[qca-nss-clients] Moved files from qca-nss-drv to qca-nss-clients
Moved files from qca-nss-drv to qca-nss-clients
Signed-off-by: Sundarajan Srinivasan <sundaraj@codeaurora.org>
Change-Id: I6f7ca642b71cbf890422d728038ce0caa32b29c0
diff --git a/nss_ipsecmgr.c b/nss_ipsecmgr.c
new file mode 100644
index 0000000..988807d
--- /dev/null
+++ b/nss_ipsecmgr.c
@@ -0,0 +1,1262 @@
+/*
+ **************************************************************************
+ * Copyright (c) 2014, The Linux Foundation. All rights reserved.
+ * Permission to use, copy, modify, and/or distribute this software for
+ * any purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all copies.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+ * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ **************************************************************************
+ */
+
+/* nss_ipsecmgr.c
+ * NSS to HLOS IPSec Manager
+ */
+#include <linux/types.h>
+#include <linux/ip.h>
+#include <linux/skbuff.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/rtnetlink.h>
+#include <asm/atomic.h>
+#include <nss_api_if.h>
+#include <nss_ipsec.h>
+#include "nss_ipsecmgr.h"
+
+#if defined(CONFIG_DYNAMIC_DEBUG)
+/*
+ * Compile messages for dynamic enable/disable
+ */
+#define nss_ipsecmgr_error(s, ...) pr_debug("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
+#define nss_ipsecmgr_warn(s, ...) pr_debug("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
+#define nss_ipsecmgr_info(s, ...) pr_debug("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
+#define nss_ipsecmgr_trace(s, ...) pr_debug("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__)
+
+#else
+/*
+ * Statically compile messages at different levels
+ */
+#define nss_ipsecmgr_error(s, ...) { \
+ if (NSS_IPSECMGR_DEBUG_LEVEL < NSS_IPSECMGR_DEBUG_LVL_ERROR) { \
+ pr_alert("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__); \
+ } \
+}
+#define nss_ipsecmgr_warn(s, ...) { \
+ if (NSS_IPSECMGR_DEBUG_LEVEL < NSS_IPSECMGR_DEBUG_LVL_WARN) { \
+ pr_warn("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__); \
+ } \
+}
+#define nss_ipsecmgr_info(s, ...) { \
+ if (NSS_IPSECMGR_DEBUG_LEVEL < NSS_IPSECMGR_DEBUG_LVL_INFO) { \
+ pr_notice("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__); \
+ } \
+}
+#define nss_ipsecmgr_trace(s, ...) { \
+ if (NSS_IPSECMGR_DEBUG_LEVEL < NSS_IPSECMGR_DEBUG_LVL_TRACE) { \
+ pr_info("%s[%d]:" s, __FUNCTION__, __LINE__, ##__VA_ARGS__); \
+ } \
+}
+
+#endif /* !CONFIG_DYNAMIC_DEBUG */
+
+/* NSS IPsec entry state */
+enum nss_ipsecmgr_entry_state {
+ NSS_IPSECMGR_ENTRY_STATE_INIT = 0, /* init state of the entry */
+ NSS_IPSECMGR_ENTRY_STATE_VALID = 1, /* entry is valid */
+ NSS_IPSECMGR_ENTRY_STATE_INVALID = 2, /* entry is invalid */
+ NSS_IPSECMGR_ENTRY_STATE_MAX
+};
+
+/* IPsec table entry */
+struct nss_ipsecmgr_tbl_entry {
+ struct nss_ipsec_rule_sel sel; /* rule selector */
+ uint32_t sa_idx; /* index into SA table for this rule */
+ enum nss_ipsecmgr_entry_state state; /* state */
+};
+
+/* NSS IPsec table type */
+struct nss_ipsecmgr_tbl {
+ uint32_t total_tx; /* total packets tx'ed from ENCAP/DECAP */
+ uint32_t total_rx; /* total packets rx'ed at ENCAP/DECAP */
+ uint32_t total_dropped; /* total dropped packets at ENCAP/DECAP */
+ struct nss_ipsecmgr_tbl_entry entry[NSS_IPSEC_MAX_RULES]; /* table entry */
+ uint32_t count; /* number of entries */
+ spinlock_t lock;
+};
+
+/* NSS IPsec SA */
+struct nss_ipsec_sa {
+ atomic_t user; /* reference count */
+ uint32_t esp_spi; /* ESP SPI */
+
+ enum nss_ipsecmgr_rule_type type; /* IPsec rule type (ENCAP/DECAP) */
+
+ struct nss_ipsec_rule_data data; /* IPsec rule data */
+ struct nss_ipsec_sa_stats stats; /* SA statistics */
+};
+
+/* NSS IPsec manager private structure */
+struct nss_ipsecmgr_priv {
+ struct nss_ipsecmgr_tbl encap; /* encap table */
+ struct nss_ipsecmgr_tbl decap; /* decap table */
+ struct nss_ipsec_sa sa_tbl[NSS_IPSEC_MAX_SA]; /* global SA table */
+
+ void *cb_ctx; /* callback context */
+ nss_ipsecmgr_data_cb_t data_cb; /* data callback function */
+ nss_ipsecmgr_event_cb_t event_cb; /* event callback function */
+ struct nss_ctx_instance *nss_ctx; /* NSS context */
+ uint32_t nss_ifnum; /* NSS if num for data */
+};
+
+typedef bool (*nss_ipsecmgr_op_t)(struct net_device *dev, struct nss_ipsecmgr_tbl *tbl, struct nss_ipsec_msg *nim);
+
+/* NSS IPsec manager operation (message types) complete routines */
+struct nss_ipsecmgr_ops {
+ nss_ipsecmgr_op_t verify_fn; /* verify function for the op */
+ nss_ipsecmgr_op_t commit_fn; /* commit function for the op */
+};
+
+/* driver global info */
+struct nss_ipsecmgr_drv {
+ atomic_t sa_count; /* number of SA's available for */
+};
+
+/*
+ **********************
+ * globals
+ **********************
+ */
+
+static struct nss_ipsecmgr_drv gbl_drv_ctx; /* global driver context */
+
+/*
+ **********************
+ * Helper Functions
+ **********************
+ */
+
+/*
+ * nss_ipsecmgr_sa_init()
+ * Initialize SA
+ */
+static void nss_ipsecmgr_sa_init(struct nss_ipsec_sa *sa)
+{
+ memset(sa, 0, sizeof(struct nss_ipsec_sa));
+ atomic_set(&sa->user, 0);
+}
+
+/*
+ * nss_ipsecmgr_sa_get()
+ * Get reference to SA at given index
+ */
+static struct nss_ipsec_sa *nss_ipsecmgr_sa_get(struct nss_ipsec_sa sa_tbl[], uint32_t sa_idx)
+{
+ struct nss_ipsec_sa *sa = &sa_tbl[sa_idx];
+
+ atomic_inc(&sa->user);
+
+ return sa;
+}
+
+/*
+ * nss_ipsecmgr_sa_put()
+ * Release reference to SA at given index
+ */
+static void nss_ipsecmgr_sa_put(struct nss_ipsec_sa sa_tbl[], uint32_t sa_idx)
+{
+ struct nss_ipsec_sa *sa = &sa_tbl[sa_idx];
+
+ if (atomic_read(&sa->user) == 0) {
+ nss_ipsecmgr_error("SA already freed for (%d)\n", sa_idx);
+ return;
+ }
+
+ if (atomic_dec_and_test(&sa->user)) {
+ nss_ipsecmgr_sa_init(sa);
+ }
+}
+
+/*
+ * nss_ipsecmgr_get_type()
+ * Get IPsec manager rule type (encap/decap)
+ */
+static enum nss_ipsecmgr_rule_type nss_ipsecmgr_get_type(uint16_t if_num)
+{
+ switch(if_num) {
+ case NSS_IPSEC_ENCAP_IF_NUMBER:
+ return NSS_IPSECMGR_RULE_TYPE_ENCAP;
+
+ case NSS_IPSEC_DECAP_IF_NUMBER:
+ return NSS_IPSECMGR_RULE_TYPE_DECAP;
+
+ default:
+ return NSS_IPSECMGR_RULE_TYPE_NONE;
+ }
+}
+
+/*
+ * nss_ipsecmgr_get_tbl()
+ * return the table associated with the interface number
+ */
+static inline struct nss_ipsecmgr_tbl *nss_ipsecmgr_get_tbl(struct nss_ipsecmgr_priv *priv, uint16_t if_num)
+{
+ switch (if_num) {
+ case NSS_IPSEC_ENCAP_IF_NUMBER:
+ return &priv->encap;
+
+ case NSS_IPSEC_DECAP_IF_NUMBER:
+ return &priv->decap;
+
+ default:
+ return NULL;
+ }
+}
+
+/*
+ * nss_ipsecmgr_copy_encap_add()
+ * prepare the IPsec message for encap add operation
+ */
+static void nss_ipsecmgr_copy_encap_add(struct net_device *dev, struct nss_ipsec_rule *msg, union nss_ipsecmgr_rule *rule)
+{
+ struct nss_ipsecmgr_encap_add *encap = &rule->encap_add;
+ struct nss_ipsec_rule_sel *sel = &msg->sel;
+ struct nss_ipsec_rule_oip *oip = &msg->oip;
+ struct nss_ipsec_rule_data *data = &msg->data;
+
+ /*
+ * Populate the selectors for encap direction
+ */
+ sel->ipv4_src = encap->inner_ipv4_src;
+ sel->ipv4_dst = encap->inner_ipv4_dst;
+
+ sel->src_port = encap->inner_src_port;
+ sel->dst_port = encap->inner_dst_port;
+
+ sel->ipv4_proto = encap->inner_ipv4_proto;
+
+ /*
+ * Populate the outer IP data for encap direction
+ */
+ oip->ipv4_dst = encap->outer_ipv4_dst;
+ oip->ipv4_src = encap->outer_ipv4_src;
+
+ oip->esp_spi = encap->esp_spi;
+
+ oip->ipv4_ttl = encap->outer_ipv4_ttl;
+
+ /*
+ * Populate the data part
+ */
+ data->cipher_algo = encap->cipher_algo;
+ data->esp_seq_skip = (encap->esp_seq_skip == 1);
+ data->esp_tail_skip = (encap->esp_tail_skip == 1);
+
+ data->esp_icv_len = encap->esp_icv_len;
+ data->auth_algo = encap->auth_algo;
+
+ data->crypto_index = encap->crypto_index;
+
+ data->nat_t_req = encap->nat_t_req;
+ data->use_pattern = encap->use_pattern;
+}
+
+/*
+ * nss_ipsecmgr_copy_decap_add()
+ * prepare the IPsec message for decap add operation
+ */
+static void nss_ipsecmgr_copy_decap_add(struct net_device *dev, struct nss_ipsec_rule *msg, union nss_ipsecmgr_rule *rule)
+{
+ struct nss_ipsecmgr_decap_add *decap = &rule->decap_add;
+ struct nss_ipsec_rule_sel *sel = &msg->sel;
+ struct nss_ipsec_rule_data *data = &msg->data;
+ /*
+ * Populate the selectors for encap direction
+ */
+ sel->ipv4_src = decap->outer_ipv4_src;
+ sel->ipv4_dst = decap->outer_ipv4_dst;
+
+ sel->esp_spi = decap->esp_spi;
+
+ sel->ipv4_proto = IPPROTO_ESP;
+
+ /*
+ * Populate the data part
+ */
+ data->cipher_algo = decap->cipher_algo;
+
+ data->esp_icv_len = decap->esp_icv_len;
+ data->esp_seq_skip = (decap->esp_seq_skip == 1);
+ data->esp_tail_skip = (decap->esp_tail_skip == 1);
+ data->auth_algo = decap->auth_algo;
+
+ data->crypto_index = decap->crypto_index;
+
+ data->nat_t_req = decap->nat_t_req;
+ if (data->nat_t_req) {
+ sel->dst_port = NSS_IPSECMGR_NATT_PORT_DATA;
+ }
+
+ data->window_size = decap->window_size;
+}
+
+/*
+ * nss_ipsecmgr_copy_encap_del()
+ * prepare the IPsec message for encap del operation
+ */
+static void nss_ipsecmgr_copy_encap_del(struct net_device *dev, struct nss_ipsec_rule *msg, union nss_ipsecmgr_rule *rule)
+{
+ struct nss_ipsecmgr_encap_del *encap = &rule->encap_del;
+ struct nss_ipsec_rule_sel *sel = &msg->sel;
+
+ /*
+ * Populate the selectors for encap direction
+ */
+ sel->ipv4_src = encap->inner_ipv4_src;
+ sel->ipv4_dst = encap->inner_ipv4_dst;
+
+ sel->src_port = encap->inner_src_port;
+ sel->dst_port = encap->inner_dst_port;
+
+ sel->ipv4_proto = encap->inner_ipv4_proto;
+}
+
+/*
+ * nss_ipsecmgr_copy_decap_del()
+ * prepare the IPsec message for decap del operation
+ */
+static void nss_ipsecmgr_copy_decap_del(struct net_device *dev, struct nss_ipsec_rule *msg, union nss_ipsecmgr_rule *rule)
+{
+ struct nss_ipsecmgr_decap_del *decap = &rule->decap_del;
+ struct nss_ipsec_rule_sel *sel = &msg->sel;
+ /*
+ * Populate the selectors for encap direction
+ */
+ sel->ipv4_src = decap->outer_ipv4_src;
+ sel->ipv4_dst = decap->outer_ipv4_dst;
+
+ sel->esp_spi = decap->esp_spi;
+
+ sel->ipv4_proto = IPPROTO_ESP;
+}
+
+/*
+ **********************
+ * message handlers
+ **********************
+ */
+/*
+ * nss_ipsecmgr_verify_add()
+ * verify the Add operation before committing
+ */
+static bool nss_ipsecmgr_verify_add(struct net_device *dev, struct nss_ipsecmgr_tbl *tbl, struct nss_ipsec_msg *nim)
+{
+ struct nss_ipsec_rule *rule = &nim->msg.push;
+ struct nss_ipsecmgr_tbl_entry *entry;
+ uint32_t tbl_idx;
+
+ tbl_idx = rule->rule_idx;
+ if (tbl_idx >= NSS_IPSEC_MAX_RULES) {
+ nss_ipsecmgr_error("table index out of range\n");
+ return false;
+ }
+
+ entry = &tbl->entry[tbl_idx];
+
+ /*
+ * XXX:Duplicate hit or hash collision; We need to handle
+ * hash collision
+ */
+ if (entry->state == NSS_IPSECMGR_ENTRY_STATE_VALID) {
+ return false;
+ }
+
+ /*
+ * Table full, XXX:must increment stats
+ */
+ if ((tbl->count + 1) >= NSS_IPSEC_MAX_RULES) {
+ return false;
+ }
+
+ return true;
+}
+
+/*
+ * nss_ipsecmgr_commit_add()
+ * commit the Add operation
+ */
+static bool nss_ipsecmgr_commit_add(struct net_device *dev, struct nss_ipsecmgr_tbl *tbl, struct nss_ipsec_msg *nim)
+{
+ struct nss_ipsec_rule *rule = &nim->msg.push;
+ struct nss_ipsecmgr_tbl_entry *entry;
+ struct nss_ipsecmgr_priv *priv;
+ struct nss_ipsec_sa *sa;
+ uint32_t tbl_idx;
+ uint32_t sa_idx;
+
+ priv = netdev_priv(dev);
+
+ /* Reduce the number of availabe SA(s) as we have successfully added one */
+ atomic_dec(&gbl_drv_ctx.sa_count);
+
+ tbl_idx = rule->rule_idx;
+ entry = &tbl->entry[tbl_idx];
+
+ tbl->count++;
+
+ memcpy(&entry->sel, &rule->sel, sizeof(struct nss_ipsec_rule_sel));
+ entry->state = NSS_IPSECMGR_ENTRY_STATE_VALID;
+
+ /* increment SA use count */
+ sa_idx = rule->sa_idx;
+ sa = nss_ipsecmgr_sa_get(priv->sa_tbl, sa_idx);
+
+ /* copy rule data to SA */
+ memcpy(&sa->data, &rule->data, sizeof(struct nss_ipsec_rule_data));
+
+ /* save rule type (encap/decap) */
+ sa->type = nss_ipsecmgr_get_type(nim->cm.interface);
+
+ /* save ESP SPI in SA */
+ switch (nim->cm.interface) {
+ case NSS_IPSEC_ENCAP_IF_NUMBER:
+ sa->esp_spi = rule->oip.esp_spi;
+ break;
+
+ case NSS_IPSEC_DECAP_IF_NUMBER:
+ sa->esp_spi = rule->sel.esp_spi;
+ break;
+
+ default:
+ nss_ipsecmgr_error("invalid interface num = %d\n", nim->cm.interface);
+ return false;
+ }
+
+ /* save SA table index for this rule entry */
+ entry->sa_idx = sa_idx;
+
+ return true;
+}
+
+/*
+ * nss_ipsecmgr_verify_del()
+ * verify the del operation before committing
+ */
+static bool nss_ipsecmgr_verify_del(struct net_device *dev, struct nss_ipsecmgr_tbl *tbl, struct nss_ipsec_msg *nim)
+{
+ struct nss_ipsec_rule *rule = &nim->msg.push;
+ struct nss_ipsecmgr_tbl_entry *entry;
+ uint32_t tbl_idx;
+
+ tbl_idx = rule->rule_idx;
+ if (tbl_idx >= NSS_IPSEC_MAX_RULES) {
+ nss_ipsecmgr_error("table index out of range\n");
+ return false;
+ }
+
+ entry = &tbl->entry[tbl_idx];
+
+ /*
+ * Entry already deleted, XXX:must increment stats
+ */
+ if (entry->state == NSS_IPSECMGR_ENTRY_STATE_INVALID) {
+ return false;
+ }
+
+ /*
+ * Entry never existed, XXX:must increment stats
+ */
+ if (entry->state == NSS_IPSECMGR_ENTRY_STATE_INIT) {
+ return false;
+ }
+
+ /*
+ * Table empty, XXX:must increment stats
+ */
+ if (tbl->count == 0) {
+ return false;
+ }
+
+ return true;
+}
+
+/*
+ * nss_ipsecmgr_commit_del()
+ * commit the Del operation
+ */
+static bool nss_ipsecmgr_commit_del(struct net_device *dev, struct nss_ipsecmgr_tbl *tbl, struct nss_ipsec_msg *nim)
+{
+ struct nss_ipsec_rule *rule = &nim->msg.push;
+ struct nss_ipsecmgr_tbl_entry *entry;
+ struct nss_ipsecmgr_priv *priv;
+ uint32_t tbl_idx;
+ uint32_t sa_idx;
+
+ priv = netdev_priv(dev);
+
+ /* Increase the number of available SA(s) as we have successfully freed one */
+ atomic_inc(&gbl_drv_ctx.sa_count);
+
+ tbl_idx = rule->rule_idx;
+ entry = &tbl->entry[tbl_idx];
+
+ tbl->count--;
+
+ memset(&entry->sel, 0, sizeof(struct nss_ipsec_rule_sel));
+ entry->state = NSS_IPSECMGR_ENTRY_STATE_INVALID;
+
+ /* decrement SA use count */
+ sa_idx = rule->sa_idx;
+ nss_ipsecmgr_sa_put(priv->sa_tbl, sa_idx);
+
+ return true;
+}
+
+/*
+ * nss_ipsecmgr_verify_stats()
+ * verify stats update operation
+ */
+static bool nss_ipsecmgr_verify_stats(struct net_device *dev, struct nss_ipsecmgr_tbl *tbl, struct nss_ipsec_msg *nim)
+{
+ struct nss_ipsec_sa_stats *msg_sa_stats = &nim->msg.stats;
+
+ /*
+ * Table empty, nothing to update
+ */
+ if (tbl->count == 0) {
+ return false;
+ }
+
+ if (msg_sa_stats->sa_idx > NSS_CRYPTO_MAX_IDXS) {
+ return false;
+ }
+
+ return true;
+}
+
+/*
+ * nss_ipsecmgr_commit_stats()
+ * commit stats for the SA
+ */
+static bool nss_ipsecmgr_commit_stats(struct net_device *dev, struct nss_ipsecmgr_tbl *tbl, struct nss_ipsec_msg *nim)
+{
+ struct nss_ipsec_sa_stats *msg_stats = &nim->msg.stats;
+ struct nss_ipsec_sa_stats *sa_stats;
+ struct nss_ipsec_sa *sa;
+ struct nss_ipsecmgr_priv *priv;
+ struct nss_ipsecmgr_event event = {.type = NSS_IPSECMGR_EVENT_SA_STATS};
+ struct nss_ipsecmgr_sa_stats *event_stats = &event.data.stats;
+ nss_ipsecmgr_event_cb_t event_cb;
+ void *cb_ctx;
+ uint32_t sa_idx;
+
+ priv = netdev_priv(dev);
+
+ /* get reference to SA stats */
+ sa_idx = msg_stats->sa_idx;
+ sa = nss_ipsecmgr_sa_get(priv->sa_tbl, sa_idx);
+
+ sa_stats = &sa->stats;
+
+ /* copy SA statistics */
+ sa_stats->seqnum = msg_stats->seqnum;
+ memcpy(&sa_stats->pkts, &msg_stats->pkts, sizeof(struct nss_ipsec_pkt_stats));
+
+ /* execute event callback to send SA stats event */
+ event_cb = priv->event_cb;
+ cb_ctx = priv->cb_ctx;
+ if (event_cb && cb_ctx) {
+ event_stats->esp_spi = sa->esp_spi;
+ event_stats->seqnum = sa_stats->seqnum;
+ event_stats->crypto_index = sa->data.crypto_index;
+ event_stats->type = sa->type;
+
+ event_stats->pkts_processed = sa_stats->pkts.processed;
+ event_stats->pkts_dropped = sa_stats->pkts.dropped;
+ event_stats->pkts_failed = sa_stats->pkts.failed;
+
+ event_cb(cb_ctx, &event);
+ }
+
+ /* decrement SA use count */
+ nss_ipsecmgr_sa_put(priv->sa_tbl, sa_idx);
+
+ return true;
+}
+
+/*
+ * nss_ipsecmgr_verify_flush()
+ * verify the flush operation
+ */
+static bool nss_ipsecmgr_verify_flush(struct net_device *dev, struct nss_ipsecmgr_tbl *tbl, struct nss_ipsec_msg *nim)
+{
+ return true;
+}
+
+/*
+ * nss_ipsecmgr_commit_flush()
+ * commit the flush operation
+ */
+static bool nss_ipsecmgr_commit_flush(struct net_device *dev, struct nss_ipsecmgr_tbl *tbl, struct nss_ipsec_msg *nim)
+{
+ struct nss_ipsecmgr_priv *priv;
+ struct nss_ipsec_sa *sa;
+ int32_t count;
+
+ priv = netdev_priv(dev);
+
+ tbl->count = 0;
+
+ for (count = 0, sa = &priv->sa_tbl[0]; count < NSS_IPSEC_MAX_SA; count++, sa++) {
+ nss_ipsecmgr_sa_init(sa);
+ }
+
+ return true;
+}
+
+/*
+ * callback operation
+ */
+const static struct nss_ipsecmgr_ops cb_ops[NSS_IPSEC_MSG_TYPE_MAX] = {
+ [NSS_IPSEC_MSG_TYPE_ADD_RULE] = {nss_ipsecmgr_verify_add, nss_ipsecmgr_commit_add},
+ [NSS_IPSEC_MSG_TYPE_DEL_RULE] = {nss_ipsecmgr_verify_del, nss_ipsecmgr_commit_del},
+ [NSS_IPSEC_MSG_TYPE_SYNC_STATS] = {nss_ipsecmgr_verify_stats, nss_ipsecmgr_commit_stats},
+ [NSS_IPSEC_MSG_TYPE_FLUSH_TUN] = {nss_ipsecmgr_verify_flush, nss_ipsecmgr_commit_flush}
+};
+
+/*
+ * nss_ipsecmgr_op_receive()
+ * asynchronous event reception
+ */
+static void nss_ipsecmgr_op_receive(void *app_data, struct nss_ipsec_msg *nim)
+{
+ struct net_device *tun_dev = (struct net_device *)app_data;
+ struct nss_ipsecmgr_priv *priv;
+ struct nss_ipsecmgr_tbl *tbl;
+ nss_ipsecmgr_op_t verify_fn;
+ nss_ipsecmgr_op_t commit_fn;
+ struct net_device *dev;
+
+ BUG_ON(tun_dev == NULL);
+ BUG_ON(nim == NULL);
+
+ /* this holds the ref_cnt for the device */
+ dev = dev_get_by_index(&init_net, nim->tunnel_id);
+ if (dev == NULL) {
+ nss_ipsecmgr_error("event received on deallocated I/F (%d)\n", nim->tunnel_id);
+ return;
+ }
+
+ if (dev != tun_dev) {
+ nss_ipsecmgr_error("event received on incorrect I/F (%d)\n", nim->tunnel_id);
+ goto done;
+ }
+
+ priv = netdev_priv(dev);
+
+ tbl = nss_ipsecmgr_get_tbl(priv, nim->cm.interface);
+ if (tbl == NULL) {
+ nss_ipsecmgr_error("invalid interface number(%d)\n", nim->cm.interface);
+ goto done;
+ }
+
+ verify_fn = cb_ops[nim->cm.type].verify_fn;
+ commit_fn = cb_ops[nim->cm.type].commit_fn;
+
+ if (!verify_fn || !commit_fn) {
+ nss_ipsecmgr_error("unhandled type (%d)\n", nim->cm.type);
+ goto done;
+ }
+
+ /*
+ * Now we can operate on the entry of the table
+ */
+ spin_lock_bh(&tbl->lock);
+
+ if (verify_fn(dev, tbl, nim) == true) {
+ commit_fn(dev, tbl, nim);
+ }
+
+ spin_unlock_bh(&tbl->lock);
+done:
+ /* release the device as we are done */
+ dev_put(dev);
+}
+
+/*
+ * nss_ipsecmgr_op_send()
+ * Push a IPsec rule to NSS
+ */
+static bool nss_ipsecmgr_op_send(struct net_device *dev, struct nss_ipsec_msg *nim, uint32_t if_num, enum nss_ipsec_msg_type type)
+{
+ struct nss_ipsecmgr_priv *priv;
+ nss_tx_status_t status;
+
+ priv = netdev_priv(dev);
+ if (priv->nss_ctx == NULL) {
+ nss_ipsecmgr_error("Tunnel registration or de-registration is underway\n");
+ return false;
+ }
+
+ nim->tunnel_id = dev->ifindex;
+
+ nss_ipsec_msg_init(nim, if_num, type, NSS_IPSEC_MSG_LEN, (nss_ipsec_msg_callback_t *)nss_ipsecmgr_op_receive, dev);
+
+ status = nss_ipsec_tx_msg(priv->nss_ctx, nim);
+ if (status != NSS_TX_SUCCESS) {
+ nss_ipsecmgr_error("unable to push rule(%d) for %s\n", type, dev->name);
+ return false;
+ }
+
+ return true;
+}
+
+/*
+ * nss_ipsecmgr_buf_receive()
+ * receive NSS exception packets
+ */
+static void nss_ipsecmgr_buf_receive(struct net_device *dev, struct sk_buff *skb, __attribute((unused)) struct napi_struct *napi)
+{
+ struct nss_ipsecmgr_priv *priv;
+ nss_ipsecmgr_data_cb_t cb_fn;
+ void *cb_ctx;
+ struct iphdr *ip;
+
+ BUG_ON(dev == NULL);
+ BUG_ON(skb == NULL);
+
+ /* hold the device till we process it */
+ dev_hold(dev);
+
+ /*
+ * XXX:need to ensure that the dev being accessed is not deleted
+ */
+ priv = netdev_priv(dev);
+
+ skb->dev = dev;
+
+ cb_fn = priv->data_cb;
+ cb_ctx = priv->cb_ctx;
+
+ /*
+ * if tunnel creator gave a callback then send the packet without
+ * any modifications to him
+ */
+ if (cb_fn && cb_ctx) {
+ cb_fn(cb_ctx, skb);
+ goto done;
+ }
+
+ ip = (struct iphdr *)skb->data;
+ if ((ip->version != IPVERSION) || (ip->ihl != 5)) {
+ nss_ipsecmgr_error("dropping packets(IP version:%x, Header len:%x)\n", ip->version, ip->ihl);
+ dev_kfree_skb_any(skb);
+ goto done;
+ }
+
+ skb_reset_network_header(skb);
+ skb_reset_mac_header(skb);
+
+ skb->pkt_type = PACKET_HOST;
+ skb->protocol = cpu_to_be16(ETH_P_IP);
+ skb->skb_iif = dev->ifindex;
+
+ netif_receive_skb(skb);
+done:
+ /* release the device as we are done */
+ dev_put(dev);
+}
+
+/*
+ **********************
+ * Netdev ops
+ **********************
+ */
+
+/*
+ * nss_ipsecmgr_tunnel_init()
+ * initiallizes the tunnel
+ */
+static int nss_ipsecmgr_tunnel_init(struct net_device *dev)
+{
+ struct nss_ipsecmgr_priv *priv;
+
+ priv = netdev_priv(dev);
+
+ priv->nss_ctx = nss_ipsec_get_context();
+
+ return 0;
+}
+
+/*
+ * nss_ipsecmgr_tunnel_exit()
+ * deinitiallizes the tunnel
+ */
+static void nss_ipsecmgr_tunnel_exit(struct net_device *dev)
+{
+ struct nss_ipsecmgr_priv *priv;
+
+ priv = netdev_priv(dev);
+
+ priv->nss_ctx = NULL;
+}
+
+/*
+ * nss_ipsecmgr_tunnel_open()
+ * open the tunnel for usage
+ */
+static int nss_ipsecmgr_tunnel_open(struct net_device *dev)
+{
+ struct nss_ipsecmgr_priv *priv;
+
+ priv = netdev_priv(dev);
+
+ netif_start_queue(dev);
+
+ return 0;
+}
+
+/*
+ * nss_ipsecmgr_tunnel_stop()
+ * stop the IPsec tunnel
+ */
+static int nss_ipsecmgr_tunnel_stop(struct net_device *dev)
+{
+ struct nss_ipsecmgr_priv *priv;
+
+ priv = netdev_priv(dev);
+
+ netif_stop_queue(dev);
+
+ return 0;
+}
+
+/*
+ * nss_ipsecmgr_tunnel_xmit()
+ * tunnel transmit function
+ */
+static netdev_tx_t nss_ipsecmgr_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+ uint32_t if_num;
+ struct iphdr *inner_ip;
+ struct nss_ipsecmgr_priv *priv;
+ struct nss_ipsecmgr_tbl *encap;
+
+ if_num = NSS_IPSEC_ENCAP_IF_NUMBER;
+ priv = netdev_priv(dev);
+ encap = &priv->encap;
+
+ if (skb_is_nonlinear(skb)) {
+ nss_ipsecmgr_error("%p: NSS IPSEC does not support fragments %p\n", priv->nss_ctx, skb);
+ goto fail;
+ }
+
+ /*
+ * Check if skb is shared
+ */
+ if (unlikely(skb_shared(skb))) {
+ nss_ipsecmgr_error("%p: Shared skb is not supported: %p\n", priv->nss_ctx, skb);
+ goto fail;
+ }
+
+ /*
+ * Check the packet head room & tail room
+ */
+ if (unlikely(skb_headroom(skb) < dev->needed_headroom)) {
+ nss_ipsecmgr_error("%p: Insufficient head room :%d in skb: %p\n", priv->nss_ctx, skb_headroom(skb), skb);
+ goto fail;
+ }
+
+ if (unlikely(skb_tailroom(skb) < dev->needed_tailroom)) {
+ nss_ipsecmgr_error("%p: Insufficient tail room:%d in skb: %p\n", priv->nss_ctx, skb_tailroom(skb), skb);
+ goto fail;
+ }
+
+ /*
+ * Check if packet is given starting from network header
+ */
+ if (skb->data != skb_network_header(skb)) {
+ nss_ipsecmgr_error("%p: 'Skb data is not starting from IP header", priv->nss_ctx);
+ goto fail;
+ }
+
+ inner_ip = (struct iphdr *)ip_hdr(skb);
+
+ /*
+ * Validate if packet has ip options
+ */
+ if ((inner_ip->version != IPVERSION) || (inner_ip->ihl != 5)) {
+ nss_ipsecmgr_error("%p: Unsupported IP header ipver: 0x%x iphdr_len: 0x%x\n", priv->nss_ctx,
+ inner_ip->version, inner_ip->ihl);
+ goto fail;
+ }
+
+ /*
+ * Check the TTL value
+ */
+ if ((inner_ip->ttl == 0)) {
+ nss_ipsecmgr_error("%p: IP TTL is zero, unabled to transmit\n", priv->nss_ctx);
+ goto fail;
+ }
+
+ /*
+ * Send the packet down
+ */
+ if (nss_ipsec_tx_buf(skb, if_num) != 0) {
+ /*
+ * TODO: NEED TO STOP THE QUEUE
+ */
+ goto fail;
+ }
+
+ /*
+ * Increment the tx count
+ */
+ encap->total_tx++;
+
+ return NETDEV_TX_OK;
+
+fail:
+ return NETDEV_TX_BUSY;
+}
+
+/*
+ * nss_ipsecmgr_tunnel_stats()
+ * get tunnel statistics
+ */
+static struct net_device_stats *nss_ipsecmgr_tunnel_stats(struct net_device *dev)
+{
+ struct net_device_stats *stats = &dev->stats;
+ struct nss_ipsecmgr_priv *priv;
+ struct nss_ipsec_sa *sa;
+ uint32_t i;
+
+ memset(stats, 0, sizeof(struct net_device_stats));
+
+ priv = netdev_priv(dev);
+
+ for (i = 0, sa = &priv->sa_tbl[0]; i < NSS_IPSEC_MAX_SA; i++, sa++) {
+ if (atomic_read(&sa->user) == 0) {
+ continue;
+ }
+
+ switch (sa->type) {
+ case NSS_IPSECMGR_RULE_TYPE_ENCAP:
+ stats->tx_packets += sa->stats.pkts.processed;
+ stats->tx_dropped += sa->stats.pkts.dropped;
+ break;
+
+ case NSS_IPSECMGR_RULE_TYPE_DECAP:
+ stats->rx_packets += sa->stats.pkts.processed;
+ stats->rx_dropped += sa->stats.pkts.dropped;
+ break;
+
+ default:
+ nss_ipsecmgr_error("unknown ipsec rule type\n");
+ break;
+ }
+ }
+
+ return stats;
+}
+
+/* NSS IPsec tunnel operation */
+static const struct net_device_ops nss_ipsecmgr_tunnel_ops = {
+ .ndo_init = nss_ipsecmgr_tunnel_init,
+ .ndo_uninit = nss_ipsecmgr_tunnel_exit,
+ .ndo_start_xmit = nss_ipsecmgr_tunnel_xmit,
+ .ndo_open = nss_ipsecmgr_tunnel_open,
+ .ndo_stop = nss_ipsecmgr_tunnel_stop,
+ .ndo_get_stats = nss_ipsecmgr_tunnel_stats,
+};
+
+/*
+ * nss_ipsecmgr_tunnel_free()
+ * free an existing IPsec tunnel interface
+ */
+static void nss_ipsecmgr_tunnel_free(struct net_device *dev)
+{
+ struct nss_ipsecmgr_priv *priv = netdev_priv(dev);
+ struct nss_ipsecmgr_tbl *encap_tbl;
+ struct nss_ipsecmgr_tbl *decap_tbl;
+
+ encap_tbl = &priv->encap;
+ decap_tbl = &priv->decap;
+
+ nss_ipsecmgr_info("IPsec tunnel device(%s) freed\n", dev->name);
+ nss_ipsecmgr_info("Entries left: encap(%d), decap(%d)\n", encap_tbl->count, decap_tbl->count);
+
+ free_netdev(dev);
+}
+
+/*
+ * nss_ipsecmr_setup_tunnel()
+ * setup the IPsec tunnel
+ */
+static void nss_ipsecmgr_tunnel_setup(struct net_device *dev)
+{
+ dev->addr_len = ETH_ALEN;
+ dev->mtu = NSS_IPSECMGR_TUN_MTU(ETH_DATA_LEN);
+
+ dev->hard_header_len = NSS_IPSECMGR_TUN_MAX_HDR_LEN;
+ dev->needed_headroom = NSS_IPSECMGR_TUN_HEADROOM;
+ dev->needed_tailroom = NSS_IPSECMGR_TUN_TAILROOM;
+
+ dev->type = NSS_IPSEC_ARPHRD_IPSEC;
+
+ dev->ethtool_ops = NULL;
+ dev->header_ops = NULL;
+ dev->netdev_ops = &nss_ipsecmgr_tunnel_ops;
+
+ dev->destructor = nss_ipsecmgr_tunnel_free;
+
+ /*
+ * XXX:should get the MAC address from the ethernet device
+ */
+ memcpy(dev->dev_addr, "\xaa\xbb\xcc\xdd\xee\xff", dev->addr_len);
+ memset(dev->broadcast, 0xff, dev->addr_len);
+ memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
+}
+
+/*
+ **********************
+ * Exported Functions
+ **********************
+ */
+
+/*
+ * nss_ipsecmgr_tunnel_add()
+ * add a IPsec pseudo tunnel device
+ */
+struct net_device *nss_ipsecmgr_tunnel_add(void *cb_ctx, nss_ipsecmgr_data_cb_t data_cb, nss_ipsecmgr_event_cb_t event_cb)
+{
+ struct net_device *dev;
+ struct nss_ipsecmgr_priv *priv;
+ struct nss_ipsec_sa *sa;
+ int status;
+ int count;
+ int32_t if_num;
+
+ /* Features denote the skb types supported */
+ uint32_t features = 0;
+
+ dev = alloc_netdev(sizeof(struct nss_ipsecmgr_priv), NSS_IPSECMGR_TUN_NAME, nss_ipsecmgr_tunnel_setup);
+ if (!dev) {
+ nss_ipsecmgr_error("unable to allocate a tunnel device\n");
+ return NULL;
+ }
+
+ priv = netdev_priv(dev);
+
+ priv->cb_ctx = cb_ctx;
+ priv->data_cb = data_cb;
+ priv->event_cb = event_cb;
+
+ /* initialize SA stats table for this tunnel */
+ for (count = 0, sa = &priv->sa_tbl[0]; count < NSS_IPSEC_MAX_SA; count++, sa++) {
+ nss_ipsecmgr_sa_init(sa);
+ }
+
+ spin_lock_init(&priv->encap.lock);
+ spin_lock_init(&priv->decap.lock);
+
+ status = rtnl_is_locked() ? register_netdevice(dev) : register_netdev(dev);
+ if (status < 0) {
+ goto fail;
+ }
+
+ if_num = nss_ipsec_get_interface(priv->nss_ctx);
+ if (if_num < 0) {
+ nss_ipsecmgr_error("Invalid nss interface :%d\n", if_num);
+ return NULL;
+ }
+
+ nss_ipsec_data_register(if_num, nss_ipsecmgr_buf_receive, dev, features);
+
+ /*
+ * Store data interface number in private data
+ */
+ priv->nss_ifnum = if_num;
+
+ nss_ipsec_notify_register(NSS_IPSEC_ENCAP_IF_NUMBER, nss_ipsecmgr_op_receive, dev);
+ nss_ipsec_notify_register(NSS_IPSEC_DECAP_IF_NUMBER, nss_ipsecmgr_op_receive, dev);
+
+ return dev;
+
+fail:
+ free_netdev(dev);
+
+ return NULL;
+}
+EXPORT_SYMBOL(nss_ipsecmgr_tunnel_add);
+
+/*
+ * nss_ipsecmgr_del_tunnel()
+ * delete an existing IPsec tunnel
+ */
+bool nss_ipsecmgr_tunnel_del(struct net_device *dev)
+{
+ struct nss_ipsecmgr_priv *priv;
+ struct nss_ipsecmgr_tbl *encap;
+ struct nss_ipsecmgr_tbl *decap;
+ struct nss_ipsec_msg nim;
+ bool status;
+
+ priv = netdev_priv(dev);
+
+ encap = &priv->encap;
+ decap = &priv->decap;
+
+ /*
+ * Unregister the callbacks from the HLOS as we are no longer
+ * interested in exception data & async messages
+ */
+ nss_ipsec_data_unregister(priv->nss_ctx, priv->nss_ifnum);
+
+ nss_ipsec_notify_unregister(priv->nss_ctx, NSS_IPSEC_ENCAP_IF_NUMBER);
+ nss_ipsec_notify_unregister(priv->nss_ctx, NSS_IPSEC_DECAP_IF_NUMBER);
+
+ priv->data_cb = NULL;
+ priv->event_cb = NULL;
+
+ /*
+ * Prepare to flush all SA(s) inside a tunnel
+ */
+ memset(&nim, 0, sizeof(struct nss_ipsec_msg));
+
+ status = nss_ipsecmgr_op_send(dev, &nim, NSS_IPSEC_ENCAP_IF_NUMBER, NSS_IPSEC_MSG_TYPE_FLUSH_TUN);
+ if (status != true) {
+ nss_ipsecmgr_error("unable complete tunnel deletion, for ingress rules\n");
+ goto fail;
+ }
+
+ /* release all SA(s) associated with the encap */
+ atomic_sub(encap->count, &gbl_drv_ctx.sa_count);
+
+ status = nss_ipsecmgr_op_send(dev, &nim, NSS_IPSEC_DECAP_IF_NUMBER, NSS_IPSEC_MSG_TYPE_FLUSH_TUN);
+ if (status != true) {
+ nss_ipsecmgr_error("unable complete tunnel deletion, for egress rules\n");
+ goto fail;
+ }
+
+ /* release all SA(s) associated with the decap */
+ atomic_sub(decap->count, &gbl_drv_ctx.sa_count);
+
+ /*
+ * The unregister should start here but the expectation is that the free would
+ * happen when the reference count goes down to '0'
+ */
+ rtnl_is_locked() ? unregister_netdevice(dev) : unregister_netdev(dev);
+
+ return true;
+fail:
+ /* caller must retry */
+ return false;
+}
+EXPORT_SYMBOL(nss_ipsecmgr_tunnel_del);
+
+/*
+ * nss_ipsecmgr_sa_add()
+ * add a new SA to the tunnel
+ */
+bool nss_ipsecmgr_sa_add(struct net_device *dev, union nss_ipsecmgr_rule *rule, enum nss_ipsecmgr_rule_type type)
+{
+ struct nss_ipsecmgr_priv *priv;
+ struct nss_ipsec_msg nim;
+ uint32_t if_num;
+
+ priv = netdev_priv(dev);
+
+ /* check if there are free SA(s) */
+ if (atomic_read(&gbl_drv_ctx.sa_count) == 0) {
+ return false;
+ }
+
+ memset(&nim, 0, sizeof(struct nss_ipsec_msg));
+
+ /* XXX: some basic validation of the passed rule needs to happen */
+
+ switch (type) {
+ case NSS_IPSECMGR_RULE_TYPE_ENCAP:
+ if_num = NSS_IPSEC_ENCAP_IF_NUMBER;
+ nss_ipsecmgr_copy_encap_add(dev, &nim.msg.push, rule);
+ break;
+
+ case NSS_IPSECMGR_RULE_TYPE_DECAP:
+ if_num = NSS_IPSEC_DECAP_IF_NUMBER;
+ nss_ipsecmgr_copy_decap_add(dev, &nim.msg.push, rule);
+ break;
+
+ default:
+ nss_ipsecmgr_error("Unknown rule type(%d) for Add operation\n", type);
+ return false;
+ }
+
+ return nss_ipsecmgr_op_send(dev, &nim, if_num, NSS_IPSEC_MSG_TYPE_ADD_RULE);
+
+}
+EXPORT_SYMBOL(nss_ipsecmgr_sa_add);
+
+/*
+ * nss_ipsecmgr_sa_del()
+ *
+ */
+bool nss_ipsecmgr_sa_del(struct net_device *dev, union nss_ipsecmgr_rule *rule, enum nss_ipsecmgr_rule_type type)
+{
+ struct nss_ipsecmgr_priv *priv;
+ struct nss_ipsec_msg nim;
+ uint32_t if_num;
+
+ priv = netdev_priv(dev);
+
+ /* check if all SA(s) are already freed */
+ if (atomic_read(&gbl_drv_ctx.sa_count) == NSS_IPSEC_MAX_RULES) {
+ return false;
+ }
+
+ memset(&nim, 0, sizeof(struct nss_ipsec_msg));
+
+ /* XXX: some basic validation of the passed rule needs to happen */
+
+ switch (type) {
+ case NSS_IPSECMGR_RULE_TYPE_ENCAP:
+ if_num = NSS_IPSEC_ENCAP_IF_NUMBER;
+ nss_ipsecmgr_copy_encap_del(dev, &nim.msg.push, rule);
+ break;
+
+ case NSS_IPSECMGR_RULE_TYPE_DECAP:
+ if_num = NSS_IPSEC_DECAP_IF_NUMBER;
+ nss_ipsecmgr_copy_decap_del(dev, &nim.msg.push, rule);
+ break;
+
+ default:
+ nss_ipsecmgr_error("Unknown rule type(%d) for Del operation\n", type);
+ return false;
+ }
+ return nss_ipsecmgr_op_send(dev, &nim, if_num, NSS_IPSEC_MSG_TYPE_DEL_RULE);
+}
+EXPORT_SYMBOL(nss_ipsecmgr_sa_del);
+
+static int __init nss_ipsecmgr_init(void)
+{
+ nss_ipsecmgr_info("NSS IPsec manager loaded: Build date %s\n", __DATE__);
+
+ memset(&gbl_drv_ctx, 0, sizeof(struct nss_ipsecmgr_drv));
+
+ atomic_set(&gbl_drv_ctx.sa_count, NSS_IPSEC_MAX_RULES);
+
+ return 0;
+}
+
+
+static void __exit nss_ipsecmgr_exit(void)
+{
+ nss_ipsecmgr_info("NSS IPsec manager unloader\n");
+}
+
+module_init(nss_ipsecmgr_init);
+module_exit(nss_ipsecmgr_exit);