1/* SPDX-License-Identifier: GPL-2.0+ */
2/*
3 * MACsec netdev header, used for h/w accelerated implementations.
4 *
5 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net>
6 */
7#ifndef _NET_MACSEC_H_
8#define _NET_MACSEC_H_
9
10#include <linux/u64_stats_sync.h>
11#include <linux/if_vlan.h>
12#include <uapi/linux/if_link.h>
13#include <uapi/linux/if_macsec.h>
14
15#define MACSEC_DEFAULT_PN_LEN 4
16#define MACSEC_XPN_PN_LEN 8
17
18#define MACSEC_NUM_AN 4 /* 2 bits for the association number */
19
20#define MACSEC_SCI_LEN 8
21#define MACSEC_PORT_ES (htons(0x0001))
22
23#define MACSEC_TCI_VERSION 0x80
24#define MACSEC_TCI_ES      0x40 /* end station */
25#define MACSEC_TCI_SC      0x20 /* SCI present */
26#define MACSEC_TCI_SCB     0x10 /* epon */
27#define MACSEC_TCI_E       0x08 /* encryption */
28#define MACSEC_TCI_C       0x04 /* changed text */
29#define MACSEC_AN_MASK     0x03 /* association number */
30#define MACSEC_TCI_CONFID  (MACSEC_TCI_E | MACSEC_TCI_C)
31
32#define MACSEC_DEFAULT_ICV_LEN 16
33
34typedef u64 __bitwise sci_t;
35typedef u32 __bitwise ssci_t;
36
37struct metadata_dst;
38
39typedef union salt {
40	struct {
41		u32 ssci;
42		u64 pn;
43	} __packed;
44	u8 bytes[MACSEC_SALT_LEN];
45} __packed salt_t;
46
47typedef union pn {
48	struct {
49#if defined(__LITTLE_ENDIAN_BITFIELD)
50		u32 lower;
51		u32 upper;
52#elif defined(__BIG_ENDIAN_BITFIELD)
53		u32 upper;
54		u32 lower;
55#else
56#error	"Please fix <asm/byteorder.h>"
57#endif
58	};
59	u64 full64;
60} pn_t;
61
62/**
63 * struct macsec_key - SA key
64 * @id: user-provided key identifier
65 * @tfm: crypto struct, key storage
66 * @salt: salt used to generate IV in XPN cipher suites
67 */
68struct macsec_key {
69	u8 id[MACSEC_KEYID_LEN];
70	struct crypto_aead *tfm;
71	salt_t salt;
72};
73
74struct macsec_rx_sc_stats {
75	__u64 InOctetsValidated;
76	__u64 InOctetsDecrypted;
77	__u64 InPktsUnchecked;
78	__u64 InPktsDelayed;
79	__u64 InPktsOK;
80	__u64 InPktsInvalid;
81	__u64 InPktsLate;
82	__u64 InPktsNotValid;
83	__u64 InPktsNotUsingSA;
84	__u64 InPktsUnusedSA;
85};
86
87struct macsec_rx_sa_stats {
88	__u32 InPktsOK;
89	__u32 InPktsInvalid;
90	__u32 InPktsNotValid;
91	__u32 InPktsNotUsingSA;
92	__u32 InPktsUnusedSA;
93};
94
95struct macsec_tx_sa_stats {
96	__u32 OutPktsProtected;
97	__u32 OutPktsEncrypted;
98};
99
100struct macsec_tx_sc_stats {
101	__u64 OutPktsProtected;
102	__u64 OutPktsEncrypted;
103	__u64 OutOctetsProtected;
104	__u64 OutOctetsEncrypted;
105};
106
107struct macsec_dev_stats {
108	__u64 OutPktsUntagged;
109	__u64 InPktsUntagged;
110	__u64 OutPktsTooLong;
111	__u64 InPktsNoTag;
112	__u64 InPktsBadTag;
113	__u64 InPktsUnknownSCI;
114	__u64 InPktsNoSCI;
115	__u64 InPktsOverrun;
116};
117
118/**
119 * struct macsec_rx_sa - receive secure association
120 * @active:
121 * @next_pn: packet number expected for the next packet
122 * @lock: protects next_pn manipulations
123 * @key: key structure
124 * @ssci: short secure channel identifier
125 * @stats: per-SA stats
126 */
127struct macsec_rx_sa {
128	struct macsec_key key;
129	ssci_t ssci;
130	spinlock_t lock;
131	union {
132		pn_t next_pn_halves;
133		u64 next_pn;
134	};
135	refcount_t refcnt;
136	bool active;
137	struct macsec_rx_sa_stats __percpu *stats;
138	struct macsec_rx_sc *sc;
139	struct rcu_head rcu;
140};
141
142struct pcpu_rx_sc_stats {
143	struct macsec_rx_sc_stats stats;
144	struct u64_stats_sync syncp;
145};
146
147struct pcpu_tx_sc_stats {
148	struct macsec_tx_sc_stats stats;
149	struct u64_stats_sync syncp;
150};
151
152/**
153 * struct macsec_rx_sc - receive secure channel
154 * @sci: secure channel identifier for this SC
155 * @active: channel is active
156 * @sa: array of secure associations
157 * @stats: per-SC stats
158 */
159struct macsec_rx_sc {
160	struct macsec_rx_sc __rcu *next;
161	sci_t sci;
162	bool active;
163	struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN];
164	struct pcpu_rx_sc_stats __percpu *stats;
165	refcount_t refcnt;
166	struct rcu_head rcu_head;
167};
168
169/**
170 * struct macsec_tx_sa - transmit secure association
171 * @active:
172 * @next_pn: packet number to use for the next packet
173 * @lock: protects next_pn manipulations
174 * @key: key structure
175 * @ssci: short secure channel identifier
176 * @stats: per-SA stats
177 */
178struct macsec_tx_sa {
179	struct macsec_key key;
180	ssci_t ssci;
181	spinlock_t lock;
182	union {
183		pn_t next_pn_halves;
184		u64 next_pn;
185	};
186	refcount_t refcnt;
187	bool active;
188	struct macsec_tx_sa_stats __percpu *stats;
189	struct rcu_head rcu;
190};
191
192/**
193 * struct macsec_tx_sc - transmit secure channel
194 * @active:
195 * @encoding_sa: association number of the SA currently in use
196 * @encrypt: encrypt packets on transmit, or authenticate only
197 * @send_sci: always include the SCI in the SecTAG
198 * @end_station:
199 * @scb: single copy broadcast flag
200 * @sa: array of secure associations
201 * @stats: stats for this TXSC
202 * @md_dst: MACsec offload metadata dst
203 */
204struct macsec_tx_sc {
205	bool active;
206	u8 encoding_sa;
207	bool encrypt;
208	bool send_sci;
209	bool end_station;
210	bool scb;
211	struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN];
212	struct pcpu_tx_sc_stats __percpu *stats;
213	struct metadata_dst *md_dst;
214};
215
216/**
217 * struct macsec_secy - MACsec Security Entity
218 * @netdev: netdevice for this SecY
219 * @n_rx_sc: number of receive secure channels configured on this SecY
220 * @sci: secure channel identifier used for tx
221 * @key_len: length of keys used by the cipher suite
222 * @icv_len: length of ICV used by the cipher suite
223 * @validate_frames: validation mode
224 * @xpn: enable XPN for this SecY
225 * @operational: MAC_Operational flag
226 * @protect_frames: enable protection for this SecY
227 * @replay_protect: enable packet number checks on receive
228 * @replay_window: size of the replay window
229 * @tx_sc: transmit secure channel
230 * @rx_sc: linked list of receive secure channels
231 */
232struct macsec_secy {
233	struct net_device *netdev;
234	unsigned int n_rx_sc;
235	sci_t sci;
236	u16 key_len;
237	u16 icv_len;
238	enum macsec_validation_type validate_frames;
239	bool xpn;
240	bool operational;
241	bool protect_frames;
242	bool replay_protect;
243	u32 replay_window;
244	struct macsec_tx_sc tx_sc;
245	struct macsec_rx_sc __rcu *rx_sc;
246};
247
248/**
249 * struct macsec_context - MACsec context for hardware offloading
250 * @netdev: a valid pointer to a struct net_device if @offload ==
251 *	MACSEC_OFFLOAD_MAC
252 * @phydev: a valid pointer to a struct phy_device if @offload ==
253 *	MACSEC_OFFLOAD_PHY
254 * @offload: MACsec offload status
255 * @secy: pointer to a MACsec SecY
256 * @rx_sc: pointer to a RX SC
257 * @update_pn: when updating the SA, update the next PN
258 * @assoc_num: association number of the target SA
259 * @key: key of the target SA
260 * @rx_sa: pointer to an RX SA if a RX SA is added/updated/removed
261 * @tx_sa: pointer to an TX SA if a TX SA is added/updated/removed
262 * @tx_sc_stats: pointer to TX SC stats structure
263 * @tx_sa_stats: pointer to TX SA stats structure
264 * @rx_sc_stats: pointer to RX SC stats structure
265 * @rx_sa_stats: pointer to RX SA stats structure
266 * @dev_stats: pointer to dev stats structure
267 */
268struct macsec_context {
269	union {
270		struct net_device *netdev;
271		struct phy_device *phydev;
272	};
273	enum macsec_offload offload;
274
275	struct macsec_secy *secy;
276	struct macsec_rx_sc *rx_sc;
277	struct {
278		bool update_pn;
279		unsigned char assoc_num;
280		u8 key[MACSEC_MAX_KEY_LEN];
281		union {
282			struct macsec_rx_sa *rx_sa;
283			struct macsec_tx_sa *tx_sa;
284		};
285	} sa;
286	union {
287		struct macsec_tx_sc_stats *tx_sc_stats;
288		struct macsec_tx_sa_stats *tx_sa_stats;
289		struct macsec_rx_sc_stats *rx_sc_stats;
290		struct macsec_rx_sa_stats *rx_sa_stats;
291		struct macsec_dev_stats  *dev_stats;
292	} stats;
293};
294
295/**
296 * struct macsec_ops - MACsec offloading operations
297 * @mdo_dev_open: called when the MACsec interface transitions to the up state
298 * @mdo_dev_stop: called when the MACsec interface transitions to the down
299 *	state
300 * @mdo_add_secy: called when a new SecY is added
301 * @mdo_upd_secy: called when the SecY flags are changed or the MAC address of
302 *	the MACsec interface is changed
303 * @mdo_del_secy: called when the hw offload is disabled or the MACsec
304 *	interface is removed
305 * @mdo_add_rxsc: called when a new RX SC is added
306 * @mdo_upd_rxsc: called when a certain RX SC is updated
307 * @mdo_del_rxsc: called when a certain RX SC is removed
308 * @mdo_add_rxsa: called when a new RX SA is added
309 * @mdo_upd_rxsa: called when a certain RX SA is updated
310 * @mdo_del_rxsa: called when a certain RX SA is removed
311 * @mdo_add_txsa: called when a new TX SA is added
312 * @mdo_upd_txsa: called when a certain TX SA is updated
313 * @mdo_del_txsa: called when a certain TX SA is removed
314 * @mdo_get_dev_stats: called when dev stats are read
315 * @mdo_get_tx_sc_stats: called when TX SC stats are read
316 * @mdo_get_tx_sa_stats: called when TX SA stats are read
317 * @mdo_get_rx_sc_stats: called when RX SC stats are read
318 * @mdo_get_rx_sa_stats: called when RX SA stats are read
319 * @mdo_insert_tx_tag: called to insert the TX tag
320 * @needed_headroom: number of bytes reserved at the beginning of the sk_buff
321 *	for the TX tag
322 * @needed_tailroom: number of bytes reserved at the end of the sk_buff for the
323 *	TX tag
324 * @rx_uses_md_dst: whether MACsec device offload supports sk_buff md_dst
325 */
326struct macsec_ops {
327	/* Device wide */
328	int (*mdo_dev_open)(struct macsec_context *ctx);
329	int (*mdo_dev_stop)(struct macsec_context *ctx);
330	/* SecY */
331	int (*mdo_add_secy)(struct macsec_context *ctx);
332	int (*mdo_upd_secy)(struct macsec_context *ctx);
333	int (*mdo_del_secy)(struct macsec_context *ctx);
334	/* Security channels */
335	int (*mdo_add_rxsc)(struct macsec_context *ctx);
336	int (*mdo_upd_rxsc)(struct macsec_context *ctx);
337	int (*mdo_del_rxsc)(struct macsec_context *ctx);
338	/* Security associations */
339	int (*mdo_add_rxsa)(struct macsec_context *ctx);
340	int (*mdo_upd_rxsa)(struct macsec_context *ctx);
341	int (*mdo_del_rxsa)(struct macsec_context *ctx);
342	int (*mdo_add_txsa)(struct macsec_context *ctx);
343	int (*mdo_upd_txsa)(struct macsec_context *ctx);
344	int (*mdo_del_txsa)(struct macsec_context *ctx);
345	/* Statistics */
346	int (*mdo_get_dev_stats)(struct macsec_context *ctx);
347	int (*mdo_get_tx_sc_stats)(struct macsec_context *ctx);
348	int (*mdo_get_tx_sa_stats)(struct macsec_context *ctx);
349	int (*mdo_get_rx_sc_stats)(struct macsec_context *ctx);
350	int (*mdo_get_rx_sa_stats)(struct macsec_context *ctx);
351	/* Offload tag */
352	int (*mdo_insert_tx_tag)(struct phy_device *phydev,
353				 struct sk_buff *skb);
354	unsigned int needed_headroom;
355	unsigned int needed_tailroom;
356	bool rx_uses_md_dst;
357};
358
359void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa);
360static inline bool macsec_send_sci(const struct macsec_secy *secy)
361{
362	const struct macsec_tx_sc *tx_sc = &secy->tx_sc;
363
364	return tx_sc->send_sci ||
365		(secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb);
366}
367struct net_device *macsec_get_real_dev(const struct net_device *dev);
368bool macsec_netdev_is_offloaded(struct net_device *dev);
369
370static inline void *macsec_netdev_priv(const struct net_device *dev)
371{
372#if IS_ENABLED(CONFIG_VLAN_8021Q)
373	if (is_vlan_dev(dev))
374		return netdev_priv(vlan_dev_priv(dev)->real_dev);
375#endif
376	return netdev_priv(dev);
377}
378
379static inline u64 sci_to_cpu(sci_t sci)
380{
381	return be64_to_cpu((__force __be64)sci);
382}
383
384#endif /* _NET_MACSEC_H_ */
385