1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * drivers/net/macsec.c - MACsec device
5 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net>
8 #include <linux/types.h>
9 #include <linux/skbuff.h>
10 #include <linux/socket.h>
11 #include <linux/module.h>
12 #include <crypto/aead.h>
13 #include <linux/etherdevice.h>
14 #include <linux/netdevice.h>
15 #include <linux/rtnetlink.h>
16 #include <linux/refcount.h>
17 #include <net/genetlink.h>
19 #include <net/gro_cells.h>
20 #include <net/macsec.h>
21 #include <linux/phy.h>
22 #include <linux/byteorder/generic.h>
23 #include <linux/if_arp.h>
25 #include <uapi/linux/if_macsec.h>
27 #define MACSEC_SCI_LEN 8
29 /* SecTAG length = macsec_eth_header without the optional SCI */
30 #define MACSEC_TAG_LEN 6
32 struct macsec_eth_header
{
36 #if defined(__LITTLE_ENDIAN_BITFIELD)
39 #elif defined(__BIG_ENDIAN_BITFIELD)
43 #error "Please fix <asm/byteorder.h>"
46 u8 secure_channel_id
[8]; /* optional */
49 #define MACSEC_TCI_VERSION 0x80
50 #define MACSEC_TCI_ES 0x40 /* end station */
51 #define MACSEC_TCI_SC 0x20 /* SCI present */
52 #define MACSEC_TCI_SCB 0x10 /* epon */
53 #define MACSEC_TCI_E 0x08 /* encryption */
54 #define MACSEC_TCI_C 0x04 /* changed text */
55 #define MACSEC_AN_MASK 0x03 /* association number */
56 #define MACSEC_TCI_CONFID (MACSEC_TCI_E | MACSEC_TCI_C)
58 /* minimum secure data length deemed "not short", see IEEE 802.1AE-2006 9.7 */
59 #define MIN_NON_SHORT_LEN 48
61 #define GCM_AES_IV_LEN 12
62 #define DEFAULT_ICV_LEN 16
64 #define for_each_rxsc(secy, sc) \
65 for (sc = rcu_dereference_bh(secy->rx_sc); \
67 sc = rcu_dereference_bh(sc->next))
68 #define for_each_rxsc_rtnl(secy, sc) \
69 for (sc = rtnl_dereference(secy->rx_sc); \
71 sc = rtnl_dereference(sc->next))
73 #define pn_same_half(pn1, pn2) (!(((pn1) >> 31) ^ ((pn2) >> 31)))
77 u8 short_secure_channel_id
[4];
85 u8 secure_channel_id
[8];
91 #define MACSEC_VALIDATE_DEFAULT MACSEC_VALIDATE_STRICT
93 struct pcpu_secy_stats
{
94 struct macsec_dev_stats stats
;
95 struct u64_stats_sync syncp
;
99 * struct macsec_dev - private data
101 * @real_dev: pointer to underlying netdevice
102 * @stats: MACsec device stats
103 * @secys: linked list of SecY's on the underlying device
104 * @gro_cells: pointer to the Generic Receive Offload cell
105 * @offload: status of offloading on the MACsec device
108 struct macsec_secy secy
;
109 struct net_device
*real_dev
;
110 struct pcpu_secy_stats __percpu
*stats
;
111 struct list_head secys
;
112 struct gro_cells gro_cells
;
113 enum macsec_offload offload
;
117 * struct macsec_rxh_data - rx_handler private argument
118 * @secys: linked list of SecY's on this underlying device
120 struct macsec_rxh_data
{
121 struct list_head secys
;
124 static struct macsec_dev
*macsec_priv(const struct net_device
*dev
)
126 return (struct macsec_dev
*)netdev_priv(dev
);
129 static struct macsec_rxh_data
*macsec_data_rcu(const struct net_device
*dev
)
131 return rcu_dereference_bh(dev
->rx_handler_data
);
134 static struct macsec_rxh_data
*macsec_data_rtnl(const struct net_device
*dev
)
136 return rtnl_dereference(dev
->rx_handler_data
);
140 struct aead_request
*req
;
142 struct macsec_tx_sa
*tx_sa
;
143 struct macsec_rx_sa
*rx_sa
;
150 static struct macsec_rx_sa
*macsec_rxsa_get(struct macsec_rx_sa __rcu
*ptr
)
152 struct macsec_rx_sa
*sa
= rcu_dereference_bh(ptr
);
154 if (!sa
|| !sa
->active
)
157 if (!refcount_inc_not_zero(&sa
->refcnt
))
163 static void free_rx_sc_rcu(struct rcu_head
*head
)
165 struct macsec_rx_sc
*rx_sc
= container_of(head
, struct macsec_rx_sc
, rcu_head
);
167 free_percpu(rx_sc
->stats
);
171 static struct macsec_rx_sc
*macsec_rxsc_get(struct macsec_rx_sc
*sc
)
173 return refcount_inc_not_zero(&sc
->refcnt
) ? sc
: NULL
;
176 static void macsec_rxsc_put(struct macsec_rx_sc
*sc
)
178 if (refcount_dec_and_test(&sc
->refcnt
))
179 call_rcu(&sc
->rcu_head
, free_rx_sc_rcu
);
182 static void free_rxsa(struct rcu_head
*head
)
184 struct macsec_rx_sa
*sa
= container_of(head
, struct macsec_rx_sa
, rcu
);
186 crypto_free_aead(sa
->key
.tfm
);
187 free_percpu(sa
->stats
);
191 static void macsec_rxsa_put(struct macsec_rx_sa
*sa
)
193 if (refcount_dec_and_test(&sa
->refcnt
))
194 call_rcu(&sa
->rcu
, free_rxsa
);
197 static struct macsec_tx_sa
*macsec_txsa_get(struct macsec_tx_sa __rcu
*ptr
)
199 struct macsec_tx_sa
*sa
= rcu_dereference_bh(ptr
);
201 if (!sa
|| !sa
->active
)
204 if (!refcount_inc_not_zero(&sa
->refcnt
))
210 static void free_txsa(struct rcu_head
*head
)
212 struct macsec_tx_sa
*sa
= container_of(head
, struct macsec_tx_sa
, rcu
);
214 crypto_free_aead(sa
->key
.tfm
);
215 free_percpu(sa
->stats
);
219 static void macsec_txsa_put(struct macsec_tx_sa
*sa
)
221 if (refcount_dec_and_test(&sa
->refcnt
))
222 call_rcu(&sa
->rcu
, free_txsa
);
225 static struct macsec_cb
*macsec_skb_cb(struct sk_buff
*skb
)
227 BUILD_BUG_ON(sizeof(struct macsec_cb
) > sizeof(skb
->cb
));
228 return (struct macsec_cb
*)skb
->cb
;
231 #define MACSEC_PORT_ES (htons(0x0001))
232 #define MACSEC_PORT_SCB (0x0000)
233 #define MACSEC_UNDEF_SCI ((__force sci_t)0xffffffffffffffffULL)
234 #define MACSEC_UNDEF_SSCI ((__force ssci_t)0xffffffff)
236 #define MACSEC_GCM_AES_128_SAK_LEN 16
237 #define MACSEC_GCM_AES_256_SAK_LEN 32
239 #define DEFAULT_SAK_LEN MACSEC_GCM_AES_128_SAK_LEN
240 #define DEFAULT_XPN false
241 #define DEFAULT_SEND_SCI true
242 #define DEFAULT_ENCRYPT false
243 #define DEFAULT_ENCODING_SA 0
244 #define MACSEC_XPN_MAX_REPLAY_WINDOW (((1 << 30) - 1))
246 static bool send_sci(const struct macsec_secy
*secy
)
248 const struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
250 return tx_sc
->send_sci
||
251 (secy
->n_rx_sc
> 1 && !tx_sc
->end_station
&& !tx_sc
->scb
);
254 static sci_t
make_sci(u8
*addr
, __be16 port
)
258 memcpy(&sci
, addr
, ETH_ALEN
);
259 memcpy(((char *)&sci
) + ETH_ALEN
, &port
, sizeof(port
));
264 static sci_t
macsec_frame_sci(struct macsec_eth_header
*hdr
, bool sci_present
)
269 memcpy(&sci
, hdr
->secure_channel_id
,
270 sizeof(hdr
->secure_channel_id
));
272 sci
= make_sci(hdr
->eth
.h_source
, MACSEC_PORT_ES
);
277 static unsigned int macsec_sectag_len(bool sci_present
)
279 return MACSEC_TAG_LEN
+ (sci_present
? MACSEC_SCI_LEN
: 0);
282 static unsigned int macsec_hdr_len(bool sci_present
)
284 return macsec_sectag_len(sci_present
) + ETH_HLEN
;
287 static unsigned int macsec_extra_len(bool sci_present
)
289 return macsec_sectag_len(sci_present
) + sizeof(__be16
);
292 /* Fill SecTAG according to IEEE 802.1AE-2006 10.5.3 */
293 static void macsec_fill_sectag(struct macsec_eth_header
*h
,
294 const struct macsec_secy
*secy
, u32 pn
,
297 const struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
299 memset(&h
->tci_an
, 0, macsec_sectag_len(sci_present
));
300 h
->eth
.h_proto
= htons(ETH_P_MACSEC
);
303 h
->tci_an
|= MACSEC_TCI_SC
;
304 memcpy(&h
->secure_channel_id
, &secy
->sci
,
305 sizeof(h
->secure_channel_id
));
307 if (tx_sc
->end_station
)
308 h
->tci_an
|= MACSEC_TCI_ES
;
310 h
->tci_an
|= MACSEC_TCI_SCB
;
313 h
->packet_number
= htonl(pn
);
315 /* with GCM, C/E clear for !encrypt, both set for encrypt */
317 h
->tci_an
|= MACSEC_TCI_CONFID
;
318 else if (secy
->icv_len
!= DEFAULT_ICV_LEN
)
319 h
->tci_an
|= MACSEC_TCI_C
;
321 h
->tci_an
|= tx_sc
->encoding_sa
;
324 static void macsec_set_shortlen(struct macsec_eth_header
*h
, size_t data_len
)
326 if (data_len
< MIN_NON_SHORT_LEN
)
327 h
->short_length
= data_len
;
330 /* Checks if a MACsec interface is being offloaded to an hardware engine */
331 static bool macsec_is_offloaded(struct macsec_dev
*macsec
)
333 if (macsec
->offload
== MACSEC_OFFLOAD_MAC
||
334 macsec
->offload
== MACSEC_OFFLOAD_PHY
)
340 /* Checks if underlying layers implement MACsec offloading functions. */
341 static bool macsec_check_offload(enum macsec_offload offload
,
342 struct macsec_dev
*macsec
)
344 if (!macsec
|| !macsec
->real_dev
)
347 if (offload
== MACSEC_OFFLOAD_PHY
)
348 return macsec
->real_dev
->phydev
&&
349 macsec
->real_dev
->phydev
->macsec_ops
;
350 else if (offload
== MACSEC_OFFLOAD_MAC
)
351 return macsec
->real_dev
->features
& NETIF_F_HW_MACSEC
&&
352 macsec
->real_dev
->macsec_ops
;
357 static const struct macsec_ops
*__macsec_get_ops(enum macsec_offload offload
,
358 struct macsec_dev
*macsec
,
359 struct macsec_context
*ctx
)
362 memset(ctx
, 0, sizeof(*ctx
));
363 ctx
->offload
= offload
;
365 if (offload
== MACSEC_OFFLOAD_PHY
)
366 ctx
->phydev
= macsec
->real_dev
->phydev
;
367 else if (offload
== MACSEC_OFFLOAD_MAC
)
368 ctx
->netdev
= macsec
->real_dev
;
371 if (offload
== MACSEC_OFFLOAD_PHY
)
372 return macsec
->real_dev
->phydev
->macsec_ops
;
374 return macsec
->real_dev
->macsec_ops
;
377 /* Returns a pointer to the MACsec ops struct if any and updates the MACsec
378 * context device reference if provided.
380 static const struct macsec_ops
*macsec_get_ops(struct macsec_dev
*macsec
,
381 struct macsec_context
*ctx
)
383 if (!macsec_check_offload(macsec
->offload
, macsec
))
386 return __macsec_get_ops(macsec
->offload
, macsec
, ctx
);
389 /* validate MACsec packet according to IEEE 802.1AE-2018 9.12 */
390 static bool macsec_validate_skb(struct sk_buff
*skb
, u16 icv_len
, bool xpn
)
392 struct macsec_eth_header
*h
= (struct macsec_eth_header
*)skb
->data
;
393 int len
= skb
->len
- 2 * ETH_ALEN
;
394 int extra_len
= macsec_extra_len(!!(h
->tci_an
& MACSEC_TCI_SC
)) + icv_len
;
396 /* a) It comprises at least 17 octets */
400 /* b) MACsec EtherType: already checked */
402 /* c) V bit is clear */
403 if (h
->tci_an
& MACSEC_TCI_VERSION
)
406 /* d) ES or SCB => !SC */
407 if ((h
->tci_an
& MACSEC_TCI_ES
|| h
->tci_an
& MACSEC_TCI_SCB
) &&
408 (h
->tci_an
& MACSEC_TCI_SC
))
411 /* e) Bits 7 and 8 of octet 4 of the SecTAG are clear */
415 /* rx.pn != 0 if not XPN (figure 10-5 with 802.11AEbw-2013 amendment) */
416 if (!h
->packet_number
&& !xpn
)
419 /* length check, f) g) h) i) */
421 return len
== extra_len
+ h
->short_length
;
422 return len
>= extra_len
+ MIN_NON_SHORT_LEN
;
425 #define MACSEC_NEEDED_HEADROOM (macsec_extra_len(true))
426 #define MACSEC_NEEDED_TAILROOM MACSEC_STD_ICV_LEN
428 static void macsec_fill_iv_xpn(unsigned char *iv
, ssci_t ssci
, u64 pn
,
431 struct gcm_iv_xpn
*gcm_iv
= (struct gcm_iv_xpn
*)iv
;
433 gcm_iv
->ssci
= ssci
^ salt
.ssci
;
434 gcm_iv
->pn
= cpu_to_be64(pn
) ^ salt
.pn
;
437 static void macsec_fill_iv(unsigned char *iv
, sci_t sci
, u32 pn
)
439 struct gcm_iv
*gcm_iv
= (struct gcm_iv
*)iv
;
442 gcm_iv
->pn
= htonl(pn
);
445 static struct macsec_eth_header
*macsec_ethhdr(struct sk_buff
*skb
)
447 return (struct macsec_eth_header
*)skb_mac_header(skb
);
450 static sci_t
dev_to_sci(struct net_device
*dev
, __be16 port
)
452 return make_sci(dev
->dev_addr
, port
);
455 static void __macsec_pn_wrapped(struct macsec_secy
*secy
,
456 struct macsec_tx_sa
*tx_sa
)
458 pr_debug("PN wrapped, transitioning to !oper\n");
459 tx_sa
->active
= false;
460 if (secy
->protect_frames
)
461 secy
->operational
= false;
464 void macsec_pn_wrapped(struct macsec_secy
*secy
, struct macsec_tx_sa
*tx_sa
)
466 spin_lock_bh(&tx_sa
->lock
);
467 __macsec_pn_wrapped(secy
, tx_sa
);
468 spin_unlock_bh(&tx_sa
->lock
);
470 EXPORT_SYMBOL_GPL(macsec_pn_wrapped
);
472 static pn_t
tx_sa_update_pn(struct macsec_tx_sa
*tx_sa
,
473 struct macsec_secy
*secy
)
477 spin_lock_bh(&tx_sa
->lock
);
479 pn
= tx_sa
->next_pn_halves
;
483 tx_sa
->next_pn_halves
.lower
++;
485 if (tx_sa
->next_pn
== 0)
486 __macsec_pn_wrapped(secy
, tx_sa
);
487 spin_unlock_bh(&tx_sa
->lock
);
492 static void macsec_encrypt_finish(struct sk_buff
*skb
, struct net_device
*dev
)
494 struct macsec_dev
*macsec
= netdev_priv(dev
);
496 skb
->dev
= macsec
->real_dev
;
497 skb_reset_mac_header(skb
);
498 skb
->protocol
= eth_hdr(skb
)->h_proto
;
501 static void macsec_count_tx(struct sk_buff
*skb
, struct macsec_tx_sc
*tx_sc
,
502 struct macsec_tx_sa
*tx_sa
)
504 struct pcpu_tx_sc_stats
*txsc_stats
= this_cpu_ptr(tx_sc
->stats
);
506 u64_stats_update_begin(&txsc_stats
->syncp
);
507 if (tx_sc
->encrypt
) {
508 txsc_stats
->stats
.OutOctetsEncrypted
+= skb
->len
;
509 txsc_stats
->stats
.OutPktsEncrypted
++;
510 this_cpu_inc(tx_sa
->stats
->OutPktsEncrypted
);
512 txsc_stats
->stats
.OutOctetsProtected
+= skb
->len
;
513 txsc_stats
->stats
.OutPktsProtected
++;
514 this_cpu_inc(tx_sa
->stats
->OutPktsProtected
);
516 u64_stats_update_end(&txsc_stats
->syncp
);
519 static void count_tx(struct net_device
*dev
, int ret
, int len
)
521 if (likely(ret
== NET_XMIT_SUCCESS
|| ret
== NET_XMIT_CN
)) {
522 struct pcpu_sw_netstats
*stats
= this_cpu_ptr(dev
->tstats
);
524 u64_stats_update_begin(&stats
->syncp
);
526 stats
->tx_bytes
+= len
;
527 u64_stats_update_end(&stats
->syncp
);
531 static void macsec_encrypt_done(struct crypto_async_request
*base
, int err
)
533 struct sk_buff
*skb
= base
->data
;
534 struct net_device
*dev
= skb
->dev
;
535 struct macsec_dev
*macsec
= macsec_priv(dev
);
536 struct macsec_tx_sa
*sa
= macsec_skb_cb(skb
)->tx_sa
;
539 aead_request_free(macsec_skb_cb(skb
)->req
);
542 macsec_encrypt_finish(skb
, dev
);
543 macsec_count_tx(skb
, &macsec
->secy
.tx_sc
, macsec_skb_cb(skb
)->tx_sa
);
545 ret
= dev_queue_xmit(skb
);
546 count_tx(dev
, ret
, len
);
547 rcu_read_unlock_bh();
553 static struct aead_request
*macsec_alloc_req(struct crypto_aead
*tfm
,
555 struct scatterlist
**sg
,
558 size_t size
, iv_offset
, sg_offset
;
559 struct aead_request
*req
;
562 size
= sizeof(struct aead_request
) + crypto_aead_reqsize(tfm
);
564 size
+= GCM_AES_IV_LEN
;
566 size
= ALIGN(size
, __alignof__(struct scatterlist
));
568 size
+= sizeof(struct scatterlist
) * num_frags
;
570 tmp
= kmalloc(size
, GFP_ATOMIC
);
574 *iv
= (unsigned char *)(tmp
+ iv_offset
);
575 *sg
= (struct scatterlist
*)(tmp
+ sg_offset
);
578 aead_request_set_tfm(req
, tfm
);
583 static struct sk_buff
*macsec_encrypt(struct sk_buff
*skb
,
584 struct net_device
*dev
)
587 struct scatterlist
*sg
;
588 struct sk_buff
*trailer
;
591 struct macsec_eth_header
*hh
;
592 size_t unprotected_len
;
593 struct aead_request
*req
;
594 struct macsec_secy
*secy
;
595 struct macsec_tx_sc
*tx_sc
;
596 struct macsec_tx_sa
*tx_sa
;
597 struct macsec_dev
*macsec
= macsec_priv(dev
);
601 secy
= &macsec
->secy
;
602 tx_sc
= &secy
->tx_sc
;
604 /* 10.5.1 TX SA assignment */
605 tx_sa
= macsec_txsa_get(tx_sc
->sa
[tx_sc
->encoding_sa
]);
607 secy
->operational
= false;
609 return ERR_PTR(-EINVAL
);
612 if (unlikely(skb_headroom(skb
) < MACSEC_NEEDED_HEADROOM
||
613 skb_tailroom(skb
) < MACSEC_NEEDED_TAILROOM
)) {
614 struct sk_buff
*nskb
= skb_copy_expand(skb
,
615 MACSEC_NEEDED_HEADROOM
,
616 MACSEC_NEEDED_TAILROOM
,
622 macsec_txsa_put(tx_sa
);
624 return ERR_PTR(-ENOMEM
);
627 skb
= skb_unshare(skb
, GFP_ATOMIC
);
629 macsec_txsa_put(tx_sa
);
630 return ERR_PTR(-ENOMEM
);
634 unprotected_len
= skb
->len
;
636 sci_present
= send_sci(secy
);
637 hh
= skb_push(skb
, macsec_extra_len(sci_present
));
638 memmove(hh
, eth
, 2 * ETH_ALEN
);
640 pn
= tx_sa_update_pn(tx_sa
, secy
);
641 if (pn
.full64
== 0) {
642 macsec_txsa_put(tx_sa
);
644 return ERR_PTR(-ENOLINK
);
646 macsec_fill_sectag(hh
, secy
, pn
.lower
, sci_present
);
647 macsec_set_shortlen(hh
, unprotected_len
- 2 * ETH_ALEN
);
649 skb_put(skb
, secy
->icv_len
);
651 if (skb
->len
- ETH_HLEN
> macsec_priv(dev
)->real_dev
->mtu
) {
652 struct pcpu_secy_stats
*secy_stats
= this_cpu_ptr(macsec
->stats
);
654 u64_stats_update_begin(&secy_stats
->syncp
);
655 secy_stats
->stats
.OutPktsTooLong
++;
656 u64_stats_update_end(&secy_stats
->syncp
);
658 macsec_txsa_put(tx_sa
);
660 return ERR_PTR(-EINVAL
);
663 ret
= skb_cow_data(skb
, 0, &trailer
);
664 if (unlikely(ret
< 0)) {
665 macsec_txsa_put(tx_sa
);
670 req
= macsec_alloc_req(tx_sa
->key
.tfm
, &iv
, &sg
, ret
);
672 macsec_txsa_put(tx_sa
);
674 return ERR_PTR(-ENOMEM
);
678 macsec_fill_iv_xpn(iv
, tx_sa
->ssci
, pn
.full64
, tx_sa
->key
.salt
);
680 macsec_fill_iv(iv
, secy
->sci
, pn
.lower
);
682 sg_init_table(sg
, ret
);
683 ret
= skb_to_sgvec(skb
, sg
, 0, skb
->len
);
684 if (unlikely(ret
< 0)) {
685 aead_request_free(req
);
686 macsec_txsa_put(tx_sa
);
691 if (tx_sc
->encrypt
) {
692 int len
= skb
->len
- macsec_hdr_len(sci_present
) -
694 aead_request_set_crypt(req
, sg
, sg
, len
, iv
);
695 aead_request_set_ad(req
, macsec_hdr_len(sci_present
));
697 aead_request_set_crypt(req
, sg
, sg
, 0, iv
);
698 aead_request_set_ad(req
, skb
->len
- secy
->icv_len
);
701 macsec_skb_cb(skb
)->req
= req
;
702 macsec_skb_cb(skb
)->tx_sa
= tx_sa
;
703 aead_request_set_callback(req
, 0, macsec_encrypt_done
, skb
);
706 ret
= crypto_aead_encrypt(req
);
707 if (ret
== -EINPROGRESS
) {
709 } else if (ret
!= 0) {
712 aead_request_free(req
);
713 macsec_txsa_put(tx_sa
);
714 return ERR_PTR(-EINVAL
);
718 aead_request_free(req
);
719 macsec_txsa_put(tx_sa
);
724 static bool macsec_post_decrypt(struct sk_buff
*skb
, struct macsec_secy
*secy
, u32 pn
)
726 struct macsec_rx_sa
*rx_sa
= macsec_skb_cb(skb
)->rx_sa
;
727 struct pcpu_rx_sc_stats
*rxsc_stats
= this_cpu_ptr(rx_sa
->sc
->stats
);
728 struct macsec_eth_header
*hdr
= macsec_ethhdr(skb
);
731 spin_lock(&rx_sa
->lock
);
732 if (rx_sa
->next_pn_halves
.lower
>= secy
->replay_window
)
733 lowest_pn
= rx_sa
->next_pn_halves
.lower
- secy
->replay_window
;
735 /* Now perform replay protection check again
736 * (see IEEE 802.1AE-2006 figure 10-5)
738 if (secy
->replay_protect
&& pn
< lowest_pn
&&
739 (!secy
->xpn
|| pn_same_half(pn
, lowest_pn
))) {
740 spin_unlock(&rx_sa
->lock
);
741 u64_stats_update_begin(&rxsc_stats
->syncp
);
742 rxsc_stats
->stats
.InPktsLate
++;
743 u64_stats_update_end(&rxsc_stats
->syncp
);
747 if (secy
->validate_frames
!= MACSEC_VALIDATE_DISABLED
) {
748 u64_stats_update_begin(&rxsc_stats
->syncp
);
749 if (hdr
->tci_an
& MACSEC_TCI_E
)
750 rxsc_stats
->stats
.InOctetsDecrypted
+= skb
->len
;
752 rxsc_stats
->stats
.InOctetsValidated
+= skb
->len
;
753 u64_stats_update_end(&rxsc_stats
->syncp
);
756 if (!macsec_skb_cb(skb
)->valid
) {
757 spin_unlock(&rx_sa
->lock
);
760 if (hdr
->tci_an
& MACSEC_TCI_C
||
761 secy
->validate_frames
== MACSEC_VALIDATE_STRICT
) {
762 u64_stats_update_begin(&rxsc_stats
->syncp
);
763 rxsc_stats
->stats
.InPktsNotValid
++;
764 u64_stats_update_end(&rxsc_stats
->syncp
);
768 u64_stats_update_begin(&rxsc_stats
->syncp
);
769 if (secy
->validate_frames
== MACSEC_VALIDATE_CHECK
) {
770 rxsc_stats
->stats
.InPktsInvalid
++;
771 this_cpu_inc(rx_sa
->stats
->InPktsInvalid
);
772 } else if (pn
< lowest_pn
) {
773 rxsc_stats
->stats
.InPktsDelayed
++;
775 rxsc_stats
->stats
.InPktsUnchecked
++;
777 u64_stats_update_end(&rxsc_stats
->syncp
);
779 u64_stats_update_begin(&rxsc_stats
->syncp
);
780 if (pn
< lowest_pn
) {
781 rxsc_stats
->stats
.InPktsDelayed
++;
783 rxsc_stats
->stats
.InPktsOK
++;
784 this_cpu_inc(rx_sa
->stats
->InPktsOK
);
786 u64_stats_update_end(&rxsc_stats
->syncp
);
788 // Instead of "pn >=" - to support pn overflow in xpn
789 if (pn
+ 1 > rx_sa
->next_pn_halves
.lower
) {
790 rx_sa
->next_pn_halves
.lower
= pn
+ 1;
791 } else if (secy
->xpn
&&
792 !pn_same_half(pn
, rx_sa
->next_pn_halves
.lower
)) {
793 rx_sa
->next_pn_halves
.upper
++;
794 rx_sa
->next_pn_halves
.lower
= pn
+ 1;
797 spin_unlock(&rx_sa
->lock
);
803 static void macsec_reset_skb(struct sk_buff
*skb
, struct net_device
*dev
)
805 skb
->pkt_type
= PACKET_HOST
;
806 skb
->protocol
= eth_type_trans(skb
, dev
);
808 skb_reset_network_header(skb
);
809 if (!skb_transport_header_was_set(skb
))
810 skb_reset_transport_header(skb
);
811 skb_reset_mac_len(skb
);
814 static void macsec_finalize_skb(struct sk_buff
*skb
, u8 icv_len
, u8 hdr_len
)
816 skb
->ip_summed
= CHECKSUM_NONE
;
817 memmove(skb
->data
+ hdr_len
, skb
->data
, 2 * ETH_ALEN
);
818 skb_pull(skb
, hdr_len
);
819 pskb_trim_unique(skb
, skb
->len
- icv_len
);
822 static void count_rx(struct net_device
*dev
, int len
)
824 struct pcpu_sw_netstats
*stats
= this_cpu_ptr(dev
->tstats
);
826 u64_stats_update_begin(&stats
->syncp
);
828 stats
->rx_bytes
+= len
;
829 u64_stats_update_end(&stats
->syncp
);
832 static void macsec_decrypt_done(struct crypto_async_request
*base
, int err
)
834 struct sk_buff
*skb
= base
->data
;
835 struct net_device
*dev
= skb
->dev
;
836 struct macsec_dev
*macsec
= macsec_priv(dev
);
837 struct macsec_rx_sa
*rx_sa
= macsec_skb_cb(skb
)->rx_sa
;
838 struct macsec_rx_sc
*rx_sc
= rx_sa
->sc
;
842 aead_request_free(macsec_skb_cb(skb
)->req
);
845 macsec_skb_cb(skb
)->valid
= true;
848 pn
= ntohl(macsec_ethhdr(skb
)->packet_number
);
849 if (!macsec_post_decrypt(skb
, &macsec
->secy
, pn
)) {
850 rcu_read_unlock_bh();
855 macsec_finalize_skb(skb
, macsec
->secy
.icv_len
,
856 macsec_extra_len(macsec_skb_cb(skb
)->has_sci
));
857 macsec_reset_skb(skb
, macsec
->secy
.netdev
);
860 if (gro_cells_receive(&macsec
->gro_cells
, skb
) == NET_RX_SUCCESS
)
863 rcu_read_unlock_bh();
866 macsec_rxsa_put(rx_sa
);
867 macsec_rxsc_put(rx_sc
);
871 static struct sk_buff
*macsec_decrypt(struct sk_buff
*skb
,
872 struct net_device
*dev
,
873 struct macsec_rx_sa
*rx_sa
,
875 struct macsec_secy
*secy
)
878 struct scatterlist
*sg
;
879 struct sk_buff
*trailer
;
881 struct aead_request
*req
;
882 struct macsec_eth_header
*hdr
;
884 u16 icv_len
= secy
->icv_len
;
886 macsec_skb_cb(skb
)->valid
= false;
887 skb
= skb_share_check(skb
, GFP_ATOMIC
);
889 return ERR_PTR(-ENOMEM
);
891 ret
= skb_cow_data(skb
, 0, &trailer
);
892 if (unlikely(ret
< 0)) {
896 req
= macsec_alloc_req(rx_sa
->key
.tfm
, &iv
, &sg
, ret
);
899 return ERR_PTR(-ENOMEM
);
902 hdr
= (struct macsec_eth_header
*)skb
->data
;
903 hdr_pn
= ntohl(hdr
->packet_number
);
906 pn_t recovered_pn
= rx_sa
->next_pn_halves
;
908 recovered_pn
.lower
= hdr_pn
;
909 if (hdr_pn
< rx_sa
->next_pn_halves
.lower
&&
910 !pn_same_half(hdr_pn
, rx_sa
->next_pn_halves
.lower
))
911 recovered_pn
.upper
++;
913 macsec_fill_iv_xpn(iv
, rx_sa
->ssci
, recovered_pn
.full64
,
916 macsec_fill_iv(iv
, sci
, hdr_pn
);
919 sg_init_table(sg
, ret
);
920 ret
= skb_to_sgvec(skb
, sg
, 0, skb
->len
);
921 if (unlikely(ret
< 0)) {
922 aead_request_free(req
);
927 if (hdr
->tci_an
& MACSEC_TCI_E
) {
928 /* confidentiality: ethernet + macsec header
929 * authenticated, encrypted payload
931 int len
= skb
->len
- macsec_hdr_len(macsec_skb_cb(skb
)->has_sci
);
933 aead_request_set_crypt(req
, sg
, sg
, len
, iv
);
934 aead_request_set_ad(req
, macsec_hdr_len(macsec_skb_cb(skb
)->has_sci
));
935 skb
= skb_unshare(skb
, GFP_ATOMIC
);
937 aead_request_free(req
);
938 return ERR_PTR(-ENOMEM
);
941 /* integrity only: all headers + data authenticated */
942 aead_request_set_crypt(req
, sg
, sg
, icv_len
, iv
);
943 aead_request_set_ad(req
, skb
->len
- icv_len
);
946 macsec_skb_cb(skb
)->req
= req
;
948 aead_request_set_callback(req
, 0, macsec_decrypt_done
, skb
);
951 ret
= crypto_aead_decrypt(req
);
952 if (ret
== -EINPROGRESS
) {
954 } else if (ret
!= 0) {
955 /* decryption/authentication failed
956 * 10.6 if validateFrames is disabled, deliver anyway
958 if (ret
!= -EBADMSG
) {
963 macsec_skb_cb(skb
)->valid
= true;
967 aead_request_free(req
);
972 static struct macsec_rx_sc
*find_rx_sc(struct macsec_secy
*secy
, sci_t sci
)
974 struct macsec_rx_sc
*rx_sc
;
976 for_each_rxsc(secy
, rx_sc
) {
977 if (rx_sc
->sci
== sci
)
984 static struct macsec_rx_sc
*find_rx_sc_rtnl(struct macsec_secy
*secy
, sci_t sci
)
986 struct macsec_rx_sc
*rx_sc
;
988 for_each_rxsc_rtnl(secy
, rx_sc
) {
989 if (rx_sc
->sci
== sci
)
996 static enum rx_handler_result
handle_not_macsec(struct sk_buff
*skb
)
998 /* Deliver to the uncontrolled port by default */
999 enum rx_handler_result ret
= RX_HANDLER_PASS
;
1000 struct ethhdr
*hdr
= eth_hdr(skb
);
1001 struct macsec_rxh_data
*rxd
;
1002 struct macsec_dev
*macsec
;
1005 rxd
= macsec_data_rcu(skb
->dev
);
1007 list_for_each_entry_rcu(macsec
, &rxd
->secys
, secys
) {
1008 struct sk_buff
*nskb
;
1009 struct pcpu_secy_stats
*secy_stats
= this_cpu_ptr(macsec
->stats
);
1010 struct net_device
*ndev
= macsec
->secy
.netdev
;
1012 /* If h/w offloading is enabled, HW decodes frames and strips
1013 * the SecTAG, so we have to deduce which port to deliver to.
1015 if (macsec_is_offloaded(macsec
) && netif_running(ndev
)) {
1016 if (ether_addr_equal_64bits(hdr
->h_dest
,
1018 /* exact match, divert skb to this port */
1020 skb
->pkt_type
= PACKET_HOST
;
1021 ret
= RX_HANDLER_ANOTHER
;
1023 } else if (is_multicast_ether_addr_64bits(
1025 /* multicast frame, deliver on this port too */
1026 nskb
= skb_clone(skb
, GFP_ATOMIC
);
1031 if (ether_addr_equal_64bits(hdr
->h_dest
,
1033 nskb
->pkt_type
= PACKET_BROADCAST
;
1035 nskb
->pkt_type
= PACKET_MULTICAST
;
1042 /* 10.6 If the management control validateFrames is not
1043 * Strict, frames without a SecTAG are received, counted, and
1044 * delivered to the Controlled Port
1046 if (macsec
->secy
.validate_frames
== MACSEC_VALIDATE_STRICT
) {
1047 u64_stats_update_begin(&secy_stats
->syncp
);
1048 secy_stats
->stats
.InPktsNoTag
++;
1049 u64_stats_update_end(&secy_stats
->syncp
);
1053 /* deliver on this port */
1054 nskb
= skb_clone(skb
, GFP_ATOMIC
);
1060 if (netif_rx(nskb
) == NET_RX_SUCCESS
) {
1061 u64_stats_update_begin(&secy_stats
->syncp
);
1062 secy_stats
->stats
.InPktsUntagged
++;
1063 u64_stats_update_end(&secy_stats
->syncp
);
1072 static rx_handler_result_t
macsec_handle_frame(struct sk_buff
**pskb
)
1074 struct sk_buff
*skb
= *pskb
;
1075 struct net_device
*dev
= skb
->dev
;
1076 struct macsec_eth_header
*hdr
;
1077 struct macsec_secy
*secy
= NULL
;
1078 struct macsec_rx_sc
*rx_sc
;
1079 struct macsec_rx_sa
*rx_sa
;
1080 struct macsec_rxh_data
*rxd
;
1081 struct macsec_dev
*macsec
;
1086 struct pcpu_rx_sc_stats
*rxsc_stats
;
1087 struct pcpu_secy_stats
*secy_stats
;
1091 if (skb_headroom(skb
) < ETH_HLEN
)
1094 hdr
= macsec_ethhdr(skb
);
1095 if (hdr
->eth
.h_proto
!= htons(ETH_P_MACSEC
))
1096 return handle_not_macsec(skb
);
1098 skb
= skb_unshare(skb
, GFP_ATOMIC
);
1101 return RX_HANDLER_CONSUMED
;
1103 pulled_sci
= pskb_may_pull(skb
, macsec_extra_len(true));
1105 if (!pskb_may_pull(skb
, macsec_extra_len(false)))
1109 hdr
= macsec_ethhdr(skb
);
1111 /* Frames with a SecTAG that has the TCI E bit set but the C
1112 * bit clear are discarded, as this reserved encoding is used
1113 * to identify frames with a SecTAG that are not to be
1114 * delivered to the Controlled Port.
1116 if ((hdr
->tci_an
& (MACSEC_TCI_C
| MACSEC_TCI_E
)) == MACSEC_TCI_E
)
1117 return RX_HANDLER_PASS
;
1119 /* now, pull the extra length */
1120 if (hdr
->tci_an
& MACSEC_TCI_SC
) {
1125 /* ethernet header is part of crypto processing */
1126 skb_push(skb
, ETH_HLEN
);
1128 macsec_skb_cb(skb
)->has_sci
= !!(hdr
->tci_an
& MACSEC_TCI_SC
);
1129 macsec_skb_cb(skb
)->assoc_num
= hdr
->tci_an
& MACSEC_AN_MASK
;
1130 sci
= macsec_frame_sci(hdr
, macsec_skb_cb(skb
)->has_sci
);
1133 rxd
= macsec_data_rcu(skb
->dev
);
1135 list_for_each_entry_rcu(macsec
, &rxd
->secys
, secys
) {
1136 struct macsec_rx_sc
*sc
= find_rx_sc(&macsec
->secy
, sci
);
1138 sc
= sc
? macsec_rxsc_get(sc
) : NULL
;
1141 secy
= &macsec
->secy
;
1151 macsec
= macsec_priv(dev
);
1152 secy_stats
= this_cpu_ptr(macsec
->stats
);
1153 rxsc_stats
= this_cpu_ptr(rx_sc
->stats
);
1155 if (!macsec_validate_skb(skb
, secy
->icv_len
, secy
->xpn
)) {
1156 u64_stats_update_begin(&secy_stats
->syncp
);
1157 secy_stats
->stats
.InPktsBadTag
++;
1158 u64_stats_update_end(&secy_stats
->syncp
);
1162 rx_sa
= macsec_rxsa_get(rx_sc
->sa
[macsec_skb_cb(skb
)->assoc_num
]);
1164 /* 10.6.1 if the SA is not in use */
1166 /* If validateFrames is Strict or the C bit in the
1167 * SecTAG is set, discard
1169 if (hdr
->tci_an
& MACSEC_TCI_C
||
1170 secy
->validate_frames
== MACSEC_VALIDATE_STRICT
) {
1171 u64_stats_update_begin(&rxsc_stats
->syncp
);
1172 rxsc_stats
->stats
.InPktsNotUsingSA
++;
1173 u64_stats_update_end(&rxsc_stats
->syncp
);
1177 /* not Strict, the frame (with the SecTAG and ICV
1178 * removed) is delivered to the Controlled Port.
1180 u64_stats_update_begin(&rxsc_stats
->syncp
);
1181 rxsc_stats
->stats
.InPktsUnusedSA
++;
1182 u64_stats_update_end(&rxsc_stats
->syncp
);
1186 /* First, PN check to avoid decrypting obviously wrong packets */
1187 hdr_pn
= ntohl(hdr
->packet_number
);
1188 if (secy
->replay_protect
) {
1191 spin_lock(&rx_sa
->lock
);
1192 late
= rx_sa
->next_pn_halves
.lower
>= secy
->replay_window
&&
1193 hdr_pn
< (rx_sa
->next_pn_halves
.lower
- secy
->replay_window
);
1196 late
= late
&& pn_same_half(rx_sa
->next_pn_halves
.lower
, hdr_pn
);
1197 spin_unlock(&rx_sa
->lock
);
1200 u64_stats_update_begin(&rxsc_stats
->syncp
);
1201 rxsc_stats
->stats
.InPktsLate
++;
1202 u64_stats_update_end(&rxsc_stats
->syncp
);
1207 macsec_skb_cb(skb
)->rx_sa
= rx_sa
;
1209 /* Disabled && !changed text => skip validation */
1210 if (hdr
->tci_an
& MACSEC_TCI_C
||
1211 secy
->validate_frames
!= MACSEC_VALIDATE_DISABLED
)
1212 skb
= macsec_decrypt(skb
, dev
, rx_sa
, sci
, secy
);
1215 /* the decrypt callback needs the reference */
1216 if (PTR_ERR(skb
) != -EINPROGRESS
) {
1217 macsec_rxsa_put(rx_sa
);
1218 macsec_rxsc_put(rx_sc
);
1222 return RX_HANDLER_CONSUMED
;
1225 if (!macsec_post_decrypt(skb
, secy
, hdr_pn
))
1229 macsec_finalize_skb(skb
, secy
->icv_len
,
1230 macsec_extra_len(macsec_skb_cb(skb
)->has_sci
));
1231 macsec_reset_skb(skb
, secy
->netdev
);
1234 macsec_rxsa_put(rx_sa
);
1235 macsec_rxsc_put(rx_sc
);
1239 ret
= gro_cells_receive(&macsec
->gro_cells
, skb
);
1240 if (ret
== NET_RX_SUCCESS
)
1243 macsec
->secy
.netdev
->stats
.rx_dropped
++;
1248 return RX_HANDLER_CONSUMED
;
1251 macsec_rxsa_put(rx_sa
);
1253 macsec_rxsc_put(rx_sc
);
1258 return RX_HANDLER_CONSUMED
;
1261 /* 10.6.1 if the SC is not found */
1262 cbit
= !!(hdr
->tci_an
& MACSEC_TCI_C
);
1264 macsec_finalize_skb(skb
, DEFAULT_ICV_LEN
,
1265 macsec_extra_len(macsec_skb_cb(skb
)->has_sci
));
1267 list_for_each_entry_rcu(macsec
, &rxd
->secys
, secys
) {
1268 struct sk_buff
*nskb
;
1270 secy_stats
= this_cpu_ptr(macsec
->stats
);
1272 /* If validateFrames is Strict or the C bit in the
1273 * SecTAG is set, discard
1276 macsec
->secy
.validate_frames
== MACSEC_VALIDATE_STRICT
) {
1277 u64_stats_update_begin(&secy_stats
->syncp
);
1278 secy_stats
->stats
.InPktsNoSCI
++;
1279 u64_stats_update_end(&secy_stats
->syncp
);
1283 /* not strict, the frame (with the SecTAG and ICV
1284 * removed) is delivered to the Controlled Port.
1286 nskb
= skb_clone(skb
, GFP_ATOMIC
);
1290 macsec_reset_skb(nskb
, macsec
->secy
.netdev
);
1292 ret
= netif_rx(nskb
);
1293 if (ret
== NET_RX_SUCCESS
) {
1294 u64_stats_update_begin(&secy_stats
->syncp
);
1295 secy_stats
->stats
.InPktsUnknownSCI
++;
1296 u64_stats_update_end(&secy_stats
->syncp
);
1298 macsec
->secy
.netdev
->stats
.rx_dropped
++;
1304 return RX_HANDLER_PASS
;
1307 static struct crypto_aead
*macsec_alloc_tfm(char *key
, int key_len
, int icv_len
)
1309 struct crypto_aead
*tfm
;
1312 /* Pick a sync gcm(aes) cipher to ensure order is preserved. */
1313 tfm
= crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC
);
1318 ret
= crypto_aead_setkey(tfm
, key
, key_len
);
1322 ret
= crypto_aead_setauthsize(tfm
, icv_len
);
1328 crypto_free_aead(tfm
);
1329 return ERR_PTR(ret
);
1332 static int init_rx_sa(struct macsec_rx_sa
*rx_sa
, char *sak
, int key_len
,
1335 rx_sa
->stats
= alloc_percpu(struct macsec_rx_sa_stats
);
1339 rx_sa
->key
.tfm
= macsec_alloc_tfm(sak
, key_len
, icv_len
);
1340 if (IS_ERR(rx_sa
->key
.tfm
)) {
1341 free_percpu(rx_sa
->stats
);
1342 return PTR_ERR(rx_sa
->key
.tfm
);
1345 rx_sa
->ssci
= MACSEC_UNDEF_SSCI
;
1346 rx_sa
->active
= false;
1348 refcount_set(&rx_sa
->refcnt
, 1);
1349 spin_lock_init(&rx_sa
->lock
);
1354 static void clear_rx_sa(struct macsec_rx_sa
*rx_sa
)
1356 rx_sa
->active
= false;
1358 macsec_rxsa_put(rx_sa
);
1361 static void free_rx_sc(struct macsec_rx_sc
*rx_sc
)
1365 for (i
= 0; i
< MACSEC_NUM_AN
; i
++) {
1366 struct macsec_rx_sa
*sa
= rtnl_dereference(rx_sc
->sa
[i
]);
1368 RCU_INIT_POINTER(rx_sc
->sa
[i
], NULL
);
1373 macsec_rxsc_put(rx_sc
);
1376 static struct macsec_rx_sc
*del_rx_sc(struct macsec_secy
*secy
, sci_t sci
)
1378 struct macsec_rx_sc
*rx_sc
, __rcu
**rx_scp
;
1380 for (rx_scp
= &secy
->rx_sc
, rx_sc
= rtnl_dereference(*rx_scp
);
1382 rx_scp
= &rx_sc
->next
, rx_sc
= rtnl_dereference(*rx_scp
)) {
1383 if (rx_sc
->sci
== sci
) {
1386 rcu_assign_pointer(*rx_scp
, rx_sc
->next
);
1394 static struct macsec_rx_sc
*create_rx_sc(struct net_device
*dev
, sci_t sci
)
1396 struct macsec_rx_sc
*rx_sc
;
1397 struct macsec_dev
*macsec
;
1398 struct net_device
*real_dev
= macsec_priv(dev
)->real_dev
;
1399 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(real_dev
);
1400 struct macsec_secy
*secy
;
1402 list_for_each_entry(macsec
, &rxd
->secys
, secys
) {
1403 if (find_rx_sc_rtnl(&macsec
->secy
, sci
))
1404 return ERR_PTR(-EEXIST
);
1407 rx_sc
= kzalloc(sizeof(*rx_sc
), GFP_KERNEL
);
1409 return ERR_PTR(-ENOMEM
);
1411 rx_sc
->stats
= netdev_alloc_pcpu_stats(struct pcpu_rx_sc_stats
);
1412 if (!rx_sc
->stats
) {
1414 return ERR_PTR(-ENOMEM
);
1418 rx_sc
->active
= true;
1419 refcount_set(&rx_sc
->refcnt
, 1);
1421 secy
= &macsec_priv(dev
)->secy
;
1422 rcu_assign_pointer(rx_sc
->next
, secy
->rx_sc
);
1423 rcu_assign_pointer(secy
->rx_sc
, rx_sc
);
1431 static int init_tx_sa(struct macsec_tx_sa
*tx_sa
, char *sak
, int key_len
,
1434 tx_sa
->stats
= alloc_percpu(struct macsec_tx_sa_stats
);
1438 tx_sa
->key
.tfm
= macsec_alloc_tfm(sak
, key_len
, icv_len
);
1439 if (IS_ERR(tx_sa
->key
.tfm
)) {
1440 free_percpu(tx_sa
->stats
);
1441 return PTR_ERR(tx_sa
->key
.tfm
);
1444 tx_sa
->ssci
= MACSEC_UNDEF_SSCI
;
1445 tx_sa
->active
= false;
1446 refcount_set(&tx_sa
->refcnt
, 1);
1447 spin_lock_init(&tx_sa
->lock
);
1452 static void clear_tx_sa(struct macsec_tx_sa
*tx_sa
)
1454 tx_sa
->active
= false;
1456 macsec_txsa_put(tx_sa
);
1459 static struct genl_family macsec_fam
;
1461 static struct net_device
*get_dev_from_nl(struct net
*net
,
1462 struct nlattr
**attrs
)
1464 int ifindex
= nla_get_u32(attrs
[MACSEC_ATTR_IFINDEX
]);
1465 struct net_device
*dev
;
1467 dev
= __dev_get_by_index(net
, ifindex
);
1469 return ERR_PTR(-ENODEV
);
1471 if (!netif_is_macsec(dev
))
1472 return ERR_PTR(-ENODEV
);
1477 static enum macsec_offload
nla_get_offload(const struct nlattr
*nla
)
1479 return (__force
enum macsec_offload
)nla_get_u8(nla
);
1482 static sci_t
nla_get_sci(const struct nlattr
*nla
)
1484 return (__force sci_t
)nla_get_u64(nla
);
1487 static int nla_put_sci(struct sk_buff
*skb
, int attrtype
, sci_t value
,
1490 return nla_put_u64_64bit(skb
, attrtype
, (__force u64
)value
, padattr
);
1493 static ssci_t
nla_get_ssci(const struct nlattr
*nla
)
1495 return (__force ssci_t
)nla_get_u32(nla
);
1498 static int nla_put_ssci(struct sk_buff
*skb
, int attrtype
, ssci_t value
)
1500 return nla_put_u32(skb
, attrtype
, (__force u64
)value
);
1503 static struct macsec_tx_sa
*get_txsa_from_nl(struct net
*net
,
1504 struct nlattr
**attrs
,
1505 struct nlattr
**tb_sa
,
1506 struct net_device
**devp
,
1507 struct macsec_secy
**secyp
,
1508 struct macsec_tx_sc
**scp
,
1511 struct net_device
*dev
;
1512 struct macsec_secy
*secy
;
1513 struct macsec_tx_sc
*tx_sc
;
1514 struct macsec_tx_sa
*tx_sa
;
1516 if (!tb_sa
[MACSEC_SA_ATTR_AN
])
1517 return ERR_PTR(-EINVAL
);
1519 *assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1521 dev
= get_dev_from_nl(net
, attrs
);
1523 return ERR_CAST(dev
);
1525 if (*assoc_num
>= MACSEC_NUM_AN
)
1526 return ERR_PTR(-EINVAL
);
1528 secy
= &macsec_priv(dev
)->secy
;
1529 tx_sc
= &secy
->tx_sc
;
1531 tx_sa
= rtnl_dereference(tx_sc
->sa
[*assoc_num
]);
1533 return ERR_PTR(-ENODEV
);
1541 static struct macsec_rx_sc
*get_rxsc_from_nl(struct net
*net
,
1542 struct nlattr
**attrs
,
1543 struct nlattr
**tb_rxsc
,
1544 struct net_device
**devp
,
1545 struct macsec_secy
**secyp
)
1547 struct net_device
*dev
;
1548 struct macsec_secy
*secy
;
1549 struct macsec_rx_sc
*rx_sc
;
1552 dev
= get_dev_from_nl(net
, attrs
);
1554 return ERR_CAST(dev
);
1556 secy
= &macsec_priv(dev
)->secy
;
1558 if (!tb_rxsc
[MACSEC_RXSC_ATTR_SCI
])
1559 return ERR_PTR(-EINVAL
);
1561 sci
= nla_get_sci(tb_rxsc
[MACSEC_RXSC_ATTR_SCI
]);
1562 rx_sc
= find_rx_sc_rtnl(secy
, sci
);
1564 return ERR_PTR(-ENODEV
);
1572 static struct macsec_rx_sa
*get_rxsa_from_nl(struct net
*net
,
1573 struct nlattr
**attrs
,
1574 struct nlattr
**tb_rxsc
,
1575 struct nlattr
**tb_sa
,
1576 struct net_device
**devp
,
1577 struct macsec_secy
**secyp
,
1578 struct macsec_rx_sc
**scp
,
1581 struct macsec_rx_sc
*rx_sc
;
1582 struct macsec_rx_sa
*rx_sa
;
1584 if (!tb_sa
[MACSEC_SA_ATTR_AN
])
1585 return ERR_PTR(-EINVAL
);
1587 *assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1588 if (*assoc_num
>= MACSEC_NUM_AN
)
1589 return ERR_PTR(-EINVAL
);
1591 rx_sc
= get_rxsc_from_nl(net
, attrs
, tb_rxsc
, devp
, secyp
);
1593 return ERR_CAST(rx_sc
);
1595 rx_sa
= rtnl_dereference(rx_sc
->sa
[*assoc_num
]);
1597 return ERR_PTR(-ENODEV
);
1603 static const struct nla_policy macsec_genl_policy
[NUM_MACSEC_ATTR
] = {
1604 [MACSEC_ATTR_IFINDEX
] = { .type
= NLA_U32
},
1605 [MACSEC_ATTR_RXSC_CONFIG
] = { .type
= NLA_NESTED
},
1606 [MACSEC_ATTR_SA_CONFIG
] = { .type
= NLA_NESTED
},
1607 [MACSEC_ATTR_OFFLOAD
] = { .type
= NLA_NESTED
},
1610 static const struct nla_policy macsec_genl_rxsc_policy
[NUM_MACSEC_RXSC_ATTR
] = {
1611 [MACSEC_RXSC_ATTR_SCI
] = { .type
= NLA_U64
},
1612 [MACSEC_RXSC_ATTR_ACTIVE
] = { .type
= NLA_U8
},
1615 static const struct nla_policy macsec_genl_sa_policy
[NUM_MACSEC_SA_ATTR
] = {
1616 [MACSEC_SA_ATTR_AN
] = { .type
= NLA_U8
},
1617 [MACSEC_SA_ATTR_ACTIVE
] = { .type
= NLA_U8
},
1618 [MACSEC_SA_ATTR_PN
] = NLA_POLICY_MIN_LEN(4),
1619 [MACSEC_SA_ATTR_KEYID
] = { .type
= NLA_BINARY
,
1620 .len
= MACSEC_KEYID_LEN
, },
1621 [MACSEC_SA_ATTR_KEY
] = { .type
= NLA_BINARY
,
1622 .len
= MACSEC_MAX_KEY_LEN
, },
1623 [MACSEC_SA_ATTR_SSCI
] = { .type
= NLA_U32
},
1624 [MACSEC_SA_ATTR_SALT
] = { .type
= NLA_BINARY
,
1625 .len
= MACSEC_SALT_LEN
, },
1628 static const struct nla_policy macsec_genl_offload_policy
[NUM_MACSEC_OFFLOAD_ATTR
] = {
1629 [MACSEC_OFFLOAD_ATTR_TYPE
] = { .type
= NLA_U8
},
1632 /* Offloads an operation to a device driver */
1633 static int macsec_offload(int (* const func
)(struct macsec_context
*),
1634 struct macsec_context
*ctx
)
1638 if (unlikely(!func
))
1641 if (ctx
->offload
== MACSEC_OFFLOAD_PHY
)
1642 mutex_lock(&ctx
->phydev
->lock
);
1644 /* Phase I: prepare. The drive should fail here if there are going to be
1645 * issues in the commit phase.
1647 ctx
->prepare
= true;
1652 /* Phase II: commit. This step cannot fail. */
1653 ctx
->prepare
= false;
1655 /* This should never happen: commit is not allowed to fail */
1657 WARN(1, "MACsec offloading commit failed (%d)\n", ret
);
1660 if (ctx
->offload
== MACSEC_OFFLOAD_PHY
)
1661 mutex_unlock(&ctx
->phydev
->lock
);
1666 static int parse_sa_config(struct nlattr
**attrs
, struct nlattr
**tb_sa
)
1668 if (!attrs
[MACSEC_ATTR_SA_CONFIG
])
1671 if (nla_parse_nested_deprecated(tb_sa
, MACSEC_SA_ATTR_MAX
, attrs
[MACSEC_ATTR_SA_CONFIG
], macsec_genl_sa_policy
, NULL
))
1677 static int parse_rxsc_config(struct nlattr
**attrs
, struct nlattr
**tb_rxsc
)
1679 if (!attrs
[MACSEC_ATTR_RXSC_CONFIG
])
1682 if (nla_parse_nested_deprecated(tb_rxsc
, MACSEC_RXSC_ATTR_MAX
, attrs
[MACSEC_ATTR_RXSC_CONFIG
], macsec_genl_rxsc_policy
, NULL
))
1688 static bool validate_add_rxsa(struct nlattr
**attrs
)
1690 if (!attrs
[MACSEC_SA_ATTR_AN
] ||
1691 !attrs
[MACSEC_SA_ATTR_KEY
] ||
1692 !attrs
[MACSEC_SA_ATTR_KEYID
])
1695 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_AN
]) >= MACSEC_NUM_AN
)
1698 if (attrs
[MACSEC_SA_ATTR_PN
] &&
1699 nla_get_u64(attrs
[MACSEC_SA_ATTR_PN
]) == 0)
1702 if (attrs
[MACSEC_SA_ATTR_ACTIVE
]) {
1703 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_ACTIVE
]) > 1)
1707 if (nla_len(attrs
[MACSEC_SA_ATTR_KEYID
]) != MACSEC_KEYID_LEN
)
1713 static int macsec_add_rxsa(struct sk_buff
*skb
, struct genl_info
*info
)
1715 struct net_device
*dev
;
1716 struct nlattr
**attrs
= info
->attrs
;
1717 struct macsec_secy
*secy
;
1718 struct macsec_rx_sc
*rx_sc
;
1719 struct macsec_rx_sa
*rx_sa
;
1720 unsigned char assoc_num
;
1722 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
1723 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
1726 if (!attrs
[MACSEC_ATTR_IFINDEX
])
1729 if (parse_sa_config(attrs
, tb_sa
))
1732 if (parse_rxsc_config(attrs
, tb_rxsc
))
1735 if (!validate_add_rxsa(tb_sa
))
1739 rx_sc
= get_rxsc_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, &dev
, &secy
);
1740 if (IS_ERR(rx_sc
)) {
1742 return PTR_ERR(rx_sc
);
1745 assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1747 if (nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]) != secy
->key_len
) {
1748 pr_notice("macsec: nl: add_rxsa: bad key length: %d != %d\n",
1749 nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]), secy
->key_len
);
1754 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
1755 if (tb_sa
[MACSEC_SA_ATTR_PN
] &&
1756 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
1757 pr_notice("macsec: nl: add_rxsa: bad pn length: %d != %d\n",
1758 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
1764 if (!tb_sa
[MACSEC_SA_ATTR_SSCI
] || !tb_sa
[MACSEC_SA_ATTR_SALT
]) {
1769 if (nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]) != MACSEC_SALT_LEN
) {
1770 pr_notice("macsec: nl: add_rxsa: bad salt length: %d != %d\n",
1771 nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]),
1778 rx_sa
= rtnl_dereference(rx_sc
->sa
[assoc_num
]);
1784 rx_sa
= kmalloc(sizeof(*rx_sa
), GFP_KERNEL
);
1790 err
= init_rx_sa(rx_sa
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
1791 secy
->key_len
, secy
->icv_len
);
1798 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
1799 spin_lock_bh(&rx_sa
->lock
);
1800 rx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
1801 spin_unlock_bh(&rx_sa
->lock
);
1804 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
1805 rx_sa
->active
= !!nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
1809 /* If h/w offloading is available, propagate to the device */
1810 if (macsec_is_offloaded(netdev_priv(dev
))) {
1811 const struct macsec_ops
*ops
;
1812 struct macsec_context ctx
;
1814 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
1820 ctx
.sa
.assoc_num
= assoc_num
;
1821 ctx
.sa
.rx_sa
= rx_sa
;
1823 memcpy(ctx
.sa
.key
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
1826 err
= macsec_offload(ops
->mdo_add_rxsa
, &ctx
);
1832 rx_sa
->ssci
= nla_get_ssci(tb_sa
[MACSEC_SA_ATTR_SSCI
]);
1833 nla_memcpy(rx_sa
->key
.salt
.bytes
, tb_sa
[MACSEC_SA_ATTR_SALT
],
1837 nla_memcpy(rx_sa
->key
.id
, tb_sa
[MACSEC_SA_ATTR_KEYID
], MACSEC_KEYID_LEN
);
1838 rcu_assign_pointer(rx_sc
->sa
[assoc_num
], rx_sa
);
1845 macsec_rxsa_put(rx_sa
);
1850 static bool validate_add_rxsc(struct nlattr
**attrs
)
1852 if (!attrs
[MACSEC_RXSC_ATTR_SCI
])
1855 if (attrs
[MACSEC_RXSC_ATTR_ACTIVE
]) {
1856 if (nla_get_u8(attrs
[MACSEC_RXSC_ATTR_ACTIVE
]) > 1)
1863 static int macsec_add_rxsc(struct sk_buff
*skb
, struct genl_info
*info
)
1865 struct net_device
*dev
;
1866 sci_t sci
= MACSEC_UNDEF_SCI
;
1867 struct nlattr
**attrs
= info
->attrs
;
1868 struct macsec_rx_sc
*rx_sc
;
1869 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
1870 struct macsec_secy
*secy
;
1874 if (!attrs
[MACSEC_ATTR_IFINDEX
])
1877 if (parse_rxsc_config(attrs
, tb_rxsc
))
1880 if (!validate_add_rxsc(tb_rxsc
))
1884 dev
= get_dev_from_nl(genl_info_net(info
), attrs
);
1887 return PTR_ERR(dev
);
1890 secy
= &macsec_priv(dev
)->secy
;
1891 sci
= nla_get_sci(tb_rxsc
[MACSEC_RXSC_ATTR_SCI
]);
1893 rx_sc
= create_rx_sc(dev
, sci
);
1894 if (IS_ERR(rx_sc
)) {
1896 return PTR_ERR(rx_sc
);
1899 was_active
= rx_sc
->active
;
1900 if (tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
])
1901 rx_sc
->active
= !!nla_get_u8(tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
]);
1903 if (macsec_is_offloaded(netdev_priv(dev
))) {
1904 const struct macsec_ops
*ops
;
1905 struct macsec_context ctx
;
1907 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
1916 ret
= macsec_offload(ops
->mdo_add_rxsc
, &ctx
);
1926 rx_sc
->active
= was_active
;
1931 static bool validate_add_txsa(struct nlattr
**attrs
)
1933 if (!attrs
[MACSEC_SA_ATTR_AN
] ||
1934 !attrs
[MACSEC_SA_ATTR_PN
] ||
1935 !attrs
[MACSEC_SA_ATTR_KEY
] ||
1936 !attrs
[MACSEC_SA_ATTR_KEYID
])
1939 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_AN
]) >= MACSEC_NUM_AN
)
1942 if (nla_get_u64(attrs
[MACSEC_SA_ATTR_PN
]) == 0)
1945 if (attrs
[MACSEC_SA_ATTR_ACTIVE
]) {
1946 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_ACTIVE
]) > 1)
1950 if (nla_len(attrs
[MACSEC_SA_ATTR_KEYID
]) != MACSEC_KEYID_LEN
)
1956 static int macsec_add_txsa(struct sk_buff
*skb
, struct genl_info
*info
)
1958 struct net_device
*dev
;
1959 struct nlattr
**attrs
= info
->attrs
;
1960 struct macsec_secy
*secy
;
1961 struct macsec_tx_sc
*tx_sc
;
1962 struct macsec_tx_sa
*tx_sa
;
1963 unsigned char assoc_num
;
1965 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
1966 bool was_operational
;
1969 if (!attrs
[MACSEC_ATTR_IFINDEX
])
1972 if (parse_sa_config(attrs
, tb_sa
))
1975 if (!validate_add_txsa(tb_sa
))
1979 dev
= get_dev_from_nl(genl_info_net(info
), attrs
);
1982 return PTR_ERR(dev
);
1985 secy
= &macsec_priv(dev
)->secy
;
1986 tx_sc
= &secy
->tx_sc
;
1988 assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1990 if (nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]) != secy
->key_len
) {
1991 pr_notice("macsec: nl: add_txsa: bad key length: %d != %d\n",
1992 nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]), secy
->key_len
);
1997 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
1998 if (nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
1999 pr_notice("macsec: nl: add_txsa: bad pn length: %d != %d\n",
2000 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
2006 if (!tb_sa
[MACSEC_SA_ATTR_SSCI
] || !tb_sa
[MACSEC_SA_ATTR_SALT
]) {
2011 if (nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]) != MACSEC_SALT_LEN
) {
2012 pr_notice("macsec: nl: add_txsa: bad salt length: %d != %d\n",
2013 nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]),
2020 tx_sa
= rtnl_dereference(tx_sc
->sa
[assoc_num
]);
2026 tx_sa
= kmalloc(sizeof(*tx_sa
), GFP_KERNEL
);
2032 err
= init_tx_sa(tx_sa
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
2033 secy
->key_len
, secy
->icv_len
);
2040 spin_lock_bh(&tx_sa
->lock
);
2041 tx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
2042 spin_unlock_bh(&tx_sa
->lock
);
2044 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
2045 tx_sa
->active
= !!nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
2047 was_operational
= secy
->operational
;
2048 if (assoc_num
== tx_sc
->encoding_sa
&& tx_sa
->active
)
2049 secy
->operational
= true;
2051 /* If h/w offloading is available, propagate to the device */
2052 if (macsec_is_offloaded(netdev_priv(dev
))) {
2053 const struct macsec_ops
*ops
;
2054 struct macsec_context ctx
;
2056 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2062 ctx
.sa
.assoc_num
= assoc_num
;
2063 ctx
.sa
.tx_sa
= tx_sa
;
2065 memcpy(ctx
.sa
.key
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
2068 err
= macsec_offload(ops
->mdo_add_txsa
, &ctx
);
2074 tx_sa
->ssci
= nla_get_ssci(tb_sa
[MACSEC_SA_ATTR_SSCI
]);
2075 nla_memcpy(tx_sa
->key
.salt
.bytes
, tb_sa
[MACSEC_SA_ATTR_SALT
],
2079 nla_memcpy(tx_sa
->key
.id
, tb_sa
[MACSEC_SA_ATTR_KEYID
], MACSEC_KEYID_LEN
);
2080 rcu_assign_pointer(tx_sc
->sa
[assoc_num
], tx_sa
);
2087 secy
->operational
= was_operational
;
2088 macsec_txsa_put(tx_sa
);
2093 static int macsec_del_rxsa(struct sk_buff
*skb
, struct genl_info
*info
)
2095 struct nlattr
**attrs
= info
->attrs
;
2096 struct net_device
*dev
;
2097 struct macsec_secy
*secy
;
2098 struct macsec_rx_sc
*rx_sc
;
2099 struct macsec_rx_sa
*rx_sa
;
2101 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2102 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2105 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2108 if (parse_sa_config(attrs
, tb_sa
))
2111 if (parse_rxsc_config(attrs
, tb_rxsc
))
2115 rx_sa
= get_rxsa_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, tb_sa
,
2116 &dev
, &secy
, &rx_sc
, &assoc_num
);
2117 if (IS_ERR(rx_sa
)) {
2119 return PTR_ERR(rx_sa
);
2122 if (rx_sa
->active
) {
2127 /* If h/w offloading is available, propagate to the device */
2128 if (macsec_is_offloaded(netdev_priv(dev
))) {
2129 const struct macsec_ops
*ops
;
2130 struct macsec_context ctx
;
2132 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2138 ctx
.sa
.assoc_num
= assoc_num
;
2139 ctx
.sa
.rx_sa
= rx_sa
;
2142 ret
= macsec_offload(ops
->mdo_del_rxsa
, &ctx
);
2147 RCU_INIT_POINTER(rx_sc
->sa
[assoc_num
], NULL
);
2159 static int macsec_del_rxsc(struct sk_buff
*skb
, struct genl_info
*info
)
2161 struct nlattr
**attrs
= info
->attrs
;
2162 struct net_device
*dev
;
2163 struct macsec_secy
*secy
;
2164 struct macsec_rx_sc
*rx_sc
;
2166 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2169 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2172 if (parse_rxsc_config(attrs
, tb_rxsc
))
2175 if (!tb_rxsc
[MACSEC_RXSC_ATTR_SCI
])
2179 dev
= get_dev_from_nl(genl_info_net(info
), info
->attrs
);
2182 return PTR_ERR(dev
);
2185 secy
= &macsec_priv(dev
)->secy
;
2186 sci
= nla_get_sci(tb_rxsc
[MACSEC_RXSC_ATTR_SCI
]);
2188 rx_sc
= del_rx_sc(secy
, sci
);
2194 /* If h/w offloading is available, propagate to the device */
2195 if (macsec_is_offloaded(netdev_priv(dev
))) {
2196 const struct macsec_ops
*ops
;
2197 struct macsec_context ctx
;
2199 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2207 ret
= macsec_offload(ops
->mdo_del_rxsc
, &ctx
);
2222 static int macsec_del_txsa(struct sk_buff
*skb
, struct genl_info
*info
)
2224 struct nlattr
**attrs
= info
->attrs
;
2225 struct net_device
*dev
;
2226 struct macsec_secy
*secy
;
2227 struct macsec_tx_sc
*tx_sc
;
2228 struct macsec_tx_sa
*tx_sa
;
2230 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2233 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2236 if (parse_sa_config(attrs
, tb_sa
))
2240 tx_sa
= get_txsa_from_nl(genl_info_net(info
), attrs
, tb_sa
,
2241 &dev
, &secy
, &tx_sc
, &assoc_num
);
2242 if (IS_ERR(tx_sa
)) {
2244 return PTR_ERR(tx_sa
);
2247 if (tx_sa
->active
) {
2252 /* If h/w offloading is available, propagate to the device */
2253 if (macsec_is_offloaded(netdev_priv(dev
))) {
2254 const struct macsec_ops
*ops
;
2255 struct macsec_context ctx
;
2257 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2263 ctx
.sa
.assoc_num
= assoc_num
;
2264 ctx
.sa
.tx_sa
= tx_sa
;
2267 ret
= macsec_offload(ops
->mdo_del_txsa
, &ctx
);
2272 RCU_INIT_POINTER(tx_sc
->sa
[assoc_num
], NULL
);
2284 static bool validate_upd_sa(struct nlattr
**attrs
)
2286 if (!attrs
[MACSEC_SA_ATTR_AN
] ||
2287 attrs
[MACSEC_SA_ATTR_KEY
] ||
2288 attrs
[MACSEC_SA_ATTR_KEYID
] ||
2289 attrs
[MACSEC_SA_ATTR_SSCI
] ||
2290 attrs
[MACSEC_SA_ATTR_SALT
])
2293 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_AN
]) >= MACSEC_NUM_AN
)
2296 if (attrs
[MACSEC_SA_ATTR_PN
] && nla_get_u64(attrs
[MACSEC_SA_ATTR_PN
]) == 0)
2299 if (attrs
[MACSEC_SA_ATTR_ACTIVE
]) {
2300 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_ACTIVE
]) > 1)
2307 static int macsec_upd_txsa(struct sk_buff
*skb
, struct genl_info
*info
)
2309 struct nlattr
**attrs
= info
->attrs
;
2310 struct net_device
*dev
;
2311 struct macsec_secy
*secy
;
2312 struct macsec_tx_sc
*tx_sc
;
2313 struct macsec_tx_sa
*tx_sa
;
2315 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2316 bool was_operational
, was_active
;
2322 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2325 if (parse_sa_config(attrs
, tb_sa
))
2328 if (!validate_upd_sa(tb_sa
))
2332 tx_sa
= get_txsa_from_nl(genl_info_net(info
), attrs
, tb_sa
,
2333 &dev
, &secy
, &tx_sc
, &assoc_num
);
2334 if (IS_ERR(tx_sa
)) {
2336 return PTR_ERR(tx_sa
);
2339 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2342 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
2343 if (nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
2344 pr_notice("macsec: nl: upd_txsa: bad pn length: %d != %d\n",
2345 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
2350 spin_lock_bh(&tx_sa
->lock
);
2351 prev_pn
= tx_sa
->next_pn_halves
;
2352 tx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
2353 spin_unlock_bh(&tx_sa
->lock
);
2356 was_active
= tx_sa
->active
;
2357 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
2358 tx_sa
->active
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
2360 was_operational
= secy
->operational
;
2361 if (assoc_num
== tx_sc
->encoding_sa
)
2362 secy
->operational
= tx_sa
->active
;
2364 /* If h/w offloading is available, propagate to the device */
2365 if (macsec_is_offloaded(netdev_priv(dev
))) {
2366 const struct macsec_ops
*ops
;
2367 struct macsec_context ctx
;
2369 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2375 ctx
.sa
.assoc_num
= assoc_num
;
2376 ctx
.sa
.tx_sa
= tx_sa
;
2379 ret
= macsec_offload(ops
->mdo_upd_txsa
, &ctx
);
2389 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2390 spin_lock_bh(&tx_sa
->lock
);
2391 tx_sa
->next_pn_halves
= prev_pn
;
2392 spin_unlock_bh(&tx_sa
->lock
);
2394 tx_sa
->active
= was_active
;
2395 secy
->operational
= was_operational
;
2400 static int macsec_upd_rxsa(struct sk_buff
*skb
, struct genl_info
*info
)
2402 struct nlattr
**attrs
= info
->attrs
;
2403 struct net_device
*dev
;
2404 struct macsec_secy
*secy
;
2405 struct macsec_rx_sc
*rx_sc
;
2406 struct macsec_rx_sa
*rx_sa
;
2408 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2409 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2416 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2419 if (parse_rxsc_config(attrs
, tb_rxsc
))
2422 if (parse_sa_config(attrs
, tb_sa
))
2425 if (!validate_upd_sa(tb_sa
))
2429 rx_sa
= get_rxsa_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, tb_sa
,
2430 &dev
, &secy
, &rx_sc
, &assoc_num
);
2431 if (IS_ERR(rx_sa
)) {
2433 return PTR_ERR(rx_sa
);
2436 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2439 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
2440 if (nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
2441 pr_notice("macsec: nl: upd_rxsa: bad pn length: %d != %d\n",
2442 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
2447 spin_lock_bh(&rx_sa
->lock
);
2448 prev_pn
= rx_sa
->next_pn_halves
;
2449 rx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
2450 spin_unlock_bh(&rx_sa
->lock
);
2453 was_active
= rx_sa
->active
;
2454 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
2455 rx_sa
->active
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
2457 /* If h/w offloading is available, propagate to the device */
2458 if (macsec_is_offloaded(netdev_priv(dev
))) {
2459 const struct macsec_ops
*ops
;
2460 struct macsec_context ctx
;
2462 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2468 ctx
.sa
.assoc_num
= assoc_num
;
2469 ctx
.sa
.rx_sa
= rx_sa
;
2472 ret
= macsec_offload(ops
->mdo_upd_rxsa
, &ctx
);
2481 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2482 spin_lock_bh(&rx_sa
->lock
);
2483 rx_sa
->next_pn_halves
= prev_pn
;
2484 spin_unlock_bh(&rx_sa
->lock
);
2486 rx_sa
->active
= was_active
;
2491 static int macsec_upd_rxsc(struct sk_buff
*skb
, struct genl_info
*info
)
2493 struct nlattr
**attrs
= info
->attrs
;
2494 struct net_device
*dev
;
2495 struct macsec_secy
*secy
;
2496 struct macsec_rx_sc
*rx_sc
;
2497 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2498 unsigned int prev_n_rx_sc
;
2502 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2505 if (parse_rxsc_config(attrs
, tb_rxsc
))
2508 if (!validate_add_rxsc(tb_rxsc
))
2512 rx_sc
= get_rxsc_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, &dev
, &secy
);
2513 if (IS_ERR(rx_sc
)) {
2515 return PTR_ERR(rx_sc
);
2518 was_active
= rx_sc
->active
;
2519 prev_n_rx_sc
= secy
->n_rx_sc
;
2520 if (tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
]) {
2521 bool new = !!nla_get_u8(tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
]);
2523 if (rx_sc
->active
!= new)
2524 secy
->n_rx_sc
+= new ? 1 : -1;
2526 rx_sc
->active
= new;
2529 /* If h/w offloading is available, propagate to the device */
2530 if (macsec_is_offloaded(netdev_priv(dev
))) {
2531 const struct macsec_ops
*ops
;
2532 struct macsec_context ctx
;
2534 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2543 ret
= macsec_offload(ops
->mdo_upd_rxsc
, &ctx
);
2553 secy
->n_rx_sc
= prev_n_rx_sc
;
2554 rx_sc
->active
= was_active
;
2559 static bool macsec_is_configured(struct macsec_dev
*macsec
)
2561 struct macsec_secy
*secy
= &macsec
->secy
;
2562 struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
2565 if (secy
->n_rx_sc
> 0)
2568 for (i
= 0; i
< MACSEC_NUM_AN
; i
++)
2575 static int macsec_upd_offload(struct sk_buff
*skb
, struct genl_info
*info
)
2577 struct nlattr
*tb_offload
[MACSEC_OFFLOAD_ATTR_MAX
+ 1];
2578 enum macsec_offload offload
, prev_offload
;
2579 int (*func
)(struct macsec_context
*ctx
);
2580 struct nlattr
**attrs
= info
->attrs
;
2581 struct net_device
*dev
;
2582 const struct macsec_ops
*ops
;
2583 struct macsec_context ctx
;
2584 struct macsec_dev
*macsec
;
2587 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2590 if (!attrs
[MACSEC_ATTR_OFFLOAD
])
2593 if (nla_parse_nested_deprecated(tb_offload
, MACSEC_OFFLOAD_ATTR_MAX
,
2594 attrs
[MACSEC_ATTR_OFFLOAD
],
2595 macsec_genl_offload_policy
, NULL
))
2598 dev
= get_dev_from_nl(genl_info_net(info
), attrs
);
2600 return PTR_ERR(dev
);
2601 macsec
= macsec_priv(dev
);
2603 if (!tb_offload
[MACSEC_OFFLOAD_ATTR_TYPE
])
2606 offload
= nla_get_u8(tb_offload
[MACSEC_OFFLOAD_ATTR_TYPE
]);
2607 if (macsec
->offload
== offload
)
2610 /* Check if the offloading mode is supported by the underlying layers */
2611 if (offload
!= MACSEC_OFFLOAD_OFF
&&
2612 !macsec_check_offload(offload
, macsec
))
2615 /* Check if the net device is busy. */
2616 if (netif_running(dev
))
2621 prev_offload
= macsec
->offload
;
2622 macsec
->offload
= offload
;
2624 /* Check if the device already has rules configured: we do not support
2627 if (macsec_is_configured(macsec
)) {
2632 ops
= __macsec_get_ops(offload
== MACSEC_OFFLOAD_OFF
? prev_offload
: offload
,
2639 if (prev_offload
== MACSEC_OFFLOAD_OFF
)
2640 func
= ops
->mdo_add_secy
;
2642 func
= ops
->mdo_del_secy
;
2644 ctx
.secy
= &macsec
->secy
;
2645 ret
= macsec_offload(func
, &ctx
);
2649 /* Force features update, since they are different for SW MACSec and
2650 * HW offloading cases.
2652 netdev_update_features(dev
);
2658 macsec
->offload
= prev_offload
;
2664 static void get_tx_sa_stats(struct net_device
*dev
, int an
,
2665 struct macsec_tx_sa
*tx_sa
,
2666 struct macsec_tx_sa_stats
*sum
)
2668 struct macsec_dev
*macsec
= macsec_priv(dev
);
2671 /* If h/w offloading is available, propagate to the device */
2672 if (macsec_is_offloaded(macsec
)) {
2673 const struct macsec_ops
*ops
;
2674 struct macsec_context ctx
;
2676 ops
= macsec_get_ops(macsec
, &ctx
);
2678 ctx
.sa
.assoc_num
= an
;
2679 ctx
.sa
.tx_sa
= tx_sa
;
2680 ctx
.stats
.tx_sa_stats
= sum
;
2681 ctx
.secy
= &macsec_priv(dev
)->secy
;
2682 macsec_offload(ops
->mdo_get_tx_sa_stats
, &ctx
);
2687 for_each_possible_cpu(cpu
) {
2688 const struct macsec_tx_sa_stats
*stats
=
2689 per_cpu_ptr(tx_sa
->stats
, cpu
);
2691 sum
->OutPktsProtected
+= stats
->OutPktsProtected
;
2692 sum
->OutPktsEncrypted
+= stats
->OutPktsEncrypted
;
2696 static int copy_tx_sa_stats(struct sk_buff
*skb
, struct macsec_tx_sa_stats
*sum
)
2698 if (nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED
,
2699 sum
->OutPktsProtected
) ||
2700 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED
,
2701 sum
->OutPktsEncrypted
))
2707 static void get_rx_sa_stats(struct net_device
*dev
,
2708 struct macsec_rx_sc
*rx_sc
, int an
,
2709 struct macsec_rx_sa
*rx_sa
,
2710 struct macsec_rx_sa_stats
*sum
)
2712 struct macsec_dev
*macsec
= macsec_priv(dev
);
2715 /* If h/w offloading is available, propagate to the device */
2716 if (macsec_is_offloaded(macsec
)) {
2717 const struct macsec_ops
*ops
;
2718 struct macsec_context ctx
;
2720 ops
= macsec_get_ops(macsec
, &ctx
);
2722 ctx
.sa
.assoc_num
= an
;
2723 ctx
.sa
.rx_sa
= rx_sa
;
2724 ctx
.stats
.rx_sa_stats
= sum
;
2725 ctx
.secy
= &macsec_priv(dev
)->secy
;
2727 macsec_offload(ops
->mdo_get_rx_sa_stats
, &ctx
);
2732 for_each_possible_cpu(cpu
) {
2733 const struct macsec_rx_sa_stats
*stats
=
2734 per_cpu_ptr(rx_sa
->stats
, cpu
);
2736 sum
->InPktsOK
+= stats
->InPktsOK
;
2737 sum
->InPktsInvalid
+= stats
->InPktsInvalid
;
2738 sum
->InPktsNotValid
+= stats
->InPktsNotValid
;
2739 sum
->InPktsNotUsingSA
+= stats
->InPktsNotUsingSA
;
2740 sum
->InPktsUnusedSA
+= stats
->InPktsUnusedSA
;
2744 static int copy_rx_sa_stats(struct sk_buff
*skb
,
2745 struct macsec_rx_sa_stats
*sum
)
2747 if (nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_OK
, sum
->InPktsOK
) ||
2748 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_INVALID
,
2749 sum
->InPktsInvalid
) ||
2750 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_VALID
,
2751 sum
->InPktsNotValid
) ||
2752 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_USING_SA
,
2753 sum
->InPktsNotUsingSA
) ||
2754 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_UNUSED_SA
,
2755 sum
->InPktsUnusedSA
))
2761 static void get_rx_sc_stats(struct net_device
*dev
,
2762 struct macsec_rx_sc
*rx_sc
,
2763 struct macsec_rx_sc_stats
*sum
)
2765 struct macsec_dev
*macsec
= macsec_priv(dev
);
2768 /* If h/w offloading is available, propagate to the device */
2769 if (macsec_is_offloaded(macsec
)) {
2770 const struct macsec_ops
*ops
;
2771 struct macsec_context ctx
;
2773 ops
= macsec_get_ops(macsec
, &ctx
);
2775 ctx
.stats
.rx_sc_stats
= sum
;
2776 ctx
.secy
= &macsec_priv(dev
)->secy
;
2778 macsec_offload(ops
->mdo_get_rx_sc_stats
, &ctx
);
2783 for_each_possible_cpu(cpu
) {
2784 const struct pcpu_rx_sc_stats
*stats
;
2785 struct macsec_rx_sc_stats tmp
;
2788 stats
= per_cpu_ptr(rx_sc
->stats
, cpu
);
2790 start
= u64_stats_fetch_begin_irq(&stats
->syncp
);
2791 memcpy(&tmp
, &stats
->stats
, sizeof(tmp
));
2792 } while (u64_stats_fetch_retry_irq(&stats
->syncp
, start
));
2794 sum
->InOctetsValidated
+= tmp
.InOctetsValidated
;
2795 sum
->InOctetsDecrypted
+= tmp
.InOctetsDecrypted
;
2796 sum
->InPktsUnchecked
+= tmp
.InPktsUnchecked
;
2797 sum
->InPktsDelayed
+= tmp
.InPktsDelayed
;
2798 sum
->InPktsOK
+= tmp
.InPktsOK
;
2799 sum
->InPktsInvalid
+= tmp
.InPktsInvalid
;
2800 sum
->InPktsLate
+= tmp
.InPktsLate
;
2801 sum
->InPktsNotValid
+= tmp
.InPktsNotValid
;
2802 sum
->InPktsNotUsingSA
+= tmp
.InPktsNotUsingSA
;
2803 sum
->InPktsUnusedSA
+= tmp
.InPktsUnusedSA
;
2807 static int copy_rx_sc_stats(struct sk_buff
*skb
, struct macsec_rx_sc_stats
*sum
)
2809 if (nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_OCTETS_VALIDATED
,
2810 sum
->InOctetsValidated
,
2811 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2812 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_OCTETS_DECRYPTED
,
2813 sum
->InOctetsDecrypted
,
2814 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2815 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNCHECKED
,
2816 sum
->InPktsUnchecked
,
2817 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2818 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_DELAYED
,
2820 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2821 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_OK
,
2823 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2824 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_INVALID
,
2826 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2827 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_LATE
,
2829 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2830 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_VALID
,
2831 sum
->InPktsNotValid
,
2832 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2833 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_USING_SA
,
2834 sum
->InPktsNotUsingSA
,
2835 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2836 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNUSED_SA
,
2837 sum
->InPktsUnusedSA
,
2838 MACSEC_RXSC_STATS_ATTR_PAD
))
2844 static void get_tx_sc_stats(struct net_device
*dev
,
2845 struct macsec_tx_sc_stats
*sum
)
2847 struct macsec_dev
*macsec
= macsec_priv(dev
);
2850 /* If h/w offloading is available, propagate to the device */
2851 if (macsec_is_offloaded(macsec
)) {
2852 const struct macsec_ops
*ops
;
2853 struct macsec_context ctx
;
2855 ops
= macsec_get_ops(macsec
, &ctx
);
2857 ctx
.stats
.tx_sc_stats
= sum
;
2858 ctx
.secy
= &macsec_priv(dev
)->secy
;
2859 macsec_offload(ops
->mdo_get_tx_sc_stats
, &ctx
);
2864 for_each_possible_cpu(cpu
) {
2865 const struct pcpu_tx_sc_stats
*stats
;
2866 struct macsec_tx_sc_stats tmp
;
2869 stats
= per_cpu_ptr(macsec_priv(dev
)->secy
.tx_sc
.stats
, cpu
);
2871 start
= u64_stats_fetch_begin_irq(&stats
->syncp
);
2872 memcpy(&tmp
, &stats
->stats
, sizeof(tmp
));
2873 } while (u64_stats_fetch_retry_irq(&stats
->syncp
, start
));
2875 sum
->OutPktsProtected
+= tmp
.OutPktsProtected
;
2876 sum
->OutPktsEncrypted
+= tmp
.OutPktsEncrypted
;
2877 sum
->OutOctetsProtected
+= tmp
.OutOctetsProtected
;
2878 sum
->OutOctetsEncrypted
+= tmp
.OutOctetsEncrypted
;
2882 static int copy_tx_sc_stats(struct sk_buff
*skb
, struct macsec_tx_sc_stats
*sum
)
2884 if (nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_PKTS_PROTECTED
,
2885 sum
->OutPktsProtected
,
2886 MACSEC_TXSC_STATS_ATTR_PAD
) ||
2887 nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_PKTS_ENCRYPTED
,
2888 sum
->OutPktsEncrypted
,
2889 MACSEC_TXSC_STATS_ATTR_PAD
) ||
2890 nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_PROTECTED
,
2891 sum
->OutOctetsProtected
,
2892 MACSEC_TXSC_STATS_ATTR_PAD
) ||
2893 nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_ENCRYPTED
,
2894 sum
->OutOctetsEncrypted
,
2895 MACSEC_TXSC_STATS_ATTR_PAD
))
2901 static void get_secy_stats(struct net_device
*dev
, struct macsec_dev_stats
*sum
)
2903 struct macsec_dev
*macsec
= macsec_priv(dev
);
2906 /* If h/w offloading is available, propagate to the device */
2907 if (macsec_is_offloaded(macsec
)) {
2908 const struct macsec_ops
*ops
;
2909 struct macsec_context ctx
;
2911 ops
= macsec_get_ops(macsec
, &ctx
);
2913 ctx
.stats
.dev_stats
= sum
;
2914 ctx
.secy
= &macsec_priv(dev
)->secy
;
2915 macsec_offload(ops
->mdo_get_dev_stats
, &ctx
);
2920 for_each_possible_cpu(cpu
) {
2921 const struct pcpu_secy_stats
*stats
;
2922 struct macsec_dev_stats tmp
;
2925 stats
= per_cpu_ptr(macsec_priv(dev
)->stats
, cpu
);
2927 start
= u64_stats_fetch_begin_irq(&stats
->syncp
);
2928 memcpy(&tmp
, &stats
->stats
, sizeof(tmp
));
2929 } while (u64_stats_fetch_retry_irq(&stats
->syncp
, start
));
2931 sum
->OutPktsUntagged
+= tmp
.OutPktsUntagged
;
2932 sum
->InPktsUntagged
+= tmp
.InPktsUntagged
;
2933 sum
->OutPktsTooLong
+= tmp
.OutPktsTooLong
;
2934 sum
->InPktsNoTag
+= tmp
.InPktsNoTag
;
2935 sum
->InPktsBadTag
+= tmp
.InPktsBadTag
;
2936 sum
->InPktsUnknownSCI
+= tmp
.InPktsUnknownSCI
;
2937 sum
->InPktsNoSCI
+= tmp
.InPktsNoSCI
;
2938 sum
->InPktsOverrun
+= tmp
.InPktsOverrun
;
2942 static int copy_secy_stats(struct sk_buff
*skb
, struct macsec_dev_stats
*sum
)
2944 if (nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_OUT_PKTS_UNTAGGED
,
2945 sum
->OutPktsUntagged
,
2946 MACSEC_SECY_STATS_ATTR_PAD
) ||
2947 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_UNTAGGED
,
2948 sum
->InPktsUntagged
,
2949 MACSEC_SECY_STATS_ATTR_PAD
) ||
2950 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_OUT_PKTS_TOO_LONG
,
2951 sum
->OutPktsTooLong
,
2952 MACSEC_SECY_STATS_ATTR_PAD
) ||
2953 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_TAG
,
2955 MACSEC_SECY_STATS_ATTR_PAD
) ||
2956 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_BAD_TAG
,
2958 MACSEC_SECY_STATS_ATTR_PAD
) ||
2959 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_UNKNOWN_SCI
,
2960 sum
->InPktsUnknownSCI
,
2961 MACSEC_SECY_STATS_ATTR_PAD
) ||
2962 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_SCI
,
2964 MACSEC_SECY_STATS_ATTR_PAD
) ||
2965 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_OVERRUN
,
2967 MACSEC_SECY_STATS_ATTR_PAD
))
2973 static int nla_put_secy(struct macsec_secy
*secy
, struct sk_buff
*skb
)
2975 struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
2976 struct nlattr
*secy_nest
= nla_nest_start_noflag(skb
,
2983 switch (secy
->key_len
) {
2984 case MACSEC_GCM_AES_128_SAK_LEN
:
2985 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_128
: MACSEC_DEFAULT_CIPHER_ID
;
2987 case MACSEC_GCM_AES_256_SAK_LEN
:
2988 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_256
: MACSEC_CIPHER_ID_GCM_AES_256
;
2994 if (nla_put_sci(skb
, MACSEC_SECY_ATTR_SCI
, secy
->sci
,
2995 MACSEC_SECY_ATTR_PAD
) ||
2996 nla_put_u64_64bit(skb
, MACSEC_SECY_ATTR_CIPHER_SUITE
,
2997 csid
, MACSEC_SECY_ATTR_PAD
) ||
2998 nla_put_u8(skb
, MACSEC_SECY_ATTR_ICV_LEN
, secy
->icv_len
) ||
2999 nla_put_u8(skb
, MACSEC_SECY_ATTR_OPER
, secy
->operational
) ||
3000 nla_put_u8(skb
, MACSEC_SECY_ATTR_PROTECT
, secy
->protect_frames
) ||
3001 nla_put_u8(skb
, MACSEC_SECY_ATTR_REPLAY
, secy
->replay_protect
) ||
3002 nla_put_u8(skb
, MACSEC_SECY_ATTR_VALIDATE
, secy
->validate_frames
) ||
3003 nla_put_u8(skb
, MACSEC_SECY_ATTR_ENCRYPT
, tx_sc
->encrypt
) ||
3004 nla_put_u8(skb
, MACSEC_SECY_ATTR_INC_SCI
, tx_sc
->send_sci
) ||
3005 nla_put_u8(skb
, MACSEC_SECY_ATTR_ES
, tx_sc
->end_station
) ||
3006 nla_put_u8(skb
, MACSEC_SECY_ATTR_SCB
, tx_sc
->scb
) ||
3007 nla_put_u8(skb
, MACSEC_SECY_ATTR_ENCODING_SA
, tx_sc
->encoding_sa
))
3010 if (secy
->replay_protect
) {
3011 if (nla_put_u32(skb
, MACSEC_SECY_ATTR_WINDOW
, secy
->replay_window
))
3015 nla_nest_end(skb
, secy_nest
);
3019 nla_nest_cancel(skb
, secy_nest
);
3023 static noinline_for_stack
int
3024 dump_secy(struct macsec_secy
*secy
, struct net_device
*dev
,
3025 struct sk_buff
*skb
, struct netlink_callback
*cb
)
3027 struct macsec_tx_sc_stats tx_sc_stats
= {0, };
3028 struct macsec_tx_sa_stats tx_sa_stats
= {0, };
3029 struct macsec_rx_sc_stats rx_sc_stats
= {0, };
3030 struct macsec_rx_sa_stats rx_sa_stats
= {0, };
3031 struct macsec_dev
*macsec
= netdev_priv(dev
);
3032 struct macsec_dev_stats dev_stats
= {0, };
3033 struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
3034 struct nlattr
*txsa_list
, *rxsc_list
;
3035 struct macsec_rx_sc
*rx_sc
;
3036 struct nlattr
*attr
;
3040 hdr
= genlmsg_put(skb
, NETLINK_CB(cb
->skb
).portid
, cb
->nlh
->nlmsg_seq
,
3041 &macsec_fam
, NLM_F_MULTI
, MACSEC_CMD_GET_TXSC
);
3045 genl_dump_check_consistent(cb
, hdr
);
3047 if (nla_put_u32(skb
, MACSEC_ATTR_IFINDEX
, dev
->ifindex
))
3048 goto nla_put_failure
;
3050 attr
= nla_nest_start_noflag(skb
, MACSEC_ATTR_OFFLOAD
);
3052 goto nla_put_failure
;
3053 if (nla_put_u8(skb
, MACSEC_OFFLOAD_ATTR_TYPE
, macsec
->offload
))
3054 goto nla_put_failure
;
3055 nla_nest_end(skb
, attr
);
3057 if (nla_put_secy(secy
, skb
))
3058 goto nla_put_failure
;
3060 attr
= nla_nest_start_noflag(skb
, MACSEC_ATTR_TXSC_STATS
);
3062 goto nla_put_failure
;
3064 get_tx_sc_stats(dev
, &tx_sc_stats
);
3065 if (copy_tx_sc_stats(skb
, &tx_sc_stats
)) {
3066 nla_nest_cancel(skb
, attr
);
3067 goto nla_put_failure
;
3069 nla_nest_end(skb
, attr
);
3071 attr
= nla_nest_start_noflag(skb
, MACSEC_ATTR_SECY_STATS
);
3073 goto nla_put_failure
;
3074 get_secy_stats(dev
, &dev_stats
);
3075 if (copy_secy_stats(skb
, &dev_stats
)) {
3076 nla_nest_cancel(skb
, attr
);
3077 goto nla_put_failure
;
3079 nla_nest_end(skb
, attr
);
3081 txsa_list
= nla_nest_start_noflag(skb
, MACSEC_ATTR_TXSA_LIST
);
3083 goto nla_put_failure
;
3084 for (i
= 0, j
= 1; i
< MACSEC_NUM_AN
; i
++) {
3085 struct macsec_tx_sa
*tx_sa
= rtnl_dereference(tx_sc
->sa
[i
]);
3086 struct nlattr
*txsa_nest
;
3093 txsa_nest
= nla_nest_start_noflag(skb
, j
++);
3095 nla_nest_cancel(skb
, txsa_list
);
3096 goto nla_put_failure
;
3099 attr
= nla_nest_start_noflag(skb
, MACSEC_SA_ATTR_STATS
);
3101 nla_nest_cancel(skb
, txsa_nest
);
3102 nla_nest_cancel(skb
, txsa_list
);
3103 goto nla_put_failure
;
3105 memset(&tx_sa_stats
, 0, sizeof(tx_sa_stats
));
3106 get_tx_sa_stats(dev
, i
, tx_sa
, &tx_sa_stats
);
3107 if (copy_tx_sa_stats(skb
, &tx_sa_stats
)) {
3108 nla_nest_cancel(skb
, attr
);
3109 nla_nest_cancel(skb
, txsa_nest
);
3110 nla_nest_cancel(skb
, txsa_list
);
3111 goto nla_put_failure
;
3113 nla_nest_end(skb
, attr
);
3116 pn
= tx_sa
->next_pn
;
3117 pn_len
= MACSEC_XPN_PN_LEN
;
3119 pn
= tx_sa
->next_pn_halves
.lower
;
3120 pn_len
= MACSEC_DEFAULT_PN_LEN
;
3123 if (nla_put_u8(skb
, MACSEC_SA_ATTR_AN
, i
) ||
3124 nla_put(skb
, MACSEC_SA_ATTR_PN
, pn_len
, &pn
) ||
3125 nla_put(skb
, MACSEC_SA_ATTR_KEYID
, MACSEC_KEYID_LEN
, tx_sa
->key
.id
) ||
3126 (secy
->xpn
&& nla_put_ssci(skb
, MACSEC_SA_ATTR_SSCI
, tx_sa
->ssci
)) ||
3127 nla_put_u8(skb
, MACSEC_SA_ATTR_ACTIVE
, tx_sa
->active
)) {
3128 nla_nest_cancel(skb
, txsa_nest
);
3129 nla_nest_cancel(skb
, txsa_list
);
3130 goto nla_put_failure
;
3133 nla_nest_end(skb
, txsa_nest
);
3135 nla_nest_end(skb
, txsa_list
);
3137 rxsc_list
= nla_nest_start_noflag(skb
, MACSEC_ATTR_RXSC_LIST
);
3139 goto nla_put_failure
;
3142 for_each_rxsc_rtnl(secy
, rx_sc
) {
3144 struct nlattr
*rxsa_list
;
3145 struct nlattr
*rxsc_nest
= nla_nest_start_noflag(skb
, j
++);
3148 nla_nest_cancel(skb
, rxsc_list
);
3149 goto nla_put_failure
;
3152 if (nla_put_u8(skb
, MACSEC_RXSC_ATTR_ACTIVE
, rx_sc
->active
) ||
3153 nla_put_sci(skb
, MACSEC_RXSC_ATTR_SCI
, rx_sc
->sci
,
3154 MACSEC_RXSC_ATTR_PAD
)) {
3155 nla_nest_cancel(skb
, rxsc_nest
);
3156 nla_nest_cancel(skb
, rxsc_list
);
3157 goto nla_put_failure
;
3160 attr
= nla_nest_start_noflag(skb
, MACSEC_RXSC_ATTR_STATS
);
3162 nla_nest_cancel(skb
, rxsc_nest
);
3163 nla_nest_cancel(skb
, rxsc_list
);
3164 goto nla_put_failure
;
3166 memset(&rx_sc_stats
, 0, sizeof(rx_sc_stats
));
3167 get_rx_sc_stats(dev
, rx_sc
, &rx_sc_stats
);
3168 if (copy_rx_sc_stats(skb
, &rx_sc_stats
)) {
3169 nla_nest_cancel(skb
, attr
);
3170 nla_nest_cancel(skb
, rxsc_nest
);
3171 nla_nest_cancel(skb
, rxsc_list
);
3172 goto nla_put_failure
;
3174 nla_nest_end(skb
, attr
);
3176 rxsa_list
= nla_nest_start_noflag(skb
,
3177 MACSEC_RXSC_ATTR_SA_LIST
);
3179 nla_nest_cancel(skb
, rxsc_nest
);
3180 nla_nest_cancel(skb
, rxsc_list
);
3181 goto nla_put_failure
;
3184 for (i
= 0, k
= 1; i
< MACSEC_NUM_AN
; i
++) {
3185 struct macsec_rx_sa
*rx_sa
= rtnl_dereference(rx_sc
->sa
[i
]);
3186 struct nlattr
*rxsa_nest
;
3193 rxsa_nest
= nla_nest_start_noflag(skb
, k
++);
3195 nla_nest_cancel(skb
, rxsa_list
);
3196 nla_nest_cancel(skb
, rxsc_nest
);
3197 nla_nest_cancel(skb
, rxsc_list
);
3198 goto nla_put_failure
;
3201 attr
= nla_nest_start_noflag(skb
,
3202 MACSEC_SA_ATTR_STATS
);
3204 nla_nest_cancel(skb
, rxsa_list
);
3205 nla_nest_cancel(skb
, rxsc_nest
);
3206 nla_nest_cancel(skb
, rxsc_list
);
3207 goto nla_put_failure
;
3209 memset(&rx_sa_stats
, 0, sizeof(rx_sa_stats
));
3210 get_rx_sa_stats(dev
, rx_sc
, i
, rx_sa
, &rx_sa_stats
);
3211 if (copy_rx_sa_stats(skb
, &rx_sa_stats
)) {
3212 nla_nest_cancel(skb
, attr
);
3213 nla_nest_cancel(skb
, rxsa_list
);
3214 nla_nest_cancel(skb
, rxsc_nest
);
3215 nla_nest_cancel(skb
, rxsc_list
);
3216 goto nla_put_failure
;
3218 nla_nest_end(skb
, attr
);
3221 pn
= rx_sa
->next_pn
;
3222 pn_len
= MACSEC_XPN_PN_LEN
;
3224 pn
= rx_sa
->next_pn_halves
.lower
;
3225 pn_len
= MACSEC_DEFAULT_PN_LEN
;
3228 if (nla_put_u8(skb
, MACSEC_SA_ATTR_AN
, i
) ||
3229 nla_put(skb
, MACSEC_SA_ATTR_PN
, pn_len
, &pn
) ||
3230 nla_put(skb
, MACSEC_SA_ATTR_KEYID
, MACSEC_KEYID_LEN
, rx_sa
->key
.id
) ||
3231 (secy
->xpn
&& nla_put_ssci(skb
, MACSEC_SA_ATTR_SSCI
, rx_sa
->ssci
)) ||
3232 nla_put_u8(skb
, MACSEC_SA_ATTR_ACTIVE
, rx_sa
->active
)) {
3233 nla_nest_cancel(skb
, rxsa_nest
);
3234 nla_nest_cancel(skb
, rxsc_nest
);
3235 nla_nest_cancel(skb
, rxsc_list
);
3236 goto nla_put_failure
;
3238 nla_nest_end(skb
, rxsa_nest
);
3241 nla_nest_end(skb
, rxsa_list
);
3242 nla_nest_end(skb
, rxsc_nest
);
3245 nla_nest_end(skb
, rxsc_list
);
3247 genlmsg_end(skb
, hdr
);
3252 genlmsg_cancel(skb
, hdr
);
3256 static int macsec_generation
= 1; /* protected by RTNL */
3258 static int macsec_dump_txsc(struct sk_buff
*skb
, struct netlink_callback
*cb
)
3260 struct net
*net
= sock_net(skb
->sk
);
3261 struct net_device
*dev
;
3264 dev_idx
= cb
->args
[0];
3269 cb
->seq
= macsec_generation
;
3271 for_each_netdev(net
, dev
) {
3272 struct macsec_secy
*secy
;
3277 if (!netif_is_macsec(dev
))
3280 secy
= &macsec_priv(dev
)->secy
;
3281 if (dump_secy(secy
, dev
, skb
, cb
) < 0)
3293 static const struct genl_small_ops macsec_genl_ops
[] = {
3295 .cmd
= MACSEC_CMD_GET_TXSC
,
3296 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3297 .dumpit
= macsec_dump_txsc
,
3300 .cmd
= MACSEC_CMD_ADD_RXSC
,
3301 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3302 .doit
= macsec_add_rxsc
,
3303 .flags
= GENL_ADMIN_PERM
,
3306 .cmd
= MACSEC_CMD_DEL_RXSC
,
3307 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3308 .doit
= macsec_del_rxsc
,
3309 .flags
= GENL_ADMIN_PERM
,
3312 .cmd
= MACSEC_CMD_UPD_RXSC
,
3313 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3314 .doit
= macsec_upd_rxsc
,
3315 .flags
= GENL_ADMIN_PERM
,
3318 .cmd
= MACSEC_CMD_ADD_TXSA
,
3319 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3320 .doit
= macsec_add_txsa
,
3321 .flags
= GENL_ADMIN_PERM
,
3324 .cmd
= MACSEC_CMD_DEL_TXSA
,
3325 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3326 .doit
= macsec_del_txsa
,
3327 .flags
= GENL_ADMIN_PERM
,
3330 .cmd
= MACSEC_CMD_UPD_TXSA
,
3331 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3332 .doit
= macsec_upd_txsa
,
3333 .flags
= GENL_ADMIN_PERM
,
3336 .cmd
= MACSEC_CMD_ADD_RXSA
,
3337 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3338 .doit
= macsec_add_rxsa
,
3339 .flags
= GENL_ADMIN_PERM
,
3342 .cmd
= MACSEC_CMD_DEL_RXSA
,
3343 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3344 .doit
= macsec_del_rxsa
,
3345 .flags
= GENL_ADMIN_PERM
,
3348 .cmd
= MACSEC_CMD_UPD_RXSA
,
3349 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3350 .doit
= macsec_upd_rxsa
,
3351 .flags
= GENL_ADMIN_PERM
,
3354 .cmd
= MACSEC_CMD_UPD_OFFLOAD
,
3355 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3356 .doit
= macsec_upd_offload
,
3357 .flags
= GENL_ADMIN_PERM
,
3361 static struct genl_family macsec_fam __ro_after_init
= {
3362 .name
= MACSEC_GENL_NAME
,
3364 .version
= MACSEC_GENL_VERSION
,
3365 .maxattr
= MACSEC_ATTR_MAX
,
3366 .policy
= macsec_genl_policy
,
3368 .module
= THIS_MODULE
,
3369 .small_ops
= macsec_genl_ops
,
3370 .n_small_ops
= ARRAY_SIZE(macsec_genl_ops
),
3373 static netdev_tx_t
macsec_start_xmit(struct sk_buff
*skb
,
3374 struct net_device
*dev
)
3376 struct macsec_dev
*macsec
= netdev_priv(dev
);
3377 struct macsec_secy
*secy
= &macsec
->secy
;
3378 struct pcpu_secy_stats
*secy_stats
;
3381 if (macsec_is_offloaded(netdev_priv(dev
))) {
3382 skb
->dev
= macsec
->real_dev
;
3383 return dev_queue_xmit(skb
);
3387 if (!secy
->protect_frames
) {
3388 secy_stats
= this_cpu_ptr(macsec
->stats
);
3389 u64_stats_update_begin(&secy_stats
->syncp
);
3390 secy_stats
->stats
.OutPktsUntagged
++;
3391 u64_stats_update_end(&secy_stats
->syncp
);
3392 skb
->dev
= macsec
->real_dev
;
3394 ret
= dev_queue_xmit(skb
);
3395 count_tx(dev
, ret
, len
);
3399 if (!secy
->operational
) {
3401 dev
->stats
.tx_dropped
++;
3402 return NETDEV_TX_OK
;
3405 skb
= macsec_encrypt(skb
, dev
);
3407 if (PTR_ERR(skb
) != -EINPROGRESS
)
3408 dev
->stats
.tx_dropped
++;
3409 return NETDEV_TX_OK
;
3412 macsec_count_tx(skb
, &macsec
->secy
.tx_sc
, macsec_skb_cb(skb
)->tx_sa
);
3414 macsec_encrypt_finish(skb
, dev
);
3416 ret
= dev_queue_xmit(skb
);
3417 count_tx(dev
, ret
, len
);
3421 #define SW_MACSEC_FEATURES \
3422 (NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST)
3424 /* If h/w offloading is enabled, use real device features save for
3425 * VLAN_FEATURES - they require additional ops
3426 * HW_MACSEC - no reason to report it
3428 #define REAL_DEV_FEATURES(dev) \
3429 ((dev)->features & ~(NETIF_F_VLAN_FEATURES | NETIF_F_HW_MACSEC))
3431 static int macsec_dev_init(struct net_device
*dev
)
3433 struct macsec_dev
*macsec
= macsec_priv(dev
);
3434 struct net_device
*real_dev
= macsec
->real_dev
;
3437 dev
->tstats
= netdev_alloc_pcpu_stats(struct pcpu_sw_netstats
);
3441 err
= gro_cells_init(&macsec
->gro_cells
, dev
);
3443 free_percpu(dev
->tstats
);
3447 if (macsec_is_offloaded(macsec
)) {
3448 dev
->features
= REAL_DEV_FEATURES(real_dev
);
3450 dev
->features
= real_dev
->features
& SW_MACSEC_FEATURES
;
3451 dev
->features
|= NETIF_F_LLTX
| NETIF_F_GSO_SOFTWARE
;
3454 dev
->needed_headroom
= real_dev
->needed_headroom
+
3455 MACSEC_NEEDED_HEADROOM
;
3456 dev
->needed_tailroom
= real_dev
->needed_tailroom
+
3457 MACSEC_NEEDED_TAILROOM
;
3459 if (is_zero_ether_addr(dev
->dev_addr
))
3460 eth_hw_addr_inherit(dev
, real_dev
);
3461 if (is_zero_ether_addr(dev
->broadcast
))
3462 memcpy(dev
->broadcast
, real_dev
->broadcast
, dev
->addr_len
);
3467 static void macsec_dev_uninit(struct net_device
*dev
)
3469 struct macsec_dev
*macsec
= macsec_priv(dev
);
3471 gro_cells_destroy(&macsec
->gro_cells
);
3472 free_percpu(dev
->tstats
);
3475 static netdev_features_t
macsec_fix_features(struct net_device
*dev
,
3476 netdev_features_t features
)
3478 struct macsec_dev
*macsec
= macsec_priv(dev
);
3479 struct net_device
*real_dev
= macsec
->real_dev
;
3481 if (macsec_is_offloaded(macsec
))
3482 return REAL_DEV_FEATURES(real_dev
);
3484 features
&= (real_dev
->features
& SW_MACSEC_FEATURES
) |
3485 NETIF_F_GSO_SOFTWARE
| NETIF_F_SOFT_FEATURES
;
3486 features
|= NETIF_F_LLTX
;
3491 static int macsec_dev_open(struct net_device
*dev
)
3493 struct macsec_dev
*macsec
= macsec_priv(dev
);
3494 struct net_device
*real_dev
= macsec
->real_dev
;
3497 err
= dev_uc_add(real_dev
, dev
->dev_addr
);
3501 if (dev
->flags
& IFF_ALLMULTI
) {
3502 err
= dev_set_allmulti(real_dev
, 1);
3507 if (dev
->flags
& IFF_PROMISC
) {
3508 err
= dev_set_promiscuity(real_dev
, 1);
3510 goto clear_allmulti
;
3513 /* If h/w offloading is available, propagate to the device */
3514 if (macsec_is_offloaded(macsec
)) {
3515 const struct macsec_ops
*ops
;
3516 struct macsec_context ctx
;
3518 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
3521 goto clear_allmulti
;
3524 ctx
.secy
= &macsec
->secy
;
3525 err
= macsec_offload(ops
->mdo_dev_open
, &ctx
);
3527 goto clear_allmulti
;
3530 if (netif_carrier_ok(real_dev
))
3531 netif_carrier_on(dev
);
3535 if (dev
->flags
& IFF_ALLMULTI
)
3536 dev_set_allmulti(real_dev
, -1);
3538 dev_uc_del(real_dev
, dev
->dev_addr
);
3539 netif_carrier_off(dev
);
3543 static int macsec_dev_stop(struct net_device
*dev
)
3545 struct macsec_dev
*macsec
= macsec_priv(dev
);
3546 struct net_device
*real_dev
= macsec
->real_dev
;
3548 netif_carrier_off(dev
);
3550 /* If h/w offloading is available, propagate to the device */
3551 if (macsec_is_offloaded(macsec
)) {
3552 const struct macsec_ops
*ops
;
3553 struct macsec_context ctx
;
3555 ops
= macsec_get_ops(macsec
, &ctx
);
3557 ctx
.secy
= &macsec
->secy
;
3558 macsec_offload(ops
->mdo_dev_stop
, &ctx
);
3562 dev_mc_unsync(real_dev
, dev
);
3563 dev_uc_unsync(real_dev
, dev
);
3565 if (dev
->flags
& IFF_ALLMULTI
)
3566 dev_set_allmulti(real_dev
, -1);
3568 if (dev
->flags
& IFF_PROMISC
)
3569 dev_set_promiscuity(real_dev
, -1);
3571 dev_uc_del(real_dev
, dev
->dev_addr
);
3576 static void macsec_dev_change_rx_flags(struct net_device
*dev
, int change
)
3578 struct net_device
*real_dev
= macsec_priv(dev
)->real_dev
;
3580 if (!(dev
->flags
& IFF_UP
))
3583 if (change
& IFF_ALLMULTI
)
3584 dev_set_allmulti(real_dev
, dev
->flags
& IFF_ALLMULTI
? 1 : -1);
3586 if (change
& IFF_PROMISC
)
3587 dev_set_promiscuity(real_dev
,
3588 dev
->flags
& IFF_PROMISC
? 1 : -1);
3591 static void macsec_dev_set_rx_mode(struct net_device
*dev
)
3593 struct net_device
*real_dev
= macsec_priv(dev
)->real_dev
;
3595 dev_mc_sync(real_dev
, dev
);
3596 dev_uc_sync(real_dev
, dev
);
3599 static int macsec_set_mac_address(struct net_device
*dev
, void *p
)
3601 struct macsec_dev
*macsec
= macsec_priv(dev
);
3602 struct net_device
*real_dev
= macsec
->real_dev
;
3603 struct sockaddr
*addr
= p
;
3606 if (!is_valid_ether_addr(addr
->sa_data
))
3607 return -EADDRNOTAVAIL
;
3609 if (!(dev
->flags
& IFF_UP
))
3612 err
= dev_uc_add(real_dev
, addr
->sa_data
);
3616 dev_uc_del(real_dev
, dev
->dev_addr
);
3619 ether_addr_copy(dev
->dev_addr
, addr
->sa_data
);
3620 macsec
->secy
.sci
= dev_to_sci(dev
, MACSEC_PORT_ES
);
3622 /* If h/w offloading is available, propagate to the device */
3623 if (macsec_is_offloaded(macsec
)) {
3624 const struct macsec_ops
*ops
;
3625 struct macsec_context ctx
;
3627 ops
= macsec_get_ops(macsec
, &ctx
);
3629 ctx
.secy
= &macsec
->secy
;
3630 macsec_offload(ops
->mdo_upd_secy
, &ctx
);
3637 static int macsec_change_mtu(struct net_device
*dev
, int new_mtu
)
3639 struct macsec_dev
*macsec
= macsec_priv(dev
);
3640 unsigned int extra
= macsec
->secy
.icv_len
+ macsec_extra_len(true);
3642 if (macsec
->real_dev
->mtu
- extra
< new_mtu
)
3650 static void macsec_get_stats64(struct net_device
*dev
,
3651 struct rtnl_link_stats64
*s
)
3656 dev_fetch_sw_netstats(s
, dev
->tstats
);
3658 s
->rx_dropped
= dev
->stats
.rx_dropped
;
3659 s
->tx_dropped
= dev
->stats
.tx_dropped
;
3662 static int macsec_get_iflink(const struct net_device
*dev
)
3664 return macsec_priv(dev
)->real_dev
->ifindex
;
3667 static const struct net_device_ops macsec_netdev_ops
= {
3668 .ndo_init
= macsec_dev_init
,
3669 .ndo_uninit
= macsec_dev_uninit
,
3670 .ndo_open
= macsec_dev_open
,
3671 .ndo_stop
= macsec_dev_stop
,
3672 .ndo_fix_features
= macsec_fix_features
,
3673 .ndo_change_mtu
= macsec_change_mtu
,
3674 .ndo_set_rx_mode
= macsec_dev_set_rx_mode
,
3675 .ndo_change_rx_flags
= macsec_dev_change_rx_flags
,
3676 .ndo_set_mac_address
= macsec_set_mac_address
,
3677 .ndo_start_xmit
= macsec_start_xmit
,
3678 .ndo_get_stats64
= macsec_get_stats64
,
3679 .ndo_get_iflink
= macsec_get_iflink
,
3682 static const struct device_type macsec_type
= {
3686 static const struct nla_policy macsec_rtnl_policy
[IFLA_MACSEC_MAX
+ 1] = {
3687 [IFLA_MACSEC_SCI
] = { .type
= NLA_U64
},
3688 [IFLA_MACSEC_PORT
] = { .type
= NLA_U16
},
3689 [IFLA_MACSEC_ICV_LEN
] = { .type
= NLA_U8
},
3690 [IFLA_MACSEC_CIPHER_SUITE
] = { .type
= NLA_U64
},
3691 [IFLA_MACSEC_WINDOW
] = { .type
= NLA_U32
},
3692 [IFLA_MACSEC_ENCODING_SA
] = { .type
= NLA_U8
},
3693 [IFLA_MACSEC_ENCRYPT
] = { .type
= NLA_U8
},
3694 [IFLA_MACSEC_PROTECT
] = { .type
= NLA_U8
},
3695 [IFLA_MACSEC_INC_SCI
] = { .type
= NLA_U8
},
3696 [IFLA_MACSEC_ES
] = { .type
= NLA_U8
},
3697 [IFLA_MACSEC_SCB
] = { .type
= NLA_U8
},
3698 [IFLA_MACSEC_REPLAY_PROTECT
] = { .type
= NLA_U8
},
3699 [IFLA_MACSEC_VALIDATION
] = { .type
= NLA_U8
},
3702 static void macsec_free_netdev(struct net_device
*dev
)
3704 struct macsec_dev
*macsec
= macsec_priv(dev
);
3706 free_percpu(macsec
->stats
);
3707 free_percpu(macsec
->secy
.tx_sc
.stats
);
3711 static void macsec_setup(struct net_device
*dev
)
3715 dev
->max_mtu
= ETH_MAX_MTU
;
3716 dev
->priv_flags
|= IFF_NO_QUEUE
;
3717 dev
->netdev_ops
= &macsec_netdev_ops
;
3718 dev
->needs_free_netdev
= true;
3719 dev
->priv_destructor
= macsec_free_netdev
;
3720 SET_NETDEV_DEVTYPE(dev
, &macsec_type
);
3722 eth_zero_addr(dev
->broadcast
);
3725 static int macsec_changelink_common(struct net_device
*dev
,
3726 struct nlattr
*data
[])
3728 struct macsec_secy
*secy
;
3729 struct macsec_tx_sc
*tx_sc
;
3731 secy
= &macsec_priv(dev
)->secy
;
3732 tx_sc
= &secy
->tx_sc
;
3734 if (data
[IFLA_MACSEC_ENCODING_SA
]) {
3735 struct macsec_tx_sa
*tx_sa
;
3737 tx_sc
->encoding_sa
= nla_get_u8(data
[IFLA_MACSEC_ENCODING_SA
]);
3738 tx_sa
= rtnl_dereference(tx_sc
->sa
[tx_sc
->encoding_sa
]);
3740 secy
->operational
= tx_sa
&& tx_sa
->active
;
3743 if (data
[IFLA_MACSEC_ENCRYPT
])
3744 tx_sc
->encrypt
= !!nla_get_u8(data
[IFLA_MACSEC_ENCRYPT
]);
3746 if (data
[IFLA_MACSEC_PROTECT
])
3747 secy
->protect_frames
= !!nla_get_u8(data
[IFLA_MACSEC_PROTECT
]);
3749 if (data
[IFLA_MACSEC_INC_SCI
])
3750 tx_sc
->send_sci
= !!nla_get_u8(data
[IFLA_MACSEC_INC_SCI
]);
3752 if (data
[IFLA_MACSEC_ES
])
3753 tx_sc
->end_station
= !!nla_get_u8(data
[IFLA_MACSEC_ES
]);
3755 if (data
[IFLA_MACSEC_SCB
])
3756 tx_sc
->scb
= !!nla_get_u8(data
[IFLA_MACSEC_SCB
]);
3758 if (data
[IFLA_MACSEC_REPLAY_PROTECT
])
3759 secy
->replay_protect
= !!nla_get_u8(data
[IFLA_MACSEC_REPLAY_PROTECT
]);
3761 if (data
[IFLA_MACSEC_VALIDATION
])
3762 secy
->validate_frames
= nla_get_u8(data
[IFLA_MACSEC_VALIDATION
]);
3764 if (data
[IFLA_MACSEC_CIPHER_SUITE
]) {
3765 switch (nla_get_u64(data
[IFLA_MACSEC_CIPHER_SUITE
])) {
3766 case MACSEC_CIPHER_ID_GCM_AES_128
:
3767 case MACSEC_DEFAULT_CIPHER_ID
:
3768 secy
->key_len
= MACSEC_GCM_AES_128_SAK_LEN
;
3771 case MACSEC_CIPHER_ID_GCM_AES_256
:
3772 secy
->key_len
= MACSEC_GCM_AES_256_SAK_LEN
;
3775 case MACSEC_CIPHER_ID_GCM_AES_XPN_128
:
3776 secy
->key_len
= MACSEC_GCM_AES_128_SAK_LEN
;
3779 case MACSEC_CIPHER_ID_GCM_AES_XPN_256
:
3780 secy
->key_len
= MACSEC_GCM_AES_256_SAK_LEN
;
3788 if (data
[IFLA_MACSEC_WINDOW
]) {
3789 secy
->replay_window
= nla_get_u32(data
[IFLA_MACSEC_WINDOW
]);
3791 /* IEEE 802.1AEbw-2013 10.7.8 - maximum replay window
3792 * for XPN cipher suites */
3794 secy
->replay_window
> MACSEC_XPN_MAX_REPLAY_WINDOW
)
3801 static int macsec_changelink(struct net_device
*dev
, struct nlattr
*tb
[],
3802 struct nlattr
*data
[],
3803 struct netlink_ext_ack
*extack
)
3805 struct macsec_dev
*macsec
= macsec_priv(dev
);
3806 struct macsec_tx_sc tx_sc
;
3807 struct macsec_secy secy
;
3813 if (data
[IFLA_MACSEC_CIPHER_SUITE
] ||
3814 data
[IFLA_MACSEC_ICV_LEN
] ||
3815 data
[IFLA_MACSEC_SCI
] ||
3816 data
[IFLA_MACSEC_PORT
])
3819 /* Keep a copy of unmodified secy and tx_sc, in case the offload
3820 * propagation fails, to revert macsec_changelink_common.
3822 memcpy(&secy
, &macsec
->secy
, sizeof(secy
));
3823 memcpy(&tx_sc
, &macsec
->secy
.tx_sc
, sizeof(tx_sc
));
3825 ret
= macsec_changelink_common(dev
, data
);
3829 /* If h/w offloading is available, propagate to the device */
3830 if (macsec_is_offloaded(macsec
)) {
3831 const struct macsec_ops
*ops
;
3832 struct macsec_context ctx
;
3835 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
3841 ctx
.secy
= &macsec
->secy
;
3842 ret
= macsec_offload(ops
->mdo_upd_secy
, &ctx
);
3850 memcpy(&macsec
->secy
.tx_sc
, &tx_sc
, sizeof(tx_sc
));
3851 memcpy(&macsec
->secy
, &secy
, sizeof(secy
));
3856 static void macsec_del_dev(struct macsec_dev
*macsec
)
3860 while (macsec
->secy
.rx_sc
) {
3861 struct macsec_rx_sc
*rx_sc
= rtnl_dereference(macsec
->secy
.rx_sc
);
3863 rcu_assign_pointer(macsec
->secy
.rx_sc
, rx_sc
->next
);
3867 for (i
= 0; i
< MACSEC_NUM_AN
; i
++) {
3868 struct macsec_tx_sa
*sa
= rtnl_dereference(macsec
->secy
.tx_sc
.sa
[i
]);
3871 RCU_INIT_POINTER(macsec
->secy
.tx_sc
.sa
[i
], NULL
);
3877 static void macsec_common_dellink(struct net_device
*dev
, struct list_head
*head
)
3879 struct macsec_dev
*macsec
= macsec_priv(dev
);
3880 struct net_device
*real_dev
= macsec
->real_dev
;
3882 /* If h/w offloading is available, propagate to the device */
3883 if (macsec_is_offloaded(macsec
)) {
3884 const struct macsec_ops
*ops
;
3885 struct macsec_context ctx
;
3887 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
3889 ctx
.secy
= &macsec
->secy
;
3890 macsec_offload(ops
->mdo_del_secy
, &ctx
);
3894 unregister_netdevice_queue(dev
, head
);
3895 list_del_rcu(&macsec
->secys
);
3896 macsec_del_dev(macsec
);
3897 netdev_upper_dev_unlink(real_dev
, dev
);
3899 macsec_generation
++;
3902 static void macsec_dellink(struct net_device
*dev
, struct list_head
*head
)
3904 struct macsec_dev
*macsec
= macsec_priv(dev
);
3905 struct net_device
*real_dev
= macsec
->real_dev
;
3906 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(real_dev
);
3908 macsec_common_dellink(dev
, head
);
3910 if (list_empty(&rxd
->secys
)) {
3911 netdev_rx_handler_unregister(real_dev
);
3916 static int register_macsec_dev(struct net_device
*real_dev
,
3917 struct net_device
*dev
)
3919 struct macsec_dev
*macsec
= macsec_priv(dev
);
3920 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(real_dev
);
3925 rxd
= kmalloc(sizeof(*rxd
), GFP_KERNEL
);
3929 INIT_LIST_HEAD(&rxd
->secys
);
3931 err
= netdev_rx_handler_register(real_dev
, macsec_handle_frame
,
3939 list_add_tail_rcu(&macsec
->secys
, &rxd
->secys
);
3943 static bool sci_exists(struct net_device
*dev
, sci_t sci
)
3945 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(dev
);
3946 struct macsec_dev
*macsec
;
3948 list_for_each_entry(macsec
, &rxd
->secys
, secys
) {
3949 if (macsec
->secy
.sci
== sci
)
3956 static int macsec_add_dev(struct net_device
*dev
, sci_t sci
, u8 icv_len
)
3958 struct macsec_dev
*macsec
= macsec_priv(dev
);
3959 struct macsec_secy
*secy
= &macsec
->secy
;
3961 macsec
->stats
= netdev_alloc_pcpu_stats(struct pcpu_secy_stats
);
3965 secy
->tx_sc
.stats
= netdev_alloc_pcpu_stats(struct pcpu_tx_sc_stats
);
3966 if (!secy
->tx_sc
.stats
) {
3967 free_percpu(macsec
->stats
);
3971 if (sci
== MACSEC_UNDEF_SCI
)
3972 sci
= dev_to_sci(dev
, MACSEC_PORT_ES
);
3975 secy
->operational
= true;
3976 secy
->key_len
= DEFAULT_SAK_LEN
;
3977 secy
->icv_len
= icv_len
;
3978 secy
->validate_frames
= MACSEC_VALIDATE_DEFAULT
;
3979 secy
->protect_frames
= true;
3980 secy
->replay_protect
= false;
3981 secy
->xpn
= DEFAULT_XPN
;
3984 secy
->tx_sc
.active
= true;
3985 secy
->tx_sc
.encoding_sa
= DEFAULT_ENCODING_SA
;
3986 secy
->tx_sc
.encrypt
= DEFAULT_ENCRYPT
;
3987 secy
->tx_sc
.send_sci
= DEFAULT_SEND_SCI
;
3988 secy
->tx_sc
.end_station
= false;
3989 secy
->tx_sc
.scb
= false;
3994 static struct lock_class_key macsec_netdev_addr_lock_key
;
3996 static int macsec_newlink(struct net
*net
, struct net_device
*dev
,
3997 struct nlattr
*tb
[], struct nlattr
*data
[],
3998 struct netlink_ext_ack
*extack
)
4000 struct macsec_dev
*macsec
= macsec_priv(dev
);
4001 rx_handler_func_t
*rx_handler
;
4002 u8 icv_len
= DEFAULT_ICV_LEN
;
4003 struct net_device
*real_dev
;
4009 real_dev
= __dev_get_by_index(net
, nla_get_u32(tb
[IFLA_LINK
]));
4012 if (real_dev
->type
!= ARPHRD_ETHER
)
4015 dev
->priv_flags
|= IFF_MACSEC
;
4017 macsec
->real_dev
= real_dev
;
4019 if (data
&& data
[IFLA_MACSEC_OFFLOAD
])
4020 macsec
->offload
= nla_get_offload(data
[IFLA_MACSEC_OFFLOAD
]);
4022 /* MACsec offloading is off by default */
4023 macsec
->offload
= MACSEC_OFFLOAD_OFF
;
4025 /* Check if the offloading mode is supported by the underlying layers */
4026 if (macsec
->offload
!= MACSEC_OFFLOAD_OFF
&&
4027 !macsec_check_offload(macsec
->offload
, macsec
))
4030 /* send_sci must be set to true when transmit sci explicitly is set */
4031 if ((data
&& data
[IFLA_MACSEC_SCI
]) &&
4032 (data
&& data
[IFLA_MACSEC_INC_SCI
])) {
4033 u8 send_sci
= !!nla_get_u8(data
[IFLA_MACSEC_INC_SCI
]);
4039 if (data
&& data
[IFLA_MACSEC_ICV_LEN
])
4040 icv_len
= nla_get_u8(data
[IFLA_MACSEC_ICV_LEN
]);
4041 mtu
= real_dev
->mtu
- icv_len
- macsec_extra_len(true);
4047 rx_handler
= rtnl_dereference(real_dev
->rx_handler
);
4048 if (rx_handler
&& rx_handler
!= macsec_handle_frame
)
4051 err
= register_netdevice(dev
);
4055 netdev_lockdep_set_classes(dev
);
4056 lockdep_set_class(&dev
->addr_list_lock
,
4057 &macsec_netdev_addr_lock_key
);
4059 err
= netdev_upper_dev_link(real_dev
, dev
, extack
);
4063 /* need to be already registered so that ->init has run and
4064 * the MAC addr is set
4066 if (data
&& data
[IFLA_MACSEC_SCI
])
4067 sci
= nla_get_sci(data
[IFLA_MACSEC_SCI
]);
4068 else if (data
&& data
[IFLA_MACSEC_PORT
])
4069 sci
= dev_to_sci(dev
, nla_get_be16(data
[IFLA_MACSEC_PORT
]));
4071 sci
= dev_to_sci(dev
, MACSEC_PORT_ES
);
4073 if (rx_handler
&& sci_exists(real_dev
, sci
)) {
4078 err
= macsec_add_dev(dev
, sci
, icv_len
);
4083 err
= macsec_changelink_common(dev
, data
);
4088 /* If h/w offloading is available, propagate to the device */
4089 if (macsec_is_offloaded(macsec
)) {
4090 const struct macsec_ops
*ops
;
4091 struct macsec_context ctx
;
4093 ops
= macsec_get_ops(macsec
, &ctx
);
4095 ctx
.secy
= &macsec
->secy
;
4096 err
= macsec_offload(ops
->mdo_add_secy
, &ctx
);
4102 err
= register_macsec_dev(real_dev
, dev
);
4106 netif_stacked_transfer_operstate(real_dev
, dev
);
4107 linkwatch_fire_event(dev
);
4109 macsec_generation
++;
4114 macsec_del_dev(macsec
);
4116 netdev_upper_dev_unlink(real_dev
, dev
);
4118 unregister_netdevice(dev
);
4122 static int macsec_validate_attr(struct nlattr
*tb
[], struct nlattr
*data
[],
4123 struct netlink_ext_ack
*extack
)
4125 u64 csid
= MACSEC_DEFAULT_CIPHER_ID
;
4126 u8 icv_len
= DEFAULT_ICV_LEN
;
4133 if (data
[IFLA_MACSEC_CIPHER_SUITE
])
4134 csid
= nla_get_u64(data
[IFLA_MACSEC_CIPHER_SUITE
]);
4136 if (data
[IFLA_MACSEC_ICV_LEN
]) {
4137 icv_len
= nla_get_u8(data
[IFLA_MACSEC_ICV_LEN
]);
4138 if (icv_len
!= DEFAULT_ICV_LEN
) {
4139 char dummy_key
[DEFAULT_SAK_LEN
] = { 0 };
4140 struct crypto_aead
*dummy_tfm
;
4142 dummy_tfm
= macsec_alloc_tfm(dummy_key
,
4145 if (IS_ERR(dummy_tfm
))
4146 return PTR_ERR(dummy_tfm
);
4147 crypto_free_aead(dummy_tfm
);
4152 case MACSEC_CIPHER_ID_GCM_AES_128
:
4153 case MACSEC_CIPHER_ID_GCM_AES_256
:
4154 case MACSEC_CIPHER_ID_GCM_AES_XPN_128
:
4155 case MACSEC_CIPHER_ID_GCM_AES_XPN_256
:
4156 case MACSEC_DEFAULT_CIPHER_ID
:
4157 if (icv_len
< MACSEC_MIN_ICV_LEN
||
4158 icv_len
> MACSEC_STD_ICV_LEN
)
4165 if (data
[IFLA_MACSEC_ENCODING_SA
]) {
4166 if (nla_get_u8(data
[IFLA_MACSEC_ENCODING_SA
]) >= MACSEC_NUM_AN
)
4170 for (flag
= IFLA_MACSEC_ENCODING_SA
+ 1;
4171 flag
< IFLA_MACSEC_VALIDATION
;
4174 if (nla_get_u8(data
[flag
]) > 1)
4179 es
= data
[IFLA_MACSEC_ES
] ? nla_get_u8(data
[IFLA_MACSEC_ES
]) : false;
4180 sci
= data
[IFLA_MACSEC_INC_SCI
] ? nla_get_u8(data
[IFLA_MACSEC_INC_SCI
]) : false;
4181 scb
= data
[IFLA_MACSEC_SCB
] ? nla_get_u8(data
[IFLA_MACSEC_SCB
]) : false;
4183 if ((sci
&& (scb
|| es
)) || (scb
&& es
))
4186 if (data
[IFLA_MACSEC_VALIDATION
] &&
4187 nla_get_u8(data
[IFLA_MACSEC_VALIDATION
]) > MACSEC_VALIDATE_MAX
)
4190 if ((data
[IFLA_MACSEC_REPLAY_PROTECT
] &&
4191 nla_get_u8(data
[IFLA_MACSEC_REPLAY_PROTECT
])) &&
4192 !data
[IFLA_MACSEC_WINDOW
])
4198 static struct net
*macsec_get_link_net(const struct net_device
*dev
)
4200 return dev_net(macsec_priv(dev
)->real_dev
);
4203 static size_t macsec_get_size(const struct net_device
*dev
)
4205 return nla_total_size_64bit(8) + /* IFLA_MACSEC_SCI */
4206 nla_total_size(1) + /* IFLA_MACSEC_ICV_LEN */
4207 nla_total_size_64bit(8) + /* IFLA_MACSEC_CIPHER_SUITE */
4208 nla_total_size(4) + /* IFLA_MACSEC_WINDOW */
4209 nla_total_size(1) + /* IFLA_MACSEC_ENCODING_SA */
4210 nla_total_size(1) + /* IFLA_MACSEC_ENCRYPT */
4211 nla_total_size(1) + /* IFLA_MACSEC_PROTECT */
4212 nla_total_size(1) + /* IFLA_MACSEC_INC_SCI */
4213 nla_total_size(1) + /* IFLA_MACSEC_ES */
4214 nla_total_size(1) + /* IFLA_MACSEC_SCB */
4215 nla_total_size(1) + /* IFLA_MACSEC_REPLAY_PROTECT */
4216 nla_total_size(1) + /* IFLA_MACSEC_VALIDATION */
4220 static int macsec_fill_info(struct sk_buff
*skb
,
4221 const struct net_device
*dev
)
4223 struct macsec_secy
*secy
= &macsec_priv(dev
)->secy
;
4224 struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
4227 switch (secy
->key_len
) {
4228 case MACSEC_GCM_AES_128_SAK_LEN
:
4229 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_128
: MACSEC_DEFAULT_CIPHER_ID
;
4231 case MACSEC_GCM_AES_256_SAK_LEN
:
4232 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_256
: MACSEC_CIPHER_ID_GCM_AES_256
;
4235 goto nla_put_failure
;
4238 if (nla_put_sci(skb
, IFLA_MACSEC_SCI
, secy
->sci
,
4240 nla_put_u8(skb
, IFLA_MACSEC_ICV_LEN
, secy
->icv_len
) ||
4241 nla_put_u64_64bit(skb
, IFLA_MACSEC_CIPHER_SUITE
,
4242 csid
, IFLA_MACSEC_PAD
) ||
4243 nla_put_u8(skb
, IFLA_MACSEC_ENCODING_SA
, tx_sc
->encoding_sa
) ||
4244 nla_put_u8(skb
, IFLA_MACSEC_ENCRYPT
, tx_sc
->encrypt
) ||
4245 nla_put_u8(skb
, IFLA_MACSEC_PROTECT
, secy
->protect_frames
) ||
4246 nla_put_u8(skb
, IFLA_MACSEC_INC_SCI
, tx_sc
->send_sci
) ||
4247 nla_put_u8(skb
, IFLA_MACSEC_ES
, tx_sc
->end_station
) ||
4248 nla_put_u8(skb
, IFLA_MACSEC_SCB
, tx_sc
->scb
) ||
4249 nla_put_u8(skb
, IFLA_MACSEC_REPLAY_PROTECT
, secy
->replay_protect
) ||
4250 nla_put_u8(skb
, IFLA_MACSEC_VALIDATION
, secy
->validate_frames
) ||
4252 goto nla_put_failure
;
4254 if (secy
->replay_protect
) {
4255 if (nla_put_u32(skb
, IFLA_MACSEC_WINDOW
, secy
->replay_window
))
4256 goto nla_put_failure
;
4265 static struct rtnl_link_ops macsec_link_ops __read_mostly
= {
4267 .priv_size
= sizeof(struct macsec_dev
),
4268 .maxtype
= IFLA_MACSEC_MAX
,
4269 .policy
= macsec_rtnl_policy
,
4270 .setup
= macsec_setup
,
4271 .validate
= macsec_validate_attr
,
4272 .newlink
= macsec_newlink
,
4273 .changelink
= macsec_changelink
,
4274 .dellink
= macsec_dellink
,
4275 .get_size
= macsec_get_size
,
4276 .fill_info
= macsec_fill_info
,
4277 .get_link_net
= macsec_get_link_net
,
4280 static bool is_macsec_master(struct net_device
*dev
)
4282 return rcu_access_pointer(dev
->rx_handler
) == macsec_handle_frame
;
4285 static int macsec_notify(struct notifier_block
*this, unsigned long event
,
4288 struct net_device
*real_dev
= netdev_notifier_info_to_dev(ptr
);
4291 if (!is_macsec_master(real_dev
))
4297 case NETDEV_CHANGE
: {
4298 struct macsec_dev
*m
, *n
;
4299 struct macsec_rxh_data
*rxd
;
4301 rxd
= macsec_data_rtnl(real_dev
);
4302 list_for_each_entry_safe(m
, n
, &rxd
->secys
, secys
) {
4303 struct net_device
*dev
= m
->secy
.netdev
;
4305 netif_stacked_transfer_operstate(real_dev
, dev
);
4309 case NETDEV_UNREGISTER
: {
4310 struct macsec_dev
*m
, *n
;
4311 struct macsec_rxh_data
*rxd
;
4313 rxd
= macsec_data_rtnl(real_dev
);
4314 list_for_each_entry_safe(m
, n
, &rxd
->secys
, secys
) {
4315 macsec_common_dellink(m
->secy
.netdev
, &head
);
4318 netdev_rx_handler_unregister(real_dev
);
4321 unregister_netdevice_many(&head
);
4324 case NETDEV_CHANGEMTU
: {
4325 struct macsec_dev
*m
;
4326 struct macsec_rxh_data
*rxd
;
4328 rxd
= macsec_data_rtnl(real_dev
);
4329 list_for_each_entry(m
, &rxd
->secys
, secys
) {
4330 struct net_device
*dev
= m
->secy
.netdev
;
4331 unsigned int mtu
= real_dev
->mtu
- (m
->secy
.icv_len
+
4332 macsec_extra_len(true));
4335 dev_set_mtu(dev
, mtu
);
4343 static struct notifier_block macsec_notifier
= {
4344 .notifier_call
= macsec_notify
,
4347 static int __init
macsec_init(void)
4351 pr_info("MACsec IEEE 802.1AE\n");
4352 err
= register_netdevice_notifier(&macsec_notifier
);
4356 err
= rtnl_link_register(&macsec_link_ops
);
4360 err
= genl_register_family(&macsec_fam
);
4367 rtnl_link_unregister(&macsec_link_ops
);
4369 unregister_netdevice_notifier(&macsec_notifier
);
4373 static void __exit
macsec_exit(void)
4375 genl_unregister_family(&macsec_fam
);
4376 rtnl_link_unregister(&macsec_link_ops
);
4377 unregister_netdevice_notifier(&macsec_notifier
);
4381 module_init(macsec_init
);
4382 module_exit(macsec_exit
);
4384 MODULE_ALIAS_RTNL_LINK("macsec");
4385 MODULE_ALIAS_GENL_FAMILY("macsec");
4387 MODULE_DESCRIPTION("MACsec IEEE 802.1AE");
4388 MODULE_LICENSE("GPL v2");