[PATCH net-next v3 0/4] Support MACsec VLAN

[PATCH net-next v3 0/4] Support MACsec VLAN

[Emeel Hakim]

Dear maintainers,

This patch series introduces support for hardware (HW) offload MACsec
devices with VLAN configuration. The patches address both scenarios
where the VLAN header is both the inner and outer header for MACsec.

The changes include:

1. Adding MACsec offload operation for VLAN.
2. Considering VLAN when accessing MACsec net device.
3. Currently offloading MACsec when it's configured over VLAN with
current MACsec TX steering rules would wrongly insert the MACsec sec tag
after inserting the VLAN header. This resulted in an ETHERNET | SECTAG |
VLAN packet when ETHERNET | VLAN | SECTAG is configured. The patche
handles this issue when configuring steering rules.
4. Adding MACsec rx_handler change support in case of a marked skb and a
mismatch on the dst MAC address.

Please review these changes and let me know if you have any feedback or
concerns.

Updates since v1:
- Consult vlan_features when adding NETIF_F_HW_MACSEC.
- Allow grep for the functions.
- Add helper function to get the macsec operation to allow the compiler
  to make some choice.

Updates since v2:
- Don't use macros to allow direct navigattion from mdo functions to its implementation.
- Make the vlan_get_macsec_ops argument a const.
- Check if the specific mdo function is available before calling it.

Thanks,
Emeel

Emeel Hakim (4):
  vlan: Add MACsec offload operations for VLAN interface
  net/mlx5: Support MACsec over VLAN
  net/mlx5: Consider VLAN interface in MACsec TX steering rules
  macsec: Add MACsec rx_handler change support

 .../mellanox/mlx5/core/en_accel/macsec.c      |  42 +++--
 .../mellanox/mlx5/core/en_accel/macsec_fs.c   |   7 +
 .../net/ethernet/mellanox/mlx5/core/en_main.c |   1 +
 drivers/net/macsec.c                          |   9 ++
 net/8021q/vlan_dev.c                          | 153 ++++++++++++++++++
 5 files changed, 196 insertions(+), 16 deletions(-)

-- 
2.21.3

[PATCH net-next v3 1/4] vlan: Add MACsec offload operations for VLAN interface

[Emeel Hakim]

Add support for MACsec offload operations for VLAN driver
to allow offloading MACsec when VLAN's real device supports
Macsec offload by forwarding the offload request to it.

Signed-off-by: Emeel Hakim <ehakim@nvidia.com>
---
 .../net/ethernet/mellanox/mlx5/core/en_main.c |   1 +
 net/8021q/vlan_dev.c                          | 153 ++++++++++++++++++
 2 files changed, 154 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 6db1aff8778d..5ecef26e83c6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -5076,6 +5076,7 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
 
 	netdev->vlan_features    |= NETIF_F_SG;
 	netdev->vlan_features    |= NETIF_F_HW_CSUM;
+	netdev->vlan_features    |= NETIF_F_HW_MACSEC;
 	netdev->vlan_features    |= NETIF_F_GRO;
 	netdev->vlan_features    |= NETIF_F_TSO;
 	netdev->vlan_features    |= NETIF_F_TSO6;
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 5920544e93e8..16efc1bfc345 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -26,6 +26,7 @@
 #include <linux/ethtool.h>
 #include <linux/phy.h>
 #include <net/arp.h>
+#include <net/macsec.h>
 
 #include "vlan.h"
 #include "vlanproc.h"
@@ -572,6 +573,9 @@ static int vlan_dev_init(struct net_device *dev)
 			   NETIF_F_HIGHDMA | NETIF_F_SCTP_CRC |
 			   NETIF_F_ALL_FCOE;
 
+	if (real_dev->features & NETIF_F_HW_MACSEC)
+		dev->hw_features |= NETIF_F_HW_MACSEC;
+
 	dev->features |= dev->hw_features | NETIF_F_LLTX;
 	netif_inherit_tso_max(dev, real_dev);
 	if (dev->features & NETIF_F_VLAN_FEATURES)
@@ -803,6 +807,152 @@ static int vlan_dev_fill_forward_path(struct net_device_path_ctx *ctx,
 	return 0;
 }
 
+#if IS_ENABLED(CONFIG_MACSEC)
+
+static const struct macsec_ops *vlan_get_macsec_ops(const struct macsec_context *ctx)
+{
+	return vlan_dev_priv(ctx->netdev)->real_dev->macsec_ops;
+}
+
+static int vlan_macsec_add_txsa(struct macsec_context *ctx)
+{
+	const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
+
+	if (!ops || !ops->mdo_add_txsa)
+		return -EOPNOTSUPP;
+
+	return ops->mdo_add_txsa(ctx);
+}
+
+static int vlan_macsec_upd_txsa(struct macsec_context *ctx)
+{
+	const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
+
+	if (!ops || !ops->mdo_upd_txsa)
+		return -EOPNOTSUPP;
+
+	return ops->mdo_upd_txsa(ctx);
+}
+
+static int vlan_macsec_del_txsa(struct macsec_context *ctx)
+{
+	const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
+
+	if (!ops || !ops->mdo_del_txsa)
+		return -EOPNOTSUPP;
+
+	return ops->mdo_del_txsa(ctx);
+}
+
+static int vlan_macsec_add_rxsa(struct macsec_context *ctx)
+{
+	const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
+
+	if (!ops || !ops->mdo_add_rxsa)
+		return -EOPNOTSUPP;
+
+	return ops->mdo_add_rxsa(ctx);
+}
+
+static int vlan_macsec_upd_rxsa(struct macsec_context *ctx)
+{
+	const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
+
+	if (!ops || !ops->mdo_upd_rxsa)
+		return -EOPNOTSUPP;
+
+	return ops->mdo_upd_rxsa(ctx);
+}
+
+static int vlan_macsec_del_rxsa(struct macsec_context *ctx)
+{
+	const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
+
+	if (!ops || !ops->mdo_del_rxsa)
+		return -EOPNOTSUPP;
+
+	return ops->mdo_del_rxsa(ctx);
+}
+
+static int vlan_macsec_add_rxsc(struct macsec_context *ctx)
+{
+	const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
+
+	if (!ops || !ops->mdo_add_rxsc)
+		return -EOPNOTSUPP;
+
+	return ops->mdo_add_rxsc(ctx);
+}
+
+static int vlan_macsec_upd_rxsc(struct macsec_context *ctx)
+{
+	const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
+
+	if (!ops || !ops->mdo_upd_rxsc)
+		return -EOPNOTSUPP;
+
+	return ops->mdo_upd_rxsc(ctx);
+}
+
+static int vlan_macsec_del_rxsc(struct macsec_context *ctx)
+{
+	const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
+
+	if (!ops || !ops->mdo_del_rxsc)
+		return -EOPNOTSUPP;
+
+	return ops->mdo_del_rxsc(ctx);
+}
+
+static int vlan_macsec_add_secy(struct macsec_context *ctx)
+{
+	const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
+
+	if (!ops || !ops->mdo_add_secy)
+		return -EOPNOTSUPP;
+
+	return ops->mdo_add_secy(ctx);
+}
+
+static int vlan_macsec_upd_secy(struct macsec_context *ctx)
+{
+	const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
+
+	if (!ops || !ops->mdo_upd_secy)
+		return -EOPNOTSUPP;
+
+	return ops->mdo_upd_secy(ctx);
+}
+
+static int vlan_macsec_del_secy(struct macsec_context *ctx)
+{
+	const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
+
+	if (!ops || !ops->mdo_del_secy)
+		return -EOPNOTSUPP;
+
+	return ops->mdo_del_secy(ctx);
+}
+
+#undef _BUILD_VLAN_MACSEC_MDO
+
+static const struct macsec_ops macsec_offload_ops = {
+	.mdo_add_txsa = vlan_macsec_add_txsa,
+	.mdo_upd_txsa = vlan_macsec_upd_txsa,
+	.mdo_del_txsa = vlan_macsec_del_txsa,
+	.mdo_add_rxsc = vlan_macsec_add_rxsc,
+	.mdo_upd_rxsc = vlan_macsec_upd_rxsc,
+	.mdo_del_rxsc = vlan_macsec_del_rxsc,
+	.mdo_add_rxsa = vlan_macsec_add_rxsa,
+	.mdo_upd_rxsa = vlan_macsec_upd_rxsa,
+	.mdo_del_rxsa = vlan_macsec_del_rxsa,
+	.mdo_add_secy = vlan_macsec_add_secy,
+	.mdo_upd_secy = vlan_macsec_upd_secy,
+	.mdo_del_secy = vlan_macsec_del_secy,
+};
+
+#endif
+
 static const struct ethtool_ops vlan_ethtool_ops = {
 	.get_link_ksettings	= vlan_ethtool_get_link_ksettings,
 	.get_drvinfo	        = vlan_ethtool_get_drvinfo,
@@ -869,6 +1019,9 @@ void vlan_setup(struct net_device *dev)
 	dev->priv_destructor	= vlan_dev_free;
 	dev->ethtool_ops	= &vlan_ethtool_ops;
 
+#if IS_ENABLED(CONFIG_MACSEC)
+	dev->macsec_ops		= &macsec_offload_ops;
+#endif
 	dev->min_mtu		= 0;
 	dev->max_mtu		= ETH_MAX_MTU;
 
-- 
2.21.3

Re: [PATCH net-next v3 1/4] vlan: Add MACsec offload operations for VLAN interface

[Simon Horman]

On Thu, Mar 30, 2023 at 04:57:12PM +0300, Emeel Hakim wrote:
> Add support for MACsec offload operations for VLAN driver
> to allow offloading MACsec when VLAN's real device supports
> Macsec offload by forwarding the offload request to it.
> 
> Signed-off-by: Emeel Hakim <ehakim@nvidia.com>

Reviewed-by: Simon Horman <simon.horman@corigine.com>

Re: [PATCH net-next v3 1/4] vlan: Add MACsec offload operations for VLAN interface

[Sabrina Dubroca]

2023-03-30, 16:57:12 +0300, Emeel Hakim wrote:
> +static int vlan_macsec_del_secy(struct macsec_context *ctx)
> +{
> +	const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
> +
> +	if (!ops || !ops->mdo_del_secy)
> +		return -EOPNOTSUPP;
> +
> +	return ops->mdo_del_secy(ctx);
> +}
> +
> +#undef _BUILD_VLAN_MACSEC_MDO

FWIW, I didn't have a problem with this particular macro, only
VLAN_MACSEC_DECLARE_MDO. But if you're going to remove
_BUILD_VLAN_MACSEC_MDO, you need to remove it completely.

-- 
Sabrina

RE: [PATCH net-next v3 1/4] vlan: Add MACsec offload operations for VLAN interface

[Emeel Hakim]

> -----Original Message-----
> From: Sabrina Dubroca <sd@queasysnail.net>
> Sent: Wednesday, 5 April 2023 12:38
> To: Emeel Hakim <ehakim@nvidia.com>
> Cc: davem@davemloft.net; kuba@kernel.org; pabeni@redhat.com;
> edumazet@google.com; netdev@vger.kernel.org; leon@kernel.org
> Subject: Re: [PATCH net-next v3 1/4] vlan: Add MACsec offload operations for
> VLAN interface
> 
> External email: Use caution opening links or attachments
> 
> 
> 2023-03-30, 16:57:12 +0300, Emeel Hakim wrote:
> > +static int vlan_macsec_del_secy(struct macsec_context *ctx) {
> > +     const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
> > +
> > +     if (!ops || !ops->mdo_del_secy)
> > +             return -EOPNOTSUPP;
> > +
> > +     return ops->mdo_del_secy(ctx);
> > +}
> > +
> > +#undef _BUILD_VLAN_MACSEC_MDO
> 
> FWIW, I didn't have a problem with this particular macro, only
> VLAN_MACSEC_DECLARE_MDO. But if you're going to remove
> _BUILD_VLAN_MACSEC_MDO, you need to remove it completely.

right, I will remove it completely, since I want to prevent doing a return from a macro.

> --
> Sabrina

RE: [EXT] Fwd: [PATCH net-next v3 1/4] vlan: Add MACsec offload operations for VLAN interface

[Subbaraya Sundeep Bhatta]

Hi,

>From: Emeel Hakim <mailto:ehakim@nvidia.com>
>Date: Thu, Mar 30, 2023 at 7:57 PM
>Subject: [PATCH net-next v3 1/4] vlan: Add MACsec offload operations for
>VLAN interface
>To: <mailto:davem@davemloft.net>, <mailto:kuba@kernel.org>,
><mailto:pabeni@redhat.com>, <mailto:edumazet@google.com>,
><mailto:sd@queasysnail.net>
>Cc: <mailto:netdev@vger.kernel.org>, <mailto:leon@kernel.org>, Emeel
>Hakim <mailto:ehakim@nvidia.com>
>
>
>Add support for MACsec offload operations for VLAN driver to allow
>offloading MACsec when VLAN's real device supports Macsec offload by
>forwarding the offload request to it.
>
>Signed-off-by: Emeel Hakim <mailto:ehakim@nvidia.com>
>---
> .../net/ethernet/mellanox/mlx5/core/en_main.c |   1 +
> net/8021q/vlan_dev.c                          | 153 ++++++++++++++++++

Do not mix generic vlan code changes and your driver changes in one patch.

> 2 files changed, 154 insertions(+)
>
>diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
>b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
>index 6db1aff8778d..5ecef26e83c6 100644
>--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
>+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
>@@ -5076,6 +5076,7 @@ static void mlx5e_build_nic_netdev(struct
>net_device *netdev)
>
>        netdev->vlan_features    |= NETIF_F_SG;
>        netdev->vlan_features    |= NETIF_F_HW_CSUM;
>+       netdev->vlan_features    |= NETIF_F_HW_MACSEC;
>        netdev->vlan_features    |= NETIF_F_GRO;
>        netdev->vlan_features    |= NETIF_F_TSO;
>        netdev->vlan_features    |= NETIF_F_TSO6; diff --git
>a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c index
>5920544e93e8..16efc1bfc345 100644
>--- a/net/8021q/vlan_dev.c
>+++ b/net/8021q/vlan_dev.c
>@@ -26,6 +26,7 @@
> #include <linux/ethtool.h>
> #include <linux/phy.h>
> #include <net/arp.h>
>+#include <net/macsec.h>
>
> #include "vlan.h"
> #include "vlanproc.h"
>@@ -572,6 +573,9 @@ static int vlan_dev_init(struct net_device *dev)
>                           NETIF_F_HIGHDMA | NETIF_F_SCTP_CRC |
>                           NETIF_F_ALL_FCOE;
>
>+       if (real_dev->features & NETIF_F_HW_MACSEC)
>+               dev->hw_features |= NETIF_F_HW_MACSEC;
>+
>        dev->features |= dev->hw_features | NETIF_F_LLTX;
>        netif_inherit_tso_max(dev, real_dev);
>        if (dev->features & NETIF_F_VLAN_FEATURES) @@ -803,6 +807,152 @@
>static int vlan_dev_fill_forward_path(struct net_device_path_ctx *ctx,
>        return 0;
> }
>
>+#if IS_ENABLED(CONFIG_MACSEC)
>+
>+static const struct macsec_ops *vlan_get_macsec_ops(const struct
>+macsec_context *ctx) {
>+       return vlan_dev_priv(ctx->netdev)->real_dev->macsec_ops;
>+}
>+
>+static int vlan_macsec_add_txsa(struct macsec_context *ctx) {
>+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
>+
>+       if (!ops || !ops->mdo_add_txsa)
>+               return -EOPNOTSUPP;
>+
>+       return ops->mdo_add_txsa(ctx);
>+}
>+
>+static int vlan_macsec_upd_txsa(struct macsec_context *ctx) {
>+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
>+
>+       if (!ops || !ops->mdo_upd_txsa)
>+               return -EOPNOTSUPP;
>+
>+       return ops->mdo_upd_txsa(ctx);
>+}
>+
>+static int vlan_macsec_del_txsa(struct macsec_context *ctx) {
>+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
>+
>+       if (!ops || !ops->mdo_del_txsa)
>+               return -EOPNOTSUPP;
>+
>+       return ops->mdo_del_txsa(ctx);
>+}
>+
>+static int vlan_macsec_add_rxsa(struct macsec_context *ctx) {
>+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
>+
>+       if (!ops || !ops->mdo_add_rxsa)
>+               return -EOPNOTSUPP;
>+
>+       return ops->mdo_add_rxsa(ctx);
>+}
>+
>+static int vlan_macsec_upd_rxsa(struct macsec_context *ctx) {
>+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
>+
>+       if (!ops || !ops->mdo_upd_rxsa)
>+               return -EOPNOTSUPP;
>+
>+       return ops->mdo_upd_rxsa(ctx);
>+}
>+
>+static int vlan_macsec_del_rxsa(struct macsec_context *ctx) {
>+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
>+
>+       if (!ops || !ops->mdo_del_rxsa)
>+               return -EOPNOTSUPP;
>+
>+       return ops->mdo_del_rxsa(ctx);
>+}
>+
>+static int vlan_macsec_add_rxsc(struct macsec_context *ctx) {
>+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
>+
>+       if (!ops || !ops->mdo_add_rxsc)
>+               return -EOPNOTSUPP;
>+
>+       return ops->mdo_add_rxsc(ctx);
>+}
>+
>+static int vlan_macsec_upd_rxsc(struct macsec_context *ctx) {
>+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
>+
>+       if (!ops || !ops->mdo_upd_rxsc)
>+               return -EOPNOTSUPP;
>+
>+       return ops->mdo_upd_rxsc(ctx);
>+}
>+
>+static int vlan_macsec_del_rxsc(struct macsec_context *ctx) {
>+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
>+
>+       if (!ops || !ops->mdo_del_rxsc)
>+               return -EOPNOTSUPP;
>+
>+       return ops->mdo_del_rxsc(ctx);
>+}
>+
>+static int vlan_macsec_add_secy(struct macsec_context *ctx) {
>+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
>+
>+       if (!ops || !ops->mdo_add_secy)
>+               return -EOPNOTSUPP;
>+
>+       return ops->mdo_add_secy(ctx);
>+}
>+
>+static int vlan_macsec_upd_secy(struct macsec_context *ctx) {
>+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
>+
>+       if (!ops || !ops->mdo_upd_secy)
>+               return -EOPNOTSUPP;
>+
>+       return ops->mdo_upd_secy(ctx);
>+}
>+
>+static int vlan_macsec_del_secy(struct macsec_context *ctx) {
>+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
>+
>+       if (!ops || !ops->mdo_del_secy)
>+               return -EOPNOTSUPP;
>+
>+       return ops->mdo_del_secy(ctx);
>+}
>+
>+#undef _BUILD_VLAN_MACSEC_MDO
>+
I guess you missed to delete this.

>+static const struct macsec_ops macsec_offload_ops = {
>+       .mdo_add_txsa = vlan_macsec_add_txsa,
>+       .mdo_upd_txsa = vlan_macsec_upd_txsa,
>+       .mdo_del_txsa = vlan_macsec_del_txsa,
>+       .mdo_add_rxsc = vlan_macsec_add_rxsc,
>+       .mdo_upd_rxsc = vlan_macsec_upd_rxsc,
>+       .mdo_del_rxsc = vlan_macsec_del_rxsc,
>+       .mdo_add_rxsa = vlan_macsec_add_rxsa,
>+       .mdo_upd_rxsa = vlan_macsec_upd_rxsa,
>+       .mdo_del_rxsa = vlan_macsec_del_rxsa,
>+       .mdo_add_secy = vlan_macsec_add_secy,
>+       .mdo_upd_secy = vlan_macsec_upd_secy,
>+       .mdo_del_secy = vlan_macsec_del_secy, };
>+

Please add mdo_open, stop and stats too. Those are required for other macsec offload drivers.

Thanks.
Sundeep

>+#endif
>+
> static const struct ethtool_ops vlan_ethtool_ops = {
>        .get_link_ksettings     = vlan_ethtool_get_link_ksettings,
>        .get_drvinfo            = vlan_ethtool_get_drvinfo, @@ -869,6 +1019,9 @@
>void vlan_setup(struct net_device *dev)
>        dev->priv_destructor    = vlan_dev_free;
>        dev->ethtool_ops        = &vlan_ethtool_ops;
>
>+#if IS_ENABLED(CONFIG_MACSEC)
>+       dev->macsec_ops         = &macsec_offload_ops; #endif
>        dev->min_mtu            = 0;
>        dev->max_mtu            = ETH_MAX_MTU;
>
>--
>2.21.3

RE: [EXT] Fwd: [PATCH net-next v3 1/4] vlan: Add MACsec offload operations for VLAN interface

[Emeel Hakim]

> -----Original Message-----
> From: Subbaraya Sundeep Bhatta <sbhatta@marvell.com>
> Sent: Wednesday, 5 April 2023 16:47
> To: edumazet@google.com; Emeel Hakim <ehakim@nvidia.com>;
> davem@davemloft.net; kuba@kernel.org; pabeni@redhat.com;
> edumazet@google.com; sd@queasysnail.net
> Cc: netdev@vger.kernel.org; Sunil Kovvuri Goutham <sgoutham@marvell.com>
> Subject: RE: [EXT] Fwd: [PATCH net-next v3 1/4] vlan: Add MACsec offload
> operations for VLAN interface
> 
> External email: Use caution opening links or attachments
> 
> 
> Hi,
> 
> >From: Emeel Hakim <mailto:ehakim@nvidia.com>
> >Date: Thu, Mar 30, 2023 at 7:57 PM
> >Subject: [PATCH net-next v3 1/4] vlan: Add MACsec offload operations
> >for VLAN interface
> >To: <mailto:davem@davemloft.net>, <mailto:kuba@kernel.org>,
> ><mailto:pabeni@redhat.com>, <mailto:edumazet@google.com>,
> ><mailto:sd@queasysnail.net>
> >Cc: <mailto:netdev@vger.kernel.org>, <mailto:leon@kernel.org>, Emeel
> >Hakim <mailto:ehakim@nvidia.com>
> >
> >
> >Add support for MACsec offload operations for VLAN driver to allow
> >offloading MACsec when VLAN's real device supports Macsec offload by
> >forwarding the offload request to it.
> >
> >Signed-off-by: Emeel Hakim <mailto:ehakim@nvidia.com>
> >---
> > .../net/ethernet/mellanox/mlx5/core/en_main.c |   1 +
> > net/8021q/vlan_dev.c                          | 153 ++++++++++++++++++
> 
> Do not mix generic vlan code changes and your driver changes in one patch.

ACK

> > 2 files changed, 154 insertions(+)
> >
> >diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
> >b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
> >index 6db1aff8778d..5ecef26e83c6 100644
> >--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
> >+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
> >@@ -5076,6 +5076,7 @@ static void mlx5e_build_nic_netdev(struct
> >net_device *netdev)
> >
> >        netdev->vlan_features    |= NETIF_F_SG;
> >        netdev->vlan_features    |= NETIF_F_HW_CSUM;
> >+       netdev->vlan_features    |= NETIF_F_HW_MACSEC;
> >        netdev->vlan_features    |= NETIF_F_GRO;
> >        netdev->vlan_features    |= NETIF_F_TSO;
> >        netdev->vlan_features    |= NETIF_F_TSO6; diff --git
> >a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c index
> >5920544e93e8..16efc1bfc345 100644
> >--- a/net/8021q/vlan_dev.c
> >+++ b/net/8021q/vlan_dev.c
> >@@ -26,6 +26,7 @@
> > #include <linux/ethtool.h>
> > #include <linux/phy.h>
> > #include <net/arp.h>
> >+#include <net/macsec.h>
> >
> > #include "vlan.h"
> > #include "vlanproc.h"
> >@@ -572,6 +573,9 @@ static int vlan_dev_init(struct net_device *dev)
> >                           NETIF_F_HIGHDMA | NETIF_F_SCTP_CRC |
> >                           NETIF_F_ALL_FCOE;
> >
> >+       if (real_dev->features & NETIF_F_HW_MACSEC)
> >+               dev->hw_features |= NETIF_F_HW_MACSEC;
> >+
> >        dev->features |= dev->hw_features | NETIF_F_LLTX;
> >        netif_inherit_tso_max(dev, real_dev);
> >        if (dev->features & NETIF_F_VLAN_FEATURES) @@ -803,6 +807,152
> >@@ static int vlan_dev_fill_forward_path(struct net_device_path_ctx *ctx,
> >        return 0;
> > }
> >
> >+#if IS_ENABLED(CONFIG_MACSEC)
> >+
> >+static const struct macsec_ops *vlan_get_macsec_ops(const struct
> >+macsec_context *ctx) {
> >+       return vlan_dev_priv(ctx->netdev)->real_dev->macsec_ops;
> >+}
> >+
> >+static int vlan_macsec_add_txsa(struct macsec_context *ctx) {
> >+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
> >+
> >+       if (!ops || !ops->mdo_add_txsa)
> >+               return -EOPNOTSUPP;
> >+
> >+       return ops->mdo_add_txsa(ctx);
> >+}
> >+
> >+static int vlan_macsec_upd_txsa(struct macsec_context *ctx) {
> >+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
> >+
> >+       if (!ops || !ops->mdo_upd_txsa)
> >+               return -EOPNOTSUPP;
> >+
> >+       return ops->mdo_upd_txsa(ctx);
> >+}
> >+
> >+static int vlan_macsec_del_txsa(struct macsec_context *ctx) {
> >+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
> >+
> >+       if (!ops || !ops->mdo_del_txsa)
> >+               return -EOPNOTSUPP;
> >+
> >+       return ops->mdo_del_txsa(ctx);
> >+}
> >+
> >+static int vlan_macsec_add_rxsa(struct macsec_context *ctx) {
> >+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
> >+
> >+       if (!ops || !ops->mdo_add_rxsa)
> >+               return -EOPNOTSUPP;
> >+
> >+       return ops->mdo_add_rxsa(ctx);
> >+}
> >+
> >+static int vlan_macsec_upd_rxsa(struct macsec_context *ctx) {
> >+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
> >+
> >+       if (!ops || !ops->mdo_upd_rxsa)
> >+               return -EOPNOTSUPP;
> >+
> >+       return ops->mdo_upd_rxsa(ctx);
> >+}
> >+
> >+static int vlan_macsec_del_rxsa(struct macsec_context *ctx) {
> >+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
> >+
> >+       if (!ops || !ops->mdo_del_rxsa)
> >+               return -EOPNOTSUPP;
> >+
> >+       return ops->mdo_del_rxsa(ctx);
> >+}
> >+
> >+static int vlan_macsec_add_rxsc(struct macsec_context *ctx) {
> >+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
> >+
> >+       if (!ops || !ops->mdo_add_rxsc)
> >+               return -EOPNOTSUPP;
> >+
> >+       return ops->mdo_add_rxsc(ctx);
> >+}
> >+
> >+static int vlan_macsec_upd_rxsc(struct macsec_context *ctx) {
> >+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
> >+
> >+       if (!ops || !ops->mdo_upd_rxsc)
> >+               return -EOPNOTSUPP;
> >+
> >+       return ops->mdo_upd_rxsc(ctx);
> >+}
> >+
> >+static int vlan_macsec_del_rxsc(struct macsec_context *ctx) {
> >+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
> >+
> >+       if (!ops || !ops->mdo_del_rxsc)
> >+               return -EOPNOTSUPP;
> >+
> >+       return ops->mdo_del_rxsc(ctx);
> >+}
> >+
> >+static int vlan_macsec_add_secy(struct macsec_context *ctx) {
> >+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
> >+
> >+       if (!ops || !ops->mdo_add_secy)
> >+               return -EOPNOTSUPP;
> >+
> >+       return ops->mdo_add_secy(ctx);
> >+}
> >+
> >+static int vlan_macsec_upd_secy(struct macsec_context *ctx) {
> >+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
> >+
> >+       if (!ops || !ops->mdo_upd_secy)
> >+               return -EOPNOTSUPP;
> >+
> >+       return ops->mdo_upd_secy(ctx);
> >+}
> >+
> >+static int vlan_macsec_del_secy(struct macsec_context *ctx) {
> >+       const struct macsec_ops *ops = vlan_get_macsec_ops(ctx);
> >+
> >+       if (!ops || !ops->mdo_del_secy)
> >+               return -EOPNOTSUPP;
> >+
> >+       return ops->mdo_del_secy(ctx);
> >+}
> >+
> >+#undef _BUILD_VLAN_MACSEC_MDO
> >+
> I guess you missed to delete this.
> 
> >+static const struct macsec_ops macsec_offload_ops = {
> >+       .mdo_add_txsa = vlan_macsec_add_txsa,
> >+       .mdo_upd_txsa = vlan_macsec_upd_txsa,
> >+       .mdo_del_txsa = vlan_macsec_del_txsa,
> >+       .mdo_add_rxsc = vlan_macsec_add_rxsc,
> >+       .mdo_upd_rxsc = vlan_macsec_upd_rxsc,
> >+       .mdo_del_rxsc = vlan_macsec_del_rxsc,
> >+       .mdo_add_rxsa = vlan_macsec_add_rxsa,
> >+       .mdo_upd_rxsa = vlan_macsec_upd_rxsa,
> >+       .mdo_del_rxsa = vlan_macsec_del_rxsa,
> >+       .mdo_add_secy = vlan_macsec_add_secy,
> >+       .mdo_upd_secy = vlan_macsec_upd_secy,
> >+       .mdo_del_secy = vlan_macsec_del_secy, };
> >+
> 
> Please add mdo_open, stop and stats too. Those are required for other macsec
> offload drivers.

ACK

> Thanks.
> Sundeep
> 
> >+#endif
> >+
> > static const struct ethtool_ops vlan_ethtool_ops = {
> >        .get_link_ksettings     = vlan_ethtool_get_link_ksettings,
> >        .get_drvinfo            = vlan_ethtool_get_drvinfo, @@ -869,6 +1019,9 @@
> >void vlan_setup(struct net_device *dev)
> >        dev->priv_destructor    = vlan_dev_free;
> >        dev->ethtool_ops        = &vlan_ethtool_ops;
> >
> >+#if IS_ENABLED(CONFIG_MACSEC)
> >+       dev->macsec_ops         = &macsec_offload_ops; #endif
> >        dev->min_mtu            = 0;
> >        dev->max_mtu            = ETH_MAX_MTU;
> >
> >--
> >2.21.3

[PATCH net-next v3 2/4] net/mlx5: Support MACsec over VLAN

[Emeel Hakim]

MACsec device may have a VLAN device on top of it.
Detect MACsec state correctly under this condition,
and return the correct net device accordingly.

Signed-off-by: Emeel Hakim <ehakim@nvidia.com>
---
 .../mellanox/mlx5/core/en_accel/macsec.c      | 42 ++++++++++++-------
 1 file changed, 26 insertions(+), 16 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c
index 33b3620ea45c..f1646fa6737d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c
@@ -4,6 +4,7 @@
 #include <linux/mlx5/device.h>
 #include <linux/mlx5/mlx5_ifc.h>
 #include <linux/xarray.h>
+#include <linux/if_vlan.h>
 
 #include "en.h"
 #include "lib/aso.h"
@@ -348,12 +349,21 @@ static void mlx5e_macsec_cleanup_sa(struct mlx5e_macsec *macsec,
 	sa->macsec_rule = NULL;
 }
 
+static inline struct mlx5e_priv *macsec_netdev_priv(const struct net_device *dev)
+{
+#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
+	if (is_vlan_dev(dev))
+		return netdev_priv(vlan_dev_priv(dev)->real_dev);
+#endif
+	return netdev_priv(dev);
+}
+
 static int mlx5e_macsec_init_sa(struct macsec_context *ctx,
 				struct mlx5e_macsec_sa *sa,
 				bool encrypt,
 				bool is_tx)
 {
-	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	struct mlx5e_macsec *macsec = priv->macsec;
 	struct mlx5_macsec_rule_attrs rule_attrs;
 	struct mlx5_core_dev *mdev = priv->mdev;
@@ -427,7 +437,7 @@ static int macsec_rx_sa_active_update(struct macsec_context *ctx,
 				      struct mlx5e_macsec_sa *rx_sa,
 				      bool active)
 {
-	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	struct mlx5e_macsec *macsec = priv->macsec;
 	int err = 0;
 
@@ -510,7 +520,7 @@ static int mlx5e_macsec_add_txsa(struct macsec_context *ctx)
 {
 	const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc;
 	const struct macsec_tx_sa *ctx_tx_sa = ctx->sa.tx_sa;
-	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	const struct macsec_secy *secy = ctx->secy;
 	struct mlx5e_macsec_device *macsec_device;
 	struct mlx5_core_dev *mdev = priv->mdev;
@@ -585,7 +595,7 @@ static int mlx5e_macsec_upd_txsa(struct macsec_context *ctx)
 {
 	const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc;
 	const struct macsec_tx_sa *ctx_tx_sa = ctx->sa.tx_sa;
-	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	struct mlx5e_macsec_device *macsec_device;
 	u8 assoc_num = ctx->sa.assoc_num;
 	struct mlx5e_macsec_sa *tx_sa;
@@ -645,7 +655,7 @@ static int mlx5e_macsec_upd_txsa(struct macsec_context *ctx)
 
 static int mlx5e_macsec_del_txsa(struct macsec_context *ctx)
 {
-	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	struct mlx5e_macsec_device *macsec_device;
 	u8 assoc_num = ctx->sa.assoc_num;
 	struct mlx5e_macsec_sa *tx_sa;
@@ -696,7 +706,7 @@ static u32 mlx5e_macsec_get_sa_from_hashtable(struct rhashtable *sci_hash, sci_t
 static int mlx5e_macsec_add_rxsc(struct macsec_context *ctx)
 {
 	struct mlx5e_macsec_rx_sc_xarray_element *sc_xarray_element;
-	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	const struct macsec_rx_sc *ctx_rx_sc = ctx->rx_sc;
 	struct mlx5e_macsec_device *macsec_device;
 	struct mlx5e_macsec_rx_sc *rx_sc;
@@ -776,7 +786,7 @@ static int mlx5e_macsec_add_rxsc(struct macsec_context *ctx)
 
 static int mlx5e_macsec_upd_rxsc(struct macsec_context *ctx)
 {
-	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	const struct macsec_rx_sc *ctx_rx_sc = ctx->rx_sc;
 	struct mlx5e_macsec_device *macsec_device;
 	struct mlx5e_macsec_rx_sc *rx_sc;
@@ -854,7 +864,7 @@ static void macsec_del_rxsc_ctx(struct mlx5e_macsec *macsec, struct mlx5e_macsec
 
 static int mlx5e_macsec_del_rxsc(struct macsec_context *ctx)
 {
-	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	struct mlx5e_macsec_device *macsec_device;
 	struct mlx5e_macsec_rx_sc *rx_sc;
 	struct mlx5e_macsec *macsec;
@@ -890,8 +900,8 @@ static int mlx5e_macsec_del_rxsc(struct macsec_context *ctx)
 
 static int mlx5e_macsec_add_rxsa(struct macsec_context *ctx)
 {
+	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	const struct macsec_rx_sa *ctx_rx_sa = ctx->sa.rx_sa;
-	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
 	struct mlx5e_macsec_device *macsec_device;
 	struct mlx5_core_dev *mdev = priv->mdev;
 	u8 assoc_num = ctx->sa.assoc_num;
@@ -976,8 +986,8 @@ static int mlx5e_macsec_add_rxsa(struct macsec_context *ctx)
 
 static int mlx5e_macsec_upd_rxsa(struct macsec_context *ctx)
 {
+	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	const struct macsec_rx_sa *ctx_rx_sa = ctx->sa.rx_sa;
-	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
 	struct mlx5e_macsec_device *macsec_device;
 	u8 assoc_num = ctx->sa.assoc_num;
 	struct mlx5e_macsec_rx_sc *rx_sc;
@@ -1033,7 +1043,7 @@ static int mlx5e_macsec_upd_rxsa(struct macsec_context *ctx)
 
 static int mlx5e_macsec_del_rxsa(struct macsec_context *ctx)
 {
-	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	struct mlx5e_macsec_device *macsec_device;
 	sci_t sci = ctx->sa.rx_sa->sc->sci;
 	struct mlx5e_macsec_rx_sc *rx_sc;
@@ -1085,7 +1095,7 @@ static int mlx5e_macsec_del_rxsa(struct macsec_context *ctx)
 
 static int mlx5e_macsec_add_secy(struct macsec_context *ctx)
 {
-	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	const struct net_device *dev = ctx->secy->netdev;
 	const struct net_device *netdev = ctx->netdev;
 	struct mlx5e_macsec_device *macsec_device;
@@ -1137,7 +1147,7 @@ static int mlx5e_macsec_add_secy(struct macsec_context *ctx)
 static int macsec_upd_secy_hw_address(struct macsec_context *ctx,
 				      struct mlx5e_macsec_device *macsec_device)
 {
-	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	const struct net_device *dev = ctx->secy->netdev;
 	struct mlx5e_macsec *macsec = priv->macsec;
 	struct mlx5e_macsec_rx_sc *rx_sc, *tmp;
@@ -1184,8 +1194,8 @@ static int macsec_upd_secy_hw_address(struct macsec_context *ctx,
  */
 static int mlx5e_macsec_upd_secy(struct macsec_context *ctx)
 {
+	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc;
-	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
 	const struct net_device *dev = ctx->secy->netdev;
 	struct mlx5e_macsec_device *macsec_device;
 	struct mlx5e_macsec_sa *tx_sa;
@@ -1240,7 +1250,7 @@ static int mlx5e_macsec_upd_secy(struct macsec_context *ctx)
 
 static int mlx5e_macsec_del_secy(struct macsec_context *ctx)
 {
-	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
+	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);
 	struct mlx5e_macsec_device *macsec_device;
 	struct mlx5e_macsec_rx_sc *rx_sc, *tmp;
 	struct mlx5e_macsec_sa *tx_sa;
@@ -1741,7 +1751,7 @@ void mlx5e_macsec_offload_handle_rx_skb(struct net_device *netdev,
 {
 	struct mlx5e_macsec_rx_sc_xarray_element *sc_xarray_element;
 	u32 macsec_meta_data = be32_to_cpu(cqe->ft_metadata);
-	struct mlx5e_priv *priv = netdev_priv(netdev);
+	struct mlx5e_priv *priv = macsec_netdev_priv(netdev);
 	struct mlx5e_macsec_rx_sc *rx_sc;
 	struct mlx5e_macsec *macsec;
 	u32  fs_id;
-- 
2.21.3

Re: [PATCH net-next v3 2/4] net/mlx5: Support MACsec over VLAN

[Simon Horman]

On Thu, Mar 30, 2023 at 04:57:13PM +0300, Emeel Hakim wrote:
> MACsec device may have a VLAN device on top of it.
> Detect MACsec state correctly under this condition,
> and return the correct net device accordingly.
> 
> Signed-off-by: Emeel Hakim <ehakim@nvidia.com>

Reviewed-by: Simon Horman <simon.horman@corigine.com>

...

> @@ -510,7 +520,7 @@ static int mlx5e_macsec_add_txsa(struct macsec_context *ctx)
>  {
>  	const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc;
>  	const struct macsec_tx_sa *ctx_tx_sa = ctx->sa.tx_sa;
> -	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
> +	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);

nit: If you need to respin for some other reason you may wish
     to consider reverse xmas tree - longest line to shortest -
     for local variable declarations

>  	const struct macsec_secy *secy = ctx->secy;
>  	struct mlx5e_macsec_device *macsec_device;
>  	struct mlx5_core_dev *mdev = priv->mdev;
> @@ -585,7 +595,7 @@ static int mlx5e_macsec_upd_txsa(struct macsec_context *ctx)
>  {
>  	const struct macsec_tx_sc *tx_sc = &ctx->secy->tx_sc;
>  	const struct macsec_tx_sa *ctx_tx_sa = ctx->sa.tx_sa;
> -	struct mlx5e_priv *priv = netdev_priv(ctx->netdev);
> +	struct mlx5e_priv *priv = macsec_netdev_priv(ctx->netdev);

ditto.

>  	struct mlx5e_macsec_device *macsec_device;
>  	u8 assoc_num = ctx->sa.assoc_num;
>  	struct mlx5e_macsec_sa *tx_sa;

[PATCH net-next v3 3/4] net/mlx5: Consider VLAN interface in MACsec TX steering rules

[Emeel Hakim]

Offloading MACsec when its configured over VLAN with current MACsec
TX steering rules will wrongly insert MACsec sec tag after inserting
the VLAN header leading to a ETHERNET | SECTAG | VLAN packet when
ETHERNET | VLAN | SECTAG is configured.

The above issue is due to adding the SECTAG by HW which is a later
stage compared to the VLAN header insertion stage.

Detect such a case and adjust TX steering rules to insert the
SECTAG in the correct place by using reformat_param_0 field in
the packet reformat to indicate the offset of SECTAG from end of
the MAC header to account for VLANs in granularity of 4Bytes.

Signed-off-by: Emeel Hakim <ehakim@nvidia.com>
---
 .../net/ethernet/mellanox/mlx5/core/en_accel/macsec_fs.c   | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec_fs.c
index 5b658a5588c6..daaaaf344f77 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec_fs.c
@@ -4,6 +4,7 @@
 #include <net/macsec.h>
 #include <linux/netdevice.h>
 #include <linux/mlx5/qp.h>
+#include <linux/if_vlan.h>
 #include "fs_core.h"
 #include "en/fs.h"
 #include "en_accel/macsec_fs.h"
@@ -510,6 +511,8 @@ static void macsec_fs_tx_del_rule(struct mlx5e_macsec_fs *macsec_fs,
 	macsec_fs_tx_ft_put(macsec_fs);
 }
 
+#define MLX5_REFORMAT_PARAM_ADD_MACSEC_OFFSET_4_BYTES 1
+
 static union mlx5e_macsec_rule *
 macsec_fs_tx_add_rule(struct mlx5e_macsec_fs *macsec_fs,
 		      const struct macsec_context *macsec_ctx,
@@ -555,6 +558,10 @@ macsec_fs_tx_add_rule(struct mlx5e_macsec_fs *macsec_fs,
 	reformat_params.type = MLX5_REFORMAT_TYPE_ADD_MACSEC;
 	reformat_params.size = reformat_size;
 	reformat_params.data = reformatbf;
+
+	if (is_vlan_dev(macsec_ctx->netdev))
+		reformat_params.param_0 = MLX5_REFORMAT_PARAM_ADD_MACSEC_OFFSET_4_BYTES;
+
 	flow_act.pkt_reformat = mlx5_packet_reformat_alloc(macsec_fs->mdev,
 							   &reformat_params,
 							   MLX5_FLOW_NAMESPACE_EGRESS_MACSEC);
-- 
2.21.3

Re: [PATCH net-next v3 3/4] net/mlx5: Consider VLAN interface in MACsec TX steering rules

[Simon Horman]

On Thu, Mar 30, 2023 at 04:57:14PM +0300, Emeel Hakim wrote:
> Offloading MACsec when its configured over VLAN with current MACsec
> TX steering rules will wrongly insert MACsec sec tag after inserting
> the VLAN header leading to a ETHERNET | SECTAG | VLAN packet when
> ETHERNET | VLAN | SECTAG is configured.
> 
> The above issue is due to adding the SECTAG by HW which is a later
> stage compared to the VLAN header insertion stage.
> 
> Detect such a case and adjust TX steering rules to insert the
> SECTAG in the correct place by using reformat_param_0 field in
> the packet reformat to indicate the offset of SECTAG from end of
> the MAC header to account for VLANs in granularity of 4Bytes.
> 
> Signed-off-by: Emeel Hakim <ehakim@nvidia.com>

Reviewed-by: Simon Horman <simon.horman@corigine.com>

[PATCH net-next v3 4/4] macsec: Add MACsec rx_handler change support

[Emeel Hakim]

Offloading device drivers will mark offloaded MACsec SKBs with the
corresponding SCI in the skb_metadata_dst so the macsec rx handler will
know to which interface to divert those skbs, in case of a marked skb
and a mismatch on the dst MAC address, divert the skb to the macsec
net_device where the macsec rx_handler will be called.

Example of such a case is having a MACsec with VLAN as an inner header
ETHERNET | SECTAG | VLAN packet.

Signed-off-by: Emeel Hakim <ehakim@nvidia.com>
---
 drivers/net/macsec.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 25616247d7a5..88b00ea4af68 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -1048,6 +1048,15 @@ static enum rx_handler_result handle_not_macsec(struct sk_buff *skb)
 
 				__netif_rx(nskb);
 			}
+
+			if (md_dst && md_dst->type == METADATA_MACSEC &&
+			    (find_rx_sc(&macsec->secy, md_dst->u.macsec_info.sci))) {
+				skb->dev = ndev;
+				skb->pkt_type = PACKET_HOST;
+				ret = RX_HANDLER_ANOTHER;
+				goto out;
+			}
+
 			continue;
 		}
 
-- 
2.21.3

Re: [PATCH net-next v3 4/4] macsec: Add MACsec rx_handler change support

[Simon Horman]

On Thu, Mar 30, 2023 at 04:57:15PM +0300, Emeel Hakim wrote:
> Offloading device drivers will mark offloaded MACsec SKBs with the
> corresponding SCI in the skb_metadata_dst so the macsec rx handler will
> know to which interface to divert those skbs, in case of a marked skb
> and a mismatch on the dst MAC address, divert the skb to the macsec
> net_device where the macsec rx_handler will be called.
> 
> Example of such a case is having a MACsec with VLAN as an inner header
> ETHERNET | SECTAG | VLAN packet.
> 
> Signed-off-by: Emeel Hakim <ehakim@nvidia.com>

Reviewed-by: Simon Horman <simon.horman@corigine.com>