contrib/wpa/src/drivers/driver_macsec_qca.c

   1 /*
   2  * Wired Ethernet driver interface for QCA MACsec driver
   3  * Copyright (c) 2005-2009, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2004, Gunter Burchardt <tira@isx.de>
   5  * Copyright (c) 2013-2014, Qualcomm Atheros, Inc.
   6  * Copyright (c) 2019, The Linux Foundation
   7  *
   8  * This software may be distributed under the terms of the BSD license.
   9  * See README for more details.
  10  */
  11
  12 #include "includes.h"
  13 #include <sys/ioctl.h>
  14 #include <net/if.h>
  15 #include <inttypes.h>
  16 #ifdef __linux__
  17 #include <netpacket/packet.h>
  18 #include <net/if_arp.h>
  19 #include <net/if.h>
  20 #endif /* __linux__ */
  21 #if defined(__FreeBSD__) || defined(__DragonFly__) || defined(__FreeBSD_kernel__)
  22 #include <net/if_dl.h>
  23 #include <net/if_media.h>
  24 #endif /* defined(__FreeBSD__) || defined(__DragonFly__) || defined(__FreeBSD_kernel__) */
  25 #ifdef __sun__
  26 #include <sys/sockio.h>
  27 #endif /* __sun__ */
  28
  29 #include "utils/common.h"
  30 #include "utils/eloop.h"
  31 #include "common/defs.h"
  32 #include "common/ieee802_1x_defs.h"
  33 #include "common/eapol_common.h"
  34 #include "pae/ieee802_1x_kay.h"
  35 #include "driver.h"
  36 #include "driver_wired_common.h"
  37
  38 #include "nss_macsec_secy.h"
  39 #include "nss_macsec_secy_rx.h"
  40 #include "nss_macsec_secy_tx.h"
  41
  42 #define MAXSC 16
  43
  44 #define SAK_128_LEN     16
  45 #define SAK_256_LEN     32
  46
  47 /* TCI field definition */
  48 #define TCI_ES                0x40
  49 #define TCI_SC                0x20
  50 #define TCI_SCB               0x10
  51 #define TCI_E                 0x08
  52 #define TCI_C                 0x04
  53
  54 #ifdef _MSC_VER
  55 #pragma pack(push, 1)
  56 #endif /* _MSC_VER */
  57
  58 #ifdef _MSC_VER
  59 #pragma pack(pop)
  60 #endif /* _MSC_VER */
  61
  62 struct channel_map {
  63         struct ieee802_1x_mka_sci sci;
  64 };
  65
  66 struct macsec_qca_data {
  67         struct driver_wired_common_data common;
  68
  69         int use_pae_group_addr;
  70         u32 secy_id;
  71
  72         /* shadow */
  73         Boolean always_include_sci;
  74         Boolean use_es;
  75         Boolean use_scb;
  76         Boolean protect_frames;
  77         Boolean replay_protect;
  78         u32 replay_window;
  79
  80         struct channel_map receive_channel_map[MAXSC];
  81         struct channel_map transmit_channel_map[MAXSC];
  82 };
  83
  84
  85 static void __macsec_drv_init(struct macsec_qca_data *drv)
  86 {
  87         int ret = 0;
  88         fal_rx_ctl_filt_t rx_ctl_filt;
  89         fal_tx_ctl_filt_t tx_ctl_filt;
  90
  91         wpa_printf(MSG_INFO, "%s: secy_id=%d", __func__, drv->secy_id);
  92
  93         /* Enable Secy and Let EAPoL bypass */
  94         ret = nss_macsec_secy_en_set(drv->secy_id, TRUE);
  95         if (ret)
  96                 wpa_printf(MSG_ERROR, "nss_macsec_secy_en_set: FAIL");
  97
  98         ret = nss_macsec_secy_sc_sa_mapping_mode_set(drv->secy_id,
  99                                                      FAL_SC_SA_MAP_1_4);
 100         if (ret)
 101                 wpa_printf(MSG_ERROR,
 102                            "nss_macsec_secy_sc_sa_mapping_mode_set: FAIL");
 103
 104         os_memset(&rx_ctl_filt, 0, sizeof(rx_ctl_filt));
 105         rx_ctl_filt.bypass = 1;
 106         rx_ctl_filt.match_type = IG_CTL_COMPARE_ETHER_TYPE;
 107         rx_ctl_filt.match_mask = 0xffff;
 108         rx_ctl_filt.ether_type_da_range = 0x888e;
 109         ret = nss_macsec_secy_rx_ctl_filt_set(drv->secy_id, 0, &rx_ctl_filt);
 110         if (ret)
 111                 wpa_printf(MSG_ERROR, "nss_macsec_secy_rx_ctl_filt_set: FAIL");
 112
 113         os_memset(&tx_ctl_filt, 0, sizeof(tx_ctl_filt));
 114         tx_ctl_filt.bypass = 1;
 115         tx_ctl_filt.match_type = EG_CTL_COMPARE_ETHER_TYPE;
 116         tx_ctl_filt.match_mask = 0xffff;
 117         tx_ctl_filt.ether_type_da_range = 0x888e;
 118         ret = nss_macsec_secy_tx_ctl_filt_set(drv->secy_id, 0, &tx_ctl_filt);
 119         if (ret)
 120                 wpa_printf(MSG_ERROR, "nss_macsec_secy_tx_ctl_filt_set: FAIL");
 121 }
 122
 123
 124 static void __macsec_drv_deinit(struct macsec_qca_data *drv)
 125 {
 126         nss_macsec_secy_en_set(drv->secy_id, FALSE);
 127         nss_macsec_secy_rx_sc_del_all(drv->secy_id);
 128         nss_macsec_secy_tx_sc_del_all(drv->secy_id);
 129 }
 130
 131
 132 #ifdef __linux__
 133
 134 static void macsec_qca_handle_data(void *ctx, unsigned char *buf, size_t len)
 135 {
 136 #ifdef HOSTAPD
 137         struct ieee8023_hdr *hdr;
 138         u8 *pos, *sa;
 139         size_t left;
 140         union wpa_event_data event;
 141
 142         /* at least 6 bytes src macaddress, 6 bytes dst macaddress
 143          * and 2 bytes ethertype
 144         */
 145         if (len < 14) {
 146                 wpa_printf(MSG_MSGDUMP,
 147                            "macsec_qca_handle_data: too short (%lu)",
 148                            (unsigned long) len);
 149                 return;
 150         }
 151         hdr = (struct ieee8023_hdr *) buf;
 152
 153         switch (ntohs(hdr->ethertype)) {
 154         case ETH_P_PAE:
 155                 wpa_printf(MSG_MSGDUMP, "Received EAPOL packet");
 156                 sa = hdr->src;
 157                 os_memset(&event, 0, sizeof(event));
 158                 event.new_sta.addr = sa;
 159                 wpa_supplicant_event(ctx, EVENT_NEW_STA, &event);
 160
 161                 pos = (u8 *) (hdr + 1);
 162                 left = len - sizeof(*hdr);
 163                 drv_event_eapol_rx(ctx, sa, pos, left);
 164                 break;
 165         default:
 166                 wpa_printf(MSG_DEBUG, "Unknown ethertype 0x%04x in data frame",
 167                            ntohs(hdr->ethertype));
 168                 break;
 169         }
 170 #endif /* HOSTAPD */
 171 }
 172
 173
 174 static void macsec_qca_handle_read(int sock, void *eloop_ctx, void *sock_ctx)
 175 {
 176         int len;
 177         unsigned char buf[3000];
 178
 179         len = recv(sock, buf, sizeof(buf), 0);
 180         if (len < 0) {
 181                 wpa_printf(MSG_ERROR, "macsec_qca: recv: %s", strerror(errno));
 182                 return;
 183         }
 184
 185         macsec_qca_handle_data(eloop_ctx, buf, len);
 186 }
 187
 188 #endif /* __linux__ */
 189
 190
 191 static int macsec_qca_init_sockets(struct macsec_qca_data *drv, u8 *own_addr)
 192 {
 193 #ifdef __linux__
 194         struct ifreq ifr;
 195         struct sockaddr_ll addr;
 196
 197         drv->common.sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_PAE));
 198         if (drv->common.sock < 0) {
 199                 wpa_printf(MSG_ERROR, "socket[PF_PACKET,SOCK_RAW]: %s",
 200                            strerror(errno));
 201                 return -1;
 202         }
 203
 204         if (eloop_register_read_sock(drv->common.sock, macsec_qca_handle_read,
 205                                      drv->common.ctx, NULL)) {
 206                 wpa_printf(MSG_INFO, "Could not register read socket");
 207                 return -1;
 208         }
 209
 210         os_memset(&ifr, 0, sizeof(ifr));
 211         os_strlcpy(ifr.ifr_name, drv->common.ifname, sizeof(ifr.ifr_name));
 212         if (ioctl(drv->common.sock, SIOCGIFINDEX, &ifr) != 0) {
 213                 wpa_printf(MSG_ERROR, "ioctl(SIOCGIFINDEX): %s",
 214                            strerror(errno));
 215                 return -1;
 216         }
 217
 218         os_memset(&addr, 0, sizeof(addr));
 219         addr.sll_family = AF_PACKET;
 220         addr.sll_ifindex = ifr.ifr_ifindex;
 221         wpa_printf(MSG_DEBUG, "Opening raw packet socket for ifindex %d",
 222                    addr.sll_ifindex);
 223
 224         if (bind(drv->common.sock, (struct sockaddr *) &addr,
 225                  sizeof(addr)) < 0) {
 226                 wpa_printf(MSG_ERROR, "macsec_qca: bind: %s", strerror(errno));
 227                 return -1;
 228         }
 229
 230         /* filter multicast address */
 231         if (wired_multicast_membership(drv->common.sock, ifr.ifr_ifindex,
 232                                        pae_group_addr, 1) < 0) {
 233                 wpa_printf(MSG_ERROR,
 234                         "macsec_qca_init_sockets: Failed to add multicast group membership");
 235                 return -1;
 236         }
 237
 238         os_memset(&ifr, 0, sizeof(ifr));
 239         os_strlcpy(ifr.ifr_name, drv->common.ifname, sizeof(ifr.ifr_name));
 240         if (ioctl(drv->common.sock, SIOCGIFHWADDR, &ifr) != 0) {
 241                 wpa_printf(MSG_ERROR, "ioctl(SIOCGIFHWADDR): %s",
 242                            strerror(errno));
 243                 return -1;
 244         }
 245
 246         if (ifr.ifr_hwaddr.sa_family != ARPHRD_ETHER) {
 247                 wpa_printf(MSG_INFO, "Invalid HW-addr family 0x%04x",
 248                            ifr.ifr_hwaddr.sa_family);
 249                 return -1;
 250         }
 251         os_memcpy(own_addr, ifr.ifr_hwaddr.sa_data, ETH_ALEN);
 252
 253         return 0;
 254 #else /* __linux__ */
 255         return -1;
 256 #endif /* __linux__ */
 257 }
 258
 259
 260 static void * macsec_qca_init(void *ctx, const char *ifname)
 261 {
 262         struct macsec_qca_data *drv;
 263
 264         drv = os_zalloc(sizeof(*drv));
 265         if (drv == NULL)
 266                 return NULL;
 267
 268         /* Board specific settings */
 269         if (os_memcmp("eth2", ifname, 4) == 0)
 270                 drv->secy_id = 1;
 271         else if (os_memcmp("eth3", ifname, 4) == 0)
 272                 drv->secy_id = 2;
 273         else
 274                 drv->secy_id = -1;
 275
 276         if (driver_wired_init_common(&drv->common, ifname, ctx) < 0) {
 277                 os_free(drv);
 278                 return NULL;
 279         }
 280
 281         return drv;
 282 }
 283
 284
 285 static void macsec_qca_deinit(void *priv)
 286 {
 287         struct macsec_qca_data *drv = priv;
 288
 289         driver_wired_deinit_common(&drv->common);
 290         os_free(drv);
 291 }
 292
 293
 294 static void * macsec_qca_hapd_init(struct hostapd_data *hapd,
 295                                    struct wpa_init_params *params)
 296 {
 297         struct macsec_qca_data *drv;
 298
 299         drv = os_zalloc(sizeof(struct macsec_qca_data));
 300         if (!drv) {
 301                 wpa_printf(MSG_INFO,
 302                            "Could not allocate memory for macsec_qca driver data");
 303                 return NULL;
 304         }
 305
 306         /* Board specific settings */
 307         if (os_memcmp("eth2", params->ifname, 4) == 0)
 308                 drv->secy_id = 1;
 309         else if (os_memcmp("eth3", params->ifname, 4) == 0)
 310                 drv->secy_id = 2;
 311         else if (os_memcmp("eth4", params->ifname, 4) == 0)
 312                 drv->secy_id = 0;
 313         else if (os_memcmp("eth5", params->ifname, 4) == 0)
 314                 drv->secy_id = 1;
 315         else
 316                 drv->secy_id = -1;
 317
 318         drv->common.ctx = hapd;
 319         os_strlcpy(drv->common.ifname, params->ifname,
 320                    sizeof(drv->common.ifname));
 321         drv->use_pae_group_addr = params->use_pae_group_addr;
 322
 323         if (macsec_qca_init_sockets(drv, params->own_addr)) {
 324                 os_free(drv);
 325                 return NULL;
 326         }
 327
 328         return drv;
 329 }
 330
 331
 332 static void macsec_qca_hapd_deinit(void *priv)
 333 {
 334         struct macsec_qca_data *drv = priv;
 335
 336         if (drv->common.sock >= 0) {
 337                 eloop_unregister_read_sock(drv->common.sock);
 338                 close(drv->common.sock);
 339         }
 340
 341         os_free(drv);
 342 }
 343
 344
 345 static int macsec_qca_send_eapol(void *priv, const u8 *addr,
 346                                  const u8 *data, size_t data_len, int encrypt,
 347                                  const u8 *own_addr, u32 flags)
 348 {
 349         struct macsec_qca_data *drv = priv;
 350         struct ieee8023_hdr *hdr;
 351         size_t len;
 352         u8 *pos;
 353         int res;
 354
 355         len = sizeof(*hdr) + data_len;
 356         hdr = os_zalloc(len);
 357         if (!hdr) {
 358                 wpa_printf(MSG_INFO,
 359                            "malloc() failed for macsec_qca_send_eapol(len=%lu)",
 360                            (unsigned long) len);
 361                 return -1;
 362         }
 363
 364         os_memcpy(hdr->dest, drv->use_pae_group_addr ? pae_group_addr : addr,
 365                   ETH_ALEN);
 366         os_memcpy(hdr->src, own_addr, ETH_ALEN);
 367         hdr->ethertype = htons(ETH_P_PAE);
 368
 369         pos = (u8 *) (hdr + 1);
 370         os_memcpy(pos, data, data_len);
 371
 372         res = send(drv->common.sock, (u8 *) hdr, len, 0);
 373         os_free(hdr);
 374
 375         if (res < 0) {
 376                 wpa_printf(MSG_ERROR,
 377                            "macsec_qca_send_eapol - packet len: %lu - failed: send: %s",
 378                            (unsigned long) len, strerror(errno));
 379         }
 380
 381         return res;
 382 }
 383
 384
 385 static int macsec_qca_macsec_init(void *priv, struct macsec_init_params *params)
 386 {
 387         struct macsec_qca_data *drv = priv;
 388
 389         drv->always_include_sci = params->always_include_sci;
 390         drv->use_es = params->use_es;
 391         drv->use_scb = params->use_scb;
 392
 393         wpa_printf(MSG_DEBUG, "%s: es=%d, scb=%d, sci=%d",
 394                    __func__, drv->use_es, drv->use_scb,
 395                    drv->always_include_sci);
 396
 397         __macsec_drv_init(drv);
 398
 399         return 0;
 400 }
 401
 402
 403 static int macsec_qca_macsec_deinit(void *priv)
 404 {
 405         struct macsec_qca_data *drv = priv;
 406
 407         wpa_printf(MSG_DEBUG, "%s", __func__);
 408
 409         __macsec_drv_deinit(drv);
 410
 411         return 0;
 412 }
 413
 414
 415 static int macsec_qca_get_capability(void *priv, enum macsec_cap *cap)
 416 {
 417         wpa_printf(MSG_DEBUG, "%s", __func__);
 418
 419         *cap = MACSEC_CAP_INTEG_AND_CONF_0_30_50;
 420
 421         return 0;
 422 }
 423
 424
 425 static int macsec_qca_enable_protect_frames(void *priv, Boolean enabled)
 426 {
 427         struct macsec_qca_data *drv = priv;
 428         int ret = 0;
 429
 430         wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
 431
 432         drv->protect_frames = enabled;
 433
 434         return ret;
 435 }
 436
 437
 438 static int macsec_qca_set_replay_protect(void *priv, Boolean enabled,
 439                                          unsigned int window)
 440 {
 441         struct macsec_qca_data *drv = priv;
 442         int ret = 0;
 443
 444         wpa_printf(MSG_DEBUG, "%s: enabled=%d, win=%u",
 445                    __func__, enabled, window);
 446
 447         drv->replay_protect = enabled;
 448         drv->replay_window = window;
 449
 450         return ret;
 451 }
 452
 453
 454 static fal_cipher_suite_e macsec_qca_cs_type_get(u64 cs)
 455 {
 456         if (cs == CS_ID_GCM_AES_128)
 457                 return FAL_CIPHER_SUITE_AES_GCM_128;
 458         if (cs == CS_ID_GCM_AES_256)
 459                 return FAL_CIPHER_SUITE_AES_GCM_256;
 460         return FAL_CIPHER_SUITE_MAX;
 461 }
 462
 463
 464 static int macsec_qca_set_current_cipher_suite(void *priv, u64 cs)
 465 {
 466         struct macsec_qca_data *drv = priv;
 467         fal_cipher_suite_e cs_type;
 468
 469         if (cs != CS_ID_GCM_AES_128 && cs != CS_ID_GCM_AES_256) {
 470                 wpa_printf(MSG_ERROR,
 471                            "%s: NOT supported CipherSuite: %016" PRIx64,
 472                            __func__, cs);
 473                 return -1;
 474         }
 475
 476         wpa_printf(MSG_DEBUG, "%s: CipherSuite: %016" PRIx64, __func__, cs);
 477
 478         cs_type = macsec_qca_cs_type_get(cs);
 479         return nss_macsec_secy_cipher_suite_set(drv->secy_id, cs_type);
 480 }
 481
 482
 483 static int macsec_qca_enable_controlled_port(void *priv, Boolean enabled)
 484 {
 485         struct macsec_qca_data *drv = priv;
 486         int ret = 0;
 487
 488         wpa_printf(MSG_DEBUG, "%s: enable=%d", __func__, enabled);
 489
 490         ret += nss_macsec_secy_controlled_port_en_set(drv->secy_id, enabled);
 491
 492         return ret;
 493 }
 494
 495
 496 static int macsec_qca_lookup_channel(struct channel_map *map,
 497                                      struct ieee802_1x_mka_sci *sci,
 498                                      u32 *channel)
 499 {
 500         u32 i;
 501
 502         for (i = 0; i < MAXSC; i++) {
 503                 if (os_memcmp(&map[i].sci, sci,
 504                               sizeof(struct ieee802_1x_mka_sci)) == 0) {
 505                         *channel = i;
 506                         return 0;
 507                 }
 508         }
 509
 510         return -1;
 511 }
 512
 513
 514 static void macsec_qca_register_channel(struct channel_map *map,
 515                                         struct ieee802_1x_mka_sci *sci,
 516                                         u32 channel)
 517 {
 518         os_memcpy(&map[channel].sci, sci, sizeof(struct ieee802_1x_mka_sci));
 519 }
 520
 521
 522 static int macsec_qca_lookup_receive_channel(struct macsec_qca_data *drv,
 523                                              struct receive_sc *sc,
 524                                              u32 *channel)
 525 {
 526         return macsec_qca_lookup_channel(drv->receive_channel_map, &sc->sci,
 527                                          channel);
 528 }
 529
 530
 531 static void macsec_qca_register_receive_channel(struct macsec_qca_data *drv,
 532                                                 struct receive_sc *sc,
 533                                                 u32 channel)
 534 {
 535         macsec_qca_register_channel(drv->receive_channel_map, &sc->sci,
 536                                     channel);
 537 }
 538
 539
 540 static int macsec_qca_lookup_transmit_channel(struct macsec_qca_data *drv,
 541                                               struct transmit_sc *sc,
 542                                               u32 *channel)
 543 {
 544         return macsec_qca_lookup_channel(drv->transmit_channel_map, &sc->sci,
 545                                          channel);
 546 }
 547
 548
 549 static void macsec_qca_register_transmit_channel(struct macsec_qca_data *drv,
 550                                                  struct transmit_sc *sc,
 551                                                  u32 channel)
 552 {
 553         macsec_qca_register_channel(drv->transmit_channel_map, &sc->sci,
 554                                     channel);
 555 }
 556
 557
 558 static int macsec_qca_get_receive_lowest_pn(void *priv, struct receive_sa *sa)
 559 {
 560         struct macsec_qca_data *drv = priv;
 561         int ret = 0;
 562         u32 next_pn = 0;
 563         bool enabled = FALSE;
 564         u32 win;
 565         u32 channel;
 566
 567         ret = macsec_qca_lookup_receive_channel(priv, sa->sc, &channel);
 568         if (ret != 0)
 569                 return ret;
 570
 571         ret += nss_macsec_secy_rx_sa_next_pn_get(drv->secy_id, channel, sa->an,
 572                                                  &next_pn);
 573         ret += nss_macsec_secy_rx_sc_replay_protect_get(drv->secy_id, channel,
 574                                                         &enabled);
 575         ret += nss_macsec_secy_rx_sc_anti_replay_window_get(drv->secy_id,
 576                                                             channel, &win);
 577
 578         if (enabled)
 579                 sa->lowest_pn = (next_pn > win) ? (next_pn - win) : 1;
 580         else
 581                 sa->lowest_pn = next_pn;
 582
 583         wpa_printf(MSG_DEBUG, "%s: lpn=0x%x", __func__, sa->lowest_pn);
 584
 585         return ret;
 586 }
 587
 588
 589 static int macsec_qca_get_transmit_next_pn(void *priv, struct transmit_sa *sa)
 590 {
 591         struct macsec_qca_data *drv = priv;
 592         int ret = 0;
 593         u32 channel;
 594
 595         ret = macsec_qca_lookup_transmit_channel(priv, sa->sc, &channel);
 596         if (ret != 0)
 597                 return ret;
 598
 599         ret += nss_macsec_secy_tx_sa_next_pn_get(drv->secy_id, channel, sa->an,
 600                                                  &sa->next_pn);
 601
 602         wpa_printf(MSG_DEBUG, "%s: npn=0x%x", __func__, sa->next_pn);
 603
 604         return ret;
 605 }
 606
 607
 608 static int macsec_qca_set_transmit_next_pn(void *priv, struct transmit_sa *sa)
 609 {
 610         struct macsec_qca_data *drv = priv;
 611         int ret = 0;
 612         u32 channel;
 613
 614         ret = macsec_qca_lookup_transmit_channel(priv, sa->sc, &channel);
 615         if (ret != 0)
 616                 return ret;
 617
 618         ret += nss_macsec_secy_tx_sa_next_pn_set(drv->secy_id, channel, sa->an,
 619                                                  sa->next_pn);
 620
 621         wpa_printf(MSG_INFO, "%s: npn=0x%x", __func__, sa->next_pn);
 622
 623         return ret;
 624 }
 625
 626
 627 static int macsec_qca_get_available_receive_sc(void *priv, u32 *channel)
 628 {
 629         struct macsec_qca_data *drv = priv;
 630         int ret = 0;
 631         u32 sc_ch = 0;
 632         bool in_use = FALSE;
 633
 634         for (sc_ch = 0; sc_ch < MAXSC; sc_ch++) {
 635                 ret = nss_macsec_secy_rx_sc_in_used_get(drv->secy_id, sc_ch,
 636                                                         &in_use);
 637                 if (ret)
 638                         continue;
 639
 640                 if (!in_use) {
 641                         *channel = sc_ch;
 642                         wpa_printf(MSG_DEBUG, "%s: channel=%d",
 643                                    __func__, *channel);
 644                         return 0;
 645                 }
 646         }
 647
 648         wpa_printf(MSG_DEBUG, "%s: no available channel", __func__);
 649
 650         return -1;
 651 }
 652
 653
 654 static int macsec_qca_create_receive_sc(void *priv, struct receive_sc *sc,
 655                                         unsigned int conf_offset,
 656                                         int validation)
 657 {
 658         struct macsec_qca_data *drv = priv;
 659         int ret = 0;
 660         fal_rx_prc_lut_t entry;
 661         fal_rx_sc_validate_frame_e vf;
 662         enum validate_frames validate_frames = validation;
 663         u32 channel;
 664         const u8 *sci_addr = sc->sci.addr;
 665         u16 sci_port = be_to_host16(sc->sci.port);
 666
 667         ret = macsec_qca_get_available_receive_sc(priv, &channel);
 668         if (ret != 0)
 669                 return ret;
 670
 671         wpa_printf(MSG_DEBUG, "%s: channel=%d", __func__, channel);
 672
 673         /* rx prc lut */
 674         os_memset(&entry, 0, sizeof(entry));
 675
 676         os_memcpy(entry.sci, sci_addr, ETH_ALEN);
 677         entry.sci[6] = (sci_port >> 8) & 0xff;
 678         entry.sci[7] = sci_port & 0xff;
 679         entry.sci_mask = 0xf;
 680
 681         entry.valid = 1;
 682         entry.channel = channel;
 683         entry.action = FAL_RX_PRC_ACTION_PROCESS;
 684         entry.offset = conf_offset;
 685
 686         /* rx validate frame  */
 687         if (validate_frames == Strict)
 688                 vf = FAL_RX_SC_VALIDATE_FRAME_STRICT;
 689         else if (validate_frames == Checked)
 690                 vf = FAL_RX_SC_VALIDATE_FRAME_CHECK;
 691         else
 692                 vf = FAL_RX_SC_VALIDATE_FRAME_DISABLED;
 693
 694         ret += nss_macsec_secy_rx_prc_lut_set(drv->secy_id, channel, &entry);
 695         ret += nss_macsec_secy_rx_sc_create(drv->secy_id, channel);
 696         ret += nss_macsec_secy_rx_sc_validate_frame_set(drv->secy_id, channel,
 697                                                         vf);
 698         ret += nss_macsec_secy_rx_sc_replay_protect_set(drv->secy_id, channel,
 699                                                         drv->replay_protect);
 700         ret += nss_macsec_secy_rx_sc_anti_replay_window_set(drv->secy_id,
 701                                                             channel,
 702                                                             drv->replay_window);
 703
 704         macsec_qca_register_receive_channel(drv, sc, channel);
 705
 706         return ret;
 707 }
 708
 709
 710 static int macsec_qca_delete_receive_sc(void *priv, struct receive_sc *sc)
 711 {
 712         struct macsec_qca_data *drv = priv;
 713         int ret;
 714         fal_rx_prc_lut_t entry;
 715         u32 channel;
 716
 717         ret = macsec_qca_lookup_receive_channel(priv, sc, &channel);
 718         if (ret != 0)
 719                 return ret;
 720
 721         wpa_printf(MSG_DEBUG, "%s: channel=%d", __func__, channel);
 722
 723         /* rx prc lut */
 724         os_memset(&entry, 0, sizeof(entry));
 725
 726         ret += nss_macsec_secy_rx_sc_del(drv->secy_id, channel);
 727         ret += nss_macsec_secy_rx_prc_lut_set(drv->secy_id, channel, &entry);
 728
 729         return ret;
 730 }
 731
 732
 733 static int macsec_qca_create_receive_sa(void *priv, struct receive_sa *sa)
 734 {
 735         struct macsec_qca_data *drv = priv;
 736         int ret;
 737         fal_rx_sak_t rx_sak;
 738         int i = 0;
 739         u32 channel;
 740         fal_rx_prc_lut_t entry;
 741         u32 offset;
 742
 743         ret = macsec_qca_lookup_receive_channel(priv, sa->sc, &channel);
 744         if (ret != 0)
 745                 return ret;
 746
 747         wpa_printf(MSG_DEBUG, "%s, channel=%d, an=%d, lpn=0x%x",
 748                    __func__, channel, sa->an, sa->lowest_pn);
 749
 750         os_memset(&rx_sak, 0, sizeof(rx_sak));
 751         rx_sak.sak_len = sa->pkey->key_len;
 752         if (sa->pkey->key_len == SAK_128_LEN) {
 753                 for (i = 0; i < 16; i++)
 754                         rx_sak.sak[i] = sa->pkey->key[15 - i];
 755         } else if (sa->pkey->key_len == SAK_256_LEN) {
 756                 for (i = 0; i < 16; i++) {
 757                         rx_sak.sak1[i] = sa->pkey->key[15 - i];
 758                         rx_sak.sak[i] = sa->pkey->key[31 - i];
 759                 }
 760         } else {
 761                 return -1;
 762         }
 763
 764         if (sa->pkey->confidentiality_offset == CONFIDENTIALITY_OFFSET_0)
 765                 offset = 0;
 766         else if (sa->pkey->confidentiality_offset == CONFIDENTIALITY_OFFSET_30)
 767                 offset = 30;
 768         else if (sa->pkey->confidentiality_offset == CONFIDENTIALITY_OFFSET_50)
 769                 offset = 50;
 770         else
 771                 return -1;
 772         ret += nss_macsec_secy_rx_prc_lut_get(drv->secy_id, channel, &entry);
 773         entry.offset = offset;
 774         ret += nss_macsec_secy_rx_prc_lut_set(drv->secy_id, channel, &entry);
 775         ret += nss_macsec_secy_rx_sa_create(drv->secy_id, channel, sa->an);
 776         ret += nss_macsec_secy_rx_sak_set(drv->secy_id, channel, sa->an,
 777                                           &rx_sak);
 778
 779         return ret;
 780 }
 781
 782
 783 static int macsec_qca_enable_receive_sa(void *priv, struct receive_sa *sa)
 784 {
 785         struct macsec_qca_data *drv = priv;
 786         int ret;
 787         u32 channel;
 788
 789         ret = macsec_qca_lookup_receive_channel(priv, sa->sc, &channel);
 790         if (ret != 0)
 791                 return ret;
 792
 793         wpa_printf(MSG_DEBUG, "%s: channel=%d, an=%d", __func__, channel,
 794                    sa->an);
 795
 796         ret += nss_macsec_secy_rx_sa_en_set(drv->secy_id, channel, sa->an,
 797                                             TRUE);
 798
 799         return ret;
 800 }
 801
 802
 803 static int macsec_qca_disable_receive_sa(void *priv, struct receive_sa *sa)
 804 {
 805         struct macsec_qca_data *drv = priv;
 806         int ret;
 807         u32 channel;
 808
 809         ret = macsec_qca_lookup_receive_channel(priv, sa->sc, &channel);
 810         if (ret != 0)
 811                 return ret;
 812
 813         wpa_printf(MSG_DEBUG, "%s: channel=%d, an=%d", __func__, channel,
 814                    sa->an);
 815
 816         ret += nss_macsec_secy_rx_sa_en_set(drv->secy_id, channel, sa->an,
 817                                             FALSE);
 818
 819         return ret;
 820 }
 821
 822
 823 static int macsec_qca_get_available_transmit_sc(void *priv, u32 *channel)
 824 {
 825         struct macsec_qca_data *drv = priv;
 826         u32 sc_ch = 0;
 827         bool in_use = FALSE;
 828
 829         for (sc_ch = 0; sc_ch < MAXSC; sc_ch++) {
 830                 if (nss_macsec_secy_tx_sc_in_used_get(drv->secy_id, sc_ch,
 831                                                       &in_use))
 832                         continue;
 833
 834                 if (!in_use) {
 835                         *channel = sc_ch;
 836                         wpa_printf(MSG_DEBUG, "%s: channel=%d",
 837                                    __func__, *channel);
 838                         return 0;
 839                 }
 840         }
 841
 842         wpa_printf(MSG_DEBUG, "%s: no avaiable channel", __func__);
 843
 844         return -1;
 845 }
 846
 847
 848 static int macsec_qca_create_transmit_sc(void *priv, struct transmit_sc *sc,
 849                                          unsigned int conf_offset)
 850 {
 851         struct macsec_qca_data *drv = priv;
 852         int ret;
 853         fal_tx_class_lut_t entry;
 854         u8 psci[ETH_ALEN + 2];
 855         u32 channel;
 856         u16 sci_port = be_to_host16(sc->sci.port);
 857
 858         ret = macsec_qca_get_available_transmit_sc(priv, &channel);
 859         if (ret != 0)
 860                 return ret;
 861
 862         wpa_printf(MSG_DEBUG, "%s: channel=%d", __func__, channel);
 863
 864         /* class lut */
 865         os_memset(&entry, 0, sizeof(entry));
 866
 867         entry.valid = 1;
 868         entry.action = FAL_TX_CLASS_ACTION_FORWARD;
 869         entry.channel = channel;
 870
 871         os_memcpy(psci, sc->sci.addr, ETH_ALEN);
 872         psci[6] = (sci_port >> 8) & 0xff;
 873         psci[7] = sci_port & 0xff;
 874
 875         ret += nss_macsec_secy_tx_class_lut_set(drv->secy_id, channel, &entry);
 876         ret += nss_macsec_secy_tx_sc_create(drv->secy_id, channel, psci, 8);
 877         ret += nss_macsec_secy_tx_sc_protect_set(drv->secy_id, channel,
 878                                                  drv->protect_frames);
 879         ret += nss_macsec_secy_tx_sc_confidentiality_offset_set(drv->secy_id,
 880                                                                 channel,
 881                                                                 conf_offset);
 882
 883         macsec_qca_register_transmit_channel(drv, sc, channel);
 884
 885         return ret;
 886 }
 887
 888
 889 static int macsec_qca_delete_transmit_sc(void *priv, struct transmit_sc *sc)
 890 {
 891         struct macsec_qca_data *drv = priv;
 892         int ret;
 893         fal_tx_class_lut_t entry;
 894         u32 channel;
 895
 896         ret = macsec_qca_lookup_transmit_channel(priv, sc, &channel);
 897         if (ret != 0)
 898                 return ret;
 899
 900         wpa_printf(MSG_DEBUG, "%s: channel=%d", __func__, channel);
 901
 902         /* class lut */
 903         os_memset(&entry, 0, sizeof(entry));
 904
 905         ret += nss_macsec_secy_tx_class_lut_set(drv->secy_id, channel, &entry);
 906         ret += nss_macsec_secy_tx_sc_del(drv->secy_id, channel);
 907
 908         return ret;
 909 }
 910
 911
 912 static int macsec_qca_create_transmit_sa(void *priv, struct transmit_sa *sa)
 913 {
 914         struct macsec_qca_data *drv = priv;
 915         int ret;
 916         u8 tci = 0;
 917         fal_tx_sak_t tx_sak;
 918         int i;
 919         u32 channel;
 920         u32 offset;
 921
 922         ret = macsec_qca_lookup_transmit_channel(priv, sa->sc, &channel);
 923         if (ret != 0)
 924                 return ret;
 925
 926         wpa_printf(MSG_DEBUG,
 927                    "%s: channel=%d, an=%d, next_pn=0x%x, confidentiality=%d",
 928                    __func__, channel, sa->an, sa->next_pn, sa->confidentiality);
 929
 930         if (drv->always_include_sci)
 931                 tci |= TCI_SC;
 932         else if (drv->use_es)
 933                 tci |= TCI_ES;
 934         else if (drv->use_scb)
 935                 tci |= TCI_SCB;
 936
 937         if (sa->confidentiality)
 938                 tci |= TCI_E | TCI_C;
 939
 940         os_memset(&tx_sak, 0, sizeof(tx_sak));
 941         tx_sak.sak_len = sa->pkey->key_len;
 942         if (sa->pkey->key_len == SAK_128_LEN) {
 943                 for (i = 0; i < 16; i++)
 944                         tx_sak.sak[i] = sa->pkey->key[15 - i];
 945         } else if (sa->pkey->key_len == SAK_256_LEN) {
 946                 for (i = 0; i < 16; i++) {
 947                         tx_sak.sak1[i] = sa->pkey->key[15 - i];
 948                         tx_sak.sak[i] = sa->pkey->key[31 - i];
 949                 }
 950         } else {
 951                 return -1;
 952         }
 953
 954         if (sa->pkey->confidentiality_offset == CONFIDENTIALITY_OFFSET_0)
 955                 offset = 0;
 956         else if (sa->pkey->confidentiality_offset == CONFIDENTIALITY_OFFSET_30)
 957                 offset = 30;
 958         else if (sa->pkey->confidentiality_offset == CONFIDENTIALITY_OFFSET_50)
 959                 offset = 50;
 960         else
 961                 return -1;
 962         ret += nss_macsec_secy_tx_sc_confidentiality_offset_set(drv->secy_id,
 963                                                                 channel,
 964                                                                 offset);
 965         ret += nss_macsec_secy_tx_sa_next_pn_set(drv->secy_id, channel, sa->an,
 966                                                  sa->next_pn);
 967         ret += nss_macsec_secy_tx_sak_set(drv->secy_id, channel, sa->an,
 968                                           &tx_sak);
 969         ret += nss_macsec_secy_tx_sc_tci_7_2_set(drv->secy_id, channel,
 970                                                  (tci >> 2));
 971         ret += nss_macsec_secy_tx_sc_an_set(drv->secy_id, channel, sa->an);
 972
 973         return ret;
 974 }
 975
 976
 977 static int macsec_qca_enable_transmit_sa(void *priv, struct transmit_sa *sa)
 978 {
 979         struct macsec_qca_data *drv = priv;
 980         int ret;
 981         u32 channel;
 982
 983         ret = macsec_qca_lookup_transmit_channel(priv, sa->sc, &channel);
 984         if (ret != 0)
 985                 return ret;
 986
 987         wpa_printf(MSG_DEBUG, "%s: channel=%d, an=%d", __func__, channel,
 988                    sa->an);
 989
 990         ret += nss_macsec_secy_tx_sa_en_set(drv->secy_id, channel, sa->an,
 991                                             TRUE);
 992
 993         return ret;
 994 }
 995
 996
 997 static int macsec_qca_disable_transmit_sa(void *priv, struct transmit_sa *sa)
 998 {
 999         struct macsec_qca_data *drv = priv;
1000         int ret;
1001         u32 channel;
1002
1003         ret = macsec_qca_lookup_transmit_channel(priv, sa->sc, &channel);
1004         if (ret != 0)
1005                 return ret;
1006
1007         wpa_printf(MSG_DEBUG, "%s: channel=%d, an=%d", __func__, channel,
1008                    sa->an);
1009
1010         ret += nss_macsec_secy_tx_sa_en_set(drv->secy_id, channel, sa->an,
1011                                             FALSE);
1012
1013         return ret;
1014 }
1015
1016
1017 const struct wpa_driver_ops wpa_driver_macsec_qca_ops = {
1018         .name = "macsec_qca",
1019         .desc = "QCA MACsec Ethernet driver",
1020         .get_ssid = driver_wired_get_ssid,
1021         .get_bssid = driver_wired_get_bssid,
1022         .get_capa = driver_wired_get_capa,
1023         .init = macsec_qca_init,
1024         .deinit = macsec_qca_deinit,
1025         .hapd_init = macsec_qca_hapd_init,
1026         .hapd_deinit = macsec_qca_hapd_deinit,
1027         .hapd_send_eapol = macsec_qca_send_eapol,
1028
1029         .macsec_init = macsec_qca_macsec_init,
1030         .macsec_deinit = macsec_qca_macsec_deinit,
1031         .macsec_get_capability = macsec_qca_get_capability,
1032         .enable_protect_frames = macsec_qca_enable_protect_frames,
1033         .set_replay_protect = macsec_qca_set_replay_protect,
1034         .set_current_cipher_suite = macsec_qca_set_current_cipher_suite,
1035         .enable_controlled_port = macsec_qca_enable_controlled_port,
1036         .get_receive_lowest_pn = macsec_qca_get_receive_lowest_pn,
1037         .get_transmit_next_pn = macsec_qca_get_transmit_next_pn,
1038         .set_transmit_next_pn = macsec_qca_set_transmit_next_pn,
1039         .create_receive_sc = macsec_qca_create_receive_sc,
1040         .delete_receive_sc = macsec_qca_delete_receive_sc,
1041         .create_receive_sa = macsec_qca_create_receive_sa,
1042         .enable_receive_sa = macsec_qca_enable_receive_sa,
1043         .disable_receive_sa = macsec_qca_disable_receive_sa,
1044         .create_transmit_sc = macsec_qca_create_transmit_sc,
1045         .delete_transmit_sc = macsec_qca_delete_transmit_sc,
1046         .create_transmit_sa = macsec_qca_create_transmit_sa,
1047         .enable_transmit_sa = macsec_qca_enable_transmit_sa,
1048         .disable_transmit_sa = macsec_qca_disable_transmit_sa,
1049 };