X-Git-Url: http://git.droids-corp.org/?a=blobdiff_plain;f=drivers%2Fnet%2Fsoftnic%2Frte_eth_softnic_cli.c;h=bc95f164396360dfc0765b6dfad49cd28dca38cd;hb=df6cd7c1f73a62e2bd889cc1aa4832096cb8c245;hp=c13f4d8dc09a4cef255b57b3929061ef91a1b667;hpb=9bc0ce0ad17c168be4dc66a94598dcf5dcf1cccd;p=dpdk.git

diff --git a/drivers/net/softnic/rte_eth_softnic_cli.c b/drivers/net/softnic/rte_eth_softnic_cli.c
index c13f4d8dc0..bc95f16439 100644
--- a/drivers/net/softnic/rte_eth_softnic_cli.c
+++ b/drivers/net/softnic/rte_eth_softnic_cli.c
@@ -9,6 +9,8 @@
 
 #include <rte_common.h>
 #include <rte_cycles.h>
+#include <rte_string_fns.h>
+#include <rte_cryptodev.h>
 
 #include "rte_eth_softnic_internals.h"
 #include "parser.h"
@@ -185,1343 +187,2088 @@ cmd_swq(struct pmd_internals *softnic,
 }
 
 /**
- * tap <tap_name>
+ * tmgr shaper profile
+ *  id <profile_id>
+ *  rate <tb_rate> size <tb_size>
+ *  adj <packet_length_adjust>
  */
 static void
-cmd_tap(struct pmd_internals *softnic,
+cmd_tmgr_shaper_profile(struct pmd_internals *softnic,
 	char **tokens,
 	uint32_t n_tokens,
 	char *out,
 	size_t out_size)
 {
-	char *name;
-	struct softnic_tap *tap;
+	struct rte_tm_shaper_params sp;
+	struct rte_tm_error error;
+	uint32_t shaper_profile_id;
+	uint16_t port_id;
+	int status;
 
-	if (n_tokens != 2) {
+	memset(&sp, 0, sizeof(struct rte_tm_shaper_params));
+
+	if (n_tokens != 11) {
 		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
 		return;
 	}
 
-	name = tokens[1];
+	if (strcmp(tokens[1], "shaper") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "shaper");
+		return;
+	}
 
-	tap = softnic_tap_create(softnic, name);
-	if (tap == NULL) {
+	if (strcmp(tokens[2], "profile") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "profile");
+		return;
+	}
+
+	if (strcmp(tokens[3], "id") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "id");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&shaper_profile_id, tokens[4]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "profile_id");
+		return;
+	}
+
+	if (strcmp(tokens[5], "rate") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "rate");
+		return;
+	}
+
+	if (softnic_parser_read_uint64(&sp.peak.rate, tokens[6]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "tb_rate");
+		return;
+	}
+
+	if (strcmp(tokens[7], "size") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "size");
+		return;
+	}
+
+	if (softnic_parser_read_uint64(&sp.peak.size, tokens[8]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "tb_size");
+		return;
+	}
+
+	if (strcmp(tokens[9], "adj") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "adj");
+		return;
+	}
+
+	if (softnic_parser_read_int32(&sp.pkt_length_adjust, tokens[10]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "packet_length_adjust");
+		return;
+	}
+
+	status = rte_eth_dev_get_port_by_name(softnic->params.name, &port_id);
+	if (status)
+		return;
+
+	status = rte_tm_shaper_profile_add(port_id, shaper_profile_id, &sp, &error);
+	if (status != 0) {
 		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
 		return;
 	}
 }
 
 /**
- * port in action profile <profile_name>
- *  [filter match | mismatch offset <key_offset> mask <key_mask> key <key_value> port <port_id>]
- *  [balance offset <key_offset> mask <key_mask> port <port_id0> ... <port_id15>]
+ * tmgr shared shaper
+ *  id <shared_shaper_id>
+ *  profile <shaper_profile_id>
  */
 static void
-cmd_port_in_action_profile(struct pmd_internals *softnic,
+cmd_tmgr_shared_shaper(struct pmd_internals *softnic,
 	char **tokens,
 	uint32_t n_tokens,
 	char *out,
 	size_t out_size)
 {
-	struct softnic_port_in_action_profile_params p;
-	struct softnic_port_in_action_profile *ap;
-	char *name;
-	uint32_t t0;
-
-	memset(&p, 0, sizeof(p));
+	struct rte_tm_error error;
+	uint32_t shared_shaper_id, shaper_profile_id;
+	uint16_t port_id;
+	int status;
 
-	if (n_tokens < 5) {
+	if (n_tokens != 7) {
 		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
 		return;
 	}
 
-	if (strcmp(tokens[1], "in") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "in");
+	if (strcmp(tokens[1], "shared") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "shared");
 		return;
 	}
 
-	if (strcmp(tokens[2], "action") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "action");
+	if (strcmp(tokens[2], "shaper") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "shaper");
 		return;
 	}
 
-	if (strcmp(tokens[3], "profile") != 0) {
+	if (strcmp(tokens[3], "id") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "id");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&shared_shaper_id, tokens[4]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "shared_shaper_id");
+		return;
+	}
+
+	if (strcmp(tokens[5], "profile") != 0) {
 		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "profile");
 		return;
 	}
 
-	name = tokens[4];
+	if (softnic_parser_read_uint32(&shaper_profile_id, tokens[6]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "shaper_profile_id");
+		return;
+	}
 
-	t0 = 5;
+	status = rte_eth_dev_get_port_by_name(softnic->params.name, &port_id);
+	if (status)
+		return;
 
-	if (t0 < n_tokens &&
-		(strcmp(tokens[t0], "filter") == 0)) {
-		uint32_t size;
+	status = rte_tm_shared_shaper_add_update(port_id,
+		shared_shaper_id,
+		shaper_profile_id,
+		&error);
+	if (status != 0) {
+		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
+		return;
+	}
+}
 
-		if (n_tokens < t0 + 10) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH, "port in action profile filter");
-			return;
-		}
+/**
+ * tmgr node
+ *   id <node_id>
+ *   parent <parent_node_id | none>
+ *   priority <priority>
+ *   weight <weight>
+ *   [shaper profile <shaper_profile_id>]
+ *   [shared shaper <shared_shaper_id>]
+ *   [nonleaf sp <n_sp_priorities>]
+ */
+static void
+cmd_tmgr_node(struct pmd_internals *softnic,
+	char **tokens,
+	uint32_t n_tokens,
+	char *out,
+	size_t out_size)
+{
+	struct rte_tm_error error;
+	struct rte_tm_node_params np;
+	uint32_t node_id, parent_node_id, priority, weight, shared_shaper_id;
+	uint16_t port_id;
+	int status;
 
-		if (strcmp(tokens[t0 + 1], "match") == 0) {
-			p.fltr.filter_on_match = 1;
-		} else if (strcmp(tokens[t0 + 1], "mismatch") == 0) {
-			p.fltr.filter_on_match = 0;
-		} else {
-			snprintf(out, out_size, MSG_ARG_INVALID, "match or mismatch");
-			return;
-		}
+	memset(&np, 0, sizeof(struct rte_tm_node_params));
+	np.shaper_profile_id = RTE_TM_SHAPER_PROFILE_ID_NONE;
+	np.nonleaf.n_sp_priorities = 1;
 
-		if (strcmp(tokens[t0 + 2], "offset") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
-			return;
-		}
+	if (n_tokens < 10) {
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+		return;
+	}
 
-		if (softnic_parser_read_uint32(&p.fltr.key_offset,
-			tokens[t0 + 3]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "key_offset");
-			return;
-		}
+	if (strcmp(tokens[1], "node") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "node");
+		return;
+	}
 
-		if (strcmp(tokens[t0 + 4], "mask") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "mask");
-			return;
-		}
+	if (strcmp(tokens[2], "id") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "id");
+		return;
+	}
 
-		size = RTE_PORT_IN_ACTION_FLTR_KEY_SIZE;
-		if ((softnic_parse_hex_string(tokens[t0 + 5],
-			p.fltr.key_mask, &size) != 0) ||
-			size != RTE_PORT_IN_ACTION_FLTR_KEY_SIZE) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "key_mask");
-			return;
-		}
+	if (softnic_parser_read_uint32(&node_id, tokens[3]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "node_id");
+		return;
+	}
 
-		if (strcmp(tokens[t0 + 6], "key") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "key");
-			return;
-		}
+	if (strcmp(tokens[4], "parent") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "parent");
+		return;
+	}
 
-		size = RTE_PORT_IN_ACTION_FLTR_KEY_SIZE;
-		if ((softnic_parse_hex_string(tokens[t0 + 7],
-			p.fltr.key, &size) != 0) ||
-			size != RTE_PORT_IN_ACTION_FLTR_KEY_SIZE) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "key_value");
+	if (strcmp(tokens[5], "none") == 0)
+		parent_node_id = RTE_TM_NODE_ID_NULL;
+	else {
+		if (softnic_parser_read_uint32(&parent_node_id, tokens[5]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "parent_node_id");
 			return;
 		}
+	}
 
-		if (strcmp(tokens[t0 + 8], "port") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
-			return;
-		}
+	if (strcmp(tokens[6], "priority") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "priority");
+		return;
+	}
 
-		if (softnic_parser_read_uint32(&p.fltr.port_id,
-			tokens[t0 + 9]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "port_id");
-			return;
-		}
+	if (softnic_parser_read_uint32(&priority, tokens[7]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "priority");
+		return;
+	}
 
-		p.action_mask |= 1LLU << RTE_PORT_IN_ACTION_FLTR;
-		t0 += 10;
-	} /* filter */
+	if (strcmp(tokens[8], "weight") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "weight");
+		return;
+	}
 
-	if (t0 < n_tokens &&
-		(strcmp(tokens[t0], "balance") == 0)) {
-		uint32_t i;
+	if (softnic_parser_read_uint32(&weight, tokens[9]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "weight");
+		return;
+	}
 
-		if (n_tokens < t0 + 22) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"port in action profile balance");
+	tokens += 10;
+	n_tokens -= 10;
+
+	if (n_tokens >= 2 &&
+		(strcmp(tokens[0], "shaper") == 0) &&
+		(strcmp(tokens[1], "profile") == 0)) {
+		if (n_tokens < 3) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH, "tmgr node");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 1], "offset") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
-			return;
+		if (strcmp(tokens[2], "none") == 0) {
+			np.shaper_profile_id = RTE_TM_SHAPER_PROFILE_ID_NONE;
+		} else {
+			if (softnic_parser_read_uint32(&np.shaper_profile_id, tokens[2]) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "shaper_profile_id");
+				return;
+			}
 		}
 
-		if (softnic_parser_read_uint32(&p.lb.key_offset,
-			tokens[t0 + 2]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "key_offset");
+		tokens += 3;
+		n_tokens -= 3;
+	} /* shaper profile */
+
+	if (n_tokens >= 2 &&
+		(strcmp(tokens[0], "shared") == 0) &&
+		(strcmp(tokens[1], "shaper") == 0)) {
+		if (n_tokens < 3) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH, "tmgr node");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 3], "mask") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "mask");
+		if (softnic_parser_read_uint32(&shared_shaper_id, tokens[2]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "shared_shaper_id");
 			return;
 		}
 
-		p.lb.key_size = RTE_PORT_IN_ACTION_LB_KEY_SIZE_MAX;
-		if (softnic_parse_hex_string(tokens[t0 + 4],
-			p.lb.key_mask, &p.lb.key_size) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "key_mask");
+		np.shared_shaper_id = &shared_shaper_id;
+		np.n_shared_shapers = 1;
+
+		tokens += 3;
+		n_tokens -= 3;
+	} /* shared shaper */
+
+	if (n_tokens >= 2 &&
+		(strcmp(tokens[0], "nonleaf") == 0) &&
+		(strcmp(tokens[1], "sp") == 0)) {
+		if (n_tokens < 3) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH, "tmgr node");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 5], "port") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
+		if (softnic_parser_read_uint32(&np.nonleaf.n_sp_priorities, tokens[2]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "n_sp_priorities");
 			return;
 		}
 
-		for (i = 0; i < 16; i++)
-			if (softnic_parser_read_uint32(&p.lb.port_id[i],
-			tokens[t0 + 6 + i]) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID, "port_id");
-				return;
-			}
-
-		p.action_mask |= 1LLU << RTE_PORT_IN_ACTION_LB;
-		t0 += 22;
-	} /* balance */
+		tokens += 3;
+		n_tokens -= 3;
+	} /* nonleaf sp <n_sp_priorities> */
 
-	if (t0 < n_tokens) {
+	if (n_tokens) {
 		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
 		return;
 	}
 
-	ap = softnic_port_in_action_profile_create(softnic, name, &p);
-	if (ap == NULL) {
+	status = rte_eth_dev_get_port_by_name(softnic->params.name, &port_id);
+	if (status != 0)
+		return;
+
+	status = rte_tm_node_add(port_id,
+		node_id,
+		parent_node_id,
+		priority,
+		weight,
+		RTE_TM_NODE_LEVEL_ID_ANY,
+		&np,
+		&error);
+	if (status != 0) {
 		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
 		return;
 	}
 }
 
-/**
- * table action profile <profile_name>
- *  ipv4 | ipv6
- *  offset <ip_offset>
- *  fwd
- *  [balance offset <key_offset> mask <key_mask> outoffset <out_offset>]
- *  [meter srtcm | trtcm
- *      tc <n_tc>
- *      stats none | pkts | bytes | both]
- *  [tm spp <n_subports_per_port> pps <n_pipes_per_subport>]
- *  [encap ether | vlan | qinq | mpls | pppoe]
- *  [nat src | dst
- *      proto udp | tcp]
- *  [ttl drop | fwd
- *      stats none | pkts]
- *  [stats pkts | bytes | both]
- *  [time]
- */
-static void
-cmd_table_action_profile(struct pmd_internals *softnic,
-	char **tokens,
-	uint32_t n_tokens,
-	char *out,
-	size_t out_size)
+static uint32_t
+root_node_id(uint32_t n_spp,
+	uint32_t n_pps)
 {
-	struct softnic_table_action_profile_params p;
-	struct softnic_table_action_profile *ap;
-	char *name;
-	uint32_t t0;
-
-	memset(&p, 0, sizeof(p));
+	uint32_t n_queues = n_spp * n_pps * RTE_SCHED_QUEUES_PER_PIPE;
+	uint32_t n_tc = n_spp * n_pps * RTE_SCHED_TRAFFIC_CLASSES_PER_PIPE;
+	uint32_t n_pipes = n_spp * n_pps;
 
-	if (n_tokens < 8) {
-		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
-		return;
-	}
+	return n_queues + n_tc + n_pipes + n_spp;
+}
 
-	if (strcmp(tokens[1], "action") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "action");
-		return;
-	}
+static uint32_t
+subport_node_id(uint32_t n_spp,
+	uint32_t n_pps,
+	uint32_t subport_id)
+{
+	uint32_t n_pipes = n_spp * n_pps;
+	uint32_t n_tc = n_pipes * RTE_SCHED_TRAFFIC_CLASSES_PER_PIPE;
+	uint32_t n_queues = n_pipes * RTE_SCHED_QUEUES_PER_PIPE;
 
-	if (strcmp(tokens[2], "profile") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "profile");
-		return;
-	}
+	return n_queues + n_tc + n_pipes + subport_id;
+}
 
-	name = tokens[3];
+static uint32_t
+pipe_node_id(uint32_t n_spp,
+	uint32_t n_pps,
+	uint32_t subport_id,
+	uint32_t pipe_id)
+{
+	uint32_t n_pipes = n_spp * n_pps;
+	uint32_t n_tc = n_pipes * RTE_SCHED_TRAFFIC_CLASSES_PER_PIPE;
+	uint32_t n_queues = n_pipes * RTE_SCHED_QUEUES_PER_PIPE;
+
+	return n_queues +
+		n_tc +
+		pipe_id +
+		subport_id * n_pps;
+}
 
-	if (strcmp(tokens[4], "ipv4") == 0) {
-		p.common.ip_version = 1;
-	} else if (strcmp(tokens[4], "ipv6") == 0) {
-		p.common.ip_version = 0;
-	} else {
-		snprintf(out, out_size, MSG_ARG_INVALID, "ipv4 or ipv6");
+static uint32_t
+tc_node_id(uint32_t n_spp,
+	uint32_t n_pps,
+	uint32_t subport_id,
+	uint32_t pipe_id,
+	uint32_t tc_id)
+{
+	uint32_t n_pipes = n_spp * n_pps;
+	uint32_t n_queues = n_pipes * RTE_SCHED_QUEUES_PER_PIPE;
+
+	return n_queues +
+		tc_id +
+		(pipe_id + subport_id * n_pps) * RTE_SCHED_TRAFFIC_CLASSES_PER_PIPE;
+}
+
+static uint32_t
+queue_node_id(uint32_t n_spp __rte_unused,
+	uint32_t n_pps,
+	uint32_t subport_id,
+	uint32_t pipe_id,
+	uint32_t tc_id,
+	uint32_t queue_id)
+{
+	return queue_id + tc_id +
+		(pipe_id + subport_id * n_pps) * RTE_SCHED_QUEUES_PER_PIPE;
+}
+
+struct tmgr_hierarchy_default_params {
+	uint32_t n_spp; /**< Number of subports per port. */
+	uint32_t n_pps; /**< Number of pipes per subport. */
+
+	struct {
+		uint32_t port;
+		uint32_t subport;
+		uint32_t pipe;
+		uint32_t tc[RTE_SCHED_TRAFFIC_CLASSES_PER_PIPE];
+	} shaper_profile_id;
+
+	struct {
+		uint32_t tc[RTE_SCHED_TRAFFIC_CLASSES_PER_PIPE];
+		uint32_t tc_valid[RTE_SCHED_TRAFFIC_CLASSES_PER_PIPE];
+	} shared_shaper_id;
+
+	struct {
+		uint32_t queue[RTE_SCHED_QUEUES_PER_PIPE];
+	} weight;
+};
+
+static int
+tmgr_hierarchy_default(struct pmd_internals *softnic,
+	struct tmgr_hierarchy_default_params *params)
+{
+	struct rte_tm_node_params root_node_params = {
+		.shaper_profile_id = params->shaper_profile_id.port,
+		.nonleaf = {
+			.n_sp_priorities = 1,
+		},
+	};
+
+	struct rte_tm_node_params subport_node_params = {
+		.shaper_profile_id = params->shaper_profile_id.subport,
+		.nonleaf = {
+			.n_sp_priorities = 1,
+		},
+	};
+
+	struct rte_tm_node_params pipe_node_params = {
+		.shaper_profile_id = params->shaper_profile_id.pipe,
+		.nonleaf = {
+			.n_sp_priorities = RTE_SCHED_TRAFFIC_CLASSES_PER_PIPE,
+		},
+	};
+
+	uint32_t *shared_shaper_id =
+		(uint32_t *)calloc(RTE_SCHED_TRAFFIC_CLASSES_PER_PIPE,
+			sizeof(uint32_t));
+
+	if (shared_shaper_id == NULL)
+		return -1;
+
+	memcpy(shared_shaper_id, params->shared_shaper_id.tc,
+		sizeof(params->shared_shaper_id.tc));
+
+	struct rte_tm_node_params tc_node_params[] = {
+		[0] = {
+			.shaper_profile_id = params->shaper_profile_id.tc[0],
+			.shared_shaper_id = &shared_shaper_id[0],
+			.n_shared_shapers =
+				(&params->shared_shaper_id.tc_valid[0]) ? 1 : 0,
+			.nonleaf = {
+				.n_sp_priorities = 1,
+			},
+		},
+
+		[1] = {
+			.shaper_profile_id = params->shaper_profile_id.tc[1],
+			.shared_shaper_id = &shared_shaper_id[1],
+			.n_shared_shapers =
+				(&params->shared_shaper_id.tc_valid[1]) ? 1 : 0,
+			.nonleaf = {
+				.n_sp_priorities = 1,
+			},
+		},
+
+		[2] = {
+			.shaper_profile_id = params->shaper_profile_id.tc[2],
+			.shared_shaper_id = &shared_shaper_id[2],
+			.n_shared_shapers =
+				(&params->shared_shaper_id.tc_valid[2]) ? 1 : 0,
+			.nonleaf = {
+				.n_sp_priorities = 1,
+			},
+		},
+
+		[3] = {
+			.shaper_profile_id = params->shaper_profile_id.tc[3],
+			.shared_shaper_id = &shared_shaper_id[3],
+			.n_shared_shapers =
+				(&params->shared_shaper_id.tc_valid[3]) ? 1 : 0,
+			.nonleaf = {
+				.n_sp_priorities = 1,
+			},
+		},
+
+		[4] = {
+			.shaper_profile_id = params->shaper_profile_id.tc[4],
+			.shared_shaper_id = &shared_shaper_id[4],
+			.n_shared_shapers =
+				(&params->shared_shaper_id.tc_valid[4]) ? 1 : 0,
+			.nonleaf = {
+				.n_sp_priorities = 1,
+			},
+		},
+
+		[5] = {
+			.shaper_profile_id = params->shaper_profile_id.tc[5],
+			.shared_shaper_id = &shared_shaper_id[5],
+			.n_shared_shapers =
+				(&params->shared_shaper_id.tc_valid[5]) ? 1 : 0,
+			.nonleaf = {
+				.n_sp_priorities = 1,
+			},
+		},
+
+		[6] = {
+			.shaper_profile_id = params->shaper_profile_id.tc[6],
+			.shared_shaper_id = &shared_shaper_id[6],
+			.n_shared_shapers =
+				(&params->shared_shaper_id.tc_valid[6]) ? 1 : 0,
+			.nonleaf = {
+				.n_sp_priorities = 1,
+			},
+		},
+
+		[7] = {
+			.shaper_profile_id = params->shaper_profile_id.tc[7],
+			.shared_shaper_id = &shared_shaper_id[7],
+			.n_shared_shapers =
+				(&params->shared_shaper_id.tc_valid[7]) ? 1 : 0,
+			.nonleaf = {
+				.n_sp_priorities = 1,
+			},
+		},
+
+		[8] = {
+			.shaper_profile_id = params->shaper_profile_id.tc[8],
+			.shared_shaper_id = &shared_shaper_id[8],
+			.n_shared_shapers =
+				(&params->shared_shaper_id.tc_valid[8]) ? 1 : 0,
+			.nonleaf = {
+				.n_sp_priorities = 1,
+			},
+		},
+
+		[9] = {
+			.shaper_profile_id = params->shaper_profile_id.tc[9],
+			.shared_shaper_id = &shared_shaper_id[9],
+			.n_shared_shapers =
+				(&params->shared_shaper_id.tc_valid[9]) ? 1 : 0,
+			.nonleaf = {
+				.n_sp_priorities = 1,
+			},
+		},
+
+		[10] = {
+			.shaper_profile_id = params->shaper_profile_id.tc[10],
+			.shared_shaper_id = &shared_shaper_id[10],
+			.n_shared_shapers =
+				(&params->shared_shaper_id.tc_valid[10]) ? 1 : 0,
+			.nonleaf = {
+				.n_sp_priorities = 1,
+			},
+		},
+
+		[11] = {
+			.shaper_profile_id = params->shaper_profile_id.tc[11],
+			.shared_shaper_id = &shared_shaper_id[11],
+			.n_shared_shapers =
+				(&params->shared_shaper_id.tc_valid[11]) ? 1 : 0,
+			.nonleaf = {
+				.n_sp_priorities = 1,
+			},
+		},
+
+		[12] = {
+			.shaper_profile_id = params->shaper_profile_id.tc[12],
+			.shared_shaper_id = &shared_shaper_id[12],
+			.n_shared_shapers =
+				(&params->shared_shaper_id.tc_valid[12]) ? 1 : 0,
+			.nonleaf = {
+				.n_sp_priorities = 1,
+			},
+		},
+	};
+
+	struct rte_tm_node_params queue_node_params = {
+		.shaper_profile_id = RTE_TM_SHAPER_PROFILE_ID_NONE,
+	};
+
+	struct rte_tm_error error;
+	uint32_t n_spp = params->n_spp, n_pps = params->n_pps, s;
+	int status;
+	uint16_t port_id;
+
+	status = rte_eth_dev_get_port_by_name(softnic->params.name, &port_id);
+	if (status)
+		return -1;
+
+	/* Hierarchy level 0: Root node */
+	status = rte_tm_node_add(port_id,
+		root_node_id(n_spp, n_pps),
+		RTE_TM_NODE_ID_NULL,
+		0,
+		1,
+		RTE_TM_NODE_LEVEL_ID_ANY,
+		&root_node_params,
+		&error);
+	if (status)
+		return -1;
+
+	/* Hierarchy level 1: Subport nodes */
+	for (s = 0; s < params->n_spp; s++) {
+		uint32_t p;
+
+		status = rte_tm_node_add(port_id,
+			subport_node_id(n_spp, n_pps, s),
+			root_node_id(n_spp, n_pps),
+			0,
+			1,
+			RTE_TM_NODE_LEVEL_ID_ANY,
+			&subport_node_params,
+			&error);
+		if (status)
+			return -1;
+
+		/* Hierarchy level 2: Pipe nodes */
+		for (p = 0; p < params->n_pps; p++) {
+			uint32_t t;
+
+			status = rte_tm_node_add(port_id,
+				pipe_node_id(n_spp, n_pps, s, p),
+				subport_node_id(n_spp, n_pps, s),
+				0,
+				1,
+				RTE_TM_NODE_LEVEL_ID_ANY,
+				&pipe_node_params,
+				&error);
+			if (status)
+				return -1;
+
+			/* Hierarchy level 3: Traffic class nodes */
+			for (t = 0; t < RTE_SCHED_TRAFFIC_CLASSES_PER_PIPE; t++) {
+				uint32_t q;
+
+				status = rte_tm_node_add(port_id,
+					tc_node_id(n_spp, n_pps, s, p, t),
+					pipe_node_id(n_spp, n_pps, s, p),
+					t,
+					1,
+					RTE_TM_NODE_LEVEL_ID_ANY,
+					&tc_node_params[t],
+					&error);
+				if (status)
+					return -1;
+
+				/* Hierarchy level 4: Queue nodes */
+				if (t < RTE_SCHED_TRAFFIC_CLASS_BE) {
+					/* Strict-priority traffic class queues */
+					q = 0;
+					status = rte_tm_node_add(port_id,
+						queue_node_id(n_spp, n_pps, s, p, t, q),
+						tc_node_id(n_spp, n_pps, s, p, t),
+						0,
+						params->weight.queue[q],
+						RTE_TM_NODE_LEVEL_ID_ANY,
+						&queue_node_params,
+						&error);
+					if (status)
+						return -1;
+
+					continue;
+				}
+				/* Best-effort traffic class queues */
+				for (q = 0; q < RTE_SCHED_BE_QUEUES_PER_PIPE; q++) {
+					status = rte_tm_node_add(port_id,
+						queue_node_id(n_spp, n_pps, s, p, t, q),
+						tc_node_id(n_spp, n_pps, s, p, t),
+						0,
+						params->weight.queue[q],
+						RTE_TM_NODE_LEVEL_ID_ANY,
+						&queue_node_params,
+						&error);
+					if (status)
+						return -1;
+				}
+			} /* TC */
+		} /* Pipe */
+	} /* Subport */
+
+	return 0;
+}
+
+
+/**
+ * tmgr hierarchy-default
+ *  spp <n_subports_per_port>
+ *  pps <n_pipes_per_subport>
+ *  shaper profile
+ *   port <profile_id>
+ *   subport <profile_id>
+ *   pipe <profile_id>
+ *   tc0 <profile_id>
+ *   tc1 <profile_id>
+ *   tc2 <profile_id>
+ *   tc3 <profile_id>
+ *   tc4 <profile_id>
+ *   tc5 <profile_id>
+ *   tc6 <profile_id>
+ *   tc7 <profile_id>
+ *   tc8 <profile_id>
+ *   tc9 <profile_id>
+ *   tc10 <profile_id>
+ *   tc11 <profile_id>
+ *   tc12 <profile_id>
+ *  shared shaper
+ *   tc0 <id | none>
+ *   tc1 <id | none>
+ *   tc2 <id | none>
+ *   tc3 <id | none>
+ *   tc4 <id | none>
+ *   tc5 <id | none>
+ *   tc6 <id | none>
+ *   tc7 <id | none>
+ *   tc8 <id | none>
+ *   tc9 <id | none>
+ *   tc10 <id | none>
+ *   tc11 <id | none>
+ *   tc12 <id | none>
+ *  weight
+ *   queue  <q12> ... <q15>
+ */
+static void
+cmd_tmgr_hierarchy_default(struct pmd_internals *softnic,
+	char **tokens,
+	uint32_t n_tokens,
+	char *out,
+	size_t out_size)
+{
+	struct tmgr_hierarchy_default_params p;
+	int i, j, status;
+
+	memset(&p, 0, sizeof(p));
+
+	if (n_tokens != 74) {
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
 		return;
 	}
 
-	if (strcmp(tokens[5], "offset") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
+	if (strcmp(tokens[1], "hierarchy-default") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "hierarchy-default");
 		return;
 	}
 
-	if (softnic_parser_read_uint32(&p.common.ip_offset,
-		tokens[6]) != 0) {
-		snprintf(out, out_size, MSG_ARG_INVALID, "ip_offset");
+	if (strcmp(tokens[2], "spp") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "spp");
 		return;
 	}
 
-	if (strcmp(tokens[7], "fwd") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "fwd");
+	if (softnic_parser_read_uint32(&p.n_spp, tokens[3]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "n_subports_per_port");
 		return;
 	}
 
-	p.action_mask |= 1LLU << RTE_TABLE_ACTION_FWD;
+	if (strcmp(tokens[4], "pps") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "pps");
+		return;
+	}
 
-	t0 = 8;
-	if (t0 < n_tokens &&
-		(strcmp(tokens[t0], "balance") == 0)) {
-		if (n_tokens < t0 + 7) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH, "table action profile balance");
-			return;
-		}
+	if (softnic_parser_read_uint32(&p.n_pps, tokens[5]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "n_pipes_per_subport");
+		return;
+	}
 
-		if (strcmp(tokens[t0 + 1], "offset") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
+	/* Shaper profile */
+
+	if (strcmp(tokens[6], "shaper") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "shaper");
+		return;
+	}
+
+	if (strcmp(tokens[7], "profile") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "profile");
+		return;
+	}
+
+	if (strcmp(tokens[8], "port") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.port, tokens[9]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "port profile id");
+		return;
+	}
+
+	if (strcmp(tokens[10], "subport") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "subport");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.subport, tokens[11]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "subport profile id");
+		return;
+	}
+
+	if (strcmp(tokens[12], "pipe") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "pipe");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.pipe, tokens[13]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "pipe_profile_id");
+		return;
+	}
+
+	if (strcmp(tokens[14], "tc0") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc0");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.tc[0], tokens[15]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "tc0 profile id");
+		return;
+	}
+
+	if (strcmp(tokens[16], "tc1") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc1");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.tc[1], tokens[17]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "tc1 profile id");
+		return;
+	}
+
+	if (strcmp(tokens[18], "tc2") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc2");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.tc[2], tokens[19]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "tc2 profile id");
+		return;
+	}
+
+	if (strcmp(tokens[20], "tc3") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc3");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.tc[3], tokens[21]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "tc3 profile id");
+		return;
+	}
+
+	if (strcmp(tokens[22], "tc4") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc4");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.tc[4], tokens[23]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "tc4 profile id");
+		return;
+	}
+
+	if (strcmp(tokens[24], "tc5") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc5");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.tc[5], tokens[25]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "tc5 profile id");
+		return;
+	}
+
+	if (strcmp(tokens[26], "tc6") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc6");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.tc[6], tokens[27]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "tc6 profile id");
+		return;
+	}
+
+	if (strcmp(tokens[28], "tc7") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc7");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.tc[7], tokens[29]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "tc7 profile id");
+		return;
+	}
+
+	if (strcmp(tokens[30], "tc8") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc8");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.tc[8], tokens[31]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "tc8 profile id");
+		return;
+	}
+
+	if (strcmp(tokens[32], "tc9") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc9");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.tc[9], tokens[33]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "tc9 profile id");
+		return;
+	}
+
+	if (strcmp(tokens[34], "tc10") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc10");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.tc[10], tokens[35]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "tc10 profile id");
+		return;
+	}
+
+	if (strcmp(tokens[36], "tc11") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc11");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.tc[11], tokens[37]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "tc11 profile id");
+		return;
+	}
+
+	if (strcmp(tokens[38], "tc12") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc12");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&p.shaper_profile_id.tc[12], tokens[39]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "tc12 profile id");
+		return;
+	}
+
+	/* Shared shaper */
+
+	if (strcmp(tokens[40], "shared") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "shared");
+		return;
+	}
+
+	if (strcmp(tokens[41], "shaper") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "shaper");
+		return;
+	}
+
+	if (strcmp(tokens[42], "tc0") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc0");
+		return;
+	}
+
+	if (strcmp(tokens[43], "none") == 0)
+		p.shared_shaper_id.tc_valid[0] = 0;
+	else {
+		if (softnic_parser_read_uint32(&p.shared_shaper_id.tc[0],
+			tokens[43]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "shared shaper tc0");
 			return;
 		}
 
-		if (softnic_parser_read_uint32(&p.lb.key_offset,
-			tokens[t0 + 2]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "key_offset");
+		p.shared_shaper_id.tc_valid[0] = 1;
+	}
+
+	if (strcmp(tokens[44], "tc1") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc1");
+		return;
+	}
+
+	if (strcmp(tokens[45], "none") == 0)
+		p.shared_shaper_id.tc_valid[1] = 0;
+	else {
+		if (softnic_parser_read_uint32(&p.shared_shaper_id.tc[1],
+			tokens[45]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "shared shaper tc1");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 3], "mask") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "mask");
+		p.shared_shaper_id.tc_valid[1] = 1;
+	}
+
+	if (strcmp(tokens[46], "tc2") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc2");
+		return;
+	}
+
+	if (strcmp(tokens[47], "none") == 0)
+		p.shared_shaper_id.tc_valid[2] = 0;
+	else {
+		if (softnic_parser_read_uint32(&p.shared_shaper_id.tc[2],
+			tokens[47]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "shared shaper tc2");
 			return;
 		}
 
-		p.lb.key_size = RTE_PORT_IN_ACTION_LB_KEY_SIZE_MAX;
-		if (softnic_parse_hex_string(tokens[t0 + 4],
-			p.lb.key_mask, &p.lb.key_size) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "key_mask");
+		p.shared_shaper_id.tc_valid[2] = 1;
+	}
+
+	if (strcmp(tokens[48], "tc3") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc3");
+		return;
+	}
+
+	if (strcmp(tokens[49], "none") == 0)
+		p.shared_shaper_id.tc_valid[3] = 0;
+	else {
+		if (softnic_parser_read_uint32(&p.shared_shaper_id.tc[3],
+			tokens[49]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "shared shaper tc3");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 5], "outoffset") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "outoffset");
+		p.shared_shaper_id.tc_valid[3] = 1;
+	}
+
+	if (strcmp(tokens[50], "tc4") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc4");
+		return;
+	}
+
+	if (strcmp(tokens[51], "none") == 0) {
+		p.shared_shaper_id.tc_valid[4] = 0;
+	} else {
+		if (softnic_parser_read_uint32(&p.shared_shaper_id.tc[4],
+			tokens[51]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "shared shaper tc4");
 			return;
 		}
 
-		if (softnic_parser_read_uint32(&p.lb.out_offset,
-			tokens[t0 + 6]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "out_offset");
+		p.shared_shaper_id.tc_valid[4] = 1;
+	}
+
+	if (strcmp(tokens[52], "tc5") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc5");
+		return;
+	}
+
+	if (strcmp(tokens[53], "none") == 0) {
+		p.shared_shaper_id.tc_valid[5] = 0;
+	} else {
+		if (softnic_parser_read_uint32(&p.shared_shaper_id.tc[5],
+			tokens[53]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "shared shaper tc5");
 			return;
 		}
 
-		p.action_mask |= 1LLU << RTE_TABLE_ACTION_LB;
-		t0 += 7;
-	} /* balance */
+		p.shared_shaper_id.tc_valid[5] = 1;
+	}
 
-	if (t0 < n_tokens &&
-		(strcmp(tokens[t0], "meter") == 0)) {
-		if (n_tokens < t0 + 6) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"table action profile meter");
+	if (strcmp(tokens[54], "tc6") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc6");
+		return;
+	}
+
+	if (strcmp(tokens[55], "none") == 0) {
+		p.shared_shaper_id.tc_valid[6] = 0;
+	} else {
+		if (softnic_parser_read_uint32(&p.shared_shaper_id.tc[6],
+			tokens[55]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "shared shaper tc6");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 1], "srtcm") == 0) {
-			p.mtr.alg = RTE_TABLE_ACTION_METER_SRTCM;
-		} else if (strcmp(tokens[t0 + 1], "trtcm") == 0) {
-			p.mtr.alg = RTE_TABLE_ACTION_METER_TRTCM;
-		} else {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-				"srtcm or trtcm");
+		p.shared_shaper_id.tc_valid[6] = 1;
+	}
+
+	if (strcmp(tokens[56], "tc7") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc7");
+		return;
+	}
+
+	if (strcmp(tokens[57], "none") == 0) {
+		p.shared_shaper_id.tc_valid[7] = 0;
+	} else {
+		if (softnic_parser_read_uint32(&p.shared_shaper_id.tc[7],
+			tokens[57]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "shared shaper tc7");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 2], "tc") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc");
+		p.shared_shaper_id.tc_valid[7] = 1;
+	}
+
+	if (strcmp(tokens[58], "tc8") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc8");
+		return;
+	}
+
+	if (strcmp(tokens[59], "none") == 0) {
+		p.shared_shaper_id.tc_valid[8] = 0;
+	} else {
+		if (softnic_parser_read_uint32(&p.shared_shaper_id.tc[8],
+			tokens[59]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "shared shaper tc8");
 			return;
 		}
 
-		if (softnic_parser_read_uint32(&p.mtr.n_tc,
-			tokens[t0 + 3]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "n_tc");
-			return;
-		}
-
-		if (strcmp(tokens[t0 + 4], "stats") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "stats");
-			return;
-		}
-
-		if (strcmp(tokens[t0 + 5], "none") == 0) {
-			p.mtr.n_packets_enabled = 0;
-			p.mtr.n_bytes_enabled = 0;
-		} else if (strcmp(tokens[t0 + 5], "pkts") == 0) {
-			p.mtr.n_packets_enabled = 1;
-			p.mtr.n_bytes_enabled = 0;
-		} else if (strcmp(tokens[t0 + 5], "bytes") == 0) {
-			p.mtr.n_packets_enabled = 0;
-			p.mtr.n_bytes_enabled = 1;
-		} else if (strcmp(tokens[t0 + 5], "both") == 0) {
-			p.mtr.n_packets_enabled = 1;
-			p.mtr.n_bytes_enabled = 1;
-		} else {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-				"none or pkts or bytes or both");
-			return;
-		}
-
-		p.action_mask |= 1LLU << RTE_TABLE_ACTION_MTR;
-		t0 += 6;
-	} /* meter */
-
-	if (t0 < n_tokens &&
-		(strcmp(tokens[t0], "tm") == 0)) {
-		if (n_tokens < t0 + 5) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"table action profile tm");
-			return;
-		}
-
-		if (strcmp(tokens[t0 + 1], "spp") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "spp");
-			return;
-		}
-
-		if (softnic_parser_read_uint32(&p.tm.n_subports_per_port,
-			tokens[t0 + 2]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID,
-				"n_subports_per_port");
-			return;
-		}
-
-		if (strcmp(tokens[t0 + 3], "pps") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "pps");
-			return;
-		}
-
-		if (softnic_parser_read_uint32(&p.tm.n_pipes_per_subport,
-			tokens[t0 + 4]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID,
-				"n_pipes_per_subport");
-			return;
-		}
+		p.shared_shaper_id.tc_valid[8] = 1;
+	}
 
-		p.action_mask |= 1LLU << RTE_TABLE_ACTION_TM;
-		t0 += 5;
-	} /* tm */
+	if (strcmp(tokens[60], "tc9") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc9");
+		return;
+	}
 
-	if (t0 < n_tokens &&
-		(strcmp(tokens[t0], "encap") == 0)) {
-		if (n_tokens < t0 + 2) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"action profile encap");
+	if (strcmp(tokens[61], "none") == 0) {
+		p.shared_shaper_id.tc_valid[9] = 0;
+	} else {
+		if (softnic_parser_read_uint32(&p.shared_shaper_id.tc[9],
+			tokens[61]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "shared shaper tc9");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 1], "ether") == 0) {
-			p.encap.encap_mask = 1LLU << RTE_TABLE_ACTION_ENCAP_ETHER;
-		} else if (strcmp(tokens[t0 + 1], "vlan") == 0) {
-			p.encap.encap_mask = 1LLU << RTE_TABLE_ACTION_ENCAP_VLAN;
-		} else if (strcmp(tokens[t0 + 1], "qinq") == 0) {
-			p.encap.encap_mask = 1LLU << RTE_TABLE_ACTION_ENCAP_QINQ;
-		} else if (strcmp(tokens[t0 + 1], "mpls") == 0) {
-			p.encap.encap_mask = 1LLU << RTE_TABLE_ACTION_ENCAP_MPLS;
-		} else if (strcmp(tokens[t0 + 1], "pppoe") == 0) {
-			p.encap.encap_mask = 1LLU << RTE_TABLE_ACTION_ENCAP_PPPOE;
-		} else {
-			snprintf(out, out_size, MSG_ARG_MISMATCH, "encap");
-			return;
-		}
+		p.shared_shaper_id.tc_valid[9] = 1;
+	}
 
-		p.action_mask |= 1LLU << RTE_TABLE_ACTION_ENCAP;
-		t0 += 2;
-	} /* encap */
+	if (strcmp(tokens[62], "tc10") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc10");
+		return;
+	}
 
-	if (t0 < n_tokens &&
-		(strcmp(tokens[t0], "nat") == 0)) {
-		if (n_tokens < t0 + 4) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"table action profile nat");
+	if (strcmp(tokens[63], "none") == 0) {
+		p.shared_shaper_id.tc_valid[10] = 0;
+	} else {
+		if (softnic_parser_read_uint32(&p.shared_shaper_id.tc[10],
+			tokens[63]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "shared shaper tc10");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 1], "src") == 0) {
-			p.nat.source_nat = 1;
-		} else if (strcmp(tokens[t0 + 1], "dst") == 0) {
-			p.nat.source_nat = 0;
-		} else {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-				"src or dst");
-			return;
-		}
+		p.shared_shaper_id.tc_valid[10] = 1;
+	}
 
-		if (strcmp(tokens[t0 + 2], "proto") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "proto");
-			return;
-		}
+	if (strcmp(tokens[64], "tc11") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc11");
+		return;
+	}
 
-		if (strcmp(tokens[t0 + 3], "tcp") == 0) {
-			p.nat.proto = 0x06;
-		} else if (strcmp(tokens[t0 + 3], "udp") == 0) {
-			p.nat.proto = 0x11;
-		} else {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-				"tcp or udp");
+	if (strcmp(tokens[65], "none") == 0) {
+		p.shared_shaper_id.tc_valid[11] = 0;
+	} else {
+		if (softnic_parser_read_uint32(&p.shared_shaper_id.tc[11],
+			tokens[65]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "shared shaper tc11");
 			return;
 		}
 
-		p.action_mask |= 1LLU << RTE_TABLE_ACTION_NAT;
-		t0 += 4;
-	} /* nat */
+		p.shared_shaper_id.tc_valid[11] = 1;
+	}
 
-	if (t0 < n_tokens &&
-		(strcmp(tokens[t0], "ttl") == 0)) {
-		if (n_tokens < t0 + 4) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"table action profile ttl");
-			return;
-		}
+	if (strcmp(tokens[66], "tc12") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc12");
+		return;
+	}
 
-		if (strcmp(tokens[t0 + 1], "drop") == 0) {
-			p.ttl.drop = 1;
-		} else if (strcmp(tokens[t0 + 1], "fwd") == 0) {
-			p.ttl.drop = 0;
-		} else {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-				"drop or fwd");
+	if (strcmp(tokens[67], "none") == 0) {
+		p.shared_shaper_id.tc_valid[12] = 0;
+	} else {
+		if (softnic_parser_read_uint32(&p.shared_shaper_id.tc[12],
+			tokens[67]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "shared shaper tc12");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 2], "stats") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "stats");
-			return;
-		}
+		p.shared_shaper_id.tc_valid[12] = 1;
+	}
 
-		if (strcmp(tokens[t0 + 3], "none") == 0) {
-			p.ttl.n_packets_enabled = 0;
-		} else if (strcmp(tokens[t0 + 3], "pkts") == 0) {
-			p.ttl.n_packets_enabled = 1;
-		} else {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-				"none or pkts");
-			return;
-		}
+	/* Weight */
 
-		p.action_mask |= 1LLU << RTE_TABLE_ACTION_TTL;
-		t0 += 4;
-	} /* ttl */
+	if (strcmp(tokens[68], "weight") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "weight");
+		return;
+	}
 
-	if (t0 < n_tokens &&
-		(strcmp(tokens[t0], "stats") == 0)) {
-		if (n_tokens < t0 + 2) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"table action profile stats");
-			return;
-		}
+	if (strcmp(tokens[69], "queue") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "queue");
+		return;
+	}
 
-		if (strcmp(tokens[t0 + 1], "pkts") == 0) {
-			p.stats.n_packets_enabled = 1;
-			p.stats.n_bytes_enabled = 0;
-		} else if (strcmp(tokens[t0 + 1], "bytes") == 0) {
-			p.stats.n_packets_enabled = 0;
-			p.stats.n_bytes_enabled = 1;
-		} else if (strcmp(tokens[t0 + 1], "both") == 0) {
-			p.stats.n_packets_enabled = 1;
-			p.stats.n_bytes_enabled = 1;
+	for (i = 0, j = 0; i < 16; i++) {
+		if (i < RTE_SCHED_TRAFFIC_CLASS_BE) {
+			p.weight.queue[i] = 1;
 		} else {
-			snprintf(out, out_size,	MSG_ARG_NOT_FOUND,
-				"pkts or bytes or both");
-			return;
+			if (softnic_parser_read_uint32(&p.weight.queue[i],
+				tokens[70 + j]) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "weight queue");
+				return;
+			}
+			j++;
 		}
-
-		p.action_mask |= 1LLU << RTE_TABLE_ACTION_STATS;
-		t0 += 2;
-	} /* stats */
-
-	if (t0 < n_tokens &&
-		(strcmp(tokens[t0], "time") == 0)) {
-		p.action_mask |= 1LLU << RTE_TABLE_ACTION_TIME;
-		t0 += 1;
-	} /* time */
-
-	if (t0 < n_tokens) {
-		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
-		return;
 	}
 
-	ap = softnic_table_action_profile_create(softnic, name, &p);
-	if (ap == NULL) {
+	status = tmgr_hierarchy_default(softnic, &p);
+	if (status != 0) {
 		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
 		return;
 	}
 }
 
 /**
- * pipeline <pipeline_name>
- *  period <timer_period_ms>
- *  offset_port_id <offset_port_id>
+ * tmgr hierarchy commit
  */
 static void
-cmd_pipeline(struct pmd_internals *softnic,
+cmd_tmgr_hierarchy_commit(struct pmd_internals *softnic,
 	char **tokens,
 	uint32_t n_tokens,
 	char *out,
 	size_t out_size)
 {
-	struct pipeline_params p;
-	char *name;
-	struct pipeline *pipeline;
+	struct rte_tm_error error;
+	uint16_t port_id;
+	int status;
 
-	if (n_tokens != 6) {
+	if (n_tokens != 3) {
 		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
 		return;
 	}
 
-	name = tokens[1];
-
-	if (strcmp(tokens[2], "period") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "period");
-		return;
-	}
-
-	if (softnic_parser_read_uint32(&p.timer_period_ms,
-		tokens[3]) != 0) {
-		snprintf(out, out_size, MSG_ARG_INVALID, "timer_period_ms");
+	if (strcmp(tokens[1], "hierarchy") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "hierarchy");
 		return;
 	}
 
-	if (strcmp(tokens[4], "offset_port_id") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset_port_id");
+	if (strcmp(tokens[2], "commit") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "commit");
 		return;
 	}
 
-	if (softnic_parser_read_uint32(&p.offset_port_id,
-		tokens[5]) != 0) {
-		snprintf(out, out_size, MSG_ARG_INVALID, "offset_port_id");
+	status = rte_eth_dev_get_port_by_name(softnic->params.name, &port_id);
+	if (status != 0)
 		return;
-	}
 
-	pipeline = softnic_pipeline_create(softnic, name, &p);
-	if (pipeline == NULL) {
+	status = rte_tm_hierarchy_commit(port_id, 1, &error);
+	if (status) {
 		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
 		return;
 	}
 }
 
 /**
- * pipeline <pipeline_name> port in
- *  bsz <burst_size>
- *  link <link_name> rxq <queue_id>
- *  | swq <swq_name>
- *  | tmgr <tmgr_name>
- *  | tap <tap_name> mempool <mempool_name> mtu <mtu>
- *  | source mempool <mempool_name> file <file_name> bpp <n_bytes_per_pkt>
- *  [action <port_in_action_profile_name>]
- *  [disabled]
+ * tmgr <tmgr_name>
  */
 static void
-cmd_pipeline_port_in(struct pmd_internals *softnic,
+cmd_tmgr(struct pmd_internals *softnic,
 	char **tokens,
 	uint32_t n_tokens,
 	char *out,
 	size_t out_size)
 {
-	struct softnic_port_in_params p;
-	char *pipeline_name;
-	uint32_t t0;
-	int enabled, status;
+	char *name;
+	struct softnic_tmgr_port *tmgr_port;
 
-	if (n_tokens < 7) {
+	if (n_tokens != 2) {
 		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
 		return;
 	}
 
-	pipeline_name = tokens[1];
+	name = tokens[1];
 
-	if (strcmp(tokens[2], "port") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
+	tmgr_port = softnic_tmgr_port_create(softnic, name);
+	if (tmgr_port == NULL) {
+		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
 		return;
 	}
+}
 
-	if (strcmp(tokens[3], "in") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "in");
-		return;
-	}
+/**
+ * tap <tap_name>
+ */
+static void
+cmd_tap(struct pmd_internals *softnic,
+	char **tokens,
+	uint32_t n_tokens,
+	char *out,
+	size_t out_size)
+{
+	char *name;
+	struct softnic_tap *tap;
 
-	if (strcmp(tokens[4], "bsz") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "bsz");
+	if (n_tokens != 2) {
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
 		return;
 	}
 
-	if (softnic_parser_read_uint32(&p.burst_size, tokens[5]) != 0) {
-		snprintf(out, out_size, MSG_ARG_INVALID, "burst_size");
+	name = tokens[1];
+
+	tap = softnic_tap_create(softnic, name);
+	if (tap == NULL) {
+		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
 		return;
 	}
+}
 
-	t0 = 6;
-
-	if (strcmp(tokens[t0], "link") == 0) {
-		if (n_tokens < t0 + 4) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"pipeline port in link");
-			return;
-		}
-
-		p.type = PORT_IN_RXQ;
-
-		p.dev_name = tokens[t0 + 1];
-
-		if (strcmp(tokens[t0 + 2], "rxq") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "rxq");
-			return;
-		}
-
-		if (softnic_parser_read_uint16(&p.rxq.queue_id,
-			tokens[t0 + 3]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID,
-				"queue_id");
-			return;
-		}
-		t0 += 4;
-	} else if (strcmp(tokens[t0], "swq") == 0) {
-		if (n_tokens < t0 + 2) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"pipeline port in swq");
-			return;
-		}
-
-		p.type = PORT_IN_SWQ;
-
-		p.dev_name = tokens[t0 + 1];
-
-		t0 += 2;
-	} else if (strcmp(tokens[t0], "tmgr") == 0) {
-		if (n_tokens < t0 + 2) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"pipeline port in tmgr");
-			return;
-		}
-
-		p.type = PORT_IN_TMGR;
-
-		p.dev_name = tokens[t0 + 1];
-
-		t0 += 2;
-	} else if (strcmp(tokens[t0], "tap") == 0) {
-		if (n_tokens < t0 + 6) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"pipeline port in tap");
-			return;
-		}
-
-		p.type = PORT_IN_TAP;
-
-		p.dev_name = tokens[t0 + 1];
-
-		if (strcmp(tokens[t0 + 2], "mempool") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-				"mempool");
-			return;
-		}
-
-		p.tap.mempool_name = tokens[t0 + 3];
-
-		if (strcmp(tokens[t0 + 4], "mtu") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-				"mtu");
-			return;
-		}
-
-		if (softnic_parser_read_uint32(&p.tap.mtu,
-			tokens[t0 + 5]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "mtu");
-			return;
-		}
-
-		t0 += 6;
-	} else if (strcmp(tokens[t0], "source") == 0) {
-		if (n_tokens < t0 + 6) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"pipeline port in source");
-			return;
-		}
-
-		p.type = PORT_IN_SOURCE;
-
-		p.dev_name = NULL;
-
-		if (strcmp(tokens[t0 + 1], "mempool") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-				"mempool");
-			return;
-		}
-
-		p.source.mempool_name = tokens[t0 + 2];
+/**
+ * cryptodev <tap_name> dev <device_name> | dev_id <device_id>
+ * queue <n_queues> <queue_size> max_sessions <n_sessions>
+ **/
 
-		if (strcmp(tokens[t0 + 3], "file") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-				"file");
-			return;
-		}
+static void
+cmd_cryptodev(struct pmd_internals *softnic,
+		char **tokens,
+		uint32_t n_tokens,
+		char *out,
+		size_t out_size)
+{
+	struct softnic_cryptodev_params params;
+	char *name;
 
-		p.source.file_name = tokens[t0 + 4];
+	memset(&params, 0, sizeof(params));
+	if (n_tokens != 9) {
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+		return;
+	}
 
-		if (strcmp(tokens[t0 + 5], "bpp") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-				"bpp");
-			return;
-		}
+	name = tokens[1];
 
-		if (softnic_parser_read_uint32(&p.source.n_bytes_per_pkt,
-			tokens[t0 + 6]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID,
-				"n_bytes_per_pkt");
+	if (strcmp(tokens[2], "dev") == 0)
+		params.dev_name = tokens[3];
+	else if (strcmp(tokens[2], "dev_id") == 0) {
+		if (softnic_parser_read_uint32(&params.dev_id, tokens[3]) < 0) {
+			snprintf(out, out_size,	MSG_ARG_INVALID,
+				"dev_id");
 			return;
 		}
-
-		t0 += 7;
 	} else {
-		snprintf(out, out_size, MSG_ARG_INVALID, tokens[0]);
+		snprintf(out, out_size,	MSG_ARG_INVALID,
+			"cryptodev");
 		return;
 	}
 
-	p.action_profile_name = NULL;
-	if (n_tokens > t0 &&
-		(strcmp(tokens[t0], "action") == 0)) {
-		if (n_tokens < t0 + 2) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH, "action");
-			return;
-		}
-
-		p.action_profile_name = tokens[t0 + 1];
+	if (strcmp(tokens[4], "queue")) {
+		snprintf(out, out_size,	MSG_ARG_NOT_FOUND,
+			"4");
+		return;
+	}
 
-		t0 += 2;
+	if (softnic_parser_read_uint32(&params.n_queues, tokens[5]) < 0) {
+		snprintf(out, out_size,	MSG_ARG_INVALID,
+			"q");
+		return;
 	}
 
-	enabled = 1;
-	if (n_tokens > t0 &&
-		(strcmp(tokens[t0], "disabled") == 0)) {
-		enabled = 0;
+	if (softnic_parser_read_uint32(&params.queue_size, tokens[6]) < 0) {
+		snprintf(out, out_size,	MSG_ARG_INVALID,
+			"queue_size");
+		return;
+	}
 
-		t0 += 1;
+	if (strcmp(tokens[7], "max_sessions")) {
+		snprintf(out, out_size,	MSG_ARG_NOT_FOUND,
+			"4");
+		return;
 	}
 
-	if (n_tokens != t0) {
-		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+	if (softnic_parser_read_uint32(&params.session_pool_size, tokens[8])
+			< 0) {
+		snprintf(out, out_size,	MSG_ARG_INVALID,
+			"q");
 		return;
 	}
 
-	status = softnic_pipeline_port_in_create(softnic,
-		pipeline_name,
-		&p,
-		enabled);
-	if (status) {
+	if (softnic_cryptodev_create(softnic, name, &params) == NULL) {
 		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
 		return;
 	}
 }
 
 /**
- * pipeline <pipeline_name> port out
- *  bsz <burst_size>
- *  link <link_name> txq <txq_id>
- *  | swq <swq_name>
- *  | tmgr <tmgr_name>
- *  | tap <tap_name>
- *  | sink [file <file_name> pkts <max_n_pkts>]
+ * port in action profile <profile_name>
+ *  [filter match | mismatch offset <key_offset> mask <key_mask> key <key_value> port <port_id>]
+ *  [balance offset <key_offset> mask <key_mask> port <port_id0> ... <port_id15>]
  */
 static void
-cmd_pipeline_port_out(struct pmd_internals *softnic,
+cmd_port_in_action_profile(struct pmd_internals *softnic,
 	char **tokens,
 	uint32_t n_tokens,
 	char *out,
 	size_t out_size)
 {
-	struct softnic_port_out_params p;
-	char *pipeline_name;
-	int status;
+	struct softnic_port_in_action_profile_params p;
+	struct softnic_port_in_action_profile *ap;
+	char *name;
+	uint32_t t0;
 
 	memset(&p, 0, sizeof(p));
 
-	if (n_tokens < 7) {
+	if (n_tokens < 5) {
 		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
 		return;
 	}
 
-	pipeline_name = tokens[1];
-
-	if (strcmp(tokens[2], "port") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
+	if (strcmp(tokens[1], "in") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "in");
 		return;
 	}
 
-	if (strcmp(tokens[3], "out") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "out");
+	if (strcmp(tokens[2], "action") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "action");
 		return;
 	}
 
-	if (strcmp(tokens[4], "bsz") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "bsz");
+	if (strcmp(tokens[3], "profile") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "profile");
 		return;
 	}
 
-	if (softnic_parser_read_uint32(&p.burst_size, tokens[5]) != 0) {
-		snprintf(out, out_size, MSG_ARG_INVALID, "burst_size");
-		return;
-	}
+	name = tokens[4];
 
-	if (strcmp(tokens[6], "link") == 0) {
-		if (n_tokens != 10) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"pipeline port out link");
+	t0 = 5;
+
+	if (t0 < n_tokens &&
+		(strcmp(tokens[t0], "filter") == 0)) {
+		uint32_t size;
+
+		if (n_tokens < t0 + 10) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH, "port in action profile filter");
 			return;
 		}
 
-		p.type = PORT_OUT_TXQ;
-
-		p.dev_name = tokens[7];
+		if (strcmp(tokens[t0 + 1], "match") == 0) {
+			p.fltr.filter_on_match = 1;
+		} else if (strcmp(tokens[t0 + 1], "mismatch") == 0) {
+			p.fltr.filter_on_match = 0;
+		} else {
+			snprintf(out, out_size, MSG_ARG_INVALID, "match or mismatch");
+			return;
+		}
 
-		if (strcmp(tokens[8], "txq") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "txq");
+		if (strcmp(tokens[t0 + 2], "offset") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
 			return;
 		}
 
-		if (softnic_parser_read_uint16(&p.txq.queue_id,
-			tokens[9]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "queue_id");
+		if (softnic_parser_read_uint32(&p.fltr.key_offset,
+			tokens[t0 + 3]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "key_offset");
 			return;
 		}
-	} else if (strcmp(tokens[6], "swq") == 0) {
-		if (n_tokens != 8) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"pipeline port out swq");
+
+		if (strcmp(tokens[t0 + 4], "mask") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "mask");
 			return;
 		}
 
-		p.type = PORT_OUT_SWQ;
+		size = RTE_PORT_IN_ACTION_FLTR_KEY_SIZE;
+		if ((softnic_parse_hex_string(tokens[t0 + 5],
+			p.fltr.key_mask, &size) != 0) ||
+			size != RTE_PORT_IN_ACTION_FLTR_KEY_SIZE) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "key_mask");
+			return;
+		}
 
-		p.dev_name = tokens[7];
-	} else if (strcmp(tokens[6], "tmgr") == 0) {
-		if (n_tokens != 8) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"pipeline port out tmgr");
+		if (strcmp(tokens[t0 + 6], "key") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "key");
 			return;
 		}
 
-		p.type = PORT_OUT_TMGR;
+		size = RTE_PORT_IN_ACTION_FLTR_KEY_SIZE;
+		if ((softnic_parse_hex_string(tokens[t0 + 7],
+			p.fltr.key, &size) != 0) ||
+			size != RTE_PORT_IN_ACTION_FLTR_KEY_SIZE) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "key_value");
+			return;
+		}
 
-		p.dev_name = tokens[7];
-	} else if (strcmp(tokens[6], "tap") == 0) {
-		if (n_tokens != 8) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"pipeline port out tap");
+		if (strcmp(tokens[t0 + 8], "port") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
 			return;
 		}
 
-		p.type = PORT_OUT_TAP;
+		if (softnic_parser_read_uint32(&p.fltr.port_id,
+			tokens[t0 + 9]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "port_id");
+			return;
+		}
 
-		p.dev_name = tokens[7];
-	} else if (strcmp(tokens[6], "sink") == 0) {
-		if ((n_tokens != 7) && (n_tokens != 11)) {
+		p.action_mask |= 1LLU << RTE_PORT_IN_ACTION_FLTR;
+		t0 += 10;
+	} /* filter */
+
+	if (t0 < n_tokens &&
+		(strcmp(tokens[t0], "balance") == 0)) {
+		uint32_t i;
+
+		if (n_tokens < t0 + 22) {
 			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"pipeline port out sink");
+				"port in action profile balance");
 			return;
 		}
 
-		p.type = PORT_OUT_SINK;
+		if (strcmp(tokens[t0 + 1], "offset") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
+			return;
+		}
 
-		p.dev_name = NULL;
+		if (softnic_parser_read_uint32(&p.lb.key_offset,
+			tokens[t0 + 2]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "key_offset");
+			return;
+		}
 
-		if (n_tokens == 7) {
-			p.sink.file_name = NULL;
-			p.sink.max_n_pkts = 0;
-		} else {
-			if (strcmp(tokens[7], "file") != 0) {
-				snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-					"file");
-				return;
-			}
+		if (strcmp(tokens[t0 + 3], "mask") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "mask");
+			return;
+		}
 
-			p.sink.file_name = tokens[8];
+		p.lb.key_size = RTE_PORT_IN_ACTION_LB_KEY_SIZE_MAX;
+		if (softnic_parse_hex_string(tokens[t0 + 4],
+			p.lb.key_mask, &p.lb.key_size) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "key_mask");
+			return;
+		}
 
-			if (strcmp(tokens[9], "pkts") != 0) {
-				snprintf(out, out_size, MSG_ARG_NOT_FOUND, "pkts");
-				return;
-			}
+		if (strcmp(tokens[t0 + 5], "port") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
+			return;
+		}
 
-			if (softnic_parser_read_uint32(&p.sink.max_n_pkts,
-				tokens[10]) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID, "max_n_pkts");
+		for (i = 0; i < 16; i++)
+			if (softnic_parser_read_uint32(&p.lb.port_id[i],
+			tokens[t0 + 6 + i]) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "port_id");
 				return;
 			}
-		}
-	} else {
-		snprintf(out, out_size, MSG_ARG_INVALID, tokens[0]);
+
+		p.action_mask |= 1LLU << RTE_PORT_IN_ACTION_LB;
+		t0 += 22;
+	} /* balance */
+
+	if (t0 < n_tokens) {
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
 		return;
 	}
 
-	status = softnic_pipeline_port_out_create(softnic, pipeline_name, &p);
-	if (status) {
+	ap = softnic_port_in_action_profile_create(softnic, name, &p);
+	if (ap == NULL) {
 		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
 		return;
 	}
 }
 
 /**
- * pipeline <pipeline_name> table
- *      match
- *      acl
- *          ipv4 | ipv6
- *          offset <ip_header_offset>
- *          size <n_rules>
- *      | array
- *          offset <key_offset>
- *          size <n_keys>
- *      | hash
- *          ext | lru
- *          key <key_size>
- *          mask <key_mask>
- *          offset <key_offset>
- *          buckets <n_buckets>
- *          size <n_keys>
- *      | lpm
- *          ipv4 | ipv6
- *          offset <ip_header_offset>
- *          size <n_rules>
- *      | stub
- *  [action <table_action_profile_name>]
+ * table action profile <profile_name>
+ *  ipv4 | ipv6
+ *  offset <ip_offset>
+ *  fwd
+ *  [balance offset <key_offset> mask <key_mask> outoffset <out_offset>]
+ *  [meter srtcm | trtcm
+ *      tc <n_tc>
+ *      stats none | pkts | bytes | both]
+ *  [tm spp <n_subports_per_port> pps <n_pipes_per_subport>]
+ *  [encap ether | vlan | qinq | mpls | pppoe | qinq_pppoe |
+ *      vxlan offset <ether_offset> ipv4 | ipv6 vlan on | off]
+ *  [nat src | dst
+ *      proto udp | tcp]
+ *  [ttl drop | fwd
+ *      stats none | pkts]
+ *  [stats pkts | bytes | both]
+ *  [time]
+ *  [tag]
+ *  [decap]
+ *
  */
 static void
-cmd_pipeline_table(struct pmd_internals *softnic,
+cmd_table_action_profile(struct pmd_internals *softnic,
 	char **tokens,
 	uint32_t n_tokens,
 	char *out,
 	size_t out_size)
 {
-	uint8_t key_mask[TABLE_RULE_MATCH_SIZE_MAX];
-	struct softnic_table_params p;
-	char *pipeline_name;
+	struct softnic_table_action_profile_params p;
+	struct softnic_table_action_profile *ap;
+	char *name;
 	uint32_t t0;
-	int status;
 
-	if (n_tokens < 5) {
+	memset(&p, 0, sizeof(p));
+
+	if (n_tokens < 8) {
 		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
 		return;
 	}
 
-	pipeline_name = tokens[1];
+	if (strcmp(tokens[1], "action") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "action");
+		return;
+	}
 
-	if (strcmp(tokens[2], "table") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "table");
+	if (strcmp(tokens[2], "profile") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "profile");
 		return;
 	}
 
-	if (strcmp(tokens[3], "match") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "match");
+	name = tokens[3];
+
+	if (strcmp(tokens[4], "ipv4") == 0) {
+		p.common.ip_version = 1;
+	} else if (strcmp(tokens[4], "ipv6") == 0) {
+		p.common.ip_version = 0;
+	} else {
+		snprintf(out, out_size, MSG_ARG_INVALID, "ipv4 or ipv6");
 		return;
 	}
 
-	t0 = 4;
-	if (strcmp(tokens[t0], "acl") == 0) {
-		if (n_tokens < t0 + 6) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"pipeline table acl");
-			return;
-		}
+	if (strcmp(tokens[5], "offset") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
+		return;
+	}
 
-		p.match_type = TABLE_ACL;
+	if (softnic_parser_read_uint32(&p.common.ip_offset,
+		tokens[6]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "ip_offset");
+		return;
+	}
 
-		if (strcmp(tokens[t0 + 1], "ipv4") == 0) {
-			p.match.acl.ip_version = 1;
-		} else if (strcmp(tokens[t0 + 1], "ipv6") == 0) {
-			p.match.acl.ip_version = 0;
-		} else {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-				"ipv4 or ipv6");
-			return;
-		}
+	if (strcmp(tokens[7], "fwd") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "fwd");
+		return;
+	}
 
-		if (strcmp(tokens[t0 + 2], "offset") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
-			return;
-		}
+	p.action_mask |= 1LLU << RTE_TABLE_ACTION_FWD;
 
-		if (softnic_parser_read_uint32(&p.match.acl.ip_header_offset,
-			tokens[t0 + 3]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID,
-				"ip_header_offset");
+	t0 = 8;
+	if (t0 < n_tokens &&
+		(strcmp(tokens[t0], "balance") == 0)) {
+		if (n_tokens < t0 + 7) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH, "table action profile balance");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 4], "size") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "size");
+		if (strcmp(tokens[t0 + 1], "offset") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
 			return;
 		}
 
-		if (softnic_parser_read_uint32(&p.match.acl.n_rules,
-			tokens[t0 + 5]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "n_rules");
+		if (softnic_parser_read_uint32(&p.lb.key_offset,
+			tokens[t0 + 2]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "key_offset");
 			return;
 		}
 
-		t0 += 6;
-	} else if (strcmp(tokens[t0], "array") == 0) {
-		if (n_tokens < t0 + 5) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"pipeline table array");
+		if (strcmp(tokens[t0 + 3], "mask") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "mask");
 			return;
 		}
 
-		p.match_type = TABLE_ARRAY;
-
-		if (strcmp(tokens[t0 + 1], "offset") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
+		p.lb.key_size = RTE_PORT_IN_ACTION_LB_KEY_SIZE_MAX;
+		if (softnic_parse_hex_string(tokens[t0 + 4],
+			p.lb.key_mask, &p.lb.key_size) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "key_mask");
 			return;
 		}
 
-		if (softnic_parser_read_uint32(&p.match.array.key_offset,
-			tokens[t0 + 2]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "key_offset");
+		if (strcmp(tokens[t0 + 5], "outoffset") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "outoffset");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 3], "size") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "size");
+		if (softnic_parser_read_uint32(&p.lb.out_offset,
+			tokens[t0 + 6]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "out_offset");
 			return;
 		}
 
-		if (softnic_parser_read_uint32(&p.match.array.n_keys,
-			tokens[t0 + 4]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "n_keys");
-			return;
-		}
-
-		t0 += 5;
-	} else if (strcmp(tokens[t0], "hash") == 0) {
-		uint32_t key_mask_size = TABLE_RULE_MATCH_SIZE_MAX;
+		p.action_mask |= 1LLU << RTE_TABLE_ACTION_LB;
+		t0 += 7;
+	} /* balance */
 
-		if (n_tokens < t0 + 12) {
+	if (t0 < n_tokens &&
+		(strcmp(tokens[t0], "meter") == 0)) {
+		if (n_tokens < t0 + 6) {
 			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"pipeline table hash");
+				"table action profile meter");
 			return;
 		}
 
-		p.match_type = TABLE_HASH;
-
-		if (strcmp(tokens[t0 + 1], "ext") == 0) {
-			p.match.hash.extendable_bucket = 1;
-		} else if (strcmp(tokens[t0 + 1], "lru") == 0) {
-			p.match.hash.extendable_bucket = 0;
+		if (strcmp(tokens[t0 + 1], "srtcm") == 0) {
+			p.mtr.alg = RTE_TABLE_ACTION_METER_SRTCM;
+		} else if (strcmp(tokens[t0 + 1], "trtcm") == 0) {
+			p.mtr.alg = RTE_TABLE_ACTION_METER_TRTCM;
 		} else {
 			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-				"ext or lru");
+				"srtcm or trtcm");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 2], "key") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "key");
+		if (strcmp(tokens[t0 + 2], "tc") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "tc");
 			return;
 		}
 
-		if ((softnic_parser_read_uint32(&p.match.hash.key_size,
-			tokens[t0 + 3]) != 0) ||
-			p.match.hash.key_size == 0 ||
-			p.match.hash.key_size > TABLE_RULE_MATCH_SIZE_MAX) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "key_size");
+		if (softnic_parser_read_uint32(&p.mtr.n_tc,
+			tokens[t0 + 3]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "n_tc");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 4], "mask") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "mask");
+		if (strcmp(tokens[t0 + 4], "stats") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "stats");
 			return;
 		}
 
-		if ((softnic_parse_hex_string(tokens[t0 + 5],
-			key_mask, &key_mask_size) != 0) ||
-			key_mask_size != p.match.hash.key_size) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "key_mask");
+		if (strcmp(tokens[t0 + 5], "none") == 0) {
+			p.mtr.n_packets_enabled = 0;
+			p.mtr.n_bytes_enabled = 0;
+		} else if (strcmp(tokens[t0 + 5], "pkts") == 0) {
+			p.mtr.n_packets_enabled = 1;
+			p.mtr.n_bytes_enabled = 0;
+		} else if (strcmp(tokens[t0 + 5], "bytes") == 0) {
+			p.mtr.n_packets_enabled = 0;
+			p.mtr.n_bytes_enabled = 1;
+		} else if (strcmp(tokens[t0 + 5], "both") == 0) {
+			p.mtr.n_packets_enabled = 1;
+			p.mtr.n_bytes_enabled = 1;
+		} else {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+				"none or pkts or bytes or both");
 			return;
 		}
-		p.match.hash.key_mask = key_mask;
 
-		if (strcmp(tokens[t0 + 6], "offset") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
+		p.action_mask |= 1LLU << RTE_TABLE_ACTION_MTR;
+		t0 += 6;
+	} /* meter */
+
+	if (t0 < n_tokens &&
+		(strcmp(tokens[t0], "tm") == 0)) {
+		if (n_tokens < t0 + 5) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"table action profile tm");
 			return;
 		}
 
-		if (softnic_parser_read_uint32(&p.match.hash.key_offset,
-			tokens[t0 + 7]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "key_offset");
+		if (strcmp(tokens[t0 + 1], "spp") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "spp");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 8], "buckets") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "buckets");
+		if (softnic_parser_read_uint32(&p.tm.n_subports_per_port,
+			tokens[t0 + 2]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID,
+				"n_subports_per_port");
 			return;
 		}
 
-		if (softnic_parser_read_uint32(&p.match.hash.n_buckets,
-			tokens[t0 + 9]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "n_buckets");
+		if (strcmp(tokens[t0 + 3], "pps") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "pps");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 10], "size") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "size");
+		if (softnic_parser_read_uint32(&p.tm.n_pipes_per_subport,
+			tokens[t0 + 4]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID,
+				"n_pipes_per_subport");
 			return;
 		}
 
-		if (softnic_parser_read_uint32(&p.match.hash.n_keys,
-			tokens[t0 + 11]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "n_keys");
+		p.action_mask |= 1LLU << RTE_TABLE_ACTION_TM;
+		t0 += 5;
+	} /* tm */
+
+	if (t0 < n_tokens &&
+		(strcmp(tokens[t0], "encap") == 0)) {
+		uint32_t n_extra_tokens = 0;
+
+		if (n_tokens < t0 + 2) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"action profile encap");
 			return;
 		}
 
-		t0 += 12;
-	} else if (strcmp(tokens[t0], "lpm") == 0) {
-		if (n_tokens < t0 + 6) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"pipeline table lpm");
+		if (strcmp(tokens[t0 + 1], "ether") == 0) {
+			p.encap.encap_mask = 1LLU << RTE_TABLE_ACTION_ENCAP_ETHER;
+		} else if (strcmp(tokens[t0 + 1], "vlan") == 0) {
+			p.encap.encap_mask = 1LLU << RTE_TABLE_ACTION_ENCAP_VLAN;
+		} else if (strcmp(tokens[t0 + 1], "qinq") == 0) {
+			p.encap.encap_mask = 1LLU << RTE_TABLE_ACTION_ENCAP_QINQ;
+		} else if (strcmp(tokens[t0 + 1], "mpls") == 0) {
+			p.encap.encap_mask = 1LLU << RTE_TABLE_ACTION_ENCAP_MPLS;
+		} else if (strcmp(tokens[t0 + 1], "pppoe") == 0) {
+			p.encap.encap_mask = 1LLU << RTE_TABLE_ACTION_ENCAP_PPPOE;
+		} else if (strcmp(tokens[t0 + 1], "vxlan") == 0) {
+			if (n_tokens < t0 + 2 + 5) {
+				snprintf(out, out_size, MSG_ARG_MISMATCH,
+					"action profile encap vxlan");
+				return;
+			}
+
+			if (strcmp(tokens[t0 + 2], "offset") != 0) {
+				snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+					"vxlan: offset");
+				return;
+			}
+
+			if (softnic_parser_read_uint32(&p.encap.vxlan.data_offset,
+				tokens[t0 + 2 + 1]) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID,
+					"vxlan: ether_offset");
+				return;
+			}
+
+			if (strcmp(tokens[t0 + 2 + 2], "ipv4") == 0)
+				p.encap.vxlan.ip_version = 1;
+			else if (strcmp(tokens[t0 + 2 + 2], "ipv6") == 0)
+				p.encap.vxlan.ip_version = 0;
+			else {
+				snprintf(out, out_size, MSG_ARG_INVALID,
+					"vxlan: ipv4 or ipv6");
+				return;
+			}
+
+			if (strcmp(tokens[t0 + 2 + 3], "vlan") != 0) {
+				snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+					"vxlan: vlan");
+				return;
+			}
+
+			if (strcmp(tokens[t0 + 2 + 4], "on") == 0)
+				p.encap.vxlan.vlan = 1;
+			else if (strcmp(tokens[t0 + 2 + 4], "off") == 0)
+				p.encap.vxlan.vlan = 0;
+			else {
+				snprintf(out, out_size, MSG_ARG_INVALID,
+					"vxlan: on or off");
+				return;
+			}
+
+			p.encap.encap_mask = 1LLU << RTE_TABLE_ACTION_ENCAP_VXLAN;
+			n_extra_tokens = 5;
+
+		} else if (strcmp(tokens[t0 + 1], "qinq_pppoe") == 0) {
+			p.encap.encap_mask =
+				1LLU << RTE_TABLE_ACTION_ENCAP_QINQ_PPPOE;
+		} else {
+			snprintf(out, out_size, MSG_ARG_MISMATCH, "encap");
 			return;
 		}
 
-		p.match_type = TABLE_LPM;
+		p.action_mask |= 1LLU << RTE_TABLE_ACTION_ENCAP;
+		t0 += 2 + n_extra_tokens;
+	} /* encap */
 
-		if (strcmp(tokens[t0 + 1], "ipv4") == 0) {
-			p.match.lpm.key_size = 4;
-		} else if (strcmp(tokens[t0 + 1], "ipv6") == 0) {
-			p.match.lpm.key_size = 16;
+	if (t0 < n_tokens &&
+		(strcmp(tokens[t0], "nat") == 0)) {
+		if (n_tokens < t0 + 4) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"table action profile nat");
+			return;
+		}
+
+		if (strcmp(tokens[t0 + 1], "src") == 0) {
+			p.nat.source_nat = 1;
+		} else if (strcmp(tokens[t0 + 1], "dst") == 0) {
+			p.nat.source_nat = 0;
 		} else {
 			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-				"ipv4 or ipv6");
+				"src or dst");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 2], "offset") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
+		if (strcmp(tokens[t0 + 2], "proto") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "proto");
 			return;
 		}
 
-		if (softnic_parser_read_uint32(&p.match.lpm.key_offset,
-			tokens[t0 + 3]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "key_offset");
+		if (strcmp(tokens[t0 + 3], "tcp") == 0) {
+			p.nat.proto = 0x06;
+		} else if (strcmp(tokens[t0 + 3], "udp") == 0) {
+			p.nat.proto = 0x11;
+		} else {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+				"tcp or udp");
 			return;
 		}
 
-		if (strcmp(tokens[t0 + 4], "size") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "size");
+		p.action_mask |= 1LLU << RTE_TABLE_ACTION_NAT;
+		t0 += 4;
+	} /* nat */
+
+	if (t0 < n_tokens &&
+		(strcmp(tokens[t0], "ttl") == 0)) {
+		if (n_tokens < t0 + 4) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"table action profile ttl");
 			return;
 		}
 
-		if (softnic_parser_read_uint32(&p.match.lpm.n_rules,
-			tokens[t0 + 5]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "n_rules");
+		if (strcmp(tokens[t0 + 1], "drop") == 0) {
+			p.ttl.drop = 1;
+		} else if (strcmp(tokens[t0 + 1], "fwd") == 0) {
+			p.ttl.drop = 0;
+		} else {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+				"drop or fwd");
 			return;
 		}
 
-		t0 += 6;
-	} else if (strcmp(tokens[t0], "stub") == 0) {
-		p.match_type = TABLE_STUB;
+		if (strcmp(tokens[t0 + 2], "stats") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "stats");
+			return;
+		}
 
-		t0 += 1;
-	} else {
-		snprintf(out, out_size, MSG_ARG_INVALID, tokens[0]);
-		return;
-	}
+		if (strcmp(tokens[t0 + 3], "none") == 0) {
+			p.ttl.n_packets_enabled = 0;
+		} else if (strcmp(tokens[t0 + 3], "pkts") == 0) {
+			p.ttl.n_packets_enabled = 1;
+		} else {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+				"none or pkts");
+			return;
+		}
 
-	p.action_profile_name = NULL;
-	if (n_tokens > t0 &&
-		(strcmp(tokens[t0], "action") == 0)) {
+		p.action_mask |= 1LLU << RTE_TABLE_ACTION_TTL;
+		t0 += 4;
+	} /* ttl */
+
+	if (t0 < n_tokens &&
+		(strcmp(tokens[t0], "stats") == 0)) {
 		if (n_tokens < t0 + 2) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH, "action");
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"table action profile stats");
 			return;
 		}
 
-		p.action_profile_name = tokens[t0 + 1];
+		if (strcmp(tokens[t0 + 1], "pkts") == 0) {
+			p.stats.n_packets_enabled = 1;
+			p.stats.n_bytes_enabled = 0;
+		} else if (strcmp(tokens[t0 + 1], "bytes") == 0) {
+			p.stats.n_packets_enabled = 0;
+			p.stats.n_bytes_enabled = 1;
+		} else if (strcmp(tokens[t0 + 1], "both") == 0) {
+			p.stats.n_packets_enabled = 1;
+			p.stats.n_bytes_enabled = 1;
+		} else {
+			snprintf(out, out_size,	MSG_ARG_NOT_FOUND,
+				"pkts or bytes or both");
+			return;
+		}
 
+		p.action_mask |= 1LLU << RTE_TABLE_ACTION_STATS;
 		t0 += 2;
-	}
+	} /* stats */
 
-	if (n_tokens > t0) {
+	if (t0 < n_tokens &&
+		(strcmp(tokens[t0], "time") == 0)) {
+		p.action_mask |= 1LLU << RTE_TABLE_ACTION_TIME;
+		t0 += 1;
+	} /* time */
+
+	if (t0 < n_tokens &&
+		(strcmp(tokens[t0], "tag") == 0)) {
+		p.action_mask |= 1LLU << RTE_TABLE_ACTION_TAG;
+		t0 += 1;
+	} /* tag */
+
+	if (t0 < n_tokens &&
+		(strcmp(tokens[t0], "decap") == 0)) {
+		p.action_mask |= 1LLU << RTE_TABLE_ACTION_DECAP;
+		t0 += 1;
+	} /* decap */
+
+	if (t0 < n_tokens && (strcmp(tokens[t0], "sym_crypto") == 0)) {
+		struct softnic_cryptodev *cryptodev;
+
+		if (n_tokens < t0 + 5 ||
+				strcmp(tokens[t0 + 1], "dev") ||
+				strcmp(tokens[t0 + 3], "offset")) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"table action profile sym_crypto");
+			return;
+		}
+
+		cryptodev = softnic_cryptodev_find(softnic, tokens[t0 + 2]);
+		if (cryptodev == NULL) {
+			snprintf(out, out_size, MSG_ARG_INVALID,
+				"table action profile sym_crypto");
+			return;
+		}
+
+		p.sym_crypto.cryptodev_id = cryptodev->dev_id;
+
+		if (softnic_parser_read_uint32(&p.sym_crypto.op_offset,
+				tokens[t0 + 4]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID,
+					"table action profile sym_crypto");
+			return;
+		}
+
+		p.sym_crypto.mp_create = cryptodev->mp_create;
+		p.sym_crypto.mp_init = cryptodev->mp_init;
+
+		p.action_mask |= 1LLU << RTE_TABLE_ACTION_SYM_CRYPTO;
+
+		t0 += 5;
+	} /* sym_crypto */
+
+	if (t0 < n_tokens) {
 		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
 		return;
 	}
 
-	status = softnic_pipeline_table_create(softnic, pipeline_name, &p);
-	if (status) {
+	ap = softnic_table_action_profile_create(softnic, name, &p);
+	if (ap == NULL) {
 		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
 		return;
 	}
 }
 
 /**
- * pipeline <pipeline_name> port in <port_id> table <table_id>
+ * pipeline <pipeline_name>
+ *  period <timer_period_ms>
+ *  offset_port_id <offset_port_id>
  */
 static void
-cmd_pipeline_port_in_table(struct pmd_internals *softnic,
+cmd_pipeline(struct pmd_internals *softnic,
 	char **tokens,
 	uint32_t n_tokens,
 	char *out,
 	size_t out_size)
 {
-	char *pipeline_name;
-	uint32_t port_id, table_id;
-	int status;
+	struct pipeline_params p;
+	char *name;
+	struct pipeline *pipeline;
 
-	if (n_tokens != 7) {
+	if (n_tokens != 6) {
 		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
 		return;
 	}
 
-	pipeline_name = tokens[1];
-
-	if (strcmp(tokens[2], "port") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
-		return;
-	}
+	name = tokens[1];
 
-	if (strcmp(tokens[3], "in") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "in");
+	if (strcmp(tokens[2], "period") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "period");
 		return;
 	}
 
-	if (softnic_parser_read_uint32(&port_id, tokens[4]) != 0) {
-		snprintf(out, out_size, MSG_ARG_INVALID, "port_id");
+	if (softnic_parser_read_uint32(&p.timer_period_ms,
+		tokens[3]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "timer_period_ms");
 		return;
 	}
 
-	if (strcmp(tokens[5], "table") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "table");
+	if (strcmp(tokens[4], "offset_port_id") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset_port_id");
 		return;
 	}
 
-	if (softnic_parser_read_uint32(&table_id, tokens[6]) != 0) {
-		snprintf(out, out_size, MSG_ARG_INVALID, "table_id");
+	if (softnic_parser_read_uint32(&p.offset_port_id,
+		tokens[5]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "offset_port_id");
 		return;
 	}
 
-	status = softnic_pipeline_port_in_connect_to_table(softnic,
-		pipeline_name,
-		port_id,
-		table_id);
-	if (status) {
+	pipeline = softnic_pipeline_create(softnic, name, &p);
+	if (pipeline == NULL) {
 		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
 		return;
 	}
 }
 
 /**
- * pipeline <pipeline_name> port in <port_id> stats read [clear]
+ * pipeline <pipeline_name> port in
+ *  bsz <burst_size>
+ *  link <link_name> rxq <queue_id>
+ *  | swq <swq_name>
+ *  | tmgr <tmgr_name>
+ *  | tap <tap_name> mempool <mempool_name> mtu <mtu>
+ *  | source mempool <mempool_name> file <file_name> bpp <n_bytes_per_pkt>
+ *  | cryptodev <cryptodev_name> rxq <queue_id>
+ *  [action <port_in_action_profile_name>]
+ *  [disabled]
  */
-
-#define MSG_PIPELINE_PORT_IN_STATS                         \
-	"Pkts in: %" PRIu64 "\n"                           \
-	"Pkts dropped by AH: %" PRIu64 "\n"                \
-	"Pkts dropped by other: %" PRIu64 "\n"
-
 static void
-cmd_pipeline_port_in_stats(struct pmd_internals *softnic,
+cmd_pipeline_port_in(struct pmd_internals *softnic,
 	char **tokens,
 	uint32_t n_tokens,
 	char *out,
 	size_t out_size)
 {
-	struct rte_pipeline_port_in_stats stats;
+	struct softnic_port_in_params p;
 	char *pipeline_name;
-	uint32_t port_id;
-	int clear, status;
+	uint32_t t0;
+	int enabled, status;
 
-	if (n_tokens != 7 &&
-		n_tokens != 8) {
+	memset(&p, 0, sizeof(p));
+
+	if (n_tokens < 7) {
 		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
 		return;
 	}
@@ -1538,1258 +2285,2573 @@ cmd_pipeline_port_in_stats(struct pmd_internals *softnic,
 		return;
 	}
 
-	if (softnic_parser_read_uint32(&port_id, tokens[4]) != 0) {
-		snprintf(out, out_size, MSG_ARG_INVALID, "port_id");
+	if (strcmp(tokens[4], "bsz") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "bsz");
 		return;
 	}
 
-	if (strcmp(tokens[5], "stats") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "stats");
+	if (softnic_parser_read_uint32(&p.burst_size, tokens[5]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "burst_size");
 		return;
 	}
 
-	if (strcmp(tokens[6], "read") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "read");
-		return;
-	}
+	t0 = 6;
 
-	clear = 0;
-	if (n_tokens == 8) {
-		if (strcmp(tokens[7], "clear") != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "clear");
+	if (strcmp(tokens[t0], "link") == 0) {
+		if (n_tokens < t0 + 4) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline port in link");
 			return;
 		}
 
-		clear = 1;
-	}
+		p.type = PORT_IN_RXQ;
 
-	status = softnic_pipeline_port_in_stats_read(softnic,
-		pipeline_name,
-		port_id,
-		&stats,
-		clear);
-	if (status) {
-		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
-		return;
-	}
+		strlcpy(p.dev_name, tokens[t0 + 1], sizeof(p.dev_name));
 
-	snprintf(out, out_size, MSG_PIPELINE_PORT_IN_STATS,
-		stats.stats.n_pkts_in,
-		stats.n_pkts_dropped_by_ah,
-		stats.stats.n_pkts_drop);
-}
+		if (strcmp(tokens[t0 + 2], "rxq") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "rxq");
+			return;
+		}
 
-/**
- * pipeline <pipeline_name> port in <port_id> enable
- */
-static void
-cmd_softnic_pipeline_port_in_enable(struct pmd_internals *softnic,
-	char **tokens,
-	uint32_t n_tokens,
-	char *out,
-	size_t out_size)
-{
-	char *pipeline_name;
-	uint32_t port_id;
-	int status;
+		if (softnic_parser_read_uint16(&p.rxq.queue_id,
+			tokens[t0 + 3]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID,
+				"queue_id");
+			return;
+		}
+		t0 += 4;
+	} else if (strcmp(tokens[t0], "swq") == 0) {
+		if (n_tokens < t0 + 2) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline port in swq");
+			return;
+		}
 
-	if (n_tokens != 6) {
-		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
-		return;
-	}
+		p.type = PORT_IN_SWQ;
 
-	pipeline_name = tokens[1];
+		strlcpy(p.dev_name, tokens[t0 + 1], sizeof(p.dev_name));
 
-	if (strcmp(tokens[2], "port") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
-		return;
-	}
+		t0 += 2;
+	} else if (strcmp(tokens[t0], "tmgr") == 0) {
+		if (n_tokens < t0 + 2) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline port in tmgr");
+			return;
+		}
 
-	if (strcmp(tokens[3], "in") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "in");
-		return;
-	}
+		p.type = PORT_IN_TMGR;
 
-	if (softnic_parser_read_uint32(&port_id, tokens[4]) != 0) {
-		snprintf(out, out_size, MSG_ARG_INVALID, "port_id");
-		return;
-	}
+		strlcpy(p.dev_name, tokens[t0 + 1], sizeof(p.dev_name));
 
-	if (strcmp(tokens[5], "enable") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "enable");
-		return;
-	}
+		t0 += 2;
+	} else if (strcmp(tokens[t0], "tap") == 0) {
+		if (n_tokens < t0 + 6) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline port in tap");
+			return;
+		}
 
-	status = softnic_pipeline_port_in_enable(softnic, pipeline_name, port_id);
-	if (status) {
-		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
-		return;
-	}
-}
+		p.type = PORT_IN_TAP;
 
-/**
- * pipeline <pipeline_name> port in <port_id> disable
- */
-static void
-cmd_softnic_pipeline_port_in_disable(struct pmd_internals *softnic,
-	char **tokens,
-	uint32_t n_tokens,
-	char *out,
-	size_t out_size)
-{
-	char *pipeline_name;
-	uint32_t port_id;
-	int status;
+		strlcpy(p.dev_name, tokens[t0 + 1], sizeof(p.dev_name));
 
-	if (n_tokens != 6) {
-		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
-		return;
-	}
+		if (strcmp(tokens[t0 + 2], "mempool") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+				"mempool");
+			return;
+		}
 
-	pipeline_name = tokens[1];
+		p.tap.mempool_name = tokens[t0 + 3];
 
-	if (strcmp(tokens[2], "port") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
-		return;
-	}
+		if (strcmp(tokens[t0 + 4], "mtu") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+				"mtu");
+			return;
+		}
 
-	if (strcmp(tokens[3], "in") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "in");
-		return;
-	}
+		if (softnic_parser_read_uint32(&p.tap.mtu,
+			tokens[t0 + 5]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "mtu");
+			return;
+		}
 
-	if (softnic_parser_read_uint32(&port_id, tokens[4]) != 0) {
-		snprintf(out, out_size, MSG_ARG_INVALID, "port_id");
-		return;
-	}
+		t0 += 6;
+	} else if (strcmp(tokens[t0], "source") == 0) {
+		if (n_tokens < t0 + 6) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline port in source");
+			return;
+		}
 
-	if (strcmp(tokens[5], "disable") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "disable");
-		return;
-	}
+		p.type = PORT_IN_SOURCE;
 
-	status = softnic_pipeline_port_in_disable(softnic, pipeline_name, port_id);
-	if (status) {
-		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
-		return;
-	}
-}
+		if (strcmp(tokens[t0 + 1], "mempool") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+				"mempool");
+			return;
+		}
 
-/**
- * pipeline <pipeline_name> port out <port_id> stats read [clear]
- */
-#define MSG_PIPELINE_PORT_OUT_STATS                        \
-	"Pkts in: %" PRIu64 "\n"                           \
-	"Pkts dropped by AH: %" PRIu64 "\n"                \
-	"Pkts dropped by other: %" PRIu64 "\n"
+		p.source.mempool_name = tokens[t0 + 2];
 
-static void
-cmd_pipeline_port_out_stats(struct pmd_internals *softnic,
-	char **tokens,
-	uint32_t n_tokens,
-	char *out,
-	size_t out_size)
-{
-	struct rte_pipeline_port_out_stats stats;
-	char *pipeline_name;
-	uint32_t port_id;
-	int clear, status;
+		if (strcmp(tokens[t0 + 3], "file") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+				"file");
+			return;
+		}
 
-	if (n_tokens != 7 &&
-		n_tokens != 8) {
-		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
-		return;
-	}
+		p.source.file_name = tokens[t0 + 4];
 
-	pipeline_name = tokens[1];
+		if (strcmp(tokens[t0 + 5], "bpp") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+				"bpp");
+			return;
+		}
 
-	if (strcmp(tokens[2], "port") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
-		return;
-	}
+		if (softnic_parser_read_uint32(&p.source.n_bytes_per_pkt,
+			tokens[t0 + 6]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID,
+				"n_bytes_per_pkt");
+			return;
+		}
 
-	if (strcmp(tokens[3], "out") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "out");
-		return;
-	}
+		t0 += 7;
+	} else if (strcmp(tokens[t0], "cryptodev") == 0) {
+		if (n_tokens < t0 + 3) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline port in cryptodev");
+			return;
+		}
 
-	if (softnic_parser_read_uint32(&port_id, tokens[4]) != 0) {
-		snprintf(out, out_size, MSG_ARG_INVALID, "port_id");
-		return;
-	}
+		p.type = PORT_IN_CRYPTODEV;
 
-	if (strcmp(tokens[5], "stats") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "stats");
-		return;
-	}
+		strlcpy(p.dev_name, tokens[t0 + 1], sizeof(p.dev_name));
+		if (softnic_parser_read_uint16(&p.rxq.queue_id,
+				tokens[t0 + 3]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID,
+				"rxq");
+			return;
+		}
 
-	if (strcmp(tokens[6], "read") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "read");
+		p.cryptodev.arg_callback = NULL;
+		p.cryptodev.f_callback = NULL;
+
+		t0 += 4;
+	} else {
+		snprintf(out, out_size, MSG_ARG_INVALID, tokens[0]);
 		return;
 	}
 
-	clear = 0;
-	if (n_tokens == 8) {
-		if (strcmp(tokens[7], "clear") != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "clear");
+	if (n_tokens > t0 &&
+		(strcmp(tokens[t0], "action") == 0)) {
+		if (n_tokens < t0 + 2) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH, "action");
 			return;
 		}
 
-		clear = 1;
+		strlcpy(p.action_profile_name, tokens[t0 + 1],
+			sizeof(p.action_profile_name));
+
+		t0 += 2;
 	}
 
-	status = softnic_pipeline_port_out_stats_read(softnic,
+	enabled = 1;
+	if (n_tokens > t0 &&
+		(strcmp(tokens[t0], "disabled") == 0)) {
+		enabled = 0;
+
+		t0 += 1;
+	}
+
+	if (n_tokens != t0) {
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+		return;
+	}
+
+	status = softnic_pipeline_port_in_create(softnic,
 		pipeline_name,
-		port_id,
-		&stats,
-		clear);
+		&p,
+		enabled);
 	if (status) {
 		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
 		return;
 	}
-
-	snprintf(out, out_size, MSG_PIPELINE_PORT_OUT_STATS,
-		stats.stats.n_pkts_in,
-		stats.n_pkts_dropped_by_ah,
-		stats.stats.n_pkts_drop);
 }
 
 /**
- * pipeline <pipeline_name> table <table_id> stats read [clear]
+ * pipeline <pipeline_name> port out
+ *  bsz <burst_size>
+ *  link <link_name> txq <txq_id>
+ *  | swq <swq_name>
+ *  | tmgr <tmgr_name>
+ *  | tap <tap_name>
+ *  | sink [file <file_name> pkts <max_n_pkts>]
+ *  | cryptodev <cryptodev_name> txq <txq_id> offset <crypto_op_offset>
  */
-#define MSG_PIPELINE_TABLE_STATS                                     \
-	"Pkts in: %" PRIu64 "\n"                                     \
-	"Pkts in with lookup miss: %" PRIu64 "\n"                    \
-	"Pkts in with lookup hit dropped by AH: %" PRIu64 "\n"       \
-	"Pkts in with lookup hit dropped by others: %" PRIu64 "\n"   \
-	"Pkts in with lookup miss dropped by AH: %" PRIu64 "\n"      \
-	"Pkts in with lookup miss dropped by others: %" PRIu64 "\n"
-
 static void
-cmd_pipeline_table_stats(struct pmd_internals *softnic,
+cmd_pipeline_port_out(struct pmd_internals *softnic,
 	char **tokens,
 	uint32_t n_tokens,
 	char *out,
 	size_t out_size)
 {
-	struct rte_pipeline_table_stats stats;
+	struct softnic_port_out_params p;
 	char *pipeline_name;
-	uint32_t table_id;
-	int clear, status;
+	int status;
 
-	if (n_tokens != 6 &&
-		n_tokens != 7) {
+	memset(&p, 0, sizeof(p));
+
+	if (n_tokens < 7) {
 		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
 		return;
 	}
 
 	pipeline_name = tokens[1];
 
-	if (strcmp(tokens[2], "table") != 0) {
+	if (strcmp(tokens[2], "port") != 0) {
 		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
 		return;
 	}
 
-	if (softnic_parser_read_uint32(&table_id, tokens[3]) != 0) {
-		snprintf(out, out_size, MSG_ARG_INVALID, "table_id");
+	if (strcmp(tokens[3], "out") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "out");
 		return;
 	}
 
-	if (strcmp(tokens[4], "stats") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "stats");
+	if (strcmp(tokens[4], "bsz") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "bsz");
 		return;
 	}
 
-	if (strcmp(tokens[5], "read") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "read");
+	if (softnic_parser_read_uint32(&p.burst_size, tokens[5]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "burst_size");
 		return;
 	}
 
-	clear = 0;
-	if (n_tokens == 7) {
-		if (strcmp(tokens[6], "clear") != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "clear");
+	if (strcmp(tokens[6], "link") == 0) {
+		if (n_tokens != 10) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline port out link");
 			return;
 		}
 
-		clear = 1;
-	}
+		p.type = PORT_OUT_TXQ;
 
-	status = softnic_pipeline_table_stats_read(softnic,
-		pipeline_name,
-		table_id,
-		&stats,
-		clear);
-	if (status) {
-		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
-		return;
-	}
+		strlcpy(p.dev_name, tokens[7], sizeof(p.dev_name));
 
-	snprintf(out, out_size, MSG_PIPELINE_TABLE_STATS,
-		stats.stats.n_pkts_in,
-		stats.stats.n_pkts_lookup_miss,
-		stats.n_pkts_dropped_by_lkp_hit_ah,
-		stats.n_pkts_dropped_lkp_hit,
-		stats.n_pkts_dropped_by_lkp_miss_ah,
-		stats.n_pkts_dropped_lkp_miss);
-}
+		if (strcmp(tokens[8], "txq") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "txq");
+			return;
+		}
 
-/**
- * <match> ::=
- *
- * match
- *    acl
- *       priority <priority>
- *       ipv4 | ipv6 <sa> <sa_depth> <da> <da_depth>
- *       <sp0> <sp1> <dp0> <dp1> <proto>
- *    | array <pos>
- *    | hash
- *       raw <key>
- *       | ipv4_5tuple <sa> <da> <sp> <dp> <proto>
- *       | ipv6_5tuple <sa> <da> <sp> <dp> <proto>
- *       | ipv4_addr <addr>
- *       | ipv6_addr <addr>
- *       | qinq <svlan> <cvlan>
- *    | lpm
- *       ipv4 | ipv6 <addr> <depth>
- */
-struct pkt_key_qinq {
-	uint16_t ethertype_svlan;
-	uint16_t svlan;
-	uint16_t ethertype_cvlan;
-	uint16_t cvlan;
-} __attribute__((__packed__));
+		if (softnic_parser_read_uint16(&p.txq.queue_id,
+			tokens[9]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "queue_id");
+			return;
+		}
+	} else if (strcmp(tokens[6], "swq") == 0) {
+		if (n_tokens != 8) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline port out swq");
+			return;
+		}
 
-struct pkt_key_ipv4_5tuple {
-	uint8_t time_to_live;
-	uint8_t proto;
-	uint16_t hdr_checksum;
-	uint32_t sa;
-	uint32_t da;
-	uint16_t sp;
-	uint16_t dp;
-} __attribute__((__packed__));
-
-struct pkt_key_ipv6_5tuple {
-	uint16_t payload_length;
-	uint8_t proto;
-	uint8_t hop_limit;
-	uint8_t sa[16];
-	uint8_t da[16];
-	uint16_t sp;
-	uint16_t dp;
-} __attribute__((__packed__));
-
-struct pkt_key_ipv4_addr {
-	uint32_t addr;
-} __attribute__((__packed__));
-
-struct pkt_key_ipv6_addr {
-	uint8_t addr[16];
-} __attribute__((__packed__));
-
-static uint32_t
-parse_match(char **tokens,
-	uint32_t n_tokens,
-	char *out,
-	size_t out_size,
-	struct softnic_table_rule_match *m)
-{
-	memset(m, 0, sizeof(*m));
-
-	if (n_tokens < 2)
-		return 0;
-
-	if (strcmp(tokens[0], "match") != 0) {
-		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "match");
-		return 0;
-	}
+		p.type = PORT_OUT_SWQ;
 
-	if (strcmp(tokens[1], "acl") == 0) {
-		if (n_tokens < 14) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
-			return 0;
+		strlcpy(p.dev_name, tokens[7], sizeof(p.dev_name));
+	} else if (strcmp(tokens[6], "tmgr") == 0) {
+		if (n_tokens != 8) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline port out tmgr");
+			return;
 		}
 
-		m->match_type = TABLE_ACL;
-
-		if (strcmp(tokens[2], "priority") != 0) {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "priority");
-			return 0;
-		}
+		p.type = PORT_OUT_TMGR;
 
-		if (softnic_parser_read_uint32(&m->match.acl.priority,
-			tokens[3]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "priority");
-			return 0;
+		strlcpy(p.dev_name, tokens[7], sizeof(p.dev_name));
+	} else if (strcmp(tokens[6], "tap") == 0) {
+		if (n_tokens != 8) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline port out tap");
+			return;
 		}
 
-		if (strcmp(tokens[4], "ipv4") == 0) {
-			struct in_addr saddr, daddr;
+		p.type = PORT_OUT_TAP;
 
-			m->match.acl.ip_version = 1;
+		strlcpy(p.dev_name, tokens[7], sizeof(p.dev_name));
+	} else if (strcmp(tokens[6], "sink") == 0) {
+		if ((n_tokens != 7) && (n_tokens != 11)) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline port out sink");
+			return;
+		}
 
-			if (softnic_parse_ipv4_addr(tokens[5], &saddr) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID, "sa");
-				return 0;
-			}
-			m->match.acl.ipv4.sa = rte_be_to_cpu_32(saddr.s_addr);
+		p.type = PORT_OUT_SINK;
 
-			if (softnic_parse_ipv4_addr(tokens[7], &daddr) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID, "da");
-				return 0;
+		if (n_tokens == 7) {
+			p.sink.file_name = NULL;
+			p.sink.max_n_pkts = 0;
+		} else {
+			if (strcmp(tokens[7], "file") != 0) {
+				snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+					"file");
+				return;
 			}
-			m->match.acl.ipv4.da = rte_be_to_cpu_32(daddr.s_addr);
-		} else if (strcmp(tokens[4], "ipv6") == 0) {
-			struct in6_addr saddr, daddr;
 
-			m->match.acl.ip_version = 0;
+			p.sink.file_name = tokens[8];
 
-			if (softnic_parse_ipv6_addr(tokens[5], &saddr) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID, "sa");
-				return 0;
+			if (strcmp(tokens[9], "pkts") != 0) {
+				snprintf(out, out_size, MSG_ARG_NOT_FOUND, "pkts");
+				return;
 			}
-			memcpy(m->match.acl.ipv6.sa, saddr.s6_addr, 16);
 
-			if (softnic_parse_ipv6_addr(tokens[7], &daddr) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID, "da");
-				return 0;
+			if (softnic_parser_read_uint32(&p.sink.max_n_pkts,
+				tokens[10]) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "max_n_pkts");
+				return;
 			}
-			memcpy(m->match.acl.ipv6.da, daddr.s6_addr, 16);
-		} else {
-			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
-				"ipv4 or ipv6");
-			return 0;
 		}
-
-		if (softnic_parser_read_uint32(&m->match.acl.sa_depth,
-			tokens[6]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "sa_depth");
-			return 0;
+	} else if (strcmp(tokens[6], "cryptodev") == 0) {
+		if (n_tokens != 12) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline port out cryptodev");
+			return;
 		}
 
-		if (softnic_parser_read_uint32(&m->match.acl.da_depth,
-			tokens[8]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "da_depth");
-			return 0;
-		}
+		p.type = PORT_OUT_CRYPTODEV;
 
-		if (softnic_parser_read_uint16(&m->match.acl.sp0, tokens[9]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "sp0");
-			return 0;
-		}
+		strlcpy(p.dev_name, tokens[7], sizeof(p.dev_name));
 
-		if (softnic_parser_read_uint16(&m->match.acl.sp1, tokens[10]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "sp1");
-			return 0;
+		if (strcmp(tokens[8], "txq")) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline port out cryptodev");
+			return;
 		}
 
-		if (softnic_parser_read_uint16(&m->match.acl.dp0, tokens[11]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "dp0");
-			return 0;
+		if (softnic_parser_read_uint16(&p.cryptodev.queue_id, tokens[9])
+				!= 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "queue_id");
+			return;
 		}
 
-		if (softnic_parser_read_uint16(&m->match.acl.dp1, tokens[12]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "dp1");
-			return 0;
+		if (strcmp(tokens[10], "offset")) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline port out cryptodev");
+			return;
 		}
 
-		if (softnic_parser_read_uint8(&m->match.acl.proto, tokens[13]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "proto");
-			return 0;
+		if (softnic_parser_read_uint32(&p.cryptodev.op_offset,
+				tokens[11]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "queue_id");
+			return;
 		}
+	} else {
+		snprintf(out, out_size, MSG_ARG_INVALID, tokens[0]);
+		return;
+	}
 
-		m->match.acl.proto_mask = 0xff;
+	status = softnic_pipeline_port_out_create(softnic, pipeline_name, &p);
+	if (status) {
+		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
+		return;
+	}
+}
 
-		return 14;
-	} /* acl */
+/**
+ * pipeline <pipeline_name> table
+ *      match
+ *      acl
+ *          ipv4 | ipv6
+ *          offset <ip_header_offset>
+ *          size <n_rules>
+ *      | array
+ *          offset <key_offset>
+ *          size <n_keys>
+ *      | hash
+ *          ext | lru
+ *          key <key_size>
+ *          mask <key_mask>
+ *          offset <key_offset>
+ *          buckets <n_buckets>
+ *          size <n_keys>
+ *      | lpm
+ *          ipv4 | ipv6
+ *          offset <ip_header_offset>
+ *          size <n_rules>
+ *      | stub
+ *  [action <table_action_profile_name>]
+ */
+static void
+cmd_pipeline_table(struct pmd_internals *softnic,
+	char **tokens,
+	uint32_t n_tokens,
+	char *out,
+	size_t out_size)
+{
+	struct softnic_table_params p;
+	char *pipeline_name;
+	uint32_t t0;
+	int status;
 
-	if (strcmp(tokens[1], "array") == 0) {
-		if (n_tokens < 3) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
-			return 0;
-		}
+	memset(&p, 0, sizeof(p));
 
-		m->match_type = TABLE_ARRAY;
+	if (n_tokens < 5) {
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+		return;
+	}
 
-		if (softnic_parser_read_uint32(&m->match.array.pos, tokens[2]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "pos");
-			return 0;
-		}
+	pipeline_name = tokens[1];
 
-		return 3;
-	} /* array */
+	if (strcmp(tokens[2], "table") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "table");
+		return;
+	}
 
-	if (strcmp(tokens[1], "hash") == 0) {
-		if (n_tokens < 3) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
-			return 0;
+	if (strcmp(tokens[3], "match") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "match");
+		return;
+	}
+
+	t0 = 4;
+	if (strcmp(tokens[t0], "acl") == 0) {
+		if (n_tokens < t0 + 6) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline table acl");
+			return;
 		}
 
-		m->match_type = TABLE_HASH;
+		p.match_type = TABLE_ACL;
 
-		if (strcmp(tokens[2], "raw") == 0) {
-			uint32_t key_size = TABLE_RULE_MATCH_SIZE_MAX;
+		if (strcmp(tokens[t0 + 1], "ipv4") == 0) {
+			p.match.acl.ip_version = 1;
+		} else if (strcmp(tokens[t0 + 1], "ipv6") == 0) {
+			p.match.acl.ip_version = 0;
+		} else {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+				"ipv4 or ipv6");
+			return;
+		}
 
-			if (n_tokens < 4) {
-				snprintf(out, out_size, MSG_ARG_MISMATCH,
-					tokens[0]);
-				return 0;
-			}
-
-			if (softnic_parse_hex_string(tokens[3],
-				m->match.hash.key, &key_size) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID, "key");
-				return 0;
-			}
+		if (strcmp(tokens[t0 + 2], "offset") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
+			return;
+		}
 
-			return 4;
-		} /* hash raw */
+		if (softnic_parser_read_uint32(&p.match.acl.ip_header_offset,
+			tokens[t0 + 3]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID,
+				"ip_header_offset");
+			return;
+		}
 
-		if (strcmp(tokens[2], "ipv4_5tuple") == 0) {
-			struct pkt_key_ipv4_5tuple *ipv4 =
-				(struct pkt_key_ipv4_5tuple *)m->match.hash.key;
-			struct in_addr saddr, daddr;
-			uint16_t sp, dp;
-			uint8_t proto;
+		if (strcmp(tokens[t0 + 4], "size") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "size");
+			return;
+		}
 
-			if (n_tokens < 8) {
-				snprintf(out, out_size, MSG_ARG_MISMATCH,
-					tokens[0]);
-				return 0;
-			}
+		if (softnic_parser_read_uint32(&p.match.acl.n_rules,
+			tokens[t0 + 5]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "n_rules");
+			return;
+		}
 
-			if (softnic_parse_ipv4_addr(tokens[3], &saddr) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID, "sa");
-				return 0;
-			}
+		t0 += 6;
+	} else if (strcmp(tokens[t0], "array") == 0) {
+		if (n_tokens < t0 + 5) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline table array");
+			return;
+		}
 
-			if (softnic_parse_ipv4_addr(tokens[4], &daddr) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID, "da");
-				return 0;
-			}
+		p.match_type = TABLE_ARRAY;
 
-			if (softnic_parser_read_uint16(&sp, tokens[5]) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID, "sp");
-				return 0;
-			}
+		if (strcmp(tokens[t0 + 1], "offset") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
+			return;
+		}
 
-			if (softnic_parser_read_uint16(&dp, tokens[6]) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID, "dp");
-				return 0;
-			}
+		if (softnic_parser_read_uint32(&p.match.array.key_offset,
+			tokens[t0 + 2]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "key_offset");
+			return;
+		}
 
-			if (softnic_parser_read_uint8(&proto, tokens[7]) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID,
-					"proto");
-				return 0;
-			}
+		if (strcmp(tokens[t0 + 3], "size") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "size");
+			return;
+		}
 
-			ipv4->sa = saddr.s_addr;
-			ipv4->da = daddr.s_addr;
-			ipv4->sp = rte_cpu_to_be_16(sp);
-			ipv4->dp = rte_cpu_to_be_16(dp);
-			ipv4->proto = proto;
+		if (softnic_parser_read_uint32(&p.match.array.n_keys,
+			tokens[t0 + 4]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "n_keys");
+			return;
+		}
 
-			return 8;
-		} /* hash ipv4_5tuple */
+		t0 += 5;
+	} else if (strcmp(tokens[t0], "hash") == 0) {
+		uint32_t key_mask_size = TABLE_RULE_MATCH_SIZE_MAX;
 
-		if (strcmp(tokens[2], "ipv6_5tuple") == 0) {
-			struct pkt_key_ipv6_5tuple *ipv6 =
-				(struct pkt_key_ipv6_5tuple *)m->match.hash.key;
-			struct in6_addr saddr, daddr;
-			uint16_t sp, dp;
-			uint8_t proto;
+		if (n_tokens < t0 + 12) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline table hash");
+			return;
+		}
 
-			if (n_tokens < 8) {
-				snprintf(out, out_size, MSG_ARG_MISMATCH,
-					tokens[0]);
-				return 0;
-			}
+		p.match_type = TABLE_HASH;
 
-			if (softnic_parse_ipv6_addr(tokens[3], &saddr) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID, "sa");
-				return 0;
-			}
+		if (strcmp(tokens[t0 + 1], "ext") == 0) {
+			p.match.hash.extendable_bucket = 1;
+		} else if (strcmp(tokens[t0 + 1], "lru") == 0) {
+			p.match.hash.extendable_bucket = 0;
+		} else {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+				"ext or lru");
+			return;
+		}
 
-			if (softnic_parse_ipv6_addr(tokens[4], &daddr) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID, "da");
-				return 0;
-			}
+		if (strcmp(tokens[t0 + 2], "key") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "key");
+			return;
+		}
 
-			if (softnic_parser_read_uint16(&sp, tokens[5]) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID, "sp");
-				return 0;
-			}
+		if ((softnic_parser_read_uint32(&p.match.hash.key_size,
+			tokens[t0 + 3]) != 0) ||
+			p.match.hash.key_size == 0 ||
+			p.match.hash.key_size > TABLE_RULE_MATCH_SIZE_MAX) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "key_size");
+			return;
+		}
 
-			if (softnic_parser_read_uint16(&dp, tokens[6]) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID, "dp");
-				return 0;
-			}
+		if (strcmp(tokens[t0 + 4], "mask") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "mask");
+			return;
+		}
 
-			if (softnic_parser_read_uint8(&proto, tokens[7]) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID,
-					"proto");
-				return 0;
-			}
+		if ((softnic_parse_hex_string(tokens[t0 + 5],
+			p.match.hash.key_mask, &key_mask_size) != 0) ||
+			key_mask_size != p.match.hash.key_size) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "key_mask");
+			return;
+		}
 
-			memcpy(ipv6->sa, saddr.s6_addr, 16);
-			memcpy(ipv6->da, daddr.s6_addr, 16);
-			ipv6->sp = rte_cpu_to_be_16(sp);
-			ipv6->dp = rte_cpu_to_be_16(dp);
-			ipv6->proto = proto;
+		if (strcmp(tokens[t0 + 6], "offset") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
+			return;
+		}
 
-			return 8;
-		} /* hash ipv6_5tuple */
+		if (softnic_parser_read_uint32(&p.match.hash.key_offset,
+			tokens[t0 + 7]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "key_offset");
+			return;
+		}
 
-		if (strcmp(tokens[2], "ipv4_addr") == 0) {
-			struct pkt_key_ipv4_addr *ipv4_addr =
-				(struct pkt_key_ipv4_addr *)m->match.hash.key;
-			struct in_addr addr;
+		if (strcmp(tokens[t0 + 8], "buckets") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "buckets");
+			return;
+		}
 
-			if (n_tokens < 4) {
-				snprintf(out, out_size, MSG_ARG_MISMATCH,
-					tokens[0]);
-				return 0;
-			}
+		if (softnic_parser_read_uint32(&p.match.hash.n_buckets,
+			tokens[t0 + 9]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "n_buckets");
+			return;
+		}
 
-			if (softnic_parse_ipv4_addr(tokens[3], &addr) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID,
-					"addr");
-				return 0;
-			}
+		if (strcmp(tokens[t0 + 10], "size") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "size");
+			return;
+		}
 
-			ipv4_addr->addr = addr.s_addr;
+		if (softnic_parser_read_uint32(&p.match.hash.n_keys,
+			tokens[t0 + 11]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "n_keys");
+			return;
+		}
 
-			return 4;
-		} /* hash ipv4_addr */
+		t0 += 12;
+	} else if (strcmp(tokens[t0], "lpm") == 0) {
+		if (n_tokens < t0 + 6) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"pipeline table lpm");
+			return;
+		}
 
-		if (strcmp(tokens[2], "ipv6_addr") == 0) {
-			struct pkt_key_ipv6_addr *ipv6_addr =
-				(struct pkt_key_ipv6_addr *)m->match.hash.key;
-			struct in6_addr addr;
+		p.match_type = TABLE_LPM;
 
-			if (n_tokens < 4) {
-				snprintf(out, out_size, MSG_ARG_MISMATCH,
-					tokens[0]);
-				return 0;
-			}
+		if (strcmp(tokens[t0 + 1], "ipv4") == 0) {
+			p.match.lpm.key_size = 4;
+		} else if (strcmp(tokens[t0 + 1], "ipv6") == 0) {
+			p.match.lpm.key_size = 16;
+		} else {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+				"ipv4 or ipv6");
+			return;
+		}
 
-			if (softnic_parse_ipv6_addr(tokens[3], &addr) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID,
-					"addr");
-				return 0;
-			}
+		if (strcmp(tokens[t0 + 2], "offset") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "offset");
+			return;
+		}
 
-			memcpy(ipv6_addr->addr, addr.s6_addr, 16);
+		if (softnic_parser_read_uint32(&p.match.lpm.key_offset,
+			tokens[t0 + 3]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "key_offset");
+			return;
+		}
+
+		if (strcmp(tokens[t0 + 4], "size") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "size");
+			return;
+		}
+
+		if (softnic_parser_read_uint32(&p.match.lpm.n_rules,
+			tokens[t0 + 5]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "n_rules");
+			return;
+		}
+
+		t0 += 6;
+	} else if (strcmp(tokens[t0], "stub") == 0) {
+		p.match_type = TABLE_STUB;
+
+		t0 += 1;
+	} else {
+		snprintf(out, out_size, MSG_ARG_INVALID, tokens[0]);
+		return;
+	}
+
+	if (n_tokens > t0 &&
+		(strcmp(tokens[t0], "action") == 0)) {
+		if (n_tokens < t0 + 2) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH, "action");
+			return;
+		}
+
+		strlcpy(p.action_profile_name, tokens[t0 + 1],
+			sizeof(p.action_profile_name));
+
+		t0 += 2;
+	}
+
+	if (n_tokens > t0) {
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+		return;
+	}
+
+	status = softnic_pipeline_table_create(softnic, pipeline_name, &p);
+	if (status) {
+		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
+		return;
+	}
+}
+
+/**
+ * pipeline <pipeline_name> port in <port_id> table <table_id>
+ */
+static void
+cmd_pipeline_port_in_table(struct pmd_internals *softnic,
+	char **tokens,
+	uint32_t n_tokens,
+	char *out,
+	size_t out_size)
+{
+	char *pipeline_name;
+	uint32_t port_id, table_id;
+	int status;
+
+	if (n_tokens != 7) {
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+		return;
+	}
+
+	pipeline_name = tokens[1];
+
+	if (strcmp(tokens[2], "port") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
+		return;
+	}
+
+	if (strcmp(tokens[3], "in") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "in");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&port_id, tokens[4]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "port_id");
+		return;
+	}
+
+	if (strcmp(tokens[5], "table") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "table");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&table_id, tokens[6]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "table_id");
+		return;
+	}
+
+	status = softnic_pipeline_port_in_connect_to_table(softnic,
+		pipeline_name,
+		port_id,
+		table_id);
+	if (status) {
+		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
+		return;
+	}
+}
+
+/**
+ * pipeline <pipeline_name> port in <port_id> stats read [clear]
+ */
+
+#define MSG_PIPELINE_PORT_IN_STATS                         \
+	"Pkts in: %" PRIu64 "\n"                           \
+	"Pkts dropped by AH: %" PRIu64 "\n"                \
+	"Pkts dropped by other: %" PRIu64 "\n"
+
+static void
+cmd_pipeline_port_in_stats(struct pmd_internals *softnic,
+	char **tokens,
+	uint32_t n_tokens,
+	char *out,
+	size_t out_size)
+{
+	struct rte_pipeline_port_in_stats stats;
+	char *pipeline_name;
+	uint32_t port_id;
+	int clear, status;
+
+	if (n_tokens != 7 &&
+		n_tokens != 8) {
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+		return;
+	}
+
+	pipeline_name = tokens[1];
+
+	if (strcmp(tokens[2], "port") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
+		return;
+	}
+
+	if (strcmp(tokens[3], "in") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "in");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&port_id, tokens[4]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "port_id");
+		return;
+	}
+
+	if (strcmp(tokens[5], "stats") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "stats");
+		return;
+	}
+
+	if (strcmp(tokens[6], "read") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "read");
+		return;
+	}
+
+	clear = 0;
+	if (n_tokens == 8) {
+		if (strcmp(tokens[7], "clear") != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "clear");
+			return;
+		}
+
+		clear = 1;
+	}
+
+	status = softnic_pipeline_port_in_stats_read(softnic,
+		pipeline_name,
+		port_id,
+		&stats,
+		clear);
+	if (status) {
+		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
+		return;
+	}
+
+	snprintf(out, out_size, MSG_PIPELINE_PORT_IN_STATS,
+		stats.stats.n_pkts_in,
+		stats.n_pkts_dropped_by_ah,
+		stats.stats.n_pkts_drop);
+}
+
+/**
+ * pipeline <pipeline_name> port in <port_id> enable
+ */
+static void
+cmd_softnic_pipeline_port_in_enable(struct pmd_internals *softnic,
+	char **tokens,
+	uint32_t n_tokens,
+	char *out,
+	size_t out_size)
+{
+	char *pipeline_name;
+	uint32_t port_id;
+	int status;
+
+	if (n_tokens != 6) {
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+		return;
+	}
+
+	pipeline_name = tokens[1];
+
+	if (strcmp(tokens[2], "port") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
+		return;
+	}
+
+	if (strcmp(tokens[3], "in") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "in");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&port_id, tokens[4]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "port_id");
+		return;
+	}
+
+	if (strcmp(tokens[5], "enable") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "enable");
+		return;
+	}
+
+	status = softnic_pipeline_port_in_enable(softnic, pipeline_name, port_id);
+	if (status) {
+		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
+		return;
+	}
+}
+
+/**
+ * pipeline <pipeline_name> port in <port_id> disable
+ */
+static void
+cmd_softnic_pipeline_port_in_disable(struct pmd_internals *softnic,
+	char **tokens,
+	uint32_t n_tokens,
+	char *out,
+	size_t out_size)
+{
+	char *pipeline_name;
+	uint32_t port_id;
+	int status;
+
+	if (n_tokens != 6) {
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+		return;
+	}
+
+	pipeline_name = tokens[1];
+
+	if (strcmp(tokens[2], "port") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
+		return;
+	}
+
+	if (strcmp(tokens[3], "in") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "in");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&port_id, tokens[4]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "port_id");
+		return;
+	}
+
+	if (strcmp(tokens[5], "disable") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "disable");
+		return;
+	}
+
+	status = softnic_pipeline_port_in_disable(softnic, pipeline_name, port_id);
+	if (status) {
+		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
+		return;
+	}
+}
+
+/**
+ * pipeline <pipeline_name> port out <port_id> stats read [clear]
+ */
+#define MSG_PIPELINE_PORT_OUT_STATS                        \
+	"Pkts in: %" PRIu64 "\n"                           \
+	"Pkts dropped by AH: %" PRIu64 "\n"                \
+	"Pkts dropped by other: %" PRIu64 "\n"
+
+static void
+cmd_pipeline_port_out_stats(struct pmd_internals *softnic,
+	char **tokens,
+	uint32_t n_tokens,
+	char *out,
+	size_t out_size)
+{
+	struct rte_pipeline_port_out_stats stats;
+	char *pipeline_name;
+	uint32_t port_id;
+	int clear, status;
+
+	if (n_tokens != 7 &&
+		n_tokens != 8) {
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+		return;
+	}
+
+	pipeline_name = tokens[1];
+
+	if (strcmp(tokens[2], "port") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
+		return;
+	}
+
+	if (strcmp(tokens[3], "out") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "out");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&port_id, tokens[4]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "port_id");
+		return;
+	}
+
+	if (strcmp(tokens[5], "stats") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "stats");
+		return;
+	}
+
+	if (strcmp(tokens[6], "read") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "read");
+		return;
+	}
+
+	clear = 0;
+	if (n_tokens == 8) {
+		if (strcmp(tokens[7], "clear") != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "clear");
+			return;
+		}
+
+		clear = 1;
+	}
+
+	status = softnic_pipeline_port_out_stats_read(softnic,
+		pipeline_name,
+		port_id,
+		&stats,
+		clear);
+	if (status) {
+		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
+		return;
+	}
+
+	snprintf(out, out_size, MSG_PIPELINE_PORT_OUT_STATS,
+		stats.stats.n_pkts_in,
+		stats.n_pkts_dropped_by_ah,
+		stats.stats.n_pkts_drop);
+}
+
+/**
+ * pipeline <pipeline_name> table <table_id> stats read [clear]
+ */
+#define MSG_PIPELINE_TABLE_STATS                                     \
+	"Pkts in: %" PRIu64 "\n"                                     \
+	"Pkts in with lookup miss: %" PRIu64 "\n"                    \
+	"Pkts in with lookup hit dropped by AH: %" PRIu64 "\n"       \
+	"Pkts in with lookup hit dropped by others: %" PRIu64 "\n"   \
+	"Pkts in with lookup miss dropped by AH: %" PRIu64 "\n"      \
+	"Pkts in with lookup miss dropped by others: %" PRIu64 "\n"
+
+static void
+cmd_pipeline_table_stats(struct pmd_internals *softnic,
+	char **tokens,
+	uint32_t n_tokens,
+	char *out,
+	size_t out_size)
+{
+	struct rte_pipeline_table_stats stats;
+	char *pipeline_name;
+	uint32_t table_id;
+	int clear, status;
+
+	if (n_tokens != 6 &&
+		n_tokens != 7) {
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+		return;
+	}
+
+	pipeline_name = tokens[1];
+
+	if (strcmp(tokens[2], "table") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "port");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&table_id, tokens[3]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "table_id");
+		return;
+	}
+
+	if (strcmp(tokens[4], "stats") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "stats");
+		return;
+	}
+
+	if (strcmp(tokens[5], "read") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "read");
+		return;
+	}
+
+	clear = 0;
+	if (n_tokens == 7) {
+		if (strcmp(tokens[6], "clear") != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "clear");
+			return;
+		}
+
+		clear = 1;
+	}
+
+	status = softnic_pipeline_table_stats_read(softnic,
+		pipeline_name,
+		table_id,
+		&stats,
+		clear);
+	if (status) {
+		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
+		return;
+	}
+
+	snprintf(out, out_size, MSG_PIPELINE_TABLE_STATS,
+		stats.stats.n_pkts_in,
+		stats.stats.n_pkts_lookup_miss,
+		stats.n_pkts_dropped_by_lkp_hit_ah,
+		stats.n_pkts_dropped_lkp_hit,
+		stats.n_pkts_dropped_by_lkp_miss_ah,
+		stats.n_pkts_dropped_lkp_miss);
+}
+
+/**
+ * <match> ::=
+ *
+ * match
+ *    acl
+ *       priority <priority>
+ *       ipv4 | ipv6 <sa> <sa_depth> <da> <da_depth>
+ *       <sp0> <sp1> <dp0> <dp1> <proto>
+ *    | array <pos>
+ *    | hash
+ *       raw <key>
+ *       | ipv4_5tuple <sa> <da> <sp> <dp> <proto>
+ *       | ipv6_5tuple <sa> <da> <sp> <dp> <proto>
+ *       | ipv4_addr <addr>
+ *       | ipv6_addr <addr>
+ *       | qinq <svlan> <cvlan>
+ *    | lpm
+ *       ipv4 | ipv6 <addr> <depth>
+ */
+struct pkt_key_qinq {
+	uint16_t ethertype_svlan;
+	uint16_t svlan;
+	uint16_t ethertype_cvlan;
+	uint16_t cvlan;
+} __attribute__((__packed__));
+
+struct pkt_key_ipv4_5tuple {
+	uint8_t time_to_live;
+	uint8_t proto;
+	uint16_t hdr_checksum;
+	uint32_t sa;
+	uint32_t da;
+	uint16_t sp;
+	uint16_t dp;
+} __attribute__((__packed__));
+
+struct pkt_key_ipv6_5tuple {
+	uint16_t payload_length;
+	uint8_t proto;
+	uint8_t hop_limit;
+	uint8_t sa[16];
+	uint8_t da[16];
+	uint16_t sp;
+	uint16_t dp;
+} __attribute__((__packed__));
+
+struct pkt_key_ipv4_addr {
+	uint32_t addr;
+} __attribute__((__packed__));
+
+struct pkt_key_ipv6_addr {
+	uint8_t addr[16];
+} __attribute__((__packed__));
+
+static uint32_t
+parse_match(char **tokens,
+	uint32_t n_tokens,
+	char *out,
+	size_t out_size,
+	struct softnic_table_rule_match *m)
+{
+	memset(m, 0, sizeof(*m));
+
+	if (n_tokens < 2)
+		return 0;
+
+	if (strcmp(tokens[0], "match") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "match");
+		return 0;
+	}
+
+	if (strcmp(tokens[1], "acl") == 0) {
+		if (n_tokens < 14) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+			return 0;
+		}
+
+		m->match_type = TABLE_ACL;
+
+		if (strcmp(tokens[2], "priority") != 0) {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND, "priority");
+			return 0;
+		}
+
+		if (softnic_parser_read_uint32(&m->match.acl.priority,
+			tokens[3]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "priority");
+			return 0;
+		}
+
+		if (strcmp(tokens[4], "ipv4") == 0) {
+			struct in_addr saddr, daddr;
+
+			m->match.acl.ip_version = 1;
+
+			if (softnic_parse_ipv4_addr(tokens[5], &saddr) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "sa");
+				return 0;
+			}
+			m->match.acl.ipv4.sa = rte_be_to_cpu_32(saddr.s_addr);
+
+			if (softnic_parse_ipv4_addr(tokens[7], &daddr) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "da");
+				return 0;
+			}
+			m->match.acl.ipv4.da = rte_be_to_cpu_32(daddr.s_addr);
+		} else if (strcmp(tokens[4], "ipv6") == 0) {
+			struct in6_addr saddr, daddr;
+
+			m->match.acl.ip_version = 0;
+
+			if (softnic_parse_ipv6_addr(tokens[5], &saddr) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "sa");
+				return 0;
+			}
+			memcpy(m->match.acl.ipv6.sa, saddr.s6_addr, 16);
+
+			if (softnic_parse_ipv6_addr(tokens[7], &daddr) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "da");
+				return 0;
+			}
+			memcpy(m->match.acl.ipv6.da, daddr.s6_addr, 16);
+		} else {
+			snprintf(out, out_size, MSG_ARG_NOT_FOUND,
+				"ipv4 or ipv6");
+			return 0;
+		}
+
+		if (softnic_parser_read_uint32(&m->match.acl.sa_depth,
+			tokens[6]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "sa_depth");
+			return 0;
+		}
+
+		if (softnic_parser_read_uint32(&m->match.acl.da_depth,
+			tokens[8]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "da_depth");
+			return 0;
+		}
+
+		if (softnic_parser_read_uint16(&m->match.acl.sp0, tokens[9]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "sp0");
+			return 0;
+		}
+
+		if (softnic_parser_read_uint16(&m->match.acl.sp1, tokens[10]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "sp1");
+			return 0;
+		}
+
+		if (softnic_parser_read_uint16(&m->match.acl.dp0, tokens[11]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "dp0");
+			return 0;
+		}
+
+		if (softnic_parser_read_uint16(&m->match.acl.dp1, tokens[12]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "dp1");
+			return 0;
+		}
+
+		if (softnic_parser_read_uint8(&m->match.acl.proto, tokens[13]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "proto");
+			return 0;
+		}
+
+		m->match.acl.proto_mask = 0xff;
+
+		return 14;
+	} /* acl */
+
+	if (strcmp(tokens[1], "array") == 0) {
+		if (n_tokens < 3) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+			return 0;
+		}
+
+		m->match_type = TABLE_ARRAY;
+
+		if (softnic_parser_read_uint32(&m->match.array.pos, tokens[2]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "pos");
+			return 0;
+		}
+
+		return 3;
+	} /* array */
+
+	if (strcmp(tokens[1], "hash") == 0) {
+		if (n_tokens < 3) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+			return 0;
+		}
+
+		m->match_type = TABLE_HASH;
+
+		if (strcmp(tokens[2], "raw") == 0) {
+			uint32_t key_size = TABLE_RULE_MATCH_SIZE_MAX;
+
+			if (n_tokens < 4) {
+				snprintf(out, out_size, MSG_ARG_MISMATCH,
+					tokens[0]);
+				return 0;
+			}
+
+			if (softnic_parse_hex_string(tokens[3],
+				m->match.hash.key, &key_size) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "key");
+				return 0;
+			}
+
+			return 4;
+		} /* hash raw */
+
+		if (strcmp(tokens[2], "ipv4_5tuple") == 0) {
+			struct pkt_key_ipv4_5tuple *ipv4 =
+				(struct pkt_key_ipv4_5tuple *)m->match.hash.key;
+			struct in_addr saddr, daddr;
+			uint16_t sp, dp;
+			uint8_t proto;
+
+			if (n_tokens < 8) {
+				snprintf(out, out_size, MSG_ARG_MISMATCH,
+					tokens[0]);
+				return 0;
+			}
+
+			if (softnic_parse_ipv4_addr(tokens[3], &saddr) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "sa");
+				return 0;
+			}
+
+			if (softnic_parse_ipv4_addr(tokens[4], &daddr) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "da");
+				return 0;
+			}
+
+			if (softnic_parser_read_uint16(&sp, tokens[5]) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "sp");
+				return 0;
+			}
+
+			if (softnic_parser_read_uint16(&dp, tokens[6]) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "dp");
+				return 0;
+			}
+
+			if (softnic_parser_read_uint8(&proto, tokens[7]) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID,
+					"proto");
+				return 0;
+			}
+
+			ipv4->sa = saddr.s_addr;
+			ipv4->da = daddr.s_addr;
+			ipv4->sp = rte_cpu_to_be_16(sp);
+			ipv4->dp = rte_cpu_to_be_16(dp);
+			ipv4->proto = proto;
+
+			return 8;
+		} /* hash ipv4_5tuple */
+
+		if (strcmp(tokens[2], "ipv6_5tuple") == 0) {
+			struct pkt_key_ipv6_5tuple *ipv6 =
+				(struct pkt_key_ipv6_5tuple *)m->match.hash.key;
+			struct in6_addr saddr, daddr;
+			uint16_t sp, dp;
+			uint8_t proto;
+
+			if (n_tokens < 8) {
+				snprintf(out, out_size, MSG_ARG_MISMATCH,
+					tokens[0]);
+				return 0;
+			}
+
+			if (softnic_parse_ipv6_addr(tokens[3], &saddr) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "sa");
+				return 0;
+			}
+
+			if (softnic_parse_ipv6_addr(tokens[4], &daddr) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "da");
+				return 0;
+			}
+
+			if (softnic_parser_read_uint16(&sp, tokens[5]) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "sp");
+				return 0;
+			}
+
+			if (softnic_parser_read_uint16(&dp, tokens[6]) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID, "dp");
+				return 0;
+			}
+
+			if (softnic_parser_read_uint8(&proto, tokens[7]) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID,
+					"proto");
+				return 0;
+			}
+
+			memcpy(ipv6->sa, saddr.s6_addr, 16);
+			memcpy(ipv6->da, daddr.s6_addr, 16);
+			ipv6->sp = rte_cpu_to_be_16(sp);
+			ipv6->dp = rte_cpu_to_be_16(dp);
+			ipv6->proto = proto;
+
+			return 8;
+		} /* hash ipv6_5tuple */
+
+		if (strcmp(tokens[2], "ipv4_addr") == 0) {
+			struct pkt_key_ipv4_addr *ipv4_addr =
+				(struct pkt_key_ipv4_addr *)m->match.hash.key;
+			struct in_addr addr;
+
+			if (n_tokens < 4) {
+				snprintf(out, out_size, MSG_ARG_MISMATCH,
+					tokens[0]);
+				return 0;
+			}
+
+			if (softnic_parse_ipv4_addr(tokens[3], &addr) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID,
+					"addr");
+				return 0;
+			}
+
+			ipv4_addr->addr = addr.s_addr;
+
+			return 4;
+		} /* hash ipv4_addr */
+
+		if (strcmp(tokens[2], "ipv6_addr") == 0) {
+			struct pkt_key_ipv6_addr *ipv6_addr =
+				(struct pkt_key_ipv6_addr *)m->match.hash.key;
+			struct in6_addr addr;
+
+			if (n_tokens < 4) {
+				snprintf(out, out_size, MSG_ARG_MISMATCH,
+					tokens[0]);
+				return 0;
+			}
+
+			if (softnic_parse_ipv6_addr(tokens[3], &addr) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID,
+					"addr");
+				return 0;
+			}
+
+			memcpy(ipv6_addr->addr, addr.s6_addr, 16);
 
 			return 4;
 		} /* hash ipv6_5tuple */
 
-		if (strcmp(tokens[2], "qinq") == 0) {
-			struct pkt_key_qinq *qinq =
-				(struct pkt_key_qinq *)m->match.hash.key;
-			uint16_t svlan, cvlan;
+		if (strcmp(tokens[2], "qinq") == 0) {
+			struct pkt_key_qinq *qinq =
+				(struct pkt_key_qinq *)m->match.hash.key;
+			uint16_t svlan, cvlan;
+
+			if (n_tokens < 5) {
+				snprintf(out, out_size, MSG_ARG_MISMATCH,
+					tokens[0]);
+				return 0;
+			}
+
+			if ((softnic_parser_read_uint16(&svlan, tokens[3]) != 0) ||
+				svlan > 0xFFF) {
+				snprintf(out, out_size, MSG_ARG_INVALID,
+					"svlan");
+				return 0;
+			}
+
+			if ((softnic_parser_read_uint16(&cvlan, tokens[4]) != 0) ||
+				cvlan > 0xFFF) {
+				snprintf(out, out_size, MSG_ARG_INVALID,
+					"cvlan");
+				return 0;
+			}
+
+			qinq->svlan = rte_cpu_to_be_16(svlan);
+			qinq->cvlan = rte_cpu_to_be_16(cvlan);
+
+			return 5;
+		} /* hash qinq */
+
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+		return 0;
+	} /* hash */
+
+	if (strcmp(tokens[1], "lpm") == 0) {
+		if (n_tokens < 5) {
+			snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+			return 0;
+		}
+
+		m->match_type = TABLE_LPM;
+
+		if (strcmp(tokens[2], "ipv4") == 0) {
+			struct in_addr addr;
+
+			m->match.lpm.ip_version = 1;
+
+			if (softnic_parse_ipv4_addr(tokens[3], &addr) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID,
+					"addr");
+				return 0;
+			}
+
+			m->match.lpm.ipv4 = rte_be_to_cpu_32(addr.s_addr);
+		} else if (strcmp(tokens[2], "ipv6") == 0) {
+			struct in6_addr addr;
+
+			m->match.lpm.ip_version = 0;
+
+			if (softnic_parse_ipv6_addr(tokens[3], &addr) != 0) {
+				snprintf(out, out_size, MSG_ARG_INVALID,
+					"addr");
+				return 0;
+			}
+
+			memcpy(m->match.lpm.ipv6, addr.s6_addr, 16);
+		} else {
+			snprintf(out, out_size, MSG_ARG_MISMATCH,
+				"ipv4 or ipv6");
+			return 0;
+		}
+
+		if (softnic_parser_read_uint8(&m->match.lpm.depth, tokens[4]) != 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID, "depth");
+			return 0;
+		}
+
+		return 5;
+	} /* lpm */
+
+	snprintf(out, out_size, MSG_ARG_MISMATCH,
+		"acl or array or hash or lpm");
+	return 0;
+}
+
+/**
+ * table_action ::=
+ *
+ * action
+ *    fwd
+ *       drop
+ *       | port <port_id>
+ *       | meta
+ *       | table <table_id>
+ *    [balance <out0> ... <out7>]
+ *    [meter
+ *       tc0 meter <meter_profile_id> policer g <pa> y <pa> r <pa>
+ *       [tc1 meter <meter_profile_id> policer g <pa> y <pa> r <pa>
+ *       tc2 meter <meter_profile_id> policer g <pa> y <pa> r <pa>
+ *       tc3 meter <meter_profile_id> policer g <pa> y <pa> r <pa>]]
+ *    [tm subport <subport_id> pipe <pipe_id>]
+ *    [encap
+ *       ether <da> <sa>
+ *       | vlan <da> <sa> <pcp> <dei> <vid>
+ *       | qinq <da> <sa> <pcp> <dei> <vid> <pcp> <dei> <vid>
+ *       | qinq_pppoe <da> <sa> <pcp> <dei> <vid> <pcp> <dei> <vid> <session_id>
+ *       | mpls unicast | multicast
+ *          <da> <sa>
+ *          label0 <label> <tc> <ttl>
+ *          [label1 <label> <tc> <ttl>
+ *          [label2 <label> <tc> <ttl>
+ *          [label3 <label> <tc> <ttl>]]]
+ *       | pppoe <da> <sa> <session_id>]
+ *       | vxlan ether <da> <sa>
+ *          [vlan <pcp> <dei> <vid>]
+ *          ipv4 <sa> <da> <dscp> <ttl>
+ *          | ipv6 <sa> <da> <flow_label> <dscp> <hop_limit>
+ *          udp <sp> <dp>
+ *          vxlan <vni>]
+ *    [nat ipv4 | ipv6 <addr> <port>]
+ *    [ttl dec | keep]
+ *    [stats]
+ *    [time]
+ *    [tag <tag>]
+ *    [decap <n>]
+ *    [sym_crypto
+ *       encrypt | decrypt
+ *       type
+ *       | cipher
+ *          cipher_algo <algo> cipher_key <key> cipher_iv <iv>
+ *       | cipher_auth
+ *          cipher_algo <algo> cipher_key <key> cipher_iv <iv>
+ *          auth_algo <algo> auth_key <key> digest_size <size>
+ *       | aead
+ *          aead_algo <algo> aead_key <key> aead_iv <iv> aead_aad <aad>
+ *          digest_size <size>
+ *       data_offset <data_offset>]
+ *
+ * where:
+ *    <pa> ::= g | y | r | drop
+ */
+static uint32_t
+parse_table_action_fwd(char **tokens,
+	uint32_t n_tokens,
+	struct softnic_table_rule_action *a)
+{
+	if (n_tokens == 0 ||
+		(strcmp(tokens[0], "fwd") != 0))
+		return 0;
+
+	tokens++;
+	n_tokens--;
+
+	if (n_tokens && (strcmp(tokens[0], "drop") == 0)) {
+		a->fwd.action = RTE_PIPELINE_ACTION_DROP;
+		a->action_mask |= 1 << RTE_TABLE_ACTION_FWD;
+		return 1 + 1;
+	}
+
+	if (n_tokens && (strcmp(tokens[0], "port") == 0)) {
+		uint32_t id;
+
+		if (n_tokens < 2 ||
+			softnic_parser_read_uint32(&id, tokens[1]))
+			return 0;
+
+		a->fwd.action = RTE_PIPELINE_ACTION_PORT;
+		a->fwd.id = id;
+		a->action_mask |= 1 << RTE_TABLE_ACTION_FWD;
+		return 1 + 2;
+	}
+
+	if (n_tokens && (strcmp(tokens[0], "meta") == 0)) {
+		a->fwd.action = RTE_PIPELINE_ACTION_PORT_META;
+		a->action_mask |= 1 << RTE_TABLE_ACTION_FWD;
+		return 1 + 1;
+	}
+
+	if (n_tokens && (strcmp(tokens[0], "table") == 0)) {
+		uint32_t id;
+
+		if (n_tokens < 2 ||
+			softnic_parser_read_uint32(&id, tokens[1]))
+			return 0;
+
+		a->fwd.action = RTE_PIPELINE_ACTION_TABLE;
+		a->fwd.id = id;
+		a->action_mask |= 1 << RTE_TABLE_ACTION_FWD;
+		return 1 + 2;
+	}
+
+	return 0;
+}
+
+static uint32_t
+parse_table_action_balance(char **tokens,
+	uint32_t n_tokens,
+	struct softnic_table_rule_action *a)
+{
+	uint32_t i;
+
+	if (n_tokens == 0 ||
+		(strcmp(tokens[0], "balance") != 0))
+		return 0;
+
+	tokens++;
+	n_tokens--;
+
+	if (n_tokens < RTE_TABLE_ACTION_LB_TABLE_SIZE)
+		return 0;
+
+	for (i = 0; i < RTE_TABLE_ACTION_LB_TABLE_SIZE; i++)
+		if (softnic_parser_read_uint32(&a->lb.out[i], tokens[i]) != 0)
+			return 0;
+
+	a->action_mask |= 1 << RTE_TABLE_ACTION_LB;
+	return 1 + RTE_TABLE_ACTION_LB_TABLE_SIZE;
+}
+
+static int
+parse_policer_action(char *token, enum rte_table_action_policer *a)
+{
+	if (strcmp(token, "g") == 0) {
+		*a = RTE_TABLE_ACTION_POLICER_COLOR_GREEN;
+		return 0;
+	}
+
+	if (strcmp(token, "y") == 0) {
+		*a = RTE_TABLE_ACTION_POLICER_COLOR_YELLOW;
+		return 0;
+	}
+
+	if (strcmp(token, "r") == 0) {
+		*a = RTE_TABLE_ACTION_POLICER_COLOR_RED;
+		return 0;
+	}
+
+	if (strcmp(token, "drop") == 0) {
+		*a = RTE_TABLE_ACTION_POLICER_DROP;
+		return 0;
+	}
+
+	return -1;
+}
+
+static uint32_t
+parse_table_action_meter_tc(char **tokens,
+	uint32_t n_tokens,
+	struct rte_table_action_mtr_tc_params *mtr)
+{
+	if (n_tokens < 9 ||
+		strcmp(tokens[0], "meter") ||
+		softnic_parser_read_uint32(&mtr->meter_profile_id, tokens[1]) ||
+		strcmp(tokens[2], "policer") ||
+		strcmp(tokens[3], "g") ||
+		parse_policer_action(tokens[4], &mtr->policer[RTE_COLOR_GREEN]) ||
+		strcmp(tokens[5], "y") ||
+		parse_policer_action(tokens[6], &mtr->policer[RTE_COLOR_YELLOW]) ||
+		strcmp(tokens[7], "r") ||
+		parse_policer_action(tokens[8], &mtr->policer[RTE_COLOR_RED]))
+		return 0;
+
+	return 9;
+}
+
+static uint32_t
+parse_table_action_meter(char **tokens,
+	uint32_t n_tokens,
+	struct softnic_table_rule_action *a)
+{
+	if (n_tokens == 0 ||
+		strcmp(tokens[0], "meter"))
+		return 0;
+
+	tokens++;
+	n_tokens--;
+
+	if (n_tokens < 10 ||
+		strcmp(tokens[0], "tc0") ||
+		(parse_table_action_meter_tc(tokens + 1,
+			n_tokens - 1,
+			&a->mtr.mtr[0]) == 0))
+		return 0;
+
+	tokens += 10;
+	n_tokens -= 10;
+
+	if (n_tokens == 0 ||
+		strcmp(tokens[0], "tc1")) {
+		a->mtr.tc_mask = 1;
+		a->action_mask |= 1 << RTE_TABLE_ACTION_MTR;
+		return 1 + 10;
+	}
+
+	if (n_tokens < 30 ||
+		(parse_table_action_meter_tc(tokens + 1,
+			n_tokens - 1, &a->mtr.mtr[1]) == 0) ||
+		strcmp(tokens[10], "tc2") ||
+		(parse_table_action_meter_tc(tokens + 11,
+			n_tokens - 11, &a->mtr.mtr[2]) == 0) ||
+		strcmp(tokens[20], "tc3") ||
+		(parse_table_action_meter_tc(tokens + 21,
+			n_tokens - 21, &a->mtr.mtr[3]) == 0))
+		return 0;
+
+	a->mtr.tc_mask = 0xF;
+	a->action_mask |= 1 << RTE_TABLE_ACTION_MTR;
+	return 1 + 10 + 3 * 10;
+}
+
+static uint32_t
+parse_table_action_tm(char **tokens,
+	uint32_t n_tokens,
+	struct softnic_table_rule_action *a)
+{
+	uint32_t subport_id, pipe_id;
+
+	if (n_tokens < 5 ||
+		strcmp(tokens[0], "tm") ||
+		strcmp(tokens[1], "subport") ||
+		softnic_parser_read_uint32(&subport_id, tokens[2]) ||
+		strcmp(tokens[3], "pipe") ||
+		softnic_parser_read_uint32(&pipe_id, tokens[4]))
+		return 0;
+
+	a->tm.subport_id = subport_id;
+	a->tm.pipe_id = pipe_id;
+	a->action_mask |= 1 << RTE_TABLE_ACTION_TM;
+	return 5;
+}
+
+static uint32_t
+parse_table_action_encap(char **tokens,
+	uint32_t n_tokens,
+	struct softnic_table_rule_action *a)
+{
+	if (n_tokens == 0 ||
+		strcmp(tokens[0], "encap"))
+		return 0;
+
+	tokens++;
+	n_tokens--;
+
+	/* ether */
+	if (n_tokens && (strcmp(tokens[0], "ether") == 0)) {
+		if (n_tokens < 3 ||
+			softnic_parse_mac_addr(tokens[1], &a->encap.ether.ether.da) ||
+			softnic_parse_mac_addr(tokens[2], &a->encap.ether.ether.sa))
+			return 0;
+
+		a->encap.type = RTE_TABLE_ACTION_ENCAP_ETHER;
+		a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
+		return 1 + 3;
+	}
+
+	/* vlan */
+	if (n_tokens && (strcmp(tokens[0], "vlan") == 0)) {
+		uint32_t pcp, dei, vid;
+
+		if (n_tokens < 6 ||
+			softnic_parse_mac_addr(tokens[1], &a->encap.vlan.ether.da) ||
+			softnic_parse_mac_addr(tokens[2], &a->encap.vlan.ether.sa) ||
+			softnic_parser_read_uint32(&pcp, tokens[3]) ||
+			pcp > 0x7 ||
+			softnic_parser_read_uint32(&dei, tokens[4]) ||
+			dei > 0x1 ||
+			softnic_parser_read_uint32(&vid, tokens[5]) ||
+			vid > 0xFFF)
+			return 0;
+
+		a->encap.vlan.vlan.pcp = pcp & 0x7;
+		a->encap.vlan.vlan.dei = dei & 0x1;
+		a->encap.vlan.vlan.vid = vid & 0xFFF;
+		a->encap.type = RTE_TABLE_ACTION_ENCAP_VLAN;
+		a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
+		return 1 + 6;
+	}
+
+	/* qinq */
+	if (n_tokens && (strcmp(tokens[0], "qinq") == 0)) {
+		uint32_t svlan_pcp, svlan_dei, svlan_vid;
+		uint32_t cvlan_pcp, cvlan_dei, cvlan_vid;
+
+		if (n_tokens < 9 ||
+			softnic_parse_mac_addr(tokens[1], &a->encap.qinq.ether.da) ||
+			softnic_parse_mac_addr(tokens[2], &a->encap.qinq.ether.sa) ||
+			softnic_parser_read_uint32(&svlan_pcp, tokens[3]) ||
+			svlan_pcp > 0x7 ||
+			softnic_parser_read_uint32(&svlan_dei, tokens[4]) ||
+			svlan_dei > 0x1 ||
+			softnic_parser_read_uint32(&svlan_vid, tokens[5]) ||
+			svlan_vid > 0xFFF ||
+			softnic_parser_read_uint32(&cvlan_pcp, tokens[6]) ||
+			cvlan_pcp > 0x7 ||
+			softnic_parser_read_uint32(&cvlan_dei, tokens[7]) ||
+			cvlan_dei > 0x1 ||
+			softnic_parser_read_uint32(&cvlan_vid, tokens[8]) ||
+			cvlan_vid > 0xFFF)
+			return 0;
+
+		a->encap.qinq.svlan.pcp = svlan_pcp & 0x7;
+		a->encap.qinq.svlan.dei = svlan_dei & 0x1;
+		a->encap.qinq.svlan.vid = svlan_vid & 0xFFF;
+		a->encap.qinq.cvlan.pcp = cvlan_pcp & 0x7;
+		a->encap.qinq.cvlan.dei = cvlan_dei & 0x1;
+		a->encap.qinq.cvlan.vid = cvlan_vid & 0xFFF;
+		a->encap.type = RTE_TABLE_ACTION_ENCAP_QINQ;
+		a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
+		return 1 + 9;
+	}
+
+	/* qinq_pppoe */
+	if (n_tokens && (strcmp(tokens[0], "qinq_pppoe") == 0)) {
+		uint32_t svlan_pcp, svlan_dei, svlan_vid;
+		uint32_t cvlan_pcp, cvlan_dei, cvlan_vid;
+
+		if (n_tokens < 10 ||
+			softnic_parse_mac_addr(tokens[1],
+				&a->encap.qinq_pppoe.ether.da) ||
+			softnic_parse_mac_addr(tokens[2],
+				&a->encap.qinq_pppoe.ether.sa) ||
+			softnic_parser_read_uint32(&svlan_pcp, tokens[3]) ||
+			svlan_pcp > 0x7 ||
+			softnic_parser_read_uint32(&svlan_dei, tokens[4]) ||
+			svlan_dei > 0x1 ||
+			softnic_parser_read_uint32(&svlan_vid, tokens[5]) ||
+			svlan_vid > 0xFFF ||
+			softnic_parser_read_uint32(&cvlan_pcp, tokens[6]) ||
+			cvlan_pcp > 0x7 ||
+			softnic_parser_read_uint32(&cvlan_dei, tokens[7]) ||
+			cvlan_dei > 0x1 ||
+			softnic_parser_read_uint32(&cvlan_vid, tokens[8]) ||
+			cvlan_vid > 0xFFF ||
+			softnic_parser_read_uint16(&a->encap.qinq_pppoe.pppoe.session_id,
+				tokens[9]))
+			return 0;
+
+		a->encap.qinq_pppoe.svlan.pcp = svlan_pcp & 0x7;
+		a->encap.qinq_pppoe.svlan.dei = svlan_dei & 0x1;
+		a->encap.qinq_pppoe.svlan.vid = svlan_vid & 0xFFF;
+		a->encap.qinq_pppoe.cvlan.pcp = cvlan_pcp & 0x7;
+		a->encap.qinq_pppoe.cvlan.dei = cvlan_dei & 0x1;
+		a->encap.qinq_pppoe.cvlan.vid = cvlan_vid & 0xFFF;
+		a->encap.type = RTE_TABLE_ACTION_ENCAP_QINQ_PPPOE;
+		a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
+		return 1 + 10;
+	}
+
+	/* mpls */
+	if (n_tokens && (strcmp(tokens[0], "mpls") == 0)) {
+		uint32_t label, tc, ttl;
+
+		if (n_tokens < 8)
+			return 0;
+
+		if (strcmp(tokens[1], "unicast") == 0)
+			a->encap.mpls.unicast = 1;
+		else if (strcmp(tokens[1], "multicast") == 0)
+			a->encap.mpls.unicast = 0;
+		else
+			return 0;
+
+		if (softnic_parse_mac_addr(tokens[2], &a->encap.mpls.ether.da) ||
+			softnic_parse_mac_addr(tokens[3], &a->encap.mpls.ether.sa) ||
+			strcmp(tokens[4], "label0") ||
+			softnic_parser_read_uint32(&label, tokens[5]) ||
+			label > 0xFFFFF ||
+			softnic_parser_read_uint32(&tc, tokens[6]) ||
+			tc > 0x7 ||
+			softnic_parser_read_uint32(&ttl, tokens[7]) ||
+			ttl > 0x3F)
+			return 0;
+
+		a->encap.mpls.mpls[0].label = label;
+		a->encap.mpls.mpls[0].tc = tc;
+		a->encap.mpls.mpls[0].ttl = ttl;
 
-			if (n_tokens < 5) {
-				snprintf(out, out_size, MSG_ARG_MISMATCH,
-					tokens[0]);
-				return 0;
-			}
+		tokens += 8;
+		n_tokens -= 8;
 
-			if ((softnic_parser_read_uint16(&svlan, tokens[3]) != 0) ||
-				svlan > 0xFFF) {
-				snprintf(out, out_size, MSG_ARG_INVALID,
-					"svlan");
-				return 0;
-			}
+		if (n_tokens == 0 ||
+			strcmp(tokens[0], "label1")) {
+			a->encap.mpls.mpls_count = 1;
+			a->encap.type = RTE_TABLE_ACTION_ENCAP_MPLS;
+			a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
+			return 1 + 8;
+		}
 
-			if ((softnic_parser_read_uint16(&cvlan, tokens[4]) != 0) ||
-				cvlan > 0xFFF) {
-				snprintf(out, out_size, MSG_ARG_INVALID,
-					"cvlan");
-				return 0;
-			}
+		if (n_tokens < 4 ||
+			softnic_parser_read_uint32(&label, tokens[1]) ||
+			label > 0xFFFFF ||
+			softnic_parser_read_uint32(&tc, tokens[2]) ||
+			tc > 0x7 ||
+			softnic_parser_read_uint32(&ttl, tokens[3]) ||
+			ttl > 0x3F)
+			return 0;
 
-			qinq->svlan = rte_cpu_to_be_16(svlan);
-			qinq->cvlan = rte_cpu_to_be_16(cvlan);
+		a->encap.mpls.mpls[1].label = label;
+		a->encap.mpls.mpls[1].tc = tc;
+		a->encap.mpls.mpls[1].ttl = ttl;
 
-			return 5;
-		} /* hash qinq */
+		tokens += 4;
+		n_tokens -= 4;
 
-		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
-		return 0;
-	} /* hash */
+		if (n_tokens == 0 ||
+			strcmp(tokens[0], "label2")) {
+			a->encap.mpls.mpls_count = 2;
+			a->encap.type = RTE_TABLE_ACTION_ENCAP_MPLS;
+			a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
+			return 1 + 8 + 4;
+		}
 
-	if (strcmp(tokens[1], "lpm") == 0) {
-		if (n_tokens < 5) {
-			snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+		if (n_tokens < 4 ||
+			softnic_parser_read_uint32(&label, tokens[1]) ||
+			label > 0xFFFFF ||
+			softnic_parser_read_uint32(&tc, tokens[2]) ||
+			tc > 0x7 ||
+			softnic_parser_read_uint32(&ttl, tokens[3]) ||
+			ttl > 0x3F)
 			return 0;
+
+		a->encap.mpls.mpls[2].label = label;
+		a->encap.mpls.mpls[2].tc = tc;
+		a->encap.mpls.mpls[2].ttl = ttl;
+
+		tokens += 4;
+		n_tokens -= 4;
+
+		if (n_tokens == 0 ||
+			strcmp(tokens[0], "label3")) {
+			a->encap.mpls.mpls_count = 3;
+			a->encap.type = RTE_TABLE_ACTION_ENCAP_MPLS;
+			a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
+			return 1 + 8 + 4 + 4;
 		}
 
-		m->match_type = TABLE_LPM;
+		if (n_tokens < 4 ||
+			softnic_parser_read_uint32(&label, tokens[1]) ||
+			label > 0xFFFFF ||
+			softnic_parser_read_uint32(&tc, tokens[2]) ||
+			tc > 0x7 ||
+			softnic_parser_read_uint32(&ttl, tokens[3]) ||
+			ttl > 0x3F)
+			return 0;
 
-		if (strcmp(tokens[2], "ipv4") == 0) {
-			struct in_addr addr;
+		a->encap.mpls.mpls[3].label = label;
+		a->encap.mpls.mpls[3].tc = tc;
+		a->encap.mpls.mpls[3].ttl = ttl;
 
-			m->match.lpm.ip_version = 1;
+		a->encap.mpls.mpls_count = 4;
+		a->encap.type = RTE_TABLE_ACTION_ENCAP_MPLS;
+		a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
+		return 1 + 8 + 4 + 4 + 4;
+	}
 
-			if (softnic_parse_ipv4_addr(tokens[3], &addr) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID,
-					"addr");
-				return 0;
-			}
+	/* pppoe */
+	if (n_tokens && (strcmp(tokens[0], "pppoe") == 0)) {
+		if (n_tokens < 4 ||
+			softnic_parse_mac_addr(tokens[1], &a->encap.pppoe.ether.da) ||
+			softnic_parse_mac_addr(tokens[2], &a->encap.pppoe.ether.sa) ||
+			softnic_parser_read_uint16(&a->encap.pppoe.pppoe.session_id,
+				tokens[3]))
+			return 0;
 
-			m->match.lpm.ipv4 = rte_be_to_cpu_32(addr.s_addr);
-		} else if (strcmp(tokens[2], "ipv6") == 0) {
-			struct in6_addr addr;
+		a->encap.type = RTE_TABLE_ACTION_ENCAP_PPPOE;
+		a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
+		return 1 + 4;
+	}
 
-			m->match.lpm.ip_version = 0;
+	/* vxlan */
+	if (n_tokens && (strcmp(tokens[0], "vxlan") == 0)) {
+		uint32_t n = 0;
 
-			if (softnic_parse_ipv6_addr(tokens[3], &addr) != 0) {
-				snprintf(out, out_size, MSG_ARG_INVALID,
-					"addr");
-				return 0;
-			}
+		n_tokens--;
+		tokens++;
+		n++;
 
-			memcpy(m->match.lpm.ipv6, addr.s6_addr, 16);
-		} else {
-			snprintf(out, out_size, MSG_ARG_MISMATCH,
-				"ipv4 or ipv6");
+		/* ether <da> <sa> */
+		if ((n_tokens < 3) ||
+			strcmp(tokens[0], "ether") ||
+			softnic_parse_mac_addr(tokens[1], &a->encap.vxlan.ether.da) ||
+			softnic_parse_mac_addr(tokens[2], &a->encap.vxlan.ether.sa))
 			return 0;
-		}
 
-		if (softnic_parser_read_uint8(&m->match.lpm.depth, tokens[4]) != 0) {
-			snprintf(out, out_size, MSG_ARG_INVALID, "depth");
-			return 0;
-		}
+		n_tokens -= 3;
+		tokens += 3;
+		n += 3;
+
+		/* [vlan <pcp> <dei> <vid>] */
+		if (strcmp(tokens[0], "vlan") == 0) {
+			uint32_t pcp, dei, vid;
+
+			if ((n_tokens < 4) ||
+				softnic_parser_read_uint32(&pcp, tokens[1]) ||
+				(pcp > 7) ||
+				softnic_parser_read_uint32(&dei, tokens[2]) ||
+				(dei > 1) ||
+				softnic_parser_read_uint32(&vid, tokens[3]) ||
+				(vid > 0xFFF))
+				return 0;
 
-		return 5;
-	} /* lpm */
+			a->encap.vxlan.vlan.pcp = pcp;
+			a->encap.vxlan.vlan.dei = dei;
+			a->encap.vxlan.vlan.vid = vid;
 
-	snprintf(out, out_size, MSG_ARG_MISMATCH,
-		"acl or array or hash or lpm");
-	return 0;
-}
+			n_tokens -= 4;
+			tokens += 4;
+			n += 4;
+		}
 
-/**
- * table_action ::=
- *
- * action
- *    fwd
- *       drop
- *       | port <port_id>
- *       | meta
- *       | table <table_id>
- *    [balance <out0> ... <out7>]
- *    [meter
- *       tc0 meter <meter_profile_id> policer g <pa> y <pa> r <pa>
- *       [tc1 meter <meter_profile_id> policer g <pa> y <pa> r <pa>
- *       tc2 meter <meter_profile_id> policer g <pa> y <pa> r <pa>
- *       tc3 meter <meter_profile_id> policer g <pa> y <pa> r <pa>]]
- *    [tm subport <subport_id> pipe <pipe_id>]
- *    [encap
- *       ether <da> <sa>
- *       | vlan <da> <sa> <pcp> <dei> <vid>
- *       | qinq <da> <sa> <pcp> <dei> <vid> <pcp> <dei> <vid>
- *       | mpls unicast | multicast
- *          <da> <sa>
- *          label0 <label> <tc> <ttl>
- *          [label1 <label> <tc> <ttl>
- *          [label2 <label> <tc> <ttl>
- *          [label3 <label> <tc> <ttl>]]]
- *       | pppoe <da> <sa> <session_id>]
- *    [nat ipv4 | ipv6 <addr> <port>]
- *    [ttl dec | keep]
- *    [stats]
- *    [time]
- *
- * where:
- *    <pa> ::= g | y | r | drop
- */
-static uint32_t
-parse_table_action_fwd(char **tokens,
-	uint32_t n_tokens,
-	struct softnic_table_rule_action *a)
-{
-	if (n_tokens == 0 ||
-		(strcmp(tokens[0], "fwd") != 0))
-		return 0;
+		/* ipv4 <sa> <da> <dscp> <ttl>
+		   | ipv6 <sa> <da> <flow_label> <dscp> <hop_limit> */
+		if (strcmp(tokens[0], "ipv4") == 0) {
+			struct in_addr sa, da;
+			uint8_t dscp, ttl;
 
-	tokens++;
-	n_tokens--;
+			if ((n_tokens < 5) ||
+				softnic_parse_ipv4_addr(tokens[1], &sa) ||
+				softnic_parse_ipv4_addr(tokens[2], &da) ||
+				softnic_parser_read_uint8(&dscp, tokens[3]) ||
+				(dscp > 64) ||
+				softnic_parser_read_uint8(&ttl, tokens[4]))
+				return 0;
 
-	if (n_tokens && (strcmp(tokens[0], "drop") == 0)) {
-		a->fwd.action = RTE_PIPELINE_ACTION_DROP;
-		a->action_mask |= 1 << RTE_TABLE_ACTION_FWD;
-		return 1 + 1;
-	}
+			a->encap.vxlan.ipv4.sa = rte_be_to_cpu_32(sa.s_addr);
+			a->encap.vxlan.ipv4.da = rte_be_to_cpu_32(da.s_addr);
+			a->encap.vxlan.ipv4.dscp = dscp;
+			a->encap.vxlan.ipv4.ttl = ttl;
+
+			n_tokens -= 5;
+			tokens += 5;
+			n += 5;
+		} else if (strcmp(tokens[0], "ipv6") == 0) {
+			struct in6_addr sa, da;
+			uint32_t flow_label;
+			uint8_t dscp, hop_limit;
+
+			if ((n_tokens < 6) ||
+				softnic_parse_ipv6_addr(tokens[1], &sa) ||
+				softnic_parse_ipv6_addr(tokens[2], &da) ||
+				softnic_parser_read_uint32(&flow_label, tokens[3]) ||
+				softnic_parser_read_uint8(&dscp, tokens[4]) ||
+				(dscp > 64) ||
+				softnic_parser_read_uint8(&hop_limit, tokens[5]))
+				return 0;
 
-	if (n_tokens && (strcmp(tokens[0], "port") == 0)) {
-		uint32_t id;
+			memcpy(a->encap.vxlan.ipv6.sa, sa.s6_addr, 16);
+			memcpy(a->encap.vxlan.ipv6.da, da.s6_addr, 16);
+			a->encap.vxlan.ipv6.flow_label = flow_label;
+			a->encap.vxlan.ipv6.dscp = dscp;
+			a->encap.vxlan.ipv6.hop_limit = hop_limit;
 
-		if (n_tokens < 2 ||
-			softnic_parser_read_uint32(&id, tokens[1]))
+			n_tokens -= 6;
+			tokens += 6;
+			n += 6;
+		} else
 			return 0;
 
-		a->fwd.action = RTE_PIPELINE_ACTION_PORT;
-		a->fwd.id = id;
-		a->action_mask |= 1 << RTE_TABLE_ACTION_FWD;
-		return 1 + 2;
-	}
-
-	if (n_tokens && (strcmp(tokens[0], "meta") == 0)) {
-		a->fwd.action = RTE_PIPELINE_ACTION_PORT_META;
-		a->action_mask |= 1 << RTE_TABLE_ACTION_FWD;
-		return 1 + 1;
-	}
+		/* udp <sp> <dp> */
+		if ((n_tokens < 3) ||
+			strcmp(tokens[0], "udp") ||
+			softnic_parser_read_uint16(&a->encap.vxlan.udp.sp, tokens[1]) ||
+			softnic_parser_read_uint16(&a->encap.vxlan.udp.dp, tokens[2]))
+			return 0;
 
-	if (n_tokens && (strcmp(tokens[0], "table") == 0)) {
-		uint32_t id;
+		n_tokens -= 3;
+		tokens += 3;
+		n += 3;
 
-		if (n_tokens < 2 ||
-			softnic_parser_read_uint32(&id, tokens[1]))
+		/* vxlan <vni> */
+		if ((n_tokens < 2) ||
+			strcmp(tokens[0], "vxlan") ||
+			softnic_parser_read_uint32(&a->encap.vxlan.vxlan.vni, tokens[1]) ||
+			(a->encap.vxlan.vxlan.vni > 0xFFFFFF))
 			return 0;
 
-		a->fwd.action = RTE_PIPELINE_ACTION_TABLE;
-		a->fwd.id = id;
-		a->action_mask |= 1 << RTE_TABLE_ACTION_FWD;
-		return 1 + 2;
+		n_tokens -= 2;
+		tokens += 2;
+		n += 2;
+
+		a->encap.type = RTE_TABLE_ACTION_ENCAP_VXLAN;
+		a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
+		return 1 + n;
 	}
 
 	return 0;
 }
 
 static uint32_t
-parse_table_action_balance(char **tokens,
+parse_table_action_nat(char **tokens,
 	uint32_t n_tokens,
 	struct softnic_table_rule_action *a)
 {
-	uint32_t i;
-
-	if (n_tokens == 0 ||
-		(strcmp(tokens[0], "balance") != 0))
+	if (n_tokens < 4 ||
+		strcmp(tokens[0], "nat"))
 		return 0;
 
-	tokens++;
-	n_tokens--;
+	if (strcmp(tokens[1], "ipv4") == 0) {
+		struct in_addr addr;
+		uint16_t port;
 
-	if (n_tokens < RTE_TABLE_ACTION_LB_TABLE_SIZE)
-		return 0;
+		if (softnic_parse_ipv4_addr(tokens[2], &addr) ||
+			softnic_parser_read_uint16(&port, tokens[3]))
+			return 0;
 
-	for (i = 0; i < RTE_TABLE_ACTION_LB_TABLE_SIZE; i++)
-		if (softnic_parser_read_uint32(&a->lb.out[i], tokens[i]) != 0)
+		a->nat.ip_version = 1;
+		a->nat.addr.ipv4 = rte_be_to_cpu_32(addr.s_addr);
+		a->nat.port = port;
+		a->action_mask |= 1 << RTE_TABLE_ACTION_NAT;
+		return 4;
+	}
+
+	if (strcmp(tokens[1], "ipv6") == 0) {
+		struct in6_addr addr;
+		uint16_t port;
+
+		if (softnic_parse_ipv6_addr(tokens[2], &addr) ||
+			softnic_parser_read_uint16(&port, tokens[3]))
 			return 0;
 
-	a->action_mask |= 1 << RTE_TABLE_ACTION_LB;
-	return 1 + RTE_TABLE_ACTION_LB_TABLE_SIZE;
+		a->nat.ip_version = 0;
+		memcpy(a->nat.addr.ipv6, addr.s6_addr, 16);
+		a->nat.port = port;
+		a->action_mask |= 1 << RTE_TABLE_ACTION_NAT;
+		return 4;
+	}
+
+	return 0;
 }
 
-static int
-parse_policer_action(char *token, enum rte_table_action_policer *a)
+static uint32_t
+parse_table_action_ttl(char **tokens,
+	uint32_t n_tokens,
+	struct softnic_table_rule_action *a)
 {
-	if (strcmp(token, "g") == 0) {
-		*a = RTE_TABLE_ACTION_POLICER_COLOR_GREEN;
-		return 0;
-	}
-
-	if (strcmp(token, "y") == 0) {
-		*a = RTE_TABLE_ACTION_POLICER_COLOR_YELLOW;
-		return 0;
-	}
-
-	if (strcmp(token, "r") == 0) {
-		*a = RTE_TABLE_ACTION_POLICER_COLOR_RED;
+	if (n_tokens < 2 ||
+		strcmp(tokens[0], "ttl"))
 		return 0;
-	}
 
-	if (strcmp(token, "drop") == 0) {
-		*a = RTE_TABLE_ACTION_POLICER_DROP;
+	if (strcmp(tokens[1], "dec") == 0)
+		a->ttl.decrement = 1;
+	else if (strcmp(tokens[1], "keep") == 0)
+		a->ttl.decrement = 0;
+	else
 		return 0;
-	}
 
-	return -1;
+	a->action_mask |= 1 << RTE_TABLE_ACTION_TTL;
+	return 2;
 }
 
 static uint32_t
-parse_table_action_meter_tc(char **tokens,
+parse_table_action_stats(char **tokens,
 	uint32_t n_tokens,
-	struct rte_table_action_mtr_tc_params *mtr)
+	struct softnic_table_rule_action *a)
 {
-	if (n_tokens < 9 ||
-		strcmp(tokens[0], "meter") ||
-		softnic_parser_read_uint32(&mtr->meter_profile_id, tokens[1]) ||
-		strcmp(tokens[2], "policer") ||
-		strcmp(tokens[3], "g") ||
-		parse_policer_action(tokens[4], &mtr->policer[e_RTE_METER_GREEN]) ||
-		strcmp(tokens[5], "y") ||
-		parse_policer_action(tokens[6], &mtr->policer[e_RTE_METER_YELLOW]) ||
-		strcmp(tokens[7], "r") ||
-		parse_policer_action(tokens[8], &mtr->policer[e_RTE_METER_RED]))
+	if (n_tokens < 1 ||
+		strcmp(tokens[0], "stats"))
 		return 0;
 
-	return 9;
+	a->stats.n_packets = 0;
+	a->stats.n_bytes = 0;
+	a->action_mask |= 1 << RTE_TABLE_ACTION_STATS;
+	return 1;
 }
 
 static uint32_t
-parse_table_action_meter(char **tokens,
+parse_table_action_time(char **tokens,
 	uint32_t n_tokens,
 	struct softnic_table_rule_action *a)
 {
-	if (n_tokens == 0 ||
-		strcmp(tokens[0], "meter"))
+	if (n_tokens < 1 ||
+		strcmp(tokens[0], "time"))
 		return 0;
 
-	tokens++;
-	n_tokens--;
+	a->time.time = rte_rdtsc();
+	a->action_mask |= 1 << RTE_TABLE_ACTION_TIME;
+	return 1;
+}
 
-	if (n_tokens < 10 ||
-		strcmp(tokens[0], "tc0") ||
-		(parse_table_action_meter_tc(tokens + 1,
-			n_tokens - 1,
-			&a->mtr.mtr[0]) == 0))
-		return 0;
+static void
+parse_free_sym_crypto_param_data(struct rte_table_action_sym_crypto_params *p)
+{
+	struct rte_crypto_sym_xform *xform[2] = {NULL};
+	uint32_t i;
 
-	tokens += 10;
-	n_tokens -= 10;
+	xform[0] = p->xform;
+	if (xform[0])
+		xform[1] = xform[0]->next;
 
-	if (n_tokens == 0 ||
-		strcmp(tokens[0], "tc1")) {
-		a->mtr.tc_mask = 1;
-		a->action_mask |= 1 << RTE_TABLE_ACTION_MTR;
-		return 1 + 10;
-	}
+	for (i = 0; i < 2; i++) {
+		if (xform[i] == NULL)
+			continue;
 
-	if (n_tokens < 30 ||
-		(parse_table_action_meter_tc(tokens + 1,
-			n_tokens - 1, &a->mtr.mtr[1]) == 0) ||
-		strcmp(tokens[10], "tc2") ||
-		(parse_table_action_meter_tc(tokens + 11,
-			n_tokens - 11, &a->mtr.mtr[2]) == 0) ||
-		strcmp(tokens[20], "tc3") ||
-		(parse_table_action_meter_tc(tokens + 21,
-			n_tokens - 21, &a->mtr.mtr[3]) == 0))
-		return 0;
+		switch (xform[i]->type) {
+		case RTE_CRYPTO_SYM_XFORM_CIPHER:
+			if (p->cipher_auth.cipher_iv.val)
+				free(p->cipher_auth.cipher_iv.val);
+			if (p->cipher_auth.cipher_iv_update.val)
+				free(p->cipher_auth.cipher_iv_update.val);
+			break;
+		case RTE_CRYPTO_SYM_XFORM_AUTH:
+			if (p->cipher_auth.auth_iv.val)
+				free(p->cipher_auth.cipher_iv.val);
+			if (p->cipher_auth.auth_iv_update.val)
+				free(p->cipher_auth.cipher_iv_update.val);
+			break;
+		case RTE_CRYPTO_SYM_XFORM_AEAD:
+			if (p->aead.iv.val)
+				free(p->aead.iv.val);
+			if (p->aead.aad.val)
+				free(p->aead.aad.val);
+			break;
+		default:
+			continue;
+		}
+	}
 
-	a->mtr.tc_mask = 0xF;
-	a->action_mask |= 1 << RTE_TABLE_ACTION_MTR;
-	return 1 + 10 + 3 * 10;
 }
 
-static uint32_t
-parse_table_action_tm(char **tokens,
-	uint32_t n_tokens,
-	struct softnic_table_rule_action *a)
+static struct rte_crypto_sym_xform *
+parse_table_action_cipher(struct rte_table_action_sym_crypto_params *p,
+		uint8_t *key, uint32_t max_key_len, char **tokens,
+		uint32_t n_tokens, uint32_t encrypt, uint32_t *used_n_tokens)
 {
-	uint32_t subport_id, pipe_id;
-
-	if (n_tokens < 5 ||
-		strcmp(tokens[0], "tm") ||
-		strcmp(tokens[1], "subport") ||
-		softnic_parser_read_uint32(&subport_id, tokens[2]) ||
-		strcmp(tokens[3], "pipe") ||
-		softnic_parser_read_uint32(&pipe_id, tokens[4]))
-		return 0;
+	struct rte_crypto_sym_xform *xform_cipher;
+	int status;
+	size_t len;
 
-	a->tm.subport_id = subport_id;
-	a->tm.pipe_id = pipe_id;
-	a->action_mask |= 1 << RTE_TABLE_ACTION_TM;
-	return 5;
-}
+	if (n_tokens < 7 || strcmp(tokens[1], "cipher_algo") ||
+			strcmp(tokens[3], "cipher_key") ||
+			strcmp(tokens[5], "cipher_iv"))
+		return NULL;
 
-static uint32_t
-parse_table_action_encap(char **tokens,
-	uint32_t n_tokens,
-	struct softnic_table_rule_action *a)
-{
-	if (n_tokens == 0 ||
-		strcmp(tokens[0], "encap"))
-		return 0;
+	xform_cipher = calloc(1, sizeof(*xform_cipher));
+	if (xform_cipher == NULL)
+		return NULL;
 
-	tokens++;
-	n_tokens--;
+	xform_cipher->type = RTE_CRYPTO_SYM_XFORM_CIPHER;
+	xform_cipher->cipher.op = encrypt ? RTE_CRYPTO_CIPHER_OP_ENCRYPT :
+			RTE_CRYPTO_CIPHER_OP_DECRYPT;
 
-	/* ether */
-	if (n_tokens && (strcmp(tokens[0], "ether") == 0)) {
-		if (n_tokens < 3 ||
-			softnic_parse_mac_addr(tokens[1], &a->encap.ether.ether.da) ||
-			softnic_parse_mac_addr(tokens[2], &a->encap.ether.ether.sa))
-			return 0;
+	/* cipher_algo */
+	status = rte_cryptodev_get_cipher_algo_enum(
+			&xform_cipher->cipher.algo, tokens[2]);
+	if (status < 0)
+		goto error_exit;
 
-		a->encap.type = RTE_TABLE_ACTION_ENCAP_ETHER;
-		a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
-		return 1 + 3;
+	/* cipher_key */
+	len = strlen(tokens[4]);
+	if (len / 2 > max_key_len) {
+		status = -ENOMEM;
+		goto error_exit;
 	}
 
-	/* vlan */
-	if (n_tokens && (strcmp(tokens[0], "vlan") == 0)) {
-		uint32_t pcp, dei, vid;
+	status = softnic_parse_hex_string(tokens[4], key, (uint32_t *)&len);
+	if (status < 0)
+		goto error_exit;
 
-		if (n_tokens < 6 ||
-			softnic_parse_mac_addr(tokens[1], &a->encap.vlan.ether.da) ||
-			softnic_parse_mac_addr(tokens[2], &a->encap.vlan.ether.sa) ||
-			softnic_parser_read_uint32(&pcp, tokens[3]) ||
-			pcp > 0x7 ||
-			softnic_parser_read_uint32(&dei, tokens[4]) ||
-			dei > 0x1 ||
-			softnic_parser_read_uint32(&vid, tokens[5]) ||
-			vid > 0xFFF)
-			return 0;
+	xform_cipher->cipher.key.data = key;
+	xform_cipher->cipher.key.length = (uint16_t)len;
 
-		a->encap.vlan.vlan.pcp = pcp & 0x7;
-		a->encap.vlan.vlan.dei = dei & 0x1;
-		a->encap.vlan.vlan.vid = vid & 0xFFF;
-		a->encap.type = RTE_TABLE_ACTION_ENCAP_VLAN;
-		a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
-		return 1 + 6;
+	/* cipher_iv */
+	len = strlen(tokens[6]);
+
+	p->cipher_auth.cipher_iv.val = calloc(1, len / 2 + 1);
+	if (p->cipher_auth.cipher_iv.val == NULL)
+		goto error_exit;
+
+	status = softnic_parse_hex_string(tokens[6],
+			p->cipher_auth.cipher_iv.val,
+			(uint32_t *)&len);
+	if (status < 0)
+		goto error_exit;
+
+	xform_cipher->cipher.iv.length = (uint16_t)len;
+	xform_cipher->cipher.iv.offset = RTE_TABLE_ACTION_SYM_CRYPTO_IV_OFFSET;
+	p->cipher_auth.cipher_iv.length = (uint32_t)len;
+	*used_n_tokens = 7;
+
+	return xform_cipher;
+
+error_exit:
+	if (p->cipher_auth.cipher_iv.val) {
+		free(p->cipher_auth.cipher_iv.val);
+		p->cipher_auth.cipher_iv.val = NULL;
 	}
 
-	/* qinq */
-	if (n_tokens && (strcmp(tokens[0], "qinq") == 0)) {
-		uint32_t svlan_pcp, svlan_dei, svlan_vid;
-		uint32_t cvlan_pcp, cvlan_dei, cvlan_vid;
+	free(xform_cipher);
 
-		if (n_tokens < 9 ||
-			softnic_parse_mac_addr(tokens[1], &a->encap.qinq.ether.da) ||
-			softnic_parse_mac_addr(tokens[2], &a->encap.qinq.ether.sa) ||
-			softnic_parser_read_uint32(&svlan_pcp, tokens[3]) ||
-			svlan_pcp > 0x7 ||
-			softnic_parser_read_uint32(&svlan_dei, tokens[4]) ||
-			svlan_dei > 0x1 ||
-			softnic_parser_read_uint32(&svlan_vid, tokens[5]) ||
-			svlan_vid > 0xFFF ||
-			softnic_parser_read_uint32(&cvlan_pcp, tokens[6]) ||
-			cvlan_pcp > 0x7 ||
-			softnic_parser_read_uint32(&cvlan_dei, tokens[7]) ||
-			cvlan_dei > 0x1 ||
-			softnic_parser_read_uint32(&cvlan_vid, tokens[8]) ||
-			cvlan_vid > 0xFFF)
-			return 0;
+	return NULL;
+}
 
-		a->encap.qinq.svlan.pcp = svlan_pcp & 0x7;
-		a->encap.qinq.svlan.dei = svlan_dei & 0x1;
-		a->encap.qinq.svlan.vid = svlan_vid & 0xFFF;
-		a->encap.qinq.cvlan.pcp = cvlan_pcp & 0x7;
-		a->encap.qinq.cvlan.dei = cvlan_dei & 0x1;
-		a->encap.qinq.cvlan.vid = cvlan_vid & 0xFFF;
-		a->encap.type = RTE_TABLE_ACTION_ENCAP_QINQ;
-		a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
-		return 1 + 9;
+static struct rte_crypto_sym_xform *
+parse_table_action_cipher_auth(struct rte_table_action_sym_crypto_params *p,
+		uint8_t *key, uint32_t max_key_len, char **tokens,
+		uint32_t n_tokens, uint32_t encrypt, uint32_t *used_n_tokens)
+{
+	struct rte_crypto_sym_xform *xform_cipher;
+	struct rte_crypto_sym_xform *xform_auth;
+	int status;
+	size_t len;
+
+	if (n_tokens < 13 ||
+			strcmp(tokens[7], "auth_algo") ||
+			strcmp(tokens[9], "auth_key") ||
+			strcmp(tokens[11], "digest_size"))
+		return NULL;
+
+	xform_auth = calloc(1, sizeof(*xform_auth));
+	if (xform_auth == NULL)
+		return NULL;
+
+	xform_auth->type = RTE_CRYPTO_SYM_XFORM_AUTH;
+	xform_auth->auth.op = encrypt ? RTE_CRYPTO_AUTH_OP_GENERATE :
+			RTE_CRYPTO_AUTH_OP_VERIFY;
+
+	/* auth_algo */
+	status = rte_cryptodev_get_auth_algo_enum(&xform_auth->auth.algo,
+			tokens[8]);
+	if (status < 0)
+		goto error_exit;
+
+	/* auth_key */
+	len = strlen(tokens[10]);
+	if (len / 2 > max_key_len) {
+		status = -ENOMEM;
+		goto error_exit;
 	}
 
-	/* mpls */
-	if (n_tokens && (strcmp(tokens[0], "mpls") == 0)) {
-		uint32_t label, tc, ttl;
+	status = softnic_parse_hex_string(tokens[10], key, (uint32_t *)&len);
+	if (status < 0)
+		goto error_exit;
 
-		if (n_tokens < 8)
-			return 0;
+	xform_auth->auth.key.data = key;
+	xform_auth->auth.key.length = (uint16_t)len;
 
-		if (strcmp(tokens[1], "unicast") == 0)
-			a->encap.mpls.unicast = 1;
-		else if (strcmp(tokens[1], "multicast") == 0)
-			a->encap.mpls.unicast = 0;
-		else
-			return 0;
+	key += xform_auth->auth.key.length;
+	max_key_len -= xform_auth->auth.key.length;
 
-		if (softnic_parse_mac_addr(tokens[2], &a->encap.mpls.ether.da) ||
-			softnic_parse_mac_addr(tokens[3], &a->encap.mpls.ether.sa) ||
-			strcmp(tokens[4], "label0") ||
-			softnic_parser_read_uint32(&label, tokens[5]) ||
-			label > 0xFFFFF ||
-			softnic_parser_read_uint32(&tc, tokens[6]) ||
-			tc > 0x7 ||
-			softnic_parser_read_uint32(&ttl, tokens[7]) ||
-			ttl > 0x3F)
-			return 0;
+	if (strcmp(tokens[11], "digest_size"))
+		goto error_exit;
 
-		a->encap.mpls.mpls[0].label = label;
-		a->encap.mpls.mpls[0].tc = tc;
-		a->encap.mpls.mpls[0].ttl = ttl;
+	status = softnic_parser_read_uint16(&xform_auth->auth.digest_length,
+			tokens[12]);
+	if (status < 0)
+		goto error_exit;
 
-		tokens += 8;
-		n_tokens -= 8;
+	xform_cipher = parse_table_action_cipher(p, key, max_key_len, tokens, 7,
+			encrypt, used_n_tokens);
+	if (xform_cipher == NULL)
+		goto error_exit;
 
-		if (n_tokens == 0 ||
-			strcmp(tokens[0], "label1")) {
-			a->encap.mpls.mpls_count = 1;
-			a->encap.type = RTE_TABLE_ACTION_ENCAP_MPLS;
-			a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
-			return 1 + 8;
-		}
+	*used_n_tokens += 6;
 
-		if (n_tokens < 4 ||
-			softnic_parser_read_uint32(&label, tokens[1]) ||
-			label > 0xFFFFF ||
-			softnic_parser_read_uint32(&tc, tokens[2]) ||
-			tc > 0x7 ||
-			softnic_parser_read_uint32(&ttl, tokens[3]) ||
-			ttl > 0x3F)
-			return 0;
+	if (encrypt) {
+		xform_cipher->next = xform_auth;
+		return xform_cipher;
+	} else {
+		xform_auth->next = xform_cipher;
+		return xform_auth;
+	}
+
+error_exit:
+	if (p->cipher_auth.auth_iv.val) {
+		free(p->cipher_auth.auth_iv.val);
+		p->cipher_auth.auth_iv.val = 0;
+	}
+
+	free(xform_auth);
+
+	return NULL;
+}
+
+static struct rte_crypto_sym_xform *
+parse_table_action_aead(struct rte_table_action_sym_crypto_params *p,
+		uint8_t *key, uint32_t max_key_len, char **tokens,
+		uint32_t n_tokens, uint32_t encrypt, uint32_t *used_n_tokens)
+{
+	struct rte_crypto_sym_xform *xform_aead;
+	int status;
+	size_t len;
+
+	if (n_tokens < 11 || strcmp(tokens[1], "aead_algo") ||
+			strcmp(tokens[3], "aead_key") ||
+			strcmp(tokens[5], "aead_iv") ||
+			strcmp(tokens[7], "aead_aad") ||
+			strcmp(tokens[9], "digest_size"))
+		return NULL;
 
-		a->encap.mpls.mpls[1].label = label;
-		a->encap.mpls.mpls[1].tc = tc;
-		a->encap.mpls.mpls[1].ttl = ttl;
+	xform_aead = calloc(1, sizeof(*xform_aead));
+	if (xform_aead == NULL)
+		return NULL;
 
-		tokens += 4;
-		n_tokens -= 4;
+	xform_aead->type = RTE_CRYPTO_SYM_XFORM_AEAD;
+	xform_aead->aead.op = encrypt ? RTE_CRYPTO_AEAD_OP_ENCRYPT :
+			RTE_CRYPTO_AEAD_OP_DECRYPT;
 
-		if (n_tokens == 0 ||
-			strcmp(tokens[0], "label2")) {
-			a->encap.mpls.mpls_count = 2;
-			a->encap.type = RTE_TABLE_ACTION_ENCAP_MPLS;
-			a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
-			return 1 + 8 + 4;
-		}
+	/* aead_algo */
+	status = rte_cryptodev_get_aead_algo_enum(&xform_aead->aead.algo,
+			tokens[2]);
+	if (status < 0)
+		goto error_exit;
 
-		if (n_tokens < 4 ||
-			softnic_parser_read_uint32(&label, tokens[1]) ||
-			label > 0xFFFFF ||
-			softnic_parser_read_uint32(&tc, tokens[2]) ||
-			tc > 0x7 ||
-			softnic_parser_read_uint32(&ttl, tokens[3]) ||
-			ttl > 0x3F)
-			return 0;
+	/* aead_key */
+	len = strlen(tokens[4]);
+	if (len / 2 > max_key_len) {
+		status = -ENOMEM;
+		goto error_exit;
+	}
 
-		a->encap.mpls.mpls[2].label = label;
-		a->encap.mpls.mpls[2].tc = tc;
-		a->encap.mpls.mpls[2].ttl = ttl;
+	status = softnic_parse_hex_string(tokens[4], key, (uint32_t *)&len);
+	if (status < 0)
+		goto error_exit;
 
-		tokens += 4;
-		n_tokens -= 4;
+	xform_aead->aead.key.data = key;
+	xform_aead->aead.key.length = (uint16_t)len;
 
-		if (n_tokens == 0 ||
-			strcmp(tokens[0], "label3")) {
-			a->encap.mpls.mpls_count = 3;
-			a->encap.type = RTE_TABLE_ACTION_ENCAP_MPLS;
-			a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
-			return 1 + 8 + 4 + 4;
-		}
+	/* aead_iv */
+	len = strlen(tokens[6]);
+	p->aead.iv.val = calloc(1, len / 2 + 1);
+	if (p->aead.iv.val == NULL)
+		goto error_exit;
 
-		if (n_tokens < 4 ||
-			softnic_parser_read_uint32(&label, tokens[1]) ||
-			label > 0xFFFFF ||
-			softnic_parser_read_uint32(&tc, tokens[2]) ||
-			tc > 0x7 ||
-			softnic_parser_read_uint32(&ttl, tokens[3]) ||
-			ttl > 0x3F)
-			return 0;
+	status = softnic_parse_hex_string(tokens[6], p->aead.iv.val,
+			(uint32_t *)&len);
+	if (status < 0)
+		goto error_exit;
 
-		a->encap.mpls.mpls[3].label = label;
-		a->encap.mpls.mpls[3].tc = tc;
-		a->encap.mpls.mpls[3].ttl = ttl;
+	xform_aead->aead.iv.length = (uint16_t)len;
+	xform_aead->aead.iv.offset = RTE_TABLE_ACTION_SYM_CRYPTO_IV_OFFSET;
+	p->aead.iv.length = (uint32_t)len;
 
-		a->encap.mpls.mpls_count = 4;
-		a->encap.type = RTE_TABLE_ACTION_ENCAP_MPLS;
-		a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
-		return 1 + 8 + 4 + 4 + 4;
-	}
+	/* aead_aad */
+	len = strlen(tokens[8]);
+	p->aead.aad.val = calloc(1, len / 2 + 1);
+	if (p->aead.aad.val == NULL)
+		goto error_exit;
 
-	/* pppoe */
-	if (n_tokens && (strcmp(tokens[0], "pppoe") == 0)) {
-		if (n_tokens < 4 ||
-			softnic_parse_mac_addr(tokens[1], &a->encap.pppoe.ether.da) ||
-			softnic_parse_mac_addr(tokens[2], &a->encap.pppoe.ether.sa) ||
-			softnic_parser_read_uint16(&a->encap.pppoe.pppoe.session_id,
-				tokens[3]))
-			return 0;
+	status = softnic_parse_hex_string(tokens[8], p->aead.aad.val, (uint32_t *)&len);
+	if (status < 0)
+		goto error_exit;
 
-		a->encap.type = RTE_TABLE_ACTION_ENCAP_PPPOE;
-		a->action_mask |= 1 << RTE_TABLE_ACTION_ENCAP;
-		return 1 + 4;
+	xform_aead->aead.aad_length = (uint16_t)len;
+	p->aead.aad.length = (uint32_t)len;
+
+	/* digest_size */
+	status = softnic_parser_read_uint16(&xform_aead->aead.digest_length,
+			tokens[10]);
+	if (status < 0)
+		goto error_exit;
+
+	*used_n_tokens = 11;
+
+	return xform_aead;
+
+error_exit:
+	if (p->aead.iv.val) {
+		free(p->aead.iv.val);
+		p->aead.iv.val = NULL;
+	}
+	if (p->aead.aad.val) {
+		free(p->aead.aad.val);
+		p->aead.aad.val = NULL;
 	}
 
-	return 0;
+	free(xform_aead);
+
+	return NULL;
 }
 
+
 static uint32_t
-parse_table_action_nat(char **tokens,
+parse_table_action_sym_crypto(char **tokens,
 	uint32_t n_tokens,
 	struct softnic_table_rule_action *a)
 {
-	if (n_tokens < 4 ||
-		strcmp(tokens[0], "nat"))
+	struct rte_table_action_sym_crypto_params *p = &a->sym_crypto;
+	struct rte_crypto_sym_xform *xform = NULL;
+	uint8_t *key = a->sym_crypto_key;
+	uint32_t max_key_len = SYM_CRYPTO_MAX_KEY_SIZE;
+	uint32_t used_n_tokens;
+	uint32_t encrypt;
+	int status;
+
+	if ((n_tokens < 12) ||
+		strcmp(tokens[0], "sym_crypto") ||
+		strcmp(tokens[2], "type"))
 		return 0;
 
-	if (strcmp(tokens[1], "ipv4") == 0) {
-		struct in_addr addr;
-		uint16_t port;
+	memset(p, 0, sizeof(*p));
 
-		if (softnic_parse_ipv4_addr(tokens[2], &addr) ||
-			softnic_parser_read_uint16(&port, tokens[3]))
-			return 0;
+	if (strcmp(tokens[1], "encrypt") == 0)
+		encrypt = 1;
+	else
+		encrypt = 0;
 
-		a->nat.ip_version = 1;
-		a->nat.addr.ipv4 = rte_be_to_cpu_32(addr.s_addr);
-		a->nat.port = port;
-		a->action_mask |= 1 << RTE_TABLE_ACTION_NAT;
-		return 4;
+	status = softnic_parser_read_uint32(&p->data_offset, tokens[n_tokens - 1]);
+	if (status < 0)
+		return 0;
+
+	if (strcmp(tokens[3], "cipher") == 0) {
+		tokens += 3;
+		n_tokens -= 3;
+
+		xform = parse_table_action_cipher(p, key, max_key_len, tokens,
+				n_tokens, encrypt, &used_n_tokens);
+	} else if (strcmp(tokens[3], "cipher_auth") == 0) {
+		tokens += 3;
+		n_tokens -= 3;
+
+		xform = parse_table_action_cipher_auth(p, key, max_key_len,
+				tokens, n_tokens, encrypt, &used_n_tokens);
+	} else if (strcmp(tokens[3], "aead") == 0) {
+		tokens += 3;
+		n_tokens -= 3;
+
+		xform = parse_table_action_aead(p, key, max_key_len, tokens,
+				n_tokens, encrypt, &used_n_tokens);
 	}
 
-	if (strcmp(tokens[1], "ipv6") == 0) {
-		struct in6_addr addr;
-		uint16_t port;
+	if (xform == NULL)
+		return 0;
 
-		if (softnic_parse_ipv6_addr(tokens[2], &addr) ||
-			softnic_parser_read_uint16(&port, tokens[3]))
-			return 0;
+	p->xform = xform;
 
-		a->nat.ip_version = 0;
-		memcpy(a->nat.addr.ipv6, addr.s6_addr, 16);
-		a->nat.port = port;
-		a->action_mask |= 1 << RTE_TABLE_ACTION_NAT;
-		return 4;
+	if (strcmp(tokens[used_n_tokens], "data_offset")) {
+		parse_free_sym_crypto_param_data(p);
+		return 0;
 	}
 
-	return 0;
+	a->action_mask |= 1 << RTE_TABLE_ACTION_SYM_CRYPTO;
+
+	return used_n_tokens + 5;
 }
 
 static uint32_t
-parse_table_action_ttl(char **tokens,
+parse_table_action_tag(char **tokens,
 	uint32_t n_tokens,
 	struct softnic_table_rule_action *a)
 {
 	if (n_tokens < 2 ||
-		strcmp(tokens[0], "ttl"))
+		strcmp(tokens[0], "tag"))
 		return 0;
 
-	if (strcmp(tokens[1], "dec") == 0)
-		a->ttl.decrement = 1;
-	else if (strcmp(tokens[1], "keep") == 0)
-		a->ttl.decrement = 0;
-	else
+	if (softnic_parser_read_uint32(&a->tag.tag, tokens[1]))
 		return 0;
 
-	a->action_mask |= 1 << RTE_TABLE_ACTION_TTL;
+	a->action_mask |= 1 << RTE_TABLE_ACTION_TAG;
 	return 2;
 }
 
 static uint32_t
-parse_table_action_stats(char **tokens,
+parse_table_action_decap(char **tokens,
 	uint32_t n_tokens,
 	struct softnic_table_rule_action *a)
 {
-	if (n_tokens < 1 ||
-		strcmp(tokens[0], "stats"))
+	if (n_tokens < 2 ||
+		strcmp(tokens[0], "decap"))
 		return 0;
 
-	a->stats.n_packets = 0;
-	a->stats.n_bytes = 0;
-	a->action_mask |= 1 << RTE_TABLE_ACTION_STATS;
-	return 1;
-}
-
-static uint32_t
-parse_table_action_time(char **tokens,
-	uint32_t n_tokens,
-	struct softnic_table_rule_action *a)
-{
-	if (n_tokens < 1 ||
-		strcmp(tokens[0], "time"))
+	if (softnic_parser_read_uint16(&a->decap.n, tokens[1]))
 		return 0;
 
-	a->time.time = rte_rdtsc();
-	a->action_mask |= 1 << RTE_TABLE_ACTION_TIME;
-	return 1;
+	a->action_mask |= 1 << RTE_TABLE_ACTION_DECAP;
+	return 2;
 }
 
 static uint32_t
@@ -2936,6 +4998,47 @@ parse_table_action(char **tokens,
 		n_tokens -= n;
 	}
 
+	if (n_tokens && (strcmp(tokens[0], "tag") == 0)) {
+		uint32_t n;
+
+		n = parse_table_action_tag(tokens, n_tokens, a);
+		if (n == 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID,
+				"action tag");
+			return 0;
+		}
+
+		tokens += n;
+		n_tokens -= n;
+	}
+
+	if (n_tokens && (strcmp(tokens[0], "decap") == 0)) {
+		uint32_t n;
+
+		n = parse_table_action_decap(tokens, n_tokens, a);
+		if (n == 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID,
+				"action decap");
+			return 0;
+		}
+
+		tokens += n;
+		n_tokens -= n;
+	}
+
+	if (n_tokens && (strcmp(tokens[0], "sym_crypto") == 0)) {
+		uint32_t n;
+
+		n = parse_table_action_sym_crypto(tokens, n_tokens, a);
+		if (n == 0) {
+			snprintf(out, out_size, MSG_ARG_INVALID,
+				"action sym_crypto");
+		}
+
+		tokens += n;
+		n_tokens -= n;
+	}
+
 	if (n_tokens0 - n_tokens == 1) {
 		snprintf(out, out_size, MSG_ARG_INVALID, "action");
 		return 0;
@@ -3704,7 +5807,7 @@ load_dscp_table(struct rte_table_action_dscp_table *dscp_table,
 	for (dscp = 0, l = 1; ; l++) {
 		char line[64];
 		char *tokens[3];
-		enum rte_meter_color color;
+		enum rte_color color;
 		uint32_t tc_id, tc_queue_id, n_tokens = RTE_DIM(tokens);
 
 		if (fgets(line, sizeof(line), f) == NULL)
@@ -3737,17 +5840,17 @@ load_dscp_table(struct rte_table_action_dscp_table *dscp_table,
 		switch (tokens[2][0]) {
 		case 'g':
 		case 'G':
-			color = e_RTE_METER_GREEN;
+			color = RTE_COLOR_GREEN;
 			break;
 
 		case 'y':
 		case 'Y':
-			color = e_RTE_METER_YELLOW;
+			color = RTE_COLOR_YELLOW;
 			break;
 
 		case 'r':
 		case 'R':
-			color = e_RTE_METER_RED;
+			color = RTE_COLOR_RED;
 			break;
 
 		default:
@@ -3820,6 +5923,19 @@ cmd_pipeline_table_dscp(struct pmd_internals *softnic,
 	}
 }
 
+/**
+ * pipeline <pipeline_name> table <table_id> rule read ttl [clear]
+ */
+static void
+cmd_softnic_pipeline_table_rule_ttl_read(struct pmd_internals *softnic __rte_unused,
+	char **tokens,
+	uint32_t n_tokens __rte_unused,
+	char *out,
+	size_t out_size)
+{
+	snprintf(out, out_size, MSG_CMD_UNIMPLEM, tokens[0]);
+}
+
 /**
  * thread <thread_id> pipeline <pipeline_name> enable
  */
@@ -3907,6 +6023,81 @@ cmd_softnic_thread_pipeline_disable(struct pmd_internals *softnic,
 	}
 }
 
+/**
+ * flowapi map
+ *  group <group_id>
+ *  ingress | egress
+ *  pipeline <pipeline_name>
+ *  table <table_id>
+ */
+static void
+cmd_softnic_flowapi_map(struct pmd_internals *softnic,
+		char **tokens,
+		uint32_t n_tokens,
+		char *out,
+		size_t out_size)
+{
+	char *pipeline_name;
+	uint32_t group_id, table_id;
+	int ingress, status;
+
+	if (n_tokens != 9) {
+		snprintf(out, out_size, MSG_ARG_MISMATCH, tokens[0]);
+		return;
+	}
+
+	if (strcmp(tokens[1], "map") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "map");
+		return;
+	}
+
+	if (strcmp(tokens[2], "group") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "group");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&group_id, tokens[3]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "group_id");
+		return;
+	}
+
+	if (strcmp(tokens[4], "ingress") == 0) {
+		ingress = 1;
+	} else if (strcmp(tokens[4], "egress") == 0) {
+		ingress = 0;
+	} else {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "ingress | egress");
+		return;
+	}
+
+	if (strcmp(tokens[5], "pipeline") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "pipeline");
+		return;
+	}
+
+	pipeline_name = tokens[6];
+
+	if (strcmp(tokens[7], "table") != 0) {
+		snprintf(out, out_size, MSG_ARG_NOT_FOUND, "table");
+		return;
+	}
+
+	if (softnic_parser_read_uint32(&table_id, tokens[8]) != 0) {
+		snprintf(out, out_size, MSG_ARG_INVALID, "table_id");
+		return;
+	}
+
+	status = flow_attr_map_set(softnic,
+			group_id,
+			ingress,
+			pipeline_name,
+			table_id);
+	if (status) {
+		snprintf(out, out_size, MSG_CMD_FAIL, tokens[0]);
+		return;
+	}
+}
+
 void
 softnic_cli_process(char *in, char *out, size_t out_size, void *arg)
 {
@@ -3942,11 +6133,56 @@ softnic_cli_process(char *in, char *out, size_t out_size, void *arg)
 		return;
 	}
 
+	if (strcmp(tokens[0], "tmgr") == 0) {
+		if (n_tokens == 2) {
+			cmd_tmgr(softnic, tokens, n_tokens, out, out_size);
+			return;
+		}
+
+		if (n_tokens >= 3 &&
+			(strcmp(tokens[1], "shaper") == 0) &&
+			(strcmp(tokens[2], "profile") == 0)) {
+			cmd_tmgr_shaper_profile(softnic, tokens, n_tokens, out, out_size);
+			return;
+		}
+
+		if (n_tokens >= 3 &&
+			(strcmp(tokens[1], "shared") == 0) &&
+			(strcmp(tokens[2], "shaper") == 0)) {
+			cmd_tmgr_shared_shaper(softnic, tokens, n_tokens, out, out_size);
+			return;
+		}
+
+		if (n_tokens >= 2 &&
+			(strcmp(tokens[1], "node") == 0)) {
+			cmd_tmgr_node(softnic, tokens, n_tokens, out, out_size);
+			return;
+		}
+
+		if (n_tokens >= 2 &&
+			(strcmp(tokens[1], "hierarchy-default") == 0)) {
+			cmd_tmgr_hierarchy_default(softnic, tokens, n_tokens, out, out_size);
+			return;
+		}
+
+		if (n_tokens >= 3 &&
+			(strcmp(tokens[1], "hierarchy") == 0) &&
+			(strcmp(tokens[2], "commit") == 0)) {
+			cmd_tmgr_hierarchy_commit(softnic, tokens, n_tokens, out, out_size);
+			return;
+		}
+	}
+
 	if (strcmp(tokens[0], "tap") == 0) {
 		cmd_tap(softnic, tokens, n_tokens, out, out_size);
 		return;
 	}
 
+	if (strcmp(tokens[0], "cryptodev") == 0) {
+		cmd_cryptodev(softnic, tokens, n_tokens, out, out_size);
+		return;
+	}
+
 	if (strcmp(tokens[0], "port") == 0) {
 		cmd_port_in_action_profile(softnic, tokens, n_tokens, out, out_size);
 		return;
@@ -4131,6 +6367,16 @@ softnic_cli_process(char *in, char *out, size_t out_size, void *arg)
 				out, out_size);
 			return;
 		}
+
+		if (n_tokens >= 7 &&
+			(strcmp(tokens[2], "table") == 0) &&
+			(strcmp(tokens[4], "rule") == 0) &&
+			(strcmp(tokens[5], "read") == 0) &&
+			(strcmp(tokens[6], "ttl") == 0)) {
+			cmd_softnic_pipeline_table_rule_ttl_read(softnic, tokens, n_tokens,
+				out, out_size);
+			return;
+		}
 	}
 
 	if (strcmp(tokens[0], "thread") == 0) {
@@ -4149,6 +6395,12 @@ softnic_cli_process(char *in, char *out, size_t out_size, void *arg)
 		}
 	}
 
+	if (strcmp(tokens[0], "flowapi") == 0) {
+		cmd_softnic_flowapi_map(softnic, tokens, n_tokens, out,
+					out_size);
+		return;
+	}
+
 	snprintf(out, out_size, MSG_CMD_UNKNOWN, tokens[0]);
 }