Merge "net: macsec: allow multiple macsec devices with offload" (c744619c) · Commits · e / devices / android_kernel_fairphone_FP5

drivers/net/macsec.c

+824 −221

File changed.

Preview size limit exceeded, changes collapsed.

include/linux/phy.h

+8 −0

Original line number	Diff line number	Diff line
		@@ -326,6 +326,9 @@ struct phy_c45_device_ids {
		u32 device_ids[8];
		};

		struct macsec_context;
		struct macsec_ops;

		/* phy_device: An instance of a PHY
		*
		* drv: Pointer to the driver for this PHY instance
		@@ -347,6 +350,7 @@ struct phy_c45_device_ids {
		* attached_dev: The attached enet driver's device instance ptr
		* adjust_link: Callback for the enet controller to respond to
		* changes in the link state.
		* macsec_ops: MACsec offloading ops.
		*
		* speed, duplex, pause, supported, advertising, lp_advertising,
		* and autoneg are used like in mii_if_info
		@@ -448,6 +452,10 @@ struct phy_device {
		ANDROID_KABI_RESERVE(2);
		ANDROID_KABI_RESERVE(3);
		ANDROID_KABI_RESERVE(4);
		#if IS_ENABLED(CONFIG_MACSEC)
		/* MACsec management functions */
		const struct macsec_ops *macsec_ops;
		#endif
		};
		#define to_phy_device(d) container_of(to_mdio_device(d), \
		struct phy_device, mdio)

include/net/macsec.h

0 → 100644

+266 −0

Original line number	Diff line number	Diff line
		/* SPDX-License-Identifier: GPL-2.0+ */
		/*
		* MACsec netdev header, used for h/w accelerated implementations.
		*
		* Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net>
		*/
		#ifndef _NET_MACSEC_H_
		#define _NET_MACSEC_H_

		#include <linux/u64_stats_sync.h>
		#include <uapi/linux/if_link.h>
		#include <uapi/linux/if_macsec.h>

		#define MACSEC_DEFAULT_PN_LEN 4
		#define MACSEC_XPN_PN_LEN 8

		#define MACSEC_SALT_LEN 12
		#define MACSEC_NUM_AN 4 /* 2 bits for the association number */

		typedef u64 __bitwise sci_t;
		typedef u32 __bitwise ssci_t;

		typedef union salt {
		struct {
		u32 ssci;
		u64 pn;
		} __packed;
		u8 bytes[MACSEC_SALT_LEN];
		} __packed salt_t;

		typedef union pn {
		struct {
		#if defined(__LITTLE_ENDIAN_BITFIELD)
		u32 lower;
		u32 upper;
		#elif defined(__BIG_ENDIAN_BITFIELD)
		u32 upper;
		u32 lower;
		#else
		#error "Please fix <asm/byteorder.h>"
		#endif
		};
		u64 full64;
		} pn_t;

		/**
		* struct macsec_key - SA key
		* @id: user-provided key identifier
		* @tfm: crypto struct, key storage
		* @salt: salt used to generate IV in XPN cipher suites
		*/
		struct macsec_key {
		u8 id[MACSEC_KEYID_LEN];
		struct crypto_aead *tfm;
		salt_t salt;
		};

		struct macsec_rx_sc_stats {
		__u64 InOctetsValidated;
		__u64 InOctetsDecrypted;
		__u64 InPktsUnchecked;
		__u64 InPktsDelayed;
		__u64 InPktsOK;
		__u64 InPktsInvalid;
		__u64 InPktsLate;
		__u64 InPktsNotValid;
		__u64 InPktsNotUsingSA;
		__u64 InPktsUnusedSA;
		};

		struct macsec_rx_sa_stats {
		__u32 InPktsOK;
		__u32 InPktsInvalid;
		__u32 InPktsNotValid;
		__u32 InPktsNotUsingSA;
		__u32 InPktsUnusedSA;
		};

		struct macsec_tx_sa_stats {
		__u32 OutPktsProtected;
		__u32 OutPktsEncrypted;
		};

		struct macsec_tx_sc_stats {
		__u64 OutPktsProtected;
		__u64 OutPktsEncrypted;
		__u64 OutOctetsProtected;
		__u64 OutOctetsEncrypted;
		};

		/**
		* struct macsec_rx_sa - receive secure association
		* @active:
		* @next_pn: packet number expected for the next packet
		* @lock: protects next_pn manipulations
		* @key: key structure
		* @ssci: short secure channel identifier
		* @stats: per-SA stats
		*/
		struct macsec_rx_sa {
		struct macsec_key key;
		ssci_t ssci;
		spinlock_t lock;
		union {
		pn_t next_pn_halves;
		u64 next_pn;
		};
		refcount_t refcnt;
		bool active;
		struct macsec_rx_sa_stats __percpu *stats;
		struct macsec_rx_sc *sc;
		struct rcu_head rcu;
		};

		struct pcpu_rx_sc_stats {
		struct macsec_rx_sc_stats stats;
		struct u64_stats_sync syncp;
		};

		struct pcpu_tx_sc_stats {
		struct macsec_tx_sc_stats stats;
		struct u64_stats_sync syncp;
		};

		/**
		* struct macsec_rx_sc - receive secure channel
		* @sci: secure channel identifier for this SC
		* @active: channel is active
		* @sa: array of secure associations
		* @stats: per-SC stats
		*/
		struct macsec_rx_sc {
		struct macsec_rx_sc __rcu *next;
		sci_t sci;
		bool active;
		struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN];
		struct pcpu_rx_sc_stats __percpu *stats;
		refcount_t refcnt;
		struct rcu_head rcu_head;
		};

		/**
		* struct macsec_tx_sa - transmit secure association
		* @active:
		* @next_pn: packet number to use for the next packet
		* @lock: protects next_pn manipulations
		* @key: key structure
		* @ssci: short secure channel identifier
		* @stats: per-SA stats
		*/
		struct macsec_tx_sa {
		struct macsec_key key;
		ssci_t ssci;
		spinlock_t lock;
		union {
		pn_t next_pn_halves;
		u64 next_pn;
		};
		refcount_t refcnt;
		bool active;
		struct macsec_tx_sa_stats __percpu *stats;
		struct rcu_head rcu;
		};

		/**
		* struct macsec_tx_sc - transmit secure channel
		* @active:
		* @encoding_sa: association number of the SA currently in use
		* @encrypt: encrypt packets on transmit, or authenticate only
		* @send_sci: always include the SCI in the SecTAG
		* @end_station:
		* @scb: single copy broadcast flag
		* @sa: array of secure associations
		* @stats: stats for this TXSC
		*/
		struct macsec_tx_sc {
		bool active;
		u8 encoding_sa;
		bool encrypt;
		bool send_sci;
		bool end_station;
		bool scb;
		struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN];
		struct pcpu_tx_sc_stats __percpu *stats;
		};

		/**
		* struct macsec_secy - MACsec Security Entity
		* @netdev: netdevice for this SecY
		* @n_rx_sc: number of receive secure channels configured on this SecY
		* @sci: secure channel identifier used for tx
		* @key_len: length of keys used by the cipher suite
		* @icv_len: length of ICV used by the cipher suite
		* @validate_frames: validation mode
		* @xpn: enable XPN for this SecY
		* @operational: MAC_Operational flag
		* @protect_frames: enable protection for this SecY
		* @replay_protect: enable packet number checks on receive
		* @replay_window: size of the replay window
		* @tx_sc: transmit secure channel
		* @rx_sc: linked list of receive secure channels
		*/
		struct macsec_secy {
		struct net_device *netdev;
		unsigned int n_rx_sc;
		sci_t sci;
		u16 key_len;
		u16 icv_len;
		enum macsec_validation_type validate_frames;
		bool xpn;
		bool operational;
		bool protect_frames;
		bool replay_protect;
		u32 replay_window;
		struct macsec_tx_sc tx_sc;
		struct macsec_rx_sc __rcu *rx_sc;
		};

		/**
		* struct macsec_context - MACsec context for hardware offloading
		*/
		struct macsec_context {
		struct phy_device *phydev;
		enum macsec_offload offload;

		struct macsec_secy *secy;
		struct macsec_rx_sc *rx_sc;
		struct {
		unsigned char assoc_num;
		u8 key[MACSEC_KEYID_LEN];
		union {
		struct macsec_rx_sa *rx_sa;
		struct macsec_tx_sa *tx_sa;
		};
		} sa;

		u8 prepare:1;
		};

		/**
		* struct macsec_ops - MACsec offloading operations
		*/
		struct macsec_ops {
		/* Device wide */
		int (mdo_dev_open)(struct macsec_context ctx);
		int (mdo_dev_stop)(struct macsec_context ctx);
		/* SecY */
		int (mdo_add_secy)(struct macsec_context ctx);
		int (mdo_upd_secy)(struct macsec_context ctx);
		int (mdo_del_secy)(struct macsec_context ctx);
		/* Security channels */
		int (mdo_add_rxsc)(struct macsec_context ctx);
		int (mdo_upd_rxsc)(struct macsec_context ctx);
		int (mdo_del_rxsc)(struct macsec_context ctx);
		/* Security associations */
		int (mdo_add_rxsa)(struct macsec_context ctx);
		int (mdo_upd_rxsa)(struct macsec_context ctx);
		int (mdo_del_rxsa)(struct macsec_context ctx);
		int (mdo_add_txsa)(struct macsec_context ctx);
		int (mdo_upd_txsa)(struct macsec_context ctx);
		int (mdo_del_txsa)(struct macsec_context ctx);
		};

		void macsec_pn_wrapped(struct macsec_secy secy, struct macsec_tx_sa tx_sa);

		#endif /* _NET_MACSEC_H_ */

include/uapi/linux/if_link.h

+7 −0

Original line number	Diff line number	Diff line
		@@ -483,6 +483,13 @@ enum macsec_validation_type {
		MACSEC_VALIDATE_MAX = __MACSEC_VALIDATE_END - 1,
		};

		enum macsec_offload {
		MACSEC_OFFLOAD_OFF = 0,
		MACSEC_OFFLOAD_PHY = 1,
		__MACSEC_OFFLOAD_END,
		MACSEC_OFFLOAD_MAX = __MACSEC_OFFLOAD_END - 1,
		};

		/* IPVLAN section */
		enum {
		IFLA_IPVLAN_UNSPEC,

include/uapi/linux/if_macsec.h

+17 −2

Original line number	Diff line number	Diff line
		@@ -22,9 +22,11 @@

		#define MACSEC_KEYID_LEN 16

		/* cipher IDs as per IEEE802.1AEbn-2011 */
		/* cipher IDs as per IEEE802.1AE-2018 (Table 14-1) */
		#define MACSEC_CIPHER_ID_GCM_AES_128 0x0080C20001000001ULL
		#define MACSEC_CIPHER_ID_GCM_AES_256 0x0080C20001000002ULL
		#define MACSEC_CIPHER_ID_GCM_AES_XPN_128 0x0080C20001000003ULL
		#define MACSEC_CIPHER_ID_GCM_AES_XPN_256 0x0080C20001000004ULL

		/* deprecated cipher ID for GCM-AES-128 */
		#define MACSEC_DEFAULT_CIPHER_ID 0x0080020001000001ULL
		@@ -45,6 +47,7 @@ enum macsec_attrs {
		MACSEC_ATTR_RXSC_LIST, /* dump, nested, macsec_rxsc_attrs for each RXSC */
		MACSEC_ATTR_TXSC_STATS, /* dump, nested, macsec_txsc_stats_attr */
		MACSEC_ATTR_SECY_STATS, /* dump, nested, macsec_secy_stats_attr */
		MACSEC_ATTR_OFFLOAD, /* config, nested, macsec_offload_attrs */
		__MACSEC_ATTR_END,
		NUM_MACSEC_ATTR = __MACSEC_ATTR_END,
		MACSEC_ATTR_MAX = __MACSEC_ATTR_END - 1,
		@@ -87,16 +90,27 @@ enum macsec_sa_attrs {
		MACSEC_SA_ATTR_UNSPEC,
		MACSEC_SA_ATTR_AN, /* config/dump, u8 0..3 */
		MACSEC_SA_ATTR_ACTIVE, /* config/dump, u8 0..1 */
		MACSEC_SA_ATTR_PN, /* config/dump, u32 */
		MACSEC_SA_ATTR_PN, /* config/dump, u32/u64 (u64 if XPN) */
		MACSEC_SA_ATTR_KEY, /* config, data */
		MACSEC_SA_ATTR_KEYID, /* config/dump, 128-bit */
		MACSEC_SA_ATTR_STATS, /* dump, nested, macsec_sa_stats_attr */
		MACSEC_SA_ATTR_PAD,
		MACSEC_SA_ATTR_SSCI, /* config/dump, u32 - XPN only */
		MACSEC_SA_ATTR_SALT, /* config, 96-bit - XPN only */
		__MACSEC_SA_ATTR_END,
		NUM_MACSEC_SA_ATTR = __MACSEC_SA_ATTR_END,
		MACSEC_SA_ATTR_MAX = __MACSEC_SA_ATTR_END - 1,
		};

		enum macsec_offload_attrs {
		MACSEC_OFFLOAD_ATTR_UNSPEC,
		MACSEC_OFFLOAD_ATTR_TYPE, /* config/dump, u8 0..2 */
		MACSEC_OFFLOAD_ATTR_PAD,
		__MACSEC_OFFLOAD_ATTR_END,
		NUM_MACSEC_OFFLOAD_ATTR = __MACSEC_OFFLOAD_ATTR_END,
		MACSEC_OFFLOAD_ATTR_MAX = __MACSEC_OFFLOAD_ATTR_END - 1,
		};

		enum macsec_nl_commands {
		MACSEC_CMD_GET_TXSC,
		MACSEC_CMD_ADD_RXSC,
		@@ -108,6 +122,7 @@ enum macsec_nl_commands {
		MACSEC_CMD_ADD_RXSA,
		MACSEC_CMD_DEL_RXSA,
		MACSEC_CMD_UPD_RXSA,
		MACSEC_CMD_UPD_OFFLOAD,
		};

		/* u64 per-RXSC stats */