Commit | Line | Data |
---|---|---|
c0e4eadf AT |
1 | /* SPDX-License-Identifier: GPL-2.0+ */ |
2 | /* | |
3 | * MACsec netdev header, used for h/w accelerated implementations. | |
4 | * | |
5 | * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net> | |
6 | */ | |
7 | #ifndef _NET_MACSEC_H_ | |
8 | #define _NET_MACSEC_H_ | |
9 | ||
10 | #include <linux/u64_stats_sync.h> | |
bd9424ef | 11 | #include <linux/if_vlan.h> |
c0e4eadf AT |
12 | #include <uapi/linux/if_link.h> |
13 | #include <uapi/linux/if_macsec.h> | |
14 | ||
48ef50fa EM |
15 | #define MACSEC_DEFAULT_PN_LEN 4 |
16 | #define MACSEC_XPN_PN_LEN 8 | |
17 | ||
a21ecf0e EM |
18 | #define MACSEC_NUM_AN 4 /* 2 bits for the association number */ |
19 | ||
b1671253 LN |
20 | #define MACSEC_SCI_LEN 8 |
21 | #define MACSEC_PORT_ES (htons(0x0001)) | |
22 | ||
23 | #define MACSEC_TCI_VERSION 0x80 | |
24 | #define MACSEC_TCI_ES 0x40 /* end station */ | |
25 | #define MACSEC_TCI_SC 0x20 /* SCI present */ | |
26 | #define MACSEC_TCI_SCB 0x10 /* epon */ | |
27 | #define MACSEC_TCI_E 0x08 /* encryption */ | |
28 | #define MACSEC_TCI_C 0x04 /* changed text */ | |
29 | #define MACSEC_AN_MASK 0x03 /* association number */ | |
30 | #define MACSEC_TCI_CONFID (MACSEC_TCI_E | MACSEC_TCI_C) | |
31 | ||
32 | #define MACSEC_DEFAULT_ICV_LEN 16 | |
33 | ||
c0e4eadf | 34 | typedef u64 __bitwise sci_t; |
a21ecf0e | 35 | typedef u32 __bitwise ssci_t; |
c0e4eadf | 36 | |
0a28bfd4 LN |
37 | struct metadata_dst; |
38 | ||
a21ecf0e EM |
39 | typedef union salt { |
40 | struct { | |
41 | u32 ssci; | |
42 | u64 pn; | |
43 | } __packed; | |
44 | u8 bytes[MACSEC_SALT_LEN]; | |
45 | } __packed salt_t; | |
46 | ||
47 | typedef union pn { | |
48 | struct { | |
49 | #if defined(__LITTLE_ENDIAN_BITFIELD) | |
50 | u32 lower; | |
51 | u32 upper; | |
52 | #elif defined(__BIG_ENDIAN_BITFIELD) | |
53 | u32 upper; | |
54 | u32 lower; | |
55 | #else | |
56 | #error "Please fix <asm/byteorder.h>" | |
57 | #endif | |
58 | }; | |
59 | u64 full64; | |
60 | } pn_t; | |
c0e4eadf AT |
61 | |
62 | /** | |
63 | * struct macsec_key - SA key | |
64 | * @id: user-provided key identifier | |
65 | * @tfm: crypto struct, key storage | |
a21ecf0e | 66 | * @salt: salt used to generate IV in XPN cipher suites |
c0e4eadf AT |
67 | */ |
68 | struct macsec_key { | |
69 | u8 id[MACSEC_KEYID_LEN]; | |
70 | struct crypto_aead *tfm; | |
a21ecf0e | 71 | salt_t salt; |
c0e4eadf AT |
72 | }; |
73 | ||
74 | struct macsec_rx_sc_stats { | |
75 | __u64 InOctetsValidated; | |
76 | __u64 InOctetsDecrypted; | |
77 | __u64 InPktsUnchecked; | |
78 | __u64 InPktsDelayed; | |
79 | __u64 InPktsOK; | |
80 | __u64 InPktsInvalid; | |
81 | __u64 InPktsLate; | |
82 | __u64 InPktsNotValid; | |
83 | __u64 InPktsNotUsingSA; | |
84 | __u64 InPktsUnusedSA; | |
85 | }; | |
86 | ||
87 | struct macsec_rx_sa_stats { | |
88 | __u32 InPktsOK; | |
89 | __u32 InPktsInvalid; | |
90 | __u32 InPktsNotValid; | |
91 | __u32 InPktsNotUsingSA; | |
92 | __u32 InPktsUnusedSA; | |
93 | }; | |
94 | ||
95 | struct macsec_tx_sa_stats { | |
96 | __u32 OutPktsProtected; | |
97 | __u32 OutPktsEncrypted; | |
98 | }; | |
99 | ||
100 | struct macsec_tx_sc_stats { | |
101 | __u64 OutPktsProtected; | |
102 | __u64 OutPktsEncrypted; | |
103 | __u64 OutOctetsProtected; | |
104 | __u64 OutOctetsEncrypted; | |
105 | }; | |
106 | ||
b62c3624 DB |
107 | struct macsec_dev_stats { |
108 | __u64 OutPktsUntagged; | |
109 | __u64 InPktsUntagged; | |
110 | __u64 OutPktsTooLong; | |
111 | __u64 InPktsNoTag; | |
112 | __u64 InPktsBadTag; | |
113 | __u64 InPktsUnknownSCI; | |
114 | __u64 InPktsNoSCI; | |
115 | __u64 InPktsOverrun; | |
116 | }; | |
117 | ||
c0e4eadf AT |
118 | /** |
119 | * struct macsec_rx_sa - receive secure association | |
120 | * @active: | |
121 | * @next_pn: packet number expected for the next packet | |
122 | * @lock: protects next_pn manipulations | |
123 | * @key: key structure | |
a21ecf0e | 124 | * @ssci: short secure channel identifier |
c0e4eadf AT |
125 | * @stats: per-SA stats |
126 | */ | |
127 | struct macsec_rx_sa { | |
128 | struct macsec_key key; | |
a21ecf0e | 129 | ssci_t ssci; |
c0e4eadf | 130 | spinlock_t lock; |
a21ecf0e EM |
131 | union { |
132 | pn_t next_pn_halves; | |
133 | u64 next_pn; | |
134 | }; | |
c0e4eadf AT |
135 | refcount_t refcnt; |
136 | bool active; | |
137 | struct macsec_rx_sa_stats __percpu *stats; | |
138 | struct macsec_rx_sc *sc; | |
139 | struct rcu_head rcu; | |
140 | }; | |
141 | ||
142 | struct pcpu_rx_sc_stats { | |
143 | struct macsec_rx_sc_stats stats; | |
144 | struct u64_stats_sync syncp; | |
145 | }; | |
146 | ||
147 | struct pcpu_tx_sc_stats { | |
148 | struct macsec_tx_sc_stats stats; | |
149 | struct u64_stats_sync syncp; | |
150 | }; | |
151 | ||
152 | /** | |
153 | * struct macsec_rx_sc - receive secure channel | |
154 | * @sci: secure channel identifier for this SC | |
155 | * @active: channel is active | |
156 | * @sa: array of secure associations | |
157 | * @stats: per-SC stats | |
158 | */ | |
159 | struct macsec_rx_sc { | |
160 | struct macsec_rx_sc __rcu *next; | |
161 | sci_t sci; | |
162 | bool active; | |
163 | struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN]; | |
164 | struct pcpu_rx_sc_stats __percpu *stats; | |
165 | refcount_t refcnt; | |
166 | struct rcu_head rcu_head; | |
167 | }; | |
168 | ||
169 | /** | |
170 | * struct macsec_tx_sa - transmit secure association | |
171 | * @active: | |
172 | * @next_pn: packet number to use for the next packet | |
173 | * @lock: protects next_pn manipulations | |
174 | * @key: key structure | |
a21ecf0e | 175 | * @ssci: short secure channel identifier |
c0e4eadf AT |
176 | * @stats: per-SA stats |
177 | */ | |
178 | struct macsec_tx_sa { | |
179 | struct macsec_key key; | |
a21ecf0e | 180 | ssci_t ssci; |
c0e4eadf | 181 | spinlock_t lock; |
a21ecf0e EM |
182 | union { |
183 | pn_t next_pn_halves; | |
184 | u64 next_pn; | |
185 | }; | |
c0e4eadf AT |
186 | refcount_t refcnt; |
187 | bool active; | |
188 | struct macsec_tx_sa_stats __percpu *stats; | |
189 | struct rcu_head rcu; | |
190 | }; | |
191 | ||
192 | /** | |
193 | * struct macsec_tx_sc - transmit secure channel | |
194 | * @active: | |
195 | * @encoding_sa: association number of the SA currently in use | |
196 | * @encrypt: encrypt packets on transmit, or authenticate only | |
197 | * @send_sci: always include the SCI in the SecTAG | |
198 | * @end_station: | |
199 | * @scb: single copy broadcast flag | |
200 | * @sa: array of secure associations | |
201 | * @stats: stats for this TXSC | |
0a28bfd4 | 202 | * @md_dst: MACsec offload metadata dst |
c0e4eadf AT |
203 | */ |
204 | struct macsec_tx_sc { | |
205 | bool active; | |
206 | u8 encoding_sa; | |
207 | bool encrypt; | |
208 | bool send_sci; | |
209 | bool end_station; | |
210 | bool scb; | |
211 | struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN]; | |
212 | struct pcpu_tx_sc_stats __percpu *stats; | |
0a28bfd4 | 213 | struct metadata_dst *md_dst; |
c0e4eadf AT |
214 | }; |
215 | ||
216 | /** | |
217 | * struct macsec_secy - MACsec Security Entity | |
218 | * @netdev: netdevice for this SecY | |
219 | * @n_rx_sc: number of receive secure channels configured on this SecY | |
220 | * @sci: secure channel identifier used for tx | |
221 | * @key_len: length of keys used by the cipher suite | |
222 | * @icv_len: length of ICV used by the cipher suite | |
223 | * @validate_frames: validation mode | |
a21ecf0e | 224 | * @xpn: enable XPN for this SecY |
c0e4eadf AT |
225 | * @operational: MAC_Operational flag |
226 | * @protect_frames: enable protection for this SecY | |
227 | * @replay_protect: enable packet number checks on receive | |
228 | * @replay_window: size of the replay window | |
229 | * @tx_sc: transmit secure channel | |
230 | * @rx_sc: linked list of receive secure channels | |
231 | */ | |
232 | struct macsec_secy { | |
233 | struct net_device *netdev; | |
234 | unsigned int n_rx_sc; | |
235 | sci_t sci; | |
236 | u16 key_len; | |
237 | u16 icv_len; | |
238 | enum macsec_validation_type validate_frames; | |
a21ecf0e | 239 | bool xpn; |
c0e4eadf AT |
240 | bool operational; |
241 | bool protect_frames; | |
242 | bool replay_protect; | |
243 | u32 replay_window; | |
244 | struct macsec_tx_sc tx_sc; | |
245 | struct macsec_rx_sc __rcu *rx_sc; | |
246 | }; | |
247 | ||
76564261 AT |
248 | /** |
249 | * struct macsec_context - MACsec context for hardware offloading | |
eb97b9bd RPNO |
250 | * @netdev: a valid pointer to a struct net_device if @offload == |
251 | * MACSEC_OFFLOAD_MAC | |
252 | * @phydev: a valid pointer to a struct phy_device if @offload == | |
253 | * MACSEC_OFFLOAD_PHY | |
254 | * @offload: MACsec offload status | |
255 | * @secy: pointer to a MACsec SecY | |
256 | * @rx_sc: pointer to a RX SC | |
257 | * @update_pn: when updating the SA, update the next PN | |
258 | * @assoc_num: association number of the target SA | |
259 | * @key: key of the target SA | |
260 | * @rx_sa: pointer to an RX SA if a RX SA is added/updated/removed | |
261 | * @tx_sa: pointer to an TX SA if a TX SA is added/updated/removed | |
262 | * @tx_sc_stats: pointer to TX SC stats structure | |
263 | * @tx_sa_stats: pointer to TX SA stats structure | |
264 | * @rx_sc_stats: pointer to RX SC stats structure | |
265 | * @rx_sa_stats: pointer to RX SA stats structure | |
266 | * @dev_stats: pointer to dev stats structure | |
76564261 AT |
267 | */ |
268 | struct macsec_context { | |
8fa91371 AT |
269 | union { |
270 | struct net_device *netdev; | |
271 | struct phy_device *phydev; | |
272 | }; | |
76564261 AT |
273 | enum macsec_offload offload; |
274 | ||
275 | struct macsec_secy *secy; | |
276 | struct macsec_rx_sc *rx_sc; | |
277 | struct { | |
0412cc84 | 278 | bool update_pn; |
76564261 | 279 | unsigned char assoc_num; |
1f7fe512 | 280 | u8 key[MACSEC_MAX_KEY_LEN]; |
76564261 AT |
281 | union { |
282 | struct macsec_rx_sa *rx_sa; | |
283 | struct macsec_tx_sa *tx_sa; | |
284 | }; | |
285 | } sa; | |
b62c3624 DB |
286 | union { |
287 | struct macsec_tx_sc_stats *tx_sc_stats; | |
288 | struct macsec_tx_sa_stats *tx_sa_stats; | |
289 | struct macsec_rx_sc_stats *rx_sc_stats; | |
290 | struct macsec_rx_sa_stats *rx_sa_stats; | |
291 | struct macsec_dev_stats *dev_stats; | |
292 | } stats; | |
76564261 AT |
293 | }; |
294 | ||
0830e20b AT |
295 | /** |
296 | * struct macsec_ops - MACsec offloading operations | |
eb97b9bd RPNO |
297 | * @mdo_dev_open: called when the MACsec interface transitions to the up state |
298 | * @mdo_dev_stop: called when the MACsec interface transitions to the down | |
299 | * state | |
300 | * @mdo_add_secy: called when a new SecY is added | |
301 | * @mdo_upd_secy: called when the SecY flags are changed or the MAC address of | |
302 | * the MACsec interface is changed | |
303 | * @mdo_del_secy: called when the hw offload is disabled or the MACsec | |
304 | * interface is removed | |
305 | * @mdo_add_rxsc: called when a new RX SC is added | |
306 | * @mdo_upd_rxsc: called when a certain RX SC is updated | |
307 | * @mdo_del_rxsc: called when a certain RX SC is removed | |
308 | * @mdo_add_rxsa: called when a new RX SA is added | |
309 | * @mdo_upd_rxsa: called when a certain RX SA is updated | |
310 | * @mdo_del_rxsa: called when a certain RX SA is removed | |
311 | * @mdo_add_txsa: called when a new TX SA is added | |
312 | * @mdo_upd_txsa: called when a certain TX SA is updated | |
313 | * @mdo_del_txsa: called when a certain TX SA is removed | |
314 | * @mdo_get_dev_stats: called when dev stats are read | |
315 | * @mdo_get_tx_sc_stats: called when TX SC stats are read | |
316 | * @mdo_get_tx_sa_stats: called when TX SA stats are read | |
317 | * @mdo_get_rx_sc_stats: called when RX SC stats are read | |
318 | * @mdo_get_rx_sa_stats: called when RX SA stats are read | |
a73d8779 RPNO |
319 | * @mdo_insert_tx_tag: called to insert the TX tag |
320 | * @needed_headroom: number of bytes reserved at the beginning of the sk_buff | |
321 | * for the TX tag | |
322 | * @needed_tailroom: number of bytes reserved at the end of the sk_buff for the | |
323 | * TX tag | |
0830e20b AT |
324 | */ |
325 | struct macsec_ops { | |
326 | /* Device wide */ | |
327 | int (*mdo_dev_open)(struct macsec_context *ctx); | |
328 | int (*mdo_dev_stop)(struct macsec_context *ctx); | |
329 | /* SecY */ | |
330 | int (*mdo_add_secy)(struct macsec_context *ctx); | |
331 | int (*mdo_upd_secy)(struct macsec_context *ctx); | |
332 | int (*mdo_del_secy)(struct macsec_context *ctx); | |
333 | /* Security channels */ | |
334 | int (*mdo_add_rxsc)(struct macsec_context *ctx); | |
335 | int (*mdo_upd_rxsc)(struct macsec_context *ctx); | |
336 | int (*mdo_del_rxsc)(struct macsec_context *ctx); | |
337 | /* Security associations */ | |
338 | int (*mdo_add_rxsa)(struct macsec_context *ctx); | |
339 | int (*mdo_upd_rxsa)(struct macsec_context *ctx); | |
340 | int (*mdo_del_rxsa)(struct macsec_context *ctx); | |
341 | int (*mdo_add_txsa)(struct macsec_context *ctx); | |
342 | int (*mdo_upd_txsa)(struct macsec_context *ctx); | |
343 | int (*mdo_del_txsa)(struct macsec_context *ctx); | |
b62c3624 DB |
344 | /* Statistics */ |
345 | int (*mdo_get_dev_stats)(struct macsec_context *ctx); | |
346 | int (*mdo_get_tx_sc_stats)(struct macsec_context *ctx); | |
347 | int (*mdo_get_tx_sa_stats)(struct macsec_context *ctx); | |
348 | int (*mdo_get_rx_sc_stats)(struct macsec_context *ctx); | |
349 | int (*mdo_get_rx_sa_stats)(struct macsec_context *ctx); | |
a73d8779 RPNO |
350 | /* Offload tag */ |
351 | int (*mdo_insert_tx_tag)(struct phy_device *phydev, | |
352 | struct sk_buff *skb); | |
353 | unsigned int needed_headroom; | |
354 | unsigned int needed_tailroom; | |
0830e20b AT |
355 | }; |
356 | ||
5c937de7 | 357 | void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa); |
b1671253 LN |
358 | static inline bool macsec_send_sci(const struct macsec_secy *secy) |
359 | { | |
360 | const struct macsec_tx_sc *tx_sc = &secy->tx_sc; | |
361 | ||
362 | return tx_sc->send_sci || | |
363 | (secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb); | |
364 | } | |
f132fdd9 PH |
365 | struct net_device *macsec_get_real_dev(const struct net_device *dev); |
366 | bool macsec_netdev_is_offloaded(struct net_device *dev); | |
5c937de7 | 367 | |
bd9424ef SS |
368 | static inline void *macsec_netdev_priv(const struct net_device *dev) |
369 | { | |
370 | #if IS_ENABLED(CONFIG_VLAN_8021Q) | |
371 | if (is_vlan_dev(dev)) | |
372 | return netdev_priv(vlan_dev_priv(dev)->real_dev); | |
373 | #endif | |
374 | return netdev_priv(dev); | |
375 | } | |
376 | ||
b1c036e8 RPNO |
377 | static inline u64 sci_to_cpu(sci_t sci) |
378 | { | |
379 | return be64_to_cpu((__force __be64)sci); | |
380 | } | |
381 | ||
c0e4eadf | 382 | #endif /* _NET_MACSEC_H_ */ |