--- zzzz-none-000/linux-3.10.107/net/ipv4/xfrm4_mode_tunnel.c	2017-06-27 09:49:32.000000000 +0000
+++ vr9-7490-729/linux-3.10.107/net/ipv4/xfrm4_mode_tunnel.c	2021-11-10 11:53:56.000000000 +0000
@@ -4,6 +4,12 @@
  * Copyright (c) 2004-2006 Herbert Xu <herbert@gondor.apana.org.au>
  */
 
+/**
+ * Some part of this file is modified by Ikanos Communications. 
+ *
+ * Copyright (C) 2013-2014 Ikanos Communications.
+ */ 
+
 #include <linux/gfp.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -15,6 +21,12 @@
 #include <net/ip.h>
 #include <net/xfrm.h>
 
+#if IS_ENABLED(CONFIG_FUSIV_KERNEL_AP_2_AP)
+#if CONFIG_IPSEC_AP_SUPPORT
+int (*ap2apIPsecUpdateFlowData_ptr)(struct sk_buff *skb, struct xfrm_state *xfrm,int direction) = NULL;
+#endif
+#endif
+
 /* Informational hook. The decap is still done here. */
 static struct xfrm_tunnel __rcu *rcv_notify_handlers __read_mostly;
 static DEFINE_MUTEX(xfrm4_mode_tunnel_input_mutex);
@@ -92,6 +104,17 @@
 	struct iphdr *top_iph;
 	int flags;
 
+#if IS_ENABLED(CONFIG_FUSIV_KERNEL_AP_2_AP)
+#if CONFIG_IPSEC_AP_SUPPORT
+	/* The ESP processing will be done at security AP. Therefore nothing
+	   to do here. */
+	if(ap2apIPsecUpdateFlowData_ptr)
+        {
+            if(!ap2apIPsecUpdateFlowData_ptr(skb,x,PROCESS_ESP_ENCAP))
+                    return 0;
+        }
+#endif
+#endif
 	skb_set_network_header(skb, -x->props.header_len);
 	skb->mac_header = skb->network_header +
 			  offsetof(struct iphdr, protocol);
@@ -191,3 +214,8 @@
 module_exit(xfrm4_mode_tunnel_exit);
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_XFRM_MODE(AF_INET, XFRM_MODE_TUNNEL);
+#if IS_ENABLED(CONFIG_FUSIV_KERNEL_AP_2_AP)
+#if CONFIG_IPSEC_AP_SUPPORT
+EXPORT_SYMBOL(ap2apIPsecUpdateFlowData_ptr);
+#endif
+#endif