1 /* SPDX-License-Identifier: GPL-2.0+ */ 2 /* 3 * MACsec netdev header, used for h/w accelerated implementations. 4 * 5 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net> 6 */ 7 #ifndef _NET_MACSEC_H_ 8 #define _NET_MACSEC_H_ 9 10 #include <linux/u64_stats_sync.h> 11 #include <linux/if_vlan.h> 12 #include <linux/workqueue.h> 13 #include <uapi/linux/if_link.h> 14 #include <uapi/linux/if_macsec.h> 15 16 #define MACSEC_DEFAULT_PN_LEN 4 17 #define MACSEC_XPN_PN_LEN 8 18 19 #define MACSEC_NUM_AN 4 /* 2 bits for the association number */ 20 21 #define MACSEC_SCI_LEN 8 22 #define MACSEC_PORT_ES (htons(0x0001)) 23 24 #define MACSEC_TCI_VERSION 0x80 25 #define MACSEC_TCI_ES 0x40 /* end station */ 26 #define MACSEC_TCI_SC 0x20 /* SCI present */ 27 #define MACSEC_TCI_SCB 0x10 /* epon */ 28 #define MACSEC_TCI_E 0x08 /* encryption */ 29 #define MACSEC_TCI_C 0x04 /* changed text */ 30 #define MACSEC_AN_MASK 0x03 /* association number */ 31 #define MACSEC_TCI_CONFID (MACSEC_TCI_E | MACSEC_TCI_C) 32 33 #define MACSEC_DEFAULT_ICV_LEN 16 34 35 typedef u64 __bitwise sci_t; 36 typedef u32 __bitwise ssci_t; 37 38 struct metadata_dst; 39 40 typedef union salt { 41 struct { 42 ssci_t ssci; 43 __be64 pn; 44 } __packed; 45 u8 bytes[MACSEC_SALT_LEN]; 46 } __packed salt_t; 47 48 typedef union pn { 49 struct { 50 #if defined(__LITTLE_ENDIAN_BITFIELD) 51 u32 lower; 52 u32 upper; 53 #elif defined(__BIG_ENDIAN_BITFIELD) 54 u32 upper; 55 u32 lower; 56 #else 57 #error "Please fix <asm/byteorder.h>" 58 #endif 59 }; 60 u64 full64; 61 } pn_t; 62 63 /** 64 * struct macsec_key - SA key 65 * @id: user-provided key identifier 66 * @tfm: crypto struct, key storage 67 * @salt: salt used to generate IV in XPN cipher suites 68 */ 69 struct macsec_key { 70 u8 id[MACSEC_KEYID_LEN]; 71 struct crypto_aead *tfm; 72 salt_t salt; 73 }; 74 75 struct macsec_rx_sc_stats { 76 __u64 InOctetsValidated; 77 __u64 InOctetsDecrypted; 78 __u64 InPktsUnchecked; 79 __u64 InPktsDelayed; 80 __u64 InPktsOK; 81 __u64 InPktsInvalid; 82 __u64 InPktsLate; 83 __u64 InPktsNotValid; 84 __u64 InPktsNotUsingSA; 85 __u64 InPktsUnusedSA; 86 }; 87 88 struct macsec_rx_sa_stats { 89 __u32 InPktsOK; 90 __u32 InPktsInvalid; 91 __u32 InPktsNotValid; 92 __u32 InPktsNotUsingSA; 93 __u32 InPktsUnusedSA; 94 }; 95 96 struct macsec_tx_sa_stats { 97 __u32 OutPktsProtected; 98 __u32 OutPktsEncrypted; 99 }; 100 101 struct macsec_tx_sc_stats { 102 __u64 OutPktsProtected; 103 __u64 OutPktsEncrypted; 104 __u64 OutOctetsProtected; 105 __u64 OutOctetsEncrypted; 106 }; 107 108 struct macsec_dev_stats { 109 __u64 OutPktsUntagged; 110 __u64 InPktsUntagged; 111 __u64 OutPktsTooLong; 112 __u64 InPktsNoTag; 113 __u64 InPktsBadTag; 114 __u64 InPktsUnknownSCI; 115 __u64 InPktsNoSCI; 116 __u64 InPktsOverrun; 117 }; 118 119 /** 120 * struct macsec_rx_sa - receive secure association 121 * @active: 122 * @next_pn: packet number expected for the next packet 123 * @lock: protects next_pn manipulations 124 * @key: key structure 125 * @ssci: short secure channel identifier 126 * @stats: per-SA stats 127 * @destroy_work: deferred work to free the SA in process context after RCU grace period 128 */ 129 struct macsec_rx_sa { 130 struct macsec_key key; 131 ssci_t ssci; 132 spinlock_t lock; 133 union { 134 pn_t next_pn_halves; 135 u64 next_pn; 136 }; 137 refcount_t refcnt; 138 bool active; 139 struct macsec_rx_sa_stats __percpu *stats; 140 struct macsec_rx_sc *sc; 141 struct rcu_work destroy_work; 142 }; 143 144 struct pcpu_rx_sc_stats { 145 struct macsec_rx_sc_stats stats; 146 struct u64_stats_sync syncp; 147 }; 148 149 struct pcpu_tx_sc_stats { 150 struct macsec_tx_sc_stats stats; 151 struct u64_stats_sync syncp; 152 }; 153 154 /** 155 * struct macsec_rx_sc - receive secure channel 156 * @sci: secure channel identifier for this SC 157 * @active: channel is active 158 * @sa: array of secure associations 159 * @stats: per-SC stats 160 */ 161 struct macsec_rx_sc { 162 struct macsec_rx_sc __rcu *next; 163 sci_t sci; 164 bool active; 165 struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN]; 166 struct pcpu_rx_sc_stats __percpu *stats; 167 refcount_t refcnt; 168 struct rcu_head rcu_head; 169 }; 170 171 /** 172 * struct macsec_tx_sa - transmit secure association 173 * @active: 174 * @next_pn: packet number to use for the next packet 175 * @lock: protects next_pn manipulations 176 * @key: key structure 177 * @ssci: short secure channel identifier 178 * @stats: per-SA stats 179 * @destroy_work: deferred work to free the SA in process context after RCU grace period 180 */ 181 struct macsec_tx_sa { 182 struct macsec_key key; 183 ssci_t ssci; 184 spinlock_t lock; 185 union { 186 pn_t next_pn_halves; 187 u64 next_pn; 188 }; 189 refcount_t refcnt; 190 bool active; 191 struct macsec_tx_sa_stats __percpu *stats; 192 struct rcu_work destroy_work; 193 }; 194 195 /** 196 * struct macsec_tx_sc - transmit secure channel 197 * @active: 198 * @encoding_sa: association number of the SA currently in use 199 * @encrypt: encrypt packets on transmit, or authenticate only 200 * @send_sci: always include the SCI in the SecTAG 201 * @end_station: 202 * @scb: single copy broadcast flag 203 * @sa: array of secure associations 204 * @stats: stats for this TXSC 205 * @md_dst: MACsec offload metadata dst 206 */ 207 struct macsec_tx_sc { 208 bool active; 209 u8 encoding_sa; 210 bool encrypt; 211 bool send_sci; 212 bool end_station; 213 bool scb; 214 struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN]; 215 struct pcpu_tx_sc_stats __percpu *stats; 216 struct metadata_dst *md_dst; 217 }; 218 219 /** 220 * struct macsec_secy - MACsec Security Entity 221 * @netdev: netdevice for this SecY 222 * @n_rx_sc: number of receive secure channels configured on this SecY 223 * @sci: secure channel identifier used for tx 224 * @key_len: length of keys used by the cipher suite 225 * @icv_len: length of ICV used by the cipher suite 226 * @validate_frames: validation mode 227 * @xpn: enable XPN for this SecY 228 * @operational: MAC_Operational flag 229 * @protect_frames: enable protection for this SecY 230 * @replay_protect: enable packet number checks on receive 231 * @replay_window: size of the replay window 232 * @tx_sc: transmit secure channel 233 * @rx_sc: linked list of receive secure channels 234 */ 235 struct macsec_secy { 236 struct net_device *netdev; 237 unsigned int n_rx_sc; 238 sci_t sci; 239 u16 key_len; 240 u16 icv_len; 241 enum macsec_validation_type validate_frames; 242 bool xpn; 243 bool operational; 244 bool protect_frames; 245 bool replay_protect; 246 u32 replay_window; 247 struct macsec_tx_sc tx_sc; 248 struct macsec_rx_sc __rcu *rx_sc; 249 }; 250 251 /** 252 * struct macsec_context - MACsec context for hardware offloading 253 * @netdev: a valid pointer to a struct net_device if @offload == 254 * MACSEC_OFFLOAD_MAC 255 * @phydev: a valid pointer to a struct phy_device if @offload == 256 * MACSEC_OFFLOAD_PHY 257 * @offload: MACsec offload status 258 * @secy: pointer to a MACsec SecY 259 * @rx_sc: pointer to a RX SC 260 * @update_pn: when updating the SA, update the next PN 261 * @assoc_num: association number of the target SA 262 * @key: key of the target SA 263 * @rx_sa: pointer to an RX SA if a RX SA is added/updated/removed 264 * @tx_sa: pointer to an TX SA if a TX SA is added/updated/removed 265 * @tx_sc_stats: pointer to TX SC stats structure 266 * @tx_sa_stats: pointer to TX SA stats structure 267 * @rx_sc_stats: pointer to RX SC stats structure 268 * @rx_sa_stats: pointer to RX SA stats structure 269 * @dev_stats: pointer to dev stats structure 270 */ 271 struct macsec_context { 272 union { 273 struct net_device *netdev; 274 struct phy_device *phydev; 275 }; 276 enum macsec_offload offload; 277 278 struct macsec_secy *secy; 279 struct macsec_rx_sc *rx_sc; 280 struct { 281 bool update_pn; 282 unsigned char assoc_num; 283 u8 key[MACSEC_MAX_KEY_LEN]; 284 union { 285 struct macsec_rx_sa *rx_sa; 286 struct macsec_tx_sa *tx_sa; 287 }; 288 } sa; 289 union { 290 struct macsec_tx_sc_stats *tx_sc_stats; 291 struct macsec_tx_sa_stats *tx_sa_stats; 292 struct macsec_rx_sc_stats *rx_sc_stats; 293 struct macsec_rx_sa_stats *rx_sa_stats; 294 struct macsec_dev_stats *dev_stats; 295 } stats; 296 }; 297 298 /** 299 * struct macsec_ops - MACsec offloading operations 300 * @mdo_dev_open: called when the MACsec interface transitions to the up state 301 * @mdo_dev_stop: called when the MACsec interface transitions to the down 302 * state 303 * @mdo_add_secy: called when a new SecY is added 304 * @mdo_upd_secy: called when the SecY flags are changed or the MAC address of 305 * the MACsec interface is changed 306 * @mdo_del_secy: called when the hw offload is disabled or the MACsec 307 * interface is removed 308 * @mdo_add_rxsc: called when a new RX SC is added 309 * @mdo_upd_rxsc: called when a certain RX SC is updated 310 * @mdo_del_rxsc: called when a certain RX SC is removed 311 * @mdo_add_rxsa: called when a new RX SA is added 312 * @mdo_upd_rxsa: called when a certain RX SA is updated 313 * @mdo_del_rxsa: called when a certain RX SA is removed 314 * @mdo_add_txsa: called when a new TX SA is added 315 * @mdo_upd_txsa: called when a certain TX SA is updated 316 * @mdo_del_txsa: called when a certain TX SA is removed 317 * @mdo_get_dev_stats: called when dev stats are read 318 * @mdo_get_tx_sc_stats: called when TX SC stats are read 319 * @mdo_get_tx_sa_stats: called when TX SA stats are read 320 * @mdo_get_rx_sc_stats: called when RX SC stats are read 321 * @mdo_get_rx_sa_stats: called when RX SA stats are read 322 * @mdo_insert_tx_tag: called to insert the TX tag 323 * @needed_headroom: number of bytes reserved at the beginning of the sk_buff 324 * for the TX tag 325 * @needed_tailroom: number of bytes reserved at the end of the sk_buff for the 326 * TX tag 327 * @rx_uses_md_dst: whether MACsec device offload supports sk_buff md_dst 328 */ 329 struct macsec_ops { 330 /* Device wide */ 331 int (*mdo_dev_open)(struct macsec_context *ctx); 332 int (*mdo_dev_stop)(struct macsec_context *ctx); 333 /* SecY */ 334 int (*mdo_add_secy)(struct macsec_context *ctx); 335 int (*mdo_upd_secy)(struct macsec_context *ctx); 336 int (*mdo_del_secy)(struct macsec_context *ctx); 337 /* Security channels */ 338 int (*mdo_add_rxsc)(struct macsec_context *ctx); 339 int (*mdo_upd_rxsc)(struct macsec_context *ctx); 340 int (*mdo_del_rxsc)(struct macsec_context *ctx); 341 /* Security associations */ 342 int (*mdo_add_rxsa)(struct macsec_context *ctx); 343 int (*mdo_upd_rxsa)(struct macsec_context *ctx); 344 int (*mdo_del_rxsa)(struct macsec_context *ctx); 345 int (*mdo_add_txsa)(struct macsec_context *ctx); 346 int (*mdo_upd_txsa)(struct macsec_context *ctx); 347 int (*mdo_del_txsa)(struct macsec_context *ctx); 348 /* Statistics */ 349 int (*mdo_get_dev_stats)(struct macsec_context *ctx); 350 int (*mdo_get_tx_sc_stats)(struct macsec_context *ctx); 351 int (*mdo_get_tx_sa_stats)(struct macsec_context *ctx); 352 int (*mdo_get_rx_sc_stats)(struct macsec_context *ctx); 353 int (*mdo_get_rx_sa_stats)(struct macsec_context *ctx); 354 /* Offload tag */ 355 int (*mdo_insert_tx_tag)(struct phy_device *phydev, 356 struct sk_buff *skb); 357 unsigned int needed_headroom; 358 unsigned int needed_tailroom; 359 bool rx_uses_md_dst; 360 }; 361 362 void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa); macsec_send_sci(const struct macsec_secy * secy)363static inline bool macsec_send_sci(const struct macsec_secy *secy) 364 { 365 const struct macsec_tx_sc *tx_sc = &secy->tx_sc; 366 367 return tx_sc->send_sci || 368 (secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb); 369 } 370 struct net_device *macsec_get_real_dev(const struct net_device *dev); 371 bool macsec_netdev_is_offloaded(struct net_device *dev); 372 macsec_netdev_priv(const struct net_device * dev)373static inline void *macsec_netdev_priv(const struct net_device *dev) 374 { 375 #if IS_ENABLED(CONFIG_VLAN_8021Q) 376 if (is_vlan_dev(dev)) 377 return netdev_priv(vlan_dev_priv(dev)->real_dev); 378 #endif 379 return netdev_priv(dev); 380 } 381 sci_to_cpu(sci_t sci)382static inline u64 sci_to_cpu(sci_t sci) 383 { 384 return be64_to_cpu((__force __be64)sci); 385 } 386 387 #endif /* _NET_MACSEC_H_ */ 388