1 /* SPDX-License-Identifier: BSD-3-Clause */ 2 /* Copyright (c) 2020, Intel Corporation 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions are met: 7 * 8 * 1. Redistributions of source code must retain the above copyright notice, 9 * this list of conditions and the following disclaimer. 10 * 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * 3. Neither the name of the Intel Corporation nor the names of its 16 * contributors may be used to endorse or promote products derived from 17 * this software without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 20 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 23 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 /*$FreeBSD$*/ 32 33 #ifndef _VIRTCHNL_INLINE_IPSEC_H_ 34 #define _VIRTCHNL_INLINE_IPSEC_H_ 35 36 #define VIRTCHNL_IPSEC_MAX_CRYPTO_CAP_NUM 3 37 #define VIRTCHNL_IPSEC_MAX_ALGO_CAP_NUM 16 38 #define VIRTCHNL_IPSEC_MAX_TX_DESC_NUM 128 39 #define VIRTCHNL_IPSEC_MAX_CRYPTO_ITEM_NUMBER 2 40 #define VIRTCHNL_IPSEC_MAX_KEY_LEN 128 41 #define VIRTCHNL_IPSEC_MAX_SA_DESTROY_NUM 8 42 #define VIRTCHNL_IPSEC_SA_DESTROY 0 43 #define VIRTCHNL_IPSEC_BROADCAST_VFID 0xFFFFFFFF 44 45 /* crypto type */ 46 #define VIRTCHNL_AUTH 1 47 #define VIRTCHNL_CIPHER 2 48 #define VIRTCHNL_AEAD 3 49 50 /* algorithm type */ 51 /* Hash Algorithm */ 52 #define VIRTCHNL_HASH_NO_ALG 0 /* NULL algorithm */ 53 #define VIRTCHNL_AES_CBC_MAC 1 /* AES-CBC-MAC algorithm */ 54 #define VIRTCHNL_AES_CMAC 2 /* AES CMAC algorithm */ 55 #define VIRTCHNL_AES_GMAC 3 /* AES GMAC algorithm */ 56 #define VIRTCHNL_AES_XCBC_MAC 4 /* AES XCBC algorithm */ 57 #define VIRTCHNL_MD5_HMAC 5 /* HMAC using MD5 algorithm */ 58 #define VIRTCHNL_SHA1_HMAC 6 /* HMAC using 128 bit SHA algorithm */ 59 #define VIRTCHNL_SHA224_HMAC 7 /* HMAC using 224 bit SHA algorithm */ 60 #define VIRTCHNL_SHA256_HMAC 8 /* HMAC using 256 bit SHA algorithm */ 61 #define VIRTCHNL_SHA384_HMAC 9 /* HMAC using 384 bit SHA algorithm */ 62 #define VIRTCHNL_SHA512_HMAC 10 /* HMAC using 512 bit SHA algorithm */ 63 #define VIRTCHNL_SHA3_224_HMAC 11 /* HMAC using 224 bit SHA3 algorithm */ 64 #define VIRTCHNL_SHA3_256_HMAC 12 /* HMAC using 256 bit SHA3 algorithm */ 65 #define VIRTCHNL_SHA3_384_HMAC 13 /* HMAC using 384 bit SHA3 algorithm */ 66 #define VIRTCHNL_SHA3_512_HMAC 14 /* HMAC using 512 bit SHA3 algorithm */ 67 /* Cipher Algorithm */ 68 #define VIRTCHNL_CIPHER_NO_ALG 15 /* NULL algorithm */ 69 #define VIRTCHNL_3DES_CBC 16 /* Triple DES algorithm in CBC mode */ 70 #define VIRTCHNL_AES_CBC 17 /* AES algorithm in CBC mode */ 71 #define VIRTCHNL_AES_CTR 18 /* AES algorithm in Counter mode */ 72 /* AEAD Algorithm */ 73 #define VIRTCHNL_AES_CCM 19 /* AES algorithm in CCM mode */ 74 #define VIRTCHNL_AES_GCM 20 /* AES algorithm in GCM mode */ 75 #define VIRTCHNL_CHACHA20_POLY1305 21 /* algorithm of ChaCha20-Poly1305 */ 76 77 /* protocol type */ 78 #define VIRTCHNL_PROTO_ESP 1 79 #define VIRTCHNL_PROTO_AH 2 80 #define VIRTCHNL_PROTO_RSVD1 3 81 82 /* sa mode */ 83 #define VIRTCHNL_SA_MODE_TRANSPORT 1 84 #define VIRTCHNL_SA_MODE_TUNNEL 2 85 #define VIRTCHNL_SA_MODE_TRAN_TUN 3 86 #define VIRTCHNL_SA_MODE_UNKNOWN 4 87 88 /* sa direction */ 89 #define VIRTCHNL_DIR_INGRESS 1 90 #define VIRTCHNL_DIR_EGRESS 2 91 #define VIRTCHNL_DIR_INGRESS_EGRESS 3 92 93 /* sa termination */ 94 #define VIRTCHNL_TERM_SOFTWARE 1 95 #define VIRTCHNL_TERM_HARDWARE 2 96 97 /* sa ip type */ 98 #define VIRTCHNL_IPV4 1 99 #define VIRTCHNL_IPV6 2 100 101 /* Detailed opcodes for DPDK and IPsec use */ 102 enum inline_ipsec_ops { 103 INLINE_IPSEC_OP_GET_CAP = 0, 104 INLINE_IPSEC_OP_GET_STATUS = 1, 105 INLINE_IPSEC_OP_SA_CREATE = 2, 106 INLINE_IPSEC_OP_SA_UPDATE = 3, 107 INLINE_IPSEC_OP_SA_DESTROY = 4, 108 INLINE_IPSEC_OP_SP_CREATE = 5, 109 INLINE_IPSEC_OP_SP_DESTROY = 6, 110 INLINE_IPSEC_OP_SA_READ = 7, 111 INLINE_IPSEC_OP_EVENT = 8, 112 INLINE_IPSEC_OP_RESP = 9, 113 }; 114 115 #pragma pack(1) 116 /* Not all valid, if certain field is invalid, set 1 for all bits */ 117 struct virtchnl_algo_cap { 118 u32 algo_type; 119 120 u16 block_size; 121 122 u16 min_key_size; 123 u16 max_key_size; 124 u16 inc_key_size; 125 126 u16 min_iv_size; 127 u16 max_iv_size; 128 u16 inc_iv_size; 129 130 u16 min_digest_size; 131 u16 max_digest_size; 132 u16 inc_digest_size; 133 134 u16 min_aad_size; 135 u16 max_aad_size; 136 u16 inc_aad_size; 137 }; 138 #pragma pack() 139 140 /* vf record the capability of crypto from the virtchnl */ 141 struct virtchnl_sym_crypto_cap { 142 u8 crypto_type; 143 u8 algo_cap_num; 144 struct virtchnl_algo_cap algo_cap_list[VIRTCHNL_IPSEC_MAX_ALGO_CAP_NUM]; 145 }; 146 147 /* VIRTCHNL_OP_GET_IPSEC_CAP 148 * VF pass virtchnl_ipsec_cap to PF 149 * and PF return capability of ipsec from virtchnl. 150 */ 151 struct virtchnl_ipsec_cap { 152 /* max number of SA per VF */ 153 u16 max_sa_num; 154 155 /* IPsec SA Protocol - value ref VIRTCHNL_PROTO_XXX */ 156 u8 virtchnl_protocol_type; 157 158 /* IPsec SA Mode - value ref VIRTCHNL_SA_MODE_XXX */ 159 u8 virtchnl_sa_mode; 160 161 /* IPSec SA Direction - value ref VIRTCHNL_DIR_XXX */ 162 u8 virtchnl_direction; 163 164 /* type of esn - !0:enable/0:disable */ 165 u8 esn_enabled; 166 167 /* type of udp_encap - !0:enable/0:disable */ 168 u8 udp_encap_enabled; 169 170 /* termination mode - value ref VIRTCHNL_TERM_XXX */ 171 u8 termination_mode; 172 173 /* SA index mode - !0:enable/0:disable */ 174 u8 sa_index_sw_enabled; 175 176 /* auditing mode - !0:enable/0:disable */ 177 u8 audit_enabled; 178 179 /* lifetime byte limit - !0:enable/0:disable */ 180 u8 byte_limit_enabled; 181 182 /* drop on authentication failure - !0:enable/0:disable */ 183 u8 drop_on_auth_fail_enabled; 184 185 /* anti-replay window check - !0:enable/0:disable */ 186 u8 arw_check_enabled; 187 188 /* number of supported crypto capability */ 189 u8 crypto_cap_num; 190 191 /* descriptor ID */ 192 u16 desc_id; 193 194 /* crypto capabilities */ 195 struct virtchnl_sym_crypto_cap cap[VIRTCHNL_IPSEC_MAX_CRYPTO_CAP_NUM]; 196 }; 197 198 #pragma pack(1) 199 /* configuration of crypto function */ 200 struct virtchnl_ipsec_crypto_cfg_item { 201 u8 crypto_type; 202 203 u32 algo_type; 204 205 /* Length of valid IV data. */ 206 u16 iv_len; 207 208 /* Length of digest */ 209 u16 digest_len; 210 211 /* SA salt */ 212 u32 salt; 213 214 /* The length of the symmetric key */ 215 u16 key_len; 216 217 /* key data buffer */ 218 u8 key_data[VIRTCHNL_IPSEC_MAX_KEY_LEN]; 219 }; 220 #pragma pack() 221 222 struct virtchnl_ipsec_sym_crypto_cfg { 223 struct virtchnl_ipsec_crypto_cfg_item 224 items[VIRTCHNL_IPSEC_MAX_CRYPTO_ITEM_NUMBER]; 225 }; 226 227 #pragma pack(1) 228 /* VIRTCHNL_OP_IPSEC_SA_CREATE 229 * VF send this SA configuration to PF using virtchnl; 230 * PF create SA as configuration and PF driver will return 231 * an unique index (sa_idx) for the created SA. 232 */ 233 struct virtchnl_ipsec_sa_cfg { 234 /* IPsec SA Protocol - AH/ESP */ 235 u8 virtchnl_protocol_type; 236 237 /* termination mode - value ref VIRTCHNL_TERM_XXX */ 238 u8 virtchnl_termination; 239 240 /* type of outer IP - IPv4/IPv6 */ 241 u8 virtchnl_ip_type; 242 243 /* type of esn - !0:enable/0:disable */ 244 u8 esn_enabled; 245 246 /* udp encap - !0:enable/0:disable */ 247 u8 udp_encap_enabled; 248 249 /* IPSec SA Direction - value ref VIRTCHNL_DIR_XXX */ 250 u8 virtchnl_direction; 251 252 /* reserved */ 253 u8 reserved1; 254 255 /* SA security parameter index */ 256 u32 spi; 257 258 /* outer src ip address */ 259 u8 src_addr[16]; 260 261 /* outer dst ip address */ 262 u8 dst_addr[16]; 263 264 /* SPD reference. Used to link an SA with its policy. 265 * PF drivers may ignore this field. 266 */ 267 u16 spd_ref; 268 269 /* high 32 bits of esn */ 270 u32 esn_hi; 271 272 /* low 32 bits of esn */ 273 u32 esn_low; 274 275 /* When enabled, sa_index must be valid */ 276 u8 sa_index_en; 277 278 /* SA index when sa_index_en is true */ 279 u32 sa_index; 280 281 /* auditing mode - enable/disable */ 282 u8 audit_en; 283 284 /* lifetime byte limit - enable/disable 285 * When enabled, byte_limit_hard and byte_limit_soft 286 * must be valid. 287 */ 288 u8 byte_limit_en; 289 290 /* hard byte limit count */ 291 u64 byte_limit_hard; 292 293 /* soft byte limit count */ 294 u64 byte_limit_soft; 295 296 /* drop on authentication failure - enable/disable */ 297 u8 drop_on_auth_fail_en; 298 299 /* anti-reply window check - enable/disable 300 * When enabled, arw_size must be valid. 301 */ 302 u8 arw_check_en; 303 304 /* size of arw window, offset by 1. Setting to 0 305 * represents ARW window size of 1. Setting to 127 306 * represents ARW window size of 128 307 */ 308 u8 arw_size; 309 310 /* no ip offload mode - enable/disable 311 * When enabled, ip type and address must not be valid. 312 */ 313 u8 no_ip_offload_en; 314 315 /* SA Domain. Used to logical separate an SADB into groups. 316 * PF drivers supporting a single group ignore this field. 317 */ 318 u16 sa_domain; 319 320 /* crypto configuration */ 321 struct virtchnl_ipsec_sym_crypto_cfg crypto_cfg; 322 }; 323 #pragma pack() 324 325 /* VIRTCHNL_OP_IPSEC_SA_UPDATE 326 * VF send configuration of index of SA to PF 327 * PF will update SA according to configuration 328 */ 329 struct virtchnl_ipsec_sa_update { 330 u32 sa_index; /* SA to update */ 331 u32 esn_hi; /* high 32 bits of esn */ 332 u32 esn_low; /* low 32 bits of esn */ 333 }; 334 335 #pragma pack(1) 336 /* VIRTCHNL_OP_IPSEC_SA_DESTROY 337 * VF send configuration of index of SA to PF 338 * PF will destroy SA according to configuration 339 * flag bitmap indicate all SA or just selected SA will 340 * be destroyed 341 */ 342 struct virtchnl_ipsec_sa_destroy { 343 /* All zero bitmap indicates all SA will be destroyed. 344 * Non-zero bitmap indicates the selected SA in 345 * array sa_index will be destroyed. 346 */ 347 u8 flag; 348 349 /* selected SA index */ 350 u32 sa_index[VIRTCHNL_IPSEC_MAX_SA_DESTROY_NUM]; 351 }; 352 353 /* VIRTCHNL_OP_IPSEC_SA_READ 354 * VF send this SA configuration to PF using virtchnl; 355 * PF read SA and will return configuration for the created SA. 356 */ 357 struct virtchnl_ipsec_sa_read { 358 /* SA valid - invalid/valid */ 359 u8 valid; 360 361 /* SA active - inactive/active */ 362 u8 active; 363 364 /* SA SN rollover - not_rollover/rollover */ 365 u8 sn_rollover; 366 367 /* IPsec SA Protocol - AH/ESP */ 368 u8 virtchnl_protocol_type; 369 370 /* termination mode - value ref VIRTCHNL_TERM_XXX */ 371 u8 virtchnl_termination; 372 373 /* auditing mode - enable/disable */ 374 u8 audit_en; 375 376 /* lifetime byte limit - enable/disable 377 * When set to limit, byte_limit_hard and byte_limit_soft 378 * must be valid. 379 */ 380 u8 byte_limit_en; 381 382 /* hard byte limit count */ 383 u64 byte_limit_hard; 384 385 /* soft byte limit count */ 386 u64 byte_limit_soft; 387 388 /* drop on authentication failure - enable/disable */ 389 u8 drop_on_auth_fail_en; 390 391 /* anti-replay window check - enable/disable 392 * When set to check, arw_size, arw_top, and arw must be valid 393 */ 394 u8 arw_check_en; 395 396 /* size of arw window, offset by 1. Setting to 0 397 * represents ARW window size of 1. Setting to 127 398 * represents ARW window size of 128 399 */ 400 u8 arw_size; 401 402 /* reserved */ 403 u8 reserved1; 404 405 /* top of anti-replay-window */ 406 u64 arw_top; 407 408 /* anti-replay-window */ 409 u8 arw[16]; 410 411 /* packets processed */ 412 u64 packets_processed; 413 414 /* bytes processed */ 415 u64 bytes_processed; 416 417 /* packets dropped */ 418 u32 packets_dropped; 419 420 /* authentication failures */ 421 u32 auth_fails; 422 423 /* ARW check failures */ 424 u32 arw_fails; 425 426 /* type of esn - enable/disable */ 427 u8 esn; 428 429 /* IPSec SA Direction - value ref VIRTCHNL_DIR_XXX */ 430 u8 virtchnl_direction; 431 432 /* SA security parameter index */ 433 u32 spi; 434 435 /* SA salt */ 436 u32 salt; 437 438 /* high 32 bits of esn */ 439 u32 esn_hi; 440 441 /* low 32 bits of esn */ 442 u32 esn_low; 443 444 /* SA Domain. Used to logical separate an SADB into groups. 445 * PF drivers supporting a single group ignore this field. 446 */ 447 u16 sa_domain; 448 449 /* SPD reference. Used to link an SA with its policy. 450 * PF drivers may ignore this field. 451 */ 452 u16 spd_ref; 453 454 /* crypto configuration. Salt and keys are set to 0 */ 455 struct virtchnl_ipsec_sym_crypto_cfg crypto_cfg; 456 }; 457 #pragma pack() 458 459 /* Add whitelist entry in IES */ 460 struct virtchnl_ipsec_sp_cfg { 461 u32 spi; 462 u32 dip[4]; 463 464 /* Drop frame if true or redirect to QAT if false. */ 465 u8 drop; 466 467 /* Congestion domain. For future use. */ 468 u8 cgd; 469 470 /* 0 for IPv4 table, 1 for IPv6 table. */ 471 u8 table_id; 472 473 /* Set TC (congestion domain) if true. For future use. */ 474 u8 set_tc; 475 }; 476 477 #pragma pack(1) 478 /* Delete whitelist entry in IES */ 479 struct virtchnl_ipsec_sp_destroy { 480 /* 0 for IPv4 table, 1 for IPv6 table. */ 481 u8 table_id; 482 u32 rule_id; 483 }; 484 #pragma pack() 485 486 /* Response from IES to whitelist operations */ 487 struct virtchnl_ipsec_sp_cfg_resp { 488 u32 rule_id; 489 }; 490 491 struct virtchnl_ipsec_sa_cfg_resp { 492 u32 sa_handle; 493 }; 494 495 #define INLINE_IPSEC_EVENT_RESET 0x1 496 #define INLINE_IPSEC_EVENT_CRYPTO_ON 0x2 497 #define INLINE_IPSEC_EVENT_CRYPTO_OFF 0x4 498 499 struct virtchnl_ipsec_event { 500 u32 ipsec_event_data; 501 }; 502 503 #define INLINE_IPSEC_STATUS_AVAILABLE 0x1 504 #define INLINE_IPSEC_STATUS_UNAVAILABLE 0x2 505 506 struct virtchnl_ipsec_status { 507 u32 status; 508 }; 509 510 struct virtchnl_ipsec_resp { 511 u32 resp; 512 }; 513 514 /* Internal message descriptor for VF <-> IPsec communication */ 515 struct inline_ipsec_msg { 516 u16 ipsec_opcode; 517 u16 req_id; 518 519 union { 520 /* IPsec request */ 521 struct virtchnl_ipsec_sa_cfg sa_cfg[0]; 522 struct virtchnl_ipsec_sp_cfg sp_cfg[0]; 523 struct virtchnl_ipsec_sa_update sa_update[0]; 524 struct virtchnl_ipsec_sa_destroy sa_destroy[0]; 525 struct virtchnl_ipsec_sp_destroy sp_destroy[0]; 526 527 /* IPsec response */ 528 struct virtchnl_ipsec_sa_cfg_resp sa_cfg_resp[0]; 529 struct virtchnl_ipsec_sp_cfg_resp sp_cfg_resp[0]; 530 struct virtchnl_ipsec_cap ipsec_cap[0]; 531 struct virtchnl_ipsec_status ipsec_status[0]; 532 /* response to del_sa, del_sp, update_sa */ 533 struct virtchnl_ipsec_resp ipsec_resp[0]; 534 535 /* IPsec event (no req_id is required) */ 536 struct virtchnl_ipsec_event event[0]; 537 538 /* Reserved */ 539 struct virtchnl_ipsec_sa_read sa_read[0]; 540 } ipsec_data; 541 }; 542 543 static inline u16 virtchnl_inline_ipsec_val_msg_len(u16 opcode) 544 { 545 u16 valid_len = sizeof(struct inline_ipsec_msg); 546 547 switch (opcode) { 548 case INLINE_IPSEC_OP_GET_CAP: 549 case INLINE_IPSEC_OP_GET_STATUS: 550 break; 551 case INLINE_IPSEC_OP_SA_CREATE: 552 valid_len += sizeof(struct virtchnl_ipsec_sa_cfg); 553 break; 554 case INLINE_IPSEC_OP_SP_CREATE: 555 valid_len += sizeof(struct virtchnl_ipsec_sp_cfg); 556 break; 557 case INLINE_IPSEC_OP_SA_UPDATE: 558 valid_len += sizeof(struct virtchnl_ipsec_sa_update); 559 break; 560 case INLINE_IPSEC_OP_SA_DESTROY: 561 valid_len += sizeof(struct virtchnl_ipsec_sa_destroy); 562 break; 563 case INLINE_IPSEC_OP_SP_DESTROY: 564 valid_len += sizeof(struct virtchnl_ipsec_sp_destroy); 565 break; 566 /* Only for msg length caculation of response to VF in case of 567 * inline ipsec failure. 568 */ 569 case INLINE_IPSEC_OP_RESP: 570 valid_len += sizeof(struct virtchnl_ipsec_resp); 571 break; 572 default: 573 valid_len = 0; 574 break; 575 } 576 577 return valid_len; 578 } 579 580 #endif /* _VIRTCHNL_INLINE_IPSEC_H_ */ 581