net/mlx5e: Tidy up IPsec NAT-T SA discovery

IPsec NAT-T packets are UDP encapsulated packets over ESP normal ones.
In case they arrive to RX, the SPI and ESP are located in inner header,
while the check was performed on outer header instead.

That wrong check caused to the situation where received rekeying request
was missed and caused to rekey timeout, which "compensated" this failure
by completing rekeying.

Fixes: d65954934937 ("net/mlx5e: Support IPsec NAT-T functionality")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
index aeb399d8dae504af0c3b4c5d77c4d40706686e68..7a789061c9989388b0a91b5e0049def792569ef8 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
@@ -1212,13 +1212,22 @@ static void setup_fte_esp(struct mlx5_flow_spec *spec)
        MLX5_SET(fte_match_param, spec->match_value, outer_headers.ip_protocol, IPPROTO_ESP);
 }
 
-static void setup_fte_spi(struct mlx5_flow_spec *spec, u32 spi)
+static void setup_fte_spi(struct mlx5_flow_spec *spec, u32 spi, bool encap)
 {
        /* SPI number */
        spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS;
 
-       MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, misc_parameters.outer_esp_spi);
-       MLX5_SET(fte_match_param, spec->match_value, misc_parameters.outer_esp_spi, spi);
+       if (encap) {
+               MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria,
+                                misc_parameters.inner_esp_spi);
+               MLX5_SET(fte_match_param, spec->match_value,
+                        misc_parameters.inner_esp_spi, spi);
+       } else {
+               MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria,
+                                misc_parameters.outer_esp_spi);
+               MLX5_SET(fte_match_param, spec->match_value,
+                        misc_parameters.outer_esp_spi, spi);
+       }
 }
 
 static void setup_fte_no_frags(struct mlx5_flow_spec *spec)
@@ -1596,8 +1605,9 @@ static int rx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
        else
                setup_fte_addr6(spec, attrs->saddr.a6, attrs->daddr.a6);
 
-       setup_fte_spi(spec, attrs->spi);
-       setup_fte_esp(spec);
+       setup_fte_spi(spec, attrs->spi, attrs->encap);
+       if (!attrs->encap)
+               setup_fte_esp(spec);
        setup_fte_no_frags(spec);
        setup_fte_upper_proto_match(spec, &attrs->upspec);
 
@@ -1719,7 +1729,7 @@ static int tx_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
 
        switch (attrs->type) {
        case XFRM_DEV_OFFLOAD_CRYPTO:
-               setup_fte_spi(spec, attrs->spi);
+               setup_fte_spi(spec, attrs->spi, false);
                setup_fte_esp(spec);
                setup_fte_reg_a(spec);
                break;

diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 90ca63f4bf63db5e0a18cfc9610d89b58ab17600..3f7b664d625b94e35539d1184bd2b5fcf109c4b1 100644 (file)
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -621,7 +621,7 @@ struct mlx5_ifc_fte_match_set_misc_bits {
 
        u8         reserved_at_140[0x8];
        u8         bth_dst_qp[0x18];
-       u8         reserved_at_160[0x20];
+       u8         inner_esp_spi[0x20];
        u8         outer_esp_spi[0x20];
        u8         reserved_at_1a0[0x60];
 };