Commit f16276ad authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'macsec-selftests' 



Sabrina Dubroca says:

====================
net: add MACsec offload selftests

Patch 1 adds MACsec offload to netdevsim (unchanged from v2).

Patch 2 adds a corresponding selftest to the rtnetlink testsuite.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 633d76ad 3b5222e2

drivers/net/netdevsim/Makefile

+4 −0
Original line number Diff line number Diff line
@@ -17,3 +17,7 @@ endif 
ifneq ($(CONFIG_PSAMPLE),)

netdevsim-objs += psample.o

endif



ifneq ($(CONFIG_MACSEC),)

netdevsim-objs += macsec.o

endif

drivers/net/netdevsim/macsec.c

0 → 100644
+356 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0



#include <net/macsec.h>

#include "netdevsim.h"



static inline u64 sci_to_cpu(sci_t sci)

{

	return be64_to_cpu((__force __be64)sci);

}



static int nsim_macsec_find_secy(struct netdevsim *ns, sci_t sci)

{

	int i;



	for (i = 0; i < NSIM_MACSEC_MAX_SECY_COUNT; i++) {

		if (ns->macsec.nsim_secy[i].sci == sci)

			return i;

	}



	return -1;

}



static int nsim_macsec_find_rxsc(struct nsim_secy *ns_secy, sci_t sci)

{

	int i;



	for (i = 0; i < NSIM_MACSEC_MAX_RXSC_COUNT; i++) {

		if (ns_secy->nsim_rxsc[i].sci == sci)

			return i;

	}



	return -1;

}



static int nsim_macsec_add_secy(struct macsec_context *ctx)

{

	struct netdevsim *ns = netdev_priv(ctx->netdev);

	int idx;



	if (ns->macsec.nsim_secy_count == NSIM_MACSEC_MAX_SECY_COUNT)

		return -ENOSPC;



	for (idx = 0; idx < NSIM_MACSEC_MAX_SECY_COUNT; idx++) {

		if (!ns->macsec.nsim_secy[idx].used)

			break;

	}



	if (idx == NSIM_MACSEC_MAX_SECY_COUNT) {

		netdev_err(ctx->netdev, "%s: nsim_secy_count not full but all SecYs used\n",

			   __func__);

		return -ENOSPC;

	}



	netdev_dbg(ctx->netdev, "%s: adding new secy with sci %08llx at index %d\n",

		   __func__, sci_to_cpu(ctx->secy->sci), idx);

	ns->macsec.nsim_secy[idx].used = true;

	ns->macsec.nsim_secy[idx].nsim_rxsc_count = 0;

	ns->macsec.nsim_secy[idx].sci = ctx->secy->sci;

	ns->macsec.nsim_secy_count++;



	return 0;

}



static int nsim_macsec_upd_secy(struct macsec_context *ctx)

{

	struct netdevsim *ns = netdev_priv(ctx->netdev);

	int idx;



	idx = nsim_macsec_find_secy(ns, ctx->secy->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in secy table\n",

			   __func__, sci_to_cpu(ctx->secy->sci));

		return -ENOENT;

	}



	netdev_dbg(ctx->netdev, "%s: updating secy with sci %08llx at index %d\n",

		   __func__, sci_to_cpu(ctx->secy->sci), idx);



	return 0;

}



static int nsim_macsec_del_secy(struct macsec_context *ctx)

{

	struct netdevsim *ns = netdev_priv(ctx->netdev);

	int idx;



	idx = nsim_macsec_find_secy(ns, ctx->secy->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in secy table\n",

			   __func__, sci_to_cpu(ctx->secy->sci));

		return -ENOENT;

	}



	netdev_dbg(ctx->netdev, "%s: removing SecY with SCI %08llx at index %d\n",

		   __func__, sci_to_cpu(ctx->secy->sci), idx);



	ns->macsec.nsim_secy[idx].used = false;

	memset(&ns->macsec.nsim_secy[idx], 0, sizeof(ns->macsec.nsim_secy[idx]));

	ns->macsec.nsim_secy_count--;



	return 0;

}



static int nsim_macsec_add_rxsc(struct macsec_context *ctx)

{

	struct netdevsim *ns = netdev_priv(ctx->netdev);

	struct nsim_secy *secy;

	int idx;



	idx = nsim_macsec_find_secy(ns, ctx->secy->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in secy table\n",

			   __func__, sci_to_cpu(ctx->secy->sci));

		return -ENOENT;

	}

	secy = &ns->macsec.nsim_secy[idx];



	if (secy->nsim_rxsc_count == NSIM_MACSEC_MAX_RXSC_COUNT)

		return -ENOSPC;



	for (idx = 0; idx < NSIM_MACSEC_MAX_RXSC_COUNT; idx++) {

		if (!secy->nsim_rxsc[idx].used)

			break;

	}



	if (idx == NSIM_MACSEC_MAX_RXSC_COUNT)

		netdev_err(ctx->netdev, "%s: nsim_rxsc_count not full but all RXSCs used\n",

			   __func__);



	netdev_dbg(ctx->netdev, "%s: adding new rxsc with sci %08llx at index %d\n",

		   __func__, sci_to_cpu(ctx->rx_sc->sci), idx);

	secy->nsim_rxsc[idx].used = true;

	secy->nsim_rxsc[idx].sci = ctx->rx_sc->sci;

	secy->nsim_rxsc_count++;



	return 0;

}



static int nsim_macsec_upd_rxsc(struct macsec_context *ctx)

{

	struct netdevsim *ns = netdev_priv(ctx->netdev);

	struct nsim_secy *secy;

	int idx;



	idx = nsim_macsec_find_secy(ns, ctx->secy->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in secy table\n",

			   __func__, sci_to_cpu(ctx->secy->sci));

		return -ENOENT;

	}

	secy = &ns->macsec.nsim_secy[idx];



	idx = nsim_macsec_find_rxsc(secy, ctx->rx_sc->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in RXSC table\n",

			   __func__, sci_to_cpu(ctx->rx_sc->sci));

		return -ENOENT;

	}



	netdev_dbg(ctx->netdev, "%s: updating RXSC with sci %08llx at index %d\n",

		   __func__, sci_to_cpu(ctx->rx_sc->sci), idx);



	return 0;

}



static int nsim_macsec_del_rxsc(struct macsec_context *ctx)

{

	struct netdevsim *ns = netdev_priv(ctx->netdev);

	struct nsim_secy *secy;

	int idx;



	idx = nsim_macsec_find_secy(ns, ctx->secy->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in secy table\n",

			   __func__, sci_to_cpu(ctx->secy->sci));

		return -ENOENT;

	}

	secy = &ns->macsec.nsim_secy[idx];



	idx = nsim_macsec_find_rxsc(secy, ctx->rx_sc->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in RXSC table\n",

			   __func__, sci_to_cpu(ctx->rx_sc->sci));

		return -ENOENT;

	}



	netdev_dbg(ctx->netdev, "%s: removing RXSC with sci %08llx at index %d\n",

		   __func__, sci_to_cpu(ctx->rx_sc->sci), idx);



	secy->nsim_rxsc[idx].used = false;

	memset(&secy->nsim_rxsc[idx], 0, sizeof(secy->nsim_rxsc[idx]));

	secy->nsim_rxsc_count--;



	return 0;

}



static int nsim_macsec_add_rxsa(struct macsec_context *ctx)

{

	struct netdevsim *ns = netdev_priv(ctx->netdev);

	struct nsim_secy *secy;

	int idx;



	idx = nsim_macsec_find_secy(ns, ctx->secy->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in secy table\n",

			   __func__, sci_to_cpu(ctx->secy->sci));

		return -ENOENT;

	}

	secy = &ns->macsec.nsim_secy[idx];



	idx = nsim_macsec_find_rxsc(secy, ctx->sa.rx_sa->sc->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in RXSC table\n",

			   __func__, sci_to_cpu(ctx->sa.rx_sa->sc->sci));

		return -ENOENT;

	}



	netdev_dbg(ctx->netdev, "%s: RXSC with sci %08llx, AN %u\n",

		   __func__, sci_to_cpu(ctx->sa.rx_sa->sc->sci), ctx->sa.assoc_num);



	return 0;

}



static int nsim_macsec_upd_rxsa(struct macsec_context *ctx)

{

	struct netdevsim *ns = netdev_priv(ctx->netdev);

	struct nsim_secy *secy;

	int idx;



	idx = nsim_macsec_find_secy(ns, ctx->secy->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in secy table\n",

			   __func__, sci_to_cpu(ctx->secy->sci));

		return -ENOENT;

	}

	secy = &ns->macsec.nsim_secy[idx];



	idx = nsim_macsec_find_rxsc(secy, ctx->sa.rx_sa->sc->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in RXSC table\n",

			   __func__, sci_to_cpu(ctx->sa.rx_sa->sc->sci));

		return -ENOENT;

	}



	netdev_dbg(ctx->netdev, "%s: RXSC with sci %08llx, AN %u\n",

		   __func__, sci_to_cpu(ctx->sa.rx_sa->sc->sci), ctx->sa.assoc_num);



	return 0;

}



static int nsim_macsec_del_rxsa(struct macsec_context *ctx)

{

	struct netdevsim *ns = netdev_priv(ctx->netdev);

	struct nsim_secy *secy;

	int idx;



	idx = nsim_macsec_find_secy(ns, ctx->secy->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in secy table\n",

			   __func__, sci_to_cpu(ctx->secy->sci));

		return -ENOENT;

	}

	secy = &ns->macsec.nsim_secy[idx];



	idx = nsim_macsec_find_rxsc(secy, ctx->sa.rx_sa->sc->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in RXSC table\n",

			   __func__, sci_to_cpu(ctx->sa.rx_sa->sc->sci));

		return -ENOENT;

	}



	netdev_dbg(ctx->netdev, "%s: RXSC with sci %08llx, AN %u\n",

		   __func__, sci_to_cpu(ctx->sa.rx_sa->sc->sci), ctx->sa.assoc_num);



	return 0;

}



static int nsim_macsec_add_txsa(struct macsec_context *ctx)

{

	struct netdevsim *ns = netdev_priv(ctx->netdev);

	int idx;



	idx = nsim_macsec_find_secy(ns, ctx->secy->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in secy table\n",

			   __func__, sci_to_cpu(ctx->secy->sci));

		return -ENOENT;

	}



	netdev_dbg(ctx->netdev, "%s: SECY with sci %08llx, AN %u\n",

		   __func__, sci_to_cpu(ctx->secy->sci), ctx->sa.assoc_num);



	return 0;

}



static int nsim_macsec_upd_txsa(struct macsec_context *ctx)

{

	struct netdevsim *ns = netdev_priv(ctx->netdev);

	int idx;



	idx = nsim_macsec_find_secy(ns, ctx->secy->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in secy table\n",

			   __func__, sci_to_cpu(ctx->secy->sci));

		return -ENOENT;

	}



	netdev_dbg(ctx->netdev, "%s: SECY with sci %08llx, AN %u\n",

		   __func__, sci_to_cpu(ctx->secy->sci), ctx->sa.assoc_num);



	return 0;

}



static int nsim_macsec_del_txsa(struct macsec_context *ctx)

{

	struct netdevsim *ns = netdev_priv(ctx->netdev);

	int idx;



	idx = nsim_macsec_find_secy(ns, ctx->secy->sci);

	if (idx < 0) {

		netdev_err(ctx->netdev, "%s: sci %08llx not found in secy table\n",

			   __func__, sci_to_cpu(ctx->secy->sci));

		return -ENOENT;

	}



	netdev_dbg(ctx->netdev, "%s: SECY with sci %08llx, AN %u\n",

		   __func__, sci_to_cpu(ctx->secy->sci), ctx->sa.assoc_num);



	return 0;

}



static const struct macsec_ops nsim_macsec_ops = {

	.mdo_add_secy = nsim_macsec_add_secy,

	.mdo_upd_secy = nsim_macsec_upd_secy,

	.mdo_del_secy = nsim_macsec_del_secy,

	.mdo_add_rxsc = nsim_macsec_add_rxsc,

	.mdo_upd_rxsc = nsim_macsec_upd_rxsc,

	.mdo_del_rxsc = nsim_macsec_del_rxsc,

	.mdo_add_rxsa = nsim_macsec_add_rxsa,

	.mdo_upd_rxsa = nsim_macsec_upd_rxsa,

	.mdo_del_rxsa = nsim_macsec_del_rxsa,

	.mdo_add_txsa = nsim_macsec_add_txsa,

	.mdo_upd_txsa = nsim_macsec_upd_txsa,

	.mdo_del_txsa = nsim_macsec_del_txsa,

};



void nsim_macsec_init(struct netdevsim *ns)

{

	ns->netdev->macsec_ops = &nsim_macsec_ops;

	ns->netdev->features |= NETIF_F_HW_MACSEC;

	memset(&ns->macsec, 0, sizeof(ns->macsec));

}



void nsim_macsec_teardown(struct netdevsim *ns)

{

}

drivers/net/netdevsim/netdev.c

+3 −0
Original line number Diff line number Diff line
@@ -304,6 +304,7 @@ static int nsim_init_netdevsim(struct netdevsim *ns) 
	if (err)

		goto err_utn_destroy;



	nsim_macsec_init(ns);

	nsim_ipsec_init(ns);



	err = register_netdevice(ns->netdev);
@@ -314,6 +315,7 @@ static int nsim_init_netdevsim(struct netdevsim *ns) 


err_ipsec_teardown:

	nsim_ipsec_teardown(ns);

	nsim_macsec_teardown(ns);

	nsim_bpf_uninit(ns);

err_utn_destroy:

	rtnl_unlock();
@@ -374,6 +376,7 @@ void nsim_destroy(struct netdevsim *ns) 
	rtnl_lock();

	unregister_netdevice(dev);

	if (nsim_dev_port_is_pf(ns->nsim_dev_port)) {

		nsim_macsec_teardown(ns);

		nsim_ipsec_teardown(ns);

		nsim_bpf_uninit(ns);

	}

drivers/net/netdevsim/netdevsim.h

+34 −0
Original line number Diff line number Diff line
@@ -23,6 +23,7 @@ 
#include <net/devlink.h>

#include <net/udp_tunnel.h>

#include <net/xdp.h>

#include <net/macsec.h>



#define DRV_NAME	"netdevsim"
@@ -52,6 +53,25 @@ struct nsim_ipsec { 
	u32 ok;

};



#define NSIM_MACSEC_MAX_SECY_COUNT 3

#define NSIM_MACSEC_MAX_RXSC_COUNT 1

struct nsim_rxsc {

	sci_t sci;

	bool used;

};



struct nsim_secy {

	sci_t sci;

	struct nsim_rxsc nsim_rxsc[NSIM_MACSEC_MAX_RXSC_COUNT];

	u8 nsim_rxsc_count;

	bool used;

};



struct nsim_macsec {

	struct nsim_secy nsim_secy[NSIM_MACSEC_MAX_SECY_COUNT];

	u8 nsim_secy_count;

};



struct nsim_ethtool_pauseparam {

	bool rx;

	bool tx;
@@ -93,6 +113,7 @@ struct netdevsim { 


	bool bpf_map_accept;

	struct nsim_ipsec ipsec;

	struct nsim_macsec macsec;

	struct {

		u32 inject_error;

		u32 sleep;
@@ -366,6 +387,19 @@ static inline bool nsim_ipsec_tx(struct netdevsim *ns, struct sk_buff *skb) 
}

#endif



#if IS_ENABLED(CONFIG_MACSEC)

void nsim_macsec_init(struct netdevsim *ns);

void nsim_macsec_teardown(struct netdevsim *ns);

#else

static inline void nsim_macsec_init(struct netdevsim *ns)

{

}



static inline void nsim_macsec_teardown(struct netdevsim *ns)

{

}

#endif



struct nsim_bus_dev {

	struct device dev;

	struct list_head list;

tools/testing/selftests/net/rtnetlink.sh

+83 −0
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ ALL_TESTS=" 
	kci_test_vrf

	kci_test_encap

	kci_test_macsec

	kci_test_macsec_offload

	kci_test_ipsec

	kci_test_ipsec_offload

	kci_test_fdb_get
@@ -643,6 +644,88 @@ kci_test_macsec() 
	echo "PASS: macsec"

}



kci_test_macsec_offload()

{

	sysfsd=/sys/kernel/debug/netdevsim/netdevsim0/ports/0/

	sysfsnet=/sys/bus/netdevsim/devices/netdevsim0/net/

	probed=false

	local ret=0



	ip macsec help 2>&1 | grep -q "^Usage: ip macsec"

	if [ $? -ne 0 ]; then

		echo "SKIP: macsec: iproute2 too old"

		return $ksft_skip

	fi



	# setup netdevsim since dummydev doesn't have offload support

	if [ ! -w /sys/bus/netdevsim/new_device ] ; then

		modprobe -q netdevsim

		check_err $?

		if [ $ret -ne 0 ]; then

			echo "SKIP: macsec_offload can't load netdevsim"

			return $ksft_skip

		fi

		probed=true

	fi



	echo "0" > /sys/bus/netdevsim/new_device

	while [ ! -d $sysfsnet ] ; do :; done

	udevadm settle

	dev=`ls $sysfsnet`



	ip link set $dev up

	if [ ! -d $sysfsd ] ; then

		echo "FAIL: macsec_offload can't create device $dev"

		return 1

	fi



	ethtool -k $dev | grep -q 'macsec-hw-offload: on'

	if [ $? -eq 1 ] ; then

		echo "FAIL: macsec_offload netdevsim doesn't support MACsec offload"

		return 1

	fi



	ip link add link $dev kci_macsec1 type macsec port 4 offload mac

	check_err $?



	ip link add link $dev kci_macsec2 type macsec address "aa:bb:cc:dd:ee:ff" port 5 offload mac

	check_err $?



	ip link add link $dev kci_macsec3 type macsec sci abbacdde01020304 offload mac

	check_err $?



	ip link add link $dev kci_macsec4 type macsec port 8 offload mac 2> /dev/null

	check_fail $?



	msname=kci_macsec1



	ip macsec add "$msname" tx sa 0 pn 1024 on key 01 12345678901234567890123456789012

	check_err $?



	ip macsec add "$msname" rx port 1234 address "1c:ed:de:ad:be:ef"

	check_err $?



	ip macsec add "$msname" rx port 1234 address "1c:ed:de:ad:be:ef" sa 0 pn 1 on \

		key 00 0123456789abcdef0123456789abcdef

	check_err $?



	ip macsec add "$msname" rx port 1235 address "1c:ed:de:ad:be:ef" 2> /dev/null

	check_fail $?



	# clean up any leftovers

	for msdev in kci_macsec{1,2,3,4} ; do

	    ip link del $msdev 2> /dev/null

	done

	echo 0 > /sys/bus/netdevsim/del_device

	$probed && rmmod netdevsim



	if [ $ret -ne 0 ]; then

		echo "FAIL: macsec_offload"

		return 1

	fi

	echo "PASS: macsec_offload"

}



#-------------------------------------------------------------------

# Example commands

#   ip x s add proto esp src 14.0.0.52 dst 14.0.0.70 \