Commit 7f95b024 authored by Leon Romanovsky's avatar Leon Romanovsky Committed by Paolo Abeni
Browse files

net/mlx5e: Always start IPsec sequence number from 1 



According to RFC4303, section "3.3.3. Sequence Number Generation",
the first packet sent using a given SA will contain a sequence
number of 1.

This is applicable to both ESN and non-ESN mode, which was not covered
in commit mentioned in Fixes line.

Fixes: 3d42c8cc ("net/mlx5e: Ensure that IPsec sequence packet number starts from 1")
Signed-off-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Reviewed-by: default avatarJacob Keller <jacob.e.keller@intel.com>
Signed-off-by: default avatarTariq Toukan <tariqt@nvidia.com>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent 25f23524

drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c

+6 −0
Original line number Diff line number Diff line
@@ -724,6 +724,12 @@ static int mlx5e_xfrm_add_state(struct xfrm_state *x, 
	/* check esn */

	if (x->props.flags & XFRM_STATE_ESN)

		mlx5e_ipsec_update_esn_state(sa_entry);

	else

		/* According to RFC4303, section "3.3.3. Sequence Number Generation",

		 * the first packet sent using a given SA will contain a sequence

		 * number of 1.

		 */

		sa_entry->esn_state.esn = 1;



	mlx5e_ipsec_build_accel_xfrm_attrs(sa_entry, &sa_entry->attrs);

drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c

+8 −3
Original line number Diff line number Diff line
@@ -91,8 +91,9 @@ u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev) 
EXPORT_SYMBOL_GPL(mlx5_ipsec_device_caps);



static void mlx5e_ipsec_packet_setup(void *obj, u32 pdn,

				     struct mlx5_accel_esp_xfrm_attrs *attrs)

				     struct mlx5e_ipsec_sa_entry *sa_entry)

{

	struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs;

	void *aso_ctx;



	aso_ctx = MLX5_ADDR_OF(ipsec_obj, obj, ipsec_aso);
@@ -120,8 +121,12 @@ static void mlx5e_ipsec_packet_setup(void *obj, u32 pdn, 
	 * active.

	 */

	MLX5_SET(ipsec_obj, obj, aso_return_reg, MLX5_IPSEC_ASO_REG_C_4_5);

	if (attrs->dir == XFRM_DEV_OFFLOAD_OUT)

	if (attrs->dir == XFRM_DEV_OFFLOAD_OUT) {

		MLX5_SET(ipsec_aso, aso_ctx, mode, MLX5_IPSEC_ASO_INC_SN);

		if (!attrs->replay_esn.trigger)

			MLX5_SET(ipsec_aso, aso_ctx, mode_parameter,

				 sa_entry->esn_state.esn);

	}



	if (attrs->lft.hard_packet_limit != XFRM_INF) {

		MLX5_SET(ipsec_aso, aso_ctx, remove_flow_pkt_cnt,
@@ -175,7 +180,7 @@ static int mlx5_create_ipsec_obj(struct mlx5e_ipsec_sa_entry *sa_entry) 


	res = &mdev->mlx5e_res.hw_objs;

	if (attrs->type == XFRM_DEV_OFFLOAD_PACKET)

		mlx5e_ipsec_packet_setup(obj, res->pdn, attrs);

		mlx5e_ipsec_packet_setup(obj, res->pdn, sa_entry);



	err = mlx5_cmd_exec(mdev, in, sizeof(in), out, sizeof(out));

	if (!err)