xflow_macsec.h (116267B)
1 /* 2 * 3 * 4 * This license is set out in https://raw.githubusercontent.com/Broadcom-Network-Switching-Software/OpenBCM/master/Legal/LICENSE file. 5 * 6 * Copyright 2007-2020 Broadcom Inc. All rights reserved. 7 * 8 */ 9 10 #ifndef __BCM_XFLOW_MACSEC_H__ 11 #define __BCM_XFLOW_MACSEC_H__ 12 13 #if defined(INCLUDE_XFLOW_MACSEC) 14 15 #include <bcm/types.h> 16 #include <xflow_macsec_defs.h> 17 18 #define BCM_XFLOW_MACSEC_SECURE_CHAN_ID_CREATE(flag, chan_id) \ 19 XFLOW_MACSEC_SECURE_CHAN_ID_CREATE(flag, chan_id) 20 #define BCM_XFLOW_MACSEC_ENCRYPT_DECRYPT_NONE XFLOW_MACSEC_ENCRYPT_DECRYPT_NONE /* Indicates the 21 parameters are not 22 specific to encrypt or 23 decrypt flow or 24 applies to both. */ 25 #define BCM_XFLOW_MACSEC_ENCRYPT XFLOW_MACSEC_ENCRYPT /* Indicates the 26 parameters are for 27 encryption. */ 28 #define BCM_XFLOW_MACSEC_DECRYPT XFLOW_MACSEC_DECRYPT /* Indicates the 29 parameters are for 30 decryption. */ 31 #define BCM_XFLOW_MACSEC_SECURE_CHAN_WITH_ID XFLOW_MACSEC_SECURE_CHAN_WITH_ID /* To be used when secure 32 channel needs to be 33 created with a 34 particular id. */ 35 #define BCM_XFLOW_MACSEC_SECURE_CHAN_INFO_INCLUDE_SCI XFLOW_MACSEC_SECURE_CHAN_INFO_INCLUDE_SCI /* Indicates the 64-bit 36 SCI should be included 37 in the SecTAG during 38 encryption. */ 39 #define BCM_XFLOW_MACSEC_SECURE_CHAN_INFO_CONTROLLED_PORT XFLOW_MACSEC_SECURE_CHAN_INFO_CONTROLLED_PORT /* Allow all data packets 40 and management 41 packets. The default 42 is uncontrolled port 43 which is to discard 44 all data packets and 45 allow only management 46 packets. */ 47 #define BCM_XFLOW_MACSEC_SECURE_CHAN_INFO_ENCRYPT_DISABLE XFLOW_MACSEC_SECURE_CHAN_INFO_ENCRYPT_DISABLE /* Do not encrypt the 48 packet using the 49 Cipher suite. The 50 default behavior is to 51 encrypt. */ 52 #define BCM_XFLOW_MACSEC_SECURE_CHAN_INFO_REPLAY_PROTECT_ENABLE XFLOW_MACSEC_SECURE_CHAN_INFO_REPLAY_PROTECT_ENABLE /* Enable replay protect. */ 53 #define BCM_XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_SVTAG_OFFSET_TO_RANGE_START XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_SVTAG_OFFSET_TO_RANGE_START /* The offset extracted 54 from the SVTAG is 55 added to 56 first_auth_range_offset_start. 57 Applicable only for 58 Inline Xflow Macsec. */ 59 #define BCM_XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_SVTAG_OFFSET_TO_RANGE_END XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_SVTAG_OFFSET_TO_RANGE_END /* The offset extracted 60 from the SVTAG is 61 added to 62 first_auth_range_offset_end. 63 Applicable only for 64 Inline Xflow Macsec. */ 65 #define BCM_XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_SVTAG_OFFSET_TO_SECTAG XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_SVTAG_OFFSET_TO_SECTAG /* The offset extracted 66 from the SVTAG is 67 added to 68 sectag_offset. 69 Applicable only for 70 Inline Xflow Macsec. */ 71 #define BCM_XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_SVTAG_OFFSET_TO_VXLANSEC XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_SVTAG_OFFSET_TO_VXLANSEC /* The offset extracted 72 from SVTAG is added to 73 the base offsets 74 calculated using 75 vxlansec_pkt_type. */ 76 #define BCM_XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_ZERO_OUT_SA_INVALID_PKT XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_ZERO_OUT_SA_INVALID_PKT /* In case of any invalid 77 SA error, zero out the 78 data from 79 confidentiality_offset 80 onwards before sending 81 it out. */ 82 #define BCM_XFLOW_MACSEC_SECURE_CHAN_DECRYPT_ADJUST_RANGE_START XFLOW_MACSEC_SECURE_CHAN_DECRYPT_ADJUST_RANGE_START /* Increment 83 first_auth_range_offset_start 84 based on the number of 85 VLAN tags or MPLS 86 labels present in the 87 ingress packet. */ 88 #define BCM_XFLOW_MACSEC_SECURE_CHAN_DECRYPT_ADJUST_RANGE_END XFLOW_MACSEC_SECURE_CHAN_DECRYPT_ADJUST_RANGE_END /* Increment 89 first_auth_range_offset_end 90 based on the number of 91 VLAN tags or MPLS 92 labels present in the 93 ingress packet. */ 94 #define BCM_XFLOW_MACSEC_SECURE_CHAN_RANGE_AUTHENTICATE XFLOW_MACSEC_SECURE_CHAN_RANGE_AUTHENTICATE /* Prior to Sectag, 95 authenticate only the 96 bytes between 97 first_auth_range_offset_start 98 and 99 first_auth_range_offset_end. 100 Default is to 101 authenticate all bytes 102 prior to Sectag as 103 mandated by the IEEE 104 spec. Applicable to 105 both encrypt and 106 decrypt. */ 107 #define BCM_XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_CONTROLLED_SECURED_DATA XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_CONTROLLED_SECURED_DATA /* ControlledPort is 108 enabled for secured 109 data packets. Secured 110 data packets are 111 allowed and accounted 112 in MIBs. */ 113 #define BCM_XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_CONTROLLED_UNSECURED_DATA XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_CONTROLLED_UNSECURED_DATA /* ControlledPort is 114 enabled for un-secured 115 data packets. 116 Unsecured data packets 117 are allowed and 118 accounted in MIBs. */ 119 #define BCM_XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_PROTECT_DISABLE XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_PROTECT_DISABLE /* Do not encrypt or 120 authenticate the 121 egress packet. Default 122 is to authenticate the 123 packet. Additionally, 124 the packet will be 125 encrypted if TCI.E is 126 set. */ 127 #define BCM_XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_SET_MPLS_BOS_ENABLE XFLOW_MACSEC_SECURE_CHAN_ENCRYPT_SET_MPLS_BOS_ENABLE /* Set the 128 Bottom-of-Stack bit in 129 the last MPLS label 130 before the SecTAG. */ 131 #define BCM_XFLOW_MACSEC_SECURE_CHAN_DECRYPT_SA_EXPIRE_DISABLE XFLOW_MACSEC_SECURE_CHAN_DECRYPT_SA_EXPIRE_DISABLE /* Disable both soft and 132 hard SA expiry 133 notification in the 134 decrypt direction. */ 135 #define BCM_XFLOW_MACSEC_SECURE_CHAN_DECRYPT_DUPLICATE_REJECT XFLOW_MACSEC_SECURE_CHAN_DECRYPT_DUPLICATE_REJECT /* Reject all secured 136 duplicate packets 137 within 128 Packet 138 Number for all secure 139 associations for the 140 channel. Applicable 141 only if replay protect 142 is enabled. */ 143 #define BCM_XFLOW_MACSEC_SECURE_CHAN_DECRYPT_RESET_MPLS_BOS XFLOW_MACSEC_SECURE_CHAN_DECRYPT_RESET_MPLS_BOS /* When set, will reset 144 the Bottom-of-Stack 145 bit in the last MPLS 146 label before SECTAG of 147 a received Secure MPLS 148 packet whose SECTAG 149 and ICV are both 150 stripped */ 151 #define BCM_XFLOW_MACSEC_IPSEC_SECURE_CHAN_ENCRYPT_ZERO_OUT_SA_INVALID_PKT XFLOW_MACSEC_IPSEC_SECURE_CHAN_ENCRYPT_ZERO_OUT_SA_INVALID_PKT /* In case of any invalid 152 SA error, zero out the 153 data from 154 confidentiality_offset 155 onwards before sending 156 it out. Applicable for 157 IPsec configuration. */ 158 #define BCM_XFLOW_MACSEC_IPSEC_SECURE_CHAN_ENCRYPT_SET_MPLS_BOS_ENABLE XFLOW_MACSEC_IPSEC_SECURE_CHAN_ENCRYPT_SET_MPLS_BOS_ENABLE /* Set the 159 Bottom-of-Stack bit in 160 the last MPLS label 161 before the ESP header. */ 162 #define BCM_XFLOW_MACSEC_IPSEC_SECURE_CHAN_ENCRYPT_SVTAG_OFFSET_TO_L3_L4 XFLOW_MACSEC_IPSEC_SECURE_CHAN_ENCRYPT_SVTAG_OFFSET_TO_L3_L4 /* The offset extracted 163 from SVTAG is added to 164 the base offsets 165 calculated using 166 l3_l4_pkt_type. */ 167 #define BCM_XFLOW_MACSEC_IPSEC_SECURE_CHAN_INFO_REPLAY_PROTECT_ENABLE XFLOW_MACSEC_IPSEC_SECURE_CHAN_INFO_REPLAY_PROTECT_ENABLE /* Enable replay protect. */ 168 #define BCM_XFLOW_MACSEC_IPSEC_SECURE_CHAN_ENCRYPT_PROTECT_DISABLE XFLOW_MACSEC_IPSEC_SECURE_CHAN_ENCRYPT_PROTECT_DISABLE /* Do not encrypt or 169 authenticate the 170 egress packet. Default 171 is to authenticate the 172 packet. */ 173 #define BCM_XFLOW_MACSEC_IPSEC_SECURE_CHAN_ENCRYPT_CONTROLLED_SECURED_DATA XFLOW_MACSEC_IPSEC_SECURE_CHAN_ENCRYPT_CONTROLLED_SECURED_DATA /* ControlledPort is 174 enabled for secured 175 data packets. Secured 176 data packets are 177 allowed and accounted 178 in MIBs. */ 179 #define BCM_XFLOW_MACSEC_IPSEC_SECURE_CHAN_ENCRYPT_CONTROLLED_UNSECURED_DATA XFLOW_MACSEC_IPSEC_SECURE_CHAN_ENCRYPT_CONTROLLED_UNSECURED_DATA /* ControlledPort is 180 enabled for un-secured 181 data packets. 182 Unsecured data packets 183 are allowed and 184 accounted in MIBs. */ 185 #define BCM_XFLOW_MACSEC_IPSEC_SECURE_CHAN_AUTH_AES_GMAC XFLOW_MACSEC_IPSEC_SECURE_CHAN_AUTH_AES_GMAC /* Enable IPsec 186 authentication only 187 mode (GMAC mode - RFC 188 4543). */ 189 #define BCM_XFLOW_MACSEC_IPSEC_SECURE_CHAN_DECRYPT_SA_EXPIRE_DISABLE XFLOW_MACSEC_IPSEC_SECURE_CHAN_DECRYPT_SA_EXPIRE_DISABLE /* Disable both soft and 190 hard SA expiry 191 notification in the 192 decrypt direction. */ 193 #define BCM_XFLOW_MACSEC_IPSEC_SECURE_CHAN_DECRYPT_DUPLICATE_REJECT XFLOW_MACSEC_IPSEC_SECURE_CHAN_DECRYPT_DUPLICATE_REJECT /* Reject all secured 194 duplicate packets 195 within 128 Sequence 196 Number for all secure 197 associations for the 198 channel. Applicable 199 only if replay protect 200 is enabled. */ 201 #define BCM_XFLOW_MACSEC_IPSEC_SECURE_CHAN_INFO_CONTROLLED_PORT XFLOW_MACSEC_IPSEC_SECURE_CHAN_INFO_CONTROLLED_PORT /* Enable all data 202 packets on the 203 controlled port. Else, 204 discard all data 205 packets. Encrypt only 206 flag. Applicable only 207 for IPsec 208 configuration. */ 209 #define BCM_XFLOW_MACSEC_IPSEC_SECURE_CHAN_ALLOCATE_MATCH_ACTION_ENTRY1 XFLOW_MACSEC_IPSEC_SECURE_CHAN_ALLOCATE_MATCH_ACTION_ENTRY1 /* Allocate second match 210 action entry (when 211 provided both match 212 entries are used). 213 Applicable only for 214 IPsec configuration. 215 Decrypt only flag. */ 216 #define BCM_XFLOW_MACSEC_IPSEC_SECURE_CHAN_ENCRYPT_SVTAG_OFFSET_TO_ESP XFLOW_MACSEC_IPSEC_SECURE_CHAN_ENCRYPT_SVTAG_OFFSET_TO_ESP /* Add the offset 217 extracted from SVTAG 218 to ESP offset. */ 219 220 typedef enum bcm_xflow_macsec_crypto_e { 221 bcmXflowMacsecCryptoAes128GcmIntegrityOnly = xflowMacsecCryptoAes128GcmIntegrityOnly, 222 bcmXflowMacsecCryptoAes128Gcm = xflowMacsecCryptoAes128Gcm, 223 bcmXflowMacsecCryptoAes128GcmXpnIntegrityOnly = xflowMacsecCryptoAes128GcmXpnIntegrityOnly, 224 bcmXflowMacsecCryptoAes128GcmXpn = xflowMacsecCryptoAes128GcmXpn, 225 bcmXflowMacsecCryptoAes256GcmIntegrityOnly = xflowMacsecCryptoAes256GcmIntegrityOnly, 226 bcmXflowMacsecCryptoAes256Gcm = xflowMacsecCryptoAes256Gcm, 227 bcmXflowMacsecCryptoAes256GcmXpnIntegrityOnly = xflowMacsecCryptoAes256GcmXpnIntegrityOnly, 228 bcmXflowMacsecCryptoAes256GcmXpn = xflowMacsecCryptoAes256GcmXpn, 229 bcmXflowMacsecCryptoCount = xflowMacsecCryptoCount 230 } bcm_xflow_macsec_crypto_t; 231 232 typedef enum bcm_xflow_macsec_mtu_e { 233 bcmXflowMacsecMtu0 = xflowMacsecMtu0, 234 bcmXflowMacsecMtu1 = xflowMacsecMtu1, 235 bcmXflowMacsecMtu2 = xflowMacsecMtu2, 236 bcmXflowMacsecMtu3 = xflowMacsecMtu3, 237 bcmXflowMacsecMtuCount = xflowMacsecMtuCount 238 } bcm_xflow_macsec_mtu_t; 239 240 typedef enum bcm_xflow_macsec_sectag_ethertype_e { 241 bcmXflowMacsecSecTagEtype0 = xflowMacsecSecTagEtype0, 242 bcmXflowMacsecSecTagEtype1 = xflowMacsecSecTagEtype1, 243 bcmXflowMacsecSecTagEtype2 = xflowMacsecSecTagEtype2, 244 bcmXflowMacsecSecTagEtype3 = xflowMacsecSecTagEtype3, 245 bcmXflowMacsecSecTagEtypeCount = xflowMacsecSecTagEtypeCount 246 } bcm_xflow_macsec_sectag_ethertype_t; 247 248 typedef enum bcm_xflow_macsec_secure_chan_vxlansec_hdr_e { 249 bcmXflowMacsecSecureChanVxLanSecHdrNoChange = xflowMacsecSecureChanVxLanSecHdrNoChange, 250 bcmXflowMacsecSecureChanVxLanSecHdrUpdateLength = xflowMacsecSecureChanVxLanSecHdrUpdateLength, 251 bcmXflowMacsecSecureChanVxLanSecHdrUpdateDestPort = xflowMacsecSecureChanVxLanSecHdrUpdateDestPort, 252 bcmXflowMacsecSecureChanVxLanSecHdrUpdateAll = xflowMacsecSecureChanVxLanSecHdrUpdateAll, 253 bcmXflowMacsecSecureChanVxLanSecHdrCount = xflowMacsecSecureChanVxLanSecHdrCount 254 } bcm_xflow_macsec_secure_chan_vxlansec_hdr_t; 255 256 typedef enum bcm_xflow_macsec_secure_chan_vxlansec_pkt_type_e { 257 bcmXflowMacsecSecureChanVxLanSecIPv40Vlan = xflowMacsecSecureChanVxLanSecIPv40Vlan, 258 bcmXflowMacsecSecureChanVxLanSecIPv41Vlan = xflowMacsecSecureChanVxLanSecIPv41Vlan, 259 bcmXflowMacsecSecureChanVxLanSecIPv42Vlan = xflowMacsecSecureChanVxLanSecIPv42Vlan, 260 bcmXflowMacsecSecureChanVxLanSecIPv60Vlan = xflowMacsecSecureChanVxLanSecIPv61Vlan, 261 bcmXflowMacsecSecureChanVxLanSecIPv61Vlan = xflowMacsecSecureChanVxLanSecIPv61Vlan, 262 bcmXflowMacsecSecureChanVxLanSecIPv62Vlan = xflowMacsecSecureChanVxLanSecIPv62Vlan, 263 bcmXflowMacsecSecureChanVxLanSecIPv4TCP0Vlan = xflowMacsecSecureChanVxLanSecIPv4TCP0Vlan, 264 bcmXflowMacsecSecureChanVxLanSecIPv4TCP1Vlan = xflowMacsecSecureChanVxLanSecIPv4TCP1Vlan, 265 bcmXflowMacsecSecureChanVxLanSecIPv4TCP2Vlan = xflowMacsecSecureChanVxLanSecIPv4TCP2Vlan, 266 bcmXflowMacsecSecureChanVxLanSecIPv4UDP0Vlan = xflowMacsecSecureChanVxLanSecIPv4UDP0Vlan, 267 bcmXflowMacsecSecureChanVxLanSecIPv4UDP1Vlan = xflowMacsecSecureChanVxLanSecIPv4UDP1Vlan, 268 bcmXflowMacsecSecureChanVxLanSecIPv4UDP2Vlan = xflowMacsecSecureChanVxLanSecIPv4UDP2Vlan, 269 bcmXflowMacsecSecureChanVxLanSecIPv6TCP0Vlan = xflowMacsecSecureChanVxLanSecIPv6TCP0Vlan, 270 bcmXflowMacsecSecureChanVxLanSecIPv6TCP1Vlan = xflowMacsecSecureChanVxLanSecIPv6TCP1Vlan, 271 bcmXflowMacsecSecureChanVxLanSecIPv6TCP2Vlan = xflowMacsecSecureChanVxLanSecIPv6TCP2Vlan, 272 bcmXflowMacsecSecureChanVxLanSecIPv6UDP0Vlan = xflowMacsecSecureChanVxLanSecIPv6UDP0Vlan, 273 bcmXflowMacsecSecureChanVxLanSecIPv6UDP1Vlan = xflowMacsecSecureChanVxLanSecIPv6UDP1Vlan, 274 bcmXflowMacsecSecureChanVxLanSecIPv6UDP2Vlan = xflowMacsecSecureChanVxLanSecIPv6UDP2Vlan, 275 bcmXflowMacsecSecureChanVxLanSecNoVxLanSec = xflowMacsecSecureChanVxLanSecNoVxLanSec, 276 bcmXflowMacsecSecureChanVxLanSecCount = xflowMacsecSecureChanVxLanSecCount 277 } bcm_xflow_macsec_secure_chan_vxlansec_pkt_type_t; 278 279 typedef enum bcm_xflow_macsec_secure_chan_l3_l4_hdr_e { 280 bcmXflowMacsecSecureChanL3L4HdrNoChange = xflowMacsecSecureChanL3L4HdrNoChange, 281 bcmXflowMacsecSecureChanL3L4HdrUpdateLength = xflowMacsecSecureChanL3L4HdrUpdateLength, 282 bcmXflowMacsecSecureChanL3L4HdrUpdateDestPort = xflowMacsecSecureChanL3L4HdrUpdateDestPort, 283 bcmXflowMacsecSecureChanL3L4HdrUpdateAll = xflowMacsecSecureChanL3L4HdrUpdateAll, 284 bcmXflowMacsecSecureChanL3L4HdrCount = xflowMacsecSecureChanL3L4HdrCount 285 } bcm_xflow_macsec_secure_chan_l3_l4_hdr_t; 286 287 typedef enum bcm_xflow_macsec_secure_chan_l3_l4_pkt_type_e { 288 bcmXflowMacsecSecureChanL3L4IPv40Vlan = xflowMacsecSecureChanL3L4IPv40Vlan, 289 bcmXflowMacsecSecureChanL3L4IPv41Vlan = xflowMacsecSecureChanL3L4IPv41Vlan, 290 bcmXflowMacsecSecureChanL3L4IPv42Vlan = xflowMacsecSecureChanL3L4IPv42Vlan, 291 bcmXflowMacsecSecureChanL3L4IPv60Vlan = xflowMacsecSecureChanL3L4IPv61Vlan, 292 bcmXflowMacsecSecureChanL3L4IPv61Vlan = xflowMacsecSecureChanL3L4IPv61Vlan, 293 bcmXflowMacsecSecureChanL3L4IPv62Vlan = xflowMacsecSecureChanL3L4IPv62Vlan, 294 bcmXflowMacsecSecureChanL3L4IPv4TCP0Vlan = xflowMacsecSecureChanL3L4IPv4TCP0Vlan, 295 bcmXflowMacsecSecureChanL3L4IPv4TCP1Vlan = xflowMacsecSecureChanL3L4IPv4TCP1Vlan, 296 bcmXflowMacsecSecureChanL3L4IPv4TCP2Vlan = xflowMacsecSecureChanL3L4IPv4TCP2Vlan, 297 bcmXflowMacsecSecureChanL3L4IPv4UDP0Vlan = xflowMacsecSecureChanL3L4IPv4UDP0Vlan, 298 bcmXflowMacsecSecureChanL3L4IPv4UDP1Vlan = xflowMacsecSecureChanL3L4IPv4UDP1Vlan, 299 bcmXflowMacsecSecureChanL3L4IPv4UDP2Vlan = xflowMacsecSecureChanL3L4IPv4UDP2Vlan, 300 bcmXflowMacsecSecureChanL3L4IPv6TCP0Vlan = xflowMacsecSecureChanL3L4IPv6TCP0Vlan, 301 bcmXflowMacsecSecureChanL3L4IPv6TCP1Vlan = xflowMacsecSecureChanL3L4IPv6TCP1Vlan, 302 bcmXflowMacsecSecureChanL3L4IPv6TCP2Vlan = xflowMacsecSecureChanL3L4IPv6TCP2Vlan, 303 bcmXflowMacsecSecureChanL3L4IPv6UDP0Vlan = xflowMacsecSecureChanL3L4IPv6UDP0Vlan, 304 bcmXflowMacsecSecureChanL3L4IPv6UDP1Vlan = xflowMacsecSecureChanL3L4IPv6UDP1Vlan, 305 bcmXflowMacsecSecureChanL3L4IPv6UDP2Vlan = xflowMacsecSecureChanL3L4IPv6UDP2Vlan, 306 bcmXflowMacsecSecureChanL3L4NoL3L4 = xflowMacsecSecureChanL3L4NoL3L4, 307 bcmXflowMacsecSecureChanL3L4Count = xflowMacsecSecureChanL3L4Count 308 } bcm_xflow_macsec_secure_chan_l3_l4_pkt_type_t; 309 310 typedef enum bcm_xflow_macsec_index_type_e { 311 bcmXflowMacsecIdTypeSecureChan = xflowMacsecIdTypeSecureChan, 312 bcmXflowMacsecIdTypeSecureAssoc = xflowMacsecIdTypeSecureAssoc, 313 bcmXflowMacsecIdTypePolicy = xflowMacsecIdTypePolicy, 314 bcmXflowMacsecIdTypeFlow = xflowMacsecIdTypeFlow, 315 bcmXflowMacsecIdTypeSubportNum = xflowMacsecIdTypeSubportNum, 316 bcmXflowMacsecIdTypePort = xflowMacsecIdTypePort, 317 bcmXflowMacsecIdTypeInvalid = xflowMacsecIdTypeInvalid, 318 bcmXflowMacsecIdTypeCount = xflowMacsecIdTypeCount 319 } bcm_xflow_macsec_index_type_t; 320 321 typedef xflow_macsec_instance_id_t bcm_xflow_macsec_instance_id_t; 322 323 typedef xflow_macsec_instance_pbmp_t bcm_xflow_macsec_instance_pbmp_t; 324 325 typedef xflow_macsec_secure_chan_info_t bcm_xflow_macsec_secure_chan_info_t; 326 327 typedef xflow_macsec_secure_chan_id_t bcm_xflow_macsec_secure_chan_id_t; 328 329 #ifndef BCM_HIDE_DISPATCHABLE 330 331 /* 332 * bcm_xflow_macsec_secure_chan_create installs a new security channel 333 * entry. It returns the secure channel ID. 334 */ 335 extern int bcm_xflow_macsec_secure_chan_create( 336 int unit, 337 uint32 flags, 338 bcm_xflow_macsec_instance_id_t instance_id, 339 bcm_xflow_macsec_secure_chan_info_t *chan_info, 340 int priority, 341 bcm_xflow_macsec_secure_chan_id_t *chan_id); 342 343 /* Set MACSec configuration for the specified port. */ 344 extern int bcm_xflow_macsec_secure_chan_set( 345 int unit, 346 uint32 flags, 347 bcm_xflow_macsec_secure_chan_id_t chan_id, 348 bcm_xflow_macsec_secure_chan_info_t *chan_info, 349 int priority); 350 351 /* Get the security channel configuration for a given SC index. */ 352 extern int bcm_xflow_macsec_secure_chan_get( 353 int unit, 354 bcm_xflow_macsec_secure_chan_id_t chan_id, 355 bcm_xflow_macsec_secure_chan_info_t *chan_info, 356 int *priority); 357 358 /* 359 * Delete the given security channel. The corresponding SA must be 360 * destroyed first. 361 */ 362 extern int bcm_xflow_macsec_secure_chan_destroy( 363 int unit, 364 bcm_xflow_macsec_secure_chan_id_t chan_id); 365 366 #endif /* BCM_HIDE_DISPATCHABLE */ 367 368 /* Initialize the secure channel data structure. */ 369 extern void bcm_xflow_macsec_secure_chan_info_t_init( 370 bcm_xflow_macsec_secure_chan_info_t *chan_info); 371 372 #ifndef BCM_HIDE_DISPATCHABLE 373 374 /* Enable the Security Channel. */ 375 extern int bcm_xflow_macsec_secure_chan_enable_set( 376 int unit, 377 bcm_xflow_macsec_secure_chan_id_t chan_id, 378 int enable); 379 380 /* Check if the Security Channel is enabled. */ 381 extern int bcm_xflow_macsec_secure_chan_enable_get( 382 int unit, 383 bcm_xflow_macsec_secure_chan_id_t chan_id, 384 int *enable); 385 386 #endif /* BCM_HIDE_DISPATCHABLE */ 387 388 /* bcm_xflow_macsec_chan_traverse_cb */ 389 typedef int (*bcm_xflow_macsec_chan_traverse_cb)( 390 int unit, 391 bcm_xflow_macsec_secure_chan_info_t *chan_info, 392 bcm_xflow_macsec_secure_chan_id_t chan_id, 393 void *user_data); 394 395 #ifndef BCM_HIDE_DISPATCHABLE 396 397 /* Traverse all secure channels. */ 398 extern int bcm_xflow_macsec_secure_chan_info_traverse( 399 int unit, 400 uint32 flags, 401 bcm_xflow_macsec_instance_id_t instance_id, 402 bcm_xflow_macsec_chan_traverse_cb callback, 403 void *user_data); 404 405 #endif /* BCM_HIDE_DISPATCHABLE */ 406 407 #define BCM_XFLOW_MACSEC_SECURE_ASSOC_ID_CREATE(flag, assoc_id) \ 408 XFLOW_MACSEC_SECURE_ASSOC_ID_CREATE(flag, assoc_id) 409 #define BCM_XFLOW_MACSEC_SECURE_ASSOC_INFO_SET_NEXT_PKT_NUM XFLOW_MACSEC_SECURE_ASSOC_INFO_SET_NEXT_PKT_NUM /* Set the next PN of the 410 security association 411 to the value given. */ 412 #define BCM_XFLOW_MACSEC_IPSEC_SECURE_ASSOC_INFO_SET_NEXT_PKT_NUM XFLOW_MACSEC_IPSEC_SECURE_ASSOC_INFO_SET_NEXT_PKT_NUM /* Set the next PN of the 413 IPsec security 414 association to the 415 value given. */ 416 417 typedef xflow_macsec_secure_assoc_info_t bcm_xflow_macsec_secure_assoc_info_t; 418 419 typedef xflow_macsec_crypto_aes128_gcm_t bcm_xflow_macsec_crypto_aes128_gcm_t; 420 421 typedef xflow_macsec_crypto_aes256_gcm_t bcm_xflow_macsec_crypto_aes256_gcm_t; 422 423 typedef uint32 bcm_xflow_macsec_secure_assoc_id_t; 424 425 typedef enum bcm_xflow_macsec_secure_assoc_an_control_e { 426 bcmXflowMacsecSecureAssocAnNormal = xflowMacsecSecureAssocAnNormal, 427 bcmXflowMacsecSecureAssocAnRollover = xflowMacsecSecureAssocAnRollover, 428 bcmXflowMacsecSecureAssocAnAuto = xflowMacsecSecureAssocAnAuto, 429 bcmXflowMacsecSecureAssocAnCount = xflowMacsecSecureAssocAnCount 430 } bcm_xflow_macsec_secure_assoc_an_control_t; 431 432 #ifndef BCM_HIDE_DISPATCHABLE 433 434 /* 435 * bcm_xflow_macsec_secure_assoc_create creates a new Security 436 * Association for the given Security Channel. 437 */ 438 extern int bcm_xflow_macsec_secure_assoc_create( 439 int unit, 440 uint32 flags, 441 bcm_xflow_macsec_secure_chan_id_t chan_id, 442 bcm_xflow_macsec_secure_assoc_info_t *assoc_info, 443 bcm_xflow_macsec_secure_assoc_id_t *assoc_id); 444 445 /* 446 * Sets/resets the value of any of the parameters of a given Security 447 * Association. 448 */ 449 extern int bcm_xflow_macsec_secure_assoc_set( 450 int unit, 451 bcm_xflow_macsec_secure_assoc_id_t assoc_id, 452 bcm_xflow_macsec_secure_assoc_info_t *assoc_info); 453 454 /* 455 * Retrieve the Security Association configuration and the SC index from 456 * the SA index. 457 */ 458 extern int bcm_xflow_macsec_secure_assoc_get( 459 int unit, 460 bcm_xflow_macsec_secure_assoc_id_t assoc_id, 461 bcm_xflow_macsec_secure_assoc_info_t *assoc_info, 462 bcm_xflow_macsec_secure_chan_id_t *chan_id); 463 464 /* Deletes the SA entry corresponding to the Security Association. */ 465 extern int bcm_xflow_macsec_secure_assoc_destroy( 466 int unit, 467 bcm_xflow_macsec_secure_assoc_id_t assoc_id); 468 469 #endif /* BCM_HIDE_DISPATCHABLE */ 470 471 /* Initialize the Security Association data structure. */ 472 extern void bcm_xflow_macsec_secure_assoc_info_t_init( 473 bcm_xflow_macsec_secure_assoc_info_t *assoc_info); 474 475 /* bcm_xflow_macsec_secure_assoc_traverse_cb */ 476 typedef int (*bcm_xflow_macsec_secure_assoc_traverse_cb)( 477 int unit, 478 bcm_xflow_macsec_secure_assoc_info_t *assoc, 479 bcm_xflow_macsec_secure_chan_id_t chan_id, 480 bcm_xflow_macsec_secure_assoc_id_t assoc_id, 481 void *user_data); 482 483 #ifndef BCM_HIDE_DISPATCHABLE 484 485 /* Traverse all the secure association belonging to a Secure channel. */ 486 extern int bcm_xflow_macsec_secure_assoc_traverse( 487 int unit, 488 bcm_xflow_macsec_secure_chan_id_t chan_id, 489 bcm_xflow_macsec_secure_assoc_traverse_cb callback, 490 void *user_data); 491 492 #endif /* BCM_HIDE_DISPATCHABLE */ 493 494 #define BCM_XFLOW_MACSEC_DECRYPT_POLICY_ID_CREATE(id) \ 495 XFLOW_MACSEC_POLICY_ID_CREATE(BCM_XFLOW_MACSEC_DECRYPT, id) 496 #define BCM_XFLOW_MACSEC_DECRYPT_POLICY_WITH_ID XFLOW_MACSEC_POLICY_WITH_ID /* Provide the policy_id 497 as input to the API. */ 498 #define BCM_XFLOW_MACSEC_DECRYPT_POLICY_UNTAGGED_FRAME_DENY XFLOW_MACSEC_DECRYPT_POLICY_UNTAGGED_FRAME_DENY /* Deny and account all 499 data packet which 500 doesn't have a sectag. */ 501 #define BCM_XFLOW_MACSEC_DECRYPT_POLICY_CHECK_ICV XFLOW_MACSEC_DECRYPT_POLICY_CHECK_ICV /* Allow all data and 502 control packets to be 503 permitted and 504 accounted regardless 505 of policy violation, 506 but do check and 507 account (but not drop) 508 for ICV violations. */ 509 #define BCM_XFLOW_MACSEC_DECRYPT_POLICY_CHECK_NONE XFLOW_MACSEC_DECRYPT_POLICY_CHECK_NONE /* Allow all data and 510 control packets to be 511 permitted and 512 accounted regardless 513 of policy violation 514 and do not perform an 515 ICV check. */ 516 #define BCM_XFLOW_MACSEC_DECRYPT_POLICY_UNTAGGED_CONTROL_PORT_ENABLE XFLOW_MACSEC_DECRYPT_POLICY_UNTAGGED_CONTROL_PORT_ENABLE /* Allow data packets 517 which are untagged 518 (i.e., they don't have 519 a SecTAG) to be 520 processed by the 521 MACsec logic. */ 522 #define BCM_XFLOW_MACSEC_DECRYPT_POLICY_TAGGED_CONTROL_PORT_ENABLE XFLOW_MACSEC_DECRYPT_POLICY_TAGGED_CONTROL_PORT_ENABLE /* Allow data 523 (non-management) 524 packets which are 525 tagged (i.e., they 526 have a SecTAG) to be 527 processed by the 528 MACsec logic. */ 529 #define BCM_XFLOW_MACSEC_DECRYPT_POLICY_POINT_TO_POINT_ENABLE XFLOW_MACSEC_DECRYPT_POLICY_POINT_TO_POINT_ENABLE /* Enable the point to 530 point mode in the 531 Policy table. This 532 mode is disabled by 533 default. The SCI value 534 is only programmed 535 when point to point 536 mode is enabled. */ 537 #define BCM_XFLOW_MACSEC_DECRYPT_POLICY_FOR_CONTROL_PACKET XFLOW_MACSEC_DECRYPT_POLICY_FOR_CONTROL_PACKET /* Creates Decrypt policy 538 for mangement packets. */ 539 #define BCM_XFLOW_MACSEC_DECRYPT_POLICY_CUSTOM_PROTOCOL XFLOW_MACSEC_DECRYPT_POLICY_CUSTOM_PROTOCOL /* The packets contain 540 custom protocol tag. 541 The sectag is 542 identified by 543 sectag_offset. 544 Applicable only for 545 Inline Xflow Macsec. */ 546 #define BCM_XFLOW_MACSEC_DECRYPT_POLICY_SECTAG_OFFSET_ADJUST XFLOW_MACSEC_DECRYPT_POLICY_SECTAG_OFFSET_ADJUST /* Adjust sectag_offset 547 based on the number of 548 VLAN Tags and MPLS 549 labels. Applicable 550 only for Inline Xflow 551 Macsec. */ 552 #define BCM_XFLOW_MACSEC_DECRYPT_POLICY_IPV4_CHKSUM_FAIL_AND_MPLS_BOS_MISS_DENY XFLOW_MACSEC_DECRYPT_POLICY_IPV4_CHKSUM_FAIL_AND_MPLS_BOS_MISS_DENY /* For IPv4 packets, 553 tagged control port 554 packets with checksum 555 fail are dropped. For 556 MPLS packets, tagged 557 and untagged control 558 port packets with MPLS 559 BOS not found are 560 dropped. In both 561 cases, drop happen 562 only when they are not 563 copied to CPU. */ 564 #define BCM_XFLOW_MACSEC_DECRYPT_POLICY_INNER_L2_VALID XFLOW_MACSEC_DECRYPT_POLICY_INNER_L2_VALID /* Inner DA and Inner SA 565 are in clear and they 566 are available before 567 SecTag. */ 568 #define BCM_XFLOW_MACSEC_IPSEC_DECRYPT_POLICY_OUTER_IP_VALID XFLOW_MACSEC_IPSEC_DECRYPT_POLICY_OUTER_IP_VALID /* The subport carries 569 IPsec flow and 570 ipsec_outer_ip_offset 571 is valid. Applicable 572 only for Inline Xflow 573 Macsec Gen 2. */ 574 #define BCM_XFLOW_MACSEC_IPSEC_DECRYPT_POLICY_ESP_OFFSET_ADJUST XFLOW_MACSEC_IPSEC_DECRYPT_POLICY_ESP_OFFSET_ADJUST /* Adjust 575 ipsec_esp_offset based 576 on the number of VLAN 577 tags or MPLS labels. 578 Applicable only for 579 Inline Xflow Macsec 580 Gen 2. */ 581 #define BCM_XFLOW_MACSEC_IPSEC_DECRYPT_POLICY_OUTER_IP_OFFSET_ADJUST XFLOW_MACSEC_IPSEC_DECRYPT_POLICY_OUTER_IP_OFFSET_ADJUST /* Adjust 582 ipsec_outer_ip_offset 583 based on the number of 584 VLAN tags or MPLS 585 labels. Applicable 586 only for Inline Xflow 587 Macsec Gen 2. */ 588 #define BCM_XFLOW_MACSEC_IPSEC_DECRYPT_POLICY XFLOW_MACSEC_IPSEC_DECRYPT_POLICY /* Identify the subport 589 (SecY) as an IPsec 590 subport. Needed to 591 configure 592 ipsec_esp_offset. */ 593 594 typedef enum bcm_xflow_macsec_tag_validate_e { 595 bcmXflowMacsecTagValidateBypassMacsec = xflowMacsecTagValidateBypassMacsec, 596 bcmXflowMacsecTagValidateStrict = xflowMacsecTagValidateStrict, 597 bcmXflowMacsecTagValidateCheckICV = xflowMacsecTagValidateCheckICV, 598 bcmXflowMacsecTagValidateCheckNone = xflowMacsecTagValidateCheckNone, 599 bcmXflowMacsecTagValidateDenyAll = xflowMacsecTagValidateDenyAll, 600 bcmXflowMacsecTagValidateCount = xflowMacsecTagValidateCount 601 } bcm_xflow_macsec_tag_validate_t; 602 603 typedef xflow_macsec_policy_id_t bcm_xflow_macsec_policy_id_t; 604 605 typedef xflow_macsec_policy_info_t bcm_xflow_macsec_decrypt_policy_info_t; 606 607 #ifndef BCM_HIDE_DISPATCHABLE 608 609 /* 610 * bcm_xflow_macsec_decrypt_policy_create creates a new decrypt policy 611 * based on the configured actions. A policy identifier is returned. 612 */ 613 extern int bcm_xflow_macsec_decrypt_policy_create( 614 int unit, 615 uint32 flags, 616 bcm_xflow_macsec_instance_id_t instance_id, 617 bcm_xflow_macsec_decrypt_policy_info_t *policy_info, 618 bcm_xflow_macsec_policy_id_t *policy_id); 619 620 /* 621 * Set/Replace one of the parameters of an existing decrypt policy 622 * configuration. 623 */ 624 extern int bcm_xflow_macsec_decrypt_policy_set( 625 int unit, 626 bcm_xflow_macsec_policy_id_t policy_id, 627 bcm_xflow_macsec_decrypt_policy_info_t *policy_info); 628 629 /* Get the decrypt policy configuration given the policy_id. */ 630 extern int bcm_xflow_macsec_decrypt_policy_get( 631 int unit, 632 bcm_xflow_macsec_policy_id_t policy_id, 633 bcm_xflow_macsec_decrypt_policy_info_t *policy_info); 634 635 /* Destroy the decrypt policy configuration given the policy_id. */ 636 extern int bcm_xflow_macsec_decrypt_policy_destroy( 637 int unit, 638 bcm_xflow_macsec_policy_id_t policy_id); 639 640 #endif /* BCM_HIDE_DISPATCHABLE */ 641 642 /* Initialize the decrypt policy data structure. */ 643 extern void bcm_xflow_macsec_decrypt_policy_info_t_init( 644 bcm_xflow_macsec_decrypt_policy_info_t *policy_info); 645 646 #define BCM_XFLOW_MACSEC_DECRYPT_FLOW_ID_CREATE(id) \ 647 XFLOW_MACSEC_FLOW_ID_CREATE(XFLOW_MACSEC_DECRYPT, id) 648 #define BCM_XFLOW_MACSEC_FLOW_WITH_ID XFLOW_MACSEC_FLOW_WITH_ID /* To be used when flows 649 need to be created 650 with a particular id */ 651 #define BCM_XFLOW_MACSEC_FLOW_TPID_SEL_0 XFLOW_MACSEC_FLOW_TPID_SEL_0 /* Select the first TPID 652 to be matched. */ 653 #define BCM_XFLOW_MACSEC_FLOW_TPID_SEL_1 XFLOW_MACSEC_FLOW_TPID_SEL_1 /* Select the second TPID 654 to be matched. */ 655 #define BCM_XFLOW_MACSEC_FLOW_TPID_SEL_2 XFLOW_MACSEC_FLOW_TPID_SEL_2 /* Select the third TPID 656 to be matched. */ 657 #define BCM_XFLOW_MACSEC_FLOW_TPID_SEL_3 XFLOW_MACSEC_FLOW_TPID_SEL_3 /* Select the fourth TPID 658 to be matched. */ 659 #define BCM_XFLOW_MACSEC_NO_TAGS_NO_LABELS XFLOW_MACSEC_NO_TAGS_NO_LABELS /* Match no vlan tag or 660 no mpls label is 661 present. */ 662 #define BCM_XFLOW_MACSEC_1_VLAN_TAG_1_MPLS_LABEL XFLOW_MACSEC_1_VLAN_TAG_1_MPLS_LABEL /* Match 1 VLAN tag or 1 663 MPLS label. */ 664 #define BCM_XFLOW_MACSEC_2_VLAN_TAG_2_MPLS_LABEL XFLOW_MACSEC_2_VLAN_TAG_2_MPLS_LABEL /* Match 2 VLAN tags or 2 665 MPLS labels. */ 666 #define BCM_XFLOW_MACSEC_3_VLAN_TAG_3_MPLS_LABEL XFLOW_MACSEC_3_VLAN_TAG_3_MPLS_LABEL /* Match 3 VLAN tags or 3 667 MPLS labels. */ 668 #define BCM_XFLOW_MACSEC_4_VLAN_TAG_4_MPLS_LABEL XFLOW_MACSEC_4_VLAN_TAG_4_MPLS_LABEL /* Match 4 VLAN tags or 4 669 MPLS labels. */ 670 #define BCM_XFLOW_MACSEC_GREATER_4_VLAN_TAG_5_MPLS_LABEL XFLOW_MACSEC_GREATER_4_VLAN_TAG_5_MPLS_LABEL /* Match greater than 4 671 VLAN Tags or Greater 672 than 5 MPLS labels. */ 673 #define BCM_XFLOW_MACSEC_DECRYPT_SOP_ERROR_UNKNOWN_POLICY XFLOW_MACSEC_DECRYPT_SOP_ERROR_UNKNOWN_POLICY /* Decrypt SVTAG SOP 674 error type unkown 675 policy. */ 676 #define BCM_XFLOW_MACSEC_DECRYPT_SOP_ERROR_TAG_CTRL_PORT XFLOW_MACSEC_DECRYPT_SOP_ERROR_TAG_CTRL_PORT /* Decrypt SVTAG SOP 677 error type tag 678 controlled port. */ 679 #define BCM_XFLOW_MACSEC_DECRYPT_SOP_ERROR_UNTAG_CTRL_PORT XFLOW_MACSEC_DECRYPT_SOP_ERROR_UNTAG_CTRL_PORT /* Decrypt SVTAG SOP 680 error type untagged 681 controlled port. */ 682 #define BCM_XFLOW_MACSEC_DECRYPT_SOP_ERROR_IPV4_MPLS XFLOW_MACSEC_DECRYPT_SOP_ERROR_IPV4_MPLS /* Decrypt SVTAG SOP 683 error type ipv4/MPLS 684 error. */ 685 #define BCM_XFLOW_MACSEC_DECRYPT_SOP_ERROR_INVALID_SECTAG XFLOW_MACSEC_DECRYPT_SOP_ERROR_INVALID_SECTAG /* Decrypt SVTAG SOP 686 error type invalid 687 sectag. */ 688 #define BCM_XFLOW_MACSEC_DECRYPT_SOP_ERROR_UNKNOWN_SECURE_CHAN XFLOW_MACSEC_DECRYPT_SOP_ERROR_UNKNOWN_SECURE_CHAN /* Decrypt SVTAG SOP 689 error type unkown 690 secure channel. */ 691 #define BCM_XFLOW_MACSEC_DECRYPT_SOP_ERROR_UNKNOWN_SECURE_ASSOC XFLOW_MACSEC_DECRYPT_SOP_ERROR_UNKNOWN_SECURE_ASSOC /* Decrypt SVTAG SOP 692 error type unkown 693 secure association. */ 694 #define BCM_XFLOW_MACSEC_DECRYPT_SOP_ERROR_REPLAY_FAILURE XFLOW_MACSEC_DECRYPT_SOP_ERROR_REPLAY_FAILURE /* Decrypt SVTAG SOP 695 error type replay 696 error. */ 697 698 typedef xflow_macsec_flow_id_t bcm_xflow_macsec_flow_id_t; 699 700 typedef xflow_macsec_flow_info_mpls_t bcm_xflow_macsec_flow_info_mpls_t; 701 702 typedef xflow_macsec_flow_udf_param_t bcm_xflow_macsec_flow_udf_param_t; 703 704 typedef xflow_macsec_flow_info_t bcm_xflow_macsec_decrypt_flow_info_t; 705 706 typedef enum bcm_xflow_macsec_decrypt_flow_pkt_type_e { 707 bcmXflowMacsecDecryptFlowAny = xflowMacsecDecryptFlowAny, 708 bcmXflowMacsecDecryptFlowNonMacsec = xflowMacsecDecryptFlowNonMacsec, 709 bcmXflowMacsecDecryptFlowMacSec = xflowMacsecDecryptFlowMacSec, 710 bcmXflowMacsecDecryptFlowManagement = xflowMacsecDecryptFlowManagement, 711 bcmXflowMacsecDecryptFlowKay = xflowMacsecDecryptFlowKay, 712 bcmXflowMacsecDecryptFlowCount = xflowMacsecDecryptFlowCount 713 } bcm_xflow_macsec_decrypt_flow_pkt_type_t; 714 715 typedef enum bcm_xflow_macsec_flow_frame_type_e { 716 bcmXflowMacsecFlowFrameEII = xflowMacsecFlowFrameEII, 717 bcmXflowMacsecFlowFrameSnap = xflowMacsecFlowFrameSnap, 718 bcmXflowMacsecFlowFrameLlc = xflowMacsecFlowFrameLlc, 719 bcmXflowMacsecFlowFrameMpls = xflowMacsecFlowFrameMpls, 720 bcmXflowMacsecFlowFramePBB = xflowMacsecFlowFramePBB, 721 bcmXflowMacsecFlowFrameVNTag = xflowMacsecFlowFrameVNTag, 722 bcmXflowMacsecFlowFrameETag = xflowMacsecFlowFrameETag, 723 bcmXflowMacsecFlowFrameIPv4 = xflowMacsecFlowFrameIPv4, 724 bcmXflowMacsecFlowFrameUDPIPv4 = xflowMacsecFlowFrameUDPIPv4, 725 bcmXflowMacsecFlowFrameTCPIPv4 = xflowMacsecFlowFrameTCPIPv4, 726 bcmXflowMacsecFlowFrameIPv6 = xflowMacsecFlowFrameIPv6, 727 bcmXflowMacsecFlowFrameUDPIPv6 = xflowMacsecFlowFrameUDPIPv6, 728 bcmXflowMacsecFlowFrameTCPIPv6 = xflowMacsecFlowFrameTCPIPv6, 729 bcmXflowMacsecFlowFrameAny = xflowMacsecFlowFrameAny, 730 bcmXflowMacsecFlowFrameCount = xflowMacsecFlowFrameCount 731 } bcm_xflow_macsec_flow_frame_type_t; 732 733 typedef enum bcm_xflow_macsec_decrypt_flow_etype_e { 734 bcmXflowMacsecFlowEtypeAny = xflowMacsecFlowEtypeAny, 735 bcmXflowMacsecFlowEtypeEII = xflowMacsecFlowEtypeEII, 736 bcmXflowMacsecFlowEtypeSnap = xflowMacsecFlowEtypeSnap, 737 bcmXflowMacsecFlowEtypeLlc = xflowMacsecFlowEtypeLlc, 738 bcmXflowMacsecFlowEtypeMpls = xflowMacsecFlowEtypeMpls, 739 bcmXflowMacsecFlowEtypeCount = xflowMacsecFlowEtypeCount 740 } bcm_xflow_macsec_decrypt_flow_etype_t; 741 742 typedef enum bcm_xflow_macsec_vlan_mpls_tag_status_e { 743 bcmXflowMacsecTagAny = xflowMacsecTagAny, 744 bcmXflowMacsecTagUntaggedVlan = xflowMacsecTagUntaggedVlan, 745 bcmXflowMacsecTagSingleVlan = xflowMacsecTagSingleVlan, 746 bcmXflowMacsecTagDoubleVlan = xflowMacsecTagDoubleVlan, 747 bcmXflowMacsecTagOneMplsLabel = xflowMacsecTagOneMplsLabel, 748 bcmXflowMacsecTagTwoMplsLabel = xflowMacsecTagTwoMplsLabel, 749 bcmXflowMacsecTagThreeMplsLabel = xflowMacsecTagThreeMplsLabel, 750 bcmXflowMacsecTagCount = xflowMacsecTagCount 751 } bcm_xflow_macsec_vlan_mpls_tag_status_t; 752 753 #ifndef BCM_HIDE_DISPATCHABLE 754 755 /* 756 * The API bcm_xflow_macsec_decrypt_flow_create creates a flow entry in 757 * the decrypt TCAM. 758 */ 759 extern int bcm_xflow_macsec_decrypt_flow_create( 760 int unit, 761 uint32 flags, 762 bcm_xflow_macsec_instance_id_t instance_id, 763 bcm_xflow_macsec_decrypt_flow_info_t *flow_info, 764 int priority, 765 bcm_xflow_macsec_flow_id_t *flow_id); 766 767 /* Set/Replace one of the parameters in the flow criteria. */ 768 extern int bcm_xflow_macsec_decrypt_flow_set( 769 int unit, 770 bcm_xflow_macsec_flow_id_t flow_id, 771 bcm_xflow_macsec_decrypt_flow_info_t *flow_info, 772 int priority); 773 774 /* Get the flow configuration given a flow index. */ 775 extern int bcm_xflow_macsec_decrypt_flow_get( 776 int unit, 777 bcm_xflow_macsec_flow_id_t flow_id, 778 bcm_xflow_macsec_decrypt_flow_info_t *flow_info, 779 int *priority); 780 781 /* Delete a flow configuration given a flow index. */ 782 extern int bcm_xflow_macsec_decrypt_flow_destroy( 783 int unit, 784 bcm_xflow_macsec_flow_id_t flow_id); 785 786 #endif /* BCM_HIDE_DISPATCHABLE */ 787 788 /* Initialize the data structure. */ 789 extern void bcm_xflow_macsec_decrypt_flow_info_t_init( 790 bcm_xflow_macsec_decrypt_flow_info_t *flow_info); 791 792 #ifndef BCM_HIDE_DISPATCHABLE 793 794 /* Enable a flow given the flow index. */ 795 extern int bcm_xflow_macsec_decrypt_flow_enable_set( 796 int unit, 797 bcm_xflow_macsec_flow_id_t flow_id, 798 int enable); 799 800 /* Get the enable status of a decrypt flow. */ 801 extern int bcm_xflow_macsec_decrypt_flow_enable_get( 802 int unit, 803 bcm_xflow_macsec_flow_id_t flow_id, 804 int *enable); 805 806 #endif /* BCM_HIDE_DISPATCHABLE */ 807 808 typedef xflow_macsec_id_t bcm_xflow_macsec_id_t; 809 810 typedef xflow_macsec_subport_id_t bcm_xflow_macsec_subport_id_t; 811 812 #ifndef BCM_HIDE_DISPATCHABLE 813 814 /* 815 * The API bcm_xflow_macsec_subport_id_get returns a subport identifier 816 * when passed a generic id type. 817 */ 818 extern int bcm_xflow_macsec_subport_id_get( 819 int unit, 820 bcm_xflow_macsec_id_t id, 821 bcm_xflow_macsec_subport_id_t *macsec_subport_id); 822 823 #endif /* BCM_HIDE_DISPATCHABLE */ 824 825 typedef enum bcm_xflow_macsec_control_e { 826 bcmXflowMacsecControlPNThreshold = xflowMacsecControlPNThreshold, 827 bcmXflowMacsecControlXPNThreshold = xflowMacsecControlXPNThreshold, 828 bcmXflowMacsecControlMgmtMTU = xflowMacsecControlMgmtMTU, 829 bcmXflowMacsecControlSVTagEnable = xflowMacsecControlSVTagEnable, 830 bcmXflowMacsecControlPTPDestPortGeneral = xflowMacsecControlPTPDestPortGeneral, 831 bcmXflowMacsecControlPTPDestPortEvent = xflowMacsecControlPTPDestPortEvent, 832 bcmXflowMacsecControlPbbTpidBTag = xflowMacsecControlPbbTpidBTag, 833 bcmXflowMacsecControlPbbTpidITag = xflowMacsecControlPbbTpidITag, 834 bcmXflowMacsecControlEtypeNIV = xflowMacsecControlEtypeNIV, 835 bcmXflowMacsecControlEtypePE = xflowMacsecControlEtypePE, 836 bcmXflowMacsecControlEtypeMgmt0 = xflowMacsecControlEtypeMgmt0, 837 bcmXflowMacsecControlEtypeMgmt1 = xflowMacsecControlEtypeMgmt1, 838 bcmXflowMacsecControlEtypeMgmt2 = xflowMacsecControlEtypeMgmt2, 839 bcmXflowMacsecControlEtypeMgmt3 = xflowMacsecControlEtypeMgmt3, 840 bcmXflowMacsecControlEtypeMgmt4 = xflowMacsecControlEtypeMgmt4, 841 bcmXflowMacsecControlEtypeMgmt5 = xflowMacsecControlEtypeMgmt5, 842 bcmXflowMacsecControlEtypeMgmt6 = xflowMacsecControlEtypeMgmt6, 843 bcmXflowMacsecControlEtypeMgmt7 = xflowMacsecControlEtypeMgmt7, 844 bcmXflowMacsecControlVxLANSecDestPort = xflowMacsecControlVxLANSecDestPort, 845 bcmXflowMacsecControlOutDestPort = xflowMacsecControlOutDestPort, 846 bcmXflowMacsecControlMplsEtype0 = xflowMacsecControlMplsEtype0, 847 bcmXflowMacsecControlMplsEtype1 = xflowMacsecControlMplsEtype1, 848 bcmXflowMacsecControlMplsEtype2 = xflowMacsecControlMplsEtype2, 849 bcmXflowMacsecControlMplsEtype3 = xflowMacsecControlMplsEtype3, 850 bcmXflowMacsecControlSVTagTPIDEtype = xflowMacsecControlSVTagTPIDEtype, 851 bcmXflowMacsecControlEncryptFailCopyToCpu = xflowMacsecControlEncryptFailCopyToCpu, 852 bcmXflowMacsecControlDecryptFailCopyToCpu = xflowMacsecControlDecryptFailCopyToCpu, 853 bcmXflowMacsecControlEncryptFailDrop = xflowMacsecControlEncryptFailDrop, 854 bcmXflowMacsecControlDecryptFailDrop = xflowMacsecControlDecryptFailDrop, 855 bcmXflowMacsecControlSelIpInfoAfterMplsBos = xflowMacsecControlSelIpInfoAfterMplsBos, 856 bcmXflowMacsecControlSvtagSopErrorDrop = xflowMacsecControlSvtagSopErrorDrop, 857 bcmXflowMacsecControlXPNThresholdMask0 = xflowMacsecControlXPNThresholdMask0, 858 bcmXflowMacsecControlXPNThresholdMask1 = xflowMacsecControlXPNThresholdMask1, 859 bcmXflowMacsecControlXPNThresholdMask2 = xflowMacsecControlXPNThresholdMask2, 860 bcmXflowMacsecControlXPNThresholdMask3 = xflowMacsecControlXPNThresholdMask3, 861 bcmXflowMacsecIpsecControlUdpDstPortWithNonEsp = xflowMacsecIpsecControlUdpDstPortWithNonEsp, 862 bcmXflowMacsecIpsecControlUdpDstPortWithoutNonEsp = xflowMacsecIpsecControlUdpDstPortWithoutNonEsp, 863 bcmXflowMacsecIpsecControlNatUdpDstPort = xflowMacsecIpsecControlNatUdpDstPort, 864 bcmXflowMacsecIpsecControlNatUdpSrcPort = xflowMacsecIpsecControlNatUdpSrcPort, 865 bcmXflowMacsecIpsecControlESPUdpDstPort = xflowMacsecIpsecControlESPUdpDstPort, 866 bcmXflowMacsecIpsecControlESPUdpSrcPort = xflowMacsecIpsecControlESPUdpSrcPort, 867 bcmXflowMacsecIpsecControlIncrementPadBytes = xflowMacsecIpsecControlIncrementPadBytes, 868 bcmXflowMacsecIpsecControlNextHopDummy = xflowMacsecIpsecControlNextHopDummy, 869 bcmXflowMacsecControlUdpDestPort = xflowMacsecControlUdpDestPort, 870 bcmXflowMacsecControlTcpDestPort = xflowMacsecControlTcpDestPort, 871 bcmXflowMacsecControlCount = xflowMacsecControlCount 872 } bcm_xflow_macsec_control_t; 873 874 #ifndef BCM_HIDE_DISPATCHABLE 875 876 /* 877 * bcm_xflow_macsec_control_set sets the value in HW for the macsec 878 * control type provided. 879 */ 880 extern int bcm_xflow_macsec_control_set( 881 int unit, 882 uint32 flags, 883 bcm_xflow_macsec_instance_id_t instance_id, 884 bcm_xflow_macsec_control_t type, 885 uint64 value); 886 887 /* 888 * bcm_xflow_macsec_control_get sets the value in HW for the macsec 889 * control type provided. 890 */ 891 extern int bcm_xflow_macsec_control_get( 892 int unit, 893 uint32 flags, 894 bcm_xflow_macsec_instance_id_t instance_id, 895 bcm_xflow_macsec_control_t type, 896 uint64 *value); 897 898 #endif /* BCM_HIDE_DISPATCHABLE */ 899 900 #define BCM_XFLOW_MACSEC_STAT_SYNC_DISABLE XFLOW_MACSEC_STAT_SYNC_DISABLE /* Disable sync when 901 using xflow macsec 902 Stat APIs. */ 903 904 typedef enum bcm_xflow_macsec_stat_type_e { 905 bcmXflowMacsecStatTypeInvalid = xflowMacsecStatTypeInvalid , 906 bcmXflowMacsecUnctrlPortInOctets = xflowMacsecUnctrlPortInOctets, 907 bcmXflowMacsecUnctrlPortInUcastPkts = xflowMacsecUnctrlPortInUcastPkts, 908 bcmXflowMacsecUnctrlPortInMulticastPkts = xflowMacsecUnctrlPortInMulticastPkts, 909 bcmXflowMacsecUnctrlPortInBroadcastPkts = xflowMacsecUnctrlPortInBroadcastPkts, 910 bcmXflowMacsecUnctrlPortInDiscards = xflowMacsecUnctrlPortInDiscards, 911 bcmXflowMacsecUnctrlPortOutOctets = xflowMacsecUnctrlPortOutOctets, 912 bcmXflowMacsecUnctrlPortOutUcastPkts = xflowMacsecUnctrlPortOutUcastPkts, 913 bcmXflowMacsecUnctrlPortOutMulticastPkts = xflowMacsecUnctrlPortOutMulticastPkts, 914 bcmXflowMacsecUnctrlPortOutBroadcastPkts = xflowMacsecUnctrlPortOutBroadcastPkts, 915 bcmXflowMacsecUnctrlPortOutErrors = xflowMacsecUnctrlPortOutErrors, 916 bcmXflowMacsecCtrlPortInOctets = xflowMacsecCtrlPortInOctets, 917 bcmXflowMacsecCtrlPortInUcastPkts = xflowMacsecCtrlPortInUcastPkts, 918 bcmXflowMacsecCtrlPortInMulticastPkts = xflowMacsecCtrlPortInMulticastPkts, 919 bcmXflowMacsecCtrlPortInBroadcastPkts = xflowMacsecCtrlPortInBroadcastPkts, 920 bcmXflowMacsecCtrlPortInDiscards = xflowMacsecCtrlPortInDiscards, 921 bcmXflowMacsecCtrlPortInErrors = xflowMacsecCtrlPortInErrors, 922 bcmXflowMacsecCtrlPortOutOctets = xflowMacsecCtrlPortOutOctets, 923 bcmXflowMacsecCtrlPortOutUcastPkts = xflowMacsecCtrlPortOutUcastPkts, 924 bcmXflowMacsecCtrlPortOutMulticastPkts = xflowMacsecCtrlPortOutMulticastPkts, 925 bcmXflowMacsecCtrlPortOutBroadcastPkts = xflowMacsecCtrlPortOutBroadcastPkts, 926 bcmXflowMacsecCtrlPortOutErrors = xflowMacsecCtrlPortOutErrors, 927 bcmXflowMacsecSecyStatsTxUntaggedPkts = xflowMacsecSecyStatsTxUntaggedPkts, 928 bcmXflowMacsecSecyStatsTxTooLongPkts = xflowMacsecSecyStatsTxTooLongPkts, 929 bcmXflowMacsecSecyStatsRxUntaggedPkts = xflowMacsecSecyStatsRxUntaggedPkts, 930 bcmXflowMacsecSecyStatsRxNoTagPkts = xflowMacsecSecyStatsRxNoTagPkts, 931 bcmXflowMacsecSecyStatsRxBadTagPkts = xflowMacsecSecyStatsRxBadTagPkts, 932 bcmXflowMacsecSecyStatsRxUnknownSCIPkts = xflowMacsecSecyStatsRxUnknownSCIPkts, 933 bcmXflowMacsecSecyStatsRxNoSCIPkts = xflowMacsecSecyStatsRxNoSCIPkts, 934 bcmXflowMacsecSecyStatsRxOverrunPkts = xflowMacsecSecyStatsRxOverrunPkts, 935 bcmXflowMacsecSecyTxSCStatsProtectedPkts = xflowMacsecSecyTxSCStatsProtectedPkts, 936 bcmXflowMacsecSecyTxSCStatsEncryptedPkts = xflowMacsecSecyTxSCStatsEncryptedPkts, 937 bcmXflowMacsecSecyTxSCStatsOctetsProtected = xflowMacsecSecyTxSCStatsOctetsProtected, 938 bcmXflowMacsecSecyTxSCStatsOctetsEncrypted = xflowMacsecSecyTxSCStatsOctetsEncrypted, 939 bcmXflowMacsecSecyRxSCStatsUnusedSAPkts = xflowMacsecSecyRxSCStatsUnusedSAPkts, 940 bcmXflowMacsecSecyRxSCStatsNotUsingSAPkts = xflowMacsecSecyRxSCStatsNotUsingSAPkts, 941 bcmXflowMacsecSecyRxSCStatsLatePkts = xflowMacsecSecyRxSCStatsLatePkts, 942 bcmXflowMacsecSecyRxSCStatsNotValidPkts = xflowMacsecSecyRxSCStatsNotValidPkts, 943 bcmXflowMacsecSecyRxSCStatsInvalidPkts = xflowMacsecSecyRxSCStatsInvalidPkts, 944 bcmXflowMacsecSecyRxSCStatsDelayedPkts = xflowMacsecSecyRxSCStatsDelayedPkts, 945 bcmXflowMacsecSecyRxSCStatsUncheckedPkts = xflowMacsecSecyRxSCStatsUncheckedPkts, 946 bcmXflowMacsecSecyRxSCStatsOKPkts = xflowMacsecSecyRxSCStatsOKPkts, 947 bcmXflowMacsecSecyRxSCStatsOctetsValidated = xflowMacsecSecyRxSCStatsOctetsValidated, 948 bcmXflowMacsecSecyRxSCStatsOctetsDecrypted = xflowMacsecSecyRxSCStatsOctetsDecrypted, 949 bcmXflowMacsecSecyTxSAStatsProtectedPkts = xflowMacsecSecyTxSAStatsProtectedPkts, 950 bcmXflowMacsecSecyTxSAStatsEncryptedPkts = xflowMacsecSecyTxSAStatsEncryptedPkts, 951 bcmXflowMacsecSecyRxSAStatsUnusedSAPkts = xflowMacsecSecyRxSAStatsUnusedSAPkts, 952 bcmXflowMacsecSecyRxSAStatsNotUsingSAPkts = xflowMacsecSecyRxSAStatsNotUsingSAPkts, 953 bcmXflowMacsecSecyRxSAStatsNotValidPkts = xflowMacsecSecyRxSAStatsNotValidPkts, 954 bcmXflowMacsecSecyRxSAStatsInvalidPkts = xflowMacsecSecyRxSAStatsInvalidPkts, 955 bcmXflowMacsecSecyRxSAStatsOKPkts = xflowMacsecSecyRxSAStatsOKPkts, 956 bcmXflowMacsecInMgmtPkts = xflowMacsecInMgmtPkts, 957 bcmXflowMacsecFlowTcamHitCntr = xflowMacsecFlowTcamHitCntr, 958 bcmXflowMacsecFlowTcamMissCntr = xflowMacsecFlowTcamMissCntr, 959 bcmXflowMacsecScTcamHitCntr = xflowMacsecScTcamHitCntr, 960 bcmXflowMacsecScTcamMissCntr = xflowMacsecScTcamMissCntr, 961 bcmXflowMacsecOutMgmtPkts = xflowMacsecOutMgmtPkts, 962 bcmXflowMacsecInPacketDropCntr = xflowMacsecInPacketDropCntr, 963 bcmXflowMacsecOutPacketDropCntr = xflowMacsecOutPacketDropCntr, 964 bcmXflowMacsecBadOlpHdrCntr = xflowMacsecBadOlpHdrCntr, 965 bcmXflowMacsecBadSvtagHdrCntr = xflowMacsecBadSvtagHdrCntr, 966 bcmXflowMacsecUnctrlPortInKayPkts = xflowMacsecUnctrlPortInKayPkts, 967 bcmXflowMacsecIPsecCtrlPortDummyPkts = xflowMacsecIPsecCtrlPortDummyPkts, 968 bcmXflowMacsecIPsecCtrlPortIPLengthMismatch = xflowMacsecIPsecCtrlPortIPLengthMismatch, 969 bcmXflowMacsecIPsecTxOutErrors = xflowMacsecIPsecTxOutErrors, 970 bcmXflowMacsecIPsecUnctrlPortInIkePkts = xflowMacsecIPsecUnctrlPortInIkePkts, 971 bcmXflowMacsecIPsecSecyRxNoSPIPkts = xflowMacsecIPsecSecyRxNoSPIPkts, 972 bcmXflowMacsecIPsecSecyRxIPFragmentsSetPkts = xflowMacsecIPsecSecyRxIPFragmentsSetPkts, 973 bcmXflowMacsecIPSecSecyRxIllegalNxtHdrPkts = xflowMacsecIPSecSecyRxIllegalNxtHdrPkts, 974 bcmXflowMacsecIPSecRxNoSAPkts = xflowMacsecIPSecRxNoSAPkts, 975 bcmXflowMacsecIPSecRxSADummyPkts = xflowMacsecIPSecRxSADummyPkts, 976 bcmXflowMacsecIPSecRxSAPadMismatchPkts = xflowMacsecIPSecRxSAPadMismatchPkts, 977 bcmXflowMacsecStatTypeCount = xflowMacsecStatTypeCount 978 } bcm_xflow_macsec_stat_type_t; 979 980 #ifndef BCM_HIDE_DISPATCHABLE 981 982 /* 983 * The API bcm_xflow_macsec_stat_get gets the counter value corresponding 984 * to the generic id and stat_type provided. 985 */ 986 extern int bcm_xflow_macsec_stat_get( 987 int unit, 988 uint32 flags, 989 bcm_xflow_macsec_id_t id, 990 bcm_xflow_macsec_stat_type_t stat_type, 991 uint64 *value); 992 993 /* 994 * The API bcm_xflow_macsec_stat_set sets the counter value corresponding 995 * to the generic id and stat_type provided. 996 */ 997 extern int bcm_xflow_macsec_stat_set( 998 int unit, 999 uint32 flags, 1000 bcm_xflow_macsec_id_t id, 1001 bcm_xflow_macsec_stat_type_t stat_type, 1002 uint64 value); 1003 1004 /* 1005 * The API bcm_xflow_macsec_stat_multi_get gets an array of counter 1006 * values. 1007 */ 1008 extern int bcm_xflow_macsec_stat_multi_get( 1009 int unit, 1010 uint32 flags, 1011 bcm_xflow_macsec_id_t id, 1012 uint32 num_stats, 1013 bcm_xflow_macsec_stat_type_t *stat_type_array, 1014 uint64 *value_array); 1015 1016 /* 1017 * The API bcm_xflow_macsec_stat_multi_set gets an array of counter 1018 * values. 1019 */ 1020 extern int bcm_xflow_macsec_stat_multi_set( 1021 int unit, 1022 uint32 flags, 1023 bcm_xflow_macsec_id_t id, 1024 uint32 num_stats, 1025 bcm_xflow_macsec_stat_type_t *stat_type_array, 1026 uint64 *value_array); 1027 1028 #endif /* BCM_HIDE_DISPATCHABLE */ 1029 1030 #define BCM_XFLOW_MACSEC_MATCH_TPID_SEL_0 XFLOW_MACSEC_MATCH_TPID_SEL_0 /* Select the first TPID 1031 to be matched. */ 1032 #define BCM_XFLOW_MACSEC_MATCH_TPID_SEL_1 XFLOW_MACSEC_MATCH_TPID_SEL_1 /* Select the second TPID 1033 to be matched. */ 1034 #define BCM_XFLOW_MACSEC_MATCH_TPID_SEL_2 XFLOW_MACSEC_MATCH_TPID_SEL_2 /* Select the third TPID 1035 to be matched. */ 1036 #define BCM_XFLOW_MACSEC_MATCH_TPID_SEL_3 XFLOW_MACSEC_MATCH_TPID_SEL_3 /* Select the fourth TPID 1037 to be matched. */ 1038 #define BCM_XFLOW_MACSEC_MATCH_TPID_SEL_4 XFLOW_MACSEC_MATCH_TPID_SEL_4 /* Select the fourth TPID 1039 to be matched. */ 1040 #define BCM_XFLOW_MACSEC_VLAN_TPID_MAX XFLOW_MACSEC_VLAN_TPID_MAX /* Total TPIDs 1041 configurable */ 1042 1043 typedef xflow_macsec_vlan_tpid_t bcm_xflow_macsec_vlan_tpid_t; 1044 1045 #ifndef BCM_HIDE_DISPATCHABLE 1046 1047 /* 1048 * The API bcm_xflow_macsec_vlan_tpid_array_set sets the four VLAN TPID 1049 * for decrypt flow. 1050 */ 1051 extern int bcm_xflow_macsec_vlan_tpid_array_set( 1052 int unit, 1053 bcm_xflow_macsec_instance_id_t instance_id, 1054 bcm_xflow_macsec_vlan_tpid_t *vlan_tpid); 1055 1056 /* 1057 * The API bcm_xflow_macsec_vlan_tpid_array_get gets the four VLAN TPID 1058 * for decrypt flow. 1059 */ 1060 extern int bcm_xflow_macsec_vlan_tpid_array_get( 1061 int unit, 1062 bcm_xflow_macsec_instance_id_t instance_id, 1063 bcm_xflow_macsec_vlan_tpid_t *vlan_tpid); 1064 1065 /* 1066 * The API bcm_xflow_macsec_vlan_tpid_array_index_get retrieves the index 1067 * corresponding to a TPID value. 1068 */ 1069 extern int bcm_xflow_macsec_vlan_tpid_array_index_get( 1070 int unit, 1071 bcm_xflow_macsec_instance_id_t instance_id, 1072 uint32 vlan_tpid, 1073 uint8 *tpid_index_sel); 1074 1075 #endif /* BCM_HIDE_DISPATCHABLE */ 1076 1077 #define BCM_XFLOW_MACSEC_MTU_WITH_ID XFLOW_MACSEC_MTU_WITH_ID /* The mtu_index is provided 1078 as an input. */ 1079 1080 #ifndef BCM_HIDE_DISPATCHABLE 1081 1082 /* 1083 * The API bcm_xflow_macsec_mtu_set sets the MTU for encrypt or decrypt 1084 * flow. 1085 */ 1086 extern int bcm_xflow_macsec_mtu_set( 1087 int unit, 1088 int flags, 1089 bcm_xflow_macsec_instance_id_t instance_id, 1090 uint32 mtu, 1091 bcm_xflow_macsec_mtu_t *mtu_sel); 1092 1093 /* 1094 * The API bcm_xflow_macsec_mtu_get gets the MTU for encrypt or decrypt 1095 * flow. 1096 */ 1097 extern int bcm_xflow_macsec_mtu_get( 1098 int unit, 1099 int flags, 1100 bcm_xflow_macsec_instance_id_t instance_id, 1101 bcm_xflow_macsec_mtu_t mtu_sel, 1102 uint32 *mtu); 1103 1104 #endif /* BCM_HIDE_DISPATCHABLE */ 1105 1106 #define BCM_XFLOW_MACSEC_ETHERTYPE_WITH_ID XFLOW_MACSEC_ETHERTYPE_WITH_ID /* The sectag_etype_index 1107 is provided as input. */ 1108 1109 #ifndef BCM_HIDE_DISPATCHABLE 1110 1111 /* 1112 * The API bcm_xflow_macsec_sectag_etype_set sets the sectag EtherType 1113 * for encrypt and decrypt flow. 1114 */ 1115 extern int bcm_xflow_macsec_sectag_etype_set( 1116 int unit, 1117 int flags, 1118 bcm_xflow_macsec_instance_id_t instance_id, 1119 uint32 sectag_etype, 1120 bcm_xflow_macsec_sectag_ethertype_t *sectag_etype_sel); 1121 1122 /* 1123 * The API bcm_xflow_macsec_sectag_etype_get gets the sectag EtherType 1124 * for encrypt and decrypt flow. 1125 */ 1126 extern int bcm_xflow_macsec_sectag_etype_get( 1127 int unit, 1128 bcm_xflow_macsec_instance_id_t instance_id, 1129 bcm_xflow_macsec_sectag_ethertype_t sectag_etype_sel, 1130 uint32 *sectag_etype); 1131 1132 #endif /* BCM_HIDE_DISPATCHABLE */ 1133 1134 typedef enum bcm_xflow_macsec_event_e { 1135 bcmXflowMacsecEventSASoftExpire = xflowMacsecEventSASoftExpire, /* SA Soft Expire event. This indicates 1136 that the PN for a given SA has hit 1137 the threshold value configured. The 1138 index id has to be typecasted to 1139 bcm_xflow_macsec_secure_assoc_id_t. */ 1140 bcmXflowMacsecEventSAExpire = xflowMacsecEventSAExpire, /* SA Expire event. This indicates that 1141 the PN for a given SA has hit the 1142 maximum value possible. For AES 1143 algorithm, this is 2^32. For AES XPN 1144 algorithm, this is 2^64. The index id 1145 has to be typecasted to 1146 bcm_xflow_macsec_secure_assoc_id_t. */ 1147 bcmXflowMacsecEventSAMinExpire = xflowMacsecEventSAMinExpire, /* SA PN/XPN Min Expire event. This 1148 indicates that the incoming SA PN/XPN 1149 is outside the SC 1150 replay_protect_window value. The 1151 index id has to be typecasted to 1152 bcm_xflow_macsec_secure_assoc_id_t. 1153 Applicable only for decrypt case. */ 1154 bcmXflowMacsecEventICVFailure = xflowMacsecEventICVFailure, /* ICV failure event.The index id has to 1155 be typecasted to 1156 bcm_xflow_macsec_secure_assoc_id_t.Applicable 1157 only for decrypt case.Not applicable 1158 for inline xflow-macsec. */ 1159 bcmXflowMacsecEventCount = xflowMacsecEventCount 1160 } bcm_xflow_macsec_event_t; 1161 1162 /* 1163 * Callback function to notify Xflow MACsec events. The flags specify 1164 * whether the callback is for encrypt or decrypt. The index id should be 1165 * typecasted based on the event. 1166 */ 1167 typedef int (*bcm_xflow_macsec_event_cb)( 1168 int unit, 1169 uint32 flags, 1170 bcm_xflow_macsec_instance_id_t instance_id, 1171 bcm_xflow_macsec_event_t event, 1172 bcm_xflow_macsec_id_t id, 1173 void *user_data); 1174 1175 #ifndef BCM_HIDE_DISPATCHABLE 1176 1177 /* 1178 * Xflow Macsec callback registration API. The callback function will be 1179 * invoked when an event occurs. 1180 */ 1181 extern int bcm_xflow_macsec_event_register( 1182 int unit, 1183 bcm_xflow_macsec_event_cb cb, 1184 void *user_data); 1185 1186 /* Xflow Macsec callback deregistration API. */ 1187 extern int bcm_xflow_macsec_event_deregister( 1188 int unit, 1189 bcm_xflow_macsec_event_cb cb); 1190 1191 #endif /* BCM_HIDE_DISPATCHABLE */ 1192 1193 typedef xflow_macsec_port_info_t bcm_xflow_macsec_port_info_t; 1194 1195 typedef xflow_macsec_mac_addr_info_t bcm_xflow_macsec_mac_addr_info_t; 1196 1197 typedef xflow_macsec_port_map_info_t bcm_xflow_macsec_port_map_info_t; 1198 1199 typedef xflow_macsec_handle_info_t bcm_xflow_macsec_handle_info_t; 1200 1201 typedef xflow_macsec_svtag_cpu_flex_map_param_t bcm_xflow_macsec_svtag_cpu_flex_map_param_t; 1202 1203 typedef xflow_macsec_svtag_cpu_flex_map_info_t bcm_xflow_macsec_svtag_cpu_flex_map_info_t; 1204 1205 #ifndef BCM_HIDE_DISPATCHABLE 1206 1207 /* Create a logical MACSec handle */ 1208 extern int bcm_xflow_macsec_handle_create( 1209 int unit, 1210 bcm_xflow_macsec_handle_info_t *handle_info, 1211 bcm_xflow_macsec_id_t *id); 1212 1213 /* 1214 * Given MACsec logical handle, return its info (such as HW index, 1215 * macsec_id, etc...) 1216 */ 1217 extern int bcm_xflow_macsec_handle_info_get( 1218 int unit, 1219 bcm_xflow_macsec_id_t id, 1220 bcm_xflow_macsec_handle_info_t *handle_info); 1221 1222 #endif /* BCM_HIDE_DISPATCHABLE */ 1223 1224 /* Initialize the data structure. */ 1225 extern void bcm_xflow_macsec_port_info_t_init( 1226 bcm_xflow_macsec_port_info_t *port_info); 1227 1228 #ifndef BCM_HIDE_DISPATCHABLE 1229 1230 /* Set the MACSEC info on a given port. */ 1231 extern int bcm_xflow_macsec_port_info_set( 1232 int unit, 1233 bcm_port_t port, 1234 bcm_xflow_macsec_port_info_t *port_info); 1235 1236 /* Get the MACSEC info on a given port. */ 1237 extern int bcm_xflow_macsec_port_info_get( 1238 int unit, 1239 bcm_port_t port, 1240 bcm_xflow_macsec_port_info_t *port_info); 1241 1242 /* 1243 * Get the Port Mapping info of a gport : Macsec instance id and Macsec 1244 * port associated with this Gport. 1245 */ 1246 extern int bcm_xflow_macsec_port_map_info_get( 1247 int unit, 1248 uint32 flags, 1249 bcm_gport_t gport, 1250 bcm_xflow_macsec_port_map_info_t *port_map_info); 1251 1252 /* 1253 * Get all the instances along with the member port bitmap. If input 1254 * parameter instance_max = 0, return in the output parameter 1255 * instance_count will be the total number of instances 1256 */ 1257 extern int bcm_xflow_macsec_instance_pbmp_map_get( 1258 int unit, 1259 int instance_max, 1260 bcm_xflow_macsec_instance_pbmp_t *instance_pbmp_map, 1261 int *instance_count); 1262 1263 #endif /* BCM_HIDE_DISPATCHABLE */ 1264 1265 /* 1266 * Mac address control enums. Applicable only for Inline Xflow Macsec 1267 * unless mentioned otherwise. Applicable only for the decrypt case. 1268 */ 1269 typedef enum bcm_xflow_macsec_mac_addr_control_e { 1270 bcmXflowMacsecMgmtDstMac0 = xflowMacsecMgmtDstMac0, /* MACDA to be classified as a 1271 rudimentary management packet. 1272 Argument mac_addr_info.mac_addr 1273 specifies the MACDA. 1274 Argument mac_addr_info.ethertype is 1275 ignored. */ 1276 bcmXflowMacsecMgmtDstMac1 = xflowMacsecMgmtDstMac1, /* MACDA to be classified as a 1277 rudimentary management packet. 1278 Argument mac_addr_info.mac_addr 1279 specifies the MACDA. 1280 Argument mac_addr_info.ethertype is 1281 ignored. */ 1282 bcmXflowMacsecMgmtDstMac2 = xflowMacsecMgmtDstMac2, /* MACDA to be classified as a 1283 rudimentary management packet. 1284 Argument mac_addr_info.mac_addr 1285 specifies the MACDA. 1286 Argument mac_addr_info.ethertype is 1287 ignored. */ 1288 bcmXflowMacsecMgmtDstMac3 = xflowMacsecMgmtDstMac3, /* MACDA to be classified as a 1289 rudimentary management packet. 1290 Argument mac_addr_info.mac_addr 1291 specifies the MACDA. 1292 Argument mac_addr_info.ethertype is 1293 ignored. */ 1294 bcmXflowMacsecMgmtDstMac4 = xflowMacsecMgmtDstMac4, /* MACDA to be classified as a 1295 rudimentary management packet. 1296 Argument mac_addr_info.mac_addr 1297 specifies the MACDA. 1298 Argument mac_addr_info.ethertype is 1299 ignored. */ 1300 bcmXflowMacsecMgmtDstMac5 = xflowMacsecMgmtDstMac5, /* MACDA to be classified as a 1301 rudimentary management packet. 1302 Argument mac_addr_info.mac_addr 1303 specifies the MACDA. 1304 Argument mac_addr_info.ethertype is 1305 ignored. */ 1306 bcmXflowMacsecMgmtDstMac6 = xflowMacsecMgmtDstMac6, /* MACDA to be classified as a 1307 rudimentary management packet. 1308 Argument mac_addr_info.mac_addr 1309 specifies the MACDA. 1310 Argument mac_addr_info.ethertype is 1311 ignored. */ 1312 bcmXflowMacsecMgmtDstMac7 = xflowMacsecMgmtDstMac7, /* MACDA to be classified as a 1313 rudimentary management packet. 1314 Argument mac_addr_info.mac_addr 1315 specifies the MACDA. 1316 Argument mac_addr_info.ethertype is 1317 ignored. */ 1318 bcmXflowMacsecMgmtDstMacRangeLow = xflowMacsecMgmtDstMacRangeLow, /* Lower limit in a range of MACDA to be 1319 classified as a management packet. 1320 Argument mac_addr_info.mac_addr 1321 specifies the MACDA. 1322 Argument mac_addr_info.value is 1323 ignored. */ 1324 bcmXflowMacsecMgmtDstMacRangeHigh = xflowMacsecMgmtDstMacRangeHigh, /* Higher limit in a range of MACDA to 1325 be classified as a management packet. 1326 Argument mac_addr_info.mac_addr 1327 specifies the MACDA. 1328 Argument mac_addr_info.value is 1329 ignored. */ 1330 bcmXflowMacsecMgmtDstMacEthertype0 = xflowMacsecMgmtDstMacEthertype0, /* First set of MACDA and Ethertype to 1331 be classified as a management packet. 1332 Argument mac_addr_info.mac_addr 1333 specifies the MACDA 1334 Argument mac_addr_info.ethertype 1335 specifies the ethertype. */ 1336 bcmXflowMacsecMgmtDstMacEthertype1 = xflowMacsecMgmtDstMacEthertype1, /* Second set of MACDA and Ethertype to 1337 be classified as a management packet. 1338 Argument mac_addr_info.mac_addr 1339 specifies the MACDA 1340 Argument mac_addr_info.ethertype 1341 specifies the ethertype. */ 1342 bcmXflowMacsecStationDstMac = xflowMacsecStationDstMac, /* Station mac addressed to be used when 1343 a dropped packet is to be copied to 1344 cpu. 1345 Argument mac_addr_info.mac_addr 1346 specifies the station MACDA. 1347 Argument mac_addr_info.value is 1348 ignored. Not applicable to Inline 1349 Xflow Macsec. */ 1350 bcmXflowMacsecMacAddrControlCount = xflowMacsecMacAddrControlCount /* Max value. */ 1351 } bcm_xflow_macsec_mac_addr_control_t; 1352 1353 #ifndef BCM_HIDE_DISPATCHABLE 1354 1355 /* 1356 * bcm_xflow_macsec_mac_addr_control_set sets the value in HW for the 1357 * macsec control type provided. 1358 */ 1359 extern int bcm_xflow_macsec_mac_addr_control_set( 1360 int unit, 1361 uint32 flags, 1362 bcm_xflow_macsec_instance_id_t instance_id, 1363 bcm_xflow_macsec_mac_addr_control_t control_type, 1364 bcm_xflow_macsec_mac_addr_info_t *control_info); 1365 1366 /* 1367 * bcm_xflow_macsec_mac_addr_control_get gets the value from HW for the 1368 * macsec control type provided. 1369 */ 1370 extern int bcm_xflow_macsec_mac_addr_control_get( 1371 int unit, 1372 uint32 flags, 1373 bcm_xflow_macsec_instance_id_t instance_id, 1374 bcm_xflow_macsec_mac_addr_control_t control_type, 1375 bcm_xflow_macsec_mac_addr_info_t *control_info); 1376 1377 #endif /* BCM_HIDE_DISPATCHABLE */ 1378 1379 /* 1380 * Port control enums. Applicable only for Inline Xflow Macsec unless 1381 * mentioned otherwise. Applicable only for the decrypt scenario unless 1382 * mentioned otherwise. 1383 */ 1384 typedef enum bcm_xflow_macsec_port_control_e { 1385 bcmXflowMacsecPortSectagEtypeSel = xflowMacsecPortSectagEtypeSel, /* Select from the configured 1386 Ethertypes. */ 1387 bcmXflowMacsecPortSectagVersion = xflowMacsecPortSectagVersion, /* Configure Macsec version for frame 1388 validation. */ 1389 bcmXflowMacsecPortSectagRuleEnable = xflowMacsecPortSectagRuleEnable, /* Enable validation rules for ingress 1390 matching. Select among the following 1391 flags: 1392 BCM_XFLOW_MACSEC_VALIDATE_SECTAG_VERSION_INVALID 1393 BCM_XFLOW_MACSEC_VALIDATE_SECTAG_SHORT_LEN_MAX 1394 BCM_XFLOW_MACSEC_VALIDATE_SECTAG_SHORT_LEN_UNSET 1395 BCM_XFLOW_MACSEC_VALIDATE_SECTAG_SHORT_LEN_MISMATCH 1396 BCM_XFLOW_MACSEC_VALIDATE_SECTAG_E0_C1 1397 BCM_XFLOW_MACSEC_VALIDATE_SECTAG_ES1_SC1 1398 BCM_XFLOW_MACSEC_VALIDATE_SECTAG_SC1_SCB1 1399 BCM_XFLOW_MACSEC_VALIDATE_SECTAG_PN0 */ 1400 bcmXflowMacsecPortTPIDEnable = xflowMacsecPortTPIDEnable, /* Enable configured TPID values. Select 1401 among the following flags: 1402 BCM_XFLOW_MACSEC_MATCH_TPID_SEL_0 1403 BCM_XFLOW_MACSEC_MATCH_TPID_SEL_1 1404 BCM_XFLOW_MACSEC_MATCH_TPID_SEL_2 1405 BCM_XFLOW_MACSEC_MATCH_TPID_SEL_3 1406 BCM_XFLOW_MACSEC_MATCH_TPID_SEL_4 */ 1407 bcmXflowMacsecPortPBBEnable = xflowMacsecPortPBBEnable, /* Per port enable for PBB packet 1408 identification. */ 1409 bcmXflowMacsecPortMPLSEnable = xflowMacsecPortMPLSEnable, /* Enable configured MPLS Ethertype. 1410 Select among the following flags: 1411 BCM_XFLOW_MACSEC_MPLS_ETYPE_0 1412 BCM_XFLOW_MACSEC_MPLS_ETYPE_1 1413 BCM_XFLOW_MACSEC_MPLS_ETYPE_2 1414 BCM_XFLOW_MACSEC_MPLS_ETYPE_3 */ 1415 bcmXflowMacsecPortIPv4EtypeEnable = xflowMacsecPortIPv4EtypeEnable, /* Per port enable for IPv4 ethertype. */ 1416 bcmXflowMacsecPortIPv6EtypeEnable = xflowMacsecPortIPv6EtypeEnable, /* Per port enable for IPv6 ethertype. */ 1417 bcmXflowMacsecPortPTPEtypeEnable = xflowMacsecPortPTPEtypeEnable, /* Per port enable for PTP ethertype. */ 1418 bcmXflowMacsecPortNIVEtypeEnable = xflowMacsecPortNIVEtypeEnable, /* Per port enable for VNTAG ethertype. */ 1419 bcmXflowMacsecPortPEEtypeEnable = xflowMacsecPortPEEtypeEnable, /* Per port enable for PE/ETAG 1420 ethertype. */ 1421 bcmXflowMacsecPortUDPEnable = xflowMacsecPortUDPEnable, /* Per port enable for UDP protocol 1422 packet. */ 1423 bcmXflowMacsecPortTCPEnable = xflowMacsecPortTCPEnable, /* Per port enable for TCP protocol 1424 packet. */ 1425 bcmXflowMacsecPortPTPDestPortEnable = xflowMacsecPortPTPDestPortEnable, /* Per port enable for PTP destination 1426 port number match. */ 1427 bcmXflowMacsecPortPTPMatchRuleEnable = xflowMacsecPortPTPMatchRuleEnable, /* Per-port enable for PTP packet 1428 identification types. Select among 1429 the following flags. 1430 BCM_XFLOW_MACSEC_MATCH_PTP_UNTAGGED 1431 BCM_XFLOW_MACSEC_MATCH_PTP_ONE_VLAN 1432 BCM_XFLOW_MACSEC_MATCH_PTP_UDP_IPV4 1433 BCM_XFLOW_MACSEC_MATCH_PTP_UDP_IPV6 */ 1434 bcmXflowMacsecPortSectagAfterIPv4Enable = xflowMacsecPortSectagAfterIPv4Enable, /* If enabled, 2B after IPV4 header is 1435 matched with SecTag Ethertype. 1436 Otherwise, Sectag EtherType is not 1437 checked after IPv4 header. */ 1438 bcmXflowMacsecPortSectagAfterIPv6Enable = xflowMacsecPortSectagAfterIPv6Enable, /* If enabled, 2B after IPV6 header is 1439 matched with SecTag Ethertype. 1440 Otherwise, Sectag EtherType is not 1441 checked after IPv6 header. */ 1442 bcmXflowMacsecPortSectagAfterTCPEnable = xflowMacsecPortSectagAfterTCPEnable, /* If enabled, 2B after TCP header is 1443 matched with SecTag Ethertype. 1444 Otherwise, Sectag EtherType is not 1445 checked after TCP header. */ 1446 bcmXflowMacsecPortSectagAfterUDPEnable = xflowMacsecPortSectagAfterUDPEnable, /* If enabled, 2B after UDP header is 1447 matched with SecTag Ethertype. 1448 Otherwise, Sectag EtherType is not 1449 checked after UDP header. */ 1450 bcmXflowMacsecPortIPv4ChecksumEnable = xflowMacsecPortIPv4ChecksumEnable, /* If enabled, IPv4 checksum is checked 1451 for secure data packets (MACSEC 1452 packets). If failed, the packet is 1453 purged. Otherwise, IPV4 checksum is 1454 not checked. */ 1455 bcmXflowMacsecPortVxLANIpv6UDPVNIMatchEnable = xflowMacsecPortVxLANIpv6UDPVNIMatchEnable, /* If enabled and if UDP destination 1456 port matches the programmed value, 1457 IPv6 with UDP packet Flags and VNI 1458 information is extracted and used for 1459 decrypt flow match. */ 1460 bcmXflowMacsecPortMTU = xflowMacsecPortMTU, /* The value of per port MTU (maximum 1461 transmission unit) for ingress 1462 management, KaY and SP TCAM Miss 1463 packets. A packet will be marked as 1464 an error packet if its (ingress) size 1465 is greater than MTU. This value 1466 doesn't include the CRC bytes. This 1467 must be set to a value less than or 1468 equal to 2^14-1 minus 16 and greater 1469 than or equal to 196. */ 1470 bcmXflowMacsecPortMgmtPktRulesEnable = xflowMacsecPortMgmtPktRulesEnable, /* Enable the following rules used in 1471 rudimentary management packet 1472 detection. Select among the following 1473 flags. 1474 BCM_XFLOW_MACSEC_MGMT_DEST_MAC_0X0180C200000 1475 BCM_XFLOW_MACSEC_MGMT_DEST_MAC_0X01000CCCCCCC 1476 BCM_XFLOW_MACSEC_MGMT_DEST_MAC[0-7] 1477 BCM_XFLOW_MACSEC_MGMT_ETYPE[0-7] 1478 BCM_XFLOW_MACSEC_MGMT_DEST_MAC_RANGE 1479 BCM_XFLOW_MACSEC_MGMT_DEST_MAC_ETYPE[0-1] 1480 BCM_XFLOW_MACSEC_MGMT_E1_C0 1481 BCM_XFLOW_MACSEC_MGMT_PTP 1482 BCM_XFLOW_MACSEC_MGMT_IPSEC_UDP_DST_PORT_WITH_NON_ESP 1483 BCM_XFLOW_MACSEC_MGMT_IPSEC_UDP_DST_PORT_WITHOUT_NON_ESP 1484 BCM_XFLOW_MACSEC_MGMT_IPSEC_UDP_NAT_PORT */ 1485 bcmXflowMacsecPortMgmtDefaultSubPort = xflowMacsecPortMgmtDefaultSubPort, /* The default sub port assigned if 1486 management packet is detected by the 1487 enabled rules for the port. Subport 1488 ID is passed in the value argument. */ 1489 bcmXflowMacsecPortBasedScEnable = xflowMacsecPortBasedScEnable, /* Relevant for Encrypt Only: If working 1490 in this mode for this port, the SC 1491 Index is derived by the core and is 1492 equal to the egress port number. */ 1493 bcmXflowMacsecPortEnable = xflowMacsecPortEnable, /* Used for enabling/disabling MACSEC to 1494 this logical port. */ 1495 bcmXflowMacsecIPsecPortEsp = xflowMacsecIPsecPortEsp, /* Enable ESP IPsec packet detection. */ 1496 bcmXflowMacsecIPsecPortEspUdp = xflowMacsecIPsecPortEspUdp, /* Enable UDP encapsulated ESP IPsec 1497 packet detection. */ 1498 bcmXflowMacsecIPsecPortEspSnZero = xflowMacsecIPsecPortEspSnZero, /* Enable to allow sequence number (SN) 1499 value in ESP to be 0. */ 1500 bcmXflowMacsecIPsecPortEspSpiZero = xflowMacsecIPsecPortEspSpiZero, /* Enable to allow security parameter 1501 index (SPI) field in ESP to be 0. */ 1502 bcmXflowMacsecIPsecPortEspSpi1To255 = xflowMacsecIPsecPortEspSpi1To255, /* Enable to allow SPI field in ESP to 1503 be in the range 1 to 255. */ 1504 bcmXflowMacsecIPsecPortIPv4Fragment = xflowMacsecIPsecPortIPv4Fragment, /* Enable to allow IPsec IPv4 fragment. */ 1505 bcmXflowMacsecIPsecPortEspUdpSrcPort = xflowMacsecIPsecPortEspUdpSrcPort, /* Enable UDP encapsulated ESP packet 1506 detection using UDP source port. */ 1507 bcmXflowMacsecIPsecPortNatKeepalive = xflowMacsecIPsecPortNatKeepalive, /* Enable NAT keepalive packet 1508 detection. */ 1509 bcmXflowMacsecPortCount = xflowMacsecPortCount /* Maximum enum value. */ 1510 } bcm_xflow_macsec_port_control_t; 1511 1512 #ifndef BCM_HIDE_DISPATCHABLE 1513 1514 /* 1515 * Set the per port parameters for Xflow Macsec. This API should be 1516 * called only in the absence of traffic. 1517 */ 1518 extern int bcm_xflow_macsec_port_control_set( 1519 int unit, 1520 uint32 flags, 1521 bcm_gport_t gport, 1522 bcm_xflow_macsec_port_control_t control_type, 1523 bcm_xflow_macsec_port_info_t *value); 1524 1525 /* Get the per port parameters for Xflow Macsec. */ 1526 extern int bcm_xflow_macsec_port_control_get( 1527 int unit, 1528 uint32 flags, 1529 bcm_gport_t gport, 1530 bcm_xflow_macsec_port_control_t control_type, 1531 bcm_xflow_macsec_port_info_t *value); 1532 1533 /* 1534 * Get the default Policy ID if flow lookup results in a TCAM miss. Valid 1535 * only if xflow_macsec_decrypt_flow_default_policy_enable config 1536 * property is enabled. This API is valid only for the Inline Xflow 1537 * Macsec architecture. 1538 */ 1539 extern int bcm_xflow_macsec_decrypt_flow_default_policy_get( 1540 int unit, 1541 bcm_xflow_macsec_instance_id_t instance_id, 1542 bcm_xflow_macsec_policy_id_t *policy_id); 1543 1544 /* set an entry in the SVTAG CPU Flex Map TCAM */ 1545 extern int bcm_xflow_macsec_decrypt_svtag_cpu_flex_map_set( 1546 int unit, 1547 bcm_xflow_macsec_instance_id_t instance_id, 1548 int index, 1549 bcm_xflow_macsec_svtag_cpu_flex_map_info_t *svtag_cpu_flex_map_info); 1550 1551 /* set an entry in the SVTAG CPU Flex Map TCAM */ 1552 extern int bcm_xflow_macsec_decrypt_svtag_cpu_flex_map_get( 1553 int unit, 1554 bcm_xflow_macsec_instance_id_t instance_id, 1555 int index, 1556 bcm_xflow_macsec_svtag_cpu_flex_map_info_t *svtag_cpu_flex_map_info); 1557 1558 /* Enable the CPU Flex Map rule. */ 1559 extern int bcm_xflow_macsec_decrypt_svtag_cpu_flex_map_enable_set( 1560 int unit, 1561 bcm_xflow_macsec_instance_id_t instance_id, 1562 int index, 1563 int enable); 1564 1565 /* Check if the CPU Flex Map rule is enabled. */ 1566 extern int bcm_xflow_macsec_decrypt_svtag_cpu_flex_map_enable_get( 1567 int unit, 1568 bcm_xflow_macsec_instance_id_t instance_id, 1569 int index, 1570 int *enable); 1571 1572 /* 1573 * Get the reserved secure chan ID for the port configured in port mode. 1574 * Valid only if config bcm_xflow_macsec_encrypt_phy_port_based_macsec is 1575 * set for the port. 1576 */ 1577 extern int bcm_xflow_macsec_port_rsvd_secure_chan_get( 1578 int unit, 1579 uint32 flags, 1580 bcm_gport_t port, 1581 bcm_xflow_macsec_secure_chan_id_t *chan_id); 1582 1583 #endif /* BCM_HIDE_DISPATCHABLE */ 1584 1585 #define BCM_XFLOW_MACSEC_SUBPORT_NUM_GET(subport_id) \ 1586 XFLOW_MACSEC_SUBPORT_NUM_GET(subport_id) 1587 #define BCM_XFLOW_MACSEC_VALIDATE_SECTAG_VERSION_INVALID XFLOW_MACSEC_VALIDATE_SECTAG_VERSION_INVALID /* Invalidate packet if 1588 SECTAG.TCI.V != 1589 (configural value). 1590 Valid only for Inline 1591 Xflow Macsec. */ 1592 #define BCM_XFLOW_MACSEC_VALIDATE_SECTAG_SHORT_LEN_MAX XFLOW_MACSEC_VALIDATE_SECTAG_SHORT_LEN_MAX /* Invalidate packet if 1593 Short_length rcv > 47. 1594 Valid only for Inline 1595 Xflow Macsec. */ 1596 #define BCM_XFLOW_MACSEC_VALIDATE_SECTAG_SHORT_LEN_UNSET XFLOW_MACSEC_VALIDATE_SECTAG_SHORT_LEN_UNSET /* Invalidate packet if 1597 short length not set 1598 but a short packet has 1599 arrived. Valid only 1600 for Inline Xflow 1601 Macsec. */ 1602 #define BCM_XFLOW_MACSEC_VALIDATE_SECTAG_SHORT_LEN_MISMATCH XFLOW_MACSEC_VALIDATE_SECTAG_SHORT_LEN_MISMATCH /* Invalidate packet if 1603 short length does not 1604 match the received 1605 packet length. Valid 1606 only for Inline Xflow 1607 Macsec. */ 1608 #define BCM_XFLOW_MACSEC_VALIDATE_SECTAG_E0_C1 XFLOW_MACSEC_VALIDATE_SECTAG_E0_C1 /* Invalidate packet if 1609 SECTAG.TCI.E = 0 and 1610 SECTAG.TCI.C = 1. 1611 Valid only for Inline 1612 Xflow Macsec. */ 1613 #define BCM_XFLOW_MACSEC_VALIDATE_SECTAG_ES1_SC1 XFLOW_MACSEC_VALIDATE_SECTAG_ES1_SC1 /* Invalidate packet if 1614 SECTAG.TCI.ES = 1 and 1615 SECTAG.TCI.SC = 1. 1616 Valid only for Inline 1617 Xflow Macsec. */ 1618 #define BCM_XFLOW_MACSEC_VALIDATE_SECTAG_SC1_SCB1 XFLOW_MACSEC_VALIDATE_SECTAG_SC1_SCB1 /* Invalidate packet if 1619 SECTAG.TCI.SC = 1 and 1620 SECTAG.TCI.SCB = 1. 1621 Valid only for Inline 1622 Xflow Macsec. */ 1623 #define BCM_XFLOW_MACSEC_VALIDATE_SECTAG_PN0 XFLOW_MACSEC_VALIDATE_SECTAG_PN0 /* Invalidate packet if 1624 SECTAG.PN = 0. Valid 1625 only for Inline Xflow 1626 Macsec. */ 1627 #define BCM_XFLOW_MACSEC_MPLS_ETYPE_0 XFLOW_MACSEC_MPLS_ETYPE_0 /* Enable first 1628 configured MPLS 1629 ethertype. Valid only 1630 for Inline Xflow 1631 Macsec. */ 1632 #define BCM_XFLOW_MACSEC_MPLS_ETYPE_1 XFLOW_MACSEC_MPLS_ETYPE_1 /* Enable second 1633 configured MPLS 1634 ethertype. Valid only 1635 for Inline Xflow 1636 Macsec. */ 1637 #define BCM_XFLOW_MACSEC_MPLS_ETYPE_2 XFLOW_MACSEC_MPLS_ETYPE_2 /* Enable third 1638 configured MPLS 1639 ethertype. Valid only 1640 for Inline Xflow 1641 Macsec. */ 1642 #define BCM_XFLOW_MACSEC_MPLS_ETYPE_3 XFLOW_MACSEC_MPLS_ETYPE_3 /* Enable fourth 1643 configured MPLS 1644 ethertype. Valid only 1645 for Inline Xflow 1646 Macsec. */ 1647 #define BCM_XFLOW_MACSEC_MATCH_PTP_UNTAGGED XFLOW_MACSEC_MATCH_PTP_UNTAGGED /* Enable untagged PTP 1648 EtherType match. Valid 1649 only for Inline Xflow 1650 Macsec. */ 1651 #define BCM_XFLOW_MACSEC_MATCH_PTP_ONE_VLAN XFLOW_MACSEC_MATCH_PTP_ONE_VLAN /* Enable PTP EtherType 1652 match with 1 VLAN. 1653 Valid only for Inline 1654 Xflow Macsec. */ 1655 #define BCM_XFLOW_MACSEC_MATCH_PTP_UDP_IPV4 XFLOW_MACSEC_MATCH_PTP_UDP_IPV4 /* Enable PTP packet with 1656 UDP over IPV4 match. 1657 Valid only for Inline 1658 Xflow Macsec. */ 1659 #define BCM_XFLOW_MACSEC_MATCH_PTP_UDP_IPV6 XFLOW_MACSEC_MATCH_PTP_UDP_IPV6 /* Enable PTP packet with 1660 UDP over IPV6 match. 1661 Valid only for Inline 1662 Xflow Macsec. */ 1663 #define BCM_XFLOW_MACSEC_MGMT_DEST_MAC_0X0180C200000 XFLOW_MACSEC_MGMT_DEST_MAC_0X0180C200000 /* Match as management 1664 packet when 1665 MAC_DA[47:4] == 1666 0x0180_c200_000. Valid 1667 only for Inline Xflow 1668 Macsec. */ 1669 #define BCM_XFLOW_MACSEC_MGMT_DEST_MAC_0X01000CCCCCCC XFLOW_MACSEC_MGMT_DEST_MAC_0X01000CCCCCCC /* Match as management 1670 packet when MAC_DA == 1671 0x0100_0ccc_cccc. 1672 Valid only for Inline 1673 Xflow Macsec. */ 1674 #define BCM_XFLOW_MACSEC_MGMT_DEST_MAC0 XFLOW_MACSEC_MGMT_DEST_MAC0 /* Enable rule to match 1675 as management packet 1676 when the first MAC_DA 1677 matches. Valid only 1678 for Inline Xflow 1679 Macsec. */ 1680 #define BCM_XFLOW_MACSEC_MGMT_DEST_MAC1 XFLOW_MACSEC_MGMT_DEST_MAC1 /* Enable rule to match 1681 as management packet 1682 when the second MAC_DA 1683 matches. Valid only 1684 for Inline Xflow 1685 Macsec. */ 1686 #define BCM_XFLOW_MACSEC_MGMT_DEST_MAC2 XFLOW_MACSEC_MGMT_DEST_MAC2 /* Enable rule to match 1687 as management packet 1688 when the third MAC_DA 1689 matches. Valid only 1690 for Inline Xflow 1691 Macsec. */ 1692 #define BCM_XFLOW_MACSEC_MGMT_DEST_MAC3 XFLOW_MACSEC_MGMT_DEST_MAC3 /* Enable rule to match 1693 as management packet 1694 when the fourth MAC_DA 1695 matches. Valid only 1696 for Inline Xflow 1697 Macsec. */ 1698 #define BCM_XFLOW_MACSEC_MGMT_DEST_MAC4 XFLOW_MACSEC_MGMT_DEST_MAC4 /* Enable rule to match 1699 as management packet 1700 when the fifth MAC_DA 1701 matches. Valid only 1702 for Inline Xflow 1703 Macsec. */ 1704 #define BCM_XFLOW_MACSEC_MGMT_DEST_MAC5 XFLOW_MACSEC_MGMT_DEST_MAC5 /* Enable rule to match 1705 as management packet 1706 when the sixth MAC_DA 1707 matches. Valid only 1708 for Inline Xflow 1709 Macsec. */ 1710 #define BCM_XFLOW_MACSEC_MGMT_DEST_MAC6 XFLOW_MACSEC_MGMT_DEST_MAC6 /* Enable rule to match 1711 as management packet 1712 when the seventh 1713 MAC_DA matches. Valid 1714 only for Inline Xflow 1715 Macsec. */ 1716 #define BCM_XFLOW_MACSEC_MGMT_DEST_MAC7 XFLOW_MACSEC_MGMT_DEST_MAC7 /* Enable rule to match 1717 as management packet 1718 when the eighth MAC_DA 1719 matches. Valid only 1720 for Inline Xflow 1721 Macsec. */ 1722 #define BCM_XFLOW_MACSEC_MGMT_ETYPE0 XFLOW_MACSEC_MGMT_ETYPE0 /* Enable rule to match 1723 as management packet 1724 when the first 1725 Ethertype matches. 1726 Valid only for Inline 1727 Xflow Macsec. */ 1728 #define BCM_XFLOW_MACSEC_MGMT_ETYPE1 XFLOW_MACSEC_MGMT_ETYPE1 /* Enable rule to match 1729 as management packet 1730 when the second 1731 Ethertype matches. 1732 Valid only for Inline 1733 Xflow Macsec. */ 1734 #define BCM_XFLOW_MACSEC_MGMT_ETYPE2 XFLOW_MACSEC_MGMT_ETYPE2 /* Enable rule to match 1735 as management packet 1736 when the third 1737 Ethertype matches. 1738 Valid only for Inline 1739 Xflow Macsec. */ 1740 #define BCM_XFLOW_MACSEC_MGMT_ETYPE3 XFLOW_MACSEC_MGMT_ETYPE3 /* Enable rule to match 1741 as management packet 1742 when the fourth 1743 Ethertype matches. 1744 Valid only for Inline 1745 Xflow Macsec. */ 1746 #define BCM_XFLOW_MACSEC_MGMT_ETYPE4 XFLOW_MACSEC_MGMT_ETYPE4 /* Enable rule to match 1747 as management packet 1748 when the fifth 1749 Ethertype matches. 1750 Valid only for Inline 1751 Xflow Macsec. */ 1752 #define BCM_XFLOW_MACSEC_MGMT_ETYPE5 XFLOW_MACSEC_MGMT_ETYPE5 /* Enable rule to match 1753 as management packet 1754 when the sixth 1755 Ethertype matches. 1756 Valid only for Inline 1757 Xflow Macsec. */ 1758 #define BCM_XFLOW_MACSEC_MGMT_ETYPE6 XFLOW_MACSEC_MGMT_ETYPE6 /* Enable rule to match 1759 as management packet 1760 when the seventh 1761 Ethertype matches. 1762 Valid only for Inline 1763 Xflow Macsec. */ 1764 #define BCM_XFLOW_MACSEC_MGMT_ETYPE7 XFLOW_MACSEC_MGMT_ETYPE7 /* Enable rule to match 1765 as management packet 1766 when the eighth 1767 Ethertype matches. 1768 Valid only for Inline 1769 Xflow Macsec. */ 1770 #define BCM_XFLOW_MACSEC_MGMT_DEST_MAC_RANGE XFLOW_MACSEC_MGMT_DEST_MAC_RANGE /* Enable rule to match 1771 as management packet 1772 when the programmable 1773 MAC_DA address range 1774 match. Valid only for 1775 Inline Xflow Macsec. */ 1776 #define BCM_XFLOW_MACSEC_MGMT_DEST_MAC_ETYPE0 XFLOW_MACSEC_MGMT_DEST_MAC_ETYPE0 /* Enable rule to match 1777 as management packet 1778 when the first set of 1779 programmable MAC_DA 1780 and EtherType match. 1781 Valid only for Inline 1782 Xflow Macsec. */ 1783 #define BCM_XFLOW_MACSEC_MGMT_DEST_MAC_ETYPE1 XFLOW_MACSEC_MGMT_DEST_MAC_ETYPE1 /* Enable rule to match 1784 as management packet 1785 when the second set of 1786 programmable MAC_DA 1787 and EtherType match. 1788 Valid only for Inline 1789 Xflow Macsec. */ 1790 #define BCM_XFLOW_MACSEC_MGMT_E1_C0 XFLOW_MACSEC_MGMT_E1_C0 /* Enable rule to match 1791 as management packet 1792 when SECTAG is present 1793 and SECTAG.TCI.E = 1 1794 and SECTAG.TCI.C = 0. 1795 Valid only for Inline 1796 Xflow Macsec. */ 1797 #define BCM_XFLOW_MACSEC_MGMT_PTP XFLOW_MACSEC_MGMT_PTP /* Enable rule to match 1798 PTP/IEEE 1588 packet 1799 as management packet. 1800 Valid only for Inline 1801 Xflow Macsec. */ 1802 #define BCM_XFLOW_MACSEC_MGMT_IPSEC_UDP_DST_PORT_WITH_NON_ESP XFLOW_MACSEC_MGMT_IPSEC_UDP_DST_PORT_WITH_NON_ESP /* Enable to allow IPsec 1803 IKE packet having UDP 1804 destination port 1805 provided by the 1806 control 1807 xflowMacsecIpsecControlUdpDstPortWithNonEsp, 1808 when the 4 byteNON-ESP 1809 marker after UDP 1810 header is 0. Valid 1811 only for Inline Xflow 1812 Macsec (IPSec only). */ 1813 #define BCM_XFLOW_MACSEC_MGMT_IPSEC_UDP_DST_PORT_WITHOUT_NON_ESP XFLOW_MACSEC_MGMT_IPSEC_UDP_DST_PORT_WITHOUT_NON_ESP /* Enable to allow IPsec 1814 IKE packet having UDP 1815 destination port 1816 provided by the 1817 control 1818 xflowMacsecIpsecControlUdpDstPortWithoutNonEsp, 1819 when the 4 byte 1820 NON-ESP marker is not 1821 present. Valid only 1822 for Inline Xflow 1823 Macsec (IPSec only). */ 1824 #define BCM_XFLOW_MACSEC_MGMT_IPSEC_UDP_NAT_PORT XFLOW_MACSEC_MGMT_IPSEC_UDP_NAT_PORT /* Enable to allow IPsec 1825 NAT keep-alive packet 1826 with UDP destination 1827 port 1828 xflowMacsecIpsecControlNatUdpDstPort, 1829 1 byte payload value 1830 0xFF and optional UDP 1831 source port 1832 xflowMacsecIpsecControlNatUdpSrcPort 1833 and per-port control 1834 xflowMacsecIPsecPortNatKeepalive 1835 set. Valid only for 1836 Inline Xflow Macsec 1837 (IPSec only). */ 1838 1839 typedef xflow_macsec_ipsec_sc_match_action_info_t bcm_xflow_macsec_ipsec_sc_match_action_info_t; 1840 1841 typedef xflow_macsec_ipsec_secure_chan_info_t bcm_xflow_macsec_ipsec_secure_chan_info_t; 1842 1843 #ifndef BCM_HIDE_DISPATCHABLE 1844 1845 /* 1846 * bcm_xflow_macsec_ipsec_secure_chan_create installs a new IPsec 1847 * security channel entry. It returns the secure channel ID. 1848 */ 1849 extern int bcm_xflow_macsec_ipsec_secure_chan_create( 1850 int unit, 1851 uint32 flags, 1852 bcm_xflow_macsec_instance_id_t instance_id, 1853 bcm_xflow_macsec_ipsec_secure_chan_info_t *chan_info, 1854 bcm_xflow_macsec_secure_chan_id_t *chan_id); 1855 1856 /* Set IPsec configuration for the specified port. */ 1857 extern int bcm_xflow_macsec_ipsec_secure_chan_set( 1858 int unit, 1859 uint32 flags, 1860 bcm_xflow_macsec_secure_chan_id_t chan_id, 1861 bcm_xflow_macsec_ipsec_secure_chan_info_t *chan_info); 1862 1863 /* Get the IPsec security channel configuration for a given SC index. */ 1864 extern int bcm_xflow_macsec_ipsec_secure_chan_get( 1865 int unit, 1866 bcm_xflow_macsec_secure_chan_id_t chan_id, 1867 bcm_xflow_macsec_ipsec_secure_chan_info_t *chan_info); 1868 1869 /* 1870 * Delete the given IPsec security channel. The corresponding SA must be 1871 * destroyed first. 1872 */ 1873 extern int bcm_xflow_macsec_ipsec_secure_chan_destroy( 1874 int unit, 1875 bcm_xflow_macsec_secure_chan_id_t chan_id); 1876 1877 #endif /* BCM_HIDE_DISPATCHABLE */ 1878 1879 /* Initialize the IPsec secure channel data structure. */ 1880 extern void bcm_xflow_macsec_ipsec_secure_chan_info_t_init( 1881 bcm_xflow_macsec_ipsec_secure_chan_info_t *chan_info); 1882 1883 /* bcm_xflow_macsec_ipsec_chan_traverse_cb */ 1884 typedef int (*bcm_xflow_macsec_ipsec_chan_traverse_cb)( 1885 int unit, 1886 bcm_xflow_macsec_ipsec_secure_chan_info_t *chan_info, 1887 bcm_xflow_macsec_secure_chan_id_t chan_id, 1888 void *user_data); 1889 1890 #ifndef BCM_HIDE_DISPATCHABLE 1891 1892 /* Traverse all secure channels. */ 1893 extern int bcm_xflow_macsec_ipsec_secure_chan_info_traverse( 1894 int unit, 1895 uint32 flags, 1896 bcm_xflow_macsec_instance_id_t instance_id, 1897 bcm_xflow_macsec_ipsec_chan_traverse_cb callback, 1898 void *user_data); 1899 1900 #endif /* BCM_HIDE_DISPATCHABLE */ 1901 1902 typedef xflow_macsec_ipsec_secure_assoc_info_t bcm_xflow_macsec_ipsec_secure_assoc_info_t; 1903 1904 #ifndef BCM_HIDE_DISPATCHABLE 1905 1906 /* 1907 * bcm_xflow_macsec_ipsec_secure_assoc_create creates a new IPsec 1908 * Security Association for the given Security Channel. 1909 */ 1910 extern int bcm_xflow_macsec_ipsec_secure_assoc_create( 1911 int unit, 1912 uint32 flags, 1913 bcm_xflow_macsec_secure_chan_id_t chan_id, 1914 bcm_xflow_macsec_ipsec_secure_assoc_info_t *assoc_info, 1915 bcm_xflow_macsec_secure_assoc_id_t *assoc_id); 1916 1917 /* 1918 * Sets/resets the value of any of the parameters of a given IPsec 1919 * Security Association. 1920 */ 1921 extern int bcm_xflow_macsec_ipsec_secure_assoc_set( 1922 int unit, 1923 bcm_xflow_macsec_secure_assoc_id_t assoc_id, 1924 bcm_xflow_macsec_ipsec_secure_assoc_info_t *assoc_info); 1925 1926 /* 1927 * Retrieve the IPsec Security Association configuration and the SC index 1928 * from the SA index. 1929 */ 1930 extern int bcm_xflow_macsec_ipsec_secure_assoc_get( 1931 int unit, 1932 bcm_xflow_macsec_secure_assoc_id_t assoc_id, 1933 bcm_xflow_macsec_ipsec_secure_assoc_info_t *assoc_info, 1934 bcm_xflow_macsec_secure_chan_id_t *chan_id); 1935 1936 /* Deletes the SA entry corresponding to the Security Association. */ 1937 extern int bcm_xflow_macsec_ipsec_secure_assoc_destroy( 1938 int unit, 1939 bcm_xflow_macsec_secure_assoc_id_t assoc_id); 1940 1941 #endif /* BCM_HIDE_DISPATCHABLE */ 1942 1943 /* Initialize the Security Association data structure. */ 1944 extern void bcm_xflow_macsec_ipsec_secure_assoc_info_t_init( 1945 bcm_xflow_macsec_ipsec_secure_assoc_info_t *assoc_info); 1946 1947 /* bcm_xflow_macsec_ipsec_secure_assoc_traverse_cb */ 1948 typedef int (*bcm_xflow_macsec_ipsec_secure_assoc_traverse_cb)( 1949 int unit, 1950 bcm_xflow_macsec_ipsec_secure_assoc_info_t *assoc, 1951 bcm_xflow_macsec_secure_chan_id_t chan_id, 1952 bcm_xflow_macsec_secure_assoc_id_t assoc_id, 1953 void *user_data); 1954 1955 #ifndef BCM_HIDE_DISPATCHABLE 1956 1957 /* 1958 * Traverse all the secure association belonging to an IPsec Secure 1959 * channel. 1960 */ 1961 extern int bcm_xflow_macsec_ipsec_secure_assoc_traverse( 1962 int unit, 1963 bcm_xflow_macsec_secure_chan_id_t chan_id, 1964 bcm_xflow_macsec_ipsec_secure_assoc_traverse_cb callback, 1965 void *user_data); 1966 1967 #endif /* defined(INCLUDE_XFLOW_MACSEC) */ 1968 1969 #endif /* BCM_HIDE_DISPATCHABLE */ 1970 1971 #endif /* __BCM_XFLOW_MACSEC_H__ */