|
| 1 | +/* |
| 2 | + * Copyright (c) 2017 Mellanox Technologies. All rights reserved. |
| 3 | + * |
| 4 | + * This software is available to you under a choice of one of two |
| 5 | + * licenses. You may choose to be licensed under the terms of the GNU |
| 6 | + * General Public License (GPL) Version 2, available from the file |
| 7 | + * COPYING in the main directory of this source tree, or the |
| 8 | + * OpenIB.org BSD license below: |
| 9 | + * |
| 10 | + * Redistribution and use in source and binary forms, with or |
| 11 | + * without modification, are permitted provided that the following |
| 12 | + * conditions are met: |
| 13 | + * |
| 14 | + * - Redistributions of source code must retain the above |
| 15 | + * copyright notice, this list of conditions and the following |
| 16 | + * disclaimer. |
| 17 | + * |
| 18 | + * - Redistributions in binary form must reproduce the above |
| 19 | + * copyright notice, this list of conditions and the following |
| 20 | + * disclaimer in the documentation and/or other materials |
| 21 | + * provided with the distribution. |
| 22 | + * |
| 23 | + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, |
| 24 | + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF |
| 25 | + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND |
| 26 | + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS |
| 27 | + * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN |
| 28 | + * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN |
| 29 | + * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE |
| 30 | + * SOFTWARE. |
| 31 | + * |
| 32 | + */ |
| 33 | + |
| 34 | +#include <crypto/aead.h> |
| 35 | +#include <net/xfrm.h> |
| 36 | + |
| 37 | +#include "en_accel/ipsec_rxtx.h" |
| 38 | +#include "en_accel/ipsec.h" |
| 39 | +#include "en.h" |
| 40 | + |
| 41 | +enum { |
| 42 | + MLX5E_IPSEC_RX_SYNDROME_DECRYPTED = 0x11, |
| 43 | + MLX5E_IPSEC_RX_SYNDROME_AUTH_FAILED = 0x12, |
| 44 | +}; |
| 45 | + |
| 46 | +struct mlx5e_ipsec_rx_metadata { |
| 47 | + unsigned char reserved; |
| 48 | + __be32 sa_handle; |
| 49 | +} __packed; |
| 50 | + |
| 51 | +struct mlx5e_ipsec_metadata { |
| 52 | + unsigned char syndrome; |
| 53 | + union { |
| 54 | + unsigned char raw[5]; |
| 55 | + /* from FPGA to host, on successful decrypt */ |
| 56 | + struct mlx5e_ipsec_rx_metadata rx; |
| 57 | + } __packed content; |
| 58 | + /* packet type ID field */ |
| 59 | + __be16 ethertype; |
| 60 | +} __packed; |
| 61 | + |
| 62 | +static inline struct xfrm_state * |
| 63 | +mlx5e_ipsec_build_sp(struct net_device *netdev, struct sk_buff *skb, |
| 64 | + struct mlx5e_ipsec_metadata *mdata) |
| 65 | +{ |
| 66 | + struct mlx5e_priv *priv = netdev_priv(netdev); |
| 67 | + struct xfrm_offload *xo; |
| 68 | + struct xfrm_state *xs; |
| 69 | + u32 sa_handle; |
| 70 | + |
| 71 | + skb->sp = secpath_dup(skb->sp); |
| 72 | + if (unlikely(!skb->sp)) { |
| 73 | + atomic64_inc(&priv->ipsec->sw_stats.ipsec_rx_drop_sp_alloc); |
| 74 | + return NULL; |
| 75 | + } |
| 76 | + |
| 77 | + sa_handle = be32_to_cpu(mdata->content.rx.sa_handle); |
| 78 | + xs = mlx5e_ipsec_sadb_rx_lookup(priv->ipsec, sa_handle); |
| 79 | + if (unlikely(!xs)) { |
| 80 | + atomic64_inc(&priv->ipsec->sw_stats.ipsec_rx_drop_sadb_miss); |
| 81 | + return NULL; |
| 82 | + } |
| 83 | + |
| 84 | + skb->sp->xvec[skb->sp->len++] = xs; |
| 85 | + skb->sp->olen++; |
| 86 | + |
| 87 | + xo = xfrm_offload(skb); |
| 88 | + xo->flags = CRYPTO_DONE; |
| 89 | + switch (mdata->syndrome) { |
| 90 | + case MLX5E_IPSEC_RX_SYNDROME_DECRYPTED: |
| 91 | + xo->status = CRYPTO_SUCCESS; |
| 92 | + break; |
| 93 | + case MLX5E_IPSEC_RX_SYNDROME_AUTH_FAILED: |
| 94 | + xo->status = CRYPTO_TUNNEL_ESP_AUTH_FAILED; |
| 95 | + break; |
| 96 | + default: |
| 97 | + atomic64_inc(&priv->ipsec->sw_stats.ipsec_rx_drop_syndrome); |
| 98 | + return NULL; |
| 99 | + } |
| 100 | + return xs; |
| 101 | +} |
| 102 | + |
| 103 | +struct sk_buff *mlx5e_ipsec_handle_rx_skb(struct net_device *netdev, |
| 104 | + struct sk_buff *skb) |
| 105 | +{ |
| 106 | + struct mlx5e_ipsec_metadata *mdata; |
| 107 | + struct ethhdr *old_eth; |
| 108 | + struct ethhdr *new_eth; |
| 109 | + struct xfrm_state *xs; |
| 110 | + __be16 *ethtype; |
| 111 | + |
| 112 | + /* Detect inline metadata */ |
| 113 | + if (skb->len < ETH_HLEN + MLX5E_METADATA_ETHER_LEN) |
| 114 | + return skb; |
| 115 | + ethtype = (__be16 *)(skb->data + ETH_ALEN * 2); |
| 116 | + if (*ethtype != cpu_to_be16(MLX5E_METADATA_ETHER_TYPE)) |
| 117 | + return skb; |
| 118 | + |
| 119 | + /* Use the metadata */ |
| 120 | + mdata = (struct mlx5e_ipsec_metadata *)(skb->data + ETH_HLEN); |
| 121 | + xs = mlx5e_ipsec_build_sp(netdev, skb, mdata); |
| 122 | + if (unlikely(!xs)) { |
| 123 | + kfree_skb(skb); |
| 124 | + return NULL; |
| 125 | + } |
| 126 | + |
| 127 | + /* Remove the metadata from the buffer */ |
| 128 | + old_eth = (struct ethhdr *)skb->data; |
| 129 | + new_eth = (struct ethhdr *)(skb->data + MLX5E_METADATA_ETHER_LEN); |
| 130 | + memmove(new_eth, old_eth, 2 * ETH_ALEN); |
| 131 | + /* Ethertype is already in its new place */ |
| 132 | + skb_pull_inline(skb, MLX5E_METADATA_ETHER_LEN); |
| 133 | + |
| 134 | + return skb; |
| 135 | +} |
0 commit comments