net/mlx5e: Always start IPsec sequence number from 1

According to RFC4303, section "3.3.3. Sequence Number Generation",
the first packet sent using a given SA will contain a sequence
number of 1.

This is applicable to both ESN and non-ESN mode, which was not covered
in commit mentioned in Fixes line.

Fixes: 3d42c8cc67a8 ("net/mlx5e: Ensure that IPsec sequence packet number starts from 1")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
index 21857474ad83fe477790293bcf6f9aa31e71e9b1..1baf8933a07cb0d9a8ef04ed940bc162fb351366 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c
@@ -724,6 +724,12 @@ static int mlx5e_xfrm_add_state(struct xfrm_state *x,
        /* check esn */
        if (x->props.flags & XFRM_STATE_ESN)
                mlx5e_ipsec_update_esn_state(sa_entry);
+       else
+               /* According to RFC4303, section "3.3.3. Sequence Number Generation",
+                * the first packet sent using a given SA will contain a sequence
+                * number of 1.
+                */
+               sa_entry->esn_state.esn = 1;
 
        mlx5e_ipsec_build_accel_xfrm_attrs(sa_entry, &sa_entry->attrs);
 

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c
index 53cfa39188cb0ecca2b6085a5df035093195d46f..820debf3fbbf220c2179096a20fd4065f94f06dd 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c
@@ -91,8 +91,9 @@ u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev)
 EXPORT_SYMBOL_GPL(mlx5_ipsec_device_caps);
 
 static void mlx5e_ipsec_packet_setup(void *obj, u32 pdn,
-                                    struct mlx5_accel_esp_xfrm_attrs *attrs)
+                                    struct mlx5e_ipsec_sa_entry *sa_entry)
 {
+       struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs;
        void *aso_ctx;
 
        aso_ctx = MLX5_ADDR_OF(ipsec_obj, obj, ipsec_aso);
@@ -120,8 +121,12 @@ static void mlx5e_ipsec_packet_setup(void *obj, u32 pdn,
         * active.
         */
        MLX5_SET(ipsec_obj, obj, aso_return_reg, MLX5_IPSEC_ASO_REG_C_4_5);
-       if (attrs->dir == XFRM_DEV_OFFLOAD_OUT)
+       if (attrs->dir == XFRM_DEV_OFFLOAD_OUT) {
                MLX5_SET(ipsec_aso, aso_ctx, mode, MLX5_IPSEC_ASO_INC_SN);
+               if (!attrs->replay_esn.trigger)
+                       MLX5_SET(ipsec_aso, aso_ctx, mode_parameter,
+                                sa_entry->esn_state.esn);
+       }
 
        if (attrs->lft.hard_packet_limit != XFRM_INF) {
                MLX5_SET(ipsec_aso, aso_ctx, remove_flow_pkt_cnt,
@@ -175,7 +180,7 @@ static int mlx5_create_ipsec_obj(struct mlx5e_ipsec_sa_entry *sa_entry)
 
        res = &mdev->mlx5e_res.hw_objs;
        if (attrs->type == XFRM_DEV_OFFLOAD_PACKET)
-               mlx5e_ipsec_packet_setup(obj, res->pdn, attrs);
+               mlx5e_ipsec_packet_setup(obj, res->pdn, sa_entry);
 
        err = mlx5_cmd_exec(mdev, in, sizeof(in), out, sizeof(out));
        if (!err)