1/* SPDX-License-Identifier: GPL-2.0+ */ 2/* 3 * MACsec netdev header, used for h/w accelerated implementations. 4 * 5 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net> 6 */ 7#ifndef _NET_MACSEC_H_ 8#define _NET_MACSEC_H_ 9 10#include <linux/u64_stats_sync.h> 11#include <linux/if_vlan.h> 12#include <uapi/linux/if_link.h> 13#include <uapi/linux/if_macsec.h> 14 15#define MACSEC_DEFAULT_PN_LEN 4 16#define MACSEC_XPN_PN_LEN 8 17 18#define MACSEC_NUM_AN 4 /* 2 bits for the association number */ 19 20#define MACSEC_SCI_LEN 8 21#define MACSEC_PORT_ES (htons(0x0001)) 22 23#define MACSEC_TCI_VERSION 0x80 24#define MACSEC_TCI_ES 0x40 /* end station */ 25#define MACSEC_TCI_SC 0x20 /* SCI present */ 26#define MACSEC_TCI_SCB 0x10 /* epon */ 27#define MACSEC_TCI_E 0x08 /* encryption */ 28#define MACSEC_TCI_C 0x04 /* changed text */ 29#define MACSEC_AN_MASK 0x03 /* association number */ 30#define MACSEC_TCI_CONFID (MACSEC_TCI_E | MACSEC_TCI_C) 31 32#define MACSEC_DEFAULT_ICV_LEN 16 33 34typedef u64 __bitwise sci_t; 35typedef u32 __bitwise ssci_t; 36 37struct metadata_dst; 38 39typedef union salt { 40 struct { 41 u32 ssci; 42 u64 pn; 43 } __packed; 44 u8 bytes[MACSEC_SALT_LEN]; 45} __packed salt_t; 46 47typedef union pn { 48 struct { 49#if defined(__LITTLE_ENDIAN_BITFIELD) 50 u32 lower; 51 u32 upper; 52#elif defined(__BIG_ENDIAN_BITFIELD) 53 u32 upper; 54 u32 lower; 55#else 56#error "Please fix <asm/byteorder.h>" 57#endif 58 }; 59 u64 full64; 60} pn_t; 61 62/** 63 * struct macsec_key - SA key 64 * @id: user-provided key identifier 65 * @tfm: crypto struct, key storage 66 * @salt: salt used to generate IV in XPN cipher suites 67 */ 68struct macsec_key { 69 u8 id[MACSEC_KEYID_LEN]; 70 struct crypto_aead *tfm; 71 salt_t salt; 72}; 73 74struct macsec_rx_sc_stats { 75 __u64 InOctetsValidated; 76 __u64 InOctetsDecrypted; 77 __u64 InPktsUnchecked; 78 __u64 InPktsDelayed; 79 __u64 InPktsOK; 80 __u64 InPktsInvalid; 81 __u64 InPktsLate; 82 __u64 InPktsNotValid; 83 __u64 InPktsNotUsingSA; 84 __u64 InPktsUnusedSA; 85}; 86 87struct macsec_rx_sa_stats { 88 __u32 InPktsOK; 89 __u32 InPktsInvalid; 90 __u32 InPktsNotValid; 91 __u32 InPktsNotUsingSA; 92 __u32 InPktsUnusedSA; 93}; 94 95struct macsec_tx_sa_stats { 96 __u32 OutPktsProtected; 97 __u32 OutPktsEncrypted; 98}; 99 100struct macsec_tx_sc_stats { 101 __u64 OutPktsProtected; 102 __u64 OutPktsEncrypted; 103 __u64 OutOctetsProtected; 104 __u64 OutOctetsEncrypted; 105}; 106 107struct macsec_dev_stats { 108 __u64 OutPktsUntagged; 109 __u64 InPktsUntagged; 110 __u64 OutPktsTooLong; 111 __u64 InPktsNoTag; 112 __u64 InPktsBadTag; 113 __u64 InPktsUnknownSCI; 114 __u64 InPktsNoSCI; 115 __u64 InPktsOverrun; 116}; 117 118/** 119 * struct macsec_rx_sa - receive secure association 120 * @active: 121 * @next_pn: packet number expected for the next packet 122 * @lock: protects next_pn manipulations 123 * @key: key structure 124 * @ssci: short secure channel identifier 125 * @stats: per-SA stats 126 */ 127struct macsec_rx_sa { 128 struct macsec_key key; 129 ssci_t ssci; 130 spinlock_t lock; 131 union { 132 pn_t next_pn_halves; 133 u64 next_pn; 134 }; 135 refcount_t refcnt; 136 bool active; 137 struct macsec_rx_sa_stats __percpu *stats; 138 struct macsec_rx_sc *sc; 139 struct rcu_head rcu; 140}; 141 142struct pcpu_rx_sc_stats { 143 struct macsec_rx_sc_stats stats; 144 struct u64_stats_sync syncp; 145}; 146 147struct pcpu_tx_sc_stats { 148 struct macsec_tx_sc_stats stats; 149 struct u64_stats_sync syncp; 150}; 151 152/** 153 * struct macsec_rx_sc - receive secure channel 154 * @sci: secure channel identifier for this SC 155 * @active: channel is active 156 * @sa: array of secure associations 157 * @stats: per-SC stats 158 */ 159struct macsec_rx_sc { 160 struct macsec_rx_sc __rcu *next; 161 sci_t sci; 162 bool active; 163 struct macsec_rx_sa __rcu *sa[MACSEC_NUM_AN]; 164 struct pcpu_rx_sc_stats __percpu *stats; 165 refcount_t refcnt; 166 struct rcu_head rcu_head; 167}; 168 169/** 170 * struct macsec_tx_sa - transmit secure association 171 * @active: 172 * @next_pn: packet number to use for the next packet 173 * @lock: protects next_pn manipulations 174 * @key: key structure 175 * @ssci: short secure channel identifier 176 * @stats: per-SA stats 177 */ 178struct macsec_tx_sa { 179 struct macsec_key key; 180 ssci_t ssci; 181 spinlock_t lock; 182 union { 183 pn_t next_pn_halves; 184 u64 next_pn; 185 }; 186 refcount_t refcnt; 187 bool active; 188 struct macsec_tx_sa_stats __percpu *stats; 189 struct rcu_head rcu; 190}; 191 192/** 193 * struct macsec_tx_sc - transmit secure channel 194 * @active: 195 * @encoding_sa: association number of the SA currently in use 196 * @encrypt: encrypt packets on transmit, or authenticate only 197 * @send_sci: always include the SCI in the SecTAG 198 * @end_station: 199 * @scb: single copy broadcast flag 200 * @sa: array of secure associations 201 * @stats: stats for this TXSC 202 * @md_dst: MACsec offload metadata dst 203 */ 204struct macsec_tx_sc { 205 bool active; 206 u8 encoding_sa; 207 bool encrypt; 208 bool send_sci; 209 bool end_station; 210 bool scb; 211 struct macsec_tx_sa __rcu *sa[MACSEC_NUM_AN]; 212 struct pcpu_tx_sc_stats __percpu *stats; 213 struct metadata_dst *md_dst; 214}; 215 216/** 217 * struct macsec_secy - MACsec Security Entity 218 * @netdev: netdevice for this SecY 219 * @n_rx_sc: number of receive secure channels configured on this SecY 220 * @sci: secure channel identifier used for tx 221 * @key_len: length of keys used by the cipher suite 222 * @icv_len: length of ICV used by the cipher suite 223 * @validate_frames: validation mode 224 * @xpn: enable XPN for this SecY 225 * @operational: MAC_Operational flag 226 * @protect_frames: enable protection for this SecY 227 * @replay_protect: enable packet number checks on receive 228 * @replay_window: size of the replay window 229 * @tx_sc: transmit secure channel 230 * @rx_sc: linked list of receive secure channels 231 */ 232struct macsec_secy { 233 struct net_device *netdev; 234 unsigned int n_rx_sc; 235 sci_t sci; 236 u16 key_len; 237 u16 icv_len; 238 enum macsec_validation_type validate_frames; 239 bool xpn; 240 bool operational; 241 bool protect_frames; 242 bool replay_protect; 243 u32 replay_window; 244 struct macsec_tx_sc tx_sc; 245 struct macsec_rx_sc __rcu *rx_sc; 246}; 247 248/** 249 * struct macsec_context - MACsec context for hardware offloading 250 */ 251struct macsec_context { 252 union { 253 struct net_device *netdev; 254 struct phy_device *phydev; 255 }; 256 enum macsec_offload offload; 257 258 struct macsec_secy *secy; 259 struct macsec_rx_sc *rx_sc; 260 struct { 261 bool update_pn; 262 unsigned char assoc_num; 263 u8 key[MACSEC_MAX_KEY_LEN]; 264 union { 265 struct macsec_rx_sa *rx_sa; 266 struct macsec_tx_sa *tx_sa; 267 }; 268 } sa; 269 union { 270 struct macsec_tx_sc_stats *tx_sc_stats; 271 struct macsec_tx_sa_stats *tx_sa_stats; 272 struct macsec_rx_sc_stats *rx_sc_stats; 273 struct macsec_rx_sa_stats *rx_sa_stats; 274 struct macsec_dev_stats *dev_stats; 275 } stats; 276}; 277 278/** 279 * struct macsec_ops - MACsec offloading operations 280 */ 281struct macsec_ops { 282 /* Device wide */ 283 int (*mdo_dev_open)(struct macsec_context *ctx); 284 int (*mdo_dev_stop)(struct macsec_context *ctx); 285 /* SecY */ 286 int (*mdo_add_secy)(struct macsec_context *ctx); 287 int (*mdo_upd_secy)(struct macsec_context *ctx); 288 int (*mdo_del_secy)(struct macsec_context *ctx); 289 /* Security channels */ 290 int (*mdo_add_rxsc)(struct macsec_context *ctx); 291 int (*mdo_upd_rxsc)(struct macsec_context *ctx); 292 int (*mdo_del_rxsc)(struct macsec_context *ctx); 293 /* Security associations */ 294 int (*mdo_add_rxsa)(struct macsec_context *ctx); 295 int (*mdo_upd_rxsa)(struct macsec_context *ctx); 296 int (*mdo_del_rxsa)(struct macsec_context *ctx); 297 int (*mdo_add_txsa)(struct macsec_context *ctx); 298 int (*mdo_upd_txsa)(struct macsec_context *ctx); 299 int (*mdo_del_txsa)(struct macsec_context *ctx); 300 /* Statistics */ 301 int (*mdo_get_dev_stats)(struct macsec_context *ctx); 302 int (*mdo_get_tx_sc_stats)(struct macsec_context *ctx); 303 int (*mdo_get_tx_sa_stats)(struct macsec_context *ctx); 304 int (*mdo_get_rx_sc_stats)(struct macsec_context *ctx); 305 int (*mdo_get_rx_sa_stats)(struct macsec_context *ctx); 306}; 307 308void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa); 309static inline bool macsec_send_sci(const struct macsec_secy *secy) 310{ 311 const struct macsec_tx_sc *tx_sc = &secy->tx_sc; 312 313 return tx_sc->send_sci || 314 (secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb); 315} 316struct net_device *macsec_get_real_dev(const struct net_device *dev); 317bool macsec_netdev_is_offloaded(struct net_device *dev); 318 319static inline void *macsec_netdev_priv(const struct net_device *dev) 320{ 321#if IS_ENABLED(CONFIG_VLAN_8021Q) 322 if (is_vlan_dev(dev)) 323 return netdev_priv(vlan_dev_priv(dev)->real_dev); 324#endif 325 return netdev_priv(dev); 326} 327 328#endif /* _NET_MACSEC_H_ */ 329