Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/128314/?format=api
{ "id": 128314, "url": "http://patchwork.dpdk.org/api/patches/128314/?format=api", "web_url": "http://patchwork.dpdk.org/project/dpdk/patch/20230607130245.8048-26-ivan.malov@arknetworks.am/", "project": { "id": 1, "url": "http://patchwork.dpdk.org/api/projects/1/?format=api", "name": "DPDK", "link_name": "dpdk", "list_id": "dev.dpdk.org", "list_email": "dev@dpdk.org", "web_url": "http://core.dpdk.org", "scm_url": "git://dpdk.org/dpdk", "webscm_url": "http://git.dpdk.org/dpdk", "list_archive_url": "https://inbox.dpdk.org/dev", "list_archive_url_format": "https://inbox.dpdk.org/dev/{}", "commit_url_format": "" }, "msgid": "<20230607130245.8048-26-ivan.malov@arknetworks.am>", "list_archive_url": "https://inbox.dpdk.org/dev/20230607130245.8048-26-ivan.malov@arknetworks.am", "date": "2023-06-07T13:02:36", "name": "[v4,25/34] net/sfc: make use of conntrack assistance for transfer flows", "commit_ref": null, "pull_url": null, "state": "accepted", "archived": true, "hash": "f0be5e21f26ff07a32df2d9a10e80f51e745a744", "submitter": { "id": 2962, "url": "http://patchwork.dpdk.org/api/people/2962/?format=api", "name": "Ivan Malov", "email": "ivan.malov@arknetworks.am" }, "delegate": { "id": 319, "url": "http://patchwork.dpdk.org/api/users/319/?format=api", "username": "fyigit", "first_name": "Ferruh", "last_name": "Yigit", "email": "ferruh.yigit@amd.com" }, "mbox": "http://patchwork.dpdk.org/project/dpdk/patch/20230607130245.8048-26-ivan.malov@arknetworks.am/mbox/", "series": [ { "id": 28390, "url": "http://patchwork.dpdk.org/api/series/28390/?format=api", "web_url": "http://patchwork.dpdk.org/project/dpdk/list/?series=28390", "date": "2023-06-07T13:02:11", "name": "net/sfc: support HW conntrack assistance", "version": 4, "mbox": "http://patchwork.dpdk.org/series/28390/mbox/" } ], "comments": "http://patchwork.dpdk.org/api/patches/128314/comments/", "check": "success", "checks": "http://patchwork.dpdk.org/api/patches/128314/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<dev-bounces@dpdk.org>", "X-Original-To": "patchwork@inbox.dpdk.org", "Delivered-To": "patchwork@inbox.dpdk.org", "Received": [ "from mails.dpdk.org (mails.dpdk.org [217.70.189.124])\n\tby inbox.dpdk.org (Postfix) with ESMTP id 8A92842C4D;\n\tWed, 7 Jun 2023 15:06:41 +0200 (CEST)", "from mails.dpdk.org (localhost [127.0.0.1])\n\tby mails.dpdk.org (Postfix) with ESMTP id 3023242FEC;\n\tWed, 7 Jun 2023 15:03:21 +0200 (CEST)", "from agw.arknetworks.am (agw.arknetworks.am [79.141.165.80])\n by mails.dpdk.org (Postfix) with ESMTP id 16C0742D63\n for <dev@dpdk.org>; Wed, 7 Jun 2023 15:03:01 +0200 (CEST)", "from localhost.localdomain (unknown [78.109.69.83])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by agw.arknetworks.am (Postfix) with ESMTPSA id 9686CE12C4;\n Wed, 7 Jun 2023 17:03:00 +0400 (+04)" ], "From": "Ivan Malov <ivan.malov@arknetworks.am>", "To": "dev@dpdk.org", "Cc": "Andrew Rybchenko <andrew.rybchenko@oktetlabs.ru>,\n Ferruh Yigit <ferruh.yigit@amd.com>, Andy Moreton <amoreton@xilinx.com>", "Subject": "[PATCH v4 25/34] net/sfc: make use of conntrack assistance for\n transfer flows", "Date": "Wed, 7 Jun 2023 17:02:36 +0400", "Message-Id": "<20230607130245.8048-26-ivan.malov@arknetworks.am>", "X-Mailer": "git-send-email 2.30.2", "In-Reply-To": "<20230607130245.8048-1-ivan.malov@arknetworks.am>", "References": "<20230601195538.8265-1-ivan.malov@arknetworks.am>\n <20230607130245.8048-1-ivan.malov@arknetworks.am>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "X-BeenThere": "dev@dpdk.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "DPDK patches and discussions <dev.dpdk.org>", "List-Unsubscribe": "<https://mails.dpdk.org/options/dev>,\n <mailto:dev-request@dpdk.org?subject=unsubscribe>", "List-Archive": "<http://mails.dpdk.org/archives/dev/>", "List-Post": "<mailto:dev@dpdk.org>", "List-Help": "<mailto:dev-request@dpdk.org?subject=help>", "List-Subscribe": "<https://mails.dpdk.org/listinfo/dev>,\n <mailto:dev-request@dpdk.org?subject=subscribe>", "Errors-To": "dev-bounces@dpdk.org" }, "content": "On EF100 hardware, match-action engine (MAE) can be equipped\nwith an assistance table for connection tracking (CT). In it,\nan entry key is a set of exact match fields: an EtherType, a\npair of IP addresses, a L4 protocol ID and a pair of L4 port\nnumbers. An entry response can provide matching packets with\na mark value and additional data to be plumbed to NAT action.\nIn addition, an update to mark-and-sweep counter can be done.\n\nThis table was designed with larger capacity in mind,\nso moving the above match criteria out of an action\nrule (AR) specification to a CT entry increases the\nlikelihood of reusing AR entries and improves the\ntotal flow engine capacity. Make use of that.\n\nNAT and CT counters will be supported later.\n\nSigned-off-by: Ivan Malov <ivan.malov@arknetworks.am>\nReviewed-by: Andy Moreton <amoreton@xilinx.com>\n---\n drivers/net/sfc/sfc_flow.h | 4 +\n drivers/net/sfc/sfc_mae.c | 314 +++++++++++++++++++++++++++++++++++--\n drivers/net/sfc/sfc_mae.h | 1 +\n 3 files changed, 310 insertions(+), 9 deletions(-)", "diff": "diff --git a/drivers/net/sfc/sfc_flow.h b/drivers/net/sfc/sfc_flow.h\nindex 10c73d012f..8f706fc589 100644\n--- a/drivers/net/sfc/sfc_flow.h\n+++ b/drivers/net/sfc/sfc_flow.h\n@@ -18,6 +18,7 @@\n #include \"efx.h\"\n \n #include \"sfc_flow_rss.h\"\n+#include \"sfc_mae_ct.h\"\n \n #ifdef __cplusplus\n extern \"C\" {\n@@ -82,6 +83,9 @@ struct sfc_flow_spec_mae {\n \tstruct sfc_mae_outer_rule\t*outer_rule;\n \t/* Action rule registry entry */\n \tstruct sfc_mae_action_rule\t*action_rule;\n+\t/* Conntrack (CT) assistance table entry key and response */\n+\tsfc_mae_conntrack_response_t\tct_resp;\n+\tsfc_mae_conntrack_key_t\t\tct_key;\n };\n \n /* Flow specification */\ndiff --git a/drivers/net/sfc/sfc_mae.c b/drivers/net/sfc/sfc_mae.c\nindex addcad2843..d3b4099213 100644\n--- a/drivers/net/sfc/sfc_mae.c\n+++ b/drivers/net/sfc/sfc_mae.c\n@@ -18,6 +18,7 @@\n #include \"sfc.h\"\n #include \"sfc_flow_tunnel.h\"\n #include \"sfc_mae_counter.h\"\n+#include \"sfc_mae_ct.h\"\n #include \"sfc_log.h\"\n #include \"sfc_switch.h\"\n #include \"sfc_service.h\"\n@@ -1177,18 +1178,23 @@ struct sfc_mae_action_rule_ctx {\n \tstruct sfc_mae_outer_rule\t*outer_rule;\n \tstruct sfc_mae_action_set\t*action_set;\n \tefx_mae_match_spec_t\t\t*match_spec;\n+\tuint32_t\t\t\tct_mark;\n };\n \n static int\n sfc_mae_action_rule_attach(struct sfc_adapter *sa,\n-\t\t\t const struct sfc_mae_action_rule_ctx *ctx,\n+\t\t\t struct sfc_mae_action_rule_ctx *ctx,\n \t\t\t struct sfc_mae_action_rule **rulep,\n-\t\t\t __rte_unused struct rte_flow_error *error)\n+\t\t\t struct rte_flow_error *error)\n {\n+\tuint32_t new_ct_mark = ctx->ct_mark;\n \tstruct sfc_mae_action_rule *rule;\n+\tint rc;\n \n \tSFC_ASSERT(sfc_adapter_is_locked(sa));\n \n+\tSFC_ASSERT(ctx->ct_mark <= 1);\n+\n \t/*\n \t * It is assumed that the caller of this helper has already properly\n \t * tailored ctx->match_spec to match on OR_ID / 0xffffffff (when\n@@ -1196,10 +1202,24 @@ sfc_mae_action_rule_attach(struct sfc_adapter *sa,\n \t * on 0xffffffff / 0xffffffff, so that specs compare correctly.\n \t */\n \tTAILQ_FOREACH(rule, &sa->mae.action_rules, entries) {\n+\t\tif (rule->ct_mark == new_ct_mark)\n+\t\t\t++new_ct_mark;\n+\n \t\tif (rule->outer_rule != ctx->outer_rule ||\n-\t\t rule->action_set != ctx->action_set)\n+\t\t rule->action_set != ctx->action_set ||\n+\t\t !!rule->ct_mark != !!ctx->ct_mark)\n \t\t\tcontinue;\n \n+\t\tif (ctx->ct_mark != 0) {\n+\t\t\trc = efx_mae_match_spec_ct_mark_set(ctx->match_spec,\n+\t\t\t\t\t\t\t rule->ct_mark);\n+\t\t\tif (rc != 0) {\n+\t\t\t\treturn rte_flow_error_set(error, EFAULT,\n+\t\t\t\t\tRTE_FLOW_ERROR_TYPE_UNSPECIFIED,\n+\t\t\t\t\tNULL, \"AR: failed to set CT mark for comparison\");\n+\t\t\t}\n+\t\t}\n+\n \t\tif (efx_mae_match_specs_equal(rule->match_spec,\n \t\t\t\t\t ctx->match_spec)) {\n \t\t\tsfc_dbg(sa, \"attaching to action_rule=%p\", rule);\n@@ -1209,6 +1229,24 @@ sfc_mae_action_rule_attach(struct sfc_adapter *sa,\n \t\t}\n \t}\n \n+\tif (ctx->ct_mark != 0) {\n+\t\tif (new_ct_mark == UINT32_MAX) {\n+\t\t\treturn rte_flow_error_set(error, ERANGE,\n+\t\t\t\t\tRTE_FLOW_ERROR_TYPE_UNSPECIFIED,\n+\t\t\t\t\tNULL, \"AR: failed to allocate CT mark\");\n+\t\t}\n+\n+\t\trc = efx_mae_match_spec_ct_mark_set(ctx->match_spec,\n+\t\t\t\t\t\t new_ct_mark);\n+\t\tif (rc != 0) {\n+\t\t\treturn rte_flow_error_set(error, EFAULT,\n+\t\t\t\t\tRTE_FLOW_ERROR_TYPE_UNSPECIFIED,\n+\t\t\t\t\tNULL, \"AR: failed to set CT mark\");\n+\t\t}\n+\n+\t\tctx->ct_mark = new_ct_mark;\n+\t}\n+\n \t/*\n \t * No need to set RTE error, as this\n \t * code should be handled gracefully.\n@@ -1231,6 +1269,17 @@ sfc_mae_action_rule_add(struct sfc_adapter *sa,\n \t\treturn ENOMEM;\n \n \trule->refcnt = 1;\n+\n+\t/*\n+\t * It is assumed that the caller invoked sfc_mae_action_rule_attach()\n+\t * and got (-ENOENT) before getting here. That ensures a unique CT\n+\t * mark value or, if no CT is involved at all, simply zero.\n+\t *\n+\t * It is also assumed that match on the mark (if non-zero)\n+\t * is already set in the action rule match specification.\n+\t */\n+\trule->ct_mark = ctx->ct_mark;\n+\n \trule->outer_rule = ctx->outer_rule;\n \trule->action_set = ctx->action_set;\n \trule->match_spec = ctx->match_spec;\n@@ -1802,6 +1851,8 @@ struct sfc_mae_field_locator {\n \tsize_t\t\t\t\tsize;\n \t/* Field offset in the corresponding rte_flow_item_ struct */\n \tsize_t\t\t\t\tofst;\n+\n+\tuint8_t\t\t\t\tct_key_field;\n };\n \n static void\n@@ -2654,6 +2705,216 @@ static const struct sfc_flow_item sfc_flow_items[] = {\n \t},\n };\n \n+#define SFC_MAE_CT_KEY_ET 0x01 /* EtherType */\n+#define SFC_MAE_CT_KEY_DA 0x02 /* IPv4/IPv6 destination address */\n+#define SFC_MAE_CT_KEY_SA 0x04 /* IPv4/IPv6 source address */\n+#define SFC_MAE_CT_KEY_L4 0x08 /* IPv4/IPv6 L4 protocol ID */\n+#define SFC_MAE_CT_KEY_DP 0x10 /* L4 destination port */\n+#define SFC_MAE_CT_KEY_SP 0x20 /* L4 source port */\n+\n+#define SFC_MAE_CT_KEY_FIELD_SIZE_MAX\tsizeof(sfc_mae_conntrack_key_t)\n+\n+static const struct sfc_mae_field_locator flocs_ct[] = {\n+\t{\n+\t\tEFX_MAE_FIELD_ETHER_TYPE_BE,\n+\t\tRTE_SIZEOF_FIELD(sfc_mae_conntrack_key_t, ether_type_le),\n+\t\toffsetof(sfc_mae_conntrack_key_t, ether_type_le),\n+\t\tSFC_MAE_CT_KEY_ET,\n+\t},\n+\t{\n+\t\tEFX_MAE_FIELD_DST_IP4_BE,\n+\t\tRTE_SIZEOF_FIELD(struct rte_flow_item_ipv4, hdr.dst_addr),\n+\t\toffsetof(sfc_mae_conntrack_key_t, dst_addr_le) +\n+\t\tRTE_SIZEOF_FIELD(struct rte_flow_item_ipv6, hdr.dst_addr) -\n+\t\tRTE_SIZEOF_FIELD(struct rte_flow_item_ipv4, hdr.dst_addr),\n+\t\tSFC_MAE_CT_KEY_DA,\n+\t},\n+\t{\n+\t\tEFX_MAE_FIELD_SRC_IP4_BE,\n+\t\tRTE_SIZEOF_FIELD(struct rte_flow_item_ipv4, hdr.src_addr),\n+\t\toffsetof(sfc_mae_conntrack_key_t, src_addr_le) +\n+\t\tRTE_SIZEOF_FIELD(struct rte_flow_item_ipv6, hdr.src_addr) -\n+\t\tRTE_SIZEOF_FIELD(struct rte_flow_item_ipv4, hdr.src_addr),\n+\t\tSFC_MAE_CT_KEY_SA,\n+\t},\n+\t{\n+\t\tEFX_MAE_FIELD_DST_IP6_BE,\n+\t\tRTE_SIZEOF_FIELD(struct rte_flow_item_ipv6, hdr.dst_addr),\n+\t\toffsetof(sfc_mae_conntrack_key_t, dst_addr_le),\n+\t\tSFC_MAE_CT_KEY_DA,\n+\t},\n+\t{\n+\t\tEFX_MAE_FIELD_SRC_IP6_BE,\n+\t\tRTE_SIZEOF_FIELD(struct rte_flow_item_ipv6, hdr.src_addr),\n+\t\toffsetof(sfc_mae_conntrack_key_t, src_addr_le),\n+\t\tSFC_MAE_CT_KEY_SA,\n+\t},\n+\t{\n+\t\tEFX_MAE_FIELD_IP_PROTO,\n+\t\tRTE_SIZEOF_FIELD(sfc_mae_conntrack_key_t, ip_proto),\n+\t\toffsetof(sfc_mae_conntrack_key_t, ip_proto),\n+\t\tSFC_MAE_CT_KEY_L4,\n+\t},\n+\t{\n+\t\tEFX_MAE_FIELD_L4_DPORT_BE,\n+\t\tRTE_SIZEOF_FIELD(sfc_mae_conntrack_key_t, dst_port_le),\n+\t\toffsetof(sfc_mae_conntrack_key_t, dst_port_le),\n+\t\tSFC_MAE_CT_KEY_DP,\n+\t},\n+\t{\n+\t\tEFX_MAE_FIELD_L4_SPORT_BE,\n+\t\tRTE_SIZEOF_FIELD(sfc_mae_conntrack_key_t, src_port_le),\n+\t\toffsetof(sfc_mae_conntrack_key_t, src_port_le),\n+\t\tSFC_MAE_CT_KEY_SP,\n+\t},\n+};\n+\n+static int\n+sfc_mae_rule_process_ct(struct sfc_adapter *sa, struct sfc_mae_parse_ctx *pctx,\n+\t\t\tstruct sfc_mae_action_rule_ctx *action_rule_ctx,\n+\t\t\tstruct sfc_flow_spec_mae *spec,\n+\t\t\tstruct rte_flow_error *error)\n+{\n+\tefx_mae_match_spec_t *match_spec_tmp;\n+\tuint8_t ct_key_missing_fields =\n+\t\tSFC_MAE_CT_KEY_ET | SFC_MAE_CT_KEY_DA | SFC_MAE_CT_KEY_SA |\n+\t\tSFC_MAE_CT_KEY_L4 | SFC_MAE_CT_KEY_DP | SFC_MAE_CT_KEY_SP;\n+\tunsigned int i;\n+\tint rc;\n+\n+\tif (pctx->ft_rule_type == SFC_FT_RULE_TUNNEL) {\n+\t\t/*\n+\t\t * TUNNEL rules have no network match fields that belong\n+\t\t * in an action rule match specification, so nothing can\n+\t\t * be possibly utilised for conntrack assistance offload.\n+\t\t */\n+\t\treturn 0;\n+\t}\n+\n+\tif (!sfc_mae_conntrack_is_supported(sa))\n+\t\treturn 0;\n+\n+\trc = efx_mae_match_spec_clone(sa->nic, pctx->match_spec_action,\n+\t\t\t\t &match_spec_tmp);\n+\tif (rc != 0) {\n+\t\treturn rte_flow_error_set(error, rc,\n+\t\t\t\tRTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,\n+\t\t\t\t\"AR: failed to clone the match specification\");\n+\t}\n+\n+\tfor (i = 0; i < RTE_DIM(flocs_ct); ++i) {\n+\t\tconst struct sfc_mae_field_locator *fl = &flocs_ct[i];\n+\t\tuint8_t mask_full[SFC_MAE_CT_KEY_FIELD_SIZE_MAX];\n+\t\tuint8_t mask_zero[SFC_MAE_CT_KEY_FIELD_SIZE_MAX];\n+\t\tuint8_t value[SFC_MAE_CT_KEY_FIELD_SIZE_MAX];\n+\t\tuint8_t mask[SFC_MAE_CT_KEY_FIELD_SIZE_MAX];\n+\t\tuint8_t *ct_key = (uint8_t *)&spec->ct_key;\n+\t\tefx_mae_field_id_t fid = fl->field_id;\n+\t\tunsigned int j;\n+\n+\t\trc = efx_mae_match_spec_field_get(match_spec_tmp, fid,\n+\t\t\t\t\t\t fl->size, value,\n+\t\t\t\t\t\t fl->size, mask);\n+\t\tif (rc != 0) {\n+\t\t\treturn rte_flow_error_set(error, rc,\n+\t\t\t\t\tRTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,\n+\t\t\t\t\t\"AR: failed to extract match field\");\n+\t\t}\n+\n+\t\tmemset(mask_full, 0xff, fl->size);\n+\n+\t\tif (memcmp(mask, mask_full, fl->size) != 0)\n+\t\t\tcontinue;\n+\n+\t\tmemset(mask_zero, 0, fl->size);\n+\n+\t\trc = efx_mae_match_spec_field_set(match_spec_tmp, fid,\n+\t\t\t\t\t\t fl->size, mask_zero,\n+\t\t\t\t\t\t fl->size, mask_zero);\n+\t\tif (rc != 0) {\n+\t\t\treturn rte_flow_error_set(error, rc,\n+\t\t\t\t\tRTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,\n+\t\t\t\t\t\"AR: failed to erase match field\");\n+\t\t}\n+\n+\t\tfor (j = 0; j < fl->size; ++j) {\n+\t\t\tuint8_t *byte_dst = ct_key + fl->ofst + fl->size - 1 - j;\n+\t\t\tconst uint8_t *byte_src = value + j;\n+\n+\t\t\t*byte_dst = *byte_src;\n+\t\t}\n+\n+\t\tct_key_missing_fields &= ~(fl->ct_key_field);\n+\t}\n+\n+\tif (ct_key_missing_fields != 0) {\n+\t\tefx_mae_match_spec_fini(sa->nic, match_spec_tmp);\n+\t\treturn 0;\n+\t}\n+\n+\tefx_mae_match_spec_fini(sa->nic, pctx->match_spec_action);\n+\tpctx->match_spec_action = match_spec_tmp;\n+\n+\tif (pctx->ft_rule_type == SFC_FT_RULE_SWITCH) {\n+\t\t/*\n+\t\t * A SWITCH rule re-uses the corresponding TUNNEL rule's\n+\t\t * outer rule, where conntrack request should have been\n+\t\t * configured already, so skip outer rule processing.\n+\t\t */\n+\t\tgoto skip_outer_rule;\n+\t}\n+\n+\tif (pctx->match_spec_outer == NULL) {\n+\t\tconst struct sfc_mae_pattern_data *pdata = &pctx->pattern_data;\n+\t\tconst struct sfc_mae_ethertype *et;\n+\t\tstruct sfc_mae *mae = &sa->mae;\n+\n+\t\trc = efx_mae_match_spec_init(sa->nic,\n+\t\t\t\t\t EFX_MAE_RULE_OUTER,\n+\t\t\t\t\t mae->nb_outer_rule_prios_max - 1,\n+\t\t\t\t\t &pctx->match_spec_outer);\n+\t\tif (rc != 0) {\n+\t\t\treturn rte_flow_error_set(error, rc,\n+\t\t\t\tRTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,\n+\t\t\t\t\"OR: failed to initialise the match specification\");\n+\t\t}\n+\n+\t\t/* Match on EtherType appears to be compulsory in outer rules */\n+\n+\t\tet = &pdata->ethertypes[pdata->nb_vlan_tags];\n+\n+\t\trc = efx_mae_match_spec_field_set(pctx->match_spec_outer,\n+\t\t\t\tEFX_MAE_FIELD_ENC_ETHER_TYPE_BE,\n+\t\t\t\tsizeof(et->value), (const uint8_t *)&et->value,\n+\t\t\t\tsizeof(et->mask), (const uint8_t *)&et->mask);\n+\t\tif (rc != 0) {\n+\t\t\treturn rte_flow_error_set(error, rc,\n+\t\t\t\t\tRTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,\n+\t\t\t\t\t\"OR: failed to set match on EtherType\");\n+\t\t}\n+\t}\n+\n+\trc = efx_mae_outer_rule_do_ct_set(pctx->match_spec_outer);\n+\tif (rc != 0) {\n+\t\treturn rte_flow_error_set(error, rc,\n+\t\t\t\tRTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,\n+\t\t\t\t\"OR: failed to request CT lookup\");\n+\t}\n+\n+skip_outer_rule:\n+\t/* Initial/dummy CT mark value */\n+\taction_rule_ctx->ct_mark = 1;\n+\n+\treturn 0;\n+}\n+\n+#undef SFC_MAE_CT_KEY_ET\n+#undef SFC_MAE_CT_KEY_DA\n+#undef SFC_MAE_CT_KEY_SA\n+#undef SFC_MAE_CT_KEY_L4\n+#undef SFC_MAE_CT_KEY_DP\n+#undef SFC_MAE_CT_KEY_SP\n+\n static int\n sfc_mae_rule_process_outer(struct sfc_adapter *sa,\n \t\t\t struct sfc_mae_parse_ctx *ctx,\n@@ -2677,13 +2938,11 @@ sfc_mae_rule_process_outer(struct sfc_adapter *sa,\n \t\treturn 0;\n \t}\n \n-\tif (ctx->encap_type == EFX_TUNNEL_PROTOCOL_NONE) {\n+\tif (ctx->match_spec_outer == NULL) {\n \t\t*rulep = NULL;\n \t\tgoto no_or_id;\n \t}\n \n-\tSFC_ASSERT(ctx->match_spec_outer != NULL);\n-\n \tif (!efx_mae_match_spec_is_valid(sa->nic, ctx->match_spec_outer)) {\n \t\treturn rte_flow_error_set(error, ENOTSUP,\n \t\t\t\t\t RTE_FLOW_ERROR_TYPE_ITEM, NULL,\n@@ -2810,6 +3069,7 @@ sfc_mae_rule_encap_parse_init(struct sfc_adapter *sa,\n {\n \tconst struct rte_flow_item *pattern = ctx->pattern;\n \tstruct sfc_mae *mae = &sa->mae;\n+\tbool request_ct = false;\n \tuint8_t recirc_id = 0;\n \tint rc;\n \n@@ -2905,6 +3165,14 @@ sfc_mae_rule_encap_parse_init(struct sfc_adapter *sa,\n \tswitch (ctx->ft_rule_type) {\n \tcase SFC_FT_RULE_TUNNEL:\n \t\trecirc_id = SFC_FT_CTX_ID_TO_CTX_MARK(ctx->ft_ctx->id);\n+\n+\t\tif (sfc_mae_conntrack_is_supported(sa)) {\n+\t\t\t/*\n+\t\t\t * Request lookup in conntrack table since SWITCH rules\n+\t\t\t * are eligible to utilise this type of assistance.\n+\t\t\t */\n+\t\t\trequest_ct = true;\n+\t\t}\n \t\t/* FALLTHROUGH */\n \tcase SFC_FT_RULE_NONE:\n \t\tif (ctx->priority >= mae->nb_outer_rule_prios_max) {\n@@ -2938,6 +3206,16 @@ sfc_mae_rule_encap_parse_init(struct sfc_adapter *sa,\n \t\t\t\t\tRTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,\n \t\t\t\t\t\"OR: failed to initialise RECIRC_ID\");\n \t\t}\n+\n+\t\tif (!request_ct)\n+\t\t\tbreak;\n+\n+\t\trc = efx_mae_outer_rule_do_ct_set(ctx->match_spec_outer);\n+\t\tif (rc != 0) {\n+\t\t\treturn rte_flow_error_set(error, rc,\n+\t\t\t\t\tRTE_FLOW_ERROR_TYPE_UNSPECIFIED, NULL,\n+\t\t\t\t\t\"OR: failed to request CT lookup\");\n+\t\t}\n \t\tbreak;\n \tcase SFC_FT_RULE_SWITCH:\n \t\t/* Outermost items -> \"ENC\" match fields in the action rule. */\n@@ -2959,9 +3237,6 @@ static void\n sfc_mae_rule_encap_parse_fini(struct sfc_adapter *sa,\n \t\t\t struct sfc_mae_parse_ctx *ctx)\n {\n-\tif (ctx->encap_type == EFX_TUNNEL_PROTOCOL_NONE)\n-\t\treturn;\n-\n \tif (ctx->match_spec_outer != NULL)\n \t\tefx_mae_match_spec_fini(sa->nic, ctx->match_spec_outer);\n }\n@@ -3065,6 +3340,11 @@ sfc_mae_rule_parse_pattern(struct sfc_adapter *sa,\n \tif (rc != 0)\n \t\tgoto fail_process_pattern_data;\n \n+\trc = sfc_mae_rule_process_ct(sa, &ctx_mae, action_rule_ctx,\n+\t\t\t\t spec, error);\n+\tif (rc != 0)\n+\t\tgoto fail_process_ct;\n+\n \trc = sfc_mae_rule_process_outer(sa, &ctx_mae, outer_rulep, error);\n \tif (rc != 0)\n \t\tgoto fail_process_outer;\n@@ -3083,6 +3363,7 @@ sfc_mae_rule_parse_pattern(struct sfc_adapter *sa,\n \n fail_validate_match_spec_action:\n fail_process_outer:\n+fail_process_ct:\n fail_process_pattern_data:\n fail_parse_pattern:\n \tsfc_mae_rule_encap_parse_fini(sa, &ctx_mae);\n@@ -4380,6 +4661,18 @@ sfc_mae_flow_insert(struct sfc_adapter *sa,\n \tif (rc != 0)\n \t\treturn rc;\n \n+\tif (spec_mae->action_rule->ct_mark != 0) {\n+\t\tspec_mae->ct_resp.ct_mark = spec_mae->action_rule->ct_mark;\n+\t\tspec_mae->ct_resp.counter_id = EFX_MAE_RSRC_ID_INVALID;\n+\n+\t\trc = sfc_mae_conntrack_insert(sa, &spec_mae->ct_key,\n+\t\t\t\t\t &spec_mae->ct_resp);\n+\t\tif (rc != 0) {\n+\t\t\tsfc_mae_action_rule_disable(sa, action_rule);\n+\t\t\treturn rc;\n+\t\t}\n+\t}\n+\n \treturn 0;\n }\n \n@@ -4394,6 +4687,9 @@ sfc_mae_flow_remove(struct sfc_adapter *sa,\n \tif (action_rule == NULL)\n \t\treturn 0;\n \n+\tif (action_rule->ct_mark != 0)\n+\t\t(void)sfc_mae_conntrack_delete(sa, &spec_mae->ct_key);\n+\n \tsfc_mae_action_rule_disable(sa, action_rule);\n \n \treturn 0;\ndiff --git a/drivers/net/sfc/sfc_mae.h b/drivers/net/sfc/sfc_mae.h\nindex cbe190075c..67fa2ca5c9 100644\n--- a/drivers/net/sfc/sfc_mae.h\n+++ b/drivers/net/sfc/sfc_mae.h\n@@ -100,6 +100,7 @@ TAILQ_HEAD(sfc_mae_action_sets, sfc_mae_action_set);\n /** Action rule registry entry */\n struct sfc_mae_action_rule {\n \tTAILQ_ENTRY(sfc_mae_action_rule)\tentries;\n+\tuint32_t\t\t\t\tct_mark;\n \tstruct sfc_mae_outer_rule\t\t*outer_rule;\n \tstruct sfc_mae_action_set\t\t*action_set;\n \tefx_mae_match_spec_t\t\t\t*match_spec;\n", "prefixes": [ "v4", "25/34" ] }