1 // SPDX-License-Identifier: GPL-2.0 2 3 #include <linux/ip.h> 4 #include <linux/skbuff.h> 5 #include <net/ip6_checksum.h> 6 #include <net/psp.h> 7 #include <net/sock.h> 8 9 #include "netdevsim.h" 10 11 void nsim_psp_handle_ext(struct sk_buff *skb, struct skb_ext *psp_ext) 12 { 13 if (psp_ext) 14 __skb_ext_set(skb, SKB_EXT_PSP, psp_ext); 15 } 16 17 enum skb_drop_reason 18 nsim_do_psp(struct sk_buff *skb, struct netdevsim *ns, 19 struct netdevsim *peer_ns, struct skb_ext **psp_ext) 20 { 21 enum skb_drop_reason rc = 0; 22 struct psp_dev *peer_psd; 23 struct psp_assoc *pas; 24 struct net *net; 25 void **ptr; 26 27 rcu_read_lock(); 28 pas = psp_skb_get_assoc_rcu(skb); 29 if (!pas) { 30 rc = SKB_NOT_DROPPED_YET; 31 goto out_unlock; 32 } 33 34 if (!skb_transport_header_was_set(skb)) { 35 rc = SKB_DROP_REASON_PSP_OUTPUT; 36 goto out_unlock; 37 } 38 39 ptr = psp_assoc_drv_data(pas); 40 if (*ptr != ns) { 41 rc = SKB_DROP_REASON_PSP_OUTPUT; 42 goto out_unlock; 43 } 44 45 net = sock_net(skb->sk); 46 if (!psp_dev_encapsulate(net, skb, pas->tx.spi, pas->version, 0)) { 47 rc = SKB_DROP_REASON_PSP_OUTPUT; 48 goto out_unlock; 49 } 50 51 /* Now pretend we just received this frame */ 52 peer_psd = rcu_dereference(peer_ns->psp.dev); 53 if (peer_psd && peer_psd->config.versions & (1 << pas->version)) { 54 bool strip_icv = false; 55 u8 generation; 56 57 /* We cheat a bit and put the generation in the key. 58 * In real life if generation was too old, then decryption would 59 * fail. Here, we just make it so a bad key causes a bad 60 * generation too, and psp_sk_rx_policy_check() will fail. 61 */ 62 generation = pas->tx.key[0]; 63 64 skb_ext_reset(skb); 65 skb->mac_len = ETH_HLEN; 66 if (psp_dev_rcv(skb, peer_psd->id, generation, strip_icv)) { 67 rc = SKB_DROP_REASON_PSP_OUTPUT; 68 goto out_unlock; 69 } 70 71 *psp_ext = skb->extensions; 72 refcount_inc(&(*psp_ext)->refcnt); 73 skb->decrypted = 1; 74 75 u64_stats_update_begin(&ns->psp.syncp); 76 u64_stats_inc(&ns->psp.tx_packets); 77 u64_stats_inc(&ns->psp.rx_packets); 78 u64_stats_add(&ns->psp.tx_bytes, 79 skb->len - skb_inner_transport_offset(skb)); 80 u64_stats_add(&ns->psp.rx_bytes, 81 skb->len - skb_inner_transport_offset(skb)); 82 u64_stats_update_end(&ns->psp.syncp); 83 } else { 84 struct ipv6hdr *ip6h __maybe_unused; 85 struct iphdr *iph; 86 struct udphdr *uh; 87 __wsum csum; 88 89 /* Do not decapsulate. Receive the skb with the udp and psp 90 * headers still there as if this is a normal udp packet. 91 * psp_dev_encapsulate() sets udp checksum to 0, so we need to 92 * provide a valid checksum here, so the skb isn't dropped. 93 */ 94 uh = udp_hdr(skb); 95 csum = skb_checksum(skb, skb_transport_offset(skb), 96 ntohs(uh->len), 0); 97 98 switch (skb->protocol) { 99 case htons(ETH_P_IP): 100 iph = ip_hdr(skb); 101 uh->check = udp_v4_check(ntohs(uh->len), iph->saddr, 102 iph->daddr, csum); 103 break; 104 #if IS_ENABLED(CONFIG_IPV6) 105 case htons(ETH_P_IPV6): 106 ip6h = ipv6_hdr(skb); 107 uh->check = udp_v6_check(ntohs(uh->len), &ip6h->saddr, 108 &ip6h->daddr, csum); 109 break; 110 #endif 111 } 112 113 uh->check = uh->check ?: CSUM_MANGLED_0; 114 skb->ip_summed = CHECKSUM_NONE; 115 } 116 117 out_unlock: 118 rcu_read_unlock(); 119 return rc; 120 } 121 122 static int 123 nsim_psp_set_config(struct psp_dev *psd, struct psp_dev_config *conf, 124 struct netlink_ext_ack *extack) 125 { 126 return 0; 127 } 128 129 static int 130 nsim_rx_spi_alloc(struct psp_dev *psd, u32 version, 131 struct psp_key_parsed *assoc, 132 struct netlink_ext_ack *extack) 133 { 134 struct netdevsim *ns = psd->drv_priv; 135 int i; 136 137 /* Check if incrementing the spi would change the phase bit */ 138 if ((ns->psp.spi & PSP_SPI_KEY_ID) == PSP_SPI_KEY_ID) { 139 NL_SET_ERR_MSG(extack, "SPI space exhausted"); 140 return -ENOSPC; 141 } 142 143 assoc->spi = cpu_to_be32(++ns->psp.spi); 144 assoc->key[0] = psd->generation; 145 for (i = 1; i < PSP_MAX_KEY; i++) 146 assoc->key[i] = ns->psp.spi + i; 147 148 return 0; 149 } 150 151 static int nsim_assoc_add(struct psp_dev *psd, struct psp_assoc *pas, 152 struct netlink_ext_ack *extack) 153 { 154 struct netdevsim *ns = psd->drv_priv; 155 void **ptr = psp_assoc_drv_data(pas); 156 157 /* Copy drv_priv from psd to assoc */ 158 *ptr = psd->drv_priv; 159 ns->psp.assoc_cnt++; 160 161 return 0; 162 } 163 164 static int nsim_key_rotate(struct psp_dev *psd, struct netlink_ext_ack *extack) 165 { 166 struct netdevsim *ns = psd->drv_priv; 167 168 /* Flip key phase and reset SPI to 0 within that space 169 * (will be pre-incremented, as 0 is an invalid SPI). 170 */ 171 if (ns->psp.spi & PSP_SPI_KEY_PHASE) 172 ns->psp.spi = 0; 173 else 174 ns->psp.spi = PSP_SPI_KEY_PHASE; 175 176 return 0; 177 } 178 179 static void nsim_assoc_del(struct psp_dev *psd, struct psp_assoc *pas) 180 { 181 struct netdevsim *ns = psd->drv_priv; 182 void **ptr = psp_assoc_drv_data(pas); 183 184 *ptr = NULL; 185 ns->psp.assoc_cnt--; 186 } 187 188 static void nsim_get_stats(struct psp_dev *psd, struct psp_dev_stats *stats) 189 { 190 struct netdevsim *ns = psd->drv_priv; 191 unsigned int start; 192 193 /* WARNING: do *not* blindly zero stats in real drivers! 194 * All required stats must be reported by the device! 195 */ 196 memset(stats, 0, sizeof(struct psp_dev_stats)); 197 198 do { 199 start = u64_stats_fetch_begin(&ns->psp.syncp); 200 stats->rx_bytes = u64_stats_read(&ns->psp.rx_bytes); 201 stats->rx_packets = u64_stats_read(&ns->psp.rx_packets); 202 stats->tx_bytes = u64_stats_read(&ns->psp.tx_bytes); 203 stats->tx_packets = u64_stats_read(&ns->psp.tx_packets); 204 } while (u64_stats_fetch_retry(&ns->psp.syncp, start)); 205 } 206 207 static struct psp_dev_ops nsim_psp_ops = { 208 .set_config = nsim_psp_set_config, 209 .rx_spi_alloc = nsim_rx_spi_alloc, 210 .tx_key_add = nsim_assoc_add, 211 .tx_key_del = nsim_assoc_del, 212 .key_rotate = nsim_key_rotate, 213 .get_stats = nsim_get_stats, 214 }; 215 216 static struct psp_dev_caps nsim_psp_caps = { 217 .versions = 1 << PSP_VERSION_HDR0_AES_GCM_128 | 218 1 << PSP_VERSION_HDR0_AES_GMAC_128 | 219 1 << PSP_VERSION_HDR0_AES_GCM_256 | 220 1 << PSP_VERSION_HDR0_AES_GMAC_256, 221 .assoc_drv_spc = sizeof(void *), 222 }; 223 224 static void __nsim_psp_uninit(struct netdevsim *ns, bool teardown) 225 { 226 struct psp_dev *psd; 227 228 psd = rcu_dereference_protected(ns->psp.dev, 229 teardown || 230 lockdep_is_held(&ns->psp.rereg_lock)); 231 if (psd) { 232 rcu_assign_pointer(ns->psp.dev, NULL); 233 synchronize_rcu(); 234 psp_dev_unregister(psd); 235 } 236 WARN_ON(ns->psp.assoc_cnt); 237 } 238 239 void nsim_psp_uninit(struct netdevsim *ns) 240 { 241 debugfs_remove(ns->psp.rereg); 242 mutex_destroy(&ns->psp.rereg_lock); 243 __nsim_psp_uninit(ns, true); 244 } 245 246 static ssize_t 247 nsim_psp_rereg_write(struct file *file, const char __user *data, size_t count, 248 loff_t *ppos) 249 { 250 struct netdevsim *ns = file->private_data; 251 struct psp_dev *psd; 252 ssize_t ret; 253 254 mutex_lock(&ns->psp.rereg_lock); 255 __nsim_psp_uninit(ns, false); 256 257 psd = psp_dev_create(ns->netdev, &nsim_psp_ops, &nsim_psp_caps, ns); 258 if (IS_ERR(psd)) { 259 ret = PTR_ERR(psd); 260 goto out; 261 } 262 263 rcu_assign_pointer(ns->psp.dev, psd); 264 ret = count; 265 out: 266 mutex_unlock(&ns->psp.rereg_lock); 267 return ret; 268 } 269 270 static const struct file_operations nsim_psp_rereg_fops = { 271 .open = simple_open, 272 .write = nsim_psp_rereg_write, 273 .llseek = generic_file_llseek, 274 .owner = THIS_MODULE, 275 }; 276 277 int nsim_psp_init(struct netdevsim *ns) 278 { 279 struct dentry *ddir = ns->nsim_dev_port->ddir; 280 struct psp_dev *psd; 281 282 psd = psp_dev_create(ns->netdev, &nsim_psp_ops, &nsim_psp_caps, ns); 283 if (IS_ERR(psd)) 284 return PTR_ERR(psd); 285 286 rcu_assign_pointer(ns->psp.dev, psd); 287 288 mutex_init(&ns->psp.rereg_lock); 289 ns->psp.rereg = debugfs_create_file("psp_rereg", 0200, ddir, ns, 290 &nsim_psp_rereg_fops); 291 return 0; 292 } 293