developer | 7e32f7e | 2022-05-18 21:10:08 +0800 | [diff] [blame] | 1 | From 28c5107aa904ef9db6b023039d20b6b4c4181675 Mon Sep 17 00:00:00 2001 |
| 2 | From: Antoine Tenart <antoine.tenart@bootlin.com> |
| 3 | Date: Mon, 13 Jan 2020 23:31:46 +0100 |
| 4 | Subject: net: phy: mscc: macsec support |
| 5 | |
| 6 | This patch adds MACsec offloading support to some Microsemi PHYs, to |
| 7 | configure flows and transformations so that matched packets can be |
| 8 | processed by the MACsec engine, either at egress, or at ingress. |
| 9 | |
| 10 | Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com> |
| 11 | Signed-off-by: David S. Miller <davem@davemloft.net> |
| 12 | --- |
| 13 | drivers/net/phy/Kconfig | 3 + |
| 14 | drivers/net/phy/mscc.c | 691 ++++++++++++++++++++++++++++++++++++++++++ |
| 15 | drivers/net/phy/mscc_macsec.h | 4 + |
| 16 | 3 files changed, 698 insertions(+) |
| 17 | |
| 18 | diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig |
| 19 | index 2e016271e1268..ac82ff959b7c0 100644 |
| 20 | --- a/drivers/net/phy/Kconfig |
| 21 | +++ b/drivers/net/phy/Kconfig |
| 22 | @@ -437,6 +437,9 @@ config MICROCHIP_T1_PHY |
| 23 | |
| 24 | config MICROSEMI_PHY |
| 25 | tristate "Microsemi PHYs" |
| 26 | + depends on MACSEC || MACSEC=n |
| 27 | + select CRYPTO_AES |
| 28 | + select CRYPTO_ECB |
| 29 | ---help--- |
| 30 | Currently supports VSC8514, VSC8530, VSC8531, VSC8540 and VSC8541 PHYs |
| 31 | |
| 32 | diff --git a/drivers/net/phy/mscc.c b/drivers/net/phy/mscc.c |
| 33 | index 8579a59a1336a..ccf17818570f9 100644 |
| 34 | --- a/drivers/net/phy/mscc.c |
| 35 | +++ b/drivers/net/phy/mscc.c |
| 36 | @@ -18,6 +18,13 @@ |
| 37 | #include <linux/netdevice.h> |
| 38 | #include <dt-bindings/net/mscc-phy-vsc8531.h> |
| 39 | |
| 40 | +#include <linux/scatterlist.h> |
| 41 | +#include <crypto/skcipher.h> |
| 42 | + |
| 43 | +#if IS_ENABLED(CONFIG_MACSEC) |
| 44 | +#include <net/macsec.h> |
| 45 | +#endif |
| 46 | + |
| 47 | #include "mscc_macsec.h" |
| 48 | #include "mscc_mac.h" |
| 49 | #include "mscc_fc_buffer.h" |
| 50 | @@ -436,6 +443,44 @@ static const struct vsc85xx_hw_stat vsc8584_hw_stats[] = { |
| 51 | }, |
| 52 | }; |
| 53 | |
| 54 | +#if IS_ENABLED(CONFIG_MACSEC) |
| 55 | +struct macsec_flow { |
| 56 | + struct list_head list; |
| 57 | + enum mscc_macsec_destination_ports port; |
| 58 | + enum macsec_bank bank; |
| 59 | + u32 index; |
| 60 | + int assoc_num; |
| 61 | + bool has_transformation; |
| 62 | + |
| 63 | + /* Highest takes precedence [0..15] */ |
| 64 | + u8 priority; |
| 65 | + |
| 66 | + u8 key[MACSEC_KEYID_LEN]; |
| 67 | + |
| 68 | + union { |
| 69 | + struct macsec_rx_sa *rx_sa; |
| 70 | + struct macsec_tx_sa *tx_sa; |
| 71 | + }; |
| 72 | + |
| 73 | + /* Matching */ |
| 74 | + struct { |
| 75 | + u8 sci:1; |
| 76 | + u8 tagged:1; |
| 77 | + u8 untagged:1; |
| 78 | + u8 etype:1; |
| 79 | + } match; |
| 80 | + |
| 81 | + u16 etype; |
| 82 | + |
| 83 | + /* Action */ |
| 84 | + struct { |
| 85 | + u8 bypass:1; |
| 86 | + u8 drop:1; |
| 87 | + } action; |
| 88 | + |
| 89 | +}; |
| 90 | +#endif |
| 91 | + |
| 92 | struct vsc8531_private { |
| 93 | int rate_magic; |
| 94 | u16 supp_led_modes; |
| 95 | @@ -449,6 +494,19 @@ struct vsc8531_private { |
| 96 | * package. |
| 97 | */ |
| 98 | unsigned int base_addr; |
| 99 | + |
| 100 | +#if IS_ENABLED(CONFIG_MACSEC) |
| 101 | + /* MACsec fields: |
| 102 | + * - One SecY per device (enforced at the s/w implementation level) |
| 103 | + * - macsec_flows: list of h/w flows |
| 104 | + * - ingr_flows: bitmap of ingress flows |
| 105 | + * - egr_flows: bitmap of egress flows |
| 106 | + */ |
| 107 | + struct macsec_secy *secy; |
| 108 | + struct list_head macsec_flows; |
| 109 | + unsigned long ingr_flows; |
| 110 | + unsigned long egr_flows; |
| 111 | +#endif |
| 112 | }; |
| 113 | |
| 114 | #ifdef CONFIG_OF_MDIO |
| 115 | @@ -1951,6 +2009,634 @@ static int vsc8584_macsec_init(struct phy_device *phydev) |
| 116 | |
| 117 | return 0; |
| 118 | } |
| 119 | + |
| 120 | +static void vsc8584_macsec_flow(struct phy_device *phydev, |
| 121 | + struct macsec_flow *flow) |
| 122 | +{ |
| 123 | + struct vsc8531_private *priv = phydev->priv; |
| 124 | + enum macsec_bank bank = flow->bank; |
| 125 | + u32 val, match = 0, mask = 0, action = 0, idx = flow->index; |
| 126 | + |
| 127 | + if (flow->match.tagged) |
| 128 | + match |= MSCC_MS_SAM_MISC_MATCH_TAGGED; |
| 129 | + if (flow->match.untagged) |
| 130 | + match |= MSCC_MS_SAM_MISC_MATCH_UNTAGGED; |
| 131 | + |
| 132 | + if (bank == MACSEC_INGR && flow->assoc_num >= 0) { |
| 133 | + match |= MSCC_MS_SAM_MISC_MATCH_AN(flow->assoc_num); |
| 134 | + mask |= MSCC_MS_SAM_MASK_AN_MASK(0x3); |
| 135 | + } |
| 136 | + |
| 137 | + if (bank == MACSEC_INGR && flow->match.sci && flow->rx_sa->sc->sci) { |
| 138 | + match |= MSCC_MS_SAM_MISC_MATCH_TCI(BIT(3)); |
| 139 | + mask |= MSCC_MS_SAM_MASK_TCI_MASK(BIT(3)) | |
| 140 | + MSCC_MS_SAM_MASK_SCI_MASK; |
| 141 | + |
| 142 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_SAM_MATCH_SCI_LO(idx), |
| 143 | + lower_32_bits(flow->rx_sa->sc->sci)); |
| 144 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_SAM_MATCH_SCI_HI(idx), |
| 145 | + upper_32_bits(flow->rx_sa->sc->sci)); |
| 146 | + } |
| 147 | + |
| 148 | + if (flow->match.etype) { |
| 149 | + mask |= MSCC_MS_SAM_MASK_MAC_ETYPE_MASK; |
| 150 | + |
| 151 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_SAM_MAC_SA_MATCH_HI(idx), |
| 152 | + MSCC_MS_SAM_MAC_SA_MATCH_HI_ETYPE(htons(flow->etype))); |
| 153 | + } |
| 154 | + |
| 155 | + match |= MSCC_MS_SAM_MISC_MATCH_PRIORITY(flow->priority); |
| 156 | + |
| 157 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_SAM_MISC_MATCH(idx), match); |
| 158 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_SAM_MASK(idx), mask); |
| 159 | + |
| 160 | + /* Action for matching packets */ |
| 161 | + if (flow->action.drop) |
| 162 | + action = MSCC_MS_FLOW_DROP; |
| 163 | + else if (flow->action.bypass || flow->port == MSCC_MS_PORT_UNCONTROLLED) |
| 164 | + action = MSCC_MS_FLOW_BYPASS; |
| 165 | + else |
| 166 | + action = (bank == MACSEC_INGR) ? |
| 167 | + MSCC_MS_FLOW_INGRESS : MSCC_MS_FLOW_EGRESS; |
| 168 | + |
| 169 | + val = MSCC_MS_SAM_FLOW_CTRL_FLOW_TYPE(action) | |
| 170 | + MSCC_MS_SAM_FLOW_CTRL_DROP_ACTION(MSCC_MS_ACTION_DROP) | |
| 171 | + MSCC_MS_SAM_FLOW_CTRL_DEST_PORT(flow->port); |
| 172 | + |
| 173 | + if (action == MSCC_MS_FLOW_BYPASS) |
| 174 | + goto write_ctrl; |
| 175 | + |
| 176 | + if (bank == MACSEC_INGR) { |
| 177 | + if (priv->secy->replay_protect) |
| 178 | + val |= MSCC_MS_SAM_FLOW_CTRL_REPLAY_PROTECT; |
| 179 | + if (priv->secy->validate_frames == MACSEC_VALIDATE_STRICT) |
| 180 | + val |= MSCC_MS_SAM_FLOW_CTRL_VALIDATE_FRAMES(MSCC_MS_VALIDATE_STRICT); |
| 181 | + else if (priv->secy->validate_frames == MACSEC_VALIDATE_CHECK) |
| 182 | + val |= MSCC_MS_SAM_FLOW_CTRL_VALIDATE_FRAMES(MSCC_MS_VALIDATE_CHECK); |
| 183 | + } else if (bank == MACSEC_EGR) { |
| 184 | + if (priv->secy->protect_frames) |
| 185 | + val |= MSCC_MS_SAM_FLOW_CTRL_PROTECT_FRAME; |
| 186 | + if (priv->secy->tx_sc.encrypt) |
| 187 | + val |= MSCC_MS_SAM_FLOW_CTRL_CONF_PROTECT; |
| 188 | + if (priv->secy->tx_sc.send_sci) |
| 189 | + val |= MSCC_MS_SAM_FLOW_CTRL_INCLUDE_SCI; |
| 190 | + } |
| 191 | + |
| 192 | +write_ctrl: |
| 193 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_SAM_FLOW_CTRL(idx), val); |
| 194 | +} |
| 195 | + |
| 196 | +static struct macsec_flow *vsc8584_macsec_find_flow(struct macsec_context *ctx, |
| 197 | + enum macsec_bank bank) |
| 198 | +{ |
| 199 | + struct vsc8531_private *priv = ctx->phydev->priv; |
| 200 | + struct macsec_flow *pos, *tmp; |
| 201 | + |
| 202 | + list_for_each_entry_safe(pos, tmp, &priv->macsec_flows, list) |
| 203 | + if (pos->assoc_num == ctx->sa.assoc_num && pos->bank == bank) |
| 204 | + return pos; |
| 205 | + |
| 206 | + return ERR_PTR(-ENOENT); |
| 207 | +} |
| 208 | + |
| 209 | +static void vsc8584_macsec_flow_enable(struct phy_device *phydev, |
| 210 | + struct macsec_flow *flow) |
| 211 | +{ |
| 212 | + enum macsec_bank bank = flow->bank; |
| 213 | + u32 val, idx = flow->index; |
| 214 | + |
| 215 | + if ((flow->bank == MACSEC_INGR && flow->rx_sa && !flow->rx_sa->active) || |
| 216 | + (flow->bank == MACSEC_EGR && flow->tx_sa && !flow->tx_sa->active)) |
| 217 | + return; |
| 218 | + |
| 219 | + /* Enable */ |
| 220 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_SAM_ENTRY_SET1, BIT(idx)); |
| 221 | + |
| 222 | + /* Set in-use */ |
| 223 | + val = vsc8584_macsec_phy_read(phydev, bank, MSCC_MS_SAM_FLOW_CTRL(idx)); |
| 224 | + val |= MSCC_MS_SAM_FLOW_CTRL_SA_IN_USE; |
| 225 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_SAM_FLOW_CTRL(idx), val); |
| 226 | +} |
| 227 | + |
| 228 | +static void vsc8584_macsec_flow_disable(struct phy_device *phydev, |
| 229 | + struct macsec_flow *flow) |
| 230 | +{ |
| 231 | + enum macsec_bank bank = flow->bank; |
| 232 | + u32 val, idx = flow->index; |
| 233 | + |
| 234 | + /* Disable */ |
| 235 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_SAM_ENTRY_CLEAR1, BIT(idx)); |
| 236 | + |
| 237 | + /* Clear in-use */ |
| 238 | + val = vsc8584_macsec_phy_read(phydev, bank, MSCC_MS_SAM_FLOW_CTRL(idx)); |
| 239 | + val &= ~MSCC_MS_SAM_FLOW_CTRL_SA_IN_USE; |
| 240 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_SAM_FLOW_CTRL(idx), val); |
| 241 | +} |
| 242 | + |
| 243 | +static u32 vsc8584_macsec_flow_context_id(struct macsec_flow *flow) |
| 244 | +{ |
| 245 | + if (flow->bank == MACSEC_INGR) |
| 246 | + return flow->index + MSCC_MS_MAX_FLOWS; |
| 247 | + |
| 248 | + return flow->index; |
| 249 | +} |
| 250 | + |
| 251 | +/* Derive the AES key to get a key for the hash autentication */ |
| 252 | +static int vsc8584_macsec_derive_key(const u8 key[MACSEC_KEYID_LEN], |
| 253 | + u16 key_len, u8 hkey[16]) |
| 254 | +{ |
| 255 | + struct crypto_skcipher *tfm = crypto_alloc_skcipher("ecb(aes)", 0, 0); |
| 256 | + struct skcipher_request *req = NULL; |
| 257 | + struct scatterlist src, dst; |
| 258 | + DECLARE_CRYPTO_WAIT(wait); |
| 259 | + u32 input[4] = {0}; |
| 260 | + int ret; |
| 261 | + |
| 262 | + if (IS_ERR(tfm)) |
| 263 | + return PTR_ERR(tfm); |
| 264 | + |
| 265 | + req = skcipher_request_alloc(tfm, GFP_KERNEL); |
| 266 | + if (!req) { |
| 267 | + ret = -ENOMEM; |
| 268 | + goto out; |
| 269 | + } |
| 270 | + |
| 271 | + skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG | |
| 272 | + CRYPTO_TFM_REQ_MAY_SLEEP, crypto_req_done, |
| 273 | + &wait); |
| 274 | + ret = crypto_skcipher_setkey(tfm, key, key_len); |
| 275 | + if (ret < 0) |
| 276 | + goto out; |
| 277 | + |
| 278 | + sg_init_one(&src, input, 16); |
| 279 | + sg_init_one(&dst, hkey, 16); |
| 280 | + skcipher_request_set_crypt(req, &src, &dst, 16, NULL); |
| 281 | + |
| 282 | + ret = crypto_wait_req(crypto_skcipher_encrypt(req), &wait); |
| 283 | + |
| 284 | +out: |
| 285 | + skcipher_request_free(req); |
| 286 | + crypto_free_skcipher(tfm); |
| 287 | + return ret; |
| 288 | +} |
| 289 | + |
| 290 | +static int vsc8584_macsec_transformation(struct phy_device *phydev, |
| 291 | + struct macsec_flow *flow) |
| 292 | +{ |
| 293 | + struct vsc8531_private *priv = phydev->priv; |
| 294 | + enum macsec_bank bank = flow->bank; |
| 295 | + int i, ret, index = flow->index; |
| 296 | + u32 rec = 0, control = 0; |
| 297 | + u8 hkey[16]; |
| 298 | + sci_t sci; |
| 299 | + |
| 300 | + ret = vsc8584_macsec_derive_key(flow->key, priv->secy->key_len, hkey); |
| 301 | + if (ret) |
| 302 | + return ret; |
| 303 | + |
| 304 | + switch (priv->secy->key_len) { |
| 305 | + case 16: |
| 306 | + control |= CONTROL_CRYPTO_ALG(CTRYPTO_ALG_AES_CTR_128); |
| 307 | + break; |
| 308 | + case 32: |
| 309 | + control |= CONTROL_CRYPTO_ALG(CTRYPTO_ALG_AES_CTR_256); |
| 310 | + break; |
| 311 | + default: |
| 312 | + return -EINVAL; |
| 313 | + } |
| 314 | + |
| 315 | + control |= (bank == MACSEC_EGR) ? |
| 316 | + (CONTROL_TYPE_EGRESS | CONTROL_AN(priv->secy->tx_sc.encoding_sa)) : |
| 317 | + (CONTROL_TYPE_INGRESS | CONTROL_SEQ_MASK); |
| 318 | + |
| 319 | + control |= CONTROL_UPDATE_SEQ | CONTROL_ENCRYPT_AUTH | CONTROL_KEY_IN_CTX | |
| 320 | + CONTROL_IV0 | CONTROL_IV1 | CONTROL_IV_IN_SEQ | |
| 321 | + CONTROL_DIGEST_TYPE(0x2) | CONTROL_SEQ_TYPE(0x1) | |
| 322 | + CONTROL_AUTH_ALG(AUTH_ALG_AES_GHAS) | CONTROL_CONTEXT_ID; |
| 323 | + |
| 324 | + /* Set the control word */ |
| 325 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_XFORM_REC(index, rec++), |
| 326 | + control); |
| 327 | + |
| 328 | + /* Set the context ID. Must be unique. */ |
| 329 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_XFORM_REC(index, rec++), |
| 330 | + vsc8584_macsec_flow_context_id(flow)); |
| 331 | + |
| 332 | + /* Set the encryption/decryption key */ |
| 333 | + for (i = 0; i < priv->secy->key_len / sizeof(u32); i++) |
| 334 | + vsc8584_macsec_phy_write(phydev, bank, |
| 335 | + MSCC_MS_XFORM_REC(index, rec++), |
| 336 | + ((u32 *)flow->key)[i]); |
| 337 | + |
| 338 | + /* Set the authentication key */ |
| 339 | + for (i = 0; i < 4; i++) |
| 340 | + vsc8584_macsec_phy_write(phydev, bank, |
| 341 | + MSCC_MS_XFORM_REC(index, rec++), |
| 342 | + ((u32 *)hkey)[i]); |
| 343 | + |
| 344 | + /* Initial sequence number */ |
| 345 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_XFORM_REC(index, rec++), |
| 346 | + bank == MACSEC_INGR ? |
| 347 | + flow->rx_sa->next_pn : flow->tx_sa->next_pn); |
| 348 | + |
| 349 | + if (bank == MACSEC_INGR) |
| 350 | + /* Set the mask (replay window size) */ |
| 351 | + vsc8584_macsec_phy_write(phydev, bank, |
| 352 | + MSCC_MS_XFORM_REC(index, rec++), |
| 353 | + priv->secy->replay_window); |
| 354 | + |
| 355 | + /* Set the input vectors */ |
| 356 | + sci = bank == MACSEC_INGR ? flow->rx_sa->sc->sci : priv->secy->sci; |
| 357 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_XFORM_REC(index, rec++), |
| 358 | + lower_32_bits(sci)); |
| 359 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_XFORM_REC(index, rec++), |
| 360 | + upper_32_bits(sci)); |
| 361 | + |
| 362 | + while (rec < 20) |
| 363 | + vsc8584_macsec_phy_write(phydev, bank, MSCC_MS_XFORM_REC(index, rec++), |
| 364 | + 0); |
| 365 | + |
| 366 | + flow->has_transformation = true; |
| 367 | + return 0; |
| 368 | +} |
| 369 | + |
| 370 | +static struct macsec_flow *vsc8584_macsec_alloc_flow(struct vsc8531_private *priv, |
| 371 | + enum macsec_bank bank) |
| 372 | +{ |
| 373 | + unsigned long *bitmap = bank == MACSEC_INGR ? |
| 374 | + &priv->ingr_flows : &priv->egr_flows; |
| 375 | + struct macsec_flow *flow; |
| 376 | + int index; |
| 377 | + |
| 378 | + index = find_first_zero_bit(bitmap, MSCC_MS_MAX_FLOWS); |
| 379 | + |
| 380 | + if (index == MSCC_MS_MAX_FLOWS) |
| 381 | + return ERR_PTR(-ENOMEM); |
| 382 | + |
| 383 | + flow = kzalloc(sizeof(*flow), GFP_KERNEL); |
| 384 | + if (!flow) |
| 385 | + return ERR_PTR(-ENOMEM); |
| 386 | + |
| 387 | + set_bit(index, bitmap); |
| 388 | + flow->index = index; |
| 389 | + flow->bank = bank; |
| 390 | + flow->priority = 8; |
| 391 | + flow->assoc_num = -1; |
| 392 | + |
| 393 | + list_add_tail(&flow->list, &priv->macsec_flows); |
| 394 | + return flow; |
| 395 | +} |
| 396 | + |
| 397 | +static void vsc8584_macsec_free_flow(struct vsc8531_private *priv, |
| 398 | + struct macsec_flow *flow) |
| 399 | +{ |
| 400 | + unsigned long *bitmap = flow->bank == MACSEC_INGR ? |
| 401 | + &priv->ingr_flows : &priv->egr_flows; |
| 402 | + |
| 403 | + list_del(&flow->list); |
| 404 | + clear_bit(flow->index, bitmap); |
| 405 | + kfree(flow); |
| 406 | +} |
| 407 | + |
| 408 | +static int vsc8584_macsec_add_flow(struct phy_device *phydev, |
| 409 | + struct macsec_flow *flow, bool update) |
| 410 | +{ |
| 411 | + int ret; |
| 412 | + |
| 413 | + flow->port = MSCC_MS_PORT_CONTROLLED; |
| 414 | + vsc8584_macsec_flow(phydev, flow); |
| 415 | + |
| 416 | + if (update) |
| 417 | + return 0; |
| 418 | + |
| 419 | + ret = vsc8584_macsec_transformation(phydev, flow); |
| 420 | + if (ret) { |
| 421 | + vsc8584_macsec_free_flow(phydev->priv, flow); |
| 422 | + return ret; |
| 423 | + } |
| 424 | + |
| 425 | + return 0; |
| 426 | +} |
| 427 | + |
| 428 | +static int vsc8584_macsec_default_flows(struct phy_device *phydev) |
| 429 | +{ |
| 430 | + struct macsec_flow *flow; |
| 431 | + |
| 432 | + /* Add a rule to let the MKA traffic go through, ingress */ |
| 433 | + flow = vsc8584_macsec_alloc_flow(phydev->priv, MACSEC_INGR); |
| 434 | + if (IS_ERR(flow)) |
| 435 | + return PTR_ERR(flow); |
| 436 | + |
| 437 | + flow->priority = 15; |
| 438 | + flow->port = MSCC_MS_PORT_UNCONTROLLED; |
| 439 | + flow->match.tagged = 1; |
| 440 | + flow->match.untagged = 1; |
| 441 | + flow->match.etype = 1; |
| 442 | + flow->etype = ETH_P_PAE; |
| 443 | + flow->action.bypass = 1; |
| 444 | + |
| 445 | + vsc8584_macsec_flow(phydev, flow); |
| 446 | + vsc8584_macsec_flow_enable(phydev, flow); |
| 447 | + |
| 448 | + /* Add a rule to let the MKA traffic go through, egress */ |
| 449 | + flow = vsc8584_macsec_alloc_flow(phydev->priv, MACSEC_EGR); |
| 450 | + if (IS_ERR(flow)) |
| 451 | + return PTR_ERR(flow); |
| 452 | + |
| 453 | + flow->priority = 15; |
| 454 | + flow->port = MSCC_MS_PORT_COMMON; |
| 455 | + flow->match.untagged = 1; |
| 456 | + flow->match.etype = 1; |
| 457 | + flow->etype = ETH_P_PAE; |
| 458 | + flow->action.bypass = 1; |
| 459 | + |
| 460 | + vsc8584_macsec_flow(phydev, flow); |
| 461 | + vsc8584_macsec_flow_enable(phydev, flow); |
| 462 | + |
| 463 | + return 0; |
| 464 | +} |
| 465 | + |
| 466 | +static void vsc8584_macsec_del_flow(struct phy_device *phydev, |
| 467 | + struct macsec_flow *flow) |
| 468 | +{ |
| 469 | + vsc8584_macsec_flow_disable(phydev, flow); |
| 470 | + vsc8584_macsec_free_flow(phydev->priv, flow); |
| 471 | +} |
| 472 | + |
| 473 | +static int __vsc8584_macsec_add_rxsa(struct macsec_context *ctx, |
| 474 | + struct macsec_flow *flow, bool update) |
| 475 | +{ |
| 476 | + struct phy_device *phydev = ctx->phydev; |
| 477 | + struct vsc8531_private *priv = phydev->priv; |
| 478 | + |
| 479 | + if (!flow) { |
| 480 | + flow = vsc8584_macsec_alloc_flow(priv, MACSEC_INGR); |
| 481 | + if (IS_ERR(flow)) |
| 482 | + return PTR_ERR(flow); |
| 483 | + |
| 484 | + memcpy(flow->key, ctx->sa.key, priv->secy->key_len); |
| 485 | + } |
| 486 | + |
| 487 | + flow->assoc_num = ctx->sa.assoc_num; |
| 488 | + flow->rx_sa = ctx->sa.rx_sa; |
| 489 | + |
| 490 | + /* Always match tagged packets on ingress */ |
| 491 | + flow->match.tagged = 1; |
| 492 | + flow->match.sci = 1; |
| 493 | + |
| 494 | + if (priv->secy->validate_frames != MACSEC_VALIDATE_DISABLED) |
| 495 | + flow->match.untagged = 1; |
| 496 | + |
| 497 | + return vsc8584_macsec_add_flow(phydev, flow, update); |
| 498 | +} |
| 499 | + |
| 500 | +static int __vsc8584_macsec_add_txsa(struct macsec_context *ctx, |
| 501 | + struct macsec_flow *flow, bool update) |
| 502 | +{ |
| 503 | + struct phy_device *phydev = ctx->phydev; |
| 504 | + struct vsc8531_private *priv = phydev->priv; |
| 505 | + |
| 506 | + if (!flow) { |
| 507 | + flow = vsc8584_macsec_alloc_flow(priv, MACSEC_EGR); |
| 508 | + if (IS_ERR(flow)) |
| 509 | + return PTR_ERR(flow); |
| 510 | + |
| 511 | + memcpy(flow->key, ctx->sa.key, priv->secy->key_len); |
| 512 | + } |
| 513 | + |
| 514 | + flow->assoc_num = ctx->sa.assoc_num; |
| 515 | + flow->tx_sa = ctx->sa.tx_sa; |
| 516 | + |
| 517 | + /* Always match untagged packets on egress */ |
| 518 | + flow->match.untagged = 1; |
| 519 | + |
| 520 | + return vsc8584_macsec_add_flow(phydev, flow, update); |
| 521 | +} |
| 522 | + |
| 523 | +static int vsc8584_macsec_dev_open(struct macsec_context *ctx) |
| 524 | +{ |
| 525 | + struct vsc8531_private *priv = ctx->phydev->priv; |
| 526 | + struct macsec_flow *flow, *tmp; |
| 527 | + |
| 528 | + /* No operation to perform before the commit step */ |
| 529 | + if (ctx->prepare) |
| 530 | + return 0; |
| 531 | + |
| 532 | + list_for_each_entry_safe(flow, tmp, &priv->macsec_flows, list) |
| 533 | + vsc8584_macsec_flow_enable(ctx->phydev, flow); |
| 534 | + |
| 535 | + return 0; |
| 536 | +} |
| 537 | + |
| 538 | +static int vsc8584_macsec_dev_stop(struct macsec_context *ctx) |
| 539 | +{ |
| 540 | + struct vsc8531_private *priv = ctx->phydev->priv; |
| 541 | + struct macsec_flow *flow, *tmp; |
| 542 | + |
| 543 | + /* No operation to perform before the commit step */ |
| 544 | + if (ctx->prepare) |
| 545 | + return 0; |
| 546 | + |
| 547 | + list_for_each_entry_safe(flow, tmp, &priv->macsec_flows, list) |
| 548 | + vsc8584_macsec_flow_disable(ctx->phydev, flow); |
| 549 | + |
| 550 | + return 0; |
| 551 | +} |
| 552 | + |
| 553 | +static int vsc8584_macsec_add_secy(struct macsec_context *ctx) |
| 554 | +{ |
| 555 | + struct vsc8531_private *priv = ctx->phydev->priv; |
| 556 | + struct macsec_secy *secy = ctx->secy; |
| 557 | + |
| 558 | + if (ctx->prepare) { |
| 559 | + if (priv->secy) |
| 560 | + return -EEXIST; |
| 561 | + |
| 562 | + return 0; |
| 563 | + } |
| 564 | + |
| 565 | + priv->secy = secy; |
| 566 | + |
| 567 | + vsc8584_macsec_flow_default_action(ctx->phydev, MACSEC_EGR, |
| 568 | + secy->validate_frames != MACSEC_VALIDATE_DISABLED); |
| 569 | + vsc8584_macsec_flow_default_action(ctx->phydev, MACSEC_INGR, |
| 570 | + secy->validate_frames != MACSEC_VALIDATE_DISABLED); |
| 571 | + |
| 572 | + return vsc8584_macsec_default_flows(ctx->phydev); |
| 573 | +} |
| 574 | + |
| 575 | +static int vsc8584_macsec_del_secy(struct macsec_context *ctx) |
| 576 | +{ |
| 577 | + struct vsc8531_private *priv = ctx->phydev->priv; |
| 578 | + struct macsec_flow *flow, *tmp; |
| 579 | + |
| 580 | + /* No operation to perform before the commit step */ |
| 581 | + if (ctx->prepare) |
| 582 | + return 0; |
| 583 | + |
| 584 | + list_for_each_entry_safe(flow, tmp, &priv->macsec_flows, list) |
| 585 | + vsc8584_macsec_del_flow(ctx->phydev, flow); |
| 586 | + |
| 587 | + vsc8584_macsec_flow_default_action(ctx->phydev, MACSEC_EGR, false); |
| 588 | + vsc8584_macsec_flow_default_action(ctx->phydev, MACSEC_INGR, false); |
| 589 | + |
| 590 | + priv->secy = NULL; |
| 591 | + return 0; |
| 592 | +} |
| 593 | + |
| 594 | +static int vsc8584_macsec_upd_secy(struct macsec_context *ctx) |
| 595 | +{ |
| 596 | + /* No operation to perform before the commit step */ |
| 597 | + if (ctx->prepare) |
| 598 | + return 0; |
| 599 | + |
| 600 | + vsc8584_macsec_del_secy(ctx); |
| 601 | + return vsc8584_macsec_add_secy(ctx); |
| 602 | +} |
| 603 | + |
| 604 | +static int vsc8584_macsec_add_rxsc(struct macsec_context *ctx) |
| 605 | +{ |
| 606 | + /* Nothing to do */ |
| 607 | + return 0; |
| 608 | +} |
| 609 | + |
| 610 | +static int vsc8584_macsec_upd_rxsc(struct macsec_context *ctx) |
| 611 | +{ |
| 612 | + return -EOPNOTSUPP; |
| 613 | +} |
| 614 | + |
| 615 | +static int vsc8584_macsec_del_rxsc(struct macsec_context *ctx) |
| 616 | +{ |
| 617 | + struct vsc8531_private *priv = ctx->phydev->priv; |
| 618 | + struct macsec_flow *flow, *tmp; |
| 619 | + |
| 620 | + /* No operation to perform before the commit step */ |
| 621 | + if (ctx->prepare) |
| 622 | + return 0; |
| 623 | + |
| 624 | + list_for_each_entry_safe(flow, tmp, &priv->macsec_flows, list) { |
| 625 | + if (flow->bank == MACSEC_INGR && flow->rx_sa && |
| 626 | + flow->rx_sa->sc->sci == ctx->rx_sc->sci) |
| 627 | + vsc8584_macsec_del_flow(ctx->phydev, flow); |
| 628 | + } |
| 629 | + |
| 630 | + return 0; |
| 631 | +} |
| 632 | + |
| 633 | +static int vsc8584_macsec_add_rxsa(struct macsec_context *ctx) |
| 634 | +{ |
| 635 | + struct macsec_flow *flow = NULL; |
| 636 | + |
| 637 | + if (ctx->prepare) |
| 638 | + return __vsc8584_macsec_add_rxsa(ctx, flow, false); |
| 639 | + |
| 640 | + flow = vsc8584_macsec_find_flow(ctx, MACSEC_INGR); |
| 641 | + if (IS_ERR(flow)) |
| 642 | + return PTR_ERR(flow); |
| 643 | + |
| 644 | + vsc8584_macsec_flow_enable(ctx->phydev, flow); |
| 645 | + return 0; |
| 646 | +} |
| 647 | + |
| 648 | +static int vsc8584_macsec_upd_rxsa(struct macsec_context *ctx) |
| 649 | +{ |
| 650 | + struct macsec_flow *flow; |
| 651 | + |
| 652 | + flow = vsc8584_macsec_find_flow(ctx, MACSEC_INGR); |
| 653 | + if (IS_ERR(flow)) |
| 654 | + return PTR_ERR(flow); |
| 655 | + |
| 656 | + if (ctx->prepare) { |
| 657 | + /* Make sure the flow is disabled before updating it */ |
| 658 | + vsc8584_macsec_flow_disable(ctx->phydev, flow); |
| 659 | + |
| 660 | + return __vsc8584_macsec_add_rxsa(ctx, flow, true); |
| 661 | + } |
| 662 | + |
| 663 | + vsc8584_macsec_flow_enable(ctx->phydev, flow); |
| 664 | + return 0; |
| 665 | +} |
| 666 | + |
| 667 | +static int vsc8584_macsec_del_rxsa(struct macsec_context *ctx) |
| 668 | +{ |
| 669 | + struct macsec_flow *flow; |
| 670 | + |
| 671 | + flow = vsc8584_macsec_find_flow(ctx, MACSEC_INGR); |
| 672 | + |
| 673 | + if (IS_ERR(flow)) |
| 674 | + return PTR_ERR(flow); |
| 675 | + if (ctx->prepare) |
| 676 | + return 0; |
| 677 | + |
| 678 | + vsc8584_macsec_del_flow(ctx->phydev, flow); |
| 679 | + return 0; |
| 680 | +} |
| 681 | + |
| 682 | +static int vsc8584_macsec_add_txsa(struct macsec_context *ctx) |
| 683 | +{ |
| 684 | + struct macsec_flow *flow = NULL; |
| 685 | + |
| 686 | + if (ctx->prepare) |
| 687 | + return __vsc8584_macsec_add_txsa(ctx, flow, false); |
| 688 | + |
| 689 | + flow = vsc8584_macsec_find_flow(ctx, MACSEC_EGR); |
| 690 | + if (IS_ERR(flow)) |
| 691 | + return PTR_ERR(flow); |
| 692 | + |
| 693 | + vsc8584_macsec_flow_enable(ctx->phydev, flow); |
| 694 | + return 0; |
| 695 | +} |
| 696 | + |
| 697 | +static int vsc8584_macsec_upd_txsa(struct macsec_context *ctx) |
| 698 | +{ |
| 699 | + struct macsec_flow *flow; |
| 700 | + |
| 701 | + flow = vsc8584_macsec_find_flow(ctx, MACSEC_EGR); |
| 702 | + if (IS_ERR(flow)) |
| 703 | + return PTR_ERR(flow); |
| 704 | + |
| 705 | + if (ctx->prepare) { |
| 706 | + /* Make sure the flow is disabled before updating it */ |
| 707 | + vsc8584_macsec_flow_disable(ctx->phydev, flow); |
| 708 | + |
| 709 | + return __vsc8584_macsec_add_txsa(ctx, flow, true); |
| 710 | + } |
| 711 | + |
| 712 | + vsc8584_macsec_flow_enable(ctx->phydev, flow); |
| 713 | + return 0; |
| 714 | +} |
| 715 | + |
| 716 | +static int vsc8584_macsec_del_txsa(struct macsec_context *ctx) |
| 717 | +{ |
| 718 | + struct macsec_flow *flow; |
| 719 | + |
| 720 | + flow = vsc8584_macsec_find_flow(ctx, MACSEC_EGR); |
| 721 | + |
| 722 | + if (IS_ERR(flow)) |
| 723 | + return PTR_ERR(flow); |
| 724 | + if (ctx->prepare) |
| 725 | + return 0; |
| 726 | + |
| 727 | + vsc8584_macsec_del_flow(ctx->phydev, flow); |
| 728 | + return 0; |
| 729 | +} |
| 730 | + |
| 731 | +static struct macsec_ops vsc8584_macsec_ops = { |
| 732 | + .mdo_dev_open = vsc8584_macsec_dev_open, |
| 733 | + .mdo_dev_stop = vsc8584_macsec_dev_stop, |
| 734 | + .mdo_add_secy = vsc8584_macsec_add_secy, |
| 735 | + .mdo_upd_secy = vsc8584_macsec_upd_secy, |
| 736 | + .mdo_del_secy = vsc8584_macsec_del_secy, |
| 737 | + .mdo_add_rxsc = vsc8584_macsec_add_rxsc, |
| 738 | + .mdo_upd_rxsc = vsc8584_macsec_upd_rxsc, |
| 739 | + .mdo_del_rxsc = vsc8584_macsec_del_rxsc, |
| 740 | + .mdo_add_rxsa = vsc8584_macsec_add_rxsa, |
| 741 | + .mdo_upd_rxsa = vsc8584_macsec_upd_rxsa, |
| 742 | + .mdo_del_rxsa = vsc8584_macsec_del_rxsa, |
| 743 | + .mdo_add_txsa = vsc8584_macsec_add_txsa, |
| 744 | + .mdo_upd_txsa = vsc8584_macsec_upd_txsa, |
| 745 | + .mdo_del_txsa = vsc8584_macsec_del_txsa, |
| 746 | +}; |
| 747 | #endif /* CONFIG_MACSEC */ |
| 748 | |
| 749 | /* Check if one PHY has already done the init of the parts common to all PHYs |
| 750 | @@ -2109,6 +2795,11 @@ static int vsc8584_config_init(struct phy_device *phydev) |
| 751 | case PHY_ID_VSC8575: |
| 752 | case PHY_ID_VSC8582: |
| 753 | case PHY_ID_VSC8584: |
| 754 | + INIT_LIST_HEAD(&vsc8531->macsec_flows); |
| 755 | + vsc8531->secy = NULL; |
| 756 | + |
| 757 | + phydev->macsec_ops = &vsc8584_macsec_ops; |
| 758 | + |
| 759 | ret = vsc8584_macsec_init(phydev); |
| 760 | if (ret) |
| 761 | goto err; |
| 762 | diff --git a/drivers/net/phy/mscc_macsec.h b/drivers/net/phy/mscc_macsec.h |
| 763 | index 0d108da28dad2..9b5d0af91d204 100644 |
| 764 | --- a/drivers/net/phy/mscc_macsec.h |
| 765 | +++ b/drivers/net/phy/mscc_macsec.h |
| 766 | @@ -8,6 +8,8 @@ |
| 767 | #ifndef _MSCC_OCELOT_MACSEC_H_ |
| 768 | #define _MSCC_OCELOT_MACSEC_H_ |
| 769 | |
| 770 | +#define MSCC_MS_MAX_FLOWS 16 |
| 771 | + |
| 772 | #define CONTROL_TYPE_EGRESS 0x6 |
| 773 | #define CONTROL_TYPE_INGRESS 0xf |
| 774 | #define CONTROL_IV0 BIT(5) |
| 775 | @@ -59,6 +61,8 @@ enum mscc_macsec_validate_levels { |
| 776 | #define MSCC_MS_XFORM_REC(x, y) (((x) << 5) + (y)) |
| 777 | #define MSCC_MS_ENA_CFG 0x800 |
| 778 | #define MSCC_MS_FC_CFG 0x804 |
| 779 | +#define MSCC_MS_SAM_MAC_SA_MATCH_LO(x) (0x1000 + ((x) << 4)) |
| 780 | +#define MSCC_MS_SAM_MAC_SA_MATCH_HI(x) (0x1001 + ((x) << 4)) |
| 781 | #define MSCC_MS_SAM_MISC_MATCH(x) (0x1004 + ((x) << 4)) |
| 782 | #define MSCC_MS_SAM_MATCH_SCI_LO(x) (0x1005 + ((x) << 4)) |
| 783 | #define MSCC_MS_SAM_MATCH_SCI_HI(x) (0x1006 + ((x) << 4)) |
| 784 | -- |
| 785 | cgit 1.2.3-1.el7 |
| 786 | |