1 /*
2  * Copyright (c) 2017 Mellanox Technologies. All rights reserved.
3  *
4  * This software is available to you under a choice of one of two
5  * licenses.  You may choose to be licensed under the terms of the GNU
6  * General Public License (GPL) Version 2, available from the file
7  * COPYING in the main directory of this source tree, or the
8  * OpenIB.org BSD license below:
9  *
10  *     Redistribution and use in source and binary forms, with or
11  *     without modification, are permitted provided that the following
12  *     conditions are met:
13  *
14  *      - Redistributions of source code must retain the above
15  *        copyright notice, this list of conditions and the following
16  *        disclaimer.
17  *
18  *      - Redistributions in binary form must reproduce the above
19  *        copyright notice, this list of conditions and the following
20  *        disclaimer in the documentation and/or other materials
21  *        provided with the distribution.
22  *
23  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
24  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
25  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
26  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
27  * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
28  * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
29  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
30  * SOFTWARE.
31  *
32  */
33 
34 #ifndef __MLX5E_IPSEC_H__
35 #define __MLX5E_IPSEC_H__
36 
37 #include <linux/mlx5/device.h>
38 #include <net/xfrm.h>
39 #include <linux/idr.h>
40 #include "lib/aso.h"
41 #include "lib/devcom.h"
42 
43 #define MLX5E_IPSEC_SADB_RX_BITS 10
44 #define MLX5E_IPSEC_ESN_SCOPE_MID 0x80000000L
45 
46 struct aes_gcm_keymat {
47 	u64   seq_iv;
48 
49 	u32   salt;
50 	u32   icv_len;
51 
52 	u32   key_len;
53 	u32   aes_key[256 / 32];
54 };
55 
56 struct upspec {
57 	u16 dport;
58 	u16 dport_mask;
59 	u16 sport;
60 	u16 sport_mask;
61 	u8 proto;
62 };
63 
64 struct mlx5_ipsec_lft {
65 	u64 hard_packet_limit;
66 	u64 soft_packet_limit;
67 	u64 numb_rounds_hard;
68 	u64 numb_rounds_soft;
69 };
70 
71 struct mlx5_replay_esn {
72 	u32 replay_window;
73 	u32 esn;
74 	u32 esn_msb;
75 	u8 overlap : 1;
76 	u8 trigger : 1;
77 };
78 
79 struct mlx5_accel_esp_xfrm_attrs {
80 	u32   spi;
81 	u32   mode;
82 	struct aes_gcm_keymat aes_gcm;
83 
84 	union {
85 		__be32 a4;
86 		__be32 a6[4];
87 	} saddr;
88 
89 	union {
90 		__be32 a4;
91 		__be32 a6[4];
92 	} daddr;
93 
94 	struct upspec upspec;
95 	u8 dir : 2;
96 	u8 type : 2;
97 	u8 drop : 1;
98 	u8 encap : 1;
99 	u8 family;
100 	struct mlx5_replay_esn replay_esn;
101 	u32 authsize;
102 	u32 reqid;
103 	struct mlx5_ipsec_lft lft;
104 	union {
105 		u8 smac[ETH_ALEN];
106 		__be16 sport;
107 	};
108 	union {
109 		u8 dmac[ETH_ALEN];
110 		__be16 dport;
111 	};
112 };
113 
114 enum mlx5_ipsec_cap {
115 	MLX5_IPSEC_CAP_CRYPTO		= 1 << 0,
116 	MLX5_IPSEC_CAP_ESN		= 1 << 1,
117 	MLX5_IPSEC_CAP_PACKET_OFFLOAD	= 1 << 2,
118 	MLX5_IPSEC_CAP_ROCE             = 1 << 3,
119 	MLX5_IPSEC_CAP_PRIO             = 1 << 4,
120 	MLX5_IPSEC_CAP_TUNNEL           = 1 << 5,
121 	MLX5_IPSEC_CAP_ESPINUDP         = 1 << 6,
122 };
123 
124 struct mlx5e_priv;
125 
126 struct mlx5e_ipsec_hw_stats {
127 	u64 ipsec_rx_pkts;
128 	u64 ipsec_rx_bytes;
129 	u64 ipsec_rx_drop_pkts;
130 	u64 ipsec_rx_drop_bytes;
131 	u64 ipsec_tx_pkts;
132 	u64 ipsec_tx_bytes;
133 	u64 ipsec_tx_drop_pkts;
134 	u64 ipsec_tx_drop_bytes;
135 };
136 
137 struct mlx5e_ipsec_sw_stats {
138 	atomic64_t ipsec_rx_drop_sp_alloc;
139 	atomic64_t ipsec_rx_drop_sadb_miss;
140 	atomic64_t ipsec_rx_drop_syndrome;
141 	atomic64_t ipsec_tx_drop_bundle;
142 	atomic64_t ipsec_tx_drop_no_state;
143 	atomic64_t ipsec_tx_drop_not_ip;
144 	atomic64_t ipsec_tx_drop_trailer;
145 };
146 
147 struct mlx5e_ipsec_fc;
148 struct mlx5e_ipsec_tx;
149 
150 struct mlx5e_ipsec_work {
151 	struct work_struct work;
152 	struct mlx5e_ipsec_sa_entry *sa_entry;
153 	void *data;
154 };
155 
156 struct mlx5e_ipsec_netevent_data {
157 	u8 addr[ETH_ALEN];
158 };
159 
160 struct mlx5e_ipsec_dwork {
161 	struct delayed_work dwork;
162 	struct mlx5e_ipsec_sa_entry *sa_entry;
163 };
164 
165 struct mlx5e_ipsec_aso {
166 	u8 __aligned(64) ctx[MLX5_ST_SZ_BYTES(ipsec_aso)];
167 	dma_addr_t dma_addr;
168 	struct mlx5_aso *aso;
169 	/* Protect ASO WQ access, as it is global to whole IPsec */
170 	spinlock_t lock;
171 };
172 
173 struct mlx5e_ipsec_rx_create_attr {
174 	struct mlx5_flow_namespace *ns;
175 	struct mlx5_ttc_table *ttc;
176 	u32 family;
177 	int prio;
178 	int pol_level;
179 	int sa_level;
180 	int status_level;
181 	enum mlx5_flow_namespace_type chains_ns;
182 };
183 
184 struct mlx5e_ipsec_ft {
185 	struct mutex mutex; /* Protect changes to this struct */
186 	struct mlx5_flow_table *pol;
187 	struct mlx5_flow_table *sa;
188 	struct mlx5_flow_table *status;
189 	u32 refcnt;
190 };
191 
192 struct mlx5e_ipsec_drop {
193 	struct mlx5_flow_handle *rule;
194 	struct mlx5_fc *fc;
195 };
196 
197 struct mlx5e_ipsec_rule {
198 	struct mlx5_flow_handle *rule;
199 	struct mlx5_modify_hdr *modify_hdr;
200 	struct mlx5_pkt_reformat *pkt_reformat;
201 	struct mlx5_fc *fc;
202 	struct mlx5e_ipsec_drop replay;
203 	struct mlx5e_ipsec_drop auth;
204 	struct mlx5e_ipsec_drop trailer;
205 };
206 
207 struct mlx5e_ipsec_miss {
208 	struct mlx5_flow_group *group;
209 	struct mlx5_flow_handle *rule;
210 };
211 
212 struct mlx5e_ipsec_tx_create_attr {
213 	int prio;
214 	int pol_level;
215 	int sa_level;
216 	int cnt_level;
217 	enum mlx5_flow_namespace_type chains_ns;
218 };
219 
220 struct mlx5e_ipsec_mpv_work {
221 	int event;
222 	struct work_struct work;
223 	struct mlx5e_priv *slave_priv;
224 	struct mlx5e_priv *master_priv;
225 };
226 
227 struct mlx5e_ipsec {
228 	struct mlx5_core_dev *mdev;
229 	struct xarray sadb;
230 	struct mlx5e_ipsec_sw_stats sw_stats;
231 	struct mlx5e_ipsec_hw_stats hw_stats;
232 	struct workqueue_struct *wq;
233 	struct completion comp;
234 	struct mlx5e_flow_steering *fs;
235 	struct mlx5e_ipsec_rx *rx_ipv4;
236 	struct mlx5e_ipsec_rx *rx_ipv6;
237 	struct mlx5e_ipsec_rx *rx_esw;
238 	struct mlx5e_ipsec_tx *tx;
239 	struct mlx5e_ipsec_tx *tx_esw;
240 	struct mlx5e_ipsec_aso *aso;
241 	struct notifier_block nb;
242 	struct notifier_block netevent_nb;
243 	struct mlx5_ipsec_fs *roce;
244 	u8 is_uplink_rep: 1;
245 	struct mlx5e_ipsec_mpv_work mpv_work;
246 	struct xarray ipsec_obj_id_map;
247 };
248 
249 struct mlx5e_ipsec_esn_state {
250 	u32 esn;
251 	u32 esn_msb;
252 	u8 overlap: 1;
253 };
254 
255 struct mlx5e_ipsec_limits {
256 	u64 round;
257 	u8 soft_limit_hit : 1;
258 	u8 fix_limit : 1;
259 };
260 
261 struct mlx5e_ipsec_sa_entry {
262 	struct mlx5e_ipsec_esn_state esn_state;
263 	struct xfrm_state *x;
264 	struct mlx5e_ipsec *ipsec;
265 	struct mlx5_accel_esp_xfrm_attrs attrs;
266 	void (*set_iv_op)(struct sk_buff *skb, struct xfrm_state *x,
267 			  struct xfrm_offload *xo);
268 	u32 ipsec_obj_id;
269 	u32 enc_key_id;
270 	struct mlx5e_ipsec_rule ipsec_rule;
271 	struct mlx5e_ipsec_work *work;
272 	struct mlx5e_ipsec_dwork *dwork;
273 	struct mlx5e_ipsec_limits limits;
274 	u32 rx_mapped_id;
275 };
276 
277 struct mlx5_accel_pol_xfrm_attrs {
278 	union {
279 		__be32 a4;
280 		__be32 a6[4];
281 	} saddr;
282 
283 	union {
284 		__be32 a4;
285 		__be32 a6[4];
286 	} daddr;
287 
288 	struct upspec upspec;
289 	u8 family;
290 	u8 action;
291 	u8 type : 2;
292 	u8 dir : 2;
293 	u32 reqid;
294 	u32 prio;
295 };
296 
297 struct mlx5e_ipsec_pol_entry {
298 	struct xfrm_policy *x;
299 	struct mlx5e_ipsec *ipsec;
300 	struct mlx5e_ipsec_rule ipsec_rule;
301 	struct mlx5_accel_pol_xfrm_attrs attrs;
302 };
303 
304 #ifdef CONFIG_MLX5_EN_IPSEC
305 
306 void mlx5e_ipsec_init(struct mlx5e_priv *priv);
307 void mlx5e_ipsec_cleanup(struct mlx5e_priv *priv);
308 void mlx5e_ipsec_build_netdev(struct mlx5e_priv *priv);
309 
310 void mlx5e_accel_ipsec_fs_cleanup(struct mlx5e_ipsec *ipsec);
311 int mlx5e_accel_ipsec_fs_init(struct mlx5e_ipsec *ipsec, struct mlx5_devcom_comp_dev **devcom);
312 int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry);
313 void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_ipsec_sa_entry *sa_entry);
314 int mlx5e_accel_ipsec_fs_add_pol(struct mlx5e_ipsec_pol_entry *pol_entry);
315 void mlx5e_accel_ipsec_fs_del_pol(struct mlx5e_ipsec_pol_entry *pol_entry);
316 void mlx5e_accel_ipsec_fs_modify(struct mlx5e_ipsec_sa_entry *sa_entry);
317 bool mlx5e_ipsec_fs_tunnel_enabled(struct mlx5e_ipsec_sa_entry *sa_entry);
318 
319 int mlx5_ipsec_create_sa_ctx(struct mlx5e_ipsec_sa_entry *sa_entry);
320 void mlx5_ipsec_free_sa_ctx(struct mlx5e_ipsec_sa_entry *sa_entry);
321 
322 u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev);
323 
324 void mlx5_accel_esp_modify_xfrm(struct mlx5e_ipsec_sa_entry *sa_entry,
325 				const struct mlx5_accel_esp_xfrm_attrs *attrs);
326 
327 int mlx5e_ipsec_aso_init(struct mlx5e_ipsec *ipsec);
328 void mlx5e_ipsec_aso_cleanup(struct mlx5e_ipsec *ipsec);
329 
330 int mlx5e_ipsec_aso_query(struct mlx5e_ipsec_sa_entry *sa_entry,
331 			  struct mlx5_wqe_aso_ctrl_seg *data);
332 void mlx5e_accel_ipsec_fs_read_stats(struct mlx5e_priv *priv,
333 				     void *ipsec_stats);
334 
335 void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry,
336 					struct mlx5_accel_esp_xfrm_attrs *attrs);
337 void mlx5e_ipsec_handle_mpv_event(int event, struct mlx5e_priv *slave_priv,
338 				  struct mlx5e_priv *master_priv);
339 void mlx5e_ipsec_send_event(struct mlx5e_priv *priv, int event);
340 
341 static inline struct mlx5_core_dev *
mlx5e_ipsec_sa2dev(struct mlx5e_ipsec_sa_entry * sa_entry)342 mlx5e_ipsec_sa2dev(struct mlx5e_ipsec_sa_entry *sa_entry)
343 {
344 	return sa_entry->ipsec->mdev;
345 }
346 
347 static inline struct mlx5_core_dev *
mlx5e_ipsec_pol2dev(struct mlx5e_ipsec_pol_entry * pol_entry)348 mlx5e_ipsec_pol2dev(struct mlx5e_ipsec_pol_entry *pol_entry)
349 {
350 	return pol_entry->ipsec->mdev;
351 }
352 
addr6_all_zero(__be32 * addr6)353 static inline bool addr6_all_zero(__be32 *addr6)
354 {
355 	static const __be32 zaddr6[4] = {};
356 
357 	return !memcmp(addr6, zaddr6, sizeof(zaddr6));
358 }
359 #else
mlx5e_ipsec_init(struct mlx5e_priv * priv)360 static inline void mlx5e_ipsec_init(struct mlx5e_priv *priv)
361 {
362 }
363 
mlx5e_ipsec_cleanup(struct mlx5e_priv * priv)364 static inline void mlx5e_ipsec_cleanup(struct mlx5e_priv *priv)
365 {
366 }
367 
mlx5e_ipsec_build_netdev(struct mlx5e_priv * priv)368 static inline void mlx5e_ipsec_build_netdev(struct mlx5e_priv *priv)
369 {
370 }
371 
mlx5_ipsec_device_caps(struct mlx5_core_dev * mdev)372 static inline u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev)
373 {
374 	return 0;
375 }
376 
mlx5e_ipsec_handle_mpv_event(int event,struct mlx5e_priv * slave_priv,struct mlx5e_priv * master_priv)377 static inline void mlx5e_ipsec_handle_mpv_event(int event, struct mlx5e_priv *slave_priv,
378 						struct mlx5e_priv *master_priv)
379 {
380 }
381 
mlx5e_ipsec_send_event(struct mlx5e_priv * priv,int event)382 static inline void mlx5e_ipsec_send_event(struct mlx5e_priv *priv, int event)
383 {
384 }
385 #endif
386 
387 #endif	/* __MLX5E_IPSEC_H__ */
388