SECURITY_PROTOCOL_IPSEC)
 		return -ENOTSUP;
 
-	if (nix->custom_inb_sa)
-		return -ENOTSUP;
-
 	if (rte_security_dynfield_register() < 0)
 		return -ENOTSUP;
 
@@ -832,6 +829,9 @@ cn20k_eth_sec_session_create(void *device, struct rte_security_session_conf *con
 	ipsec = &conf->ipsec;
 	crypto = conf->crypto_xform;
 
+	if (nix->custom_inb_sa && ipsec->direction == RTE_SECURITY_IPSEC_SA_DIR_INGRESS)
+		return -ENOTSUP;
+
 	rc = cnxk_ipsec_xform_verify(ipsec, crypto);
 	if (rc) {
 		plt_err("Crypto xform verify failed, rc=%d", rc);
@@ -1083,7 +1083,7 @@ cn20k_eth_sec_session_destroy(void *device, struct rte_security_session *sess)
 	eth_sec = cnxk_eth_sec_sess_get_by_sess(dev, sess);
 	if (!eth_sec)
 		return -ENOENT;
-	if (dev->nix.custom_inb_sa)
+	if (dev->nix.custom_inb_sa && eth_sec->inb)
 		return -ENOTSUP;
 
 	lock = eth_sec->inb ? &dev->inb.lock : &dev->outb.lock;
-- 
2.34.1

Re: [PATCH 01/14] net/cnxk: fix packet length handling

[Stephen Hemminger]

On Thu, 17 Sep 2026 12:40:03 +0530
Rahul Bhansali <rbhansali@marvell.com> wrote:

> Fix packet length handling for reassembly failure cases.
> Also updated few macros as per cn20k platform.
> 
> Fixes: 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Rahul Bhansali <rbhansali@marvell.com>
> ---

More careful review by AI saw:

Patch 1/14 net/cnxk: fix packet length handling
-----------------------------------------------
Warning: the commit log does not mention the userdata change. The
patch drops the "flags & NIX_RX_REAS_F && inb_priv->userdata" guard
in nix_sec_meta_to_mbuf_sc() and nix_sec_meta_to_mbuf(), so
rte_security_dynfield is now written unconditionally. Describe it or
split it out.

Info: the OT->OW macro changes are no-op renames
(ROC_NIX_INL_OT/OW_IPSEC_INB_SA_SZ_LOG2 are both 10). Keep them out of
a stable fix.

Re: [PATCH 02/14] common/cnxk: disable CPT drop error in CQ

[Stephen Hemminger]

On Thu, 17 Sep 2026 12:40:04 +0530
Rahul Bhansali <rbhansali@marvell.com> wrote:

> Disable CPT drop error in CQ context for cn20k platform.
> 
> Signed-off-by: Rahul Bhansali <rbhansali@marvell.com>
> ---

More detailed AI review.

Patch 2/14 common/cnxk: disable CPT drop error in CQ
----------------------------------------------------
Warning: the line above still does
  cq_ctx->cq_err_int_ena |= BIT(NIX_CQERRINT_CPT_DROP);
while cpt_drop_err_en is now 0. Either drop the interrupt enable too,
or explain why it stays. The commit log gives no reason for the
change and has no Fixes: tag if this corrects prior behaviour.

Re: [PATCH 03/14] common/cnxk: fix NIX QINT count reset

[Stephen Hemminger]

On Thu, 17 Sep 2026 12:40:05 +0530
Rahul Bhansali <rbhansali@marvell.com> wrote:

> Fix QINT count reset on NIX queue IRQs register and
> unregister.
> Queue interrupt will be cleared by individual queue
> interrupt operation register update.
> 
> Fixes: f6d567b03d28 ("common/cnxk: support NIX IRQ")
> Fixes: 3c100e0e6b9c ("common/cnxk: support per-port RQ in inline device")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Rahul Bhansali <rbhansali@marvell.com>
> ---

More detailed AI review:

Patch 3/14 common/cnxk: fix NIX QINT count reset
------------------------------------------------
Warning: the inline dev path now clears QINTX_INT with ~0ull (W1C),
but roc_nix_register_queue_irqs() still does
  plt_write64(0, nix->base + NIX_LF_QINTX_INT(q));
before ENA_W1S, and roc_nix_unregister_queue_irqs() does the same.
Writing 0 to a W1C register clears nothing, so a stale QINT is still
pending when the interrupt is enabled. Use ~0ull in both places.

Info: the roc_nix path uses "int64_t val; plt_write64(-val, ...)"
while the inl path casts explicitly. Pick one form.

Re: [PATCH 06/14] common/cnxk: fix null deref and irq ack in CPT CQ handler

[Stephen Hemminger]

On Thu, 17 Sep 2026 12:40:08 +0530
Rahul Bhansali <rbhansali@marvell.com> wrote:

> From: Aarnav JP <ajp@marvell.com>
> 
> The CPT CQ interrupt handler (nix_inl_cpt_cq_cb) unconditionally
> dereferences lf->dev->roc_nix to obtain roc_nix, nix, and port_id.
> For inbound, the CPT LF belongs to the inline device which is not
> an ethdev, so roc_nix is NULL and the dereference crashes.
> 
> Additionally, error paths returned without writing CPT_LF_DONE_ACK,
> leaving CQ entries unacknowledged causing the completion queue to
> fill up.
> 
> Fix by deferring roc_nix/nix/port_id derivation into the outbound
> branch where roc_nix is valid, setting port_id to UINT32_MAX for
> inbound, and routing all error paths through a common cq_ack label
> that drains entries and writes CPT_LF_DONE_ACK.
> 
> Fixes: 3fdf3e53f3c4 ("common/cnxk: enable CPT CQ for inline IPsec inbound")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Aarnav JP <ajp@marvell.com>
> ---

More detailed AI review:

Patch 6/14 common/cnxk: fix null deref and irq ack in CPT CQ handler
-------------------------------------------------------------------
Info: at cq_ack,
  head = (lf->cq_head + count) % lf->cq_size;
overwrites the head the loop already computed on the normal path.
It is only needed for the early gotos.

Re: [PATCH 07/14] common/cnxk: derive mbuf from CPT CQ in inline IRQ path

[Stephen Hemminger]

On Thu, 17 Sep 2026 12:40:09 +0530
Rahul Bhansali <rbhansali@marvell.com> wrote:

> From: Rakesh Kudurumalla <rkudurumalla@marvell.com>
> 
> Populate mbuf from WQE_PTR_CPTR and CPTR_WQE_PTR completions, handle
> WQE_PTR_ANTI_REPLAY and CPTR_ANTI_REPLAY, and pass the mbuf pointer
> into the inline device work callback instead of a fixed non-NULL
> sentinel.
> 
> Signed-off-by: Rakesh Kudurumalla <rkudurumalla@marvell.com>
> Signed-off-by: Rahul Bhansali <rbhansali@marvell.com>
> ---

Patch 7/14 common/cnxk: derive mbuf from CPT CQ in inline IRQ path
------------------------------------------------------------------
Error: NULL dereference at this commit.
- WQE_PTR_ANTI_REPLAY now calls work_cb() with sa = NULL and
  cq_type NIX_INL_INB_CPT_CQ.
- At this commit, cn20k_eth_sec_sso_work_cb() still does
    inb_priv = roc_nix_inl_ow_ipsec_inb_sa_sw_rsvd(args);
    if (inb_priv->eth_sec && ...
  which is PLT_PTR_ADD(NULL, HW_SZ) followed by a dereference.
- The guard only arrives in patch 8.
Squash 7 and 8, or move the guard first.

Re: [PATCH 08/14] net/cnxk: resolve mbuf from CPT CQ format in SSO work cb

[Stephen Hemminger]

On Thu, 17 Sep 2026 12:40:10 +0530
Rahul Bhansali <rbhansali@marvell.com> wrote:

> From: Rakesh Kudurumalla <rkudurumalla@marvell.com>
> 
> When handling NIX inline CPT CQ events (type < NIX_INL_SSO), derive the
> mbuf from the completion queue word layout using fmt bits: WQE_PTR_CPTR
> uses w1.esn; CPTR_WQE_PTR uses w3.comp_ptr shifted left by 3 for the byte
> address. Pass the mbuf into cn20k_eth_sec_post_event instead of NULL.
> Drop RTE_SET_USED(args) since args is consumed by post_event.
> 
> Signed-off-by: Rakesh Kudurumalla <rkudurumalla@marvell.com>
> Signed-off-by: Rahul Bhansali <rbhansali@marvell.com>
> ---


Patch 8/14 net/cnxk: resolve mbuf from CPT CQ format in SSO work cb
------------------------------------------------------------------
Error: wrong mbuf address for inbound events.
  mbuf = (struct rte_mbuf *)(uintptr_t)gw[1];
- gw[1] is the raw WQE pointer; patch 7 only masks the low 3 bits.
- Outbound is correct: the Tx path stores (uintptr_t)m | 1 in CPT
  word 3.
- For inbound, the same function's RTE_EVENT_TYPE_ETHDEV case uses
    gw[1] - sizeof(struct rte_mbuf)
- So cn20k_eth_sec_post_event() reads *rte_security_dynfield(mbuf)
  from the wrong address.
Subtract sizeof(struct rte_mbuf) for NIX_INL_INB_CPT_CQ.

Warning: WQE_PTR_ANTI_REPLAY events are dropped.
- eth_dev stays NULL.
- post_event() builds desc and skips rte_eth_dev_callback_process()
  because of "if (eth_dev)".
- It returns false, so nothing is freed either.
Resolve the port for this format, or do not dispatch it.

Warning: the commit log does not match the code. It says WQE_PTR_CPTR
takes the mbuf from w1.esn and CPTR_WQE_PTR from w3.comp_ptr "shifted
left by 3". The code (patch 7) is the other way round, and masks
instead of shifting:
  WQE_PTR_CPTR:  wqe = w3.comp_ptr & ~7
  CPTR_WQE_PTR:  wqe = w1.esn & ~7
That derivation lives in patch 7, not here.

Info: post_event() log messages still say "Outbound error" for
inbound events.

Re: [PATCH 09/14] common/cnxk: update bpid config for cn20k

[Stephen Hemminger]

On Thu, 17 Sep 2026 12:40:11 +0530
Rahul Bhansali <rbhansali@marvell.com> wrote:

> For cn20k, Rx chan bpid config range increased to 10 bit from 8
> bits. These extra bits are reserved in cn10k platform so separate
> platform specific bpid range mask is not required.
> 
> Signed-off-by: Rahul Bhansali <rbhansali@marvell.com>
> ---
Patch 9/14 common/cnxk: update bpid config for cn20k
----------------------------------------------------
Warning: the commit log says the range grows from 8 to 10 bits. The
masks go from 0x1FF (9 bits) to 0x7FF (11 bits), i.e. bpid (9) plus
bpid_ext (2). Fix the log.

Re: [PATCH 10/14] net/cnxk: add MSNS inb SA and CN20K CPT result struct

[Stephen Hemminger]

On Thu, 17 Sep 2026 12:40:12 +0530
Rahul Bhansali <rbhansali@marvell.com> wrote:

> From: Rakesh Kudurumalla <rkudurumalla@marvell.com>
> 
> Define the 1KB inbound MSNS SA layout with four packed anti-replay
> sub-spaces, the MSNS context update region, and compile-time size
> checks. Extend the HW SA union and add the CN20K CPT result format
> for inline IPsec custom profile support.
> 
> Signed-off-by: Rakesh Kudurumalla <rkudurumalla@marvell.com>
> ---
Patch 10/14 net/cnxk: add MSNS inb SA and CN20K CPT result struct
----------------------------------------------------------------
Warning: undocumented API change in an installed header.
- ltype_mask, ltype_match, lid, noffset and offset are removed from
  struct rte_pmd_cnxk_rx_gen_inl_cfg in rte_pmd_cnxk.h.
- That struct is embedded in rte_pmd_cnxk_profile_cfg_params, used by
  rte_pmd_cnxk_nix_inl_custom_profile_setup() (experimental, 25.11).
- The removal is source-breaking and is not in the commit log.
Split it out and add a release note.

Warning: rte_pmd_cnxk_inl_inb_prof_sa_base_get() now returns the
default IPsec SA base when profile_id == UINT16_MAX. Neither the
Doxygen ("Custom profile ID to get the SA base for") nor the commit
log mention this.

Warning: a new typedef is added already marked @deprecated:
  typedef struct rte_pmd_cnxk_ipsec_inb_msns_sa
          rte_pmd_cnxk_ipsec_inb_sa_msns;
Drop it.

Info: RTE_PMD_CNXK_IPSEC_INB_MSNS_CTX_PUSH_SZ(x) is an identity macro,
and RTE_PMD_CNXK_IPSEC_INB_SA_MSNS_SZ_ALIGN duplicates
RTE_PMD_CNXK_IPSEC_INB_SA_MSNS_SZ.

Re: [PATCH 12/14] common/cnxk: update mode param for link speed

[Stephen Hemminger]

On Thu, 17 Sep 2026 12:40:14 +0530
Rahul Bhansali <rbhansali@marvell.com> wrote:

> From: Alok Mishra <almishra@marvell.com>
> 
> Populate mode for kernels that uses args.mode for link speed
> update.
> 
> Signed-off-by: Alok Mishra <almishra@marvell.com>
> ---


Patch 12/14 common/cnxk: update mode param for link speed
---------------------------------------------------------
Warning: args.mode keeps only one advertised mode.
  req->args.mode = plt_ctz64(link_info->advertising);
- With autoneg, nix_link_advertising_get() ORs in one bit per
  requested speed.
- mode therefore carries only the lowest one.
- args.multimode and args.mode_baseidx are left unset.

Warning: the commit log does not mention the new rsp->status
propagation from mbox_process_msg_tmo().

Re: [PATCH 13/14] common/cnxk: support for cn20k legacy msns mode

[Stephen Hemminger]

On Thu, 17 Sep 2026 12:40:15 +0530
Rahul Bhansali <rbhansali@marvell.com> wrote:

> From: Nithin Dabilpuram <ndabilpuram@marvell.com>
> 
> Update nix_rx_action2_s for legacy msns mode support for cn20k
> 
> Signed-off-by: Rakesh Kudurumalla <rkudurumalla@marvell.com>
> Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
> ---

Patch 13/14 common/cnxk: support for cn20k legacy msns mode
-----------------------------------------------------------
Error: roc_nix_inl_ctx_write() no longer rejects oversized inbound SAs.
- The check "sa_len > ROC_NIX_INL_INB_CUSTOM_SA_SZ" now only logs at
  debug level.
- It then goes on to memcpy(sa_cptr, sa_dptr, sa_len) or
  roc_cpt_ctx_write().
- With custom_inb_sa, nix_inl_inb_sa_tbl_setup() sizes each slot as
  ROC_NIX_INL_INB_CUSTOM_SA_SZ (512).
- sa_len comes from the application through
  rte_pmd_cnxk_hw_sa_write().
- A 1KB MSNS SA written there overwrites the next slot.
Check against the slot size of the owning table (inb_sa_sz[profile])
instead of dropping the check.

Warning: roc_nix_cqe_dump() now reads past the descriptor.
  for (i = 0; i < ((rx->desc_sizem1 + 1) << 1) + 2; i++)
The datapath (nix_cqe_xtract_mseg) ends the SG list at
  (rx + 1) + ((rx->desc_sizem1 + 1) << 1)
so the dump reads two words beyond it. No rationale is given.

Warning: the log says "Update nix_rx_action2_s", but hw/nix.h
struct nix_rx_action2_s is unchanged.
- npc_action2 is built from raw shifts (<< 7, << 17, << 32, << 48).
- Those land in fields the struct still marks reserved.
Update the struct and use it.

Warning: unrelated changes are bundled into one patch.
- roc_cpt_cq_dump(), which has no caller in the series.
- The cqe dump loop bound.
- Removal of the ctx_write length check.
- roc_model_is_cn20k() -> roc_feature_nix_has_inl_profile().
Split them, each with its own rationale.

Info: roc_cpt_cq_dump() prints "uc_info \t0%" PRIu64, which is decimal
with a literal leading 0 and reads as octal. Use 0x%" PRIx64.

Re: [PATCH 01/14] net/cnxk: fix packet length handling

[Stephen Hemminger]

On Thu, 17 Sep 2026 12:40:03 +0530
Rahul Bhansali <rbhansali@marvell.com> wrote:

> Fix packet length handling for reassembly failure cases.
> Also updated few macros as per cn20k platform.
> 
> Fixes: 5856f23129bb ("net/cnxk: support CN20K inline IPsec Rx")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Rahul Bhansali <rbhansali@marvell.com>
> ---

NAK
Lots of problem reported from AI review of this series.