From: Igor Russkikh <irusskikh@marvell.com>
To: <netdev@vger.kernel.org>
Cc: "David S . Miller" <davem@davemloft.net>,
Antoine Tenart <antoine.tenart@bootlin.com>,
Mark Starovoytov <mstarovoitov@marvell.com>,
Dmitry Bogdanov <dbogdanov@marvell.com>,
Igor Russkikh <irusskikh@marvell.com>
Subject: [RFC 08/18] net: macsec: support multicast/broadcast when offloading
Date: Fri, 14 Feb 2020 18:02:48 +0300 [thread overview]
Message-ID: <20200214150258.390-9-irusskikh@marvell.com> (raw)
In-Reply-To: <20200214150258.390-1-irusskikh@marvell.com>
From: Mark Starovoytov <mstarovoitov@marvell.com>
The idea is simple. If the frame is an exact match for the controlled port
(based on DA comparison), then we simply divert this skb to matching port.
Multicast/broadcast messages are delivered to all ports.
Signed-off-by: Mark Starovoytov <mstarovoitov@marvell.com>
Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
---
drivers/net/macsec.c | 51 +++++++++++++++++++++++++++++++++-----------
1 file changed, 38 insertions(+), 13 deletions(-)
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 066d61238b11..01da47b47f64 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -952,22 +952,53 @@ static enum rx_handler_result handle_not_macsec(struct sk_buff *skb)
{
/* Deliver to the uncontrolled port by default */
enum rx_handler_result ret = RX_HANDLER_PASS;
+ struct ethhdr *hdr = eth_hdr(skb);
struct macsec_rxh_data *rxd;
struct macsec_dev *macsec;
rcu_read_lock();
rxd = macsec_data_rcu(skb->dev);
- /* 10.6 If the management control validateFrames is not
- * Strict, frames without a SecTAG are received, counted, and
- * delivered to the Controlled Port
- */
list_for_each_entry_rcu(macsec, &rxd->secys, secys) {
struct sk_buff *nskb;
struct pcpu_secy_stats *secy_stats = this_cpu_ptr(macsec->stats);
+ struct net_device *ndev = macsec->secy.netdev;
- if (!macsec_is_offloaded(macsec) &&
- macsec->secy.validate_frames == MACSEC_VALIDATE_STRICT) {
+ /* If h/w offloading is enabled, HW decodes frames and strips
+ * the SecTAG, so we have to deduce which port to deliver to.
+ */
+ if (macsec_is_offloaded(macsec) && netif_running(ndev)) {
+ if (ether_addr_equal_64bits(hdr->h_dest,
+ ndev->dev_addr)) {
+ /* exact match, divert skb to this port */
+ skb->dev = ndev;
+ skb->pkt_type = PACKET_HOST;
+ ret = RX_HANDLER_ANOTHER;
+ goto out;
+ } else if (is_multicast_ether_addr_64bits(
+ hdr->h_dest)) {
+ /* multicast frame, deliver on this port too */
+ nskb = skb_clone(skb, GFP_ATOMIC);
+ if (!nskb)
+ break;
+
+ nskb->dev = ndev;
+ if (ether_addr_equal_64bits(hdr->h_dest,
+ ndev->broadcast))
+ nskb->pkt_type = PACKET_BROADCAST;
+ else
+ nskb->pkt_type = PACKET_MULTICAST;
+
+ netif_rx(nskb);
+ }
+ continue;
+ }
+
+ /* 10.6 If the management control validateFrames is not
+ * Strict, frames without a SecTAG are received, counted, and
+ * delivered to the Controlled Port
+ */
+ if (macsec->secy.validate_frames == MACSEC_VALIDATE_STRICT) {
u64_stats_update_begin(&secy_stats->syncp);
secy_stats->stats.InPktsNoTag++;
u64_stats_update_end(&secy_stats->syncp);
@@ -979,19 +1010,13 @@ static enum rx_handler_result handle_not_macsec(struct sk_buff *skb)
if (!nskb)
break;
- nskb->dev = macsec->secy.netdev;
+ nskb->dev = ndev;
if (netif_rx(nskb) == NET_RX_SUCCESS) {
u64_stats_update_begin(&secy_stats->syncp);
secy_stats->stats.InPktsUntagged++;
u64_stats_update_end(&secy_stats->syncp);
}
-
- if (netif_running(macsec->secy.netdev) &&
- macsec_is_offloaded(macsec)) {
- ret = RX_HANDLER_EXACT;
- goto out;
- }
}
out:
--
2.17.1
next prev parent reply other threads:[~2020-02-14 15:03 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-14 15:02 [RFC 00/18] net: atlantic: MACSec support for AQC devices Igor Russkikh
2020-02-14 15:02 ` [RFC 01/18] net: introduce the MACSEC netdev feature Igor Russkikh
2020-02-14 15:02 ` [RFC 02/18] net: add a reference to MACsec ops in net_device Igor Russkikh
2020-02-14 15:02 ` [RFC 03/18] net: macsec: allow to reference a netdev from a MACsec context Igor Russkikh
2020-02-14 15:02 ` [RFC 04/18] net: macsec: add support for offloading to the MAC Igor Russkikh
2020-02-14 15:02 ` [RFC 05/18] net: macsec: init secy pointer in macsec_context Igor Russkikh
2020-02-21 15:09 ` Antoine Tenart
2020-02-14 15:02 ` [RFC 06/18] net: macsec: invoke mdo_upd_secy callback when mac address changed Igor Russkikh
2020-02-21 15:07 ` Antoine Tenart
2020-02-14 15:02 ` [RFC 07/18] net: macsec: allow multiple macsec devices with offload Igor Russkikh
2020-02-14 15:02 ` Igor Russkikh [this message]
2020-02-14 15:02 ` [RFC 09/18] net: macsec: add support for getting offloaded stats Igor Russkikh
2020-02-21 17:48 ` Antoine Tenart
2020-02-14 15:02 ` [RFC 10/18] net: macsec: enable HW offloading by default (when available) Igor Russkikh
2020-02-21 18:04 ` Antoine Tenart
2020-02-14 15:02 ` [RFC 11/18] net: macsec: report real_dev features when HW offloading is enabled Igor Russkikh
2020-02-14 15:02 ` [RFC 12/18] net: atlantic: MACSec offload skeleton Igor Russkikh
2020-02-21 18:21 ` Antoine Tenart
2020-02-14 15:02 ` [RFC 13/18] net: atlantic: MACSec egress offload HW bindings Igor Russkikh
2020-02-14 15:02 ` [RFC 14/18] net: atlantic: MACSec egress offload implementation Igor Russkikh
2020-02-14 15:02 ` [RFC 15/18] net: atlantic: MACSec ingress offload HW bindings Igor Russkikh
2020-02-14 15:02 ` [RFC 16/18] net: atlantic: MACSec ingress offload implementation Igor Russkikh
2020-02-14 15:02 ` [RFC 17/18] net: atlantic: MACSec offload statistics HW bindings Igor Russkikh
2020-02-14 15:02 ` [RFC 18/18] net: atlantic: MACSec offload statistics implementation Igor Russkikh
2020-02-21 14:57 ` [RFC 00/18] net: atlantic: MACSec support for AQC devices Antoine Tenart
2020-02-26 8:12 ` [EXT] " Igor Russkikh
2020-02-26 15:50 ` Antoine Tenart
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200214150258.390-9-irusskikh@marvell.com \
--to=irusskikh@marvell.com \
--cc=antoine.tenart@bootlin.com \
--cc=davem@davemloft.net \
--cc=dbogdanov@marvell.com \
--cc=mstarovoitov@marvell.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).