1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright(c) 2018 Oracle and/or its affiliates. All rights reserved. */ 3 4 #include <crypto/aead.h> 5 #include <linux/debugfs.h> 6 #include <net/xfrm.h> 7 8 #include "netdevsim.h" 9 10 #define NSIM_IPSEC_AUTH_BITS 128 11 12 static ssize_t nsim_dbg_netdev_ops_read(struct file *filp, 13 char __user *buffer, 14 size_t count, loff_t *ppos) 15 { 16 struct netdevsim *ns = filp->private_data; 17 struct nsim_ipsec *ipsec = &ns->ipsec; 18 size_t bufsize; 19 char *buf, *p; 20 int len; 21 int i; 22 23 /* the buffer needed is 24 * (num SAs * 3 lines each * ~60 bytes per line) + one more line 25 */ 26 bufsize = (ipsec->count * 4 * 60) + 60; 27 buf = kzalloc(bufsize, GFP_KERNEL); 28 if (!buf) 29 return -ENOMEM; 30 31 p = buf; 32 p += scnprintf(p, bufsize - (p - buf), 33 "SA count=%u tx=%u\n", 34 ipsec->count, ipsec->tx); 35 36 for (i = 0; i < NSIM_IPSEC_MAX_SA_COUNT; i++) { 37 struct nsim_sa *sap = &ipsec->sa[i]; 38 39 if (!sap->used) 40 continue; 41 42 p += scnprintf(p, bufsize - (p - buf), 43 "sa[%i] %cx ipaddr=0x%08x %08x %08x %08x\n", 44 i, (sap->rx ? 'r' : 't'), sap->ipaddr[0], 45 sap->ipaddr[1], sap->ipaddr[2], sap->ipaddr[3]); 46 p += scnprintf(p, bufsize - (p - buf), 47 "sa[%i] spi=0x%08x proto=0x%x salt=0x%08x crypt=%d\n", 48 i, be32_to_cpu(sap->xs->id.spi), 49 sap->xs->id.proto, sap->salt, sap->crypt); 50 p += scnprintf(p, bufsize - (p - buf), 51 "sa[%i] key=0x%08x %08x %08x %08x\n", 52 i, sap->key[0], sap->key[1], 53 sap->key[2], sap->key[3]); 54 } 55 56 len = simple_read_from_buffer(buffer, count, ppos, buf, p - buf); 57 58 kfree(buf); 59 return len; 60 } 61 62 static const struct file_operations ipsec_dbg_fops = { 63 .owner = THIS_MODULE, 64 .open = simple_open, 65 .read = nsim_dbg_netdev_ops_read, 66 }; 67 68 static int nsim_ipsec_find_empty_idx(struct nsim_ipsec *ipsec) 69 { 70 u32 i; 71 72 if (ipsec->count == NSIM_IPSEC_MAX_SA_COUNT) 73 return -ENOSPC; 74 75 /* search sa table */ 76 for (i = 0; i < NSIM_IPSEC_MAX_SA_COUNT; i++) { 77 if (!ipsec->sa[i].used) 78 return i; 79 } 80 81 return -ENOSPC; 82 } 83 84 static int nsim_ipsec_parse_proto_keys(struct xfrm_state *xs, 85 u32 *mykey, u32 *mysalt) 86 { 87 const char aes_gcm_name[] = "rfc4106(gcm(aes))"; 88 struct net_device *dev = xs->xso.real_dev; 89 unsigned char *key_data; 90 char *alg_name = NULL; 91 int key_len; 92 93 if (!xs->aead) { 94 netdev_err(dev, "Unsupported IPsec algorithm\n"); 95 return -EINVAL; 96 } 97 98 if (xs->aead->alg_icv_len != NSIM_IPSEC_AUTH_BITS) { 99 netdev_err(dev, "IPsec offload requires %d bit authentication\n", 100 NSIM_IPSEC_AUTH_BITS); 101 return -EINVAL; 102 } 103 104 key_data = &xs->aead->alg_key[0]; 105 key_len = xs->aead->alg_key_len; 106 alg_name = xs->aead->alg_name; 107 108 if (strcmp(alg_name, aes_gcm_name)) { 109 netdev_err(dev, "Unsupported IPsec algorithm - please use %s\n", 110 aes_gcm_name); 111 return -EINVAL; 112 } 113 114 /* 160 accounts for 16 byte key and 4 byte salt */ 115 if (key_len > NSIM_IPSEC_AUTH_BITS) { 116 *mysalt = ((u32 *)key_data)[4]; 117 } else if (key_len == NSIM_IPSEC_AUTH_BITS) { 118 *mysalt = 0; 119 } else { 120 netdev_err(dev, "IPsec hw offload only supports 128 bit keys with optional 32 bit salt\n"); 121 return -EINVAL; 122 } 123 memcpy(mykey, key_data, 16); 124 125 return 0; 126 } 127 128 static int nsim_ipsec_add_sa(struct xfrm_state *xs) 129 { 130 struct nsim_ipsec *ipsec; 131 struct net_device *dev; 132 struct netdevsim *ns; 133 struct nsim_sa sa; 134 u16 sa_idx; 135 int ret; 136 137 dev = xs->xso.real_dev; 138 ns = netdev_priv(dev); 139 ipsec = &ns->ipsec; 140 141 if (xs->id.proto != IPPROTO_ESP && xs->id.proto != IPPROTO_AH) { 142 netdev_err(dev, "Unsupported protocol 0x%04x for ipsec offload\n", 143 xs->id.proto); 144 return -EINVAL; 145 } 146 147 if (xs->calg) { 148 netdev_err(dev, "Compression offload not supported\n"); 149 return -EINVAL; 150 } 151 152 /* find the first unused index */ 153 ret = nsim_ipsec_find_empty_idx(ipsec); 154 if (ret < 0) { 155 netdev_err(dev, "No space for SA in Rx table!\n"); 156 return ret; 157 } 158 sa_idx = (u16)ret; 159 160 memset(&sa, 0, sizeof(sa)); 161 sa.used = true; 162 sa.xs = xs; 163 164 if (sa.xs->id.proto & IPPROTO_ESP) 165 sa.crypt = xs->ealg || xs->aead; 166 167 /* get the key and salt */ 168 ret = nsim_ipsec_parse_proto_keys(xs, sa.key, &sa.salt); 169 if (ret) { 170 netdev_err(dev, "Failed to get key data for SA table\n"); 171 return ret; 172 } 173 174 if (xs->xso.flags & XFRM_OFFLOAD_INBOUND) { 175 sa.rx = true; 176 177 if (xs->props.family == AF_INET6) 178 memcpy(sa.ipaddr, &xs->id.daddr.a6, 16); 179 else 180 memcpy(&sa.ipaddr[3], &xs->id.daddr.a4, 4); 181 } 182 183 /* the preparations worked, so save the info */ 184 memcpy(&ipsec->sa[sa_idx], &sa, sizeof(sa)); 185 186 /* the XFRM stack doesn't like offload_handle == 0, 187 * so add a bitflag in case our array index is 0 188 */ 189 xs->xso.offload_handle = sa_idx | NSIM_IPSEC_VALID; 190 ipsec->count++; 191 192 return 0; 193 } 194 195 static void nsim_ipsec_del_sa(struct xfrm_state *xs) 196 { 197 struct netdevsim *ns = netdev_priv(xs->xso.real_dev); 198 struct nsim_ipsec *ipsec = &ns->ipsec; 199 u16 sa_idx; 200 201 sa_idx = xs->xso.offload_handle & ~NSIM_IPSEC_VALID; 202 if (!ipsec->sa[sa_idx].used) { 203 netdev_err(ns->netdev, "Invalid SA for delete sa_idx=%d\n", 204 sa_idx); 205 return; 206 } 207 208 memset(&ipsec->sa[sa_idx], 0, sizeof(struct nsim_sa)); 209 ipsec->count--; 210 } 211 212 static bool nsim_ipsec_offload_ok(struct sk_buff *skb, struct xfrm_state *xs) 213 { 214 struct netdevsim *ns = netdev_priv(xs->xso.real_dev); 215 struct nsim_ipsec *ipsec = &ns->ipsec; 216 217 ipsec->ok++; 218 219 return true; 220 } 221 222 static const struct xfrmdev_ops nsim_xfrmdev_ops = { 223 .xdo_dev_state_add = nsim_ipsec_add_sa, 224 .xdo_dev_state_delete = nsim_ipsec_del_sa, 225 .xdo_dev_offload_ok = nsim_ipsec_offload_ok, 226 }; 227 228 bool nsim_ipsec_tx(struct netdevsim *ns, struct sk_buff *skb) 229 { 230 struct sec_path *sp = skb_sec_path(skb); 231 struct nsim_ipsec *ipsec = &ns->ipsec; 232 struct xfrm_state *xs; 233 struct nsim_sa *tsa; 234 u32 sa_idx; 235 236 /* do we even need to check this packet? */ 237 if (!sp) 238 return true; 239 240 if (unlikely(!sp->len)) { 241 netdev_err(ns->netdev, "no xfrm state len = %d\n", 242 sp->len); 243 return false; 244 } 245 246 xs = xfrm_input_state(skb); 247 if (unlikely(!xs)) { 248 netdev_err(ns->netdev, "no xfrm_input_state() xs = %p\n", xs); 249 return false; 250 } 251 252 sa_idx = xs->xso.offload_handle & ~NSIM_IPSEC_VALID; 253 if (unlikely(sa_idx >= NSIM_IPSEC_MAX_SA_COUNT)) { 254 netdev_err(ns->netdev, "bad sa_idx=%d max=%d\n", 255 sa_idx, NSIM_IPSEC_MAX_SA_COUNT); 256 return false; 257 } 258 259 tsa = &ipsec->sa[sa_idx]; 260 if (unlikely(!tsa->used)) { 261 netdev_err(ns->netdev, "unused sa_idx=%d\n", sa_idx); 262 return false; 263 } 264 265 if (xs->id.proto != IPPROTO_ESP && xs->id.proto != IPPROTO_AH) { 266 netdev_err(ns->netdev, "unexpected proto=%d\n", xs->id.proto); 267 return false; 268 } 269 270 ipsec->tx++; 271 272 return true; 273 } 274 275 void nsim_ipsec_init(struct netdevsim *ns) 276 { 277 ns->netdev->xfrmdev_ops = &nsim_xfrmdev_ops; 278 279 #define NSIM_ESP_FEATURES (NETIF_F_HW_ESP | \ 280 NETIF_F_HW_ESP_TX_CSUM | \ 281 NETIF_F_GSO_ESP) 282 283 ns->netdev->features |= NSIM_ESP_FEATURES; 284 ns->netdev->hw_enc_features |= NSIM_ESP_FEATURES; 285 286 ns->ipsec.pfile = debugfs_create_file("ipsec", 0400, 287 ns->nsim_dev_port->ddir, ns, 288 &ipsec_dbg_fops); 289 } 290 291 void nsim_ipsec_teardown(struct netdevsim *ns) 292 { 293 struct nsim_ipsec *ipsec = &ns->ipsec; 294 295 if (ipsec->count) 296 netdev_err(ns->netdev, "tearing down IPsec offload with %d SAs left\n", 297 ipsec->count); 298 debugfs_remove_recursive(ipsec->pfile); 299 } 300