Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 775f7498 authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "net: macsec: add mac offload"

parents f104d9db 4118a1b0

drivers/net/macsec.c

+679 −332

File changed.

Preview size limit exceeded, changes collapsed.

include/linux/netdev_features.h

+2 −0
Original line number Diff line number Diff line
@@ -80,6 +80,7 @@ enum { 
	NETIF_F_HW_ESP_BIT,		/* Hardware ESP transformation offload */

	NETIF_F_HW_ESP_TX_CSUM_BIT,	/* ESP with TX checksum offload */

	NETIF_F_RX_UDP_TUNNEL_PORT_BIT, /* Offload of RX port for UDP tunnels */

	NETIF_F_HW_MACSEC_BIT,          /* Offload MACsec operations */



	NETIF_F_GRO_HW_BIT,		/* Hardware Generic receive offload */
@@ -149,6 +150,7 @@ enum { 
#define NETIF_F_HW_ESP_TX_CSUM	__NETIF_F(HW_ESP_TX_CSUM)

#define	NETIF_F_RX_UDP_TUNNEL_PORT  __NETIF_F(RX_UDP_TUNNEL_PORT)

#define NETIF_F_GSO_UDP_L4	__NETIF_F(GSO_UDP_L4)

#define NETIF_F_HW_MACSEC      __NETIF_F(HW_MACSEC)



/* Finds the next feature with the highest number of the range of start till 0.

 */

include/linux/netdevice.h

+37 −0
Original line number Diff line number Diff line
@@ -56,6 +56,7 @@ struct netpoll_info; 
struct device;

struct phy_device;

struct dsa_switch_tree;

struct macsec_context;



/* 802.11 specific */

struct wireless_dev;
@@ -826,6 +827,35 @@ struct xfrmdev_ops { 
};

#endif



#if IS_ENABLED(CONFIG_MACSEC)

struct macsec_ops {

	/* Device wide */

	int (*mdo_dev_open)(struct macsec_context *ctx);

	int (*mdo_dev_stop)(struct macsec_context *ctx);

	/* SecY */

	int (*mdo_add_secy)(struct macsec_context *ctx);

	int (*mdo_upd_secy)(struct macsec_context *ctx);

	int (*mdo_del_secy)(struct macsec_context *ctx);

	/* Security channels */

	int (*mdo_add_rxsc)(struct macsec_context *ctx);

	int (*mdo_upd_rxsc)(struct macsec_context *ctx);

	int (*mdo_del_rxsc)(struct macsec_context *ctx);

	/* Security associations */

	int (*mdo_add_rxsa)(struct macsec_context *ctx);

	int (*mdo_upd_rxsa)(struct macsec_context *ctx);

	int (*mdo_del_rxsa)(struct macsec_context *ctx);

	int (*mdo_add_txsa)(struct macsec_context *ctx);

	int (*mdo_upd_txsa)(struct macsec_context *ctx);

	int (*mdo_del_txsa)(struct macsec_context *ctx);

	/* Statistics */

	int (*mdo_get_dev_stats)(struct macsec_context *ctx);

	int (*mdo_get_tx_sc_stats)(struct macsec_context *ctx);

	int (*mdo_get_tx_sa_stats)(struct macsec_context *ctx);

	int (*mdo_get_rx_sc_stats)(struct macsec_context *ctx);

	int (*mdo_get_rx_sa_stats)(struct macsec_context *ctx);

};

#endif



/*

 * This structure defines the management hooks for network devices.

 * The following hooks can be defined; unless noted otherwise, they are
@@ -1628,6 +1658,8 @@ enum netdev_priv_flags { 
 *			switch driver and used to set the phys state of the

 *			switch port.

 *

 *	@macsec_ops:    MACsec offloading ops

 *

 *	FIXME: cleanup struct net_device such that network protocol info

 *	moves out.

 */
@@ -1901,6 +1933,11 @@ struct net_device { 
	struct lock_class_key	*qdisc_tx_busylock;

	struct lock_class_key	*qdisc_running_key;

	bool			proto_down;



#if IS_ENABLED(CONFIG_MACSEC)

	/* MACsec management functions */

	const struct macsec_ops *macsec_ops;

#endif

};

#define to_net_dev(d) container_of(d, struct net_device, dev)

include/linux/phy.h

+10 −0
Original line number Diff line number Diff line
@@ -26,6 +26,10 @@ 
#include <linux/workqueue.h>

#include <linux/mod_devicetable.h>



#if IS_ENABLED(CONFIG_MACSEC)

#include <net/macsec.h>

#endif



#include <linux/atomic.h>



#define PHY_DEFAULT_FEATURES	(SUPPORTED_Autoneg | \
@@ -384,6 +388,7 @@ struct phy_c45_device_ids { 
 * attached_dev: The attached enet driver's device instance ptr

 * adjust_link: Callback for the enet controller to respond to

 * changes in the link state.

 * macsec_ops: MACsec offloading ops.

 *

 * speed, duplex, pause, supported, advertising, lp_advertising,

 * and autoneg are used like in mii_if_info
@@ -479,6 +484,11 @@ struct phy_device { 


	void (*phy_link_change)(struct phy_device *, bool up, bool do_carrier);

	void (*adjust_link)(struct net_device *dev);



#if IS_ENABLED(CONFIG_MACSEC)

	/* MACsec management functions */

	const struct macsec_ops *macsec_ops;

#endif

};

#define to_phy_device(d) container_of(to_mdio_device(d), \

				      struct phy_device, mdio)

include/net/macsec.h

0 → 100644
+223 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0+ */

/*

 * MACsec netdev header, used for h/w accelerated implementations.

 *

 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net>

 */

#ifndef _NET_MACSEC_H_

#define _NET_MACSEC_H_



#include <linux/u64_stats_sync.h>

#include <uapi/linux/if_link.h>

#include <uapi/linux/if_macsec.h>



typedef u64 __bitwise sci_t;



#define MACSEC_NUM_AN 4 /* 2 bits for the association number */

#define MACSEC_KEYID_LEN 16



/**

 * struct macsec_key - SA key

 * @id: user-provided key identifier

 * @tfm: crypto struct, key storage

 */

struct macsec_key {

	u8 id[MACSEC_KEYID_LEN];

	struct crypto_aead *tfm;

};



struct macsec_rx_sc_stats {

	__u64 InOctetsValidated;

	__u64 InOctetsDecrypted;

	__u64 InPktsUnchecked;

	__u64 InPktsDelayed;

	__u64 InPktsOK;

	__u64 InPktsInvalid;

	__u64 InPktsLate;

	__u64 InPktsNotValid;

	__u64 InPktsNotUsingSA;

	__u64 InPktsUnusedSA;

};



struct macsec_rx_sa_stats {

	__u32 InPktsOK;

	__u32 InPktsInvalid;

	__u32 InPktsNotValid;

	__u32 InPktsNotUsingSA;

	__u32 InPktsUnusedSA;

};



struct macsec_tx_sa_stats {

	__u32 OutPktsProtected;

	__u32 OutPktsEncrypted;

};



struct macsec_tx_sc_stats {

	__u64 OutPktsProtected;

	__u64 OutPktsEncrypted;

	__u64 OutOctetsProtected;

	__u64 OutOctetsEncrypted;

};



struct macsec_dev_stats {

	__u64 OutPktsUntagged;

	__u64 InPktsUntagged;

	__u64 OutPktsTooLong;

	__u64 InPktsNoTag;

	__u64 InPktsBadTag;

	__u64 InPktsUnknownSCI;

	__u64 InPktsNoSCI;

	__u64 InPktsOverrun;

};



/**

 * struct macsec_rx_sa - receive secure association

 * @active:

 * @next_pn: packet number expected for the next packet

 * @lock: protects next_pn manipulations

 * @key: key structure

 * @stats: per-SA stats

 */

struct macsec_rx_sa {

	struct macsec_key key;

	spinlock_t lock;

	u32 next_pn;

	atomic_t refcnt;

	bool active;

	struct macsec_rx_sa_stats __percpu *stats;

	struct macsec_rx_sc *sc;

	struct rcu_head rcu;

};



struct pcpu_rx_sc_stats {

	struct macsec_rx_sc_stats stats;

	struct u64_stats_sync syncp;

};



struct pcpu_tx_sc_stats {

	struct macsec_tx_sc_stats stats;

	struct u64_stats_sync syncp;

};



/**

 * struct macsec_rx_sc - receive secure channel

 * @sci: secure channel identifier for this SC

 * @active: channel is active

 * @sa: array of secure associations

 * @stats: per-SC stats

 */

struct macsec_rx_sc {

	struct macsec_rx_sc __rcu *next;

	sci_t sci;

	bool active;

	struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN];

	struct pcpu_rx_sc_stats __percpu *stats;

	atomic_t refcnt;

	struct rcu_head rcu_head;

};



/**

 * struct macsec_tx_sa - transmit secure association

 * @active:

 * @next_pn: packet number to use for the next packet

 * @lock: protects next_pn manipulations

 * @key: key structure

 * @stats: per-SA stats

 */

struct macsec_tx_sa {

	struct macsec_key key;

	spinlock_t lock;

	u32 next_pn;

	atomic_t refcnt;

	bool active;

	bool offloaded;

	struct macsec_tx_sa_stats __percpu *stats;

	struct rcu_head rcu;

};



/**

 * struct macsec_tx_sc - transmit secure channel

 * @active:

 * @encoding_sa: association number of the SA currently in use

 * @encrypt: encrypt packets on transmit, or authenticate only

 * @send_sci: always include the SCI in the SecTAG

 * @end_station:

 * @scb: single copy broadcast flag

 * @sa: array of secure associations

 * @stats: stats for this TXSC

 */

struct macsec_tx_sc {

	bool active;

	u8 encoding_sa;

	bool encrypt;

	bool send_sci;

	bool end_station;

	bool scb;

	struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN];

	struct pcpu_tx_sc_stats __percpu *stats;

};



/**

 * struct macsec_secy - MACsec Security Entity

 * @netdev: netdevice for this SecY

 * @n_rx_sc: number of receive secure channels configured on this SecY

 * @sci: secure channel identifier used for tx

 * @key_len: length of keys used by the cipher suite

 * @icv_len: length of ICV used by the cipher suite

 * @validate_frames: validation mode

 * @operational: MAC_Operational flag

 * @protect_frames: enable protection for this SecY

 * @replay_protect: enable packet number checks on receive

 * @replay_window: size of the replay window

 * @tx_sc: transmit secure channel

 * @rx_sc: linked list of receive secure channels

 */

struct macsec_secy {

	struct net_device *netdev;

	unsigned int n_rx_sc;

	sci_t sci;

	u16 key_len;

	u16 icv_len;

	enum macsec_validation_type validate_frames;

	bool operational;

	bool protect_frames;

	bool replay_protect;

	u32 replay_window;

	struct macsec_tx_sc tx_sc;

	struct macsec_rx_sc __rcu *rx_sc;

};



/**

 * struct macsec_context - MACsec context for hardware offloading

 */

struct macsec_context {

	union {

		struct net_device *netdev;

		struct phy_device *phydev;

	};



	const struct macsec_secy *secy;

	const struct macsec_rx_sc *rx_sc;

	struct {

		unsigned char assoc_num;

		u8 key[MACSEC_KEYID_LEN];

		union {

			const struct macsec_rx_sa *rx_sa;

			const struct macsec_tx_sa *tx_sa;

		};

	} sa;

	union {

		struct macsec_tx_sc_stats *tx_sc_stats;

		struct macsec_tx_sa_stats *tx_sa_stats;

		struct macsec_rx_sc_stats *rx_sc_stats;

		struct macsec_rx_sa_stats *rx_sa_stats;

		struct macsec_dev_stats  *dev_stats;

	} stats;



	u8 prepare:1;

	u8 is_phy:1;

};



void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa);



#endif /* _NET_MACSEC_H_ */