net/mlx5e: Add MACsec offload SecY support

Add offload support for MACsec SecY callbacks - add/update/delete.
add_secy is called when need to create a new MACsec interface.
upd_secy is called when source MAC address or tx SC was changed.
del_secy is called when need to destroy the MACsec interface.

Signed-off-by: Lior Nahmanson <liorna@nvidia.com>
Reviewed-by: Raed Salem <raeds@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c
index d5559b4fce05d352f050b31d491675f6154b84fa..90ce4fe618b32f39a8e3550ac516b9691510fddd 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c
@@ -66,6 +66,7 @@ struct mlx5e_macsec {
        /* Rx fs_id -> rx_sc mapping */
        struct xarray sc_xarray;
 
+       unsigned char *dev_addr;
        struct mlx5_core_dev *mdev;
 };
 
@@ -243,6 +244,42 @@ static int mlx5e_macsec_update_rx_sa(struct mlx5e_macsec *macsec,
        return 0;
 }
 
+static bool mlx5e_macsec_secy_features_validate(struct macsec_context *ctx)
+{
+       const struct net_device *netdev = ctx->netdev;
+       const struct macsec_secy *secy = ctx->secy;
+
+       if (secy->validate_frames != MACSEC_VALIDATE_STRICT) {
+               netdev_err(netdev,
+                          "MACsec offload is supported only when validate_frame is in strict mode\n");
+               return false;
+       }
+
+       if (secy->icv_len != MACSEC_DEFAULT_ICV_LEN) {
+               netdev_err(netdev, "MACsec offload is supported only when icv_len is %d\n",
+                          MACSEC_DEFAULT_ICV_LEN);
+               return false;
+       }
+
+       if (!secy->protect_frames) {
+               netdev_err(netdev,
+                          "MACsec offload is supported only when protect_frames is set\n");
+               return false;
+       }
+
+       if (secy->xpn) {
+               netdev_err(netdev, "MACsec offload: xpn is not supported\n");
+               return false;
+       }
+
+       if (secy->replay_protect) {
+               netdev_err(netdev, "MACsec offload: replay protection is not supported\n");
+               return false;
+       }
+
+       return true;
+}
+
 static int mlx5e_macsec_add_txsa(struct macsec_context *ctx)
 {
        const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc;
@@ -764,6 +801,195 @@ out:
        return err;
 }
 
+static int mlx5e_macsec_add_secy(struct macsec_context *ctx)
+{
+       struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+       const struct net_device *dev = ctx->secy->netdev;
+       const struct net_device *netdev = ctx->netdev;
+       struct mlx5e_macsec *macsec;
+       int err = 0;
+
+       if (ctx->prepare)
+               return 0;
+
+       if (!mlx5e_macsec_secy_features_validate(ctx))
+               return -EINVAL;
+
+       mutex_lock(&priv->macsec->lock);
+
+       macsec = priv->macsec;
+
+       if (macsec->dev_addr) {
+               netdev_err(netdev, "Currently, only one MACsec offload device can be set\n");
+               err = -EINVAL;
+       }
+
+       macsec->dev_addr = kzalloc(dev->addr_len, GFP_KERNEL);
+       if (!macsec->dev_addr) {
+               err = -ENOMEM;
+               goto out;
+       }
+
+       memcpy(macsec->dev_addr, dev->dev_addr, dev->addr_len);
+out:
+       mutex_unlock(&macsec->lock);
+
+       return err;
+}
+
+static int macsec_upd_secy_hw_address(struct macsec_context *ctx)
+{
+       struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+       const struct net_device *dev = ctx->secy->netdev;
+       struct mlx5e_macsec *macsec = priv->macsec;
+       struct mlx5e_macsec_rx_sc *rx_sc, *tmp;
+       struct mlx5e_macsec_sa *rx_sa;
+       struct list_head *list;
+       int i, err = 0;
+
+
+       list = &macsec->macsec_rx_sc_list_head;
+       list_for_each_entry_safe(rx_sc, tmp, list, rx_sc_list_element) {
+               for (i = 0; i < MACSEC_NUM_AN; ++i) {
+                       rx_sa = rx_sc->rx_sa[i];
+                       if (!rx_sa || !rx_sa->macsec_rule)
+                               continue;
+
+                       mlx5e_macsec_cleanup_sa(macsec, rx_sa, false);
+               }
+       }
+
+       list_for_each_entry_safe(rx_sc, tmp, list, rx_sc_list_element) {
+               for (i = 0; i < MACSEC_NUM_AN; ++i) {
+                       rx_sa = rx_sc->rx_sa[i];
+                       if (!rx_sa)
+                               continue;
+
+                       if (rx_sa->active) {
+                               err = mlx5e_macsec_init_sa(ctx, rx_sa, false, false);
+                               if (err)
+                                       goto out;
+                       }
+               }
+       }
+
+       memcpy(macsec->dev_addr, dev->dev_addr, dev->addr_len);
+out:
+       return err;
+}
+
+/* this function is called from 2 macsec ops functions:
+ *  macsec_set_mac_address – MAC address was changed, therefore we need to destroy
+ *  and create new Tx contexts(macsec object + steering).
+ *  macsec_changelink – in this case the tx SC or SecY may be changed, therefore need to
+ *  destroy Tx and Rx contexts(macsec object + steering)
+ */
+static int mlx5e_macsec_upd_secy(struct macsec_context *ctx)
+{
+       const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc;
+       struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+       const struct net_device *dev = ctx->secy->netdev;
+       struct mlx5e_macsec_sa *tx_sa;
+       struct mlx5e_macsec *macsec;
+       int i, err = 0;
+
+       if (ctx->prepare)
+               return 0;
+
+       if (!mlx5e_macsec_secy_features_validate(ctx))
+               return -EINVAL;
+
+       mutex_lock(&priv->macsec->lock);
+
+       macsec = priv->macsec;
+
+       /* if the dev_addr hasn't change, it mean the callback is from macsec_changelink */
+       if (!memcmp(macsec->dev_addr, dev->dev_addr, dev->addr_len)) {
+               err = macsec_upd_secy_hw_address(ctx);
+               if (err)
+                       goto out;
+       }
+
+       for (i = 0; i < MACSEC_NUM_AN; ++i) {
+               tx_sa = macsec->tx_sa[i];
+               if (!tx_sa)
+                       continue;
+
+               mlx5e_macsec_cleanup_sa(macsec, tx_sa, true);
+       }
+
+       for (i = 0; i < MACSEC_NUM_AN; ++i) {
+               tx_sa = macsec->tx_sa[i];
+               if (!tx_sa)
+                       continue;
+
+               if (tx_sa->assoc_num == tx_sc->encoding_sa && tx_sa->active) {
+                       err = mlx5e_macsec_init_sa(ctx, tx_sa, tx_sc->encrypt, true);
+                       if (err)
+                               goto out;
+               }
+       }
+
+out:
+       mutex_unlock(&macsec->lock);
+
+       return err;
+}
+
+static int mlx5e_macsec_del_secy(struct macsec_context *ctx)
+{
+       struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+       struct mlx5e_macsec_rx_sc *rx_sc, *tmp;
+       struct mlx5e_macsec_sa *rx_sa;
+       struct mlx5e_macsec_sa *tx_sa;
+       struct mlx5e_macsec *macsec;
+       struct list_head *list;
+       int i;
+
+       if (ctx->prepare)
+               return 0;
+
+       mutex_lock(&priv->macsec->lock);
+
+       macsec = priv->macsec;
+
+       for (i = 0; i < MACSEC_NUM_AN; ++i) {
+               tx_sa = macsec->tx_sa[i];
+               if (!tx_sa)
+                       continue;
+
+               mlx5e_macsec_cleanup_sa(macsec, tx_sa, true);
+               mlx5_destroy_encryption_key(macsec->mdev, tx_sa->enc_key_id);
+               kfree(tx_sa);
+               macsec->tx_sa[i] = NULL;
+       }
+
+       list = &macsec->macsec_rx_sc_list_head;
+       list_for_each_entry_safe(rx_sc, tmp, list, rx_sc_list_element) {
+               for (i = 0; i < MACSEC_NUM_AN; ++i) {
+                       rx_sa = rx_sc->rx_sa[i];
+                       if (!rx_sa)
+                               continue;
+
+                       mlx5e_macsec_cleanup_sa(macsec, rx_sa, false);
+                       mlx5_destroy_encryption_key(macsec->mdev, rx_sa->enc_key_id);
+                       kfree(rx_sa);
+                       rx_sc->rx_sa[i] = NULL;
+               }
+
+               list_del_rcu(&rx_sc->rx_sc_list_element);
+
+               kfree_rcu(rx_sc);
+       }
+
+       kfree(macsec->dev_addr);
+       macsec->dev_addr = NULL;
+
+       mutex_unlock(&macsec->lock);
+
+       return 0;
+}
+
 static bool mlx5e_is_macsec_device(const struct mlx5_core_dev *mdev)
 {
        if (!(MLX5_CAP_GEN_64(mdev, general_obj_types) &
@@ -805,6 +1031,9 @@ static const struct macsec_ops macsec_offload_ops = {
        .mdo_add_rxsa = mlx5e_macsec_add_rxsa,
        .mdo_upd_rxsa = mlx5e_macsec_upd_rxsa,
        .mdo_del_rxsa = mlx5e_macsec_del_rxsa,
+       .mdo_add_secy = mlx5e_macsec_add_secy,
+       .mdo_upd_secy = mlx5e_macsec_upd_secy,
+       .mdo_del_secy = mlx5e_macsec_del_secy,
 };
 
 bool mlx5e_macsec_handle_tx_skb(struct mlx5e_macsec *macsec, struct sk_buff *skb)