Skip to content

Commit 1cf3fe1

Browse files
davem330davem330
committed
Merge branch 'macsec-vlan'
Emeel Hakim says: ==================== Support MACsec VLAN This patch series introduces support for hardware (HW) offload MACsec devices with VLAN configuration. The patches address both scenarios where the VLAN header is both the inner and outer header for MACsec. The changes include: 1. Adding MACsec offload operation for VLAN. 2. Considering VLAN when accessing MACsec net device. 3. Currently offloading MACsec when it's configured over VLAN with current MACsec TX steering rules would wrongly insert the MACsec sec tag after inserting the VLAN header. This resulted in an ETHERNET | SECTAG | VLAN packet when ETHERNET | VLAN | SECTAG is configured. The patche handles this issue when configuring steering rules. 4. Adding MACsec rx_handler change support in case of a marked skb and a mismatch on the dst MAC address. Please review these changes and let me know if you have any feedback or concerns. Updates since v1: - Consult vlan_features when adding NETIF_F_HW_MACSEC. - Allow grep for the functions. - Add helper function to get the macsec operation to allow the compiler to make some choice. Updates since v2: - Don't use macros to allow direct navigattion from mdo functions to its implementation. - Make the vlan_get_macsec_ops argument a const. - Check if the specific mdo function is available before calling it. - Enable NETIF_F_HW_MACSEC by default when the lower device has it enabled and in case the lower device currently has NETIF_F_HW_MACSEC but disabled let the new vlan device also have it disabled. Updates since v3: - Split patch ("vlan: Add MACsec offload operations for VLAN interface") to prevent mixing generic vlan code changes with driver changes. - Add mdo_open, stop and stats to support drivers which have those. - Don't fail if macsec offload operations are available but a specific function is not, to support drivers which does not implement all macsec offload operations. - Don't call find_rx_sc twice in the same loop, instead save the result in a parameter and re-use it. - Completely remove _BUILD_VLAN_MACSEC_MDO macro, to prevent returning from a macro. - Reorder the functions inside struct macsec_ops to match the struct decleration. Updates since v4: - Change subject line of ("macsec: Add MACsec rx_handler change support") and adapt commit message. - Don't separate the new check in patch ("macsec: Add MACsec rx_handler change support") from the previous if/else if. - Drop"_found" from the parameter naming "rx_sc_found" and move the definition to the relevant block. - Remove "{}" since not needed around a single line. Updates since v5: - Consider promiscuous mode case. Updates since v6: - Use IS_ENABLED instead of checking for ifdef. - Don't add inline keywork in c files, let the compiler make its own decisions. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2 parents e2598db + 7661351 commit 1cf3fe1

5 files changed

Lines changed: 288 additions & 18 deletions

File tree

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c‎

Lines changed: 26 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
#include <linux/mlx5/device.h>
55
#include <linux/mlx5/mlx5_ifc.h>
66
#include <linux/xarray.h>
7+
#include <linux/if_vlan.h>
78

89
#include "en.h"
910
#include "lib/aso.h"
@@ -348,12 +349,21 @@ static void mlx5e_macsec_cleanup_sa(struct mlx5e_macsec *macsec,
348349
sa->macsec_rule = NULL;
349350
}
350351

352+
static struct mlx5e_priv *macsec_netdev_priv(const struct net_device *dev)
353+
{
354+
#if IS_ENABLED(CONFIG_VLAN_8021Q)
355+
if (is_vlan_dev(dev))
356+
return netdev_priv(vlan_dev_priv(dev)->real_dev);
357+
#endif
358+
return netdev_priv(dev);
359+
}
360+
351361
static int mlx5e_macsec_init_sa(struct macsec_context *ctx,
352362
struct mlx5e_macsec_sa *sa,
353363
bool encrypt,
354364
bool is_tx)
355365
{
356-
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
366+
struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
357367
struct mlx5e_macsec *macsec = priv->macsec;
358368
struct mlx5_macsec_rule_attrs rule_attrs;
359369
struct mlx5_core_dev *mdev = priv->mdev;
@@ -427,7 +437,7 @@ static int macsec_rx_sa_active_update(struct macsec_context *ctx,
427437
struct mlx5e_macsec_sa *rx_sa,
428438
bool active)
429439
{
430-
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
440+
struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
431441
struct mlx5e_macsec *macsec = priv->macsec;
432442
int err = 0;
433443

@@ -508,9 +518,9 @@ static void update_macsec_epn(struct mlx5e_macsec_sa *sa, const struct macsec_ke
508518

509519
static int mlx5e_macsec_add_txsa(struct macsec_context *ctx)
510520
{
521+
struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
511522
const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc;
512523
const struct macsec_tx_sa *ctx_tx_sa = ctx->sa.tx_sa;
513-
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
514524
const struct macsec_secy *secy = ctx->secy;
515525
struct mlx5e_macsec_device *macsec_device;
516526
struct mlx5_core_dev *mdev = priv->mdev;
@@ -583,9 +593,9 @@ static int mlx5e_macsec_add_txsa(struct macsec_context *ctx)
583593

584594
static int mlx5e_macsec_upd_txsa(struct macsec_context *ctx)
585595
{
596+
struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
586597
const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc;
587598
const struct macsec_tx_sa *ctx_tx_sa = ctx->sa.tx_sa;
588-
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
589599
struct mlx5e_macsec_device *macsec_device;
590600
u8 assoc_num = ctx->sa.assoc_num;
591601
struct mlx5e_macsec_sa *tx_sa;
@@ -645,7 +655,7 @@ static int mlx5e_macsec_upd_txsa(struct macsec_context *ctx)
645655

646656
static int mlx5e_macsec_del_txsa(struct macsec_context *ctx)
647657
{
648-
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
658+
struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
649659
struct mlx5e_macsec_device *macsec_device;
650660
u8 assoc_num = ctx->sa.assoc_num;
651661
struct mlx5e_macsec_sa *tx_sa;
@@ -696,7 +706,7 @@ static u32 mlx5e_macsec_get_sa_from_hashtable(struct rhashtable *sci_hash, sci_t
696706
static int mlx5e_macsec_add_rxsc(struct macsec_context *ctx)
697707
{
698708
struct mlx5e_macsec_rx_sc_xarray_element *sc_xarray_element;
699-
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
709+
struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
700710
const struct macsec_rx_sc *ctx_rx_sc = ctx->rx_sc;
701711
struct mlx5e_macsec_device *macsec_device;
702712
struct mlx5e_macsec_rx_sc *rx_sc;
@@ -776,7 +786,7 @@ static int mlx5e_macsec_add_rxsc(struct macsec_context *ctx)
776786

777787
static int mlx5e_macsec_upd_rxsc(struct macsec_context *ctx)
778788
{
779-
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
789+
struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
780790
const struct macsec_rx_sc *ctx_rx_sc = ctx->rx_sc;
781791
struct mlx5e_macsec_device *macsec_device;
782792
struct mlx5e_macsec_rx_sc *rx_sc;
@@ -854,7 +864,7 @@ static void macsec_del_rxsc_ctx(struct mlx5e_macsec *macsec, struct mlx5e_macsec
854864

855865
static int mlx5e_macsec_del_rxsc(struct macsec_context *ctx)
856866
{
857-
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
867+
struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
858868
struct mlx5e_macsec_device *macsec_device;
859869
struct mlx5e_macsec_rx_sc *rx_sc;
860870
struct mlx5e_macsec *macsec;
@@ -890,8 +900,8 @@ static int mlx5e_macsec_del_rxsc(struct macsec_context *ctx)
890900

891901
static int mlx5e_macsec_add_rxsa(struct macsec_context *ctx)
892902
{
903+
struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
893904
const struct macsec_rx_sa *ctx_rx_sa = ctx->sa.rx_sa;
894-
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
895905
struct mlx5e_macsec_device *macsec_device;
896906
struct mlx5_core_dev *mdev = priv->mdev;
897907
u8 assoc_num = ctx->sa.assoc_num;
@@ -976,8 +986,8 @@ static int mlx5e_macsec_add_rxsa(struct macsec_context *ctx)
976986

977987
static int mlx5e_macsec_upd_rxsa(struct macsec_context *ctx)
978988
{
989+
struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
979990
const struct macsec_rx_sa *ctx_rx_sa = ctx->sa.rx_sa;
980-
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
981991
struct mlx5e_macsec_device *macsec_device;
982992
u8 assoc_num = ctx->sa.assoc_num;
983993
struct mlx5e_macsec_rx_sc *rx_sc;
@@ -1033,7 +1043,7 @@ static int mlx5e_macsec_upd_rxsa(struct macsec_context *ctx)
10331043

10341044
static int mlx5e_macsec_del_rxsa(struct macsec_context *ctx)
10351045
{
1036-
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
1046+
struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
10371047
struct mlx5e_macsec_device *macsec_device;
10381048
sci_t sci = ctx->sa.rx_sa->sc->sci;
10391049
struct mlx5e_macsec_rx_sc *rx_sc;
@@ -1085,7 +1095,7 @@ static int mlx5e_macsec_del_rxsa(struct macsec_context *ctx)
10851095

10861096
static int mlx5e_macsec_add_secy(struct macsec_context *ctx)
10871097
{
1088-
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
1098+
struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
10891099
const struct net_device *dev = ctx->secy->netdev;
10901100
const struct net_device *netdev = ctx->netdev;
10911101
struct mlx5e_macsec_device *macsec_device;
@@ -1137,7 +1147,7 @@ static int mlx5e_macsec_add_secy(struct macsec_context *ctx)
11371147
static int macsec_upd_secy_hw_address(struct macsec_context *ctx,
11381148
struct mlx5e_macsec_device *macsec_device)
11391149
{
1140-
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
1150+
struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
11411151
const struct net_device *dev = ctx->secy->netdev;
11421152
struct mlx5e_macsec *macsec = priv->macsec;
11431153
struct mlx5e_macsec_rx_sc *rx_sc, *tmp;
@@ -1184,8 +1194,8 @@ static int macsec_upd_secy_hw_address(struct macsec_context *ctx,
11841194
*/
11851195
static int mlx5e_macsec_upd_secy(struct macsec_context *ctx)
11861196
{
1197+
struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
11871198
const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc;
1188-
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
11891199
const struct net_device *dev = ctx->secy->netdev;
11901200
struct mlx5e_macsec_device *macsec_device;
11911201
struct mlx5e_macsec_sa *tx_sa;
@@ -1240,7 +1250,7 @@ static int mlx5e_macsec_upd_secy(struct macsec_context *ctx)
12401250

12411251
static int mlx5e_macsec_del_secy(struct macsec_context *ctx)
12421252
{
1243-
struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
1253+
struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
12441254
struct mlx5e_macsec_device *macsec_device;
12451255
struct mlx5e_macsec_rx_sc *rx_sc, *tmp;
12461256
struct mlx5e_macsec_sa *tx_sa;
@@ -1741,7 +1751,7 @@ void mlx5e_macsec_offload_handle_rx_skb(struct net_device *netdev,
17411751
{
17421752
struct mlx5e_macsec_rx_sc_xarray_element *sc_xarray_element;
17431753
u32 macsec_meta_data = be32_to_cpu(cqe->ft_metadata);
1744-
struct mlx5e_priv *priv = netdev_priv(netdev);
1754+
struct mlx5e_priv *priv = macsec_netdev_priv(netdev);
17451755
struct mlx5e_macsec_rx_sc *rx_sc;
17461756
struct mlx5e_macsec *macsec;
17471757
u32 fs_id;

‎drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec_fs.c‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
#include <net/macsec.h>
55
#include <linux/netdevice.h>
66
#include <linux/mlx5/qp.h>
7+
#include <linux/if_vlan.h>
78
#include "fs_core.h"
89
#include "en/fs.h"
910
#include "en_accel/macsec_fs.h"
@@ -508,6 +509,8 @@ static void macsec_fs_tx_del_rule(struct mlx5e_macsec_fs *macsec_fs,
508509
macsec_fs_tx_ft_put(macsec_fs);
509510
}
510511

512+
#define MLX5_REFORMAT_PARAM_ADD_MACSEC_OFFSET_4_BYTES 1
513+
511514
static union mlx5e_macsec_rule *
512515
macsec_fs_tx_add_rule(struct mlx5e_macsec_fs *macsec_fs,
513516
const struct macsec_context *macsec_ctx,
@@ -553,6 +556,10 @@ macsec_fs_tx_add_rule(struct mlx5e_macsec_fs *macsec_fs,
553556
reformat_params.type = MLX5_REFORMAT_TYPE_ADD_MACSEC;
554557
reformat_params.size = reformat_size;
555558
reformat_params.data = reformatbf;
559+
560+
if (is_vlan_dev(macsec_ctx->netdev))
561+
reformat_params.param_0 = MLX5_REFORMAT_PARAM_ADD_MACSEC_OFFSET_4_BYTES;
562+
556563
flow_act.pkt_reformat = mlx5_packet_reformat_alloc(macsec_fs->mdev,
557564
&reformat_params,
558565
MLX5_FLOW_NAMESPACE_EGRESS_MACSEC);

‎drivers/net/ethernet/mellanox/mlx5/core/en_main.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5109,6 +5109,7 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
51095109

51105110
netdev->vlan_features |= NETIF_F_SG;
51115111
netdev->vlan_features |= NETIF_F_HW_CSUM;
5112+
netdev->vlan_features |= NETIF_F_HW_MACSEC;
51125113
netdev->vlan_features |= NETIF_F_GRO;
51135114
netdev->vlan_features |= NETIF_F_TSO;
51145115
netdev->vlan_features |= NETIF_F_TSO6;

‎drivers/net/macsec.c‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1021,8 +1021,12 @@ static enum rx_handler_result handle_not_macsec(struct sk_buff *skb)
10211021
* the SecTAG, so we have to deduce which port to deliver to.
10221022
*/
10231023
if (macsec_is_offloaded(macsec) && netif_running(ndev)) {
1024-
if (md_dst && md_dst->type == METADATA_MACSEC &&
1025-
(!find_rx_sc(&macsec->secy, md_dst->u.macsec_info.sci)))
1024+
struct macsec_rx_sc *rx_sc = NULL;
1025+
1026+
if (md_dst && md_dst->type == METADATA_MACSEC)
1027+
rx_sc = find_rx_sc(&macsec->secy, md_dst->u.macsec_info.sci);
1028+
1029+
if (md_dst && md_dst->type == METADATA_MACSEC && !rx_sc)
10261030
continue;
10271031

10281032
if (ether_addr_equal_64bits(hdr->h_dest,
@@ -1047,7 +1051,13 @@ static enum rx_handler_result handle_not_macsec(struct sk_buff *skb)
10471051
nskb->pkt_type = PACKET_MULTICAST;
10481052

10491053
__netif_rx(nskb);
1054+
} else if (rx_sc || ndev->flags & IFF_PROMISC) {
1055+
skb->dev = ndev;
1056+
skb->pkt_type = PACKET_HOST;
1057+
ret = RX_HANDLER_ANOTHER;
1058+
goto out;
10501059
}
1060+
10511061
continue;
10521062
}
10531063

0 commit comments

Comments
 (0)