1/* 2 * Copyright (c) 2017 Mellanox Technologies. All rights reserved. 3 * 4 * This software is available to you under a choice of one of two 5 * licenses. You may choose to be licensed under the terms of the GNU 6 * General Public License (GPL) Version 2, available from the file 7 * COPYING in the main directory of this source tree, or the 8 * OpenIB.org BSD license below: 9 * 10 * Redistribution and use in source and binary forms, with or 11 * without modification, are permitted provided that the following 12 * conditions are met: 13 * 14 * - Redistributions of source code must retain the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer. 17 * 18 * - Redistributions in binary form must reproduce the above 19 * copyright notice, this list of conditions and the following 20 * disclaimer in the documentation and/or other materials 21 * provided with the distribution. 22 * 23 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 24 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 25 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 26 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS 27 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 28 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 29 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 30 * SOFTWARE. 31 * 32 */ 33 34#ifndef __MLX5E_IPSEC_H__ 35#define __MLX5E_IPSEC_H__ 36 37#include <linux/mlx5/device.h> 38#include <net/xfrm.h> 39#include <linux/idr.h> 40#include "lib/aso.h" 41#include "lib/devcom.h" 42 43#define MLX5E_IPSEC_SADB_RX_BITS 10 44#define MLX5E_IPSEC_ESN_SCOPE_MID 0x80000000L 45 46struct aes_gcm_keymat { 47 u64 seq_iv; 48 49 u32 salt; 50 u32 icv_len; 51 52 u32 key_len; 53 u32 aes_key[256 / 32]; 54}; 55 56struct upspec { 57 u16 dport; 58 u16 dport_mask; 59 u16 sport; 60 u16 sport_mask; 61 u8 proto; 62}; 63 64struct mlx5_ipsec_lft { 65 u64 hard_packet_limit; 66 u64 soft_packet_limit; 67 u64 numb_rounds_hard; 68 u64 numb_rounds_soft; 69}; 70 71struct mlx5_replay_esn { 72 u32 replay_window; 73 u32 esn; 74 u32 esn_msb; 75 u8 overlap : 1; 76 u8 trigger : 1; 77}; 78 79struct mlx5_accel_esp_xfrm_attrs { 80 u32 spi; 81 u32 mode; 82 struct aes_gcm_keymat aes_gcm; 83 84 union { 85 __be32 a4; 86 __be32 a6[4]; 87 } saddr; 88 89 union { 90 __be32 a4; 91 __be32 a6[4]; 92 } daddr; 93 94 struct upspec upspec; 95 u8 dir : 2; 96 u8 type : 2; 97 u8 drop : 1; 98 u8 encap : 1; 99 u8 family; 100 struct mlx5_replay_esn replay_esn; 101 u32 authsize; 102 u32 reqid; 103 struct mlx5_ipsec_lft lft; 104 union { 105 u8 smac[ETH_ALEN]; 106 __be16 sport; 107 }; 108 union { 109 u8 dmac[ETH_ALEN]; 110 __be16 dport; 111 }; 112}; 113 114enum mlx5_ipsec_cap { 115 MLX5_IPSEC_CAP_CRYPTO = 1 << 0, 116 MLX5_IPSEC_CAP_ESN = 1 << 1, 117 MLX5_IPSEC_CAP_PACKET_OFFLOAD = 1 << 2, 118 MLX5_IPSEC_CAP_ROCE = 1 << 3, 119 MLX5_IPSEC_CAP_PRIO = 1 << 4, 120 MLX5_IPSEC_CAP_TUNNEL = 1 << 5, 121 MLX5_IPSEC_CAP_ESPINUDP = 1 << 6, 122}; 123 124struct mlx5e_priv; 125 126struct mlx5e_ipsec_hw_stats { 127 u64 ipsec_rx_pkts; 128 u64 ipsec_rx_bytes; 129 u64 ipsec_rx_drop_pkts; 130 u64 ipsec_rx_drop_bytes; 131 u64 ipsec_tx_pkts; 132 u64 ipsec_tx_bytes; 133 u64 ipsec_tx_drop_pkts; 134 u64 ipsec_tx_drop_bytes; 135}; 136 137struct mlx5e_ipsec_sw_stats { 138 atomic64_t ipsec_rx_drop_sp_alloc; 139 atomic64_t ipsec_rx_drop_sadb_miss; 140 atomic64_t ipsec_tx_drop_bundle; 141 atomic64_t ipsec_tx_drop_no_state; 142 atomic64_t ipsec_tx_drop_not_ip; 143 atomic64_t ipsec_tx_drop_trailer; 144}; 145 146struct mlx5e_ipsec_fc; 147struct mlx5e_ipsec_tx; 148 149struct mlx5e_ipsec_work { 150 struct work_struct work; 151 struct mlx5e_ipsec_sa_entry *sa_entry; 152 void *data; 153}; 154 155struct mlx5e_ipsec_netevent_data { 156 u8 addr[ETH_ALEN]; 157}; 158 159struct mlx5e_ipsec_dwork { 160 struct delayed_work dwork; 161 struct mlx5e_ipsec_sa_entry *sa_entry; 162}; 163 164struct mlx5e_ipsec_aso { 165 u8 __aligned(64) ctx[MLX5_ST_SZ_BYTES(ipsec_aso)]; 166 dma_addr_t dma_addr; 167 struct mlx5_aso *aso; 168 /* Protect ASO WQ access, as it is global to whole IPsec */ 169 spinlock_t lock; 170}; 171 172struct mlx5e_ipsec_rx_create_attr { 173 struct mlx5_flow_namespace *ns; 174 struct mlx5_ttc_table *ttc; 175 u32 family; 176 int prio; 177 int pol_level; 178 int sa_level; 179 int status_level; 180 enum mlx5_flow_namespace_type chains_ns; 181}; 182 183struct mlx5e_ipsec_ft { 184 struct mutex mutex; /* Protect changes to this struct */ 185 struct mlx5_flow_table *pol; 186 struct mlx5_flow_table *sa; 187 struct mlx5_flow_table *status; 188 u32 refcnt; 189}; 190 191struct mlx5e_ipsec_drop { 192 struct mlx5_flow_handle *rule; 193 struct mlx5_fc *fc; 194}; 195 196struct mlx5e_ipsec_rule { 197 struct mlx5_flow_handle *rule; 198 struct mlx5_modify_hdr *modify_hdr; 199 struct mlx5_pkt_reformat *pkt_reformat; 200 struct mlx5_fc *fc; 201 struct mlx5e_ipsec_drop replay; 202 struct mlx5e_ipsec_drop auth; 203 struct mlx5e_ipsec_drop trailer; 204}; 205 206struct mlx5e_ipsec_miss { 207 struct mlx5_flow_group *group; 208 struct mlx5_flow_handle *rule; 209}; 210 211struct mlx5e_ipsec_tx_create_attr { 212 int prio; 213 int pol_level; 214 int sa_level; 215 int cnt_level; 216 enum mlx5_flow_namespace_type chains_ns; 217}; 218 219struct mlx5e_ipsec_mpv_work { 220 int event; 221 struct work_struct work; 222 struct mlx5e_priv *slave_priv; 223 struct mlx5e_priv *master_priv; 224}; 225 226struct mlx5e_ipsec { 227 struct mlx5_core_dev *mdev; 228 struct xarray sadb; 229 struct mlx5e_ipsec_sw_stats sw_stats; 230 struct mlx5e_ipsec_hw_stats hw_stats; 231 struct workqueue_struct *wq; 232 struct completion comp; 233 struct mlx5e_flow_steering *fs; 234 struct mlx5e_ipsec_rx *rx_ipv4; 235 struct mlx5e_ipsec_rx *rx_ipv6; 236 struct mlx5e_ipsec_rx *rx_esw; 237 struct mlx5e_ipsec_tx *tx; 238 struct mlx5e_ipsec_tx *tx_esw; 239 struct mlx5e_ipsec_aso *aso; 240 struct notifier_block nb; 241 struct notifier_block netevent_nb; 242 struct mlx5_ipsec_fs *roce; 243 u8 is_uplink_rep: 1; 244 struct mlx5e_ipsec_mpv_work mpv_work; 245 struct xarray ipsec_obj_id_map; 246}; 247 248struct mlx5e_ipsec_esn_state { 249 u32 esn; 250 u32 esn_msb; 251 u8 overlap: 1; 252}; 253 254struct mlx5e_ipsec_limits { 255 u64 round; 256 u8 soft_limit_hit : 1; 257 u8 fix_limit : 1; 258}; 259 260struct mlx5e_ipsec_sa_entry { 261 struct mlx5e_ipsec_esn_state esn_state; 262 struct xfrm_state *x; 263 struct mlx5e_ipsec *ipsec; 264 struct mlx5_accel_esp_xfrm_attrs attrs; 265 void (*set_iv_op)(struct sk_buff *skb, struct xfrm_state *x, 266 struct xfrm_offload *xo); 267 u32 ipsec_obj_id; 268 u32 enc_key_id; 269 struct mlx5e_ipsec_rule ipsec_rule; 270 struct mlx5e_ipsec_work *work; 271 struct mlx5e_ipsec_dwork *dwork; 272 struct mlx5e_ipsec_limits limits; 273 u32 rx_mapped_id; 274}; 275 276struct mlx5_accel_pol_xfrm_attrs { 277 union { 278 __be32 a4; 279 __be32 a6[4]; 280 } saddr; 281 282 union { 283 __be32 a4; 284 __be32 a6[4]; 285 } daddr; 286 287 struct upspec upspec; 288 u8 family; 289 u8 action; 290 u8 type : 2; 291 u8 dir : 2; 292 u32 reqid; 293 u32 prio; 294}; 295 296struct mlx5e_ipsec_pol_entry { 297 struct xfrm_policy *x; 298 struct mlx5e_ipsec *ipsec; 299 struct mlx5e_ipsec_rule ipsec_rule; 300 struct mlx5_accel_pol_xfrm_attrs attrs; 301}; 302 303#ifdef CONFIG_MLX5_EN_IPSEC 304 305void mlx5e_ipsec_init(struct mlx5e_priv *priv); 306void mlx5e_ipsec_cleanup(struct mlx5e_priv *priv); 307void mlx5e_ipsec_build_netdev(struct mlx5e_priv *priv); 308 309void mlx5e_accel_ipsec_fs_cleanup(struct mlx5e_ipsec *ipsec); 310int mlx5e_accel_ipsec_fs_init(struct mlx5e_ipsec *ipsec, struct mlx5_devcom_comp_dev **devcom); 311int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry); 312void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_ipsec_sa_entry *sa_entry); 313int mlx5e_accel_ipsec_fs_add_pol(struct mlx5e_ipsec_pol_entry *pol_entry); 314void mlx5e_accel_ipsec_fs_del_pol(struct mlx5e_ipsec_pol_entry *pol_entry); 315void mlx5e_accel_ipsec_fs_modify(struct mlx5e_ipsec_sa_entry *sa_entry); 316bool mlx5e_ipsec_fs_tunnel_enabled(struct mlx5e_ipsec_sa_entry *sa_entry); 317 318int mlx5_ipsec_create_sa_ctx(struct mlx5e_ipsec_sa_entry *sa_entry); 319void mlx5_ipsec_free_sa_ctx(struct mlx5e_ipsec_sa_entry *sa_entry); 320 321u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev); 322 323void mlx5_accel_esp_modify_xfrm(struct mlx5e_ipsec_sa_entry *sa_entry, 324 const struct mlx5_accel_esp_xfrm_attrs *attrs); 325 326int mlx5e_ipsec_aso_init(struct mlx5e_ipsec *ipsec); 327void mlx5e_ipsec_aso_cleanup(struct mlx5e_ipsec *ipsec); 328 329int mlx5e_ipsec_aso_query(struct mlx5e_ipsec_sa_entry *sa_entry, 330 struct mlx5_wqe_aso_ctrl_seg *data); 331void mlx5e_accel_ipsec_fs_read_stats(struct mlx5e_priv *priv, 332 void *ipsec_stats); 333 334void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry, 335 struct mlx5_accel_esp_xfrm_attrs *attrs); 336void mlx5e_ipsec_handle_mpv_event(int event, struct mlx5e_priv *slave_priv, 337 struct mlx5e_priv *master_priv); 338void mlx5e_ipsec_send_event(struct mlx5e_priv *priv, int event); 339 340static inline struct mlx5_core_dev * 341mlx5e_ipsec_sa2dev(struct mlx5e_ipsec_sa_entry *sa_entry) 342{ 343 return sa_entry->ipsec->mdev; 344} 345 346static inline struct mlx5_core_dev * 347mlx5e_ipsec_pol2dev(struct mlx5e_ipsec_pol_entry *pol_entry) 348{ 349 return pol_entry->ipsec->mdev; 350} 351 352static inline bool addr6_all_zero(__be32 *addr6) 353{ 354 static const __be32 zaddr6[4] = {}; 355 356 return !memcmp(addr6, zaddr6, sizeof(zaddr6)); 357} 358#else 359static inline void mlx5e_ipsec_init(struct mlx5e_priv *priv) 360{ 361} 362 363static inline void mlx5e_ipsec_cleanup(struct mlx5e_priv *priv) 364{ 365} 366 367static inline void mlx5e_ipsec_build_netdev(struct mlx5e_priv *priv) 368{ 369} 370 371static inline u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev) 372{ 373 return 0; 374} 375 376static inline void mlx5e_ipsec_handle_mpv_event(int event, struct mlx5e_priv *slave_priv, 377 struct mlx5e_priv *master_priv) 378{ 379} 380 381static inline void mlx5e_ipsec_send_event(struct mlx5e_priv *priv, int event) 382{ 383} 384#endif 385 386#endif /* __MLX5E_IPSEC_H__ */ 387