]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - drivers/net/macsec.c
projects / mirror_ubuntu-jammy-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
macsec: limit replay window size with XPN
[mirror_ubuntu-jammy-kernel.git] / drivers / net / macsec.c
CommitLineData
2874c5fd 1// SPDX-License-Identifier: GPL-2.0-or-later
c09440f7
SD		 2/*
3 * drivers/net/macsec.c - MACsec device
4 *
5 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net>
c09440f7
SD		 6 */
7
8#include <linux/types.h>
9#include <linux/skbuff.h>
10#include <linux/socket.h>
11#include <linux/module.h>
12#include <crypto/aead.h>
13#include <linux/etherdevice.h>
3cf3227a 14#include <linux/netdevice.h>
c09440f7 15#include <linux/rtnetlink.h>
e187246f 16#include <linux/refcount.h>
c09440f7
SD		 17#include <net/genetlink.h>
18#include <net/sock.h>
5491e7c6 19#include <net/gro_cells.h>
c0e4eadf 20#include <net/macsec.h>
3cf3227a 21#include <linux/phy.h>
a21ecf0e 22#include <linux/byteorder/generic.h>
b06d072c 23#include <linux/if_arp.h>
c09440f7
SD		 24
25#include <uapi/linux/if_macsec.h>
26
c09440f7
SD		 27#define MACSEC_SCI_LEN 8
28
29/* SecTAG length = macsec_eth_header without the optional SCI */
30#define MACSEC_TAG_LEN 6
31
32struct macsec_eth_header {
33 struct ethhdr eth;
34 /* SecTAG */
35 u8 tci_an;
36#if defined(__LITTLE_ENDIAN_BITFIELD)
37 u8 short_length:6,
38 unused:2;
39#elif defined(__BIG_ENDIAN_BITFIELD)
40 u8 unused:2,
41 short_length:6;
42#else
43#error "Please fix <asm/byteorder.h>"
44#endif
45 __be32 packet_number;
46 u8 secure_channel_id[8]; /* optional */
47} __packed;
48
49#define MACSEC_TCI_VERSION 0x80
50#define MACSEC_TCI_ES 0x40 /* end station */
51#define MACSEC_TCI_SC 0x20 /* SCI present */
52#define MACSEC_TCI_SCB 0x10 /* epon */
53#define MACSEC_TCI_E 0x08 /* encryption */
54#define MACSEC_TCI_C 0x04 /* changed text */
55#define MACSEC_AN_MASK 0x03 /* association number */
56#define MACSEC_TCI_CONFID (MACSEC_TCI_E | MACSEC_TCI_C)
57
58/* minimum secure data length deemed "not short", see IEEE 802.1AE-2006 9.7 */
59#define MIN_NON_SHORT_LEN 48
60
61#define GCM_AES_IV_LEN 12
62#define DEFAULT_ICV_LEN 16
63
7979472b 64#define for_each_rxsc(secy, sc) \
c09440f7 65 for (sc = rcu_dereference_bh(secy->rx_sc); \
7979472b 66 sc; \
c09440f7
SD		 67 sc = rcu_dereference_bh(sc->next))
68#define for_each_rxsc_rtnl(secy, sc) \
69 for (sc = rtnl_dereference(secy->rx_sc); \
70 sc; \
71 sc = rtnl_dereference(sc->next))
72
a21ecf0e
EM		 73#define pn_same_half(pn1, pn2) (!(((pn1) >> 31) ^ ((pn2) >> 31)))
74
75struct gcm_iv_xpn {
76 union {
77 u8 short_secure_channel_id[4];
78 ssci_t ssci;
79 };
80 __be64 pn;
81} __packed;
82
c09440f7
SD		 83struct gcm_iv {
84 union {
85 u8 secure_channel_id[8];
86 sci_t sci;
87 };
88 __be32 pn;
89};
90
c09440f7
SD		 91#define MACSEC_VALIDATE_DEFAULT MACSEC_VALIDATE_STRICT
92
c09440f7
SD		 93struct pcpu_secy_stats {
94 struct macsec_dev_stats stats;
95 struct u64_stats_sync syncp;
96};
97
98/**
99 * struct macsec_dev - private data
100 * @secy: SecY config
101 * @real_dev: pointer to underlying netdevice
102 * @stats: MACsec device stats
103 * @secys: linked list of SecY's on the underlying device
ecdc5689 104 * @gro_cells: pointer to the Generic Receive Offload cell
3cf3227a 105 * @offload: status of offloading on the MACsec device
c09440f7
SD		 106 */
107struct macsec_dev {
108 struct macsec_secy secy;
109 struct net_device *real_dev;
110 struct pcpu_secy_stats __percpu *stats;
111 struct list_head secys;
5491e7c6 112 struct gro_cells gro_cells;
3cf3227a 113 enum macsec_offload offload;
c09440f7
SD		 114};
115
116/**
117 * struct macsec_rxh_data - rx_handler private argument
118 * @secys: linked list of SecY's on this underlying device
119 */
120struct macsec_rxh_data {
121 struct list_head secys;
122};
123
124static struct macsec_dev *macsec_priv(const struct net_device *dev)
125{
126 return (struct macsec_dev *)netdev_priv(dev);
127}
128
129static struct macsec_rxh_data *macsec_data_rcu(const struct net_device *dev)
130{
131 return rcu_dereference_bh(dev->rx_handler_data);
132}
133
134static struct macsec_rxh_data *macsec_data_rtnl(const struct net_device *dev)
135{
136 return rtnl_dereference(dev->rx_handler_data);
137}
138
139struct macsec_cb {
140 struct aead_request *req;
141 union {
142 struct macsec_tx_sa *tx_sa;
143 struct macsec_rx_sa *rx_sa;
144 };
145 u8 assoc_num;
146 bool valid;
147 bool has_sci;
148};
149
150static struct macsec_rx_sa *macsec_rxsa_get(struct macsec_rx_sa __rcu *ptr)
151{
152 struct macsec_rx_sa *sa = rcu_dereference_bh(ptr);
153
154 if (!sa || !sa->active)
155 return NULL;
156
e187246f 157 if (!refcount_inc_not_zero(&sa->refcnt))
c09440f7
SD		 158 return NULL;
159
160 return sa;
161}
162
163static void free_rx_sc_rcu(struct rcu_head *head)
164{
165 struct macsec_rx_sc *rx_sc = container_of(head, struct macsec_rx_sc, rcu_head);
166
167 free_percpu(rx_sc->stats);
168 kfree(rx_sc);
169}
170
171static struct macsec_rx_sc *macsec_rxsc_get(struct macsec_rx_sc *sc)
172{
8676d76f 173 return refcount_inc_not_zero(&sc->refcnt) ? sc : NULL;
c09440f7
SD		 174}
175
176static void macsec_rxsc_put(struct macsec_rx_sc *sc)
177{
8676d76f 178 if (refcount_dec_and_test(&sc->refcnt))
c09440f7
SD		 179 call_rcu(&sc->rcu_head, free_rx_sc_rcu);
180}
181
182static void free_rxsa(struct rcu_head *head)
183{
184 struct macsec_rx_sa *sa = container_of(head, struct macsec_rx_sa, rcu);
185
186 crypto_free_aead(sa->key.tfm);
187 free_percpu(sa->stats);
c09440f7
SD		 188 kfree(sa);
189}
190
191static void macsec_rxsa_put(struct macsec_rx_sa *sa)
192{
e187246f 193 if (refcount_dec_and_test(&sa->refcnt))
c09440f7
SD		 194 call_rcu(&sa->rcu, free_rxsa);
195}
196
197static struct macsec_tx_sa *macsec_txsa_get(struct macsec_tx_sa __rcu *ptr)
198{
199 struct macsec_tx_sa *sa = rcu_dereference_bh(ptr);
200
201 if (!sa || !sa->active)
202 return NULL;
203
28206cdb 204 if (!refcount_inc_not_zero(&sa->refcnt))
c09440f7
SD		 205 return NULL;
206
207 return sa;
208}
209
210static void free_txsa(struct rcu_head *head)
211{
212 struct macsec_tx_sa *sa = container_of(head, struct macsec_tx_sa, rcu);
213
214 crypto_free_aead(sa->key.tfm);
215 free_percpu(sa->stats);
216 kfree(sa);
217}
218
219static void macsec_txsa_put(struct macsec_tx_sa *sa)
220{
28206cdb 221 if (refcount_dec_and_test(&sa->refcnt))
c09440f7
SD		 222 call_rcu(&sa->rcu, free_txsa);
223}
224
225static struct macsec_cb *macsec_skb_cb(struct sk_buff *skb)
226{
227 BUILD_BUG_ON(sizeof(struct macsec_cb) > sizeof(skb->cb));
228 return (struct macsec_cb *)skb->cb;
229}
230
231#define MACSEC_PORT_ES (htons(0x0001))
232#define MACSEC_PORT_SCB (0x0000)
233#define MACSEC_UNDEF_SCI ((__force sci_t)0xffffffffffffffffULL)
48ef50fa 234#define MACSEC_UNDEF_SSCI ((__force ssci_t)0xffffffff)
c09440f7 235
ccfdec90
FW		 236#define MACSEC_GCM_AES_128_SAK_LEN 16
237#define MACSEC_GCM_AES_256_SAK_LEN 32
238
ccfdec90 239#define DEFAULT_SAK_LEN MACSEC_GCM_AES_128_SAK_LEN
48ef50fa 240#define DEFAULT_XPN false
c09440f7
SD		 241#define DEFAULT_SEND_SCI true
242#define DEFAULT_ENCRYPT false
243#define DEFAULT_ENCODING_SA 0
0b52e10a 244#define MACSEC_XPN_MAX_REPLAY_WINDOW (((1 << 30) - 1))
c09440f7 245
e0f841f5
TB		 246static bool send_sci(const struct macsec_secy *secy)
247{
248 const struct macsec_tx_sc *tx_sc = &secy->tx_sc;
249
250 return tx_sc->send_sci ||
251 (secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb);
252}
253
c09440f7
SD		 254static sci_t make_sci(u8 *addr, __be16 port)
255{
256 sci_t sci;
257
258 memcpy(&sci, addr, ETH_ALEN);
259 memcpy(((char *)&sci) + ETH_ALEN, &port, sizeof(port));
260
261 return sci;
262}
263
264static sci_t macsec_frame_sci(struct macsec_eth_header *hdr, bool sci_present)
265{
266 sci_t sci;
267
268 if (sci_present)
269 memcpy(&sci, hdr->secure_channel_id,
270 sizeof(hdr->secure_channel_id));
271 else
272 sci = make_sci(hdr->eth.h_source, MACSEC_PORT_ES);
273
274 return sci;
275}
276
277static unsigned int macsec_sectag_len(bool sci_present)
278{
279 return MACSEC_TAG_LEN + (sci_present ? MACSEC_SCI_LEN : 0);
280}
281
282static unsigned int macsec_hdr_len(bool sci_present)
283{
284 return macsec_sectag_len(sci_present) + ETH_HLEN;
285}
286
287static unsigned int macsec_extra_len(bool sci_present)
288{
289 return macsec_sectag_len(sci_present) + sizeof(__be16);
290}
291
292/* Fill SecTAG according to IEEE 802.1AE-2006 10.5.3 */
293static void macsec_fill_sectag(struct macsec_eth_header *h,
e0f841f5
TB		 294 const struct macsec_secy *secy, u32 pn,
295 bool sci_present)
c09440f7
SD		 296{
297 const struct macsec_tx_sc *tx_sc = &secy->tx_sc;
298
e0f841f5 299 memset(&h->tci_an, 0, macsec_sectag_len(sci_present));
c09440f7
SD		 300 h->eth.h_proto = htons(ETH_P_MACSEC);
301
e0f841f5 302 if (sci_present) {
c09440f7
SD		 303 h->tci_an |= MACSEC_TCI_SC;
304 memcpy(&h->secure_channel_id, &secy->sci,
305 sizeof(h->secure_channel_id));
306 } else {
307 if (tx_sc->end_station)
308 h->tci_an |= MACSEC_TCI_ES;
309 if (tx_sc->scb)
310 h->tci_an |= MACSEC_TCI_SCB;
311 }
312
313 h->packet_number = htonl(pn);
314
315 /* with GCM, C/E clear for !encrypt, both set for encrypt */
316 if (tx_sc->encrypt)
317 h->tci_an |= MACSEC_TCI_CONFID;
318 else if (secy->icv_len != DEFAULT_ICV_LEN)
319 h->tci_an |= MACSEC_TCI_C;
320
321 h->tci_an |= tx_sc->encoding_sa;
322}
323
324static void macsec_set_shortlen(struct macsec_eth_header *h, size_t data_len)
325{
326 if (data_len < MIN_NON_SHORT_LEN)
327 h->short_length = data_len;
328}
329
3cf3227a
AT		 330/* Checks if a MACsec interface is being offloaded to an hardware engine */
331static bool macsec_is_offloaded(struct macsec_dev *macsec)
332{
21114b7f
AT		 333 if (macsec->offload == MACSEC_OFFLOAD_MAC ||
334 macsec->offload == MACSEC_OFFLOAD_PHY)
3cf3227a
AT		 335 return true;
336
337 return false;
338}
339
340/* Checks if underlying layers implement MACsec offloading functions. */
341static bool macsec_check_offload(enum macsec_offload offload,
342 struct macsec_dev *macsec)
343{
344 if (!macsec || !macsec->real_dev)
345 return false;
346
347 if (offload == MACSEC_OFFLOAD_PHY)
348 return macsec->real_dev->phydev &&
349 macsec->real_dev->phydev->macsec_ops;
21114b7f
AT		 350 else if (offload == MACSEC_OFFLOAD_MAC)
351 return macsec->real_dev->features & NETIF_F_HW_MACSEC &&
352 macsec->real_dev->macsec_ops;
3cf3227a
AT		 353
354 return false;
355}
356
357static const struct macsec_ops *__macsec_get_ops(enum macsec_offload offload,
358 struct macsec_dev *macsec,
359 struct macsec_context *ctx)
360{
361 if (ctx) {
362 memset(ctx, 0, sizeof(*ctx));
363 ctx->offload = offload;
364
365 if (offload == MACSEC_OFFLOAD_PHY)
366 ctx->phydev = macsec->real_dev->phydev;
21114b7f
AT		 367 else if (offload == MACSEC_OFFLOAD_MAC)
368 ctx->netdev = macsec->real_dev;
3cf3227a
AT		 369 }
370
21114b7f
AT		 371 if (offload == MACSEC_OFFLOAD_PHY)
372 return macsec->real_dev->phydev->macsec_ops;
373 else
374 return macsec->real_dev->macsec_ops;
3cf3227a
AT		 375}
376
377/* Returns a pointer to the MACsec ops struct if any and updates the MACsec
378 * context device reference if provided.
379 */
380static const struct macsec_ops *macsec_get_ops(struct macsec_dev *macsec,
381 struct macsec_context *ctx)
382{
383 if (!macsec_check_offload(macsec->offload, macsec))
384 return NULL;
385
386 return __macsec_get_ops(macsec->offload, macsec, ctx);
387}
388
a21ecf0e
EM		 389/* validate MACsec packet according to IEEE 802.1AE-2018 9.12 */
390static bool macsec_validate_skb(struct sk_buff *skb, u16 icv_len, bool xpn)
c09440f7
SD		 391{
392 struct macsec_eth_header *h = (struct macsec_eth_header *)skb->data;
393 int len = skb->len - 2 * ETH_ALEN;
394 int extra_len = macsec_extra_len(!!(h->tci_an & MACSEC_TCI_SC)) + icv_len;
395
396 /* a) It comprises at least 17 octets */
397 if (skb->len <= 16)
398 return false;
399
400 /* b) MACsec EtherType: already checked */
401
402 /* c) V bit is clear */
403 if (h->tci_an & MACSEC_TCI_VERSION)
404 return false;
405
406 /* d) ES or SCB => !SC */
407 if ((h->tci_an & MACSEC_TCI_ES || h->tci_an & MACSEC_TCI_SCB) &&
408 (h->tci_an & MACSEC_TCI_SC))
409 return false;
410
411 /* e) Bits 7 and 8 of octet 4 of the SecTAG are clear */
412 if (h->unused)
413 return false;
414
a21ecf0e
EM		 415 /* rx.pn != 0 if not XPN (figure 10-5 with 802.11AEbw-2013 amendment) */
416 if (!h->packet_number && !xpn)
c09440f7
SD		 417 return false;
418
419 /* length check, f) g) h) i) */
420 if (h->short_length)
421 return len == extra_len + h->short_length;
422 return len >= extra_len + MIN_NON_SHORT_LEN;
423}
424
425#define MACSEC_NEEDED_HEADROOM (macsec_extra_len(true))
2ccbe2cb 426#define MACSEC_NEEDED_TAILROOM MACSEC_STD_ICV_LEN
c09440f7 427
a21ecf0e
EM		 428static void macsec_fill_iv_xpn(unsigned char *iv, ssci_t ssci, u64 pn,
429 salt_t salt)
430{
431 struct gcm_iv_xpn *gcm_iv = (struct gcm_iv_xpn *)iv;
432
433 gcm_iv->ssci = ssci ^ salt.ssci;
434 gcm_iv->pn = cpu_to_be64(pn) ^ salt.pn;
435}
436
c09440f7
SD		 437static void macsec_fill_iv(unsigned char *iv, sci_t sci, u32 pn)
438{
439 struct gcm_iv *gcm_iv = (struct gcm_iv *)iv;
440
441 gcm_iv->sci = sci;
442 gcm_iv->pn = htonl(pn);
443}
444
445static struct macsec_eth_header *macsec_ethhdr(struct sk_buff *skb)
446{
447 return (struct macsec_eth_header *)skb_mac_header(skb);
448}
449
6fc498bc
DB		 450static sci_t dev_to_sci(struct net_device *dev, __be16 port)
451{
452 return make_sci(dev->dev_addr, port);
453}
454
5c937de7
AT		 455static void __macsec_pn_wrapped(struct macsec_secy *secy,
456 struct macsec_tx_sa *tx_sa)
457{
458 pr_debug("PN wrapped, transitioning to !oper\n");
459 tx_sa->active = false;
460 if (secy->protect_frames)
461 secy->operational = false;
462}
463
464void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa)
465{
466 spin_lock_bh(&tx_sa->lock);
467 __macsec_pn_wrapped(secy, tx_sa);
468 spin_unlock_bh(&tx_sa->lock);
469}
470EXPORT_SYMBOL_GPL(macsec_pn_wrapped);
471
a21ecf0e
EM		 472static pn_t tx_sa_update_pn(struct macsec_tx_sa *tx_sa,
473 struct macsec_secy *secy)
c09440f7 474{
a21ecf0e 475 pn_t pn;
c09440f7
SD		 476
477 spin_lock_bh(&tx_sa->lock);
c09440f7 478
a21ecf0e
EM		 479 pn = tx_sa->next_pn_halves;
480 if (secy->xpn)
481 tx_sa->next_pn++;
482 else
483 tx_sa->next_pn_halves.lower++;
484
5c937de7
AT		 485 if (tx_sa->next_pn == 0)
486 __macsec_pn_wrapped(secy, tx_sa);
c09440f7
SD		 487 spin_unlock_bh(&tx_sa->lock);
488
489 return pn;
490}
491
492static void macsec_encrypt_finish(struct sk_buff *skb, struct net_device *dev)
493{
494 struct macsec_dev *macsec = netdev_priv(dev);
495
496 skb->dev = macsec->real_dev;
497 skb_reset_mac_header(skb);
498 skb->protocol = eth_hdr(skb)->h_proto;
499}
500
501static void macsec_count_tx(struct sk_buff *skb, struct macsec_tx_sc *tx_sc,
502 struct macsec_tx_sa *tx_sa)
503{
504 struct pcpu_tx_sc_stats *txsc_stats = this_cpu_ptr(tx_sc->stats);
505
506 u64_stats_update_begin(&txsc_stats->syncp);
507 if (tx_sc->encrypt) {
508 txsc_stats->stats.OutOctetsEncrypted += skb->len;
509 txsc_stats->stats.OutPktsEncrypted++;
510 this_cpu_inc(tx_sa->stats->OutPktsEncrypted);
511 } else {
512 txsc_stats->stats.OutOctetsProtected += skb->len;
513 txsc_stats->stats.OutPktsProtected++;
514 this_cpu_inc(tx_sa->stats->OutPktsProtected);
515 }
516 u64_stats_update_end(&txsc_stats->syncp);
517}
518
519static void count_tx(struct net_device *dev, int ret, int len)
520{
521 if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
522 struct pcpu_sw_netstats *stats = this_cpu_ptr(dev->tstats);
523
524 u64_stats_update_begin(&stats->syncp);
525 stats->tx_packets++;
526 stats->tx_bytes += len;
527 u64_stats_update_end(&stats->syncp);
c09440f7
SD		 528 }
529}
530
531static void macsec_encrypt_done(struct crypto_async_request *base, int err)
532{
533 struct sk_buff *skb = base->data;
534 struct net_device *dev = skb->dev;
535 struct macsec_dev *macsec = macsec_priv(dev);
536 struct macsec_tx_sa *sa = macsec_skb_cb(skb)->tx_sa;
537 int len, ret;
538
539 aead_request_free(macsec_skb_cb(skb)->req);
540
541 rcu_read_lock_bh();
542 macsec_encrypt_finish(skb, dev);
543 macsec_count_tx(skb, &macsec->secy.tx_sc, macsec_skb_cb(skb)->tx_sa);
544 len = skb->len;
545 ret = dev_queue_xmit(skb);
546 count_tx(dev, ret, len);
547 rcu_read_unlock_bh();
548
549 macsec_txsa_put(sa);
550 dev_put(dev);
551}
552
5d9649b3
SD		 553static struct aead_request *macsec_alloc_req(struct crypto_aead *tfm,
554 unsigned char **iv,
5294b830
JD		 555 struct scatterlist **sg,
556 int num_frags)
5d9649b3
SD		 557{
558 size_t size, iv_offset, sg_offset;
559 struct aead_request *req;
560 void *tmp;
561
562 size = sizeof(struct aead_request) + crypto_aead_reqsize(tfm);
563 iv_offset = size;
564 size += GCM_AES_IV_LEN;
565
566 size = ALIGN(size, __alignof__(struct scatterlist));
567 sg_offset = size;
5294b830 568 size += sizeof(struct scatterlist) * num_frags;
5d9649b3
SD		 569
570 tmp = kmalloc(size, GFP_ATOMIC);
571 if (!tmp)
572 return NULL;
573
574 *iv = (unsigned char *)(tmp + iv_offset);
575 *sg = (struct scatterlist *)(tmp + sg_offset);
576 req = tmp;
577
578 aead_request_set_tfm(req, tfm);
579
580 return req;
581}
582
c09440f7
SD		 583static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
584 struct net_device *dev)
585{
586 int ret;
5d9649b3 587 struct scatterlist *sg;
5294b830 588 struct sk_buff *trailer;
5d9649b3 589 unsigned char *iv;
c09440f7
SD		 590 struct ethhdr *eth;
591 struct macsec_eth_header *hh;
592 size_t unprotected_len;
593 struct aead_request *req;
594 struct macsec_secy *secy;
595 struct macsec_tx_sc *tx_sc;
596 struct macsec_tx_sa *tx_sa;
597 struct macsec_dev *macsec = macsec_priv(dev);
e0f841f5 598 bool sci_present;
a21ecf0e 599 pn_t pn;
c09440f7
SD		 600
601 secy = &macsec->secy;
602 tx_sc = &secy->tx_sc;
603
604 /* 10.5.1 TX SA assignment */
605 tx_sa = macsec_txsa_get(tx_sc->sa[tx_sc->encoding_sa]);
606 if (!tx_sa) {
607 secy->operational = false;
608 kfree_skb(skb);
609 return ERR_PTR(-EINVAL);
610 }
611
612 if (unlikely(skb_headroom(skb) < MACSEC_NEEDED_HEADROOM ||
613 skb_tailroom(skb) < MACSEC_NEEDED_TAILROOM)) {
614 struct sk_buff *nskb = skb_copy_expand(skb,
615 MACSEC_NEEDED_HEADROOM,
616 MACSEC_NEEDED_TAILROOM,
617 GFP_ATOMIC);
618 if (likely(nskb)) {
619 consume_skb(skb);
620 skb = nskb;
621 } else {
622 macsec_txsa_put(tx_sa);
623 kfree_skb(skb);
624 return ERR_PTR(-ENOMEM);
625 }
626 } else {
627 skb = skb_unshare(skb, GFP_ATOMIC);
628 if (!skb) {
629 macsec_txsa_put(tx_sa);
630 return ERR_PTR(-ENOMEM);
631 }
632 }
633
634 unprotected_len = skb->len;
635 eth = eth_hdr(skb);
e0f841f5 636 sci_present = send_sci(secy);
d58ff351 637 hh = skb_push(skb, macsec_extra_len(sci_present));
c09440f7
SD		 638 memmove(hh, eth, 2 * ETH_ALEN);
639
640 pn = tx_sa_update_pn(tx_sa, secy);
a21ecf0e 641 if (pn.full64 == 0) {
c09440f7
SD		 642 macsec_txsa_put(tx_sa);
643 kfree_skb(skb);
644 return ERR_PTR(-ENOLINK);
645 }
a21ecf0e 646 macsec_fill_sectag(hh, secy, pn.lower, sci_present);
c09440f7
SD		 647 macsec_set_shortlen(hh, unprotected_len - 2 * ETH_ALEN);
648
c09440f7
SD		 649 skb_put(skb, secy->icv_len);
650
651 if (skb->len - ETH_HLEN > macsec_priv(dev)->real_dev->mtu) {
652 struct pcpu_secy_stats *secy_stats = this_cpu_ptr(macsec->stats);
653
654 u64_stats_update_begin(&secy_stats->syncp);
655 secy_stats->stats.OutPktsTooLong++;
656 u64_stats_update_end(&secy_stats->syncp);
657
658 macsec_txsa_put(tx_sa);
659 kfree_skb(skb);
660 return ERR_PTR(-EINVAL);
661 }
662
5294b830
JD		 663 ret = skb_cow_data(skb, 0, &trailer);
664 if (unlikely(ret < 0)) {
665 macsec_txsa_put(tx_sa);
666 kfree_skb(skb);
667 return ERR_PTR(ret);
668 }
669
670 req = macsec_alloc_req(tx_sa->key.tfm, &iv, &sg, ret);
c09440f7
SD		 671 if (!req) {
672 macsec_txsa_put(tx_sa);
673 kfree_skb(skb);
674 return ERR_PTR(-ENOMEM);
675 }
676
a21ecf0e
EM		 677 if (secy->xpn)
678 macsec_fill_iv_xpn(iv, tx_sa->ssci, pn.full64, tx_sa->key.salt);
679 else
680 macsec_fill_iv(iv, secy->sci, pn.lower);
5d9649b3 681
5294b830 682 sg_init_table(sg, ret);
cda7ea69
JD		 683 ret = skb_to_sgvec(skb, sg, 0, skb->len);
684 if (unlikely(ret < 0)) {
5aba2ba5 685 aead_request_free(req);
cda7ea69
JD		 686 macsec_txsa_put(tx_sa);
687 kfree_skb(skb);
688 return ERR_PTR(ret);
689 }
c09440f7
SD		 690
691 if (tx_sc->encrypt) {
e0f841f5 692 int len = skb->len - macsec_hdr_len(sci_present) -
c09440f7
SD		 693 secy->icv_len;
694 aead_request_set_crypt(req, sg, sg, len, iv);
e0f841f5 695 aead_request_set_ad(req, macsec_hdr_len(sci_present));
c09440f7
SD		 696 } else {
697 aead_request_set_crypt(req, sg, sg, 0, iv);
698 aead_request_set_ad(req, skb->len - secy->icv_len);
699 }
700
701 macsec_skb_cb(skb)->req = req;
702 macsec_skb_cb(skb)->tx_sa = tx_sa;
703 aead_request_set_callback(req, 0, macsec_encrypt_done, skb);
704
705 dev_hold(skb->dev);
706 ret = crypto_aead_encrypt(req);
707 if (ret == -EINPROGRESS) {
708 return ERR_PTR(ret);
709 } else if (ret != 0) {
710 dev_put(skb->dev);
711 kfree_skb(skb);
712 aead_request_free(req);
713 macsec_txsa_put(tx_sa);
714 return ERR_PTR(-EINVAL);
715 }
716
717 dev_put(skb->dev);
718 aead_request_free(req);
719 macsec_txsa_put(tx_sa);
720
721 return skb;
722}
723
724static bool macsec_post_decrypt(struct sk_buff *skb, struct macsec_secy *secy, u32 pn)
725{
726 struct macsec_rx_sa *rx_sa = macsec_skb_cb(skb)->rx_sa;
727 struct pcpu_rx_sc_stats *rxsc_stats = this_cpu_ptr(rx_sa->sc->stats);
728 struct macsec_eth_header *hdr = macsec_ethhdr(skb);
729 u32 lowest_pn = 0;
730
731 spin_lock(&rx_sa->lock);
a21ecf0e
EM		 732 if (rx_sa->next_pn_halves.lower >= secy->replay_window)
733 lowest_pn = rx_sa->next_pn_halves.lower - secy->replay_window;
c09440f7
SD		 734
735 /* Now perform replay protection check again
736 * (see IEEE 802.1AE-2006 figure 10-5)
737 */
a21ecf0e
EM		 738 if (secy->replay_protect && pn < lowest_pn &&
739 (!secy->xpn || pn_same_half(pn, lowest_pn))) {
c09440f7
SD		 740 spin_unlock(&rx_sa->lock);
741 u64_stats_update_begin(&rxsc_stats->syncp);
742 rxsc_stats->stats.InPktsLate++;
743 u64_stats_update_end(&rxsc_stats->syncp);
744 return false;
745 }
746
747 if (secy->validate_frames != MACSEC_VALIDATE_DISABLED) {
748 u64_stats_update_begin(&rxsc_stats->syncp);
749 if (hdr->tci_an & MACSEC_TCI_E)
750 rxsc_stats->stats.InOctetsDecrypted += skb->len;
751 else
752 rxsc_stats->stats.InOctetsValidated += skb->len;
753 u64_stats_update_end(&rxsc_stats->syncp);
754 }
755
756 if (!macsec_skb_cb(skb)->valid) {
757 spin_unlock(&rx_sa->lock);
758
759 /* 10.6.5 */
760 if (hdr->tci_an & MACSEC_TCI_C ||
761 secy->validate_frames == MACSEC_VALIDATE_STRICT) {
762 u64_stats_update_begin(&rxsc_stats->syncp);
763 rxsc_stats->stats.InPktsNotValid++;
764 u64_stats_update_end(&rxsc_stats->syncp);
765 return false;
766 }
767
768 u64_stats_update_begin(&rxsc_stats->syncp);
769 if (secy->validate_frames == MACSEC_VALIDATE_CHECK) {
770 rxsc_stats->stats.InPktsInvalid++;
771 this_cpu_inc(rx_sa->stats->InPktsInvalid);
772 } else if (pn < lowest_pn) {
773 rxsc_stats->stats.InPktsDelayed++;
774 } else {
775 rxsc_stats->stats.InPktsUnchecked++;
776 }
777 u64_stats_update_end(&rxsc_stats->syncp);
778 } else {
779 u64_stats_update_begin(&rxsc_stats->syncp);
780 if (pn < lowest_pn) {
781 rxsc_stats->stats.InPktsDelayed++;
782 } else {
783 rxsc_stats->stats.InPktsOK++;
784 this_cpu_inc(rx_sa->stats->InPktsOK);
785 }
786 u64_stats_update_end(&rxsc_stats->syncp);
787
a21ecf0e
EM		 788 // Instead of "pn >=" - to support pn overflow in xpn
789 if (pn + 1 > rx_sa->next_pn_halves.lower) {
790 rx_sa->next_pn_halves.lower = pn + 1;
791 } else if (secy->xpn &&
792 !pn_same_half(pn, rx_sa->next_pn_halves.lower)) {
793 rx_sa->next_pn_halves.upper++;
794 rx_sa->next_pn_halves.lower = pn + 1;
795 }
796
c09440f7
SD		 797 spin_unlock(&rx_sa->lock);
798 }
799
800 return true;
801}
802
803static void macsec_reset_skb(struct sk_buff *skb, struct net_device *dev)
804{
805 skb->pkt_type = PACKET_HOST;
806 skb->protocol = eth_type_trans(skb, dev);
807
808 skb_reset_network_header(skb);
809 if (!skb_transport_header_was_set(skb))
810 skb_reset_transport_header(skb);
811 skb_reset_mac_len(skb);
812}
813
814static void macsec_finalize_skb(struct sk_buff *skb, u8 icv_len, u8 hdr_len)
815{
7d8b16b9 816 skb->ip_summed = CHECKSUM_NONE;
c09440f7
SD		 817 memmove(skb->data + hdr_len, skb->data, 2 * ETH_ALEN);
818 skb_pull(skb, hdr_len);
819 pskb_trim_unique(skb, skb->len - icv_len);
820}
821
822static void count_rx(struct net_device *dev, int len)
823{
824 struct pcpu_sw_netstats *stats = this_cpu_ptr(dev->tstats);
825
826 u64_stats_update_begin(&stats->syncp);
827 stats->rx_packets++;
828 stats->rx_bytes += len;
829 u64_stats_update_end(&stats->syncp);
830}
831
832static void macsec_decrypt_done(struct crypto_async_request *base, int err)
833{
834 struct sk_buff *skb = base->data;
835 struct net_device *dev = skb->dev;
836 struct macsec_dev *macsec = macsec_priv(dev);
837 struct macsec_rx_sa *rx_sa = macsec_skb_cb(skb)->rx_sa;
c78ebe1d 838 struct macsec_rx_sc *rx_sc = rx_sa->sc;
863483c9 839 int len;
c09440f7
SD		 840 u32 pn;
841
842 aead_request_free(macsec_skb_cb(skb)->req);
843
b3bdc3ac
LR		 844 if (!err)
845 macsec_skb_cb(skb)->valid = true;
846
c09440f7
SD		 847 rcu_read_lock_bh();
848 pn = ntohl(macsec_ethhdr(skb)->packet_number);
849 if (!macsec_post_decrypt(skb, &macsec->secy, pn)) {
850 rcu_read_unlock_bh();
851 kfree_skb(skb);
852 goto out;
853 }
854
855 macsec_finalize_skb(skb, macsec->secy.icv_len,
856 macsec_extra_len(macsec_skb_cb(skb)->has_sci));
857 macsec_reset_skb(skb, macsec->secy.netdev);
858
859 len = skb->len;
863483c9 860 if (gro_cells_receive(&macsec->gro_cells, skb) == NET_RX_SUCCESS)
c09440f7 861 count_rx(dev, len);
c09440f7
SD		 862
863 rcu_read_unlock_bh();
864
865out:
866 macsec_rxsa_put(rx_sa);
c78ebe1d 867 macsec_rxsc_put(rx_sc);
c09440f7 868 dev_put(dev);
c09440f7
SD		 869}
870
871static struct sk_buff *macsec_decrypt(struct sk_buff *skb,
872 struct net_device *dev,
873 struct macsec_rx_sa *rx_sa,
874 sci_t sci,
875 struct macsec_secy *secy)
876{
877 int ret;
5d9649b3 878 struct scatterlist *sg;
5294b830 879 struct sk_buff *trailer;
5d9649b3 880 unsigned char *iv;
c09440f7
SD		 881 struct aead_request *req;
882 struct macsec_eth_header *hdr;
a21ecf0e 883 u32 hdr_pn;
c09440f7
SD		 884 u16 icv_len = secy->icv_len;
885
886 macsec_skb_cb(skb)->valid = false;
887 skb = skb_share_check(skb, GFP_ATOMIC);
888 if (!skb)
c3b7d0bd 889 return ERR_PTR(-ENOMEM);
c09440f7 890
5294b830
JD		 891 ret = skb_cow_data(skb, 0, &trailer);
892 if (unlikely(ret < 0)) {
893 kfree_skb(skb);
894 return ERR_PTR(ret);
895 }
896 req = macsec_alloc_req(rx_sa->key.tfm, &iv, &sg, ret);
c09440f7
SD		 897 if (!req) {
898 kfree_skb(skb);
c3b7d0bd 899 return ERR_PTR(-ENOMEM);
c09440f7
SD		 900 }
901
902 hdr = (struct macsec_eth_header *)skb->data;
a21ecf0e
EM		 903 hdr_pn = ntohl(hdr->packet_number);
904
905 if (secy->xpn) {
906 pn_t recovered_pn = rx_sa->next_pn_halves;
907
908 recovered_pn.lower = hdr_pn;
909 if (hdr_pn < rx_sa->next_pn_halves.lower &&
910 !pn_same_half(hdr_pn, rx_sa->next_pn_halves.lower))
911 recovered_pn.upper++;
912
913 macsec_fill_iv_xpn(iv, rx_sa->ssci, recovered_pn.full64,
914 rx_sa->key.salt);
915 } else {
916 macsec_fill_iv(iv, sci, hdr_pn);
917 }
c09440f7 918
5294b830 919 sg_init_table(sg, ret);
cda7ea69
JD		 920 ret = skb_to_sgvec(skb, sg, 0, skb->len);
921 if (unlikely(ret < 0)) {
5aba2ba5 922 aead_request_free(req);
cda7ea69
JD		 923 kfree_skb(skb);
924 return ERR_PTR(ret);
925 }
c09440f7
SD		 926
927 if (hdr->tci_an & MACSEC_TCI_E) {
928 /* confidentiality: ethernet + macsec header
929 * authenticated, encrypted payload
930 */
931 int len = skb->len - macsec_hdr_len(macsec_skb_cb(skb)->has_sci);
932
933 aead_request_set_crypt(req, sg, sg, len, iv);
934 aead_request_set_ad(req, macsec_hdr_len(macsec_skb_cb(skb)->has_sci));
935 skb = skb_unshare(skb, GFP_ATOMIC);
936 if (!skb) {
937 aead_request_free(req);
c3b7d0bd 938 return ERR_PTR(-ENOMEM);
c09440f7
SD		 939 }
940 } else {
941 /* integrity only: all headers + data authenticated */
942 aead_request_set_crypt(req, sg, sg, icv_len, iv);
943 aead_request_set_ad(req, skb->len - icv_len);
944 }
945
946 macsec_skb_cb(skb)->req = req;
c09440f7
SD		 947 skb->dev = dev;
948 aead_request_set_callback(req, 0, macsec_decrypt_done, skb);
949
950 dev_hold(dev);
951 ret = crypto_aead_decrypt(req);
952 if (ret == -EINPROGRESS) {
c3b7d0bd 953 return ERR_PTR(ret);
c09440f7
SD		 954 } else if (ret != 0) {
955 /* decryption/authentication failed
956 * 10.6 if validateFrames is disabled, deliver anyway
957 */
958 if (ret != -EBADMSG) {
959 kfree_skb(skb);
c3b7d0bd 960 skb = ERR_PTR(ret);
c09440f7
SD		 961 }
962 } else {
963 macsec_skb_cb(skb)->valid = true;
964 }
965 dev_put(dev);
966
967 aead_request_free(req);
968
969 return skb;
970}
971
972static struct macsec_rx_sc *find_rx_sc(struct macsec_secy *secy, sci_t sci)
973{
974 struct macsec_rx_sc *rx_sc;
975
976 for_each_rxsc(secy, rx_sc) {
977 if (rx_sc->sci == sci)
978 return rx_sc;
979 }
980
981 return NULL;
982}
983
984static struct macsec_rx_sc *find_rx_sc_rtnl(struct macsec_secy *secy, sci_t sci)
985{
986 struct macsec_rx_sc *rx_sc;
987
988 for_each_rxsc_rtnl(secy, rx_sc) {
989 if (rx_sc->sci == sci)
990 return rx_sc;
991 }
992
993 return NULL;
994}
995
3cf3227a 996static enum rx_handler_result handle_not_macsec(struct sk_buff *skb)
c09440f7 997{
3cf3227a
AT		 998 /* Deliver to the uncontrolled port by default */
999 enum rx_handler_result ret = RX_HANDLER_PASS;
f428011b 1000 struct ethhdr *hdr = eth_hdr(skb);
c09440f7
SD		 1001 struct macsec_rxh_data *rxd;
1002 struct macsec_dev *macsec;
1003
1004 rcu_read_lock();
1005 rxd = macsec_data_rcu(skb->dev);
1006
c09440f7
SD		 1007 list_for_each_entry_rcu(macsec, &rxd->secys, secys) {
1008 struct sk_buff *nskb;
c09440f7 1009 struct pcpu_secy_stats *secy_stats = this_cpu_ptr(macsec->stats);
f428011b
MS		 1010 struct net_device *ndev = macsec->secy.netdev;
1011
1012 /* If h/w offloading is enabled, HW decodes frames and strips
1013 * the SecTAG, so we have to deduce which port to deliver to.
1014 */
1015 if (macsec_is_offloaded(macsec) && netif_running(ndev)) {
1016 if (ether_addr_equal_64bits(hdr->h_dest,
1017 ndev->dev_addr)) {
1018 /* exact match, divert skb to this port */
1019 skb->dev = ndev;
1020 skb->pkt_type = PACKET_HOST;
1021 ret = RX_HANDLER_ANOTHER;
1022 goto out;
1023 } else if (is_multicast_ether_addr_64bits(
1024 hdr->h_dest)) {
1025 /* multicast frame, deliver on this port too */
1026 nskb = skb_clone(skb, GFP_ATOMIC);
1027 if (!nskb)
1028 break;
1029
1030 nskb->dev = ndev;
1031 if (ether_addr_equal_64bits(hdr->h_dest,
1032 ndev->broadcast))
1033 nskb->pkt_type = PACKET_BROADCAST;
1034 else
1035 nskb->pkt_type = PACKET_MULTICAST;
1036
1037 netif_rx(nskb);
1038 }
1039 continue;
1040 }
c09440f7 1041
f428011b
MS		 1042 /* 10.6 If the management control validateFrames is not
1043 * Strict, frames without a SecTAG are received, counted, and
1044 * delivered to the Controlled Port
1045 */
1046 if (macsec->secy.validate_frames == MACSEC_VALIDATE_STRICT) {
c09440f7
SD		 1047 u64_stats_update_begin(&secy_stats->syncp);
1048 secy_stats->stats.InPktsNoTag++;
1049 u64_stats_update_end(&secy_stats->syncp);
1050 continue;
1051 }
1052
1053 /* deliver on this port */
1054 nskb = skb_clone(skb, GFP_ATOMIC);
1055 if (!nskb)
1056 break;
1057
f428011b 1058 nskb->dev = ndev;
c09440f7 1059
863483c9 1060 if (netif_rx(nskb) == NET_RX_SUCCESS) {
c09440f7
SD		 1061 u64_stats_update_begin(&secy_stats->syncp);
1062 secy_stats->stats.InPktsUntagged++;
1063 u64_stats_update_end(&secy_stats->syncp);
c09440f7
SD		 1064 }
1065 }
1066
3cf3227a 1067out:
c09440f7 1068 rcu_read_unlock();
3cf3227a 1069 return ret;
c09440f7
SD		 1070}
1071
1072static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
1073{
1074 struct sk_buff *skb = *pskb;
1075 struct net_device *dev = skb->dev;
1076 struct macsec_eth_header *hdr;
1077 struct macsec_secy *secy = NULL;
1078 struct macsec_rx_sc *rx_sc;
1079 struct macsec_rx_sa *rx_sa;
1080 struct macsec_rxh_data *rxd;
1081 struct macsec_dev *macsec;
c7cc9200 1082 unsigned int len;
c09440f7 1083 sci_t sci;
a21ecf0e 1084 u32 hdr_pn;
c09440f7
SD		 1085 bool cbit;
1086 struct pcpu_rx_sc_stats *rxsc_stats;
1087 struct pcpu_secy_stats *secy_stats;
1088 bool pulled_sci;
5491e7c6 1089 int ret;
c09440f7
SD		 1090
1091 if (skb_headroom(skb) < ETH_HLEN)
1092 goto drop_direct;
1093
1094 hdr = macsec_ethhdr(skb);
3cf3227a
AT		 1095 if (hdr->eth.h_proto != htons(ETH_P_MACSEC))
1096 return handle_not_macsec(skb);
c09440f7
SD		 1097
1098 skb = skb_unshare(skb, GFP_ATOMIC);
095c02da
AS		 1099 *pskb = skb;
1100 if (!skb)
c09440f7 1101 return RX_HANDLER_CONSUMED;
c09440f7
SD		 1102
1103 pulled_sci = pskb_may_pull(skb, macsec_extra_len(true));
1104 if (!pulled_sci) {
1105 if (!pskb_may_pull(skb, macsec_extra_len(false)))
1106 goto drop_direct;
1107 }
1108
1109 hdr = macsec_ethhdr(skb);
1110
1111 /* Frames with a SecTAG that has the TCI E bit set but the C
1112 * bit clear are discarded, as this reserved encoding is used
1113 * to identify frames with a SecTAG that are not to be
1114 * delivered to the Controlled Port.
1115 */
1116 if ((hdr->tci_an & (MACSEC_TCI_C | MACSEC_TCI_E)) == MACSEC_TCI_E)
1117 return RX_HANDLER_PASS;
1118
1119 /* now, pull the extra length */
1120 if (hdr->tci_an & MACSEC_TCI_SC) {
1121 if (!pulled_sci)
1122 goto drop_direct;
1123 }
1124
1125 /* ethernet header is part of crypto processing */
1126 skb_push(skb, ETH_HLEN);
1127
1128 macsec_skb_cb(skb)->has_sci = !!(hdr->tci_an & MACSEC_TCI_SC);
1129 macsec_skb_cb(skb)->assoc_num = hdr->tci_an & MACSEC_AN_MASK;
1130 sci = macsec_frame_sci(hdr, macsec_skb_cb(skb)->has_sci);
1131
1132 rcu_read_lock();
1133 rxd = macsec_data_rcu(skb->dev);
1134
1135 list_for_each_entry_rcu(macsec, &rxd->secys, secys) {
1136 struct macsec_rx_sc *sc = find_rx_sc(&macsec->secy, sci);
7979472b 1137
c78ebe1d 1138 sc = sc ? macsec_rxsc_get(sc) : NULL;
c09440f7
SD		 1139
1140 if (sc) {
1141 secy = &macsec->secy;
1142 rx_sc = sc;
1143 break;
1144 }
1145 }
1146
1147 if (!secy)
1148 goto nosci;
1149
1150 dev = secy->netdev;
1151 macsec = macsec_priv(dev);
1152 secy_stats = this_cpu_ptr(macsec->stats);
1153 rxsc_stats = this_cpu_ptr(rx_sc->stats);
1154
a21ecf0e 1155 if (!macsec_validate_skb(skb, secy->icv_len, secy->xpn)) {
c09440f7
SD		 1156 u64_stats_update_begin(&secy_stats->syncp);
1157 secy_stats->stats.InPktsBadTag++;
1158 u64_stats_update_end(&secy_stats->syncp);
1159 goto drop_nosa;
1160 }
1161
1162 rx_sa = macsec_rxsa_get(rx_sc->sa[macsec_skb_cb(skb)->assoc_num]);
1163 if (!rx_sa) {
1164 /* 10.6.1 if the SA is not in use */
1165
1166 /* If validateFrames is Strict or the C bit in the
1167 * SecTAG is set, discard
1168 */
1169 if (hdr->tci_an & MACSEC_TCI_C ||
1170 secy->validate_frames == MACSEC_VALIDATE_STRICT) {
1171 u64_stats_update_begin(&rxsc_stats->syncp);
1172 rxsc_stats->stats.InPktsNotUsingSA++;
1173 u64_stats_update_end(&rxsc_stats->syncp);
1174 goto drop_nosa;
1175 }
1176
1177 /* not Strict, the frame (with the SecTAG and ICV
1178 * removed) is delivered to the Controlled Port.
1179 */
1180 u64_stats_update_begin(&rxsc_stats->syncp);
1181 rxsc_stats->stats.InPktsUnusedSA++;
1182 u64_stats_update_end(&rxsc_stats->syncp);
1183 goto deliver;
1184 }
1185
1186 /* First, PN check to avoid decrypting obviously wrong packets */
a21ecf0e 1187 hdr_pn = ntohl(hdr->packet_number);
c09440f7
SD		 1188 if (secy->replay_protect) {
1189 bool late;
1190
1191 spin_lock(&rx_sa->lock);
a21ecf0e
EM		 1192 late = rx_sa->next_pn_halves.lower >= secy->replay_window &&
1193 hdr_pn < (rx_sa->next_pn_halves.lower - secy->replay_window);
1194
1195 if (secy->xpn)
1196 late = late && pn_same_half(rx_sa->next_pn_halves.lower, hdr_pn);
c09440f7
SD		 1197 spin_unlock(&rx_sa->lock);
1198
1199 if (late) {
1200 u64_stats_update_begin(&rxsc_stats->syncp);
1201 rxsc_stats->stats.InPktsLate++;
1202 u64_stats_update_end(&rxsc_stats->syncp);
1203 goto drop;
1204 }
1205 }
1206
e3a3b626
BG		 1207 macsec_skb_cb(skb)->rx_sa = rx_sa;
1208
c09440f7
SD		 1209 /* Disabled && !changed text => skip validation */
1210 if (hdr->tci_an & MACSEC_TCI_C ||
1211 secy->validate_frames != MACSEC_VALIDATE_DISABLED)
1212 skb = macsec_decrypt(skb, dev, rx_sa, sci, secy);
1213
c3b7d0bd
SD		 1214 if (IS_ERR(skb)) {
1215 /* the decrypt callback needs the reference */
c78ebe1d 1216 if (PTR_ERR(skb) != -EINPROGRESS) {
c3b7d0bd 1217 macsec_rxsa_put(rx_sa);
c78ebe1d
SD		 1218 macsec_rxsc_put(rx_sc);
1219 }
c09440f7
SD		 1220 rcu_read_unlock();
1221 *pskb = NULL;
1222 return RX_HANDLER_CONSUMED;
1223 }
1224
a21ecf0e 1225 if (!macsec_post_decrypt(skb, secy, hdr_pn))
c09440f7
SD		 1226 goto drop;
1227
1228deliver:
1229 macsec_finalize_skb(skb, secy->icv_len,
1230 macsec_extra_len(macsec_skb_cb(skb)->has_sci));
1231 macsec_reset_skb(skb, secy->netdev);
1232
497f358a
SD		 1233 if (rx_sa)
1234 macsec_rxsa_put(rx_sa);
c78ebe1d 1235 macsec_rxsc_put(rx_sc);
5491e7c6 1236
ba56d8ce 1237 skb_orphan(skb);
c7cc9200 1238 len = skb->len;
5491e7c6
PA		 1239 ret = gro_cells_receive(&macsec->gro_cells, skb);
1240 if (ret == NET_RX_SUCCESS)
c7cc9200 1241 count_rx(dev, len);
5491e7c6
PA		 1242 else
1243 macsec->secy.netdev->stats.rx_dropped++;
c09440f7
SD		 1244
1245 rcu_read_unlock();
1246
5491e7c6
PA		 1247 *pskb = NULL;
1248 return RX_HANDLER_CONSUMED;
c09440f7
SD		 1249
1250drop:
1251 macsec_rxsa_put(rx_sa);
1252drop_nosa:
c78ebe1d 1253 macsec_rxsc_put(rx_sc);
c09440f7
SD		 1254 rcu_read_unlock();
1255drop_direct:
1256 kfree_skb(skb);
1257 *pskb = NULL;
1258 return RX_HANDLER_CONSUMED;
1259
1260nosci:
1261 /* 10.6.1 if the SC is not found */
1262 cbit = !!(hdr->tci_an & MACSEC_TCI_C);
1263 if (!cbit)
1264 macsec_finalize_skb(skb, DEFAULT_ICV_LEN,
1265 macsec_extra_len(macsec_skb_cb(skb)->has_sci));
1266
1267 list_for_each_entry_rcu(macsec, &rxd->secys, secys) {
1268 struct sk_buff *nskb;
c09440f7
SD		 1269
1270 secy_stats = this_cpu_ptr(macsec->stats);
1271
1272 /* If validateFrames is Strict or the C bit in the
1273 * SecTAG is set, discard
1274 */
1275 if (cbit ||
1276 macsec->secy.validate_frames == MACSEC_VALIDATE_STRICT) {
1277 u64_stats_update_begin(&secy_stats->syncp);
1278 secy_stats->stats.InPktsNoSCI++;
1279 u64_stats_update_end(&secy_stats->syncp);
1280 continue;
1281 }
1282
1283 /* not strict, the frame (with the SecTAG and ICV
1284 * removed) is delivered to the Controlled Port.
1285 */
1286 nskb = skb_clone(skb, GFP_ATOMIC);
1287 if (!nskb)
1288 break;
1289
1290 macsec_reset_skb(nskb, macsec->secy.netdev);
1291
1292 ret = netif_rx(nskb);
1293 if (ret == NET_RX_SUCCESS) {
1294 u64_stats_update_begin(&secy_stats->syncp);
1295 secy_stats->stats.InPktsUnknownSCI++;
1296 u64_stats_update_end(&secy_stats->syncp);
1297 } else {
1298 macsec->secy.netdev->stats.rx_dropped++;
1299 }
1300 }
1301
1302 rcu_read_unlock();
1303 *pskb = skb;
1304 return RX_HANDLER_PASS;
1305}
1306
1307static struct crypto_aead *macsec_alloc_tfm(char *key, int key_len, int icv_len)
1308{
1309 struct crypto_aead *tfm;
1310 int ret;
1311
ab046a5d
SD		 1312 /* Pick a sync gcm(aes) cipher to ensure order is preserved. */
1313 tfm = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC);
34aedfee
DC		 1314
1315 if (IS_ERR(tfm))
1316 return tfm;
c09440f7
SD		 1317
1318 ret = crypto_aead_setkey(tfm, key, key_len);
34aedfee
DC		 1319 if (ret < 0)
1320 goto fail;
c09440f7
SD		 1321
1322 ret = crypto_aead_setauthsize(tfm, icv_len);
34aedfee
DC		 1323 if (ret < 0)
1324 goto fail;
c09440f7
SD		 1325
1326 return tfm;
34aedfee
DC		 1327fail:
1328 crypto_free_aead(tfm);
1329 return ERR_PTR(ret);
c09440f7
SD		 1330}
1331
1332static int init_rx_sa(struct macsec_rx_sa *rx_sa, char *sak, int key_len,
1333 int icv_len)
1334{
1335 rx_sa->stats = alloc_percpu(struct macsec_rx_sa_stats);
1336 if (!rx_sa->stats)
34aedfee 1337 return -ENOMEM;
c09440f7
SD		 1338
1339 rx_sa->key.tfm = macsec_alloc_tfm(sak, key_len, icv_len);
34aedfee 1340 if (IS_ERR(rx_sa->key.tfm)) {
c09440f7 1341 free_percpu(rx_sa->stats);
34aedfee 1342 return PTR_ERR(rx_sa->key.tfm);
c09440f7
SD		 1343 }
1344
48ef50fa 1345 rx_sa->ssci = MACSEC_UNDEF_SSCI;
c09440f7
SD		 1346 rx_sa->active = false;
1347 rx_sa->next_pn = 1;
e187246f 1348 refcount_set(&rx_sa->refcnt, 1);
c09440f7
SD		 1349 spin_lock_init(&rx_sa->lock);
1350
1351 return 0;
1352}
1353
1354static void clear_rx_sa(struct macsec_rx_sa *rx_sa)
1355{
1356 rx_sa->active = false;
1357
1358 macsec_rxsa_put(rx_sa);
1359}
1360
1361static void free_rx_sc(struct macsec_rx_sc *rx_sc)
1362{
1363 int i;
1364
1365 for (i = 0; i < MACSEC_NUM_AN; i++) {
1366 struct macsec_rx_sa *sa = rtnl_dereference(rx_sc->sa[i]);
1367
1368 RCU_INIT_POINTER(rx_sc->sa[i], NULL);
1369 if (sa)
1370 clear_rx_sa(sa);
1371 }
1372
1373 macsec_rxsc_put(rx_sc);
1374}
1375
1376static struct macsec_rx_sc *del_rx_sc(struct macsec_secy *secy, sci_t sci)
1377{
1378 struct macsec_rx_sc *rx_sc, __rcu **rx_scp;
1379
1380 for (rx_scp = &secy->rx_sc, rx_sc = rtnl_dereference(*rx_scp);
1381 rx_sc;
1382 rx_scp = &rx_sc->next, rx_sc = rtnl_dereference(*rx_scp)) {
1383 if (rx_sc->sci == sci) {
1384 if (rx_sc->active)
1385 secy->n_rx_sc--;
1386 rcu_assign_pointer(*rx_scp, rx_sc->next);
1387 return rx_sc;
1388 }
1389 }
1390
1391 return NULL;
1392}
1393
1394static struct macsec_rx_sc *create_rx_sc(struct net_device *dev, sci_t sci)
1395{
1396 struct macsec_rx_sc *rx_sc;
1397 struct macsec_dev *macsec;
1398 struct net_device *real_dev = macsec_priv(dev)->real_dev;
1399 struct macsec_rxh_data *rxd = macsec_data_rtnl(real_dev);
1400 struct macsec_secy *secy;
1401
1402 list_for_each_entry(macsec, &rxd->secys, secys) {
1403 if (find_rx_sc_rtnl(&macsec->secy, sci))
1404 return ERR_PTR(-EEXIST);
1405 }
1406
1407 rx_sc = kzalloc(sizeof(*rx_sc), GFP_KERNEL);
1408 if (!rx_sc)
1409 return ERR_PTR(-ENOMEM);
1410
1411 rx_sc->stats = netdev_alloc_pcpu_stats(struct pcpu_rx_sc_stats);
1412 if (!rx_sc->stats) {
1413 kfree(rx_sc);
1414 return ERR_PTR(-ENOMEM);
1415 }
1416
1417 rx_sc->sci = sci;
1418 rx_sc->active = true;
8676d76f 1419 refcount_set(&rx_sc->refcnt, 1);
c09440f7
SD		 1420
1421 secy = &macsec_priv(dev)->secy;
1422 rcu_assign_pointer(rx_sc->next, secy->rx_sc);
1423 rcu_assign_pointer(secy->rx_sc, rx_sc);
1424
1425 if (rx_sc->active)
1426 secy->n_rx_sc++;
1427
1428 return rx_sc;
1429}
1430
1431static int init_tx_sa(struct macsec_tx_sa *tx_sa, char *sak, int key_len,
1432 int icv_len)
1433{
1434 tx_sa->stats = alloc_percpu(struct macsec_tx_sa_stats);
1435 if (!tx_sa->stats)
34aedfee 1436 return -ENOMEM;
c09440f7
SD		 1437
1438 tx_sa->key.tfm = macsec_alloc_tfm(sak, key_len, icv_len);
34aedfee 1439 if (IS_ERR(tx_sa->key.tfm)) {
c09440f7 1440 free_percpu(tx_sa->stats);
34aedfee 1441 return PTR_ERR(tx_sa->key.tfm);
c09440f7
SD		 1442 }
1443
48ef50fa 1444 tx_sa->ssci = MACSEC_UNDEF_SSCI;
c09440f7 1445 tx_sa->active = false;
28206cdb 1446 refcount_set(&tx_sa->refcnt, 1);
c09440f7
SD		 1447 spin_lock_init(&tx_sa->lock);
1448
1449 return 0;
1450}
1451
1452static void clear_tx_sa(struct macsec_tx_sa *tx_sa)
1453{
1454 tx_sa->active = false;
1455
1456 macsec_txsa_put(tx_sa);
1457}
1458
489111e5 1459static struct genl_family macsec_fam;
c09440f7
SD		 1460
1461static struct net_device *get_dev_from_nl(struct net *net,
1462 struct nlattr **attrs)
1463{
1464 int ifindex = nla_get_u32(attrs[MACSEC_ATTR_IFINDEX]);
1465 struct net_device *dev;
1466
1467 dev = __dev_get_by_index(net, ifindex);
1468 if (!dev)
1469 return ERR_PTR(-ENODEV);
1470
1471 if (!netif_is_macsec(dev))
1472 return ERR_PTR(-ENODEV);
1473
1474 return dev;
1475}
1476
791bb3fc
MS		 1477static enum macsec_offload nla_get_offload(const struct nlattr *nla)
1478{
1479 return (__force enum macsec_offload)nla_get_u8(nla);
1480}
1481
c09440f7
SD		 1482static sci_t nla_get_sci(const struct nlattr *nla)
1483{
1484 return (__force sci_t)nla_get_u64(nla);
1485}
1486
f60d94c0
ND		 1487static int nla_put_sci(struct sk_buff *skb, int attrtype, sci_t value,
1488 int padattr)
c09440f7 1489{
f60d94c0 1490 return nla_put_u64_64bit(skb, attrtype, (__force u64)value, padattr);
c09440f7
SD		 1491}
1492
48ef50fa
EM		 1493static ssci_t nla_get_ssci(const struct nlattr *nla)
1494{
1495 return (__force ssci_t)nla_get_u32(nla);
1496}
1497
1498static int nla_put_ssci(struct sk_buff *skb, int attrtype, ssci_t value)
1499{
1500 return nla_put_u32(skb, attrtype, (__force u64)value);
1501}
1502
c09440f7
SD		 1503static struct macsec_tx_sa *get_txsa_from_nl(struct net *net,
1504 struct nlattr **attrs,
1505 struct nlattr **tb_sa,
1506 struct net_device **devp,
1507 struct macsec_secy **secyp,
1508 struct macsec_tx_sc **scp,
1509 u8 *assoc_num)
1510{
1511 struct net_device *dev;
1512 struct macsec_secy *secy;
1513 struct macsec_tx_sc *tx_sc;
1514 struct macsec_tx_sa *tx_sa;
1515
1516 if (!tb_sa[MACSEC_SA_ATTR_AN])
1517 return ERR_PTR(-EINVAL);
1518
1519 *assoc_num = nla_get_u8(tb_sa[MACSEC_SA_ATTR_AN]);
1520
1521 dev = get_dev_from_nl(net, attrs);
1522 if (IS_ERR(dev))
1523 return ERR_CAST(dev);
1524
1525 if (*assoc_num >= MACSEC_NUM_AN)
1526 return ERR_PTR(-EINVAL);
1527
1528 secy = &macsec_priv(dev)->secy;
1529 tx_sc = &secy->tx_sc;
1530
1531 tx_sa = rtnl_dereference(tx_sc->sa[*assoc_num]);
1532 if (!tx_sa)
1533 return ERR_PTR(-ENODEV);
1534
1535 *devp = dev;
1536 *scp = tx_sc;
1537 *secyp = secy;
1538 return tx_sa;
1539}
1540
1541static struct macsec_rx_sc *get_rxsc_from_nl(struct net *net,
1542 struct nlattr **attrs,
1543 struct nlattr **tb_rxsc,
1544 struct net_device **devp,
1545 struct macsec_secy **secyp)
1546{
1547 struct net_device *dev;
1548 struct macsec_secy *secy;
1549 struct macsec_rx_sc *rx_sc;
1550 sci_t sci;
1551
1552 dev = get_dev_from_nl(net, attrs);
1553 if (IS_ERR(dev))
1554 return ERR_CAST(dev);
1555
1556 secy = &macsec_priv(dev)->secy;
1557
1558 if (!tb_rxsc[MACSEC_RXSC_ATTR_SCI])
1559 return ERR_PTR(-EINVAL);
1560
1561 sci = nla_get_sci(tb_rxsc[MACSEC_RXSC_ATTR_SCI]);
1562 rx_sc = find_rx_sc_rtnl(secy, sci);
1563 if (!rx_sc)
1564 return ERR_PTR(-ENODEV);
1565
1566 *secyp = secy;
1567 *devp = dev;
1568
1569 return rx_sc;
1570}
1571
1572static struct macsec_rx_sa *get_rxsa_from_nl(struct net *net,
1573 struct nlattr **attrs,
1574 struct nlattr **tb_rxsc,
1575 struct nlattr **tb_sa,
1576 struct net_device **devp,
1577 struct macsec_secy **secyp,
1578 struct macsec_rx_sc **scp,
1579 u8 *assoc_num)
1580{
1581 struct macsec_rx_sc *rx_sc;
1582 struct macsec_rx_sa *rx_sa;
1583
1584 if (!tb_sa[MACSEC_SA_ATTR_AN])
1585 return ERR_PTR(-EINVAL);
1586
1587 *assoc_num = nla_get_u8(tb_sa[MACSEC_SA_ATTR_AN]);
1588 if (*assoc_num >= MACSEC_NUM_AN)
1589 return ERR_PTR(-EINVAL);
1590
1591 rx_sc = get_rxsc_from_nl(net, attrs, tb_rxsc, devp, secyp);
1592 if (IS_ERR(rx_sc))
1593 return ERR_CAST(rx_sc);
1594
1595 rx_sa = rtnl_dereference(rx_sc->sa[*assoc_num]);
1596 if (!rx_sa)
1597 return ERR_PTR(-ENODEV);
1598
1599 *scp = rx_sc;
1600 return rx_sa;
1601}
1602
c09440f7
SD		 1603static const struct nla_policy macsec_genl_policy[NUM_MACSEC_ATTR] = {
1604 [MACSEC_ATTR_IFINDEX] = { .type = NLA_U32 },
1605 [MACSEC_ATTR_RXSC_CONFIG] = { .type = NLA_NESTED },
1606 [MACSEC_ATTR_SA_CONFIG] = { .type = NLA_NESTED },
dcb780fb 1607 [MACSEC_ATTR_OFFLOAD] = { .type = NLA_NESTED },
c09440f7
SD		 1608};
1609
1610static const struct nla_policy macsec_genl_rxsc_policy[NUM_MACSEC_RXSC_ATTR] = {
1611 [MACSEC_RXSC_ATTR_SCI] = { .type = NLA_U64 },
1612 [MACSEC_RXSC_ATTR_ACTIVE] = { .type = NLA_U8 },
1613};
1614
1615static const struct nla_policy macsec_genl_sa_policy[NUM_MACSEC_SA_ATTR] = {
1616 [MACSEC_SA_ATTR_AN] = { .type = NLA_U8 },
1617 [MACSEC_SA_ATTR_ACTIVE] = { .type = NLA_U8 },
bc043585 1618 [MACSEC_SA_ATTR_PN] = NLA_POLICY_MIN_LEN(4),
8acca6ac
SD		 1619 [MACSEC_SA_ATTR_KEYID] = { .type = NLA_BINARY,
1620 .len = MACSEC_KEYID_LEN, },
c09440f7 1621 [MACSEC_SA_ATTR_KEY] = { .type = NLA_BINARY,
e8660ded 1622 .len = MACSEC_MAX_KEY_LEN, },
48ef50fa
EM		 1623 [MACSEC_SA_ATTR_SSCI] = { .type = NLA_U32 },
1624 [MACSEC_SA_ATTR_SALT] = { .type = NLA_BINARY,
1625 .len = MACSEC_SALT_LEN, },
c09440f7
SD		 1626};
1627
dcb780fb
AT		 1628static const struct nla_policy macsec_genl_offload_policy[NUM_MACSEC_OFFLOAD_ATTR] = {
1629 [MACSEC_OFFLOAD_ATTR_TYPE] = { .type = NLA_U8 },
1630};
1631
3cf3227a
AT		 1632/* Offloads an operation to a device driver */
1633static int macsec_offload(int (* const func)(struct macsec_context *),
1634 struct macsec_context *ctx)
1635{
1636 int ret;
1637
1638 if (unlikely(!func))
1639 return 0;
1640
1641 if (ctx->offload == MACSEC_OFFLOAD_PHY)
1642 mutex_lock(&ctx->phydev->lock);
1643
1644 /* Phase I: prepare. The drive should fail here if there are going to be
1645 * issues in the commit phase.
1646 */
1647 ctx->prepare = true;
1648 ret = (*func)(ctx);
1649 if (ret)
1650 goto phy_unlock;
1651
1652 /* Phase II: commit. This step cannot fail. */
1653 ctx->prepare = false;
1654 ret = (*func)(ctx);
1655 /* This should never happen: commit is not allowed to fail */
1656 if (unlikely(ret))
1657 WARN(1, "MACsec offloading commit failed (%d)\n", ret);
1658
1659phy_unlock:
1660 if (ctx->offload == MACSEC_OFFLOAD_PHY)
1661 mutex_unlock(&ctx->phydev->lock);
1662
1663 return ret;
1664}
1665
c09440f7
SD		 1666static int parse_sa_config(struct nlattr **attrs, struct nlattr **tb_sa)
1667{
1668 if (!attrs[MACSEC_ATTR_SA_CONFIG])
1669 return -EINVAL;
1670
8cb08174 1671 if (nla_parse_nested_deprecated(tb_sa, MACSEC_SA_ATTR_MAX, attrs[MACSEC_ATTR_SA_CONFIG], macsec_genl_sa_policy, NULL))
c09440f7
SD		 1672 return -EINVAL;
1673
1674 return 0;
1675}
1676
1677static int parse_rxsc_config(struct nlattr **attrs, struct nlattr **tb_rxsc)
1678{
1679 if (!attrs[MACSEC_ATTR_RXSC_CONFIG])
1680 return -EINVAL;
1681
8cb08174 1682 if (nla_parse_nested_deprecated(tb_rxsc, MACSEC_RXSC_ATTR_MAX, attrs[MACSEC_ATTR_RXSC_CONFIG], macsec_genl_rxsc_policy, NULL))
c09440f7
SD		 1683 return -EINVAL;
1684
1685 return 0;
1686}
1687
1688static bool validate_add_rxsa(struct nlattr **attrs)
1689{
1690 if (!attrs[MACSEC_SA_ATTR_AN] ||
1691 !attrs[MACSEC_SA_ATTR_KEY] ||
1692 !attrs[MACSEC_SA_ATTR_KEYID])
1693 return false;
1694
1695 if (nla_get_u8(attrs[MACSEC_SA_ATTR_AN]) >= MACSEC_NUM_AN)
1696 return false;
1697
48ef50fa
EM		 1698 if (attrs[MACSEC_SA_ATTR_PN] &&
1699 *(u64 *)nla_data(attrs[MACSEC_SA_ATTR_PN]) == 0)
c09440f7
SD		 1700 return false;
1701
1702 if (attrs[MACSEC_SA_ATTR_ACTIVE]) {
1703 if (nla_get_u8(attrs[MACSEC_SA_ATTR_ACTIVE]) > 1)
1704 return false;
1705 }
1706
8acca6ac
SD		 1707 if (nla_len(attrs[MACSEC_SA_ATTR_KEYID]) != MACSEC_KEYID_LEN)
1708 return false;
1709
c09440f7
SD		 1710 return true;
1711}
1712
1713static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info)
1714{
1715 struct net_device *dev;
1716 struct nlattr **attrs = info->attrs;
1717 struct macsec_secy *secy;
1718 struct macsec_rx_sc *rx_sc;
1719 struct macsec_rx_sa *rx_sa;
1720 unsigned char assoc_num;
48ef50fa 1721 int pn_len;
c09440f7
SD		 1722 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1];
1723 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
34aedfee 1724 int err;
c09440f7
SD		 1725
1726 if (!attrs[MACSEC_ATTR_IFINDEX])
1727 return -EINVAL;
1728
1729 if (parse_sa_config(attrs, tb_sa))
1730 return -EINVAL;
1731
1732 if (parse_rxsc_config(attrs, tb_rxsc))
1733 return -EINVAL;
1734
1735 if (!validate_add_rxsa(tb_sa))
1736 return -EINVAL;
1737
1738 rtnl_lock();
1739 rx_sc = get_rxsc_from_nl(genl_info_net(info), attrs, tb_rxsc, &dev, &secy);
36b232c8 1740 if (IS_ERR(rx_sc)) {
c09440f7
SD		 1741 rtnl_unlock();
1742 return PTR_ERR(rx_sc);
1743 }
1744
1745 assoc_num = nla_get_u8(tb_sa[MACSEC_SA_ATTR_AN]);
1746
1747 if (nla_len(tb_sa[MACSEC_SA_ATTR_KEY]) != secy->key_len) {
1748 pr_notice("macsec: nl: add_rxsa: bad key length: %d != %d\n",
1749 nla_len(tb_sa[MACSEC_SA_ATTR_KEY]), secy->key_len);
1750 rtnl_unlock();
1751 return -EINVAL;
1752 }
1753
48ef50fa 1754 pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;
254e2f10
SD		 1755 if (tb_sa[MACSEC_SA_ATTR_PN] &&
1756 nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) {
48ef50fa
EM		 1757 pr_notice("macsec: nl: add_rxsa: bad pn length: %d != %d\n",
1758 nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len);
1759 rtnl_unlock();
1760 return -EINVAL;
1761 }
1762
1763 if (secy->xpn) {
1764 if (!tb_sa[MACSEC_SA_ATTR_SSCI] || !tb_sa[MACSEC_SA_ATTR_SALT]) {
1765 rtnl_unlock();
1766 return -EINVAL;
1767 }
1768
1769 if (nla_len(tb_sa[MACSEC_SA_ATTR_SALT]) != MACSEC_SALT_LEN) {
1770 pr_notice("macsec: nl: add_rxsa: bad salt length: %d != %d\n",
1771 nla_len(tb_sa[MACSEC_SA_ATTR_SALT]),
019866ee 1772 MACSEC_SALT_LEN);
48ef50fa
EM		 1773 rtnl_unlock();
1774 return -EINVAL;
1775 }
1776 }
1777
c09440f7
SD		 1778 rx_sa = rtnl_dereference(rx_sc->sa[assoc_num]);
1779 if (rx_sa) {
1780 rtnl_unlock();
1781 return -EBUSY;
1782 }
1783
1784 rx_sa = kmalloc(sizeof(*rx_sa), GFP_KERNEL);
34aedfee 1785 if (!rx_sa) {
c09440f7
SD		 1786 rtnl_unlock();
1787 return -ENOMEM;
1788 }
1789
34aedfee
DC		 1790 err = init_rx_sa(rx_sa, nla_data(tb_sa[MACSEC_SA_ATTR_KEY]),
1791 secy->key_len, secy->icv_len);
1792 if (err < 0) {
1793 kfree(rx_sa);
1794 rtnl_unlock();
1795 return err;
1796 }
1797
c09440f7
SD		 1798 if (tb_sa[MACSEC_SA_ATTR_PN]) {
1799 spin_lock_bh(&rx_sa->lock);
48ef50fa 1800 rx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
c09440f7
SD		 1801 spin_unlock_bh(&rx_sa->lock);
1802 }
1803
1804 if (tb_sa[MACSEC_SA_ATTR_ACTIVE])
1805 rx_sa->active = !!nla_get_u8(tb_sa[MACSEC_SA_ATTR_ACTIVE]);
1806
c09440f7 1807 rx_sa->sc = rx_sc;
3cf3227a
AT		 1808
1809 /* If h/w offloading is available, propagate to the device */
1810 if (macsec_is_offloaded(netdev_priv(dev))) {
1811 const struct macsec_ops *ops;
1812 struct macsec_context ctx;
1813
1814 ops = macsec_get_ops(netdev_priv(dev), &ctx);
1815 if (!ops) {
1816 err = -EOPNOTSUPP;
1817 goto cleanup;
1818 }
1819
1820 ctx.sa.assoc_num = assoc_num;
1821 ctx.sa.rx_sa = rx_sa;
182879f8 1822 ctx.secy = secy;
3cf3227a 1823 memcpy(ctx.sa.key, nla_data(tb_sa[MACSEC_SA_ATTR_KEY]),
1f7fe512 1824 secy->key_len);
3cf3227a
AT		 1825
1826 err = macsec_offload(ops->mdo_add_rxsa, &ctx);
1827 if (err)
1828 goto cleanup;
1829 }
1830
48ef50fa
EM		 1831 if (secy->xpn) {
1832 rx_sa->ssci = nla_get_ssci(tb_sa[MACSEC_SA_ATTR_SSCI]);
1833 nla_memcpy(rx_sa->key.salt.bytes, tb_sa[MACSEC_SA_ATTR_SALT],
1834 MACSEC_SALT_LEN);
1835 }
1836
3cf3227a 1837 nla_memcpy(rx_sa->key.id, tb_sa[MACSEC_SA_ATTR_KEYID], MACSEC_KEYID_LEN);
c09440f7
SD		 1838 rcu_assign_pointer(rx_sc->sa[assoc_num], rx_sa);
1839
1840 rtnl_unlock();
1841
1842 return 0;
3cf3227a
AT		 1843
1844cleanup:
1845 kfree(rx_sa);
1846 rtnl_unlock();
1847 return err;
c09440f7
SD		 1848}
1849
1850static bool validate_add_rxsc(struct nlattr **attrs)
1851{
1852 if (!attrs[MACSEC_RXSC_ATTR_SCI])
1853 return false;
1854
1855 if (attrs[MACSEC_RXSC_ATTR_ACTIVE]) {
1856 if (nla_get_u8(attrs[MACSEC_RXSC_ATTR_ACTIVE]) > 1)
1857 return false;
1858 }
1859
1860 return true;
1861}
1862
1863static int macsec_add_rxsc(struct sk_buff *skb, struct genl_info *info)
1864{
1865 struct net_device *dev;
1866 sci_t sci = MACSEC_UNDEF_SCI;
1867 struct nlattr **attrs = info->attrs;
1868 struct macsec_rx_sc *rx_sc;
1869 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1];
182879f8 1870 struct macsec_secy *secy;
3cf3227a
AT		 1871 bool was_active;
1872 int ret;
c09440f7
SD		 1873
1874 if (!attrs[MACSEC_ATTR_IFINDEX])
1875 return -EINVAL;
1876
1877 if (parse_rxsc_config(attrs, tb_rxsc))
1878 return -EINVAL;
1879
1880 if (!validate_add_rxsc(tb_rxsc))
1881 return -EINVAL;
1882
1883 rtnl_lock();
1884 dev = get_dev_from_nl(genl_info_net(info), attrs);
1885 if (IS_ERR(dev)) {
1886 rtnl_unlock();
1887 return PTR_ERR(dev);
1888 }
1889
182879f8 1890 secy = &macsec_priv(dev)->secy;
c09440f7
SD		 1891 sci = nla_get_sci(tb_rxsc[MACSEC_RXSC_ATTR_SCI]);
1892
1893 rx_sc = create_rx_sc(dev, sci);
1894 if (IS_ERR(rx_sc)) {
1895 rtnl_unlock();
1896 return PTR_ERR(rx_sc);
1897 }
1898
3cf3227a 1899 was_active = rx_sc->active;
c09440f7
SD		 1900 if (tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE])
1901 rx_sc->active = !!nla_get_u8(tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE]);
1902
3cf3227a
AT		 1903 if (macsec_is_offloaded(netdev_priv(dev))) {
1904 const struct macsec_ops *ops;
1905 struct macsec_context ctx;
1906
1907 ops = macsec_get_ops(netdev_priv(dev), &ctx);
1908 if (!ops) {
1909 ret = -EOPNOTSUPP;
1910 goto cleanup;
1911 }
1912
1913 ctx.rx_sc = rx_sc;
182879f8 1914 ctx.secy = secy;
3cf3227a
AT		 1915
1916 ret = macsec_offload(ops->mdo_add_rxsc, &ctx);
1917 if (ret)
1918 goto cleanup;
1919 }
1920
c09440f7
SD		 1921 rtnl_unlock();
1922
1923 return 0;
3cf3227a
AT		 1924
1925cleanup:
1926 rx_sc->active = was_active;
1927 rtnl_unlock();
1928 return ret;
c09440f7
SD		 1929}
1930
1931static bool validate_add_txsa(struct nlattr **attrs)
1932{
1933 if (!attrs[MACSEC_SA_ATTR_AN] ||
1934 !attrs[MACSEC_SA_ATTR_PN] ||
1935 !attrs[MACSEC_SA_ATTR_KEY] ||
1936 !attrs[MACSEC_SA_ATTR_KEYID])
1937 return false;
1938
1939 if (nla_get_u8(attrs[MACSEC_SA_ATTR_AN]) >= MACSEC_NUM_AN)
1940 return false;
1941
1942 if (nla_get_u32(attrs[MACSEC_SA_ATTR_PN]) == 0)
1943 return false;
1944
1945 if (attrs[MACSEC_SA_ATTR_ACTIVE]) {
1946 if (nla_get_u8(attrs[MACSEC_SA_ATTR_ACTIVE]) > 1)
1947 return false;
1948 }
1949
8acca6ac
SD		 1950 if (nla_len(attrs[MACSEC_SA_ATTR_KEYID]) != MACSEC_KEYID_LEN)
1951 return false;
1952
c09440f7
SD		 1953 return true;
1954}
1955
1956static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info)
1957{
1958 struct net_device *dev;
1959 struct nlattr **attrs = info->attrs;
1960 struct macsec_secy *secy;
1961 struct macsec_tx_sc *tx_sc;
1962 struct macsec_tx_sa *tx_sa;
1963 unsigned char assoc_num;
48ef50fa 1964 int pn_len;
c09440f7 1965 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
3cf3227a 1966 bool was_operational;
34aedfee 1967 int err;
c09440f7
SD		 1968
1969 if (!attrs[MACSEC_ATTR_IFINDEX])
1970 return -EINVAL;
1971
1972 if (parse_sa_config(attrs, tb_sa))
1973 return -EINVAL;
1974
1975 if (!validate_add_txsa(tb_sa))
1976 return -EINVAL;
1977
1978 rtnl_lock();
1979 dev = get_dev_from_nl(genl_info_net(info), attrs);
1980 if (IS_ERR(dev)) {
1981 rtnl_unlock();
1982 return PTR_ERR(dev);
1983 }
1984
1985 secy = &macsec_priv(dev)->secy;
1986 tx_sc = &secy->tx_sc;
1987
1988 assoc_num = nla_get_u8(tb_sa[MACSEC_SA_ATTR_AN]);
1989
1990 if (nla_len(tb_sa[MACSEC_SA_ATTR_KEY]) != secy->key_len) {
1991 pr_notice("macsec: nl: add_txsa: bad key length: %d != %d\n",
1992 nla_len(tb_sa[MACSEC_SA_ATTR_KEY]), secy->key_len);
1993 rtnl_unlock();
1994 return -EINVAL;
1995 }
1996
48ef50fa
EM		 1997 pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;
1998 if (nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) {
1999 pr_notice("macsec: nl: add_txsa: bad pn length: %d != %d\n",
2000 nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len);
2001 rtnl_unlock();
2002 return -EINVAL;
2003 }
2004
2005 if (secy->xpn) {
2006 if (!tb_sa[MACSEC_SA_ATTR_SSCI] || !tb_sa[MACSEC_SA_ATTR_SALT]) {
2007 rtnl_unlock();
2008 return -EINVAL;
2009 }
2010
2011 if (nla_len(tb_sa[MACSEC_SA_ATTR_SALT]) != MACSEC_SALT_LEN) {
2012 pr_notice("macsec: nl: add_txsa: bad salt length: %d != %d\n",
2013 nla_len(tb_sa[MACSEC_SA_ATTR_SALT]),
019866ee 2014 MACSEC_SALT_LEN);
48ef50fa
EM		 2015 rtnl_unlock();
2016 return -EINVAL;
2017 }
2018 }
2019
c09440f7
SD		 2020 tx_sa = rtnl_dereference(tx_sc->sa[assoc_num]);
2021 if (tx_sa) {
2022 rtnl_unlock();
2023 return -EBUSY;
2024 }
2025
2026 tx_sa = kmalloc(sizeof(*tx_sa), GFP_KERNEL);
34aedfee 2027 if (!tx_sa) {
c09440f7
SD		 2028 rtnl_unlock();
2029 return -ENOMEM;
2030 }
2031
34aedfee
DC		 2032 err = init_tx_sa(tx_sa, nla_data(tb_sa[MACSEC_SA_ATTR_KEY]),
2033 secy->key_len, secy->icv_len);
2034 if (err < 0) {
2035 kfree(tx_sa);
2036 rtnl_unlock();
2037 return err;
2038 }
2039
c09440f7 2040 spin_lock_bh(&tx_sa->lock);
48ef50fa 2041 tx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
c09440f7
SD		 2042 spin_unlock_bh(&tx_sa->lock);
2043
2044 if (tb_sa[MACSEC_SA_ATTR_ACTIVE])
2045 tx_sa->active = !!nla_get_u8(tb_sa[MACSEC_SA_ATTR_ACTIVE]);
2046
3cf3227a 2047 was_operational = secy->operational;
c09440f7
SD		 2048 if (assoc_num == tx_sc->encoding_sa && tx_sa->active)
2049 secy->operational = true;
2050
3cf3227a
AT		 2051 /* If h/w offloading is available, propagate to the device */
2052 if (macsec_is_offloaded(netdev_priv(dev))) {
2053 const struct macsec_ops *ops;
2054 struct macsec_context ctx;
2055
2056 ops = macsec_get_ops(netdev_priv(dev), &ctx);
2057 if (!ops) {
2058 err = -EOPNOTSUPP;
2059 goto cleanup;
2060 }
2061
2062 ctx.sa.assoc_num = assoc_num;
2063 ctx.sa.tx_sa = tx_sa;
182879f8 2064 ctx.secy = secy;
3cf3227a 2065 memcpy(ctx.sa.key, nla_data(tb_sa[MACSEC_SA_ATTR_KEY]),
1f7fe512 2066 secy->key_len);
3cf3227a
AT		 2067
2068 err = macsec_offload(ops->mdo_add_txsa, &ctx);
2069 if (err)
2070 goto cleanup;
2071 }
2072
48ef50fa
EM		 2073 if (secy->xpn) {
2074 tx_sa->ssci = nla_get_ssci(tb_sa[MACSEC_SA_ATTR_SSCI]);
2075 nla_memcpy(tx_sa->key.salt.bytes, tb_sa[MACSEC_SA_ATTR_SALT],
2076 MACSEC_SALT_LEN);
2077 }
2078
3cf3227a 2079 nla_memcpy(tx_sa->key.id, tb_sa[MACSEC_SA_ATTR_KEYID], MACSEC_KEYID_LEN);
c09440f7
SD		 2080 rcu_assign_pointer(tx_sc->sa[assoc_num], tx_sa);
2081
2082 rtnl_unlock();
2083
2084 return 0;
3cf3227a
AT		 2085
2086cleanup:
2087 secy->operational = was_operational;
2088 kfree(tx_sa);
2089 rtnl_unlock();
2090 return err;
c09440f7
SD		 2091}
2092
2093static int macsec_del_rxsa(struct sk_buff *skb, struct genl_info *info)
2094{
2095 struct nlattr **attrs = info->attrs;
2096 struct net_device *dev;
2097 struct macsec_secy *secy;
2098 struct macsec_rx_sc *rx_sc;
2099 struct macsec_rx_sa *rx_sa;
2100 u8 assoc_num;
2101 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1];
2102 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
3cf3227a 2103 int ret;
c09440f7
SD		 2104
2105 if (!attrs[MACSEC_ATTR_IFINDEX])
2106 return -EINVAL;
2107
2108 if (parse_sa_config(attrs, tb_sa))
2109 return -EINVAL;
2110
2111 if (parse_rxsc_config(attrs, tb_rxsc))
2112 return -EINVAL;
2113
2114 rtnl_lock();
2115 rx_sa = get_rxsa_from_nl(genl_info_net(info), attrs, tb_rxsc, tb_sa,
2116 &dev, &secy, &rx_sc, &assoc_num);
2117 if (IS_ERR(rx_sa)) {
2118 rtnl_unlock();
2119 return PTR_ERR(rx_sa);
2120 }
2121
2122 if (rx_sa->active) {
2123 rtnl_unlock();
2124 return -EBUSY;
2125 }
2126
3cf3227a
AT		 2127 /* If h/w offloading is available, propagate to the device */
2128 if (macsec_is_offloaded(netdev_priv(dev))) {
2129 const struct macsec_ops *ops;
2130 struct macsec_context ctx;
2131
2132 ops = macsec_get_ops(netdev_priv(dev), &ctx);
2133 if (!ops) {
2134 ret = -EOPNOTSUPP;
2135 goto cleanup;
2136 }
2137
2138 ctx.sa.assoc_num = assoc_num;
2139 ctx.sa.rx_sa = rx_sa;
182879f8 2140 ctx.secy = secy;
3cf3227a
AT		 2141
2142 ret = macsec_offload(ops->mdo_del_rxsa, &ctx);
2143 if (ret)
2144 goto cleanup;
2145 }
2146
c09440f7
SD		 2147 RCU_INIT_POINTER(rx_sc->sa[assoc_num], NULL);
2148 clear_rx_sa(rx_sa);
2149
2150 rtnl_unlock();
2151
2152 return 0;
3cf3227a
AT		 2153
2154cleanup:
2155 rtnl_unlock();
2156 return ret;
c09440f7
SD		 2157}
2158
2159static int macsec_del_rxsc(struct sk_buff *skb, struct genl_info *info)
2160{
2161 struct nlattr **attrs = info->attrs;
2162 struct net_device *dev;
2163 struct macsec_secy *secy;
2164 struct macsec_rx_sc *rx_sc;
2165 sci_t sci;
2166 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1];
3cf3227a 2167 int ret;
c09440f7
SD		 2168
2169 if (!attrs[MACSEC_ATTR_IFINDEX])
2170 return -EINVAL;
2171
2172 if (parse_rxsc_config(attrs, tb_rxsc))
2173 return -EINVAL;
2174
2175 if (!tb_rxsc[MACSEC_RXSC_ATTR_SCI])
2176 return -EINVAL;
2177
2178 rtnl_lock();
2179 dev = get_dev_from_nl(genl_info_net(info), info->attrs);
2180 if (IS_ERR(dev)) {
2181 rtnl_unlock();
2182 return PTR_ERR(dev);
2183 }
2184
2185 secy = &macsec_priv(dev)->secy;
2186 sci = nla_get_sci(tb_rxsc[MACSEC_RXSC_ATTR_SCI]);
2187
2188 rx_sc = del_rx_sc(secy, sci);
2189 if (!rx_sc) {
2190 rtnl_unlock();
2191 return -ENODEV;
2192 }
2193
3cf3227a
AT		 2194 /* If h/w offloading is available, propagate to the device */
2195 if (macsec_is_offloaded(netdev_priv(dev))) {
2196 const struct macsec_ops *ops;
2197 struct macsec_context ctx;
2198
2199 ops = macsec_get_ops(netdev_priv(dev), &ctx);
2200 if (!ops) {
2201 ret = -EOPNOTSUPP;
2202 goto cleanup;
2203 }
2204
2205 ctx.rx_sc = rx_sc;
182879f8 2206 ctx.secy = secy;
3cf3227a
AT		 2207 ret = macsec_offload(ops->mdo_del_rxsc, &ctx);
2208 if (ret)
2209 goto cleanup;
2210 }
2211
c09440f7
SD		 2212 free_rx_sc(rx_sc);
2213 rtnl_unlock();
2214
2215 return 0;
3cf3227a
AT		 2216
2217cleanup:
2218 rtnl_unlock();
2219 return ret;
c09440f7
SD		 2220}
2221
2222static int macsec_del_txsa(struct sk_buff *skb, struct genl_info *info)
2223{
2224 struct nlattr **attrs = info->attrs;
2225 struct net_device *dev;
2226 struct macsec_secy *secy;
2227 struct macsec_tx_sc *tx_sc;
2228 struct macsec_tx_sa *tx_sa;
2229 u8 assoc_num;
2230 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
3cf3227a 2231 int ret;
c09440f7
SD		 2232
2233 if (!attrs[MACSEC_ATTR_IFINDEX])
2234 return -EINVAL;
2235
2236 if (parse_sa_config(attrs, tb_sa))
2237 return -EINVAL;
2238
2239 rtnl_lock();
2240 tx_sa = get_txsa_from_nl(genl_info_net(info), attrs, tb_sa,
2241 &dev, &secy, &tx_sc, &assoc_num);
2242 if (IS_ERR(tx_sa)) {
2243 rtnl_unlock();
2244 return PTR_ERR(tx_sa);
2245 }
2246
2247 if (tx_sa->active) {
2248 rtnl_unlock();
2249 return -EBUSY;
2250 }
2251
3cf3227a
AT		 2252 /* If h/w offloading is available, propagate to the device */
2253 if (macsec_is_offloaded(netdev_priv(dev))) {
2254 const struct macsec_ops *ops;
2255 struct macsec_context ctx;
2256
2257 ops = macsec_get_ops(netdev_priv(dev), &ctx);
2258 if (!ops) {
2259 ret = -EOPNOTSUPP;
2260 goto cleanup;
2261 }
2262
2263 ctx.sa.assoc_num = assoc_num;
2264 ctx.sa.tx_sa = tx_sa;
182879f8 2265 ctx.secy = secy;
3cf3227a
AT		 2266
2267 ret = macsec_offload(ops->mdo_del_txsa, &ctx);
2268 if (ret)
2269 goto cleanup;
2270 }
2271
c09440f7
SD		 2272 RCU_INIT_POINTER(tx_sc->sa[assoc_num], NULL);
2273 clear_tx_sa(tx_sa);
2274
2275 rtnl_unlock();
2276
2277 return 0;
3cf3227a
AT		 2278
2279cleanup:
2280 rtnl_unlock();
2281 return ret;
c09440f7
SD		 2282}
2283
2284static bool validate_upd_sa(struct nlattr **attrs)
2285{
2286 if (!attrs[MACSEC_SA_ATTR_AN] ||
2287 attrs[MACSEC_SA_ATTR_KEY] ||
48ef50fa
EM		 2288 attrs[MACSEC_SA_ATTR_KEYID] ||
2289 attrs[MACSEC_SA_ATTR_SSCI] ||
2290 attrs[MACSEC_SA_ATTR_SALT])
c09440f7
SD		 2291 return false;
2292
2293 if (nla_get_u8(attrs[MACSEC_SA_ATTR_AN]) >= MACSEC_NUM_AN)
2294 return false;
2295
2296 if (attrs[MACSEC_SA_ATTR_PN] && nla_get_u32(attrs[MACSEC_SA_ATTR_PN]) == 0)
2297 return false;
2298
2299 if (attrs[MACSEC_SA_ATTR_ACTIVE]) {
2300 if (nla_get_u8(attrs[MACSEC_SA_ATTR_ACTIVE]) > 1)
2301 return false;
2302 }
2303
2304 return true;
2305}
2306
2307static int macsec_upd_txsa(struct sk_buff *skb, struct genl_info *info)
2308{
2309 struct nlattr **attrs = info->attrs;
2310 struct net_device *dev;
2311 struct macsec_secy *secy;
2312 struct macsec_tx_sc *tx_sc;
2313 struct macsec_tx_sa *tx_sa;
2314 u8 assoc_num;
2315 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
3cf3227a 2316 bool was_operational, was_active;
a21ecf0e 2317 pn_t prev_pn;
3cf3227a 2318 int ret = 0;
c09440f7 2319
a21ecf0e
EM		 2320 prev_pn.full64 = 0;
2321
c09440f7
SD		 2322 if (!attrs[MACSEC_ATTR_IFINDEX])
2323 return -EINVAL;
2324
2325 if (parse_sa_config(attrs, tb_sa))
2326 return -EINVAL;
2327
2328 if (!validate_upd_sa(tb_sa))
2329 return -EINVAL;
2330
2331 rtnl_lock();
2332 tx_sa = get_txsa_from_nl(genl_info_net(info), attrs, tb_sa,
2333 &dev, &secy, &tx_sc, &assoc_num);
2334 if (IS_ERR(tx_sa)) {
2335 rtnl_unlock();
2336 return PTR_ERR(tx_sa);
2337 }
2338
2339 if (tb_sa[MACSEC_SA_ATTR_PN]) {
48ef50fa
EM		 2340 int pn_len;
2341
2342 pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;
2343 if (nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) {
2344 pr_notice("macsec: nl: upd_txsa: bad pn length: %d != %d\n",
2345 nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len);
2346 rtnl_unlock();
2347 return -EINVAL;
2348 }
2349
c09440f7 2350 spin_lock_bh(&tx_sa->lock);
a21ecf0e 2351 prev_pn = tx_sa->next_pn_halves;
48ef50fa 2352 tx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
c09440f7
SD		 2353 spin_unlock_bh(&tx_sa->lock);
2354 }
2355
3cf3227a 2356 was_active = tx_sa->active;
c09440f7
SD		 2357 if (tb_sa[MACSEC_SA_ATTR_ACTIVE])
2358 tx_sa->active = nla_get_u8(tb_sa[MACSEC_SA_ATTR_ACTIVE]);
2359
3cf3227a 2360 was_operational = secy->operational;
c09440f7
SD		 2361 if (assoc_num == tx_sc->encoding_sa)
2362 secy->operational = tx_sa->active;
2363
3cf3227a
AT		 2364 /* If h/w offloading is available, propagate to the device */
2365 if (macsec_is_offloaded(netdev_priv(dev))) {
2366 const struct macsec_ops *ops;
2367 struct macsec_context ctx;
2368
2369 ops = macsec_get_ops(netdev_priv(dev), &ctx);
2370 if (!ops) {
2371 ret = -EOPNOTSUPP;
2372 goto cleanup;
2373 }
2374
2375 ctx.sa.assoc_num = assoc_num;
2376 ctx.sa.tx_sa = tx_sa;
182879f8 2377 ctx.secy = secy;
3cf3227a
AT		 2378
2379 ret = macsec_offload(ops->mdo_upd_txsa, &ctx);
2380 if (ret)
2381 goto cleanup;
2382 }
2383
c09440f7
SD		 2384 rtnl_unlock();
2385
2386 return 0;
3cf3227a
AT		 2387
2388cleanup:
2389 if (tb_sa[MACSEC_SA_ATTR_PN]) {
2390 spin_lock_bh(&tx_sa->lock);
a21ecf0e 2391 tx_sa->next_pn_halves = prev_pn;
3cf3227a
AT		 2392 spin_unlock_bh(&tx_sa->lock);
2393 }
2394 tx_sa->active = was_active;
2395 secy->operational = was_operational;
2396 rtnl_unlock();
2397 return ret;
c09440f7
SD		 2398}
2399
2400static int macsec_upd_rxsa(struct sk_buff *skb, struct genl_info *info)
2401{
2402 struct nlattr **attrs = info->attrs;
2403 struct net_device *dev;
2404 struct macsec_secy *secy;
2405 struct macsec_rx_sc *rx_sc;
2406 struct macsec_rx_sa *rx_sa;
2407 u8 assoc_num;
2408 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1];
2409 struct nlattr *tb_sa[MACSEC_SA_ATTR_MAX + 1];
3cf3227a 2410 bool was_active;
a21ecf0e 2411 pn_t prev_pn;
3cf3227a 2412 int ret = 0;
c09440f7 2413
a21ecf0e
EM		 2414 prev_pn.full64 = 0;
2415
c09440f7
SD		 2416 if (!attrs[MACSEC_ATTR_IFINDEX])
2417 return -EINVAL;
2418
2419 if (parse_rxsc_config(attrs, tb_rxsc))
2420 return -EINVAL;
2421
2422 if (parse_sa_config(attrs, tb_sa))
2423 return -EINVAL;
2424
2425 if (!validate_upd_sa(tb_sa))
2426 return -EINVAL;
2427
2428 rtnl_lock();
2429 rx_sa = get_rxsa_from_nl(genl_info_net(info), attrs, tb_rxsc, tb_sa,
2430 &dev, &secy, &rx_sc, &assoc_num);
2431 if (IS_ERR(rx_sa)) {
2432 rtnl_unlock();
2433 return PTR_ERR(rx_sa);
2434 }
2435
2436 if (tb_sa[MACSEC_SA_ATTR_PN]) {
48ef50fa
EM		 2437 int pn_len;
2438
2439 pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;
2440 if (nla_len(tb_sa[MACSEC_SA_ATTR_PN]) != pn_len) {
2441 pr_notice("macsec: nl: upd_rxsa: bad pn length: %d != %d\n",
2442 nla_len(tb_sa[MACSEC_SA_ATTR_PN]), pn_len);
2443 rtnl_unlock();
2444 return -EINVAL;
2445 }
2446
c09440f7 2447 spin_lock_bh(&rx_sa->lock);
a21ecf0e 2448 prev_pn = rx_sa->next_pn_halves;
48ef50fa 2449 rx_sa->next_pn = nla_get_u64(tb_sa[MACSEC_SA_ATTR_PN]);
c09440f7
SD		 2450 spin_unlock_bh(&rx_sa->lock);
2451 }
2452
3cf3227a 2453 was_active = rx_sa->active;
c09440f7
SD		 2454 if (tb_sa[MACSEC_SA_ATTR_ACTIVE])
2455 rx_sa->active = nla_get_u8(tb_sa[MACSEC_SA_ATTR_ACTIVE]);
2456
3cf3227a
AT		 2457 /* If h/w offloading is available, propagate to the device */
2458 if (macsec_is_offloaded(netdev_priv(dev))) {
2459 const struct macsec_ops *ops;
2460 struct macsec_context ctx;
2461
2462 ops = macsec_get_ops(netdev_priv(dev), &ctx);
2463 if (!ops) {
2464 ret = -EOPNOTSUPP;
2465 goto cleanup;
2466 }
2467
2468 ctx.sa.assoc_num = assoc_num;
2469 ctx.sa.rx_sa = rx_sa;
182879f8 2470 ctx.secy = secy;
3cf3227a
AT		 2471
2472 ret = macsec_offload(ops->mdo_upd_rxsa, &ctx);
2473 if (ret)
2474 goto cleanup;
2475 }
2476
c09440f7
SD		 2477 rtnl_unlock();
2478 return 0;
3cf3227a
AT		 2479
2480cleanup:
2481 if (tb_sa[MACSEC_SA_ATTR_PN]) {
2482 spin_lock_bh(&rx_sa->lock);
a21ecf0e 2483 rx_sa->next_pn_halves = prev_pn;
3cf3227a
AT		 2484 spin_unlock_bh(&rx_sa->lock);
2485 }
2486 rx_sa->active = was_active;
2487 rtnl_unlock();
2488 return ret;
c09440f7
SD		 2489}
2490
2491static int macsec_upd_rxsc(struct sk_buff *skb, struct genl_info *info)
2492{
2493 struct nlattr **attrs = info->attrs;
2494 struct net_device *dev;
2495 struct macsec_secy *secy;
2496 struct macsec_rx_sc *rx_sc;
2497 struct nlattr *tb_rxsc[MACSEC_RXSC_ATTR_MAX + 1];
3cf3227a
AT		 2498 unsigned int prev_n_rx_sc;
2499 bool was_active;
2500 int ret;
c09440f7
SD		 2501
2502 if (!attrs[MACSEC_ATTR_IFINDEX])
2503 return -EINVAL;
2504
2505 if (parse_rxsc_config(attrs, tb_rxsc))
2506 return -EINVAL;
2507
2508 if (!validate_add_rxsc(tb_rxsc))
2509 return -EINVAL;
2510
2511 rtnl_lock();
2512 rx_sc = get_rxsc_from_nl(genl_info_net(info), attrs, tb_rxsc, &dev, &secy);
2513 if (IS_ERR(rx_sc)) {
2514 rtnl_unlock();
2515 return PTR_ERR(rx_sc);
2516 }
2517
3cf3227a
AT		 2518 was_active = rx_sc->active;
2519 prev_n_rx_sc = secy->n_rx_sc;
c09440f7
SD		 2520 if (tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE]) {
2521 bool new = !!nla_get_u8(tb_rxsc[MACSEC_RXSC_ATTR_ACTIVE]);
2522
2523 if (rx_sc->active != new)
2524 secy->n_rx_sc += new ? 1 : -1;
2525
2526 rx_sc->active = new;
2527 }
2528
3cf3227a
AT		 2529 /* If h/w offloading is available, propagate to the device */
2530 if (macsec_is_offloaded(netdev_priv(dev))) {
2531 const struct macsec_ops *ops;
2532 struct macsec_context ctx;
2533
2534 ops = macsec_get_ops(netdev_priv(dev), &ctx);
2535 if (!ops) {
2536 ret = -EOPNOTSUPP;
2537 goto cleanup;
2538 }
2539
2540 ctx.rx_sc = rx_sc;
182879f8 2541 ctx.secy = secy;
3cf3227a
AT		 2542
2543 ret = macsec_offload(ops->mdo_upd_rxsc, &ctx);
2544 if (ret)
2545 goto cleanup;
2546 }
2547
c09440f7
SD		 2548 rtnl_unlock();
2549
2550 return 0;
3cf3227a
AT		 2551
2552cleanup:
2553 secy->n_rx_sc = prev_n_rx_sc;
2554 rx_sc->active = was_active;
2555 rtnl_unlock();
2556 return ret;
c09440f7
SD		 2557}
2558
dcb780fb
AT		 2559static bool macsec_is_configured(struct macsec_dev *macsec)
2560{
2561 struct macsec_secy *secy = &macsec->secy;
2562 struct macsec_tx_sc *tx_sc = &secy->tx_sc;
2563 int i;
2564
2565 if (secy->n_rx_sc > 0)
2566 return true;
2567
2568 for (i = 0; i < MACSEC_NUM_AN; i++)
2569 if (tx_sc->sa[i])
2570 return true;
2571
2572 return false;
2573}
2574
2575static int macsec_upd_offload(struct sk_buff *skb, struct genl_info *info)
2576{
2577 struct nlattr *tb_offload[MACSEC_OFFLOAD_ATTR_MAX + 1];
2578 enum macsec_offload offload, prev_offload;
2579 int (*func)(struct macsec_context *ctx);
2580 struct nlattr **attrs = info->attrs;
a249f805 2581 struct net_device *dev;
dcb780fb
AT		 2582 const struct macsec_ops *ops;
2583 struct macsec_context ctx;
2584 struct macsec_dev *macsec;
dcb780fb
AT		 2585 int ret;
2586
2587 if (!attrs[MACSEC_ATTR_IFINDEX])
2588 return -EINVAL;
2589
2590 if (!attrs[MACSEC_ATTR_OFFLOAD])
2591 return -EINVAL;
2592
2593 if (nla_parse_nested_deprecated(tb_offload, MACSEC_OFFLOAD_ATTR_MAX,
2594 attrs[MACSEC_ATTR_OFFLOAD],
2595 macsec_genl_offload_policy, NULL))
2596 return -EINVAL;
2597
2598 dev = get_dev_from_nl(genl_info_net(info), attrs);
2599 if (IS_ERR(dev))
2600 return PTR_ERR(dev);
2601 macsec = macsec_priv(dev);
2602
aa81700c
DC		 2603 if (!tb_offload[MACSEC_OFFLOAD_ATTR_TYPE])
2604 return -EINVAL;
2605
dcb780fb
AT		 2606 offload = nla_get_u8(tb_offload[MACSEC_OFFLOAD_ATTR_TYPE]);
2607 if (macsec->offload == offload)
2608 return 0;
2609
2610 /* Check if the offloading mode is supported by the underlying layers */
2611 if (offload != MACSEC_OFFLOAD_OFF &&
2612 !macsec_check_offload(offload, macsec))
2613 return -EOPNOTSUPP;
2614
dcb780fb
AT		 2615 /* Check if the net device is busy. */
2616 if (netif_running(dev))
2617 return -EBUSY;
2618
2619 rtnl_lock();
2620
2621 prev_offload = macsec->offload;
2622 macsec->offload = offload;
2623
2624 /* Check if the device already has rules configured: we do not support
2625 * rules migration.
2626 */
2627 if (macsec_is_configured(macsec)) {
2628 ret = -EBUSY;
2629 goto rollback;
2630 }
2631
2632 ops = __macsec_get_ops(offload == MACSEC_OFFLOAD_OFF ? prev_offload : offload,
2633 macsec, &ctx);
2634 if (!ops) {
2635 ret = -EOPNOTSUPP;
2636 goto rollback;
2637 }
2638
2639 if (prev_offload == MACSEC_OFFLOAD_OFF)
2640 func = ops->mdo_add_secy;
2641 else
2642 func = ops->mdo_del_secy;
2643
2644 ctx.secy = &macsec->secy;
2645 ret = macsec_offload(func, &ctx);
2646 if (ret)
2647 goto rollback;
2648
c850240b
MS		 2649 /* Force features update, since they are different for SW MACSec and
2650 * HW offloading cases.
2651 */
2652 netdev_update_features(dev);
29ca3cdf
AT		 2653
2654 rtnl_unlock();
dcb780fb
AT		 2655 return 0;
2656
2657rollback:
2658 macsec->offload = prev_offload;
2659
2660 rtnl_unlock();
2661 return ret;
2662}
2663
b62c3624
DB		 2664static void get_tx_sa_stats(struct net_device *dev, int an,
2665 struct macsec_tx_sa *tx_sa,
2666 struct macsec_tx_sa_stats *sum)
c09440f7 2667{
b62c3624 2668 struct macsec_dev *macsec = macsec_priv(dev);
c09440f7
SD		 2669 int cpu;
2670
b62c3624
DB		 2671 /* If h/w offloading is available, propagate to the device */
2672 if (macsec_is_offloaded(macsec)) {
2673 const struct macsec_ops *ops;
2674 struct macsec_context ctx;
2675
2676 ops = macsec_get_ops(macsec, &ctx);
2677 if (ops) {
2678 ctx.sa.assoc_num = an;
2679 ctx.sa.tx_sa = tx_sa;
2680 ctx.stats.tx_sa_stats = sum;
2681 ctx.secy = &macsec_priv(dev)->secy;
2682 macsec_offload(ops->mdo_get_tx_sa_stats, &ctx);
2683 }
2684 return;
2685 }
2686
c09440f7 2687 for_each_possible_cpu(cpu) {
b62c3624
DB		 2688 const struct macsec_tx_sa_stats *stats =
2689 per_cpu_ptr(tx_sa->stats, cpu);
c09440f7 2690
b62c3624
DB		 2691 sum->OutPktsProtected += stats->OutPktsProtected;
2692 sum->OutPktsEncrypted += stats->OutPktsEncrypted;
c09440f7 2693 }
b62c3624 2694}
c09440f7 2695
b62c3624
DB		 2696static int copy_tx_sa_stats(struct sk_buff *skb, struct macsec_tx_sa_stats *sum)
2697{
2698 if (nla_put_u32(skb, MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED,
2699 sum->OutPktsProtected) ||
2700 nla_put_u32(skb, MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED,
2701 sum->OutPktsEncrypted))
c09440f7
SD		 2702 return -EMSGSIZE;
2703
2704 return 0;
2705}
2706
b62c3624
DB		 2707static void get_rx_sa_stats(struct net_device *dev,
2708 struct macsec_rx_sc *rx_sc, int an,
2709 struct macsec_rx_sa *rx_sa,
2710 struct macsec_rx_sa_stats *sum)
c09440f7 2711{
b62c3624 2712 struct macsec_dev *macsec = macsec_priv(dev);
c09440f7
SD		 2713 int cpu;
2714
b62c3624
DB		 2715 /* If h/w offloading is available, propagate to the device */
2716 if (macsec_is_offloaded(macsec)) {
2717 const struct macsec_ops *ops;
2718 struct macsec_context ctx;
2719
2720 ops = macsec_get_ops(macsec, &ctx);
2721 if (ops) {
2722 ctx.sa.assoc_num = an;
2723 ctx.sa.rx_sa = rx_sa;
2724 ctx.stats.rx_sa_stats = sum;
2725 ctx.secy = &macsec_priv(dev)->secy;
2726 ctx.rx_sc = rx_sc;
2727 macsec_offload(ops->mdo_get_rx_sa_stats, &ctx);
2728 }
2729 return;
2730 }
2731
c09440f7 2732 for_each_possible_cpu(cpu) {
b62c3624
DB		 2733 const struct macsec_rx_sa_stats *stats =
2734 per_cpu_ptr(rx_sa->stats, cpu);
c09440f7 2735
b62c3624
DB		 2736 sum->InPktsOK += stats->InPktsOK;
2737 sum->InPktsInvalid += stats->InPktsInvalid;
2738 sum->InPktsNotValid += stats->InPktsNotValid;
2739 sum->InPktsNotUsingSA += stats->InPktsNotUsingSA;
2740 sum->InPktsUnusedSA += stats->InPktsUnusedSA;
c09440f7 2741 }
b62c3624 2742}
c09440f7 2743
b62c3624
DB		 2744static int copy_rx_sa_stats(struct sk_buff *skb,
2745 struct macsec_rx_sa_stats *sum)
2746{
2747 if (nla_put_u32(skb, MACSEC_SA_STATS_ATTR_IN_PKTS_OK, sum->InPktsOK) ||
2748 nla_put_u32(skb, MACSEC_SA_STATS_ATTR_IN_PKTS_INVALID,
2749 sum->InPktsInvalid) ||
2750 nla_put_u32(skb, MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_VALID,
2751 sum->InPktsNotValid) ||
2752 nla_put_u32(skb, MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_USING_SA,
2753 sum->InPktsNotUsingSA) ||
2754 nla_put_u32(skb, MACSEC_SA_STATS_ATTR_IN_PKTS_UNUSED_SA,
2755 sum->InPktsUnusedSA))
c09440f7
SD		 2756 return -EMSGSIZE;
2757
2758 return 0;
2759}
2760
b62c3624
DB		 2761static void get_rx_sc_stats(struct net_device *dev,
2762 struct macsec_rx_sc *rx_sc,
2763 struct macsec_rx_sc_stats *sum)
c09440f7 2764{
b62c3624 2765 struct macsec_dev *macsec = macsec_priv(dev);
c09440f7
SD		 2766 int cpu;
2767
b62c3624
DB		 2768 /* If h/w offloading is available, propagate to the device */
2769 if (macsec_is_offloaded(macsec)) {
2770 const struct macsec_ops *ops;
2771 struct macsec_context ctx;
2772
2773 ops = macsec_get_ops(macsec, &ctx);
2774 if (ops) {
2775 ctx.stats.rx_sc_stats = sum;
2776 ctx.secy = &macsec_priv(dev)->secy;
2777 ctx.rx_sc = rx_sc;
2778 macsec_offload(ops->mdo_get_rx_sc_stats, &ctx);
2779 }
2780 return;
2781 }
2782
c09440f7
SD		 2783 for_each_possible_cpu(cpu) {
2784 const struct pcpu_rx_sc_stats *stats;
2785 struct macsec_rx_sc_stats tmp;
2786 unsigned int start;
2787
b62c3624 2788 stats = per_cpu_ptr(rx_sc->stats, cpu);
c09440f7
SD		 2789 do {
2790 start = u64_stats_fetch_begin_irq(&stats->syncp);
2791 memcpy(&tmp, &stats->stats, sizeof(tmp));
2792 } while (u64_stats_fetch_retry_irq(&stats->syncp, start));
2793
b62c3624
DB		 2794 sum->InOctetsValidated += tmp.InOctetsValidated;
2795 sum->InOctetsDecrypted += tmp.InOctetsDecrypted;
2796 sum->InPktsUnchecked += tmp.InPktsUnchecked;
2797 sum->InPktsDelayed += tmp.InPktsDelayed;
2798 sum->InPktsOK += tmp.InPktsOK;
2799 sum->InPktsInvalid += tmp.InPktsInvalid;
2800 sum->InPktsLate += tmp.InPktsLate;
2801 sum->InPktsNotValid += tmp.InPktsNotValid;
2802 sum->InPktsNotUsingSA += tmp.InPktsNotUsingSA;
2803 sum->InPktsUnusedSA += tmp.InPktsUnusedSA;
c09440f7 2804 }
b62c3624 2805}
c09440f7 2806
b62c3624
DB		 2807static int copy_rx_sc_stats(struct sk_buff *skb, struct macsec_rx_sc_stats *sum)
2808{
f60d94c0 2809 if (nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_OCTETS_VALIDATED,
b62c3624 2810 sum->InOctetsValidated,
f60d94c0
ND		 2811 MACSEC_RXSC_STATS_ATTR_PAD) ||
2812 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_OCTETS_DECRYPTED,
b62c3624 2813 sum->InOctetsDecrypted,
f60d94c0
ND		 2814 MACSEC_RXSC_STATS_ATTR_PAD) ||
2815 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNCHECKED,
b62c3624 2816 sum->InPktsUnchecked,
f60d94c0
ND		 2817 MACSEC_RXSC_STATS_ATTR_PAD) ||
2818 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_DELAYED,
b62c3624 2819 sum->InPktsDelayed,
f60d94c0
ND		 2820 MACSEC_RXSC_STATS_ATTR_PAD) ||
2821 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_OK,
b62c3624 2822 sum->InPktsOK,
f60d94c0
ND		 2823 MACSEC_RXSC_STATS_ATTR_PAD) ||
2824 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_INVALID,
b62c3624 2825 sum->InPktsInvalid,
f60d94c0
ND		 2826 MACSEC_RXSC_STATS_ATTR_PAD) ||
2827 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_LATE,
b62c3624 2828 sum->InPktsLate,
f60d94c0
ND		 2829 MACSEC_RXSC_STATS_ATTR_PAD) ||
2830 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_VALID,
b62c3624 2831 sum->InPktsNotValid,
f60d94c0
ND		 2832 MACSEC_RXSC_STATS_ATTR_PAD) ||
2833 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_USING_SA,
b62c3624 2834 sum->InPktsNotUsingSA,
f60d94c0
ND		 2835 MACSEC_RXSC_STATS_ATTR_PAD) ||
2836 nla_put_u64_64bit(skb, MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNUSED_SA,
b62c3624 2837 sum->InPktsUnusedSA,
f60d94c0 2838 MACSEC_RXSC_STATS_ATTR_PAD))
c09440f7
SD		 2839 return -EMSGSIZE;
2840
2841 return 0;
2842}
2843
b62c3624
DB		 2844static void get_tx_sc_stats(struct net_device *dev,
2845 struct macsec_tx_sc_stats *sum)
c09440f7 2846{
b62c3624 2847 struct macsec_dev *macsec = macsec_priv(dev);
c09440f7
SD		 2848 int cpu;
2849
b62c3624
DB		 2850 /* If h/w offloading is available, propagate to the device */
2851 if (macsec_is_offloaded(macsec)) {
2852 const struct macsec_ops *ops;
2853 struct macsec_context ctx;
2854
2855 ops = macsec_get_ops(macsec, &ctx);
2856 if (ops) {
2857 ctx.stats.tx_sc_stats = sum;
2858 ctx.secy = &macsec_priv(dev)->secy;
2859 macsec_offload(ops->mdo_get_tx_sc_stats, &ctx);
2860 }
2861 return;
2862 }
2863
c09440f7
SD		 2864 for_each_possible_cpu(cpu) {
2865 const struct pcpu_tx_sc_stats *stats;
2866 struct macsec_tx_sc_stats tmp;
2867 unsigned int start;
2868
b62c3624 2869 stats = per_cpu_ptr(macsec_priv(dev)->secy.tx_sc.stats, cpu);
c09440f7
SD		 2870 do {
2871 start = u64_stats_fetch_begin_irq(&stats->syncp);
2872 memcpy(&tmp, &stats->stats, sizeof(tmp));
2873 } while (u64_stats_fetch_retry_irq(&stats->syncp, start));
2874
b62c3624
DB		 2875 sum->OutPktsProtected += tmp.OutPktsProtected;
2876 sum->OutPktsEncrypted += tmp.OutPktsEncrypted;
2877 sum->OutOctetsProtected += tmp.OutOctetsProtected;
2878 sum->OutOctetsEncrypted += tmp.OutOctetsEncrypted;
c09440f7 2879 }
b62c3624 2880}
c09440f7 2881
b62c3624
DB		 2882static int copy_tx_sc_stats(struct sk_buff *skb, struct macsec_tx_sc_stats *sum)
2883{
f60d94c0 2884 if (nla_put_u64_64bit(skb, MACSEC_TXSC_STATS_ATTR_OUT_PKTS_PROTECTED,
b62c3624 2885 sum->OutPktsProtected,
f60d94c0
ND		 2886 MACSEC_TXSC_STATS_ATTR_PAD) ||
2887 nla_put_u64_64bit(skb, MACSEC_TXSC_STATS_ATTR_OUT_PKTS_ENCRYPTED,
b62c3624 2888 sum->OutPktsEncrypted,
f60d94c0
ND		 2889 MACSEC_TXSC_STATS_ATTR_PAD) ||
2890 nla_put_u64_64bit(skb, MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_PROTECTED,
b62c3624 2891 sum->OutOctetsProtected,
f60d94c0
ND		 2892 MACSEC_TXSC_STATS_ATTR_PAD) ||
2893 nla_put_u64_64bit(skb, MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_ENCRYPTED,
b62c3624 2894 sum->OutOctetsEncrypted,
f60d94c0 2895 MACSEC_TXSC_STATS_ATTR_PAD))
c09440f7
SD		 2896 return -EMSGSIZE;
2897
2898 return 0;
2899}
2900
b62c3624 2901static void get_secy_stats(struct net_device *dev, struct macsec_dev_stats *sum)
c09440f7 2902{
b62c3624 2903 struct macsec_dev *macsec = macsec_priv(dev);
c09440f7
SD		 2904 int cpu;
2905
b62c3624
DB		 2906 /* If h/w offloading is available, propagate to the device */
2907 if (macsec_is_offloaded(macsec)) {
2908 const struct macsec_ops *ops;
2909 struct macsec_context ctx;
2910
2911 ops = macsec_get_ops(macsec, &ctx);
2912 if (ops) {
2913 ctx.stats.dev_stats = sum;
2914 ctx.secy = &macsec_priv(dev)->secy;
2915 macsec_offload(ops->mdo_get_dev_stats, &ctx);
2916 }
2917 return;
2918 }
2919
c09440f7
SD		 2920 for_each_possible_cpu(cpu) {
2921 const struct pcpu_secy_stats *stats;
2922 struct macsec_dev_stats tmp;
2923 unsigned int start;
2924
b62c3624 2925 stats = per_cpu_ptr(macsec_priv(dev)->stats, cpu);
c09440f7
SD		 2926 do {
2927 start = u64_stats_fetch_begin_irq(&stats->syncp);
2928 memcpy(&tmp, &stats->stats, sizeof(tmp));
2929 } while (u64_stats_fetch_retry_irq(&stats->syncp, start));
2930
b62c3624
DB		 2931 sum->OutPktsUntagged += tmp.OutPktsUntagged;
2932 sum->InPktsUntagged += tmp.InPktsUntagged;
2933 sum->OutPktsTooLong += tmp.OutPktsTooLong;
2934 sum->InPktsNoTag += tmp.InPktsNoTag;
2935 sum->InPktsBadTag += tmp.InPktsBadTag;
2936 sum->InPktsUnknownSCI += tmp.InPktsUnknownSCI;
2937 sum->InPktsNoSCI += tmp.InPktsNoSCI;
2938 sum->InPktsOverrun += tmp.InPktsOverrun;
c09440f7 2939 }
b62c3624 2940}
c09440f7 2941
b62c3624
DB		 2942static int copy_secy_stats(struct sk_buff *skb, struct macsec_dev_stats *sum)
2943{
f60d94c0 2944 if (nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_OUT_PKTS_UNTAGGED,
b62c3624 2945 sum->OutPktsUntagged,
f60d94c0
ND		 2946 MACSEC_SECY_STATS_ATTR_PAD) ||
2947 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_UNTAGGED,
b62c3624 2948 sum->InPktsUntagged,
f60d94c0
ND		 2949 MACSEC_SECY_STATS_ATTR_PAD) ||
2950 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_OUT_PKTS_TOO_LONG,
b62c3624 2951 sum->OutPktsTooLong,
f60d94c0
ND		 2952 MACSEC_SECY_STATS_ATTR_PAD) ||
2953 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_TAG,
b62c3624 2954 sum->InPktsNoTag,
f60d94c0
ND		 2955 MACSEC_SECY_STATS_ATTR_PAD) ||
2956 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_BAD_TAG,
b62c3624 2957 sum->InPktsBadTag,
f60d94c0
ND		 2958 MACSEC_SECY_STATS_ATTR_PAD) ||
2959 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_UNKNOWN_SCI,
b62c3624 2960 sum->InPktsUnknownSCI,
f60d94c0
ND		 2961 MACSEC_SECY_STATS_ATTR_PAD) ||
2962 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_SCI,
b62c3624 2963 sum->InPktsNoSCI,
f60d94c0
ND		 2964 MACSEC_SECY_STATS_ATTR_PAD) ||
2965 nla_put_u64_64bit(skb, MACSEC_SECY_STATS_ATTR_IN_PKTS_OVERRUN,
b62c3624 2966 sum->InPktsOverrun,
f60d94c0 2967 MACSEC_SECY_STATS_ATTR_PAD))
c09440f7
SD		 2968 return -EMSGSIZE;
2969
2970 return 0;
2971}
2972
2973static int nla_put_secy(struct macsec_secy *secy, struct sk_buff *skb)
2974{
2975 struct macsec_tx_sc *tx_sc = &secy->tx_sc;
ae0be8de
MK		 2976 struct nlattr *secy_nest = nla_nest_start_noflag(skb,
2977 MACSEC_ATTR_SECY);
ccfdec90 2978 u64 csid;
c09440f7
SD		 2979
2980 if (!secy_nest)
2981 return 1;
2982
ccfdec90
FW		 2983 switch (secy->key_len) {
2984 case MACSEC_GCM_AES_128_SAK_LEN:
48ef50fa 2985 csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_128 : MACSEC_DEFAULT_CIPHER_ID;
ccfdec90
FW		 2986 break;
2987 case MACSEC_GCM_AES_256_SAK_LEN:
48ef50fa 2988 csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_256 : MACSEC_CIPHER_ID_GCM_AES_256;
ccfdec90
FW		 2989 break;
2990 default:
2991 goto cancel;
2992 }
2993
f60d94c0
ND		 2994 if (nla_put_sci(skb, MACSEC_SECY_ATTR_SCI, secy->sci,
2995 MACSEC_SECY_ATTR_PAD) ||
2996 nla_put_u64_64bit(skb, MACSEC_SECY_ATTR_CIPHER_SUITE,
ccfdec90 2997 csid, MACSEC_SECY_ATTR_PAD) ||
c09440f7
SD		 2998 nla_put_u8(skb, MACSEC_SECY_ATTR_ICV_LEN, secy->icv_len) ||
2999 nla_put_u8(skb, MACSEC_SECY_ATTR_OPER, secy->operational) ||
3000 nla_put_u8(skb, MACSEC_SECY_ATTR_PROTECT, secy->protect_frames) ||
3001 nla_put_u8(skb, MACSEC_SECY_ATTR_REPLAY, secy->replay_protect) ||
3002 nla_put_u8(skb, MACSEC_SECY_ATTR_VALIDATE, secy->validate_frames) ||
3003 nla_put_u8(skb, MACSEC_SECY_ATTR_ENCRYPT, tx_sc->encrypt) ||
3004 nla_put_u8(skb, MACSEC_SECY_ATTR_INC_SCI, tx_sc->send_sci) ||
3005 nla_put_u8(skb, MACSEC_SECY_ATTR_ES, tx_sc->end_station) ||
3006 nla_put_u8(skb, MACSEC_SECY_ATTR_SCB, tx_sc->scb) ||
3007 nla_put_u8(skb, MACSEC_SECY_ATTR_ENCODING_SA, tx_sc->encoding_sa))
3008 goto cancel;
3009
3010 if (secy->replay_protect) {
3011 if (nla_put_u32(skb, MACSEC_SECY_ATTR_WINDOW, secy->replay_window))
3012 goto cancel;
3013 }
3014
3015 nla_nest_end(skb, secy_nest);
3016 return 0;
3017
3018cancel:
3019 nla_nest_cancel(skb, secy_nest);
3020 return 1;
3021}
3022
e1427237
FW		 3023static noinline_for_stack int
3024dump_secy(struct macsec_secy *secy, struct net_device *dev,
3025 struct sk_buff *skb, struct netlink_callback *cb)
c09440f7 3026{
b62c3624
DB		 3027 struct macsec_tx_sc_stats tx_sc_stats = {0, };
3028 struct macsec_tx_sa_stats tx_sa_stats = {0, };
3029 struct macsec_rx_sc_stats rx_sc_stats = {0, };
3030 struct macsec_rx_sa_stats rx_sa_stats = {0, };
dcb780fb 3031 struct macsec_dev *macsec = netdev_priv(dev);
b62c3624 3032 struct macsec_dev_stats dev_stats = {0, };
c09440f7
SD		 3033 struct macsec_tx_sc *tx_sc = &secy->tx_sc;
3034 struct nlattr *txsa_list, *rxsc_list;
dcb780fb 3035 struct macsec_rx_sc *rx_sc;
c09440f7 3036 struct nlattr *attr;
dcb780fb
AT		 3037 void *hdr;
3038 int i, j;
c09440f7
SD		 3039
3040 hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
3041 &macsec_fam, NLM_F_MULTI, MACSEC_CMD_GET_TXSC);
3042 if (!hdr)
3043 return -EMSGSIZE;
3044
0a833c29 3045 genl_dump_check_consistent(cb, hdr);
c09440f7
SD		 3046
3047 if (nla_put_u32(skb, MACSEC_ATTR_IFINDEX, dev->ifindex))
3048 goto nla_put_failure;
3049
dcb780fb
AT		 3050 attr = nla_nest_start_noflag(skb, MACSEC_ATTR_OFFLOAD);
3051 if (!attr)
3052 goto nla_put_failure;
3053 if (nla_put_u8(skb, MACSEC_OFFLOAD_ATTR_TYPE, macsec->offload))
3054 goto nla_put_failure;
3055 nla_nest_end(skb, attr);
3056
c09440f7
SD		 3057 if (nla_put_secy(secy, skb))
3058 goto nla_put_failure;
3059
ae0be8de 3060 attr = nla_nest_start_noflag(skb, MACSEC_ATTR_TXSC_STATS);
c09440f7
SD		 3061 if (!attr)
3062 goto nla_put_failure;
b62c3624
DB		 3063
3064 get_tx_sc_stats(dev, &tx_sc_stats);
3065 if (copy_tx_sc_stats(skb, &tx_sc_stats)) {
c09440f7
SD		 3066 nla_nest_cancel(skb, attr);
3067 goto nla_put_failure;
3068 }
3069 nla_nest_end(skb, attr);
3070
ae0be8de 3071 attr = nla_nest_start_noflag(skb, MACSEC_ATTR_SECY_STATS);
c09440f7
SD		 3072 if (!attr)
3073 goto nla_put_failure;
b62c3624
DB		 3074 get_secy_stats(dev, &dev_stats);
3075 if (copy_secy_stats(skb, &dev_stats)) {
c09440f7
SD		 3076 nla_nest_cancel(skb, attr);
3077 goto nla_put_failure;
3078 }
3079 nla_nest_end(skb, attr);
3080
ae0be8de 3081 txsa_list = nla_nest_start_noflag(skb, MACSEC_ATTR_TXSA_LIST);
c09440f7
SD		 3082 if (!txsa_list)
3083 goto nla_put_failure;
3084 for (i = 0, j = 1; i < MACSEC_NUM_AN; i++) {
3085 struct macsec_tx_sa *tx_sa = rtnl_dereference(tx_sc->sa[i]);
3086 struct nlattr *txsa_nest;
48ef50fa
EM		 3087 u64 pn;
3088 int pn_len;
c09440f7
SD		 3089
3090 if (!tx_sa)
3091 continue;
3092
ae0be8de 3093 txsa_nest = nla_nest_start_noflag(skb, j++);
c09440f7
SD		 3094 if (!txsa_nest) {
3095 nla_nest_cancel(skb, txsa_list);
3096 goto nla_put_failure;
3097 }
3098
b62c3624
DB		 3099 attr = nla_nest_start_noflag(skb, MACSEC_SA_ATTR_STATS);
3100 if (!attr) {
3101 nla_nest_cancel(skb, txsa_nest);
3102 nla_nest_cancel(skb, txsa_list);
3103 goto nla_put_failure;
3104 }
3105 memset(&tx_sa_stats, 0, sizeof(tx_sa_stats));
3106 get_tx_sa_stats(dev, i, tx_sa, &tx_sa_stats);
3107 if (copy_tx_sa_stats(skb, &tx_sa_stats)) {
3108 nla_nest_cancel(skb, attr);
3109 nla_nest_cancel(skb, txsa_nest);
3110 nla_nest_cancel(skb, txsa_list);
3111 goto nla_put_failure;
3112 }
3113 nla_nest_end(skb, attr);
3114
48ef50fa
EM		 3115 if (secy->xpn) {
3116 pn = tx_sa->next_pn;
3117 pn_len = MACSEC_XPN_PN_LEN;
3118 } else {
3119 pn = tx_sa->next_pn_halves.lower;
3120 pn_len = MACSEC_DEFAULT_PN_LEN;
3121 }
3122
c09440f7 3123 if (nla_put_u8(skb, MACSEC_SA_ATTR_AN, i) ||
48ef50fa 3124 nla_put(skb, MACSEC_SA_ATTR_PN, pn_len, &pn) ||
8acca6ac 3125 nla_put(skb, MACSEC_SA_ATTR_KEYID, MACSEC_KEYID_LEN, tx_sa->key.id) ||
48ef50fa 3126 (secy->xpn && nla_put_ssci(skb, MACSEC_SA_ATTR_SSCI, tx_sa->ssci)) ||
c09440f7
SD		 3127 nla_put_u8(skb, MACSEC_SA_ATTR_ACTIVE, tx_sa->active)) {
3128 nla_nest_cancel(skb, txsa_nest);
3129 nla_nest_cancel(skb, txsa_list);
3130 goto nla_put_failure;
3131 }
3132
c09440f7
SD		 3133 nla_nest_end(skb, txsa_nest);
3134 }
3135 nla_nest_end(skb, txsa_list);
3136
ae0be8de 3137 rxsc_list = nla_nest_start_noflag(skb, MACSEC_ATTR_RXSC_LIST);
c09440f7
SD		 3138 if (!rxsc_list)
3139 goto nla_put_failure;
3140
3141 j = 1;
3142 for_each_rxsc_rtnl(secy, rx_sc) {
3143 int k;
3144 struct nlattr *rxsa_list;
ae0be8de 3145 struct nlattr *rxsc_nest = nla_nest_start_noflag(skb, j++);
c09440f7
SD		 3146
3147 if (!rxsc_nest) {
3148 nla_nest_cancel(skb, rxsc_list);
3149 goto nla_put_failure;
3150 }
3151
3152 if (nla_put_u8(skb, MACSEC_RXSC_ATTR_ACTIVE, rx_sc->active) ||
f60d94c0
ND		 3153 nla_put_sci(skb, MACSEC_RXSC_ATTR_SCI, rx_sc->sci,
3154 MACSEC_RXSC_ATTR_PAD)) {
c09440f7
SD		 3155 nla_nest_cancel(skb, rxsc_nest);
3156 nla_nest_cancel(skb, rxsc_list);
3157 goto nla_put_failure;
3158 }
3159
ae0be8de 3160 attr = nla_nest_start_noflag(skb, MACSEC_RXSC_ATTR_STATS);
c09440f7
SD		 3161 if (!attr) {
3162 nla_nest_cancel(skb, rxsc_nest);
3163 nla_nest_cancel(skb, rxsc_list);
3164 goto nla_put_failure;
3165 }
b62c3624
DB		 3166 memset(&rx_sc_stats, 0, sizeof(rx_sc_stats));
3167 get_rx_sc_stats(dev, rx_sc, &rx_sc_stats);
3168 if (copy_rx_sc_stats(skb, &rx_sc_stats)) {
c09440f7
SD		 3169 nla_nest_cancel(skb, attr);
3170 nla_nest_cancel(skb, rxsc_nest);
3171 nla_nest_cancel(skb, rxsc_list);
3172 goto nla_put_failure;
3173 }
3174 nla_nest_end(skb, attr);
3175
ae0be8de
MK		 3176 rxsa_list = nla_nest_start_noflag(skb,
3177 MACSEC_RXSC_ATTR_SA_LIST);
c09440f7
SD		 3178 if (!rxsa_list) {
3179 nla_nest_cancel(skb, rxsc_nest);
3180 nla_nest_cancel(skb, rxsc_list);
3181 goto nla_put_failure;
3182 }
3183
3184 for (i = 0, k = 1; i < MACSEC_NUM_AN; i++) {
3185 struct macsec_rx_sa *rx_sa = rtnl_dereference(rx_sc->sa[i]);
3186 struct nlattr *rxsa_nest;
48ef50fa
EM		 3187 u64 pn;
3188 int pn_len;
c09440f7
SD		 3189
3190 if (!rx_sa)
3191 continue;
3192
ae0be8de 3193 rxsa_nest = nla_nest_start_noflag(skb, k++);
c09440f7
SD		 3194 if (!rxsa_nest) {
3195 nla_nest_cancel(skb, rxsa_list);
3196 nla_nest_cancel(skb, rxsc_nest);
3197 nla_nest_cancel(skb, rxsc_list);
3198 goto nla_put_failure;
3199 }
3200
ae0be8de
MK		 3201 attr = nla_nest_start_noflag(skb,
3202 MACSEC_SA_ATTR_STATS);
c09440f7
SD		 3203 if (!attr) {
3204 nla_nest_cancel(skb, rxsa_list);
3205 nla_nest_cancel(skb, rxsc_nest);
3206 nla_nest_cancel(skb, rxsc_list);
3207 goto nla_put_failure;
3208 }
b62c3624
DB		 3209 memset(&rx_sa_stats, 0, sizeof(rx_sa_stats));
3210 get_rx_sa_stats(dev, rx_sc, i, rx_sa, &rx_sa_stats);
3211 if (copy_rx_sa_stats(skb, &rx_sa_stats)) {
c09440f7
SD		 3212 nla_nest_cancel(skb, attr);
3213 nla_nest_cancel(skb, rxsa_list);
3214 nla_nest_cancel(skb, rxsc_nest);
3215 nla_nest_cancel(skb, rxsc_list);
3216 goto nla_put_failure;
3217 }
3218 nla_nest_end(skb, attr);
3219
48ef50fa
EM		 3220 if (secy->xpn) {
3221 pn = rx_sa->next_pn;
3222 pn_len = MACSEC_XPN_PN_LEN;
3223 } else {
3224 pn = rx_sa->next_pn_halves.lower;
3225 pn_len = MACSEC_DEFAULT_PN_LEN;
3226 }
3227
c09440f7 3228 if (nla_put_u8(skb, MACSEC_SA_ATTR_AN, i) ||
48ef50fa 3229 nla_put(skb, MACSEC_SA_ATTR_PN, pn_len, &pn) ||
8acca6ac 3230 nla_put(skb, MACSEC_SA_ATTR_KEYID, MACSEC_KEYID_LEN, rx_sa->key.id) ||
48ef50fa 3231 (secy->xpn && nla_put_ssci(skb, MACSEC_SA_ATTR_SSCI, rx_sa->ssci)) ||
c09440f7
SD		 3232 nla_put_u8(skb, MACSEC_SA_ATTR_ACTIVE, rx_sa->active)) {
3233 nla_nest_cancel(skb, rxsa_nest);
3234 nla_nest_cancel(skb, rxsc_nest);
3235 nla_nest_cancel(skb, rxsc_list);
3236 goto nla_put_failure;
3237 }
3238 nla_nest_end(skb, rxsa_nest);
3239 }
3240
3241 nla_nest_end(skb, rxsa_list);
3242 nla_nest_end(skb, rxsc_nest);
3243 }
3244
3245 nla_nest_end(skb, rxsc_list);
3246
c09440f7
SD		 3247 genlmsg_end(skb, hdr);
3248
3249 return 0;
3250
3251nla_put_failure:
c09440f7
SD		 3252 genlmsg_cancel(skb, hdr);
3253 return -EMSGSIZE;
3254}
3255
96cfc505
SD		 3256static int macsec_generation = 1; /* protected by RTNL */
3257
c09440f7
SD		 3258static int macsec_dump_txsc(struct sk_buff *skb, struct netlink_callback *cb)
3259{
3260 struct net *net = sock_net(skb->sk);
3261 struct net_device *dev;
3262 int dev_idx, d;
3263
3264 dev_idx = cb->args[0];
3265
3266 d = 0;
c10c63ea 3267 rtnl_lock();
96cfc505
SD		 3268
3269 cb->seq = macsec_generation;
3270
c09440f7
SD		 3271 for_each_netdev(net, dev) {
3272 struct macsec_secy *secy;
3273
3274 if (d < dev_idx)
3275 goto next;
3276
3277 if (!netif_is_macsec(dev))
3278 goto next;
3279
3280 secy = &macsec_priv(dev)->secy;
3281 if (dump_secy(secy, dev, skb, cb) < 0)
3282 goto done;
3283next:
3284 d++;
3285 }
3286
3287done:
c10c63ea 3288 rtnl_unlock();
c09440f7
SD		 3289 cb->args[0] = d;
3290 return skb->len;
3291}
3292
66a9b928 3293static const struct genl_small_ops macsec_genl_ops[] = {
c09440f7
SD		 3294 {
3295 .cmd = MACSEC_CMD_GET_TXSC,
ef6243ac 3296 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
c09440f7 3297 .dumpit = macsec_dump_txsc,
c09440f7
SD		 3298 },
3299 {
3300 .cmd = MACSEC_CMD_ADD_RXSC,
ef6243ac 3301 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
c09440f7 3302 .doit = macsec_add_rxsc,
c09440f7
SD		 3303 .flags = GENL_ADMIN_PERM,
3304 },
3305 {
3306 .cmd = MACSEC_CMD_DEL_RXSC,
ef6243ac 3307 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
c09440f7 3308 .doit = macsec_del_rxsc,
c09440f7
SD		 3309 .flags = GENL_ADMIN_PERM,
3310 },
3311 {
3312 .cmd = MACSEC_CMD_UPD_RXSC,
ef6243ac 3313 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
c09440f7 3314 .doit = macsec_upd_rxsc,
c09440f7
SD		 3315 .flags = GENL_ADMIN_PERM,
3316 },
3317 {
3318 .cmd = MACSEC_CMD_ADD_TXSA,
ef6243ac 3319 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
c09440f7 3320 .doit = macsec_add_txsa,
c09440f7
SD		 3321 .flags = GENL_ADMIN_PERM,
3322 },
3323 {
3324 .cmd = MACSEC_CMD_DEL_TXSA,
ef6243ac 3325 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
c09440f7 3326 .doit = macsec_del_txsa,
c09440f7
SD		 3327 .flags = GENL_ADMIN_PERM,
3328 },
3329 {
3330 .cmd = MACSEC_CMD_UPD_TXSA,
ef6243ac 3331 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
c09440f7 3332 .doit = macsec_upd_txsa,
c09440f7
SD		 3333 .flags = GENL_ADMIN_PERM,
3334 },
3335 {
3336 .cmd = MACSEC_CMD_ADD_RXSA,
ef6243ac 3337 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
c09440f7 3338 .doit = macsec_add_rxsa,
c09440f7
SD		 3339 .flags = GENL_ADMIN_PERM,
3340 },
3341 {
3342 .cmd = MACSEC_CMD_DEL_RXSA,
ef6243ac 3343 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
c09440f7 3344 .doit = macsec_del_rxsa,
c09440f7
SD		 3345 .flags = GENL_ADMIN_PERM,
3346 },
3347 {
3348 .cmd = MACSEC_CMD_UPD_RXSA,
ef6243ac 3349 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
c09440f7 3350 .doit = macsec_upd_rxsa,
c09440f7
SD		 3351 .flags = GENL_ADMIN_PERM,
3352 },
dcb780fb
AT		 3353 {
3354 .cmd = MACSEC_CMD_UPD_OFFLOAD,
3355 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
3356 .doit = macsec_upd_offload,
3357 .flags = GENL_ADMIN_PERM,
3358 },
c09440f7
SD		 3359};
3360
56989f6d 3361static struct genl_family macsec_fam __ro_after_init = {
489111e5
JB		 3362 .name = MACSEC_GENL_NAME,
3363 .hdrsize = 0,
3364 .version = MACSEC_GENL_VERSION,
3365 .maxattr = MACSEC_ATTR_MAX,
3b0f31f2 3366 .policy = macsec_genl_policy,
489111e5
JB		 3367 .netnsok = true,
3368 .module = THIS_MODULE,
66a9b928
JK		 3369 .small_ops = macsec_genl_ops,
3370 .n_small_ops = ARRAY_SIZE(macsec_genl_ops),
489111e5
JB		 3371};
3372
c09440f7
SD		 3373static netdev_tx_t macsec_start_xmit(struct sk_buff *skb,
3374 struct net_device *dev)
3375{
3376 struct macsec_dev *macsec = netdev_priv(dev);
3377 struct macsec_secy *secy = &macsec->secy;
3378 struct pcpu_secy_stats *secy_stats;
3379 int ret, len;
3380
3cf3227a
AT		 3381 if (macsec_is_offloaded(netdev_priv(dev))) {
3382 skb->dev = macsec->real_dev;
3383 return dev_queue_xmit(skb);
3384 }
3385
c09440f7
SD		 3386 /* 10.5 */
3387 if (!secy->protect_frames) {
3388 secy_stats = this_cpu_ptr(macsec->stats);
3389 u64_stats_update_begin(&secy_stats->syncp);
3390 secy_stats->stats.OutPktsUntagged++;
3391 u64_stats_update_end(&secy_stats->syncp);
79c62220 3392 skb->dev = macsec->real_dev;
c09440f7
SD		 3393 len = skb->len;
3394 ret = dev_queue_xmit(skb);
3395 count_tx(dev, ret, len);
3396 return ret;
3397 }
3398
3399 if (!secy->operational) {
3400 kfree_skb(skb);
3401 dev->stats.tx_dropped++;
3402 return NETDEV_TX_OK;
3403 }
3404
3405 skb = macsec_encrypt(skb, dev);
3406 if (IS_ERR(skb)) {
3407 if (PTR_ERR(skb) != -EINPROGRESS)
3408 dev->stats.tx_dropped++;
3409 return NETDEV_TX_OK;
3410 }
3411
3412 macsec_count_tx(skb, &macsec->secy.tx_sc, macsec_skb_cb(skb)->tx_sa);
3413
3414 macsec_encrypt_finish(skb, dev);
3415 len = skb->len;
3416 ret = dev_queue_xmit(skb);
3417 count_tx(dev, ret, len);
3418 return ret;
3419}
3420
c850240b 3421#define SW_MACSEC_FEATURES \
c09440f7 3422 (NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST)
e2003872 3423
c850240b
MS		 3424/* If h/w offloading is enabled, use real device features save for
3425 * VLAN_FEATURES - they require additional ops
3426 * HW_MACSEC - no reason to report it
3427 */
3428#define REAL_DEV_FEATURES(dev) \
3429 ((dev)->features & ~(NETIF_F_VLAN_FEATURES | NETIF_F_HW_MACSEC))
3430
c09440f7
SD		 3431static int macsec_dev_init(struct net_device *dev)
3432{
3433 struct macsec_dev *macsec = macsec_priv(dev);
3434 struct net_device *real_dev = macsec->real_dev;
5491e7c6 3435 int err;
c09440f7
SD		 3436
3437 dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
3438 if (!dev->tstats)
3439 return -ENOMEM;
3440
5491e7c6
PA		 3441 err = gro_cells_init(&macsec->gro_cells, dev);
3442 if (err) {
3443 free_percpu(dev->tstats);
3444 return err;
3445 }
3446
c850240b
MS		 3447 if (macsec_is_offloaded(macsec)) {
3448 dev->features = REAL_DEV_FEATURES(real_dev);
3449 } else {
3450 dev->features = real_dev->features & SW_MACSEC_FEATURES;
3451 dev->features |= NETIF_F_LLTX | NETIF_F_GSO_SOFTWARE;
3452 }
c09440f7
SD		 3453
3454 dev->needed_headroom = real_dev->needed_headroom +
3455 MACSEC_NEEDED_HEADROOM;
3456 dev->needed_tailroom = real_dev->needed_tailroom +
3457 MACSEC_NEEDED_TAILROOM;
3458
3459 if (is_zero_ether_addr(dev->dev_addr))
3460 eth_hw_addr_inherit(dev, real_dev);
3461 if (is_zero_ether_addr(dev->broadcast))
3462 memcpy(dev->broadcast, real_dev->broadcast, dev->addr_len);
3463
3464 return 0;
3465}
3466
3467static void macsec_dev_uninit(struct net_device *dev)
3468{
5491e7c6
PA		 3469 struct macsec_dev *macsec = macsec_priv(dev);
3470
3471 gro_cells_destroy(&macsec->gro_cells);
c09440f7
SD		 3472 free_percpu(dev->tstats);
3473}
3474
3475static netdev_features_t macsec_fix_features(struct net_device *dev,
3476 netdev_features_t features)
3477{
3478 struct macsec_dev *macsec = macsec_priv(dev);
3479 struct net_device *real_dev = macsec->real_dev;
3480
c850240b
MS		 3481 if (macsec_is_offloaded(macsec))
3482 return REAL_DEV_FEATURES(real_dev);
3483
3484 features &= (real_dev->features & SW_MACSEC_FEATURES) |
5491e7c6
PA		 3485 NETIF_F_GSO_SOFTWARE | NETIF_F_SOFT_FEATURES;
3486 features |= NETIF_F_LLTX;
c09440f7
SD		 3487
3488 return features;
3489}
3490
3491static int macsec_dev_open(struct net_device *dev)
3492{
3493 struct macsec_dev *macsec = macsec_priv(dev);
3494 struct net_device *real_dev = macsec->real_dev;
3495 int err;
3496
c09440f7
SD		 3497 err = dev_uc_add(real_dev, dev->dev_addr);
3498 if (err < 0)
3499 return err;
3500
3501 if (dev->flags & IFF_ALLMULTI) {
3502 err = dev_set_allmulti(real_dev, 1);
3503 if (err < 0)
3504 goto del_unicast;
3505 }
3506
3507 if (dev->flags & IFF_PROMISC) {
3508 err = dev_set_promiscuity(real_dev, 1);
3509 if (err < 0)
3510 goto clear_allmulti;
3511 }
3512
3cf3227a
AT		 3513 /* If h/w offloading is available, propagate to the device */
3514 if (macsec_is_offloaded(macsec)) {
3515 const struct macsec_ops *ops;
3516 struct macsec_context ctx;
3517
3518 ops = macsec_get_ops(netdev_priv(dev), &ctx);
3519 if (!ops) {
3520 err = -EOPNOTSUPP;
3521 goto clear_allmulti;
3522 }
3523
182879f8 3524 ctx.secy = &macsec->secy;
3cf3227a
AT		 3525 err = macsec_offload(ops->mdo_dev_open, &ctx);
3526 if (err)
3527 goto clear_allmulti;
3528 }
3529
c09440f7
SD		 3530 if (netif_carrier_ok(real_dev))
3531 netif_carrier_on(dev);
3532
3533 return 0;
3534clear_allmulti:
3535 if (dev->flags & IFF_ALLMULTI)
3536 dev_set_allmulti(real_dev, -1);
3537del_unicast:
3538 dev_uc_del(real_dev, dev->dev_addr);
3539 netif_carrier_off(dev);
3540 return err;
3541}
3542
3543static int macsec_dev_stop(struct net_device *dev)
3544{
3545 struct macsec_dev *macsec = macsec_priv(dev);
3546 struct net_device *real_dev = macsec->real_dev;
3547
3548 netif_carrier_off(dev);
3549
3cf3227a
AT		 3550 /* If h/w offloading is available, propagate to the device */
3551 if (macsec_is_offloaded(macsec)) {
3552 const struct macsec_ops *ops;
3553 struct macsec_context ctx;
3554
3555 ops = macsec_get_ops(macsec, &ctx);
182879f8
DB		 3556 if (ops) {
3557 ctx.secy = &macsec->secy;
3cf3227a 3558 macsec_offload(ops->mdo_dev_stop, &ctx);
182879f8 3559 }
3cf3227a
AT		 3560 }
3561
c09440f7
SD		 3562 dev_mc_unsync(real_dev, dev);
3563 dev_uc_unsync(real_dev, dev);
3564
3565 if (dev->flags & IFF_ALLMULTI)
3566 dev_set_allmulti(real_dev, -1);
3567
3568 if (dev->flags & IFF_PROMISC)
3569 dev_set_promiscuity(real_dev, -1);
3570
3571 dev_uc_del(real_dev, dev->dev_addr);
3572
3573 return 0;
3574}
3575
3576static void macsec_dev_change_rx_flags(struct net_device *dev, int change)
3577{
3578 struct net_device *real_dev = macsec_priv(dev)->real_dev;
3579
3580 if (!(dev->flags & IFF_UP))
3581 return;
3582
3583 if (change & IFF_ALLMULTI)
3584 dev_set_allmulti(real_dev, dev->flags & IFF_ALLMULTI ? 1 : -1);
3585
3586 if (change & IFF_PROMISC)
3587 dev_set_promiscuity(real_dev,
3588 dev->flags & IFF_PROMISC ? 1 : -1);
3589}
3590
3591static void macsec_dev_set_rx_mode(struct net_device *dev)
3592{
3593 struct net_device *real_dev = macsec_priv(dev)->real_dev;
3594
3595 dev_mc_sync(real_dev, dev);
3596 dev_uc_sync(real_dev, dev);
3597}
3598
3599static int macsec_set_mac_address(struct net_device *dev, void *p)
3600{
3601 struct macsec_dev *macsec = macsec_priv(dev);
3602 struct net_device *real_dev = macsec->real_dev;
3603 struct sockaddr *addr = p;
3604 int err;
3605
3606 if (!is_valid_ether_addr(addr->sa_data))
3607 return -EADDRNOTAVAIL;
3608
3609 if (!(dev->flags & IFF_UP))
3610 goto out;
3611
3612 err = dev_uc_add(real_dev, addr->sa_data);
3613 if (err < 0)
3614 return err;
3615
3616 dev_uc_del(real_dev, dev->dev_addr);
3617
3618out:
3619 ether_addr_copy(dev->dev_addr, addr->sa_data);
6fc498bc 3620 macsec->secy.sci = dev_to_sci(dev, MACSEC_PORT_ES);
09f4136c
DB		 3621
3622 /* If h/w offloading is available, propagate to the device */
3623 if (macsec_is_offloaded(macsec)) {
3624 const struct macsec_ops *ops;
3625 struct macsec_context ctx;
3626
3627 ops = macsec_get_ops(macsec, &ctx);
3628 if (ops) {
3629 ctx.secy = &macsec->secy;
3630 macsec_offload(ops->mdo_upd_secy, &ctx);
3631 }
3632 }
3633
c09440f7
SD		 3634 return 0;
3635}
3636
3637static int macsec_change_mtu(struct net_device *dev, int new_mtu)
3638{
3639 struct macsec_dev *macsec = macsec_priv(dev);
3640 unsigned int extra = macsec->secy.icv_len + macsec_extra_len(true);
3641
3642 if (macsec->real_dev->mtu - extra < new_mtu)
3643 return -ERANGE;
3644
3645 dev->mtu = new_mtu;
3646
3647 return 0;
3648}
3649
bc1f4470 3650static void macsec_get_stats64(struct net_device *dev,
3651 struct rtnl_link_stats64 *s)
c09440f7 3652{
c09440f7 3653 if (!dev->tstats)
bc1f4470 3654 return;
c09440f7 3655
9d015167 3656 dev_fetch_sw_netstats(s, dev->tstats);
c09440f7
SD		 3657
3658 s->rx_dropped = dev->stats.rx_dropped;
3659 s->tx_dropped = dev->stats.tx_dropped;
c09440f7
SD		 3660}
3661
3662static int macsec_get_iflink(const struct net_device *dev)
3663{
3664 return macsec_priv(dev)->real_dev->ifindex;
3665}
3666
3667static const struct net_device_ops macsec_netdev_ops = {
3668 .ndo_init = macsec_dev_init,
3669 .ndo_uninit = macsec_dev_uninit,
3670 .ndo_open = macsec_dev_open,
3671 .ndo_stop = macsec_dev_stop,
3672 .ndo_fix_features = macsec_fix_features,
3673 .ndo_change_mtu = macsec_change_mtu,
3674 .ndo_set_rx_mode = macsec_dev_set_rx_mode,
3675 .ndo_change_rx_flags = macsec_dev_change_rx_flags,
3676 .ndo_set_mac_address = macsec_set_mac_address,
3677 .ndo_start_xmit = macsec_start_xmit,
3678 .ndo_get_stats64 = macsec_get_stats64,
3679 .ndo_get_iflink = macsec_get_iflink,
3680};
3681
3682static const struct device_type macsec_type = {
3683 .name = "macsec",
3684};
3685
3686static const struct nla_policy macsec_rtnl_policy[IFLA_MACSEC_MAX + 1] = {
3687 [IFLA_MACSEC_SCI] = { .type = NLA_U64 },
31d9a1c5 3688 [IFLA_MACSEC_PORT] = { .type = NLA_U16 },
c09440f7
SD		 3689 [IFLA_MACSEC_ICV_LEN] = { .type = NLA_U8 },
3690 [IFLA_MACSEC_CIPHER_SUITE] = { .type = NLA_U64 },
3691 [IFLA_MACSEC_WINDOW] = { .type = NLA_U32 },
3692 [IFLA_MACSEC_ENCODING_SA] = { .type = NLA_U8 },
3693 [IFLA_MACSEC_ENCRYPT] = { .type = NLA_U8 },
3694 [IFLA_MACSEC_PROTECT] = { .type = NLA_U8 },
3695 [IFLA_MACSEC_INC_SCI] = { .type = NLA_U8 },
3696 [IFLA_MACSEC_ES] = { .type = NLA_U8 },
3697 [IFLA_MACSEC_SCB] = { .type = NLA_U8 },
3698 [IFLA_MACSEC_REPLAY_PROTECT] = { .type = NLA_U8 },
3699 [IFLA_MACSEC_VALIDATION] = { .type = NLA_U8 },
3700};
3701
3702static void macsec_free_netdev(struct net_device *dev)
3703{
3704 struct macsec_dev *macsec = macsec_priv(dev);
c09440f7
SD		 3705
3706 free_percpu(macsec->stats);
3707 free_percpu(macsec->secy.tx_sc.stats);
3708
c09440f7
SD		 3709}
3710
3711static void macsec_setup(struct net_device *dev)
3712{
3713 ether_setup(dev);
91572088
JW		 3714 dev->min_mtu = 0;
3715 dev->max_mtu = ETH_MAX_MTU;
e425974f 3716 dev->priv_flags |= IFF_NO_QUEUE;
c09440f7 3717 dev->netdev_ops = &macsec_netdev_ops;
cf124db5
DM		 3718 dev->needs_free_netdev = true;
3719 dev->priv_destructor = macsec_free_netdev;
c24acf03 3720 SET_NETDEV_DEVTYPE(dev, &macsec_type);
c09440f7
SD		 3721
3722 eth_zero_addr(dev->broadcast);
3723}
3724
ccfdec90
FW		 3725static int macsec_changelink_common(struct net_device *dev,
3726 struct nlattr *data[])
c09440f7
SD		 3727{
3728 struct macsec_secy *secy;
3729 struct macsec_tx_sc *tx_sc;
3730
3731 secy = &macsec_priv(dev)->secy;
3732 tx_sc = &secy->tx_sc;
3733
3734 if (data[IFLA_MACSEC_ENCODING_SA]) {
3735 struct macsec_tx_sa *tx_sa;
3736
3737 tx_sc->encoding_sa = nla_get_u8(data[IFLA_MACSEC_ENCODING_SA]);
3738 tx_sa = rtnl_dereference(tx_sc->sa[tx_sc->encoding_sa]);
3739
3740 secy->operational = tx_sa && tx_sa->active;
3741 }
3742
c09440f7
SD		 3743 if (data[IFLA_MACSEC_ENCRYPT])
3744 tx_sc->encrypt = !!nla_get_u8(data[IFLA_MACSEC_ENCRYPT]);
3745
3746 if (data[IFLA_MACSEC_PROTECT])
3747 secy->protect_frames = !!nla_get_u8(data[IFLA_MACSEC_PROTECT]);
3748
3749 if (data[IFLA_MACSEC_INC_SCI])
3750 tx_sc->send_sci = !!nla_get_u8(data[IFLA_MACSEC_INC_SCI]);
3751
3752 if (data[IFLA_MACSEC_ES])
3753 tx_sc->end_station = !!nla_get_u8(data[IFLA_MACSEC_ES]);
3754
3755 if (data[IFLA_MACSEC_SCB])
3756 tx_sc->scb = !!nla_get_u8(data[IFLA_MACSEC_SCB]);
3757
3758 if (data[IFLA_MACSEC_REPLAY_PROTECT])
3759 secy->replay_protect = !!nla_get_u8(data[IFLA_MACSEC_REPLAY_PROTECT]);
3760
3761 if (data[IFLA_MACSEC_VALIDATION])
3762 secy->validate_frames = nla_get_u8(data[IFLA_MACSEC_VALIDATION]);
ccfdec90
FW		 3763
3764 if (data[IFLA_MACSEC_CIPHER_SUITE]) {
3765 switch (nla_get_u64(data[IFLA_MACSEC_CIPHER_SUITE])) {
3766 case MACSEC_CIPHER_ID_GCM_AES_128:
e8660ded 3767 case MACSEC_DEFAULT_CIPHER_ID:
ccfdec90 3768 secy->key_len = MACSEC_GCM_AES_128_SAK_LEN;
48ef50fa 3769 secy->xpn = false;
ccfdec90
FW		 3770 break;
3771 case MACSEC_CIPHER_ID_GCM_AES_256:
3772 secy->key_len = MACSEC_GCM_AES_256_SAK_LEN;
48ef50fa
EM		 3773 secy->xpn = false;
3774 break;
3775 case MACSEC_CIPHER_ID_GCM_AES_XPN_128:
3776 secy->key_len = MACSEC_GCM_AES_128_SAK_LEN;
3777 secy->xpn = true;
3778 break;
3779 case MACSEC_CIPHER_ID_GCM_AES_XPN_256:
3780 secy->key_len = MACSEC_GCM_AES_256_SAK_LEN;
3781 secy->xpn = true;
ccfdec90
FW		 3782 break;
3783 default:
3784 return -EINVAL;
3785 }
3786 }
3787
0b52e10a
SD		 3788 if (data[IFLA_MACSEC_WINDOW]) {
3789 secy->replay_window = nla_get_u32(data[IFLA_MACSEC_WINDOW]);
3790
3791 /* IEEE 802.1AEbw-2013 10.7.8 - maximum replay window
3792 * for XPN cipher suites */
3793 if (secy->xpn &&
3794 secy->replay_window > MACSEC_XPN_MAX_REPLAY_WINDOW)
3795 return -EINVAL;
3796 }
3797
ccfdec90 3798 return 0;
c09440f7
SD		 3799}
3800
3801static int macsec_changelink(struct net_device *dev, struct nlattr *tb[],
ad744b22
MS		 3802 struct nlattr *data[],
3803 struct netlink_ext_ack *extack)
c09440f7 3804{
3cf3227a 3805 struct macsec_dev *macsec = macsec_priv(dev);
022e9d60 3806 struct macsec_tx_sc tx_sc;
3cf3227a
AT		 3807 struct macsec_secy secy;
3808 int ret;
3809
c09440f7
SD		 3810 if (!data)
3811 return 0;
3812
3813 if (data[IFLA_MACSEC_CIPHER_SUITE] ||
3814 data[IFLA_MACSEC_ICV_LEN] ||
3815 data[IFLA_MACSEC_SCI] ||
3816 data[IFLA_MACSEC_PORT])
3817 return -EINVAL;
3818
3cf3227a
AT		 3819 /* Keep a copy of unmodified secy and tx_sc, in case the offload
3820 * propagation fails, to revert macsec_changelink_common.
3821 */
3822 memcpy(&secy, &macsec->secy, sizeof(secy));
3823 memcpy(&tx_sc, &macsec->secy.tx_sc, sizeof(tx_sc));
3824
3825 ret = macsec_changelink_common(dev, data);
3826 if (ret)
0b52e10a 3827 goto cleanup;
3cf3227a
AT		 3828
3829 /* If h/w offloading is available, propagate to the device */
3830 if (macsec_is_offloaded(macsec)) {
3831 const struct macsec_ops *ops;
3832 struct macsec_context ctx;
3833 int ret;
3834
3835 ops = macsec_get_ops(netdev_priv(dev), &ctx);
3836 if (!ops) {
3837 ret = -EOPNOTSUPP;
3838 goto cleanup;
3839 }
3840
3841 ctx.secy = &macsec->secy;
3842 ret = macsec_offload(ops->mdo_upd_secy, &ctx);
3843 if (ret)
3844 goto cleanup;
3845 }
3846
3847 return 0;
3848
3849cleanup:
3850 memcpy(&macsec->secy.tx_sc, &tx_sc, sizeof(tx_sc));
3851 memcpy(&macsec->secy, &secy, sizeof(secy));
3852
3853 return ret;
c09440f7
SD		 3854}
3855
3856static void macsec_del_dev(struct macsec_dev *macsec)
3857{
3858 int i;
3859
3860 while (macsec->secy.rx_sc) {
3861 struct macsec_rx_sc *rx_sc = rtnl_dereference(macsec->secy.rx_sc);
3862
3863 rcu_assign_pointer(macsec->secy.rx_sc, rx_sc->next);
3864 free_rx_sc(rx_sc);
3865 }
3866
3867 for (i = 0; i < MACSEC_NUM_AN; i++) {
3868 struct macsec_tx_sa *sa = rtnl_dereference(macsec->secy.tx_sc.sa[i]);
3869
3870 if (sa) {
3871 RCU_INIT_POINTER(macsec->secy.tx_sc.sa[i], NULL);
3872 clear_tx_sa(sa);
3873 }
3874 }
3875}
3876
bbe11fab
SD		 3877static void macsec_common_dellink(struct net_device *dev, struct list_head *head)
3878{
3879 struct macsec_dev *macsec = macsec_priv(dev);
e2003872 3880 struct net_device *real_dev = macsec->real_dev;
bbe11fab 3881
19ee9054
LN		 3882 /* If h/w offloading is available, propagate to the device */
3883 if (macsec_is_offloaded(macsec)) {
3884 const struct macsec_ops *ops;
3885 struct macsec_context ctx;
3886
3887 ops = macsec_get_ops(netdev_priv(dev), &ctx);
3888 if (ops) {
3889 ctx.secy = &macsec->secy;
3890 macsec_offload(ops->mdo_del_secy, &ctx);
3891 }
3892 }
3893
bbe11fab
SD		 3894 unregister_netdevice_queue(dev, head);
3895 list_del_rcu(&macsec->secys);
3896 macsec_del_dev(macsec);
e2003872 3897 netdev_upper_dev_unlink(real_dev, dev);
bbe11fab
SD		 3898
3899 macsec_generation++;
3900}
3901
c09440f7
SD		 3902static void macsec_dellink(struct net_device *dev, struct list_head *head)
3903{
3904 struct macsec_dev *macsec = macsec_priv(dev);
3905 struct net_device *real_dev = macsec->real_dev;
3906 struct macsec_rxh_data *rxd = macsec_data_rtnl(real_dev);
3907
bbe11fab 3908 macsec_common_dellink(dev, head);
96cfc505 3909
960d5848 3910 if (list_empty(&rxd->secys)) {
c09440f7 3911 netdev_rx_handler_unregister(real_dev);
960d5848
SD		 3912 kfree(rxd);
3913 }
c09440f7
SD		 3914}
3915
3916static int register_macsec_dev(struct net_device *real_dev,
3917 struct net_device *dev)
3918{
3919 struct macsec_dev *macsec = macsec_priv(dev);
3920 struct macsec_rxh_data *rxd = macsec_data_rtnl(real_dev);
3921
3922 if (!rxd) {
3923 int err;
3924
3925 rxd = kmalloc(sizeof(*rxd), GFP_KERNEL);
3926 if (!rxd)
3927 return -ENOMEM;
3928
3929 INIT_LIST_HEAD(&rxd->secys);
3930
3931 err = netdev_rx_handler_register(real_dev, macsec_handle_frame,
3932 rxd);
960d5848
SD		 3933 if (err < 0) {
3934 kfree(rxd);
c09440f7 3935 return err;
960d5848 3936 }
c09440f7
SD		 3937 }
3938
3939 list_add_tail_rcu(&macsec->secys, &rxd->secys);
3940 return 0;
3941}
3942
3943static bool sci_exists(struct net_device *dev, sci_t sci)
3944{
3945 struct macsec_rxh_data *rxd = macsec_data_rtnl(dev);
3946 struct macsec_dev *macsec;
3947
3948 list_for_each_entry(macsec, &rxd->secys, secys) {
3949 if (macsec->secy.sci == sci)
3950 return true;
3951 }
3952
3953 return false;
3954}
3955
c09440f7
SD		 3956static int macsec_add_dev(struct net_device *dev, sci_t sci, u8 icv_len)
3957{
3958 struct macsec_dev *macsec = macsec_priv(dev);
3959 struct macsec_secy *secy = &macsec->secy;
3960
3961 macsec->stats = netdev_alloc_pcpu_stats(struct pcpu_secy_stats);
3962 if (!macsec->stats)
3963 return -ENOMEM;
3964
3965 secy->tx_sc.stats = netdev_alloc_pcpu_stats(struct pcpu_tx_sc_stats);
3966 if (!secy->tx_sc.stats) {
3967 free_percpu(macsec->stats);
3968 return -ENOMEM;
3969 }
3970
3971 if (sci == MACSEC_UNDEF_SCI)
3972 sci = dev_to_sci(dev, MACSEC_PORT_ES);
3973
3974 secy->netdev = dev;
3975 secy->operational = true;
3976 secy->key_len = DEFAULT_SAK_LEN;
3977 secy->icv_len = icv_len;
3978 secy->validate_frames = MACSEC_VALIDATE_DEFAULT;
3979 secy->protect_frames = true;
3980 secy->replay_protect = false;
48ef50fa 3981 secy->xpn = DEFAULT_XPN;
c09440f7
SD		 3982
3983 secy->sci = sci;
3984 secy->tx_sc.active = true;
3985 secy->tx_sc.encoding_sa = DEFAULT_ENCODING_SA;
3986 secy->tx_sc.encrypt = DEFAULT_ENCRYPT;
3987 secy->tx_sc.send_sci = DEFAULT_SEND_SCI;
3988 secy->tx_sc.end_station = false;
3989 secy->tx_sc.scb = false;
3990
3991 return 0;
3992}
3993
845e0ebb
CW		 3994static struct lock_class_key macsec_netdev_addr_lock_key;
3995
c09440f7 3996static int macsec_newlink(struct net *net, struct net_device *dev,
7a3f4a18
MS		 3997 struct nlattr *tb[], struct nlattr *data[],
3998 struct netlink_ext_ack *extack)
c09440f7
SD		 3999{
4000 struct macsec_dev *macsec = macsec_priv(dev);
7f327080
TY		 4001 rx_handler_func_t *rx_handler;
4002 u8 icv_len = DEFAULT_ICV_LEN;
c09440f7 4003 struct net_device *real_dev;
7f327080 4004 int err, mtu;
c09440f7 4005 sci_t sci;
c09440f7
SD		 4006
4007 if (!tb[IFLA_LINK])
4008 return -EINVAL;
4009 real_dev = __dev_get_by_index(net, nla_get_u32(tb[IFLA_LINK]));
4010 if (!real_dev)
4011 return -ENODEV;
b06d072c
WB		 4012 if (real_dev->type != ARPHRD_ETHER)
4013 return -EINVAL;
c09440f7
SD		 4014
4015 dev->priv_flags |= IFF_MACSEC;
4016
4017 macsec->real_dev = real_dev;
4018
791bb3fc
MS		 4019 if (data && data[IFLA_MACSEC_OFFLOAD])
4020 macsec->offload = nla_get_offload(data[IFLA_MACSEC_OFFLOAD]);
4021 else
4022 /* MACsec offloading is off by default */
4023 macsec->offload = MACSEC_OFFLOAD_OFF;
4024
4025 /* Check if the offloading mode is supported by the underlying layers */
4026 if (macsec->offload != MACSEC_OFFLOAD_OFF &&
4027 !macsec_check_offload(macsec->offload, macsec))
4028 return -EOPNOTSUPP;
3cf3227a 4029
e4f40642
LN		 4030 /* send_sci must be set to true when transmit sci explicitly is set */
4031 if ((data && data[IFLA_MACSEC_SCI]) &&
4032 (data && data[IFLA_MACSEC_INC_SCI])) {
4033 u8 send_sci = !!nla_get_u8(data[IFLA_MACSEC_INC_SCI]);
4034
4035 if (!send_sci)
4036 return -EINVAL;
4037 }
4038
c09440f7
SD		 4039 if (data && data[IFLA_MACSEC_ICV_LEN])
4040 icv_len = nla_get_u8(data[IFLA_MACSEC_ICV_LEN]);
7f327080
TY		 4041 mtu = real_dev->mtu - icv_len - macsec_extra_len(true);
4042 if (mtu < 0)
4043 dev->mtu = 0;
4044 else
4045 dev->mtu = mtu;
c09440f7
SD		 4046
4047 rx_handler = rtnl_dereference(real_dev->rx_handler);
4048 if (rx_handler && rx_handler != macsec_handle_frame)
4049 return -EBUSY;
4050
4051 err = register_netdevice(dev);
4052 if (err < 0)
4053 return err;
4054
1a33e10e 4055 netdev_lockdep_set_classes(dev);
be74294f
CW		 4056 lockdep_set_class(&dev->addr_list_lock,
4057 &macsec_netdev_addr_lock_key);
1a33e10e 4058
42ab19ee 4059 err = netdev_upper_dev_link(real_dev, dev, extack);
e2003872 4060 if (err < 0)
bd28899d 4061 goto unregister;
e2003872 4062
c09440f7
SD		 4063 /* need to be already registered so that ->init has run and
4064 * the MAC addr is set
4065 */
4066 if (data && data[IFLA_MACSEC_SCI])
4067 sci = nla_get_sci(data[IFLA_MACSEC_SCI]);
4068 else if (data && data[IFLA_MACSEC_PORT])
4069 sci = dev_to_sci(dev, nla_get_be16(data[IFLA_MACSEC_PORT]));
4070 else
4071 sci = dev_to_sci(dev, MACSEC_PORT_ES);
4072
4073 if (rx_handler && sci_exists(real_dev, sci)) {
4074 err = -EBUSY;
e2003872 4075 goto unlink;
c09440f7
SD		 4076 }
4077
4078 err = macsec_add_dev(dev, sci, icv_len);
4079 if (err)
e2003872 4080 goto unlink;
c09440f7 4081
ccfdec90
FW		 4082 if (data) {
4083 err = macsec_changelink_common(dev, data);
4084 if (err)
4085 goto del_dev;
4086 }
c09440f7 4087
791bb3fc
MS		 4088 /* If h/w offloading is available, propagate to the device */
4089 if (macsec_is_offloaded(macsec)) {
4090 const struct macsec_ops *ops;
4091 struct macsec_context ctx;
4092
4093 ops = macsec_get_ops(macsec, &ctx);
4094 if (ops) {
4095 ctx.secy = &macsec->secy;
4096 err = macsec_offload(ops->mdo_add_secy, &ctx);
4097 if (err)
4098 goto del_dev;
4099 }
4100 }
4101
c09440f7
SD		 4102 err = register_macsec_dev(real_dev, dev);
4103 if (err < 0)
4104 goto del_dev;
4105
e6ac0758
SD		 4106 netif_stacked_transfer_operstate(real_dev, dev);
4107 linkwatch_fire_event(dev);
4108
96cfc505
SD		 4109 macsec_generation++;
4110
c09440f7
SD		 4111 return 0;
4112
4113del_dev:
4114 macsec_del_dev(macsec);
e2003872
SD		 4115unlink:
4116 netdev_upper_dev_unlink(real_dev, dev);
bd28899d 4117unregister:
c09440f7
SD		 4118 unregister_netdevice(dev);
4119 return err;
4120}
4121
a8b8a889
MS		 4122static int macsec_validate_attr(struct nlattr *tb[], struct nlattr *data[],
4123 struct netlink_ext_ack *extack)
c09440f7 4124{
74816480 4125 u64 csid = MACSEC_DEFAULT_CIPHER_ID;
c09440f7
SD		 4126 u8 icv_len = DEFAULT_ICV_LEN;
4127 int flag;
4128 bool es, scb, sci;
4129
4130 if (!data)
4131 return 0;
4132
4133 if (data[IFLA_MACSEC_CIPHER_SUITE])
4134 csid = nla_get_u64(data[IFLA_MACSEC_CIPHER_SUITE]);
4135
f04c392d 4136 if (data[IFLA_MACSEC_ICV_LEN]) {
c09440f7 4137 icv_len = nla_get_u8(data[IFLA_MACSEC_ICV_LEN]);
f04c392d
DC		 4138 if (icv_len != DEFAULT_ICV_LEN) {
4139 char dummy_key[DEFAULT_SAK_LEN] = { 0 };
4140 struct crypto_aead *dummy_tfm;
4141
4142 dummy_tfm = macsec_alloc_tfm(dummy_key,
4143 DEFAULT_SAK_LEN,
4144 icv_len);
4145 if (IS_ERR(dummy_tfm))
4146 return PTR_ERR(dummy_tfm);
4147 crypto_free_aead(dummy_tfm);
4148 }
4149 }
c09440f7
SD		 4150
4151 switch (csid) {
ccfdec90
FW		 4152 case MACSEC_CIPHER_ID_GCM_AES_128:
4153 case MACSEC_CIPHER_ID_GCM_AES_256:
48ef50fa
EM		 4154 case MACSEC_CIPHER_ID_GCM_AES_XPN_128:
4155 case MACSEC_CIPHER_ID_GCM_AES_XPN_256:
e8660ded 4156 case MACSEC_DEFAULT_CIPHER_ID:
c09440f7 4157 if (icv_len < MACSEC_MIN_ICV_LEN ||
2ccbe2cb 4158 icv_len > MACSEC_STD_ICV_LEN)
c09440f7
SD		 4159 return -EINVAL;
4160 break;
4161 default:
4162 return -EINVAL;
4163 }
4164
4165 if (data[IFLA_MACSEC_ENCODING_SA]) {
4166 if (nla_get_u8(data[IFLA_MACSEC_ENCODING_SA]) >= MACSEC_NUM_AN)
4167 return -EINVAL;
4168 }
4169
4170 for (flag = IFLA_MACSEC_ENCODING_SA + 1;
4171 flag < IFLA_MACSEC_VALIDATION;
4172 flag++) {
4173 if (data[flag]) {
4174 if (nla_get_u8(data[flag]) > 1)
4175 return -EINVAL;
4176 }
4177 }
4178
4179 es = data[IFLA_MACSEC_ES] ? nla_get_u8(data[IFLA_MACSEC_ES]) : false;
4180 sci = data[IFLA_MACSEC_INC_SCI] ? nla_get_u8(data[IFLA_MACSEC_INC_SCI]) : false;
4181 scb = data[IFLA_MACSEC_SCB] ? nla_get_u8(data[IFLA_MACSEC_SCB]) : false;
4182
4183 if ((sci && (scb || es)) || (scb && es))
4184 return -EINVAL;
4185
4186 if (data[IFLA_MACSEC_VALIDATION] &&
4187 nla_get_u8(data[IFLA_MACSEC_VALIDATION]) > MACSEC_VALIDATE_MAX)
4188 return -EINVAL;
4189
4b1fb935
SD		 4190 if ((data[IFLA_MACSEC_REPLAY_PROTECT] &&
4191 nla_get_u8(data[IFLA_MACSEC_REPLAY_PROTECT])) &&
c09440f7
SD		 4192 !data[IFLA_MACSEC_WINDOW])
4193 return -EINVAL;
4194
4195 return 0;
4196}
4197
4198static struct net *macsec_get_link_net(const struct net_device *dev)
4199{
4200 return dev_net(macsec_priv(dev)->real_dev);
4201}
4202
4203static size_t macsec_get_size(const struct net_device *dev)
4204{
c9fba3ed
ZS		 4205 return nla_total_size_64bit(8) + /* IFLA_MACSEC_SCI */
4206 nla_total_size(1) + /* IFLA_MACSEC_ICV_LEN */
4207 nla_total_size_64bit(8) + /* IFLA_MACSEC_CIPHER_SUITE */
4208 nla_total_size(4) + /* IFLA_MACSEC_WINDOW */
4209 nla_total_size(1) + /* IFLA_MACSEC_ENCODING_SA */
4210 nla_total_size(1) + /* IFLA_MACSEC_ENCRYPT */
4211 nla_total_size(1) + /* IFLA_MACSEC_PROTECT */
4212 nla_total_size(1) + /* IFLA_MACSEC_INC_SCI */
4213 nla_total_size(1) + /* IFLA_MACSEC_ES */
4214 nla_total_size(1) + /* IFLA_MACSEC_SCB */
4215 nla_total_size(1) + /* IFLA_MACSEC_REPLAY_PROTECT */
4216 nla_total_size(1) + /* IFLA_MACSEC_VALIDATION */
c09440f7
SD		 4217 0;
4218}
4219
4220static int macsec_fill_info(struct sk_buff *skb,
4221 const struct net_device *dev)
4222{
4223 struct macsec_secy *secy = &macsec_priv(dev)->secy;
4224 struct macsec_tx_sc *tx_sc = &secy->tx_sc;
ccfdec90
FW		 4225 u64 csid;
4226
4227 switch (secy->key_len) {
4228 case MACSEC_GCM_AES_128_SAK_LEN:
48ef50fa 4229 csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_128 : MACSEC_DEFAULT_CIPHER_ID;
ccfdec90
FW		 4230 break;
4231 case MACSEC_GCM_AES_256_SAK_LEN:
48ef50fa 4232 csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_256 : MACSEC_CIPHER_ID_GCM_AES_256;
ccfdec90
FW		 4233 break;
4234 default:
4235 goto nla_put_failure;
4236 }
c09440f7 4237
f60d94c0
ND		 4238 if (nla_put_sci(skb, IFLA_MACSEC_SCI, secy->sci,
4239 IFLA_MACSEC_PAD) ||
c09440f7 4240 nla_put_u8(skb, IFLA_MACSEC_ICV_LEN, secy->icv_len) ||
f60d94c0 4241 nla_put_u64_64bit(skb, IFLA_MACSEC_CIPHER_SUITE,
ccfdec90 4242 csid, IFLA_MACSEC_PAD) ||
c09440f7
SD		 4243 nla_put_u8(skb, IFLA_MACSEC_ENCODING_SA, tx_sc->encoding_sa) ||
4244 nla_put_u8(skb, IFLA_MACSEC_ENCRYPT, tx_sc->encrypt) ||
4245 nla_put_u8(skb, IFLA_MACSEC_PROTECT, secy->protect_frames) ||
4246 nla_put_u8(skb, IFLA_MACSEC_INC_SCI, tx_sc->send_sci) ||
4247 nla_put_u8(skb, IFLA_MACSEC_ES, tx_sc->end_station) ||
4248 nla_put_u8(skb, IFLA_MACSEC_SCB, tx_sc->scb) ||
4249 nla_put_u8(skb, IFLA_MACSEC_REPLAY_PROTECT, secy->replay_protect) ||
4250 nla_put_u8(skb, IFLA_MACSEC_VALIDATION, secy->validate_frames) ||
4251 0)
4252 goto nla_put_failure;
4253
4254 if (secy->replay_protect) {
4255 if (nla_put_u32(skb, IFLA_MACSEC_WINDOW, secy->replay_window))
4256 goto nla_put_failure;
4257 }
4258
4259 return 0;
4260
4261nla_put_failure:
4262 return -EMSGSIZE;
4263}
4264
4265static struct rtnl_link_ops macsec_link_ops __read_mostly = {
4266 .kind = "macsec",
4267 .priv_size = sizeof(struct macsec_dev),
4268 .maxtype = IFLA_MACSEC_MAX,
4269 .policy = macsec_rtnl_policy,
4270 .setup = macsec_setup,
4271 .validate = macsec_validate_attr,
4272 .newlink = macsec_newlink,
4273 .changelink = macsec_changelink,
4274 .dellink = macsec_dellink,
4275 .get_size = macsec_get_size,
4276 .fill_info = macsec_fill_info,
4277 .get_link_net = macsec_get_link_net,
4278};
4279
4280static bool is_macsec_master(struct net_device *dev)
4281{
4282 return rcu_access_pointer(dev->rx_handler) == macsec_handle_frame;
4283}
4284
4285static int macsec_notify(struct notifier_block *this, unsigned long event,
4286 void *ptr)
4287{
4288 struct net_device *real_dev = netdev_notifier_info_to_dev(ptr);
4289 LIST_HEAD(head);
4290
4291 if (!is_macsec_master(real_dev))
4292 return NOTIFY_DONE;
4293
4294 switch (event) {
e6ac0758
SD		 4295 case NETDEV_DOWN:
4296 case NETDEV_UP:
4297 case NETDEV_CHANGE: {
4298 struct macsec_dev *m, *n;
4299 struct macsec_rxh_data *rxd;
4300
4301 rxd = macsec_data_rtnl(real_dev);
4302 list_for_each_entry_safe(m, n, &rxd->secys, secys) {
4303 struct net_device *dev = m->secy.netdev;
4304
4305 netif_stacked_transfer_operstate(real_dev, dev);
4306 }
4307 break;
4308 }
c09440f7
SD		 4309 case NETDEV_UNREGISTER: {
4310 struct macsec_dev *m, *n;
4311 struct macsec_rxh_data *rxd;
4312
4313 rxd = macsec_data_rtnl(real_dev);
4314 list_for_each_entry_safe(m, n, &rxd->secys, secys) {
bbe11fab 4315 macsec_common_dellink(m->secy.netdev, &head);
c09440f7 4316 }
bbe11fab
SD		 4317
4318 netdev_rx_handler_unregister(real_dev);
4319 kfree(rxd);
4320
c09440f7
SD		 4321 unregister_netdevice_many(&head);
4322 break;
4323 }
4324 case NETDEV_CHANGEMTU: {
4325 struct macsec_dev *m;
4326 struct macsec_rxh_data *rxd;
4327
4328 rxd = macsec_data_rtnl(real_dev);
4329 list_for_each_entry(m, &rxd->secys, secys) {
4330 struct net_device *dev = m->secy.netdev;
4331 unsigned int mtu = real_dev->mtu - (m->secy.icv_len +
4332 macsec_extra_len(true));
4333
4334 if (dev->mtu > mtu)
4335 dev_set_mtu(dev, mtu);
4336 }
4337 }
4338 }
4339
4340 return NOTIFY_OK;
4341}
4342
4343static struct notifier_block macsec_notifier = {
4344 .notifier_call = macsec_notify,
4345};
4346
4347static int __init macsec_init(void)
4348{
4349 int err;
4350
4351 pr_info("MACsec IEEE 802.1AE\n");
4352 err = register_netdevice_notifier(&macsec_notifier);
4353 if (err)
4354 return err;
4355
4356 err = rtnl_link_register(&macsec_link_ops);
4357 if (err)
4358 goto notifier;
4359
489111e5 4360 err = genl_register_family(&macsec_fam);
c09440f7
SD		 4361 if (err)
4362 goto rtnl;
4363
4364 return 0;
4365
4366rtnl:
4367 rtnl_link_unregister(&macsec_link_ops);
4368notifier:
4369 unregister_netdevice_notifier(&macsec_notifier);
4370 return err;
4371}
4372
4373static void __exit macsec_exit(void)
4374{
4375 genl_unregister_family(&macsec_fam);
4376 rtnl_link_unregister(&macsec_link_ops);
4377 unregister_netdevice_notifier(&macsec_notifier);
b196c22a 4378 rcu_barrier();
c09440f7
SD		 4379}
4380
4381module_init(macsec_init);
4382module_exit(macsec_exit);
4383
4384MODULE_ALIAS_RTNL_LINK("macsec");
78362998 4385MODULE_ALIAS_GENL_FAMILY("macsec");
c09440f7
SD		 4386
4387MODULE_DESCRIPTION("MACsec IEEE 802.1AE");
4388MODULE_LICENSE("GPL v2");
Ubuntu Jammy Linux kernel mirror