Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

Steffen Klassert says:

====================
pull request (net-next): ipsec-next 2018-01-26

One last patch for this development cycle:

1) Add ESN support for IPSec HW offload.
   From Yossef Efraim.

Please pull or let me know if there are problems.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

5 files changed, 27 insertions, 2 deletions

diff --git a/Documentation/networking/xfrm_device.txt b/Documentation/networking/xfrm_device.txt
index 2d9d588cd34b..50c34ca65efe 100644
--- a/Documentation/networking/xfrm_device.txt
+++ b/Documentation/networking/xfrm_device.txt
@@ -41,6 +41,7 @@ struct xfrmdev_ops {
         void    (*xdo_dev_state_free) (struct xfrm_state *x);
         bool    (*xdo_dev_offload_ok) (struct sk_buff *skb,
                                        struct xfrm_state *x);
+        void    (*xdo_dev_state_advance_esn) (struct xfrm_state *x);
 };
 
 The NIC driver offering ipsec offload will need to implement these
@@ -117,6 +118,8 @@ the stack in xfrm_input().
 
         hand the packet to napi_gro_receive() as usual
 
+In ESN mode, xdo_dev_state_advance_esn() is called from xfrm_replay_advance_esn().
+Driver will check packet seq number and update HW ESN state machine if needed.
 
 When the SA is removed by the user, the driver's xdo_dev_state_delete()
 is asked to disable the offload.  Later, xdo_dev_state_free() is called
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 24a62d590350..cd46d3d63aa0 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -851,6 +851,7 @@ struct xfrmdev_ops {
         void    (*xdo_dev_state_free) (struct xfrm_state *x);
         bool    (*xdo_dev_offload_ok) (struct sk_buff *skb,
                                        struct xfrm_state *x);
+        void    (*xdo_dev_state_advance_esn) (struct xfrm_state *x);
 };
 #endif
 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 2e6d4fe6b0ba..7d2077665c0b 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1904,6 +1904,14 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
                        struct xfrm_user_offload *xuo);
 bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x);
 
+static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
+{
+        struct xfrm_state_offload *xso = &x->xso;
+
+        if (xso->dev && xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn)
+                xso->dev->xfrmdev_ops->xdo_dev_state_advance_esn(x);
+}
+
 static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
 {
         struct xfrm_state *x = dst->xfrm;
@@ -1974,6 +1982,10 @@ static inline bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x
         return false;
 }
 
+static inline void xfrm_dev_state_advance_esn(struct xfrm_state *x)
+{
+}
+
 static inline bool xfrm_dst_offload_ok(struct dst_entry *dst)
 {
         return false;
diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index 92b4648e75ca..8e70291e586a 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -147,8 +147,8 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
         if (!x->type_offload)
                 return -EINVAL;
 
-        /* We don't yet support UDP encapsulation, TFC padding and ESN. */
-        if (x->encap || x->tfcpad || (x->props.flags & XFRM_STATE_ESN))
+        /* We don't yet support UDP encapsulation and TFC padding. */
+        if (x->encap || x->tfcpad)
                 return -EINVAL;
 
         dev = dev_get_by_index(net, xuo->ifindex);
@@ -178,6 +178,13 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
                 return 0;
         }
 
+        if (x->props.flags & XFRM_STATE_ESN &&
+            !dev->xfrmdev_ops->xdo_dev_state_advance_esn) {
+                xso->dev = NULL;
+                dev_put(dev);
+                return -EINVAL;
+        }
+
         xso->dev = dev;
         xso->num_exthdrs = 1;
         xso->flags = xuo->flags;
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 02501817227b..1d38c6acf8af 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -551,6 +551,8 @@ static void xfrm_replay_advance_esn(struct xfrm_state *x, __be32 net_seq)
                         bitnr = replay_esn->replay_window - (diff - pos);
         }
 
+        xfrm_dev_state_advance_esn(x);
+
         nr = bitnr >> 5;
         bitnr = bitnr & 0x1F;
         replay_esn->bmp[nr] |= (1U << bitnr);