Skip to content

Commit

Permalink
octeontx2-pf: mcs: Offload extended packet number(XPN) feature
Browse files Browse the repository at this point in the history 
The macsec hardware block supports XPN cipher suites also.
Hence added changes to offload XPN feature. Changes include
configuring SecY policy to XPN cipher suite, Salt and SSCI values.
64 bit packet number is passed instead of 32 bit packet number.

Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Subbaraya Sundeep authored and David S. Miller committed May 12, 2023
1 parent 7f88efc commit 48c0db0
Show file tree
Hide file tree
Showing 2 changed files with 75 additions and 19 deletions.
89 changes: 70 additions & 19 deletions drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@

#include <linux/rtnetlink.h>
#include <linux/bitfield.h>
#include <net/macsec.h>
#include "otx2_common.h"

#define MCS_TCAM0_MAC_DA_MASK GENMASK_ULL(47, 0)
Expand Down Expand Up @@ -212,6 +211,7 @@ static int cn10k_mcs_write_rx_secy(struct otx2_nic *pfvf,
struct mcs_secy_plcy_write_req *req;
struct mbox *mbox = &pfvf->mbox;
u64 policy;
u8 cipher;
int ret;

mutex_lock(&mbox->lock);
Expand All @@ -227,7 +227,21 @@ static int cn10k_mcs_write_rx_secy(struct otx2_nic *pfvf,
policy |= MCS_RX_SECY_PLCY_RP;

policy |= MCS_RX_SECY_PLCY_AUTH_ENA;
policy |= FIELD_PREP(MCS_RX_SECY_PLCY_CIP, MCS_GCM_AES_128);

switch (secy->key_len) {
case 16:
cipher = secy->xpn ? MCS_GCM_AES_XPN_128 : MCS_GCM_AES_128;
break;
case 32:
cipher = secy->xpn ? MCS_GCM_AES_XPN_256 : MCS_GCM_AES_256;
break;
default:
cipher = MCS_GCM_AES_128;
dev_warn(pfvf->dev, "Unsupported key length\n");
break;
};

policy |= FIELD_PREP(MCS_RX_SECY_PLCY_CIP, cipher);
policy |= FIELD_PREP(MCS_RX_SECY_PLCY_VAL, secy->validate_frames);

policy |= MCS_RX_SECY_PLCY_ENA;
Expand Down Expand Up @@ -323,9 +337,12 @@ static int cn10k_mcs_write_rx_sa_plcy(struct otx2_nic *pfvf,
{
unsigned char *src = rxsc->sa_key[assoc_num];
struct mcs_sa_plcy_write_req *plcy_req;
u8 *salt_p = rxsc->salt[assoc_num];
struct mcs_rx_sc_sa_map *map_req;
struct mbox *mbox = &pfvf->mbox;
u64 ssci_salt_95_64 = 0;
u8 reg, key_len;
u64 salt_63_0;
int ret;

mutex_lock(&mbox->lock);
Expand All @@ -349,6 +366,15 @@ static int cn10k_mcs_write_rx_sa_plcy(struct otx2_nic *pfvf,
reg++;
}

if (secy->xpn) {
memcpy((u8 *)&salt_63_0, salt_p, 8);
memcpy((u8 *)&ssci_salt_95_64, salt_p + 8, 4);
ssci_salt_95_64 |= (__force u64)rxsc->ssci[assoc_num] << 32;

plcy_req->plcy[0][6] = salt_63_0;
plcy_req->plcy[0][7] = ssci_salt_95_64;
}

plcy_req->sa_index[0] = rxsc->hw_sa_id[assoc_num];
plcy_req->sa_cnt = 1;
plcy_req->dir = MCS_RX;
Expand Down Expand Up @@ -404,6 +430,7 @@ static int cn10k_mcs_write_tx_secy(struct otx2_nic *pfvf,
u8 tag_offset = 12;
u8 sectag_tci = 0;
u64 policy;
u8 cipher;
int ret;

sw_tx_sc = &secy->tx_sc;
Expand Down Expand Up @@ -434,7 +461,21 @@ static int cn10k_mcs_write_tx_secy(struct otx2_nic *pfvf,
policy |= FIELD_PREP(MCS_TX_SECY_PLCY_ST_OFFSET, tag_offset);
policy |= MCS_TX_SECY_PLCY_INS_MODE;
policy |= MCS_TX_SECY_PLCY_AUTH_ENA;
policy |= FIELD_PREP(MCS_TX_SECY_PLCY_CIP, MCS_GCM_AES_128);

switch (secy->key_len) {
case 16:
cipher = secy->xpn ? MCS_GCM_AES_XPN_128 : MCS_GCM_AES_128;
break;
case 32:
cipher = secy->xpn ? MCS_GCM_AES_XPN_256 : MCS_GCM_AES_256;
break;
default:
cipher = MCS_GCM_AES_128;
dev_warn(pfvf->dev, "Unsupported key length\n");
break;
};

policy |= FIELD_PREP(MCS_TX_SECY_PLCY_CIP, cipher);

if (secy->protect_frames)
policy |= MCS_TX_SECY_PLCY_PROTECT;
Expand Down Expand Up @@ -544,8 +585,11 @@ static int cn10k_mcs_write_tx_sa_plcy(struct otx2_nic *pfvf,
{
unsigned char *src = txsc->sa_key[assoc_num];
struct mcs_sa_plcy_write_req *plcy_req;
u8 *salt_p = txsc->salt[assoc_num];
struct mbox *mbox = &pfvf->mbox;
u64 ssci_salt_95_64 = 0;
u8 reg, key_len;
u64 salt_63_0;
int ret;

mutex_lock(&mbox->lock);
Expand All @@ -561,6 +605,15 @@ static int cn10k_mcs_write_tx_sa_plcy(struct otx2_nic *pfvf,
reg++;
}

if (secy->xpn) {
memcpy((u8 *)&salt_63_0, salt_p, 8);
memcpy((u8 *)&ssci_salt_95_64, salt_p + 8, 4);
ssci_salt_95_64 |= (__force u64)txsc->ssci[assoc_num] << 32;

plcy_req->plcy[0][6] = salt_63_0;
plcy_req->plcy[0][7] = ssci_salt_95_64;
}

plcy_req->plcy[0][8] = assoc_num;
plcy_req->sa_index[0] = txsc->hw_sa_id[assoc_num];
plcy_req->sa_cnt = 1;
Expand Down Expand Up @@ -922,8 +975,7 @@ static int cn10k_mcs_secy_tx_cfg(struct otx2_nic *pfvf, struct macsec_secy *secy
{
if (sw_tx_sa) {
cn10k_mcs_write_tx_sa_plcy(pfvf, secy, txsc, sa_num);
cn10k_write_tx_sa_pn(pfvf, txsc, sa_num,
sw_tx_sa->next_pn_halves.lower);
cn10k_write_tx_sa_pn(pfvf, txsc, sa_num, sw_tx_sa->next_pn);
cn10k_mcs_link_tx_sa2sc(pfvf, secy, txsc, sa_num,
sw_tx_sa->active);
}
Expand Down Expand Up @@ -959,7 +1011,7 @@ static int cn10k_mcs_secy_rx_cfg(struct otx2_nic *pfvf,
cn10k_mcs_write_rx_sa_plcy(pfvf, secy, mcs_rx_sc,
sa_num, sw_rx_sa->active);
cn10k_mcs_write_rx_sa_pn(pfvf, mcs_rx_sc, sa_num,
sw_rx_sa->next_pn_halves.lower);
sw_rx_sa->next_pn);
}

cn10k_mcs_write_rx_flowid(pfvf, mcs_rx_sc, hw_secy_id);
Expand Down Expand Up @@ -1103,13 +1155,6 @@ static int cn10k_mdo_add_secy(struct macsec_context *ctx)
if (secy->icv_len != MACSEC_DEFAULT_ICV_LEN)
return -EOPNOTSUPP;

/* Stick to 16 bytes key len until XPN support is added */
if (secy->key_len != 16)
return -EOPNOTSUPP;

if (secy->xpn)
return -EOPNOTSUPP;

txsc = cn10k_mcs_create_txsc(pfvf);
if (IS_ERR(txsc))
return -ENOSPC;
Expand Down Expand Up @@ -1202,6 +1247,9 @@ static int cn10k_mdo_add_txsa(struct macsec_context *ctx)
return -ENOSPC;

memcpy(&txsc->sa_key[sa_num], ctx->sa.key, secy->key_len);
memcpy(&txsc->salt[sa_num], sw_tx_sa->key.salt.bytes, MACSEC_SALT_LEN);
txsc->ssci[sa_num] = sw_tx_sa->ssci;

txsc->sa_bmap |= 1 << sa_num;

if (netif_running(secy->netdev)) {
Expand All @@ -1210,7 +1258,7 @@ static int cn10k_mdo_add_txsa(struct macsec_context *ctx)
return err;

err = cn10k_write_tx_sa_pn(pfvf, txsc, sa_num,
sw_tx_sa->next_pn_halves.lower);
sw_tx_sa->next_pn);
if (err)
return err;

Expand Down Expand Up @@ -1243,7 +1291,7 @@ static int cn10k_mdo_upd_txsa(struct macsec_context *ctx)
if (netif_running(secy->netdev)) {
/* Keys cannot be changed after creation */
err = cn10k_write_tx_sa_pn(pfvf, txsc, sa_num,
sw_tx_sa->next_pn_halves.lower);
sw_tx_sa->next_pn);
if (err)
return err;

Expand Down Expand Up @@ -1353,7 +1401,6 @@ static int cn10k_mdo_add_rxsa(struct macsec_context *ctx)
struct macsec_rx_sc *sw_rx_sc = ctx->sa.rx_sa->sc;
struct cn10k_mcs_cfg *cfg = pfvf->macsec_cfg;
struct macsec_rx_sa *rx_sa = ctx->sa.rx_sa;
u64 next_pn = rx_sa->next_pn_halves.lower;
struct macsec_secy *secy = ctx->secy;
bool sa_in_use = rx_sa->active;
u8 sa_num = ctx->sa.assoc_num;
Expand All @@ -1371,6 +1418,9 @@ static int cn10k_mdo_add_rxsa(struct macsec_context *ctx)
return -ENOSPC;

memcpy(&rxsc->sa_key[sa_num], ctx->sa.key, ctx->secy->key_len);
memcpy(&rxsc->salt[sa_num], rx_sa->key.salt.bytes, MACSEC_SALT_LEN);
rxsc->ssci[sa_num] = rx_sa->ssci;

rxsc->sa_bmap |= 1 << sa_num;

if (netif_running(secy->netdev)) {
Expand All @@ -1379,7 +1429,8 @@ static int cn10k_mdo_add_rxsa(struct macsec_context *ctx)
if (err)
return err;

err = cn10k_mcs_write_rx_sa_pn(pfvf, rxsc, sa_num, next_pn);
err = cn10k_mcs_write_rx_sa_pn(pfvf, rxsc, sa_num,
rx_sa->next_pn);
if (err)
return err;
}
Expand All @@ -1393,7 +1444,6 @@ static int cn10k_mdo_upd_rxsa(struct macsec_context *ctx)
struct macsec_rx_sc *sw_rx_sc = ctx->sa.rx_sa->sc;
struct cn10k_mcs_cfg *cfg = pfvf->macsec_cfg;
struct macsec_rx_sa *rx_sa = ctx->sa.rx_sa;
u64 next_pn = rx_sa->next_pn_halves.lower;
struct macsec_secy *secy = ctx->secy;
bool sa_in_use = rx_sa->active;
u8 sa_num = ctx->sa.assoc_num;
Expand All @@ -1412,7 +1462,8 @@ static int cn10k_mdo_upd_rxsa(struct macsec_context *ctx)
if (err)
return err;

err = cn10k_mcs_write_rx_sa_pn(pfvf, rxsc, sa_num, next_pn);
err = cn10k_mcs_write_rx_sa_pn(pfvf, rxsc, sa_num,
rx_sa->next_pn);
if (err)
return err;
}
Expand Down
5 changes: 5 additions & 0 deletions drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
#include <linux/ptp_clock_kernel.h>
#include <linux/timecounter.h>
#include <linux/soc/marvell/octeontx2/asm.h>
#include <net/macsec.h>
#include <net/pkt_cls.h>
#include <net/devlink.h>
#include <linux/time64.h>
Expand Down Expand Up @@ -398,6 +399,8 @@ struct cn10k_mcs_txsc {
u8 sa_bmap;
u8 sa_key[CN10K_MCS_SA_PER_SC][MACSEC_MAX_KEY_LEN];
u8 encoding_sa;
u8 salt[CN10K_MCS_SA_PER_SC][MACSEC_SALT_LEN];
ssci_t ssci[CN10K_MCS_SA_PER_SC];
};

struct cn10k_mcs_rxsc {
Expand All @@ -410,6 +413,8 @@ struct cn10k_mcs_rxsc {
u16 hw_sa_id[CN10K_MCS_SA_PER_SC];
u8 sa_bmap;
u8 sa_key[CN10K_MCS_SA_PER_SC][MACSEC_MAX_KEY_LEN];
u8 salt[CN10K_MCS_SA_PER_SC][MACSEC_SALT_LEN];
ssci_t ssci[CN10K_MCS_SA_PER_SC];
};

struct cn10k_mcs_cfg {
Expand Down

0 comments on commit 48c0db0

Please sign in to comment.