net/macsec: Add MACsec skb extension Rx Data path support

Like in the Tx changes, packet that don't have SecTAG
header aren't necessary been offloaded by the HW.
Therefore, the MACsec driver needs to distinguish if the packet
was offloaded or not and handle accordingly.
Moreover, if there are more than one MACsec device with the same MAC
address as in the packet's destination MAC, the packet will forward only
to this device and only to the desired one.

Used SKB extension and marking it by the HW if the packet was offloaded
and to which MACsec offload device it belongs according to the packet's
SCI.

Signed-off-by: Lior Nahmanson <liorna@nvidia.com>
Reviewed-by: Raed Salem <raeds@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Ben Ben-Ishay <benishay@nvidia.com>

drivers/net/macsec.c

@@ -999,11 +999,13 @@ static enum rx_handler_result handle_not_macsec(struct sk_buff *skb)
 	/* Deliver to the uncontrolled port by default */
 	enum rx_handler_result ret = RX_HANDLER_PASS;
 	struct ethhdr *hdr = eth_hdr(skb);
+	struct macsec_ext *macsec_ext;
 	struct macsec_rxh_data *rxd;
 	struct macsec_dev *macsec;
 
 	rcu_read_lock();
 	rxd = macsec_data_rcu(skb->dev);
+	macsec_ext = skb_ext_find(skb, SKB_EXT_MACSEC);
 
 	list_for_each_entry_rcu(macsec, &rxd->secys, secys) {
 		struct sk_buff *nskb;
@@ -1013,7 +1015,11 @@ static enum rx_handler_result handle_not_macsec(struct sk_buff *skb)
 		/* If h/w offloading is enabled, HW decodes frames and strips
 		 * the SecTAG, so we have to deduce which port to deliver to.
 		 */
-		if (macsec_is_offloaded(macsec) && netif_running(ndev)) {
+		if (macsec_is_offloaded(macsec) && netif_running(ndev) &&
+		    (!macsec_ext || macsec_ext->offloaded)) {
+			if ((macsec_ext) && (!find_rx_sc(&macsec->secy, macsec_ext->sci)))
+				continue;
+
 			if (ether_addr_equal_64bits(hdr->h_dest,
 						    ndev->dev_addr)) {
 				/* exact match, divert skb to this port */

include/net/macsec.h

@@ -23,6 +23,7 @@ typedef u32 __bitwise ssci_t;
 /* MACsec sk_buff extension data */
 struct macsec_ext {
 	sci_t sci;
+	bool offloaded;
 };
 
 typedef union salt {

net/core/gro.c

@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 #include <net/gro.h>
+#include <net/macsec.h>
 #include <net/dst_metadata.h>
 #include <net/busy_poll.h>
 #include <trace/events/net.h>
@@ -390,6 +391,10 @@ static void gro_list_prepare(const struct list_head *head,
 			struct tc_skb_ext *skb_ext;
 			struct tc_skb_ext *p_ext;
 #endif
+#if IS_ENABLED(CONFIG_SKB_EXTENSIONS) && IS_ENABLED(CONFIG_MACSEC)
+			struct macsec_ext *macsec_skb_ext;
+			struct macsec_ext *macsec_p_ext;
+#endif
 
 			diffs |= p->sk != skb->sk;
 			diffs |= skb_metadata_dst_cmp(p, skb);
@@ -402,6 +407,17 @@ static void gro_list_prepare(const struct list_head *head,
 			diffs |= (!!p_ext) ^ (!!skb_ext);
 			if (!diffs && unlikely(skb_ext))
 				diffs |= p_ext->chain ^ skb_ext->chain;
+#endif
+#if IS_ENABLED(CONFIG_SKB_EXTENSIONS) && IS_ENABLED(CONFIG_MACSEC)
+			macsec_skb_ext = skb_ext_find(skb, SKB_EXT_MACSEC);
+			macsec_p_ext = skb_ext_find(p, SKB_EXT_MACSEC);
+
+			diffs |= (!!macsec_p_ext) ^ (!!macsec_skb_ext);
+			if (!diffs && unlikely(macsec_skb_ext)) {
+				diffs |= (__force unsigned long)macsec_p_ext->sci ^
+					 (__force unsigned long)macsec_skb_ext->sci;
+				diffs |= macsec_p_ext->offloaded ^ macsec_skb_ext->offloaded;
+			}
 #endif
 		}