Message-Id: <20220906052129.104507-1-saeed@kernel.org>
Date:   Mon,  5 Sep 2022 22:21:12 -0700
From:   Saeed Mahameed <saeed@...nel.org>
To:     "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Eric Dumazet <edumazet@...gle.com>
Cc:     Saeed Mahameed <saeedm@...dia.com>, netdev@...r.kernel.org,
        Tariq Toukan <tariqt@...dia.com>
Subject: [PATCH net-next V2 00/17] Introduce MACsec skb_metadata_dst and mlx5 macsec offload

From: Saeed Mahameed <saeedm@...dia.com>

v1->v2:
   - attach mlx5 implementation patches.  

This patchset introduces MACsec skb_metadata_dst to lay the ground
for MACsec HW offload.

MACsec is an IEEE standard (IEEE 802.1AE) for MAC security.
It defines a way to establish a protocol independent connection
between two hosts with data confidentiality, authenticity and/or
integrity, using GCM-AES. MACsec operates on the Ethernet layer and
as such is a layer 2 protocol, which means it’s designed to secure
traffic within a layer 2 network, including DHCP or ARP requests.

Linux has a software implementation of the MACsec standard and
HW offloading support.
The offloading is re-using the logic, netlink API and data
structures of the existing MACsec software implementation.

For Tx:
In the current MACsec offload implementation, MACsec interfaces shares
the same MAC address by default.
Therefore, HW can't distinguish from which MACsec interface the traffic
originated from.

MACsec stack will use skb_metadata_dst to store the SCI value, which is
unique per MACsec interface, skb_metadat_dst will be used later by the
offloading device driver to associate the SKB with the corresponding
offloaded interface (SCI) to facilitate HW MACsec offload.

For Rx:
Like in the Tx changes, if there are more than one MACsec device with
the same MAC address as in the packet's destination MAC, the packet will
be forward only to one of the devices and not neccessarly to the desired one.

Offloading device driver sets the MACsec skb_metadata_dst sci
field with the appropriaate Rx SCI for each SKB so the MACsec rx handler
will know to which port to divert those skbs, instead of wrongly solely
relaying on dst MAC address comparison.

1) patch 1,2, Add support to skb_metadata_dst in MACsec code:
net/macsec: Add MACsec skb_metadata_dst Tx Data path support
net/macsec: Add MACsec skb_metadata_dst Rx Data path support

2) patch 3, Move some MACsec driver code for sharing with various
drivers that implements offload:
net/macsec: Move some code for sharing with various drivers that
implements offload

3) The rest of the patches introduce mlx5 implementation for macsec
offloads TX and RX via steering tables.
  a) TX, intercept skbs with macsec offlad mark in skb_metadata_dst and mark
the descriptor for offload.
  b) RX, intercept offloaded frames and prepare the proper
skb_metadata_dst to mark offloaded rx frames.

Lior Nahmanson (17):
  net/macsec: Add MACsec skb_metadata_dst Tx Data path support
  net/macsec: Add MACsec skb_metadata_dst Rx Data path support
  net/macsec: Move some code for sharing with various drivers that
    implements offload
  net/mlx5: Removed esp_id from struct mlx5_flow_act
  net/mlx5: Generalize Flow Context for new crypto fields
  net/mlx5: Introduce MACsec Connect-X offload hardware bits and
    structures
  net/mlx5: Add MACsec offload Tx command support
  net/mlx5: Add MACsec Tx tables support to fs_core
  net/mlx5e: Add MACsec TX steering rules
  net/mlx5e: Implement MACsec Tx data path using MACsec skb_metadata_dst
  net/mlx5e: Add MACsec offload Rx command support
  net/mlx5: Add MACsec Rx tables support to fs_core
  net/mlx5e: Add MACsec RX steering rules
  net/mlx5e: Implement MACsec Rx data path using MACsec skb_metadata_dst
  net/mlx5e: Add MACsec offload SecY support
  net/mlx5e: Add MACsec stats support for Rx/Tx flows
  net/mlx5e: Add support to configure more than one macsec offload
    device

 .../net/ethernet/mellanox/mlx5/core/Kconfig   |    8 +
 .../net/ethernet/mellanox/mlx5/core/Makefile  |    3 +
 drivers/net/ethernet/mellanox/mlx5/core/en.h  |    3 +
 .../mellanox/mlx5/core/en_accel/en_accel.h    |   15 +
 .../mellanox/mlx5/core/en_accel/ipsec_fs.c    |    9 +-
 .../mellanox/mlx5/core/en_accel/ipsec_rxtx.h  |    4 +-
 .../mellanox/mlx5/core/en_accel/macsec.c      | 1332 ++++++++++++++++
 .../mellanox/mlx5/core/en_accel/macsec.h      |   72 +
 .../mellanox/mlx5/core/en_accel/macsec_fs.c   | 1384 +++++++++++++++++
 .../mellanox/mlx5/core/en_accel/macsec_fs.h   |   47 +
 .../mlx5/core/en_accel/macsec_stats.c         |   72 +
 .../net/ethernet/mellanox/mlx5/core/en_main.c |    7 +
 .../net/ethernet/mellanox/mlx5/core/en_rx.c   |    4 +
 .../ethernet/mellanox/mlx5/core/en_stats.c    |    3 +
 .../ethernet/mellanox/mlx5/core/en_stats.h    |    1 +
 .../net/ethernet/mellanox/mlx5/core/en_tx.c   |    3 +-
 .../net/ethernet/mellanox/mlx5/core/fs_cmd.c  |    9 +-
 .../net/ethernet/mellanox/mlx5/core/fs_core.c |   31 +-
 drivers/net/ethernet/mellanox/mlx5/core/fw.c  |    7 +
 .../ethernet/mellanox/mlx5/core/lib/mlx5.h    |    1 +
 .../net/ethernet/mellanox/mlx5/core/main.c    |    1 +
 drivers/net/macsec.c                          |   54 +-
 include/linux/mlx5/device.h                   |    4 +
 include/linux/mlx5/fs.h                       |   12 +-
 include/linux/mlx5/mlx5_ifc.h                 |  111 +-
 include/linux/mlx5/qp.h                       |    1 +
 include/net/dst_metadata.h                    |   10 +
 include/net/macsec.h                          |   25 +
 28 files changed, 3180 insertions(+), 53 deletions(-)
 create mode 100644 drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c
 create mode 100644 drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.h
 create mode 100644 drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec_fs.c
 create mode 100644 drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec_fs.h
 create mode 100644 drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec_stats.c

-- 
2.37.2

Powered by blists - more mailing lists