Re: [net] Octeontx2-af: Skip overlap check for SPI field

[Simon Horman]

On Fri, Jul 25, 2025 at 12:18:02PM +0530, Hariprasad Kelam wrote:
> Octeontx2/CN10K silicon supports generating a 256-bit key per packet.
> The specific fields to be extracted from a packet for key generation
> are configurable via a Key Extraction (MKEX) Profile.
> 
> The AF driver scans the configured extraction profile to ensure that
> fields from upper layers do not overwrite fields from lower layers in
> the key.
> 
> Example Packet Field Layout:
> LA: DMAC + SMAC
> LB: VLAN
> LC: IPv4/IPv6
> LD: TCP/UDP
> 
> Valid MKEX Profile Configuration:
> 
> LA   -> DMAC   -> key_offset[0-5]
> LC   -> SIP    -> key_offset[20-23]
> LD   -> SPORT  -> key_offset[30-31]
> 
> Invalid MKEX profile configuration:
> 
> LA   -> DMAC   -> key_offset[0-5]
> LC   -> SIP    -> key_offset[20-23]
> LD   -> SPORT  -> key_offset[2-3]  // Overlaps with DMAC field
> 
> In another scenario, if the MKEX profile is configured to extract
> the SPI field from both AH and ESP headers at the same key offset,
> the driver rejecting this configuration. In a regular traffic,
> ipsec packet will be having either AF(LD) or ESP (LE). This patch

Should "AF" be "AH ?

> relaxes the check for the same.
> 
> Fixes: 12aa0a3b93f3 ("octeontx2-af: Harden rule validation.")
> Signed-off-by: Hariprasad Kelam <hkelam@xxxxxxxxxxx>
> ---
>  drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c
> index 1b765045aa63..d8d491a01e5b 100644
> --- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c
> +++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c
> @@ -607,7 +607,7 @@ static void npc_set_features(struct rvu *rvu, int blkaddr, u8 intf)
>  			*features &= ~BIT_ULL(NPC_OUTER_VID);
>  
>  	/* Set SPI flag only if AH/ESP and IPSEC_SPI are in the key */
> -	if (npc_check_field(rvu, blkaddr, NPC_IPSEC_SPI, intf) &&
> +	if (npc_is_field_present(rvu, NPC_IPSEC_SPI, intf) &&

As this checks now differs in form from that of other's in this function,
perhaps expanding the comment above is warranted.

>  	    (*features & (BIT_ULL(NPC_IPPROTO_ESP) | BIT_ULL(NPC_IPPROTO_AH))))
>  		*features |= BIT_ULL(NPC_IPSEC_SPI);
>  
> -- 
> 2.34.1
>