1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * drivers/net/macsec.c - MACsec device
5 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net>
8 #include <linux/types.h>
9 #include <linux/skbuff.h>
10 #include <linux/socket.h>
11 #include <linux/module.h>
12 #include <crypto/aead.h>
13 #include <linux/etherdevice.h>
14 #include <linux/netdevice.h>
15 #include <linux/rtnetlink.h>
16 #include <linux/refcount.h>
17 #include <net/genetlink.h>
19 #include <net/gro_cells.h>
20 #include <net/macsec.h>
21 #include <linux/phy.h>
22 #include <linux/byteorder/generic.h>
23 #include <linux/if_arp.h>
25 #include <uapi/linux/if_macsec.h>
27 #define MACSEC_SCI_LEN 8
29 /* SecTAG length = macsec_eth_header without the optional SCI */
30 #define MACSEC_TAG_LEN 6
32 struct macsec_eth_header
{
36 #if defined(__LITTLE_ENDIAN_BITFIELD)
39 #elif defined(__BIG_ENDIAN_BITFIELD)
43 #error "Please fix <asm/byteorder.h>"
46 u8 secure_channel_id
[8]; /* optional */
49 #define MACSEC_TCI_VERSION 0x80
50 #define MACSEC_TCI_ES 0x40 /* end station */
51 #define MACSEC_TCI_SC 0x20 /* SCI present */
52 #define MACSEC_TCI_SCB 0x10 /* epon */
53 #define MACSEC_TCI_E 0x08 /* encryption */
54 #define MACSEC_TCI_C 0x04 /* changed text */
55 #define MACSEC_AN_MASK 0x03 /* association number */
56 #define MACSEC_TCI_CONFID (MACSEC_TCI_E | MACSEC_TCI_C)
58 /* minimum secure data length deemed "not short", see IEEE 802.1AE-2006 9.7 */
59 #define MIN_NON_SHORT_LEN 48
61 #define GCM_AES_IV_LEN 12
62 #define DEFAULT_ICV_LEN 16
64 #define for_each_rxsc(secy, sc) \
65 for (sc = rcu_dereference_bh(secy->rx_sc); \
67 sc = rcu_dereference_bh(sc->next))
68 #define for_each_rxsc_rtnl(secy, sc) \
69 for (sc = rtnl_dereference(secy->rx_sc); \
71 sc = rtnl_dereference(sc->next))
73 #define pn_same_half(pn1, pn2) (!(((pn1) >> 31) ^ ((pn2) >> 31)))
77 u8 short_secure_channel_id
[4];
85 u8 secure_channel_id
[8];
91 #define MACSEC_VALIDATE_DEFAULT MACSEC_VALIDATE_STRICT
93 struct pcpu_secy_stats
{
94 struct macsec_dev_stats stats
;
95 struct u64_stats_sync syncp
;
99 * struct macsec_dev - private data
101 * @real_dev: pointer to underlying netdevice
102 * @stats: MACsec device stats
103 * @secys: linked list of SecY's on the underlying device
104 * @gro_cells: pointer to the Generic Receive Offload cell
105 * @offload: status of offloading on the MACsec device
108 struct macsec_secy secy
;
109 struct net_device
*real_dev
;
110 struct pcpu_secy_stats __percpu
*stats
;
111 struct list_head secys
;
112 struct gro_cells gro_cells
;
113 enum macsec_offload offload
;
117 * struct macsec_rxh_data - rx_handler private argument
118 * @secys: linked list of SecY's on this underlying device
120 struct macsec_rxh_data
{
121 struct list_head secys
;
124 static struct macsec_dev
*macsec_priv(const struct net_device
*dev
)
126 return (struct macsec_dev
*)netdev_priv(dev
);
129 static struct macsec_rxh_data
*macsec_data_rcu(const struct net_device
*dev
)
131 return rcu_dereference_bh(dev
->rx_handler_data
);
134 static struct macsec_rxh_data
*macsec_data_rtnl(const struct net_device
*dev
)
136 return rtnl_dereference(dev
->rx_handler_data
);
140 struct aead_request
*req
;
142 struct macsec_tx_sa
*tx_sa
;
143 struct macsec_rx_sa
*rx_sa
;
150 static struct macsec_rx_sa
*macsec_rxsa_get(struct macsec_rx_sa __rcu
*ptr
)
152 struct macsec_rx_sa
*sa
= rcu_dereference_bh(ptr
);
154 if (!sa
|| !sa
->active
)
157 if (!refcount_inc_not_zero(&sa
->refcnt
))
163 static void free_rx_sc_rcu(struct rcu_head
*head
)
165 struct macsec_rx_sc
*rx_sc
= container_of(head
, struct macsec_rx_sc
, rcu_head
);
167 free_percpu(rx_sc
->stats
);
171 static struct macsec_rx_sc
*macsec_rxsc_get(struct macsec_rx_sc
*sc
)
173 return refcount_inc_not_zero(&sc
->refcnt
) ? sc
: NULL
;
176 static void macsec_rxsc_put(struct macsec_rx_sc
*sc
)
178 if (refcount_dec_and_test(&sc
->refcnt
))
179 call_rcu(&sc
->rcu_head
, free_rx_sc_rcu
);
182 static void free_rxsa(struct rcu_head
*head
)
184 struct macsec_rx_sa
*sa
= container_of(head
, struct macsec_rx_sa
, rcu
);
186 crypto_free_aead(sa
->key
.tfm
);
187 free_percpu(sa
->stats
);
191 static void macsec_rxsa_put(struct macsec_rx_sa
*sa
)
193 if (refcount_dec_and_test(&sa
->refcnt
))
194 call_rcu(&sa
->rcu
, free_rxsa
);
197 static struct macsec_tx_sa
*macsec_txsa_get(struct macsec_tx_sa __rcu
*ptr
)
199 struct macsec_tx_sa
*sa
= rcu_dereference_bh(ptr
);
201 if (!sa
|| !sa
->active
)
204 if (!refcount_inc_not_zero(&sa
->refcnt
))
210 static void free_txsa(struct rcu_head
*head
)
212 struct macsec_tx_sa
*sa
= container_of(head
, struct macsec_tx_sa
, rcu
);
214 crypto_free_aead(sa
->key
.tfm
);
215 free_percpu(sa
->stats
);
219 static void macsec_txsa_put(struct macsec_tx_sa
*sa
)
221 if (refcount_dec_and_test(&sa
->refcnt
))
222 call_rcu(&sa
->rcu
, free_txsa
);
225 static struct macsec_cb
*macsec_skb_cb(struct sk_buff
*skb
)
227 BUILD_BUG_ON(sizeof(struct macsec_cb
) > sizeof(skb
->cb
));
228 return (struct macsec_cb
*)skb
->cb
;
231 #define MACSEC_PORT_ES (htons(0x0001))
232 #define MACSEC_PORT_SCB (0x0000)
233 #define MACSEC_UNDEF_SCI ((__force sci_t)0xffffffffffffffffULL)
234 #define MACSEC_UNDEF_SSCI ((__force ssci_t)0xffffffff)
236 #define MACSEC_GCM_AES_128_SAK_LEN 16
237 #define MACSEC_GCM_AES_256_SAK_LEN 32
239 #define DEFAULT_SAK_LEN MACSEC_GCM_AES_128_SAK_LEN
240 #define DEFAULT_XPN false
241 #define DEFAULT_SEND_SCI true
242 #define DEFAULT_ENCRYPT false
243 #define DEFAULT_ENCODING_SA 0
245 static bool send_sci(const struct macsec_secy
*secy
)
247 const struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
249 return tx_sc
->send_sci
||
250 (secy
->n_rx_sc
> 1 && !tx_sc
->end_station
&& !tx_sc
->scb
);
253 static sci_t
make_sci(u8
*addr
, __be16 port
)
257 memcpy(&sci
, addr
, ETH_ALEN
);
258 memcpy(((char *)&sci
) + ETH_ALEN
, &port
, sizeof(port
));
263 static sci_t
macsec_frame_sci(struct macsec_eth_header
*hdr
, bool sci_present
)
268 memcpy(&sci
, hdr
->secure_channel_id
,
269 sizeof(hdr
->secure_channel_id
));
271 sci
= make_sci(hdr
->eth
.h_source
, MACSEC_PORT_ES
);
276 static unsigned int macsec_sectag_len(bool sci_present
)
278 return MACSEC_TAG_LEN
+ (sci_present
? MACSEC_SCI_LEN
: 0);
281 static unsigned int macsec_hdr_len(bool sci_present
)
283 return macsec_sectag_len(sci_present
) + ETH_HLEN
;
286 static unsigned int macsec_extra_len(bool sci_present
)
288 return macsec_sectag_len(sci_present
) + sizeof(__be16
);
291 /* Fill SecTAG according to IEEE 802.1AE-2006 10.5.3 */
292 static void macsec_fill_sectag(struct macsec_eth_header
*h
,
293 const struct macsec_secy
*secy
, u32 pn
,
296 const struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
298 memset(&h
->tci_an
, 0, macsec_sectag_len(sci_present
));
299 h
->eth
.h_proto
= htons(ETH_P_MACSEC
);
302 h
->tci_an
|= MACSEC_TCI_SC
;
303 memcpy(&h
->secure_channel_id
, &secy
->sci
,
304 sizeof(h
->secure_channel_id
));
306 if (tx_sc
->end_station
)
307 h
->tci_an
|= MACSEC_TCI_ES
;
309 h
->tci_an
|= MACSEC_TCI_SCB
;
312 h
->packet_number
= htonl(pn
);
314 /* with GCM, C/E clear for !encrypt, both set for encrypt */
316 h
->tci_an
|= MACSEC_TCI_CONFID
;
317 else if (secy
->icv_len
!= DEFAULT_ICV_LEN
)
318 h
->tci_an
|= MACSEC_TCI_C
;
320 h
->tci_an
|= tx_sc
->encoding_sa
;
323 static void macsec_set_shortlen(struct macsec_eth_header
*h
, size_t data_len
)
325 if (data_len
< MIN_NON_SHORT_LEN
)
326 h
->short_length
= data_len
;
329 /* Checks if a MACsec interface is being offloaded to an hardware engine */
330 static bool macsec_is_offloaded(struct macsec_dev
*macsec
)
332 if (macsec
->offload
== MACSEC_OFFLOAD_MAC
||
333 macsec
->offload
== MACSEC_OFFLOAD_PHY
)
339 /* Checks if underlying layers implement MACsec offloading functions. */
340 static bool macsec_check_offload(enum macsec_offload offload
,
341 struct macsec_dev
*macsec
)
343 if (!macsec
|| !macsec
->real_dev
)
346 if (offload
== MACSEC_OFFLOAD_PHY
)
347 return macsec
->real_dev
->phydev
&&
348 macsec
->real_dev
->phydev
->macsec_ops
;
349 else if (offload
== MACSEC_OFFLOAD_MAC
)
350 return macsec
->real_dev
->features
& NETIF_F_HW_MACSEC
&&
351 macsec
->real_dev
->macsec_ops
;
356 static const struct macsec_ops
*__macsec_get_ops(enum macsec_offload offload
,
357 struct macsec_dev
*macsec
,
358 struct macsec_context
*ctx
)
361 memset(ctx
, 0, sizeof(*ctx
));
362 ctx
->offload
= offload
;
364 if (offload
== MACSEC_OFFLOAD_PHY
)
365 ctx
->phydev
= macsec
->real_dev
->phydev
;
366 else if (offload
== MACSEC_OFFLOAD_MAC
)
367 ctx
->netdev
= macsec
->real_dev
;
370 if (offload
== MACSEC_OFFLOAD_PHY
)
371 return macsec
->real_dev
->phydev
->macsec_ops
;
373 return macsec
->real_dev
->macsec_ops
;
376 /* Returns a pointer to the MACsec ops struct if any and updates the MACsec
377 * context device reference if provided.
379 static const struct macsec_ops
*macsec_get_ops(struct macsec_dev
*macsec
,
380 struct macsec_context
*ctx
)
382 if (!macsec_check_offload(macsec
->offload
, macsec
))
385 return __macsec_get_ops(macsec
->offload
, macsec
, ctx
);
388 /* validate MACsec packet according to IEEE 802.1AE-2018 9.12 */
389 static bool macsec_validate_skb(struct sk_buff
*skb
, u16 icv_len
, bool xpn
)
391 struct macsec_eth_header
*h
= (struct macsec_eth_header
*)skb
->data
;
392 int len
= skb
->len
- 2 * ETH_ALEN
;
393 int extra_len
= macsec_extra_len(!!(h
->tci_an
& MACSEC_TCI_SC
)) + icv_len
;
395 /* a) It comprises at least 17 octets */
399 /* b) MACsec EtherType: already checked */
401 /* c) V bit is clear */
402 if (h
->tci_an
& MACSEC_TCI_VERSION
)
405 /* d) ES or SCB => !SC */
406 if ((h
->tci_an
& MACSEC_TCI_ES
|| h
->tci_an
& MACSEC_TCI_SCB
) &&
407 (h
->tci_an
& MACSEC_TCI_SC
))
410 /* e) Bits 7 and 8 of octet 4 of the SecTAG are clear */
414 /* rx.pn != 0 if not XPN (figure 10-5 with 802.11AEbw-2013 amendment) */
415 if (!h
->packet_number
&& !xpn
)
418 /* length check, f) g) h) i) */
420 return len
== extra_len
+ h
->short_length
;
421 return len
>= extra_len
+ MIN_NON_SHORT_LEN
;
424 #define MACSEC_NEEDED_HEADROOM (macsec_extra_len(true))
425 #define MACSEC_NEEDED_TAILROOM MACSEC_STD_ICV_LEN
427 static void macsec_fill_iv_xpn(unsigned char *iv
, ssci_t ssci
, u64 pn
,
430 struct gcm_iv_xpn
*gcm_iv
= (struct gcm_iv_xpn
*)iv
;
432 gcm_iv
->ssci
= ssci
^ salt
.ssci
;
433 gcm_iv
->pn
= cpu_to_be64(pn
) ^ salt
.pn
;
436 static void macsec_fill_iv(unsigned char *iv
, sci_t sci
, u32 pn
)
438 struct gcm_iv
*gcm_iv
= (struct gcm_iv
*)iv
;
441 gcm_iv
->pn
= htonl(pn
);
444 static struct macsec_eth_header
*macsec_ethhdr(struct sk_buff
*skb
)
446 return (struct macsec_eth_header
*)skb_mac_header(skb
);
449 static sci_t
dev_to_sci(struct net_device
*dev
, __be16 port
)
451 return make_sci(dev
->dev_addr
, port
);
454 static void __macsec_pn_wrapped(struct macsec_secy
*secy
,
455 struct macsec_tx_sa
*tx_sa
)
457 pr_debug("PN wrapped, transitioning to !oper\n");
458 tx_sa
->active
= false;
459 if (secy
->protect_frames
)
460 secy
->operational
= false;
463 void macsec_pn_wrapped(struct macsec_secy
*secy
, struct macsec_tx_sa
*tx_sa
)
465 spin_lock_bh(&tx_sa
->lock
);
466 __macsec_pn_wrapped(secy
, tx_sa
);
467 spin_unlock_bh(&tx_sa
->lock
);
469 EXPORT_SYMBOL_GPL(macsec_pn_wrapped
);
471 static pn_t
tx_sa_update_pn(struct macsec_tx_sa
*tx_sa
,
472 struct macsec_secy
*secy
)
476 spin_lock_bh(&tx_sa
->lock
);
478 pn
= tx_sa
->next_pn_halves
;
482 tx_sa
->next_pn_halves
.lower
++;
484 if (tx_sa
->next_pn
== 0)
485 __macsec_pn_wrapped(secy
, tx_sa
);
486 spin_unlock_bh(&tx_sa
->lock
);
491 static void macsec_encrypt_finish(struct sk_buff
*skb
, struct net_device
*dev
)
493 struct macsec_dev
*macsec
= netdev_priv(dev
);
495 skb
->dev
= macsec
->real_dev
;
496 skb_reset_mac_header(skb
);
497 skb
->protocol
= eth_hdr(skb
)->h_proto
;
500 static void macsec_count_tx(struct sk_buff
*skb
, struct macsec_tx_sc
*tx_sc
,
501 struct macsec_tx_sa
*tx_sa
)
503 struct pcpu_tx_sc_stats
*txsc_stats
= this_cpu_ptr(tx_sc
->stats
);
505 u64_stats_update_begin(&txsc_stats
->syncp
);
506 if (tx_sc
->encrypt
) {
507 txsc_stats
->stats
.OutOctetsEncrypted
+= skb
->len
;
508 txsc_stats
->stats
.OutPktsEncrypted
++;
509 this_cpu_inc(tx_sa
->stats
->OutPktsEncrypted
);
511 txsc_stats
->stats
.OutOctetsProtected
+= skb
->len
;
512 txsc_stats
->stats
.OutPktsProtected
++;
513 this_cpu_inc(tx_sa
->stats
->OutPktsProtected
);
515 u64_stats_update_end(&txsc_stats
->syncp
);
518 static void count_tx(struct net_device
*dev
, int ret
, int len
)
520 if (likely(ret
== NET_XMIT_SUCCESS
|| ret
== NET_XMIT_CN
)) {
521 struct pcpu_sw_netstats
*stats
= this_cpu_ptr(dev
->tstats
);
523 u64_stats_update_begin(&stats
->syncp
);
525 stats
->tx_bytes
+= len
;
526 u64_stats_update_end(&stats
->syncp
);
530 static void macsec_encrypt_done(struct crypto_async_request
*base
, int err
)
532 struct sk_buff
*skb
= base
->data
;
533 struct net_device
*dev
= skb
->dev
;
534 struct macsec_dev
*macsec
= macsec_priv(dev
);
535 struct macsec_tx_sa
*sa
= macsec_skb_cb(skb
)->tx_sa
;
538 aead_request_free(macsec_skb_cb(skb
)->req
);
541 macsec_encrypt_finish(skb
, dev
);
542 macsec_count_tx(skb
, &macsec
->secy
.tx_sc
, macsec_skb_cb(skb
)->tx_sa
);
544 ret
= dev_queue_xmit(skb
);
545 count_tx(dev
, ret
, len
);
546 rcu_read_unlock_bh();
552 static struct aead_request
*macsec_alloc_req(struct crypto_aead
*tfm
,
554 struct scatterlist
**sg
,
557 size_t size
, iv_offset
, sg_offset
;
558 struct aead_request
*req
;
561 size
= sizeof(struct aead_request
) + crypto_aead_reqsize(tfm
);
563 size
+= GCM_AES_IV_LEN
;
565 size
= ALIGN(size
, __alignof__(struct scatterlist
));
567 size
+= sizeof(struct scatterlist
) * num_frags
;
569 tmp
= kmalloc(size
, GFP_ATOMIC
);
573 *iv
= (unsigned char *)(tmp
+ iv_offset
);
574 *sg
= (struct scatterlist
*)(tmp
+ sg_offset
);
577 aead_request_set_tfm(req
, tfm
);
582 static struct sk_buff
*macsec_encrypt(struct sk_buff
*skb
,
583 struct net_device
*dev
)
586 struct scatterlist
*sg
;
587 struct sk_buff
*trailer
;
590 struct macsec_eth_header
*hh
;
591 size_t unprotected_len
;
592 struct aead_request
*req
;
593 struct macsec_secy
*secy
;
594 struct macsec_tx_sc
*tx_sc
;
595 struct macsec_tx_sa
*tx_sa
;
596 struct macsec_dev
*macsec
= macsec_priv(dev
);
600 secy
= &macsec
->secy
;
601 tx_sc
= &secy
->tx_sc
;
603 /* 10.5.1 TX SA assignment */
604 tx_sa
= macsec_txsa_get(tx_sc
->sa
[tx_sc
->encoding_sa
]);
606 secy
->operational
= false;
608 return ERR_PTR(-EINVAL
);
611 if (unlikely(skb_headroom(skb
) < MACSEC_NEEDED_HEADROOM
||
612 skb_tailroom(skb
) < MACSEC_NEEDED_TAILROOM
)) {
613 struct sk_buff
*nskb
= skb_copy_expand(skb
,
614 MACSEC_NEEDED_HEADROOM
,
615 MACSEC_NEEDED_TAILROOM
,
621 macsec_txsa_put(tx_sa
);
623 return ERR_PTR(-ENOMEM
);
626 skb
= skb_unshare(skb
, GFP_ATOMIC
);
628 macsec_txsa_put(tx_sa
);
629 return ERR_PTR(-ENOMEM
);
633 unprotected_len
= skb
->len
;
635 sci_present
= send_sci(secy
);
636 hh
= skb_push(skb
, macsec_extra_len(sci_present
));
637 memmove(hh
, eth
, 2 * ETH_ALEN
);
639 pn
= tx_sa_update_pn(tx_sa
, secy
);
640 if (pn
.full64
== 0) {
641 macsec_txsa_put(tx_sa
);
643 return ERR_PTR(-ENOLINK
);
645 macsec_fill_sectag(hh
, secy
, pn
.lower
, sci_present
);
646 macsec_set_shortlen(hh
, unprotected_len
- 2 * ETH_ALEN
);
648 skb_put(skb
, secy
->icv_len
);
650 if (skb
->len
- ETH_HLEN
> macsec_priv(dev
)->real_dev
->mtu
) {
651 struct pcpu_secy_stats
*secy_stats
= this_cpu_ptr(macsec
->stats
);
653 u64_stats_update_begin(&secy_stats
->syncp
);
654 secy_stats
->stats
.OutPktsTooLong
++;
655 u64_stats_update_end(&secy_stats
->syncp
);
657 macsec_txsa_put(tx_sa
);
659 return ERR_PTR(-EINVAL
);
662 ret
= skb_cow_data(skb
, 0, &trailer
);
663 if (unlikely(ret
< 0)) {
664 macsec_txsa_put(tx_sa
);
669 req
= macsec_alloc_req(tx_sa
->key
.tfm
, &iv
, &sg
, ret
);
671 macsec_txsa_put(tx_sa
);
673 return ERR_PTR(-ENOMEM
);
677 macsec_fill_iv_xpn(iv
, tx_sa
->ssci
, pn
.full64
, tx_sa
->key
.salt
);
679 macsec_fill_iv(iv
, secy
->sci
, pn
.lower
);
681 sg_init_table(sg
, ret
);
682 ret
= skb_to_sgvec(skb
, sg
, 0, skb
->len
);
683 if (unlikely(ret
< 0)) {
684 aead_request_free(req
);
685 macsec_txsa_put(tx_sa
);
690 if (tx_sc
->encrypt
) {
691 int len
= skb
->len
- macsec_hdr_len(sci_present
) -
693 aead_request_set_crypt(req
, sg
, sg
, len
, iv
);
694 aead_request_set_ad(req
, macsec_hdr_len(sci_present
));
696 aead_request_set_crypt(req
, sg
, sg
, 0, iv
);
697 aead_request_set_ad(req
, skb
->len
- secy
->icv_len
);
700 macsec_skb_cb(skb
)->req
= req
;
701 macsec_skb_cb(skb
)->tx_sa
= tx_sa
;
702 aead_request_set_callback(req
, 0, macsec_encrypt_done
, skb
);
705 ret
= crypto_aead_encrypt(req
);
706 if (ret
== -EINPROGRESS
) {
708 } else if (ret
!= 0) {
711 aead_request_free(req
);
712 macsec_txsa_put(tx_sa
);
713 return ERR_PTR(-EINVAL
);
717 aead_request_free(req
);
718 macsec_txsa_put(tx_sa
);
723 static bool macsec_post_decrypt(struct sk_buff
*skb
, struct macsec_secy
*secy
, u32 pn
)
725 struct macsec_rx_sa
*rx_sa
= macsec_skb_cb(skb
)->rx_sa
;
726 struct pcpu_rx_sc_stats
*rxsc_stats
= this_cpu_ptr(rx_sa
->sc
->stats
);
727 struct macsec_eth_header
*hdr
= macsec_ethhdr(skb
);
730 spin_lock(&rx_sa
->lock
);
731 if (rx_sa
->next_pn_halves
.lower
>= secy
->replay_window
)
732 lowest_pn
= rx_sa
->next_pn_halves
.lower
- secy
->replay_window
;
734 /* Now perform replay protection check again
735 * (see IEEE 802.1AE-2006 figure 10-5)
737 if (secy
->replay_protect
&& pn
< lowest_pn
&&
738 (!secy
->xpn
|| pn_same_half(pn
, lowest_pn
))) {
739 spin_unlock(&rx_sa
->lock
);
740 u64_stats_update_begin(&rxsc_stats
->syncp
);
741 rxsc_stats
->stats
.InPktsLate
++;
742 u64_stats_update_end(&rxsc_stats
->syncp
);
746 if (secy
->validate_frames
!= MACSEC_VALIDATE_DISABLED
) {
747 u64_stats_update_begin(&rxsc_stats
->syncp
);
748 if (hdr
->tci_an
& MACSEC_TCI_E
)
749 rxsc_stats
->stats
.InOctetsDecrypted
+= skb
->len
;
751 rxsc_stats
->stats
.InOctetsValidated
+= skb
->len
;
752 u64_stats_update_end(&rxsc_stats
->syncp
);
755 if (!macsec_skb_cb(skb
)->valid
) {
756 spin_unlock(&rx_sa
->lock
);
759 if (hdr
->tci_an
& MACSEC_TCI_C
||
760 secy
->validate_frames
== MACSEC_VALIDATE_STRICT
) {
761 u64_stats_update_begin(&rxsc_stats
->syncp
);
762 rxsc_stats
->stats
.InPktsNotValid
++;
763 u64_stats_update_end(&rxsc_stats
->syncp
);
767 u64_stats_update_begin(&rxsc_stats
->syncp
);
768 if (secy
->validate_frames
== MACSEC_VALIDATE_CHECK
) {
769 rxsc_stats
->stats
.InPktsInvalid
++;
770 this_cpu_inc(rx_sa
->stats
->InPktsInvalid
);
771 } else if (pn
< lowest_pn
) {
772 rxsc_stats
->stats
.InPktsDelayed
++;
774 rxsc_stats
->stats
.InPktsUnchecked
++;
776 u64_stats_update_end(&rxsc_stats
->syncp
);
778 u64_stats_update_begin(&rxsc_stats
->syncp
);
779 if (pn
< lowest_pn
) {
780 rxsc_stats
->stats
.InPktsDelayed
++;
782 rxsc_stats
->stats
.InPktsOK
++;
783 this_cpu_inc(rx_sa
->stats
->InPktsOK
);
785 u64_stats_update_end(&rxsc_stats
->syncp
);
787 // Instead of "pn >=" - to support pn overflow in xpn
788 if (pn
+ 1 > rx_sa
->next_pn_halves
.lower
) {
789 rx_sa
->next_pn_halves
.lower
= pn
+ 1;
790 } else if (secy
->xpn
&&
791 !pn_same_half(pn
, rx_sa
->next_pn_halves
.lower
)) {
792 rx_sa
->next_pn_halves
.upper
++;
793 rx_sa
->next_pn_halves
.lower
= pn
+ 1;
796 spin_unlock(&rx_sa
->lock
);
802 static void macsec_reset_skb(struct sk_buff
*skb
, struct net_device
*dev
)
804 skb
->pkt_type
= PACKET_HOST
;
805 skb
->protocol
= eth_type_trans(skb
, dev
);
807 skb_reset_network_header(skb
);
808 if (!skb_transport_header_was_set(skb
))
809 skb_reset_transport_header(skb
);
810 skb_reset_mac_len(skb
);
813 static void macsec_finalize_skb(struct sk_buff
*skb
, u8 icv_len
, u8 hdr_len
)
815 skb
->ip_summed
= CHECKSUM_NONE
;
816 memmove(skb
->data
+ hdr_len
, skb
->data
, 2 * ETH_ALEN
);
817 skb_pull(skb
, hdr_len
);
818 pskb_trim_unique(skb
, skb
->len
- icv_len
);
821 static void count_rx(struct net_device
*dev
, int len
)
823 struct pcpu_sw_netstats
*stats
= this_cpu_ptr(dev
->tstats
);
825 u64_stats_update_begin(&stats
->syncp
);
827 stats
->rx_bytes
+= len
;
828 u64_stats_update_end(&stats
->syncp
);
831 static void macsec_decrypt_done(struct crypto_async_request
*base
, int err
)
833 struct sk_buff
*skb
= base
->data
;
834 struct net_device
*dev
= skb
->dev
;
835 struct macsec_dev
*macsec
= macsec_priv(dev
);
836 struct macsec_rx_sa
*rx_sa
= macsec_skb_cb(skb
)->rx_sa
;
837 struct macsec_rx_sc
*rx_sc
= rx_sa
->sc
;
841 aead_request_free(macsec_skb_cb(skb
)->req
);
844 macsec_skb_cb(skb
)->valid
= true;
847 pn
= ntohl(macsec_ethhdr(skb
)->packet_number
);
848 if (!macsec_post_decrypt(skb
, &macsec
->secy
, pn
)) {
849 rcu_read_unlock_bh();
854 macsec_finalize_skb(skb
, macsec
->secy
.icv_len
,
855 macsec_extra_len(macsec_skb_cb(skb
)->has_sci
));
856 macsec_reset_skb(skb
, macsec
->secy
.netdev
);
859 if (gro_cells_receive(&macsec
->gro_cells
, skb
) == NET_RX_SUCCESS
)
862 rcu_read_unlock_bh();
865 macsec_rxsa_put(rx_sa
);
866 macsec_rxsc_put(rx_sc
);
870 static struct sk_buff
*macsec_decrypt(struct sk_buff
*skb
,
871 struct net_device
*dev
,
872 struct macsec_rx_sa
*rx_sa
,
874 struct macsec_secy
*secy
)
877 struct scatterlist
*sg
;
878 struct sk_buff
*trailer
;
880 struct aead_request
*req
;
881 struct macsec_eth_header
*hdr
;
883 u16 icv_len
= secy
->icv_len
;
885 macsec_skb_cb(skb
)->valid
= false;
886 skb
= skb_share_check(skb
, GFP_ATOMIC
);
888 return ERR_PTR(-ENOMEM
);
890 ret
= skb_cow_data(skb
, 0, &trailer
);
891 if (unlikely(ret
< 0)) {
895 req
= macsec_alloc_req(rx_sa
->key
.tfm
, &iv
, &sg
, ret
);
898 return ERR_PTR(-ENOMEM
);
901 hdr
= (struct macsec_eth_header
*)skb
->data
;
902 hdr_pn
= ntohl(hdr
->packet_number
);
905 pn_t recovered_pn
= rx_sa
->next_pn_halves
;
907 recovered_pn
.lower
= hdr_pn
;
908 if (hdr_pn
< rx_sa
->next_pn_halves
.lower
&&
909 !pn_same_half(hdr_pn
, rx_sa
->next_pn_halves
.lower
))
910 recovered_pn
.upper
++;
912 macsec_fill_iv_xpn(iv
, rx_sa
->ssci
, recovered_pn
.full64
,
915 macsec_fill_iv(iv
, sci
, hdr_pn
);
918 sg_init_table(sg
, ret
);
919 ret
= skb_to_sgvec(skb
, sg
, 0, skb
->len
);
920 if (unlikely(ret
< 0)) {
921 aead_request_free(req
);
926 if (hdr
->tci_an
& MACSEC_TCI_E
) {
927 /* confidentiality: ethernet + macsec header
928 * authenticated, encrypted payload
930 int len
= skb
->len
- macsec_hdr_len(macsec_skb_cb(skb
)->has_sci
);
932 aead_request_set_crypt(req
, sg
, sg
, len
, iv
);
933 aead_request_set_ad(req
, macsec_hdr_len(macsec_skb_cb(skb
)->has_sci
));
934 skb
= skb_unshare(skb
, GFP_ATOMIC
);
936 aead_request_free(req
);
937 return ERR_PTR(-ENOMEM
);
940 /* integrity only: all headers + data authenticated */
941 aead_request_set_crypt(req
, sg
, sg
, icv_len
, iv
);
942 aead_request_set_ad(req
, skb
->len
- icv_len
);
945 macsec_skb_cb(skb
)->req
= req
;
947 aead_request_set_callback(req
, 0, macsec_decrypt_done
, skb
);
950 ret
= crypto_aead_decrypt(req
);
951 if (ret
== -EINPROGRESS
) {
953 } else if (ret
!= 0) {
954 /* decryption/authentication failed
955 * 10.6 if validateFrames is disabled, deliver anyway
957 if (ret
!= -EBADMSG
) {
962 macsec_skb_cb(skb
)->valid
= true;
966 aead_request_free(req
);
971 static struct macsec_rx_sc
*find_rx_sc(struct macsec_secy
*secy
, sci_t sci
)
973 struct macsec_rx_sc
*rx_sc
;
975 for_each_rxsc(secy
, rx_sc
) {
976 if (rx_sc
->sci
== sci
)
983 static struct macsec_rx_sc
*find_rx_sc_rtnl(struct macsec_secy
*secy
, sci_t sci
)
985 struct macsec_rx_sc
*rx_sc
;
987 for_each_rxsc_rtnl(secy
, rx_sc
) {
988 if (rx_sc
->sci
== sci
)
995 static enum rx_handler_result
handle_not_macsec(struct sk_buff
*skb
)
997 /* Deliver to the uncontrolled port by default */
998 enum rx_handler_result ret
= RX_HANDLER_PASS
;
999 struct ethhdr
*hdr
= eth_hdr(skb
);
1000 struct macsec_rxh_data
*rxd
;
1001 struct macsec_dev
*macsec
;
1004 rxd
= macsec_data_rcu(skb
->dev
);
1006 list_for_each_entry_rcu(macsec
, &rxd
->secys
, secys
) {
1007 struct sk_buff
*nskb
;
1008 struct pcpu_secy_stats
*secy_stats
= this_cpu_ptr(macsec
->stats
);
1009 struct net_device
*ndev
= macsec
->secy
.netdev
;
1011 /* If h/w offloading is enabled, HW decodes frames and strips
1012 * the SecTAG, so we have to deduce which port to deliver to.
1014 if (macsec_is_offloaded(macsec
) && netif_running(ndev
)) {
1015 if (ether_addr_equal_64bits(hdr
->h_dest
,
1017 /* exact match, divert skb to this port */
1019 skb
->pkt_type
= PACKET_HOST
;
1020 ret
= RX_HANDLER_ANOTHER
;
1022 } else if (is_multicast_ether_addr_64bits(
1024 /* multicast frame, deliver on this port too */
1025 nskb
= skb_clone(skb
, GFP_ATOMIC
);
1030 if (ether_addr_equal_64bits(hdr
->h_dest
,
1032 nskb
->pkt_type
= PACKET_BROADCAST
;
1034 nskb
->pkt_type
= PACKET_MULTICAST
;
1041 /* 10.6 If the management control validateFrames is not
1042 * Strict, frames without a SecTAG are received, counted, and
1043 * delivered to the Controlled Port
1045 if (macsec
->secy
.validate_frames
== MACSEC_VALIDATE_STRICT
) {
1046 u64_stats_update_begin(&secy_stats
->syncp
);
1047 secy_stats
->stats
.InPktsNoTag
++;
1048 u64_stats_update_end(&secy_stats
->syncp
);
1052 /* deliver on this port */
1053 nskb
= skb_clone(skb
, GFP_ATOMIC
);
1059 if (netif_rx(nskb
) == NET_RX_SUCCESS
) {
1060 u64_stats_update_begin(&secy_stats
->syncp
);
1061 secy_stats
->stats
.InPktsUntagged
++;
1062 u64_stats_update_end(&secy_stats
->syncp
);
1071 static rx_handler_result_t
macsec_handle_frame(struct sk_buff
**pskb
)
1073 struct sk_buff
*skb
= *pskb
;
1074 struct net_device
*dev
= skb
->dev
;
1075 struct macsec_eth_header
*hdr
;
1076 struct macsec_secy
*secy
= NULL
;
1077 struct macsec_rx_sc
*rx_sc
;
1078 struct macsec_rx_sa
*rx_sa
;
1079 struct macsec_rxh_data
*rxd
;
1080 struct macsec_dev
*macsec
;
1085 struct pcpu_rx_sc_stats
*rxsc_stats
;
1086 struct pcpu_secy_stats
*secy_stats
;
1090 if (skb_headroom(skb
) < ETH_HLEN
)
1093 hdr
= macsec_ethhdr(skb
);
1094 if (hdr
->eth
.h_proto
!= htons(ETH_P_MACSEC
))
1095 return handle_not_macsec(skb
);
1097 skb
= skb_unshare(skb
, GFP_ATOMIC
);
1100 return RX_HANDLER_CONSUMED
;
1102 pulled_sci
= pskb_may_pull(skb
, macsec_extra_len(true));
1104 if (!pskb_may_pull(skb
, macsec_extra_len(false)))
1108 hdr
= macsec_ethhdr(skb
);
1110 /* Frames with a SecTAG that has the TCI E bit set but the C
1111 * bit clear are discarded, as this reserved encoding is used
1112 * to identify frames with a SecTAG that are not to be
1113 * delivered to the Controlled Port.
1115 if ((hdr
->tci_an
& (MACSEC_TCI_C
| MACSEC_TCI_E
)) == MACSEC_TCI_E
)
1116 return RX_HANDLER_PASS
;
1118 /* now, pull the extra length */
1119 if (hdr
->tci_an
& MACSEC_TCI_SC
) {
1124 /* ethernet header is part of crypto processing */
1125 skb_push(skb
, ETH_HLEN
);
1127 macsec_skb_cb(skb
)->has_sci
= !!(hdr
->tci_an
& MACSEC_TCI_SC
);
1128 macsec_skb_cb(skb
)->assoc_num
= hdr
->tci_an
& MACSEC_AN_MASK
;
1129 sci
= macsec_frame_sci(hdr
, macsec_skb_cb(skb
)->has_sci
);
1132 rxd
= macsec_data_rcu(skb
->dev
);
1134 list_for_each_entry_rcu(macsec
, &rxd
->secys
, secys
) {
1135 struct macsec_rx_sc
*sc
= find_rx_sc(&macsec
->secy
, sci
);
1137 sc
= sc
? macsec_rxsc_get(sc
) : NULL
;
1140 secy
= &macsec
->secy
;
1150 macsec
= macsec_priv(dev
);
1151 secy_stats
= this_cpu_ptr(macsec
->stats
);
1152 rxsc_stats
= this_cpu_ptr(rx_sc
->stats
);
1154 if (!macsec_validate_skb(skb
, secy
->icv_len
, secy
->xpn
)) {
1155 u64_stats_update_begin(&secy_stats
->syncp
);
1156 secy_stats
->stats
.InPktsBadTag
++;
1157 u64_stats_update_end(&secy_stats
->syncp
);
1161 rx_sa
= macsec_rxsa_get(rx_sc
->sa
[macsec_skb_cb(skb
)->assoc_num
]);
1163 /* 10.6.1 if the SA is not in use */
1165 /* If validateFrames is Strict or the C bit in the
1166 * SecTAG is set, discard
1168 if (hdr
->tci_an
& MACSEC_TCI_C
||
1169 secy
->validate_frames
== MACSEC_VALIDATE_STRICT
) {
1170 u64_stats_update_begin(&rxsc_stats
->syncp
);
1171 rxsc_stats
->stats
.InPktsNotUsingSA
++;
1172 u64_stats_update_end(&rxsc_stats
->syncp
);
1176 /* not Strict, the frame (with the SecTAG and ICV
1177 * removed) is delivered to the Controlled Port.
1179 u64_stats_update_begin(&rxsc_stats
->syncp
);
1180 rxsc_stats
->stats
.InPktsUnusedSA
++;
1181 u64_stats_update_end(&rxsc_stats
->syncp
);
1185 /* First, PN check to avoid decrypting obviously wrong packets */
1186 hdr_pn
= ntohl(hdr
->packet_number
);
1187 if (secy
->replay_protect
) {
1190 spin_lock(&rx_sa
->lock
);
1191 late
= rx_sa
->next_pn_halves
.lower
>= secy
->replay_window
&&
1192 hdr_pn
< (rx_sa
->next_pn_halves
.lower
- secy
->replay_window
);
1195 late
= late
&& pn_same_half(rx_sa
->next_pn_halves
.lower
, hdr_pn
);
1196 spin_unlock(&rx_sa
->lock
);
1199 u64_stats_update_begin(&rxsc_stats
->syncp
);
1200 rxsc_stats
->stats
.InPktsLate
++;
1201 u64_stats_update_end(&rxsc_stats
->syncp
);
1206 macsec_skb_cb(skb
)->rx_sa
= rx_sa
;
1208 /* Disabled && !changed text => skip validation */
1209 if (hdr
->tci_an
& MACSEC_TCI_C
||
1210 secy
->validate_frames
!= MACSEC_VALIDATE_DISABLED
)
1211 skb
= macsec_decrypt(skb
, dev
, rx_sa
, sci
, secy
);
1214 /* the decrypt callback needs the reference */
1215 if (PTR_ERR(skb
) != -EINPROGRESS
) {
1216 macsec_rxsa_put(rx_sa
);
1217 macsec_rxsc_put(rx_sc
);
1221 return RX_HANDLER_CONSUMED
;
1224 if (!macsec_post_decrypt(skb
, secy
, hdr_pn
))
1228 macsec_finalize_skb(skb
, secy
->icv_len
,
1229 macsec_extra_len(macsec_skb_cb(skb
)->has_sci
));
1230 macsec_reset_skb(skb
, secy
->netdev
);
1233 macsec_rxsa_put(rx_sa
);
1234 macsec_rxsc_put(rx_sc
);
1238 ret
= gro_cells_receive(&macsec
->gro_cells
, skb
);
1239 if (ret
== NET_RX_SUCCESS
)
1242 macsec
->secy
.netdev
->stats
.rx_dropped
++;
1247 return RX_HANDLER_CONSUMED
;
1250 macsec_rxsa_put(rx_sa
);
1252 macsec_rxsc_put(rx_sc
);
1257 return RX_HANDLER_CONSUMED
;
1260 /* 10.6.1 if the SC is not found */
1261 cbit
= !!(hdr
->tci_an
& MACSEC_TCI_C
);
1263 macsec_finalize_skb(skb
, DEFAULT_ICV_LEN
,
1264 macsec_extra_len(macsec_skb_cb(skb
)->has_sci
));
1266 list_for_each_entry_rcu(macsec
, &rxd
->secys
, secys
) {
1267 struct sk_buff
*nskb
;
1269 secy_stats
= this_cpu_ptr(macsec
->stats
);
1271 /* If validateFrames is Strict or the C bit in the
1272 * SecTAG is set, discard
1275 macsec
->secy
.validate_frames
== MACSEC_VALIDATE_STRICT
) {
1276 u64_stats_update_begin(&secy_stats
->syncp
);
1277 secy_stats
->stats
.InPktsNoSCI
++;
1278 u64_stats_update_end(&secy_stats
->syncp
);
1282 /* not strict, the frame (with the SecTAG and ICV
1283 * removed) is delivered to the Controlled Port.
1285 nskb
= skb_clone(skb
, GFP_ATOMIC
);
1289 macsec_reset_skb(nskb
, macsec
->secy
.netdev
);
1291 ret
= netif_rx(nskb
);
1292 if (ret
== NET_RX_SUCCESS
) {
1293 u64_stats_update_begin(&secy_stats
->syncp
);
1294 secy_stats
->stats
.InPktsUnknownSCI
++;
1295 u64_stats_update_end(&secy_stats
->syncp
);
1297 macsec
->secy
.netdev
->stats
.rx_dropped
++;
1303 return RX_HANDLER_PASS
;
1306 static struct crypto_aead
*macsec_alloc_tfm(char *key
, int key_len
, int icv_len
)
1308 struct crypto_aead
*tfm
;
1311 /* Pick a sync gcm(aes) cipher to ensure order is preserved. */
1312 tfm
= crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC
);
1317 ret
= crypto_aead_setkey(tfm
, key
, key_len
);
1321 ret
= crypto_aead_setauthsize(tfm
, icv_len
);
1327 crypto_free_aead(tfm
);
1328 return ERR_PTR(ret
);
1331 static int init_rx_sa(struct macsec_rx_sa
*rx_sa
, char *sak
, int key_len
,
1334 rx_sa
->stats
= alloc_percpu(struct macsec_rx_sa_stats
);
1338 rx_sa
->key
.tfm
= macsec_alloc_tfm(sak
, key_len
, icv_len
);
1339 if (IS_ERR(rx_sa
->key
.tfm
)) {
1340 free_percpu(rx_sa
->stats
);
1341 return PTR_ERR(rx_sa
->key
.tfm
);
1344 rx_sa
->ssci
= MACSEC_UNDEF_SSCI
;
1345 rx_sa
->active
= false;
1347 refcount_set(&rx_sa
->refcnt
, 1);
1348 spin_lock_init(&rx_sa
->lock
);
1353 static void clear_rx_sa(struct macsec_rx_sa
*rx_sa
)
1355 rx_sa
->active
= false;
1357 macsec_rxsa_put(rx_sa
);
1360 static void free_rx_sc(struct macsec_rx_sc
*rx_sc
)
1364 for (i
= 0; i
< MACSEC_NUM_AN
; i
++) {
1365 struct macsec_rx_sa
*sa
= rtnl_dereference(rx_sc
->sa
[i
]);
1367 RCU_INIT_POINTER(rx_sc
->sa
[i
], NULL
);
1372 macsec_rxsc_put(rx_sc
);
1375 static struct macsec_rx_sc
*del_rx_sc(struct macsec_secy
*secy
, sci_t sci
)
1377 struct macsec_rx_sc
*rx_sc
, __rcu
**rx_scp
;
1379 for (rx_scp
= &secy
->rx_sc
, rx_sc
= rtnl_dereference(*rx_scp
);
1381 rx_scp
= &rx_sc
->next
, rx_sc
= rtnl_dereference(*rx_scp
)) {
1382 if (rx_sc
->sci
== sci
) {
1385 rcu_assign_pointer(*rx_scp
, rx_sc
->next
);
1393 static struct macsec_rx_sc
*create_rx_sc(struct net_device
*dev
, sci_t sci
)
1395 struct macsec_rx_sc
*rx_sc
;
1396 struct macsec_dev
*macsec
;
1397 struct net_device
*real_dev
= macsec_priv(dev
)->real_dev
;
1398 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(real_dev
);
1399 struct macsec_secy
*secy
;
1401 list_for_each_entry(macsec
, &rxd
->secys
, secys
) {
1402 if (find_rx_sc_rtnl(&macsec
->secy
, sci
))
1403 return ERR_PTR(-EEXIST
);
1406 rx_sc
= kzalloc(sizeof(*rx_sc
), GFP_KERNEL
);
1408 return ERR_PTR(-ENOMEM
);
1410 rx_sc
->stats
= netdev_alloc_pcpu_stats(struct pcpu_rx_sc_stats
);
1411 if (!rx_sc
->stats
) {
1413 return ERR_PTR(-ENOMEM
);
1417 rx_sc
->active
= true;
1418 refcount_set(&rx_sc
->refcnt
, 1);
1420 secy
= &macsec_priv(dev
)->secy
;
1421 rcu_assign_pointer(rx_sc
->next
, secy
->rx_sc
);
1422 rcu_assign_pointer(secy
->rx_sc
, rx_sc
);
1430 static int init_tx_sa(struct macsec_tx_sa
*tx_sa
, char *sak
, int key_len
,
1433 tx_sa
->stats
= alloc_percpu(struct macsec_tx_sa_stats
);
1437 tx_sa
->key
.tfm
= macsec_alloc_tfm(sak
, key_len
, icv_len
);
1438 if (IS_ERR(tx_sa
->key
.tfm
)) {
1439 free_percpu(tx_sa
->stats
);
1440 return PTR_ERR(tx_sa
->key
.tfm
);
1443 tx_sa
->ssci
= MACSEC_UNDEF_SSCI
;
1444 tx_sa
->active
= false;
1445 refcount_set(&tx_sa
->refcnt
, 1);
1446 spin_lock_init(&tx_sa
->lock
);
1451 static void clear_tx_sa(struct macsec_tx_sa
*tx_sa
)
1453 tx_sa
->active
= false;
1455 macsec_txsa_put(tx_sa
);
1458 static struct genl_family macsec_fam
;
1460 static struct net_device
*get_dev_from_nl(struct net
*net
,
1461 struct nlattr
**attrs
)
1463 int ifindex
= nla_get_u32(attrs
[MACSEC_ATTR_IFINDEX
]);
1464 struct net_device
*dev
;
1466 dev
= __dev_get_by_index(net
, ifindex
);
1468 return ERR_PTR(-ENODEV
);
1470 if (!netif_is_macsec(dev
))
1471 return ERR_PTR(-ENODEV
);
1476 static enum macsec_offload
nla_get_offload(const struct nlattr
*nla
)
1478 return (__force
enum macsec_offload
)nla_get_u8(nla
);
1481 static sci_t
nla_get_sci(const struct nlattr
*nla
)
1483 return (__force sci_t
)nla_get_u64(nla
);
1486 static int nla_put_sci(struct sk_buff
*skb
, int attrtype
, sci_t value
,
1489 return nla_put_u64_64bit(skb
, attrtype
, (__force u64
)value
, padattr
);
1492 static ssci_t
nla_get_ssci(const struct nlattr
*nla
)
1494 return (__force ssci_t
)nla_get_u32(nla
);
1497 static int nla_put_ssci(struct sk_buff
*skb
, int attrtype
, ssci_t value
)
1499 return nla_put_u32(skb
, attrtype
, (__force u64
)value
);
1502 static struct macsec_tx_sa
*get_txsa_from_nl(struct net
*net
,
1503 struct nlattr
**attrs
,
1504 struct nlattr
**tb_sa
,
1505 struct net_device
**devp
,
1506 struct macsec_secy
**secyp
,
1507 struct macsec_tx_sc
**scp
,
1510 struct net_device
*dev
;
1511 struct macsec_secy
*secy
;
1512 struct macsec_tx_sc
*tx_sc
;
1513 struct macsec_tx_sa
*tx_sa
;
1515 if (!tb_sa
[MACSEC_SA_ATTR_AN
])
1516 return ERR_PTR(-EINVAL
);
1518 *assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1520 dev
= get_dev_from_nl(net
, attrs
);
1522 return ERR_CAST(dev
);
1524 if (*assoc_num
>= MACSEC_NUM_AN
)
1525 return ERR_PTR(-EINVAL
);
1527 secy
= &macsec_priv(dev
)->secy
;
1528 tx_sc
= &secy
->tx_sc
;
1530 tx_sa
= rtnl_dereference(tx_sc
->sa
[*assoc_num
]);
1532 return ERR_PTR(-ENODEV
);
1540 static struct macsec_rx_sc
*get_rxsc_from_nl(struct net
*net
,
1541 struct nlattr
**attrs
,
1542 struct nlattr
**tb_rxsc
,
1543 struct net_device
**devp
,
1544 struct macsec_secy
**secyp
)
1546 struct net_device
*dev
;
1547 struct macsec_secy
*secy
;
1548 struct macsec_rx_sc
*rx_sc
;
1551 dev
= get_dev_from_nl(net
, attrs
);
1553 return ERR_CAST(dev
);
1555 secy
= &macsec_priv(dev
)->secy
;
1557 if (!tb_rxsc
[MACSEC_RXSC_ATTR_SCI
])
1558 return ERR_PTR(-EINVAL
);
1560 sci
= nla_get_sci(tb_rxsc
[MACSEC_RXSC_ATTR_SCI
]);
1561 rx_sc
= find_rx_sc_rtnl(secy
, sci
);
1563 return ERR_PTR(-ENODEV
);
1571 static struct macsec_rx_sa
*get_rxsa_from_nl(struct net
*net
,
1572 struct nlattr
**attrs
,
1573 struct nlattr
**tb_rxsc
,
1574 struct nlattr
**tb_sa
,
1575 struct net_device
**devp
,
1576 struct macsec_secy
**secyp
,
1577 struct macsec_rx_sc
**scp
,
1580 struct macsec_rx_sc
*rx_sc
;
1581 struct macsec_rx_sa
*rx_sa
;
1583 if (!tb_sa
[MACSEC_SA_ATTR_AN
])
1584 return ERR_PTR(-EINVAL
);
1586 *assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1587 if (*assoc_num
>= MACSEC_NUM_AN
)
1588 return ERR_PTR(-EINVAL
);
1590 rx_sc
= get_rxsc_from_nl(net
, attrs
, tb_rxsc
, devp
, secyp
);
1592 return ERR_CAST(rx_sc
);
1594 rx_sa
= rtnl_dereference(rx_sc
->sa
[*assoc_num
]);
1596 return ERR_PTR(-ENODEV
);
1602 static const struct nla_policy macsec_genl_policy
[NUM_MACSEC_ATTR
] = {
1603 [MACSEC_ATTR_IFINDEX
] = { .type
= NLA_U32
},
1604 [MACSEC_ATTR_RXSC_CONFIG
] = { .type
= NLA_NESTED
},
1605 [MACSEC_ATTR_SA_CONFIG
] = { .type
= NLA_NESTED
},
1606 [MACSEC_ATTR_OFFLOAD
] = { .type
= NLA_NESTED
},
1609 static const struct nla_policy macsec_genl_rxsc_policy
[NUM_MACSEC_RXSC_ATTR
] = {
1610 [MACSEC_RXSC_ATTR_SCI
] = { .type
= NLA_U64
},
1611 [MACSEC_RXSC_ATTR_ACTIVE
] = { .type
= NLA_U8
},
1614 static const struct nla_policy macsec_genl_sa_policy
[NUM_MACSEC_SA_ATTR
] = {
1615 [MACSEC_SA_ATTR_AN
] = { .type
= NLA_U8
},
1616 [MACSEC_SA_ATTR_ACTIVE
] = { .type
= NLA_U8
},
1617 [MACSEC_SA_ATTR_PN
] = NLA_POLICY_MIN_LEN(4),
1618 [MACSEC_SA_ATTR_KEYID
] = { .type
= NLA_BINARY
,
1619 .len
= MACSEC_KEYID_LEN
, },
1620 [MACSEC_SA_ATTR_KEY
] = { .type
= NLA_BINARY
,
1621 .len
= MACSEC_MAX_KEY_LEN
, },
1622 [MACSEC_SA_ATTR_SSCI
] = { .type
= NLA_U32
},
1623 [MACSEC_SA_ATTR_SALT
] = { .type
= NLA_BINARY
,
1624 .len
= MACSEC_SALT_LEN
, },
1627 static const struct nla_policy macsec_genl_offload_policy
[NUM_MACSEC_OFFLOAD_ATTR
] = {
1628 [MACSEC_OFFLOAD_ATTR_TYPE
] = { .type
= NLA_U8
},
1631 /* Offloads an operation to a device driver */
1632 static int macsec_offload(int (* const func
)(struct macsec_context
*),
1633 struct macsec_context
*ctx
)
1637 if (unlikely(!func
))
1640 if (ctx
->offload
== MACSEC_OFFLOAD_PHY
)
1641 mutex_lock(&ctx
->phydev
->lock
);
1643 /* Phase I: prepare. The drive should fail here if there are going to be
1644 * issues in the commit phase.
1646 ctx
->prepare
= true;
1651 /* Phase II: commit. This step cannot fail. */
1652 ctx
->prepare
= false;
1654 /* This should never happen: commit is not allowed to fail */
1656 WARN(1, "MACsec offloading commit failed (%d)\n", ret
);
1659 if (ctx
->offload
== MACSEC_OFFLOAD_PHY
)
1660 mutex_unlock(&ctx
->phydev
->lock
);
1665 static int parse_sa_config(struct nlattr
**attrs
, struct nlattr
**tb_sa
)
1667 if (!attrs
[MACSEC_ATTR_SA_CONFIG
])
1670 if (nla_parse_nested_deprecated(tb_sa
, MACSEC_SA_ATTR_MAX
, attrs
[MACSEC_ATTR_SA_CONFIG
], macsec_genl_sa_policy
, NULL
))
1676 static int parse_rxsc_config(struct nlattr
**attrs
, struct nlattr
**tb_rxsc
)
1678 if (!attrs
[MACSEC_ATTR_RXSC_CONFIG
])
1681 if (nla_parse_nested_deprecated(tb_rxsc
, MACSEC_RXSC_ATTR_MAX
, attrs
[MACSEC_ATTR_RXSC_CONFIG
], macsec_genl_rxsc_policy
, NULL
))
1687 static bool validate_add_rxsa(struct nlattr
**attrs
)
1689 if (!attrs
[MACSEC_SA_ATTR_AN
] ||
1690 !attrs
[MACSEC_SA_ATTR_KEY
] ||
1691 !attrs
[MACSEC_SA_ATTR_KEYID
])
1694 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_AN
]) >= MACSEC_NUM_AN
)
1697 if (attrs
[MACSEC_SA_ATTR_PN
] &&
1698 *(u64
*)nla_data(attrs
[MACSEC_SA_ATTR_PN
]) == 0)
1701 if (attrs
[MACSEC_SA_ATTR_ACTIVE
]) {
1702 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_ACTIVE
]) > 1)
1706 if (nla_len(attrs
[MACSEC_SA_ATTR_KEYID
]) != MACSEC_KEYID_LEN
)
1712 static int macsec_add_rxsa(struct sk_buff
*skb
, struct genl_info
*info
)
1714 struct net_device
*dev
;
1715 struct nlattr
**attrs
= info
->attrs
;
1716 struct macsec_secy
*secy
;
1717 struct macsec_rx_sc
*rx_sc
;
1718 struct macsec_rx_sa
*rx_sa
;
1719 unsigned char assoc_num
;
1721 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
1722 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
1725 if (!attrs
[MACSEC_ATTR_IFINDEX
])
1728 if (parse_sa_config(attrs
, tb_sa
))
1731 if (parse_rxsc_config(attrs
, tb_rxsc
))
1734 if (!validate_add_rxsa(tb_sa
))
1738 rx_sc
= get_rxsc_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, &dev
, &secy
);
1739 if (IS_ERR(rx_sc
)) {
1741 return PTR_ERR(rx_sc
);
1744 assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1746 if (nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]) != secy
->key_len
) {
1747 pr_notice("macsec: nl: add_rxsa: bad key length: %d != %d\n",
1748 nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]), secy
->key_len
);
1753 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
1754 if (tb_sa
[MACSEC_SA_ATTR_PN
] &&
1755 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
1756 pr_notice("macsec: nl: add_rxsa: bad pn length: %d != %d\n",
1757 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
1763 if (!tb_sa
[MACSEC_SA_ATTR_SSCI
] || !tb_sa
[MACSEC_SA_ATTR_SALT
]) {
1768 if (nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]) != MACSEC_SALT_LEN
) {
1769 pr_notice("macsec: nl: add_rxsa: bad salt length: %d != %d\n",
1770 nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]),
1777 rx_sa
= rtnl_dereference(rx_sc
->sa
[assoc_num
]);
1783 rx_sa
= kmalloc(sizeof(*rx_sa
), GFP_KERNEL
);
1789 err
= init_rx_sa(rx_sa
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
1790 secy
->key_len
, secy
->icv_len
);
1797 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
1798 spin_lock_bh(&rx_sa
->lock
);
1799 rx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
1800 spin_unlock_bh(&rx_sa
->lock
);
1803 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
1804 rx_sa
->active
= !!nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
1808 /* If h/w offloading is available, propagate to the device */
1809 if (macsec_is_offloaded(netdev_priv(dev
))) {
1810 const struct macsec_ops
*ops
;
1811 struct macsec_context ctx
;
1813 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
1819 ctx
.sa
.assoc_num
= assoc_num
;
1820 ctx
.sa
.rx_sa
= rx_sa
;
1822 memcpy(ctx
.sa
.key
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
1825 err
= macsec_offload(ops
->mdo_add_rxsa
, &ctx
);
1831 rx_sa
->ssci
= nla_get_ssci(tb_sa
[MACSEC_SA_ATTR_SSCI
]);
1832 nla_memcpy(rx_sa
->key
.salt
.bytes
, tb_sa
[MACSEC_SA_ATTR_SALT
],
1836 nla_memcpy(rx_sa
->key
.id
, tb_sa
[MACSEC_SA_ATTR_KEYID
], MACSEC_KEYID_LEN
);
1837 rcu_assign_pointer(rx_sc
->sa
[assoc_num
], rx_sa
);
1849 static bool validate_add_rxsc(struct nlattr
**attrs
)
1851 if (!attrs
[MACSEC_RXSC_ATTR_SCI
])
1854 if (attrs
[MACSEC_RXSC_ATTR_ACTIVE
]) {
1855 if (nla_get_u8(attrs
[MACSEC_RXSC_ATTR_ACTIVE
]) > 1)
1862 static int macsec_add_rxsc(struct sk_buff
*skb
, struct genl_info
*info
)
1864 struct net_device
*dev
;
1865 sci_t sci
= MACSEC_UNDEF_SCI
;
1866 struct nlattr
**attrs
= info
->attrs
;
1867 struct macsec_rx_sc
*rx_sc
;
1868 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
1869 struct macsec_secy
*secy
;
1873 if (!attrs
[MACSEC_ATTR_IFINDEX
])
1876 if (parse_rxsc_config(attrs
, tb_rxsc
))
1879 if (!validate_add_rxsc(tb_rxsc
))
1883 dev
= get_dev_from_nl(genl_info_net(info
), attrs
);
1886 return PTR_ERR(dev
);
1889 secy
= &macsec_priv(dev
)->secy
;
1890 sci
= nla_get_sci(tb_rxsc
[MACSEC_RXSC_ATTR_SCI
]);
1892 rx_sc
= create_rx_sc(dev
, sci
);
1893 if (IS_ERR(rx_sc
)) {
1895 return PTR_ERR(rx_sc
);
1898 was_active
= rx_sc
->active
;
1899 if (tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
])
1900 rx_sc
->active
= !!nla_get_u8(tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
]);
1902 if (macsec_is_offloaded(netdev_priv(dev
))) {
1903 const struct macsec_ops
*ops
;
1904 struct macsec_context ctx
;
1906 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
1915 ret
= macsec_offload(ops
->mdo_add_rxsc
, &ctx
);
1925 rx_sc
->active
= was_active
;
1930 static bool validate_add_txsa(struct nlattr
**attrs
)
1932 if (!attrs
[MACSEC_SA_ATTR_AN
] ||
1933 !attrs
[MACSEC_SA_ATTR_PN
] ||
1934 !attrs
[MACSEC_SA_ATTR_KEY
] ||
1935 !attrs
[MACSEC_SA_ATTR_KEYID
])
1938 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_AN
]) >= MACSEC_NUM_AN
)
1941 if (nla_get_u32(attrs
[MACSEC_SA_ATTR_PN
]) == 0)
1944 if (attrs
[MACSEC_SA_ATTR_ACTIVE
]) {
1945 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_ACTIVE
]) > 1)
1949 if (nla_len(attrs
[MACSEC_SA_ATTR_KEYID
]) != MACSEC_KEYID_LEN
)
1955 static int macsec_add_txsa(struct sk_buff
*skb
, struct genl_info
*info
)
1957 struct net_device
*dev
;
1958 struct nlattr
**attrs
= info
->attrs
;
1959 struct macsec_secy
*secy
;
1960 struct macsec_tx_sc
*tx_sc
;
1961 struct macsec_tx_sa
*tx_sa
;
1962 unsigned char assoc_num
;
1964 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
1965 bool was_operational
;
1968 if (!attrs
[MACSEC_ATTR_IFINDEX
])
1971 if (parse_sa_config(attrs
, tb_sa
))
1974 if (!validate_add_txsa(tb_sa
))
1978 dev
= get_dev_from_nl(genl_info_net(info
), attrs
);
1981 return PTR_ERR(dev
);
1984 secy
= &macsec_priv(dev
)->secy
;
1985 tx_sc
= &secy
->tx_sc
;
1987 assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1989 if (nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]) != secy
->key_len
) {
1990 pr_notice("macsec: nl: add_txsa: bad key length: %d != %d\n",
1991 nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]), secy
->key_len
);
1996 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
1997 if (nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
1998 pr_notice("macsec: nl: add_txsa: bad pn length: %d != %d\n",
1999 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
2005 if (!tb_sa
[MACSEC_SA_ATTR_SSCI
] || !tb_sa
[MACSEC_SA_ATTR_SALT
]) {
2010 if (nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]) != MACSEC_SALT_LEN
) {
2011 pr_notice("macsec: nl: add_txsa: bad salt length: %d != %d\n",
2012 nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]),
2019 tx_sa
= rtnl_dereference(tx_sc
->sa
[assoc_num
]);
2025 tx_sa
= kmalloc(sizeof(*tx_sa
), GFP_KERNEL
);
2031 err
= init_tx_sa(tx_sa
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
2032 secy
->key_len
, secy
->icv_len
);
2039 spin_lock_bh(&tx_sa
->lock
);
2040 tx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
2041 spin_unlock_bh(&tx_sa
->lock
);
2043 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
2044 tx_sa
->active
= !!nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
2046 was_operational
= secy
->operational
;
2047 if (assoc_num
== tx_sc
->encoding_sa
&& tx_sa
->active
)
2048 secy
->operational
= true;
2050 /* If h/w offloading is available, propagate to the device */
2051 if (macsec_is_offloaded(netdev_priv(dev
))) {
2052 const struct macsec_ops
*ops
;
2053 struct macsec_context ctx
;
2055 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2061 ctx
.sa
.assoc_num
= assoc_num
;
2062 ctx
.sa
.tx_sa
= tx_sa
;
2064 memcpy(ctx
.sa
.key
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
2067 err
= macsec_offload(ops
->mdo_add_txsa
, &ctx
);
2073 tx_sa
->ssci
= nla_get_ssci(tb_sa
[MACSEC_SA_ATTR_SSCI
]);
2074 nla_memcpy(tx_sa
->key
.salt
.bytes
, tb_sa
[MACSEC_SA_ATTR_SALT
],
2078 nla_memcpy(tx_sa
->key
.id
, tb_sa
[MACSEC_SA_ATTR_KEYID
], MACSEC_KEYID_LEN
);
2079 rcu_assign_pointer(tx_sc
->sa
[assoc_num
], tx_sa
);
2086 secy
->operational
= was_operational
;
2092 static int macsec_del_rxsa(struct sk_buff
*skb
, struct genl_info
*info
)
2094 struct nlattr
**attrs
= info
->attrs
;
2095 struct net_device
*dev
;
2096 struct macsec_secy
*secy
;
2097 struct macsec_rx_sc
*rx_sc
;
2098 struct macsec_rx_sa
*rx_sa
;
2100 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2101 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2104 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2107 if (parse_sa_config(attrs
, tb_sa
))
2110 if (parse_rxsc_config(attrs
, tb_rxsc
))
2114 rx_sa
= get_rxsa_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, tb_sa
,
2115 &dev
, &secy
, &rx_sc
, &assoc_num
);
2116 if (IS_ERR(rx_sa
)) {
2118 return PTR_ERR(rx_sa
);
2121 if (rx_sa
->active
) {
2126 /* If h/w offloading is available, propagate to the device */
2127 if (macsec_is_offloaded(netdev_priv(dev
))) {
2128 const struct macsec_ops
*ops
;
2129 struct macsec_context ctx
;
2131 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2137 ctx
.sa
.assoc_num
= assoc_num
;
2138 ctx
.sa
.rx_sa
= rx_sa
;
2141 ret
= macsec_offload(ops
->mdo_del_rxsa
, &ctx
);
2146 RCU_INIT_POINTER(rx_sc
->sa
[assoc_num
], NULL
);
2158 static int macsec_del_rxsc(struct sk_buff
*skb
, struct genl_info
*info
)
2160 struct nlattr
**attrs
= info
->attrs
;
2161 struct net_device
*dev
;
2162 struct macsec_secy
*secy
;
2163 struct macsec_rx_sc
*rx_sc
;
2165 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2168 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2171 if (parse_rxsc_config(attrs
, tb_rxsc
))
2174 if (!tb_rxsc
[MACSEC_RXSC_ATTR_SCI
])
2178 dev
= get_dev_from_nl(genl_info_net(info
), info
->attrs
);
2181 return PTR_ERR(dev
);
2184 secy
= &macsec_priv(dev
)->secy
;
2185 sci
= nla_get_sci(tb_rxsc
[MACSEC_RXSC_ATTR_SCI
]);
2187 rx_sc
= del_rx_sc(secy
, sci
);
2193 /* If h/w offloading is available, propagate to the device */
2194 if (macsec_is_offloaded(netdev_priv(dev
))) {
2195 const struct macsec_ops
*ops
;
2196 struct macsec_context ctx
;
2198 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2206 ret
= macsec_offload(ops
->mdo_del_rxsc
, &ctx
);
2221 static int macsec_del_txsa(struct sk_buff
*skb
, struct genl_info
*info
)
2223 struct nlattr
**attrs
= info
->attrs
;
2224 struct net_device
*dev
;
2225 struct macsec_secy
*secy
;
2226 struct macsec_tx_sc
*tx_sc
;
2227 struct macsec_tx_sa
*tx_sa
;
2229 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2232 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2235 if (parse_sa_config(attrs
, tb_sa
))
2239 tx_sa
= get_txsa_from_nl(genl_info_net(info
), attrs
, tb_sa
,
2240 &dev
, &secy
, &tx_sc
, &assoc_num
);
2241 if (IS_ERR(tx_sa
)) {
2243 return PTR_ERR(tx_sa
);
2246 if (tx_sa
->active
) {
2251 /* If h/w offloading is available, propagate to the device */
2252 if (macsec_is_offloaded(netdev_priv(dev
))) {
2253 const struct macsec_ops
*ops
;
2254 struct macsec_context ctx
;
2256 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2262 ctx
.sa
.assoc_num
= assoc_num
;
2263 ctx
.sa
.tx_sa
= tx_sa
;
2266 ret
= macsec_offload(ops
->mdo_del_txsa
, &ctx
);
2271 RCU_INIT_POINTER(tx_sc
->sa
[assoc_num
], NULL
);
2283 static bool validate_upd_sa(struct nlattr
**attrs
)
2285 if (!attrs
[MACSEC_SA_ATTR_AN
] ||
2286 attrs
[MACSEC_SA_ATTR_KEY
] ||
2287 attrs
[MACSEC_SA_ATTR_KEYID
] ||
2288 attrs
[MACSEC_SA_ATTR_SSCI
] ||
2289 attrs
[MACSEC_SA_ATTR_SALT
])
2292 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_AN
]) >= MACSEC_NUM_AN
)
2295 if (attrs
[MACSEC_SA_ATTR_PN
] && nla_get_u32(attrs
[MACSEC_SA_ATTR_PN
]) == 0)
2298 if (attrs
[MACSEC_SA_ATTR_ACTIVE
]) {
2299 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_ACTIVE
]) > 1)
2306 static int macsec_upd_txsa(struct sk_buff
*skb
, struct genl_info
*info
)
2308 struct nlattr
**attrs
= info
->attrs
;
2309 struct net_device
*dev
;
2310 struct macsec_secy
*secy
;
2311 struct macsec_tx_sc
*tx_sc
;
2312 struct macsec_tx_sa
*tx_sa
;
2314 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2315 bool was_operational
, was_active
;
2321 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2324 if (parse_sa_config(attrs
, tb_sa
))
2327 if (!validate_upd_sa(tb_sa
))
2331 tx_sa
= get_txsa_from_nl(genl_info_net(info
), attrs
, tb_sa
,
2332 &dev
, &secy
, &tx_sc
, &assoc_num
);
2333 if (IS_ERR(tx_sa
)) {
2335 return PTR_ERR(tx_sa
);
2338 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2341 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
2342 if (nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
2343 pr_notice("macsec: nl: upd_txsa: bad pn length: %d != %d\n",
2344 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
2349 spin_lock_bh(&tx_sa
->lock
);
2350 prev_pn
= tx_sa
->next_pn_halves
;
2351 tx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
2352 spin_unlock_bh(&tx_sa
->lock
);
2355 was_active
= tx_sa
->active
;
2356 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
2357 tx_sa
->active
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
2359 was_operational
= secy
->operational
;
2360 if (assoc_num
== tx_sc
->encoding_sa
)
2361 secy
->operational
= tx_sa
->active
;
2363 /* If h/w offloading is available, propagate to the device */
2364 if (macsec_is_offloaded(netdev_priv(dev
))) {
2365 const struct macsec_ops
*ops
;
2366 struct macsec_context ctx
;
2368 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2374 ctx
.sa
.assoc_num
= assoc_num
;
2375 ctx
.sa
.tx_sa
= tx_sa
;
2378 ret
= macsec_offload(ops
->mdo_upd_txsa
, &ctx
);
2388 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2389 spin_lock_bh(&tx_sa
->lock
);
2390 tx_sa
->next_pn_halves
= prev_pn
;
2391 spin_unlock_bh(&tx_sa
->lock
);
2393 tx_sa
->active
= was_active
;
2394 secy
->operational
= was_operational
;
2399 static int macsec_upd_rxsa(struct sk_buff
*skb
, struct genl_info
*info
)
2401 struct nlattr
**attrs
= info
->attrs
;
2402 struct net_device
*dev
;
2403 struct macsec_secy
*secy
;
2404 struct macsec_rx_sc
*rx_sc
;
2405 struct macsec_rx_sa
*rx_sa
;
2407 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2408 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2415 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2418 if (parse_rxsc_config(attrs
, tb_rxsc
))
2421 if (parse_sa_config(attrs
, tb_sa
))
2424 if (!validate_upd_sa(tb_sa
))
2428 rx_sa
= get_rxsa_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, tb_sa
,
2429 &dev
, &secy
, &rx_sc
, &assoc_num
);
2430 if (IS_ERR(rx_sa
)) {
2432 return PTR_ERR(rx_sa
);
2435 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2438 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
2439 if (nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
2440 pr_notice("macsec: nl: upd_rxsa: bad pn length: %d != %d\n",
2441 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
2446 spin_lock_bh(&rx_sa
->lock
);
2447 prev_pn
= rx_sa
->next_pn_halves
;
2448 rx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
2449 spin_unlock_bh(&rx_sa
->lock
);
2452 was_active
= rx_sa
->active
;
2453 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
2454 rx_sa
->active
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
2456 /* If h/w offloading is available, propagate to the device */
2457 if (macsec_is_offloaded(netdev_priv(dev
))) {
2458 const struct macsec_ops
*ops
;
2459 struct macsec_context ctx
;
2461 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2467 ctx
.sa
.assoc_num
= assoc_num
;
2468 ctx
.sa
.rx_sa
= rx_sa
;
2471 ret
= macsec_offload(ops
->mdo_upd_rxsa
, &ctx
);
2480 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2481 spin_lock_bh(&rx_sa
->lock
);
2482 rx_sa
->next_pn_halves
= prev_pn
;
2483 spin_unlock_bh(&rx_sa
->lock
);
2485 rx_sa
->active
= was_active
;
2490 static int macsec_upd_rxsc(struct sk_buff
*skb
, struct genl_info
*info
)
2492 struct nlattr
**attrs
= info
->attrs
;
2493 struct net_device
*dev
;
2494 struct macsec_secy
*secy
;
2495 struct macsec_rx_sc
*rx_sc
;
2496 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2497 unsigned int prev_n_rx_sc
;
2501 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2504 if (parse_rxsc_config(attrs
, tb_rxsc
))
2507 if (!validate_add_rxsc(tb_rxsc
))
2511 rx_sc
= get_rxsc_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, &dev
, &secy
);
2512 if (IS_ERR(rx_sc
)) {
2514 return PTR_ERR(rx_sc
);
2517 was_active
= rx_sc
->active
;
2518 prev_n_rx_sc
= secy
->n_rx_sc
;
2519 if (tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
]) {
2520 bool new = !!nla_get_u8(tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
]);
2522 if (rx_sc
->active
!= new)
2523 secy
->n_rx_sc
+= new ? 1 : -1;
2525 rx_sc
->active
= new;
2528 /* If h/w offloading is available, propagate to the device */
2529 if (macsec_is_offloaded(netdev_priv(dev
))) {
2530 const struct macsec_ops
*ops
;
2531 struct macsec_context ctx
;
2533 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2542 ret
= macsec_offload(ops
->mdo_upd_rxsc
, &ctx
);
2552 secy
->n_rx_sc
= prev_n_rx_sc
;
2553 rx_sc
->active
= was_active
;
2558 static bool macsec_is_configured(struct macsec_dev
*macsec
)
2560 struct macsec_secy
*secy
= &macsec
->secy
;
2561 struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
2564 if (secy
->n_rx_sc
> 0)
2567 for (i
= 0; i
< MACSEC_NUM_AN
; i
++)
2574 static int macsec_upd_offload(struct sk_buff
*skb
, struct genl_info
*info
)
2576 struct nlattr
*tb_offload
[MACSEC_OFFLOAD_ATTR_MAX
+ 1];
2577 enum macsec_offload offload
, prev_offload
;
2578 int (*func
)(struct macsec_context
*ctx
);
2579 struct nlattr
**attrs
= info
->attrs
;
2580 struct net_device
*dev
;
2581 const struct macsec_ops
*ops
;
2582 struct macsec_context ctx
;
2583 struct macsec_dev
*macsec
;
2586 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2589 if (!attrs
[MACSEC_ATTR_OFFLOAD
])
2592 if (nla_parse_nested_deprecated(tb_offload
, MACSEC_OFFLOAD_ATTR_MAX
,
2593 attrs
[MACSEC_ATTR_OFFLOAD
],
2594 macsec_genl_offload_policy
, NULL
))
2597 dev
= get_dev_from_nl(genl_info_net(info
), attrs
);
2599 return PTR_ERR(dev
);
2600 macsec
= macsec_priv(dev
);
2602 if (!tb_offload
[MACSEC_OFFLOAD_ATTR_TYPE
])
2605 offload
= nla_get_u8(tb_offload
[MACSEC_OFFLOAD_ATTR_TYPE
]);
2606 if (macsec
->offload
== offload
)
2609 /* Check if the offloading mode is supported by the underlying layers */
2610 if (offload
!= MACSEC_OFFLOAD_OFF
&&
2611 !macsec_check_offload(offload
, macsec
))
2614 /* Check if the net device is busy. */
2615 if (netif_running(dev
))
2620 prev_offload
= macsec
->offload
;
2621 macsec
->offload
= offload
;
2623 /* Check if the device already has rules configured: we do not support
2626 if (macsec_is_configured(macsec
)) {
2631 ops
= __macsec_get_ops(offload
== MACSEC_OFFLOAD_OFF
? prev_offload
: offload
,
2638 if (prev_offload
== MACSEC_OFFLOAD_OFF
)
2639 func
= ops
->mdo_add_secy
;
2641 func
= ops
->mdo_del_secy
;
2643 ctx
.secy
= &macsec
->secy
;
2644 ret
= macsec_offload(func
, &ctx
);
2648 /* Force features update, since they are different for SW MACSec and
2649 * HW offloading cases.
2651 netdev_update_features(dev
);
2657 macsec
->offload
= prev_offload
;
2663 static void get_tx_sa_stats(struct net_device
*dev
, int an
,
2664 struct macsec_tx_sa
*tx_sa
,
2665 struct macsec_tx_sa_stats
*sum
)
2667 struct macsec_dev
*macsec
= macsec_priv(dev
);
2670 /* If h/w offloading is available, propagate to the device */
2671 if (macsec_is_offloaded(macsec
)) {
2672 const struct macsec_ops
*ops
;
2673 struct macsec_context ctx
;
2675 ops
= macsec_get_ops(macsec
, &ctx
);
2677 ctx
.sa
.assoc_num
= an
;
2678 ctx
.sa
.tx_sa
= tx_sa
;
2679 ctx
.stats
.tx_sa_stats
= sum
;
2680 ctx
.secy
= &macsec_priv(dev
)->secy
;
2681 macsec_offload(ops
->mdo_get_tx_sa_stats
, &ctx
);
2686 for_each_possible_cpu(cpu
) {
2687 const struct macsec_tx_sa_stats
*stats
=
2688 per_cpu_ptr(tx_sa
->stats
, cpu
);
2690 sum
->OutPktsProtected
+= stats
->OutPktsProtected
;
2691 sum
->OutPktsEncrypted
+= stats
->OutPktsEncrypted
;
2695 static int copy_tx_sa_stats(struct sk_buff
*skb
, struct macsec_tx_sa_stats
*sum
)
2697 if (nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED
,
2698 sum
->OutPktsProtected
) ||
2699 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED
,
2700 sum
->OutPktsEncrypted
))
2706 static void get_rx_sa_stats(struct net_device
*dev
,
2707 struct macsec_rx_sc
*rx_sc
, int an
,
2708 struct macsec_rx_sa
*rx_sa
,
2709 struct macsec_rx_sa_stats
*sum
)
2711 struct macsec_dev
*macsec
= macsec_priv(dev
);
2714 /* If h/w offloading is available, propagate to the device */
2715 if (macsec_is_offloaded(macsec
)) {
2716 const struct macsec_ops
*ops
;
2717 struct macsec_context ctx
;
2719 ops
= macsec_get_ops(macsec
, &ctx
);
2721 ctx
.sa
.assoc_num
= an
;
2722 ctx
.sa
.rx_sa
= rx_sa
;
2723 ctx
.stats
.rx_sa_stats
= sum
;
2724 ctx
.secy
= &macsec_priv(dev
)->secy
;
2726 macsec_offload(ops
->mdo_get_rx_sa_stats
, &ctx
);
2731 for_each_possible_cpu(cpu
) {
2732 const struct macsec_rx_sa_stats
*stats
=
2733 per_cpu_ptr(rx_sa
->stats
, cpu
);
2735 sum
->InPktsOK
+= stats
->InPktsOK
;
2736 sum
->InPktsInvalid
+= stats
->InPktsInvalid
;
2737 sum
->InPktsNotValid
+= stats
->InPktsNotValid
;
2738 sum
->InPktsNotUsingSA
+= stats
->InPktsNotUsingSA
;
2739 sum
->InPktsUnusedSA
+= stats
->InPktsUnusedSA
;
2743 static int copy_rx_sa_stats(struct sk_buff
*skb
,
2744 struct macsec_rx_sa_stats
*sum
)
2746 if (nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_OK
, sum
->InPktsOK
) ||
2747 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_INVALID
,
2748 sum
->InPktsInvalid
) ||
2749 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_VALID
,
2750 sum
->InPktsNotValid
) ||
2751 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_USING_SA
,
2752 sum
->InPktsNotUsingSA
) ||
2753 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_UNUSED_SA
,
2754 sum
->InPktsUnusedSA
))
2760 static void get_rx_sc_stats(struct net_device
*dev
,
2761 struct macsec_rx_sc
*rx_sc
,
2762 struct macsec_rx_sc_stats
*sum
)
2764 struct macsec_dev
*macsec
= macsec_priv(dev
);
2767 /* If h/w offloading is available, propagate to the device */
2768 if (macsec_is_offloaded(macsec
)) {
2769 const struct macsec_ops
*ops
;
2770 struct macsec_context ctx
;
2772 ops
= macsec_get_ops(macsec
, &ctx
);
2774 ctx
.stats
.rx_sc_stats
= sum
;
2775 ctx
.secy
= &macsec_priv(dev
)->secy
;
2777 macsec_offload(ops
->mdo_get_rx_sc_stats
, &ctx
);
2782 for_each_possible_cpu(cpu
) {
2783 const struct pcpu_rx_sc_stats
*stats
;
2784 struct macsec_rx_sc_stats tmp
;
2787 stats
= per_cpu_ptr(rx_sc
->stats
, cpu
);
2789 start
= u64_stats_fetch_begin_irq(&stats
->syncp
);
2790 memcpy(&tmp
, &stats
->stats
, sizeof(tmp
));
2791 } while (u64_stats_fetch_retry_irq(&stats
->syncp
, start
));
2793 sum
->InOctetsValidated
+= tmp
.InOctetsValidated
;
2794 sum
->InOctetsDecrypted
+= tmp
.InOctetsDecrypted
;
2795 sum
->InPktsUnchecked
+= tmp
.InPktsUnchecked
;
2796 sum
->InPktsDelayed
+= tmp
.InPktsDelayed
;
2797 sum
->InPktsOK
+= tmp
.InPktsOK
;
2798 sum
->InPktsInvalid
+= tmp
.InPktsInvalid
;
2799 sum
->InPktsLate
+= tmp
.InPktsLate
;
2800 sum
->InPktsNotValid
+= tmp
.InPktsNotValid
;
2801 sum
->InPktsNotUsingSA
+= tmp
.InPktsNotUsingSA
;
2802 sum
->InPktsUnusedSA
+= tmp
.InPktsUnusedSA
;
2806 static int copy_rx_sc_stats(struct sk_buff
*skb
, struct macsec_rx_sc_stats
*sum
)
2808 if (nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_OCTETS_VALIDATED
,
2809 sum
->InOctetsValidated
,
2810 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2811 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_OCTETS_DECRYPTED
,
2812 sum
->InOctetsDecrypted
,
2813 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2814 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNCHECKED
,
2815 sum
->InPktsUnchecked
,
2816 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2817 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_DELAYED
,
2819 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2820 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_OK
,
2822 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2823 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_INVALID
,
2825 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2826 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_LATE
,
2828 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2829 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_VALID
,
2830 sum
->InPktsNotValid
,
2831 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2832 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_USING_SA
,
2833 sum
->InPktsNotUsingSA
,
2834 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2835 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNUSED_SA
,
2836 sum
->InPktsUnusedSA
,
2837 MACSEC_RXSC_STATS_ATTR_PAD
))
2843 static void get_tx_sc_stats(struct net_device
*dev
,
2844 struct macsec_tx_sc_stats
*sum
)
2846 struct macsec_dev
*macsec
= macsec_priv(dev
);
2849 /* If h/w offloading is available, propagate to the device */
2850 if (macsec_is_offloaded(macsec
)) {
2851 const struct macsec_ops
*ops
;
2852 struct macsec_context ctx
;
2854 ops
= macsec_get_ops(macsec
, &ctx
);
2856 ctx
.stats
.tx_sc_stats
= sum
;
2857 ctx
.secy
= &macsec_priv(dev
)->secy
;
2858 macsec_offload(ops
->mdo_get_tx_sc_stats
, &ctx
);
2863 for_each_possible_cpu(cpu
) {
2864 const struct pcpu_tx_sc_stats
*stats
;
2865 struct macsec_tx_sc_stats tmp
;
2868 stats
= per_cpu_ptr(macsec_priv(dev
)->secy
.tx_sc
.stats
, cpu
);
2870 start
= u64_stats_fetch_begin_irq(&stats
->syncp
);
2871 memcpy(&tmp
, &stats
->stats
, sizeof(tmp
));
2872 } while (u64_stats_fetch_retry_irq(&stats
->syncp
, start
));
2874 sum
->OutPktsProtected
+= tmp
.OutPktsProtected
;
2875 sum
->OutPktsEncrypted
+= tmp
.OutPktsEncrypted
;
2876 sum
->OutOctetsProtected
+= tmp
.OutOctetsProtected
;
2877 sum
->OutOctetsEncrypted
+= tmp
.OutOctetsEncrypted
;
2881 static int copy_tx_sc_stats(struct sk_buff
*skb
, struct macsec_tx_sc_stats
*sum
)
2883 if (nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_PKTS_PROTECTED
,
2884 sum
->OutPktsProtected
,
2885 MACSEC_TXSC_STATS_ATTR_PAD
) ||
2886 nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_PKTS_ENCRYPTED
,
2887 sum
->OutPktsEncrypted
,
2888 MACSEC_TXSC_STATS_ATTR_PAD
) ||
2889 nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_PROTECTED
,
2890 sum
->OutOctetsProtected
,
2891 MACSEC_TXSC_STATS_ATTR_PAD
) ||
2892 nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_ENCRYPTED
,
2893 sum
->OutOctetsEncrypted
,
2894 MACSEC_TXSC_STATS_ATTR_PAD
))
2900 static void get_secy_stats(struct net_device
*dev
, struct macsec_dev_stats
*sum
)
2902 struct macsec_dev
*macsec
= macsec_priv(dev
);
2905 /* If h/w offloading is available, propagate to the device */
2906 if (macsec_is_offloaded(macsec
)) {
2907 const struct macsec_ops
*ops
;
2908 struct macsec_context ctx
;
2910 ops
= macsec_get_ops(macsec
, &ctx
);
2912 ctx
.stats
.dev_stats
= sum
;
2913 ctx
.secy
= &macsec_priv(dev
)->secy
;
2914 macsec_offload(ops
->mdo_get_dev_stats
, &ctx
);
2919 for_each_possible_cpu(cpu
) {
2920 const struct pcpu_secy_stats
*stats
;
2921 struct macsec_dev_stats tmp
;
2924 stats
= per_cpu_ptr(macsec_priv(dev
)->stats
, cpu
);
2926 start
= u64_stats_fetch_begin_irq(&stats
->syncp
);
2927 memcpy(&tmp
, &stats
->stats
, sizeof(tmp
));
2928 } while (u64_stats_fetch_retry_irq(&stats
->syncp
, start
));
2930 sum
->OutPktsUntagged
+= tmp
.OutPktsUntagged
;
2931 sum
->InPktsUntagged
+= tmp
.InPktsUntagged
;
2932 sum
->OutPktsTooLong
+= tmp
.OutPktsTooLong
;
2933 sum
->InPktsNoTag
+= tmp
.InPktsNoTag
;
2934 sum
->InPktsBadTag
+= tmp
.InPktsBadTag
;
2935 sum
->InPktsUnknownSCI
+= tmp
.InPktsUnknownSCI
;
2936 sum
->InPktsNoSCI
+= tmp
.InPktsNoSCI
;
2937 sum
->InPktsOverrun
+= tmp
.InPktsOverrun
;
2941 static int copy_secy_stats(struct sk_buff
*skb
, struct macsec_dev_stats
*sum
)
2943 if (nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_OUT_PKTS_UNTAGGED
,
2944 sum
->OutPktsUntagged
,
2945 MACSEC_SECY_STATS_ATTR_PAD
) ||
2946 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_UNTAGGED
,
2947 sum
->InPktsUntagged
,
2948 MACSEC_SECY_STATS_ATTR_PAD
) ||
2949 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_OUT_PKTS_TOO_LONG
,
2950 sum
->OutPktsTooLong
,
2951 MACSEC_SECY_STATS_ATTR_PAD
) ||
2952 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_TAG
,
2954 MACSEC_SECY_STATS_ATTR_PAD
) ||
2955 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_BAD_TAG
,
2957 MACSEC_SECY_STATS_ATTR_PAD
) ||
2958 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_UNKNOWN_SCI
,
2959 sum
->InPktsUnknownSCI
,
2960 MACSEC_SECY_STATS_ATTR_PAD
) ||
2961 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_SCI
,
2963 MACSEC_SECY_STATS_ATTR_PAD
) ||
2964 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_OVERRUN
,
2966 MACSEC_SECY_STATS_ATTR_PAD
))
2972 static int nla_put_secy(struct macsec_secy
*secy
, struct sk_buff
*skb
)
2974 struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
2975 struct nlattr
*secy_nest
= nla_nest_start_noflag(skb
,
2982 switch (secy
->key_len
) {
2983 case MACSEC_GCM_AES_128_SAK_LEN
:
2984 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_128
: MACSEC_DEFAULT_CIPHER_ID
;
2986 case MACSEC_GCM_AES_256_SAK_LEN
:
2987 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_256
: MACSEC_CIPHER_ID_GCM_AES_256
;
2993 if (nla_put_sci(skb
, MACSEC_SECY_ATTR_SCI
, secy
->sci
,
2994 MACSEC_SECY_ATTR_PAD
) ||
2995 nla_put_u64_64bit(skb
, MACSEC_SECY_ATTR_CIPHER_SUITE
,
2996 csid
, MACSEC_SECY_ATTR_PAD
) ||
2997 nla_put_u8(skb
, MACSEC_SECY_ATTR_ICV_LEN
, secy
->icv_len
) ||
2998 nla_put_u8(skb
, MACSEC_SECY_ATTR_OPER
, secy
->operational
) ||
2999 nla_put_u8(skb
, MACSEC_SECY_ATTR_PROTECT
, secy
->protect_frames
) ||
3000 nla_put_u8(skb
, MACSEC_SECY_ATTR_REPLAY
, secy
->replay_protect
) ||
3001 nla_put_u8(skb
, MACSEC_SECY_ATTR_VALIDATE
, secy
->validate_frames
) ||
3002 nla_put_u8(skb
, MACSEC_SECY_ATTR_ENCRYPT
, tx_sc
->encrypt
) ||
3003 nla_put_u8(skb
, MACSEC_SECY_ATTR_INC_SCI
, tx_sc
->send_sci
) ||
3004 nla_put_u8(skb
, MACSEC_SECY_ATTR_ES
, tx_sc
->end_station
) ||
3005 nla_put_u8(skb
, MACSEC_SECY_ATTR_SCB
, tx_sc
->scb
) ||
3006 nla_put_u8(skb
, MACSEC_SECY_ATTR_ENCODING_SA
, tx_sc
->encoding_sa
))
3009 if (secy
->replay_protect
) {
3010 if (nla_put_u32(skb
, MACSEC_SECY_ATTR_WINDOW
, secy
->replay_window
))
3014 nla_nest_end(skb
, secy_nest
);
3018 nla_nest_cancel(skb
, secy_nest
);
3022 static noinline_for_stack
int
3023 dump_secy(struct macsec_secy
*secy
, struct net_device
*dev
,
3024 struct sk_buff
*skb
, struct netlink_callback
*cb
)
3026 struct macsec_tx_sc_stats tx_sc_stats
= {0, };
3027 struct macsec_tx_sa_stats tx_sa_stats
= {0, };
3028 struct macsec_rx_sc_stats rx_sc_stats
= {0, };
3029 struct macsec_rx_sa_stats rx_sa_stats
= {0, };
3030 struct macsec_dev
*macsec
= netdev_priv(dev
);
3031 struct macsec_dev_stats dev_stats
= {0, };
3032 struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
3033 struct nlattr
*txsa_list
, *rxsc_list
;
3034 struct macsec_rx_sc
*rx_sc
;
3035 struct nlattr
*attr
;
3039 hdr
= genlmsg_put(skb
, NETLINK_CB(cb
->skb
).portid
, cb
->nlh
->nlmsg_seq
,
3040 &macsec_fam
, NLM_F_MULTI
, MACSEC_CMD_GET_TXSC
);
3044 genl_dump_check_consistent(cb
, hdr
);
3046 if (nla_put_u32(skb
, MACSEC_ATTR_IFINDEX
, dev
->ifindex
))
3047 goto nla_put_failure
;
3049 attr
= nla_nest_start_noflag(skb
, MACSEC_ATTR_OFFLOAD
);
3051 goto nla_put_failure
;
3052 if (nla_put_u8(skb
, MACSEC_OFFLOAD_ATTR_TYPE
, macsec
->offload
))
3053 goto nla_put_failure
;
3054 nla_nest_end(skb
, attr
);
3056 if (nla_put_secy(secy
, skb
))
3057 goto nla_put_failure
;
3059 attr
= nla_nest_start_noflag(skb
, MACSEC_ATTR_TXSC_STATS
);
3061 goto nla_put_failure
;
3063 get_tx_sc_stats(dev
, &tx_sc_stats
);
3064 if (copy_tx_sc_stats(skb
, &tx_sc_stats
)) {
3065 nla_nest_cancel(skb
, attr
);
3066 goto nla_put_failure
;
3068 nla_nest_end(skb
, attr
);
3070 attr
= nla_nest_start_noflag(skb
, MACSEC_ATTR_SECY_STATS
);
3072 goto nla_put_failure
;
3073 get_secy_stats(dev
, &dev_stats
);
3074 if (copy_secy_stats(skb
, &dev_stats
)) {
3075 nla_nest_cancel(skb
, attr
);
3076 goto nla_put_failure
;
3078 nla_nest_end(skb
, attr
);
3080 txsa_list
= nla_nest_start_noflag(skb
, MACSEC_ATTR_TXSA_LIST
);
3082 goto nla_put_failure
;
3083 for (i
= 0, j
= 1; i
< MACSEC_NUM_AN
; i
++) {
3084 struct macsec_tx_sa
*tx_sa
= rtnl_dereference(tx_sc
->sa
[i
]);
3085 struct nlattr
*txsa_nest
;
3092 txsa_nest
= nla_nest_start_noflag(skb
, j
++);
3094 nla_nest_cancel(skb
, txsa_list
);
3095 goto nla_put_failure
;
3098 attr
= nla_nest_start_noflag(skb
, MACSEC_SA_ATTR_STATS
);
3100 nla_nest_cancel(skb
, txsa_nest
);
3101 nla_nest_cancel(skb
, txsa_list
);
3102 goto nla_put_failure
;
3104 memset(&tx_sa_stats
, 0, sizeof(tx_sa_stats
));
3105 get_tx_sa_stats(dev
, i
, tx_sa
, &tx_sa_stats
);
3106 if (copy_tx_sa_stats(skb
, &tx_sa_stats
)) {
3107 nla_nest_cancel(skb
, attr
);
3108 nla_nest_cancel(skb
, txsa_nest
);
3109 nla_nest_cancel(skb
, txsa_list
);
3110 goto nla_put_failure
;
3112 nla_nest_end(skb
, attr
);
3115 pn
= tx_sa
->next_pn
;
3116 pn_len
= MACSEC_XPN_PN_LEN
;
3118 pn
= tx_sa
->next_pn_halves
.lower
;
3119 pn_len
= MACSEC_DEFAULT_PN_LEN
;
3122 if (nla_put_u8(skb
, MACSEC_SA_ATTR_AN
, i
) ||
3123 nla_put(skb
, MACSEC_SA_ATTR_PN
, pn_len
, &pn
) ||
3124 nla_put(skb
, MACSEC_SA_ATTR_KEYID
, MACSEC_KEYID_LEN
, tx_sa
->key
.id
) ||
3125 (secy
->xpn
&& nla_put_ssci(skb
, MACSEC_SA_ATTR_SSCI
, tx_sa
->ssci
)) ||
3126 nla_put_u8(skb
, MACSEC_SA_ATTR_ACTIVE
, tx_sa
->active
)) {
3127 nla_nest_cancel(skb
, txsa_nest
);
3128 nla_nest_cancel(skb
, txsa_list
);
3129 goto nla_put_failure
;
3132 nla_nest_end(skb
, txsa_nest
);
3134 nla_nest_end(skb
, txsa_list
);
3136 rxsc_list
= nla_nest_start_noflag(skb
, MACSEC_ATTR_RXSC_LIST
);
3138 goto nla_put_failure
;
3141 for_each_rxsc_rtnl(secy
, rx_sc
) {
3143 struct nlattr
*rxsa_list
;
3144 struct nlattr
*rxsc_nest
= nla_nest_start_noflag(skb
, j
++);
3147 nla_nest_cancel(skb
, rxsc_list
);
3148 goto nla_put_failure
;
3151 if (nla_put_u8(skb
, MACSEC_RXSC_ATTR_ACTIVE
, rx_sc
->active
) ||
3152 nla_put_sci(skb
, MACSEC_RXSC_ATTR_SCI
, rx_sc
->sci
,
3153 MACSEC_RXSC_ATTR_PAD
)) {
3154 nla_nest_cancel(skb
, rxsc_nest
);
3155 nla_nest_cancel(skb
, rxsc_list
);
3156 goto nla_put_failure
;
3159 attr
= nla_nest_start_noflag(skb
, MACSEC_RXSC_ATTR_STATS
);
3161 nla_nest_cancel(skb
, rxsc_nest
);
3162 nla_nest_cancel(skb
, rxsc_list
);
3163 goto nla_put_failure
;
3165 memset(&rx_sc_stats
, 0, sizeof(rx_sc_stats
));
3166 get_rx_sc_stats(dev
, rx_sc
, &rx_sc_stats
);
3167 if (copy_rx_sc_stats(skb
, &rx_sc_stats
)) {
3168 nla_nest_cancel(skb
, attr
);
3169 nla_nest_cancel(skb
, rxsc_nest
);
3170 nla_nest_cancel(skb
, rxsc_list
);
3171 goto nla_put_failure
;
3173 nla_nest_end(skb
, attr
);
3175 rxsa_list
= nla_nest_start_noflag(skb
,
3176 MACSEC_RXSC_ATTR_SA_LIST
);
3178 nla_nest_cancel(skb
, rxsc_nest
);
3179 nla_nest_cancel(skb
, rxsc_list
);
3180 goto nla_put_failure
;
3183 for (i
= 0, k
= 1; i
< MACSEC_NUM_AN
; i
++) {
3184 struct macsec_rx_sa
*rx_sa
= rtnl_dereference(rx_sc
->sa
[i
]);
3185 struct nlattr
*rxsa_nest
;
3192 rxsa_nest
= nla_nest_start_noflag(skb
, k
++);
3194 nla_nest_cancel(skb
, rxsa_list
);
3195 nla_nest_cancel(skb
, rxsc_nest
);
3196 nla_nest_cancel(skb
, rxsc_list
);
3197 goto nla_put_failure
;
3200 attr
= nla_nest_start_noflag(skb
,
3201 MACSEC_SA_ATTR_STATS
);
3203 nla_nest_cancel(skb
, rxsa_list
);
3204 nla_nest_cancel(skb
, rxsc_nest
);
3205 nla_nest_cancel(skb
, rxsc_list
);
3206 goto nla_put_failure
;
3208 memset(&rx_sa_stats
, 0, sizeof(rx_sa_stats
));
3209 get_rx_sa_stats(dev
, rx_sc
, i
, rx_sa
, &rx_sa_stats
);
3210 if (copy_rx_sa_stats(skb
, &rx_sa_stats
)) {
3211 nla_nest_cancel(skb
, attr
);
3212 nla_nest_cancel(skb
, rxsa_list
);
3213 nla_nest_cancel(skb
, rxsc_nest
);
3214 nla_nest_cancel(skb
, rxsc_list
);
3215 goto nla_put_failure
;
3217 nla_nest_end(skb
, attr
);
3220 pn
= rx_sa
->next_pn
;
3221 pn_len
= MACSEC_XPN_PN_LEN
;
3223 pn
= rx_sa
->next_pn_halves
.lower
;
3224 pn_len
= MACSEC_DEFAULT_PN_LEN
;
3227 if (nla_put_u8(skb
, MACSEC_SA_ATTR_AN
, i
) ||
3228 nla_put(skb
, MACSEC_SA_ATTR_PN
, pn_len
, &pn
) ||
3229 nla_put(skb
, MACSEC_SA_ATTR_KEYID
, MACSEC_KEYID_LEN
, rx_sa
->key
.id
) ||
3230 (secy
->xpn
&& nla_put_ssci(skb
, MACSEC_SA_ATTR_SSCI
, rx_sa
->ssci
)) ||
3231 nla_put_u8(skb
, MACSEC_SA_ATTR_ACTIVE
, rx_sa
->active
)) {
3232 nla_nest_cancel(skb
, rxsa_nest
);
3233 nla_nest_cancel(skb
, rxsc_nest
);
3234 nla_nest_cancel(skb
, rxsc_list
);
3235 goto nla_put_failure
;
3237 nla_nest_end(skb
, rxsa_nest
);
3240 nla_nest_end(skb
, rxsa_list
);
3241 nla_nest_end(skb
, rxsc_nest
);
3244 nla_nest_end(skb
, rxsc_list
);
3246 genlmsg_end(skb
, hdr
);
3251 genlmsg_cancel(skb
, hdr
);
3255 static int macsec_generation
= 1; /* protected by RTNL */
3257 static int macsec_dump_txsc(struct sk_buff
*skb
, struct netlink_callback
*cb
)
3259 struct net
*net
= sock_net(skb
->sk
);
3260 struct net_device
*dev
;
3263 dev_idx
= cb
->args
[0];
3268 cb
->seq
= macsec_generation
;
3270 for_each_netdev(net
, dev
) {
3271 struct macsec_secy
*secy
;
3276 if (!netif_is_macsec(dev
))
3279 secy
= &macsec_priv(dev
)->secy
;
3280 if (dump_secy(secy
, dev
, skb
, cb
) < 0)
3292 static const struct genl_small_ops macsec_genl_ops
[] = {
3294 .cmd
= MACSEC_CMD_GET_TXSC
,
3295 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3296 .dumpit
= macsec_dump_txsc
,
3299 .cmd
= MACSEC_CMD_ADD_RXSC
,
3300 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3301 .doit
= macsec_add_rxsc
,
3302 .flags
= GENL_ADMIN_PERM
,
3305 .cmd
= MACSEC_CMD_DEL_RXSC
,
3306 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3307 .doit
= macsec_del_rxsc
,
3308 .flags
= GENL_ADMIN_PERM
,
3311 .cmd
= MACSEC_CMD_UPD_RXSC
,
3312 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3313 .doit
= macsec_upd_rxsc
,
3314 .flags
= GENL_ADMIN_PERM
,
3317 .cmd
= MACSEC_CMD_ADD_TXSA
,
3318 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3319 .doit
= macsec_add_txsa
,
3320 .flags
= GENL_ADMIN_PERM
,
3323 .cmd
= MACSEC_CMD_DEL_TXSA
,
3324 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3325 .doit
= macsec_del_txsa
,
3326 .flags
= GENL_ADMIN_PERM
,
3329 .cmd
= MACSEC_CMD_UPD_TXSA
,
3330 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3331 .doit
= macsec_upd_txsa
,
3332 .flags
= GENL_ADMIN_PERM
,
3335 .cmd
= MACSEC_CMD_ADD_RXSA
,
3336 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3337 .doit
= macsec_add_rxsa
,
3338 .flags
= GENL_ADMIN_PERM
,
3341 .cmd
= MACSEC_CMD_DEL_RXSA
,
3342 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3343 .doit
= macsec_del_rxsa
,
3344 .flags
= GENL_ADMIN_PERM
,
3347 .cmd
= MACSEC_CMD_UPD_RXSA
,
3348 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3349 .doit
= macsec_upd_rxsa
,
3350 .flags
= GENL_ADMIN_PERM
,
3353 .cmd
= MACSEC_CMD_UPD_OFFLOAD
,
3354 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3355 .doit
= macsec_upd_offload
,
3356 .flags
= GENL_ADMIN_PERM
,
3360 static struct genl_family macsec_fam __ro_after_init
= {
3361 .name
= MACSEC_GENL_NAME
,
3363 .version
= MACSEC_GENL_VERSION
,
3364 .maxattr
= MACSEC_ATTR_MAX
,
3365 .policy
= macsec_genl_policy
,
3367 .module
= THIS_MODULE
,
3368 .small_ops
= macsec_genl_ops
,
3369 .n_small_ops
= ARRAY_SIZE(macsec_genl_ops
),
3372 static netdev_tx_t
macsec_start_xmit(struct sk_buff
*skb
,
3373 struct net_device
*dev
)
3375 struct macsec_dev
*macsec
= netdev_priv(dev
);
3376 struct macsec_secy
*secy
= &macsec
->secy
;
3377 struct pcpu_secy_stats
*secy_stats
;
3380 if (macsec_is_offloaded(netdev_priv(dev
))) {
3381 skb
->dev
= macsec
->real_dev
;
3382 return dev_queue_xmit(skb
);
3386 if (!secy
->protect_frames
) {
3387 secy_stats
= this_cpu_ptr(macsec
->stats
);
3388 u64_stats_update_begin(&secy_stats
->syncp
);
3389 secy_stats
->stats
.OutPktsUntagged
++;
3390 u64_stats_update_end(&secy_stats
->syncp
);
3391 skb
->dev
= macsec
->real_dev
;
3393 ret
= dev_queue_xmit(skb
);
3394 count_tx(dev
, ret
, len
);
3398 if (!secy
->operational
) {
3400 dev
->stats
.tx_dropped
++;
3401 return NETDEV_TX_OK
;
3404 skb
= macsec_encrypt(skb
, dev
);
3406 if (PTR_ERR(skb
) != -EINPROGRESS
)
3407 dev
->stats
.tx_dropped
++;
3408 return NETDEV_TX_OK
;
3411 macsec_count_tx(skb
, &macsec
->secy
.tx_sc
, macsec_skb_cb(skb
)->tx_sa
);
3413 macsec_encrypt_finish(skb
, dev
);
3415 ret
= dev_queue_xmit(skb
);
3416 count_tx(dev
, ret
, len
);
3420 #define SW_MACSEC_FEATURES \
3421 (NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST)
3423 /* If h/w offloading is enabled, use real device features save for
3424 * VLAN_FEATURES - they require additional ops
3425 * HW_MACSEC - no reason to report it
3427 #define REAL_DEV_FEATURES(dev) \
3428 ((dev)->features & ~(NETIF_F_VLAN_FEATURES | NETIF_F_HW_MACSEC))
3430 static int macsec_dev_init(struct net_device
*dev
)
3432 struct macsec_dev
*macsec
= macsec_priv(dev
);
3433 struct net_device
*real_dev
= macsec
->real_dev
;
3436 dev
->tstats
= netdev_alloc_pcpu_stats(struct pcpu_sw_netstats
);
3440 err
= gro_cells_init(&macsec
->gro_cells
, dev
);
3442 free_percpu(dev
->tstats
);
3446 if (macsec_is_offloaded(macsec
)) {
3447 dev
->features
= REAL_DEV_FEATURES(real_dev
);
3449 dev
->features
= real_dev
->features
& SW_MACSEC_FEATURES
;
3450 dev
->features
|= NETIF_F_LLTX
| NETIF_F_GSO_SOFTWARE
;
3453 dev
->needed_headroom
= real_dev
->needed_headroom
+
3454 MACSEC_NEEDED_HEADROOM
;
3455 dev
->needed_tailroom
= real_dev
->needed_tailroom
+
3456 MACSEC_NEEDED_TAILROOM
;
3458 if (is_zero_ether_addr(dev
->dev_addr
))
3459 eth_hw_addr_inherit(dev
, real_dev
);
3460 if (is_zero_ether_addr(dev
->broadcast
))
3461 memcpy(dev
->broadcast
, real_dev
->broadcast
, dev
->addr_len
);
3466 static void macsec_dev_uninit(struct net_device
*dev
)
3468 struct macsec_dev
*macsec
= macsec_priv(dev
);
3470 gro_cells_destroy(&macsec
->gro_cells
);
3471 free_percpu(dev
->tstats
);
3474 static netdev_features_t
macsec_fix_features(struct net_device
*dev
,
3475 netdev_features_t features
)
3477 struct macsec_dev
*macsec
= macsec_priv(dev
);
3478 struct net_device
*real_dev
= macsec
->real_dev
;
3480 if (macsec_is_offloaded(macsec
))
3481 return REAL_DEV_FEATURES(real_dev
);
3483 features
&= (real_dev
->features
& SW_MACSEC_FEATURES
) |
3484 NETIF_F_GSO_SOFTWARE
| NETIF_F_SOFT_FEATURES
;
3485 features
|= NETIF_F_LLTX
;
3490 static int macsec_dev_open(struct net_device
*dev
)
3492 struct macsec_dev
*macsec
= macsec_priv(dev
);
3493 struct net_device
*real_dev
= macsec
->real_dev
;
3496 err
= dev_uc_add(real_dev
, dev
->dev_addr
);
3500 if (dev
->flags
& IFF_ALLMULTI
) {
3501 err
= dev_set_allmulti(real_dev
, 1);
3506 if (dev
->flags
& IFF_PROMISC
) {
3507 err
= dev_set_promiscuity(real_dev
, 1);
3509 goto clear_allmulti
;
3512 /* If h/w offloading is available, propagate to the device */
3513 if (macsec_is_offloaded(macsec
)) {
3514 const struct macsec_ops
*ops
;
3515 struct macsec_context ctx
;
3517 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
3520 goto clear_allmulti
;
3523 ctx
.secy
= &macsec
->secy
;
3524 err
= macsec_offload(ops
->mdo_dev_open
, &ctx
);
3526 goto clear_allmulti
;
3529 if (netif_carrier_ok(real_dev
))
3530 netif_carrier_on(dev
);
3534 if (dev
->flags
& IFF_ALLMULTI
)
3535 dev_set_allmulti(real_dev
, -1);
3537 dev_uc_del(real_dev
, dev
->dev_addr
);
3538 netif_carrier_off(dev
);
3542 static int macsec_dev_stop(struct net_device
*dev
)
3544 struct macsec_dev
*macsec
= macsec_priv(dev
);
3545 struct net_device
*real_dev
= macsec
->real_dev
;
3547 netif_carrier_off(dev
);
3549 /* If h/w offloading is available, propagate to the device */
3550 if (macsec_is_offloaded(macsec
)) {
3551 const struct macsec_ops
*ops
;
3552 struct macsec_context ctx
;
3554 ops
= macsec_get_ops(macsec
, &ctx
);
3556 ctx
.secy
= &macsec
->secy
;
3557 macsec_offload(ops
->mdo_dev_stop
, &ctx
);
3561 dev_mc_unsync(real_dev
, dev
);
3562 dev_uc_unsync(real_dev
, dev
);
3564 if (dev
->flags
& IFF_ALLMULTI
)
3565 dev_set_allmulti(real_dev
, -1);
3567 if (dev
->flags
& IFF_PROMISC
)
3568 dev_set_promiscuity(real_dev
, -1);
3570 dev_uc_del(real_dev
, dev
->dev_addr
);
3575 static void macsec_dev_change_rx_flags(struct net_device
*dev
, int change
)
3577 struct net_device
*real_dev
= macsec_priv(dev
)->real_dev
;
3579 if (!(dev
->flags
& IFF_UP
))
3582 if (change
& IFF_ALLMULTI
)
3583 dev_set_allmulti(real_dev
, dev
->flags
& IFF_ALLMULTI
? 1 : -1);
3585 if (change
& IFF_PROMISC
)
3586 dev_set_promiscuity(real_dev
,
3587 dev
->flags
& IFF_PROMISC
? 1 : -1);
3590 static void macsec_dev_set_rx_mode(struct net_device
*dev
)
3592 struct net_device
*real_dev
= macsec_priv(dev
)->real_dev
;
3594 dev_mc_sync(real_dev
, dev
);
3595 dev_uc_sync(real_dev
, dev
);
3598 static int macsec_set_mac_address(struct net_device
*dev
, void *p
)
3600 struct macsec_dev
*macsec
= macsec_priv(dev
);
3601 struct net_device
*real_dev
= macsec
->real_dev
;
3602 struct sockaddr
*addr
= p
;
3605 if (!is_valid_ether_addr(addr
->sa_data
))
3606 return -EADDRNOTAVAIL
;
3608 if (!(dev
->flags
& IFF_UP
))
3611 err
= dev_uc_add(real_dev
, addr
->sa_data
);
3615 dev_uc_del(real_dev
, dev
->dev_addr
);
3618 ether_addr_copy(dev
->dev_addr
, addr
->sa_data
);
3619 macsec
->secy
.sci
= dev_to_sci(dev
, MACSEC_PORT_ES
);
3621 /* If h/w offloading is available, propagate to the device */
3622 if (macsec_is_offloaded(macsec
)) {
3623 const struct macsec_ops
*ops
;
3624 struct macsec_context ctx
;
3626 ops
= macsec_get_ops(macsec
, &ctx
);
3628 ctx
.secy
= &macsec
->secy
;
3629 macsec_offload(ops
->mdo_upd_secy
, &ctx
);
3636 static int macsec_change_mtu(struct net_device
*dev
, int new_mtu
)
3638 struct macsec_dev
*macsec
= macsec_priv(dev
);
3639 unsigned int extra
= macsec
->secy
.icv_len
+ macsec_extra_len(true);
3641 if (macsec
->real_dev
->mtu
- extra
< new_mtu
)
3649 static void macsec_get_stats64(struct net_device
*dev
,
3650 struct rtnl_link_stats64
*s
)
3655 dev_fetch_sw_netstats(s
, dev
->tstats
);
3657 s
->rx_dropped
= dev
->stats
.rx_dropped
;
3658 s
->tx_dropped
= dev
->stats
.tx_dropped
;
3661 static int macsec_get_iflink(const struct net_device
*dev
)
3663 return macsec_priv(dev
)->real_dev
->ifindex
;
3666 static const struct net_device_ops macsec_netdev_ops
= {
3667 .ndo_init
= macsec_dev_init
,
3668 .ndo_uninit
= macsec_dev_uninit
,
3669 .ndo_open
= macsec_dev_open
,
3670 .ndo_stop
= macsec_dev_stop
,
3671 .ndo_fix_features
= macsec_fix_features
,
3672 .ndo_change_mtu
= macsec_change_mtu
,
3673 .ndo_set_rx_mode
= macsec_dev_set_rx_mode
,
3674 .ndo_change_rx_flags
= macsec_dev_change_rx_flags
,
3675 .ndo_set_mac_address
= macsec_set_mac_address
,
3676 .ndo_start_xmit
= macsec_start_xmit
,
3677 .ndo_get_stats64
= macsec_get_stats64
,
3678 .ndo_get_iflink
= macsec_get_iflink
,
3681 static const struct device_type macsec_type
= {
3685 static const struct nla_policy macsec_rtnl_policy
[IFLA_MACSEC_MAX
+ 1] = {
3686 [IFLA_MACSEC_SCI
] = { .type
= NLA_U64
},
3687 [IFLA_MACSEC_PORT
] = { .type
= NLA_U16
},
3688 [IFLA_MACSEC_ICV_LEN
] = { .type
= NLA_U8
},
3689 [IFLA_MACSEC_CIPHER_SUITE
] = { .type
= NLA_U64
},
3690 [IFLA_MACSEC_WINDOW
] = { .type
= NLA_U32
},
3691 [IFLA_MACSEC_ENCODING_SA
] = { .type
= NLA_U8
},
3692 [IFLA_MACSEC_ENCRYPT
] = { .type
= NLA_U8
},
3693 [IFLA_MACSEC_PROTECT
] = { .type
= NLA_U8
},
3694 [IFLA_MACSEC_INC_SCI
] = { .type
= NLA_U8
},
3695 [IFLA_MACSEC_ES
] = { .type
= NLA_U8
},
3696 [IFLA_MACSEC_SCB
] = { .type
= NLA_U8
},
3697 [IFLA_MACSEC_REPLAY_PROTECT
] = { .type
= NLA_U8
},
3698 [IFLA_MACSEC_VALIDATION
] = { .type
= NLA_U8
},
3701 static void macsec_free_netdev(struct net_device
*dev
)
3703 struct macsec_dev
*macsec
= macsec_priv(dev
);
3705 free_percpu(macsec
->stats
);
3706 free_percpu(macsec
->secy
.tx_sc
.stats
);
3710 static void macsec_setup(struct net_device
*dev
)
3714 dev
->max_mtu
= ETH_MAX_MTU
;
3715 dev
->priv_flags
|= IFF_NO_QUEUE
;
3716 dev
->netdev_ops
= &macsec_netdev_ops
;
3717 dev
->needs_free_netdev
= true;
3718 dev
->priv_destructor
= macsec_free_netdev
;
3719 SET_NETDEV_DEVTYPE(dev
, &macsec_type
);
3721 eth_zero_addr(dev
->broadcast
);
3724 static int macsec_changelink_common(struct net_device
*dev
,
3725 struct nlattr
*data
[])
3727 struct macsec_secy
*secy
;
3728 struct macsec_tx_sc
*tx_sc
;
3730 secy
= &macsec_priv(dev
)->secy
;
3731 tx_sc
= &secy
->tx_sc
;
3733 if (data
[IFLA_MACSEC_ENCODING_SA
]) {
3734 struct macsec_tx_sa
*tx_sa
;
3736 tx_sc
->encoding_sa
= nla_get_u8(data
[IFLA_MACSEC_ENCODING_SA
]);
3737 tx_sa
= rtnl_dereference(tx_sc
->sa
[tx_sc
->encoding_sa
]);
3739 secy
->operational
= tx_sa
&& tx_sa
->active
;
3742 if (data
[IFLA_MACSEC_WINDOW
])
3743 secy
->replay_window
= nla_get_u32(data
[IFLA_MACSEC_WINDOW
]);
3745 if (data
[IFLA_MACSEC_ENCRYPT
])
3746 tx_sc
->encrypt
= !!nla_get_u8(data
[IFLA_MACSEC_ENCRYPT
]);
3748 if (data
[IFLA_MACSEC_PROTECT
])
3749 secy
->protect_frames
= !!nla_get_u8(data
[IFLA_MACSEC_PROTECT
]);
3751 if (data
[IFLA_MACSEC_INC_SCI
])
3752 tx_sc
->send_sci
= !!nla_get_u8(data
[IFLA_MACSEC_INC_SCI
]);
3754 if (data
[IFLA_MACSEC_ES
])
3755 tx_sc
->end_station
= !!nla_get_u8(data
[IFLA_MACSEC_ES
]);
3757 if (data
[IFLA_MACSEC_SCB
])
3758 tx_sc
->scb
= !!nla_get_u8(data
[IFLA_MACSEC_SCB
]);
3760 if (data
[IFLA_MACSEC_REPLAY_PROTECT
])
3761 secy
->replay_protect
= !!nla_get_u8(data
[IFLA_MACSEC_REPLAY_PROTECT
]);
3763 if (data
[IFLA_MACSEC_VALIDATION
])
3764 secy
->validate_frames
= nla_get_u8(data
[IFLA_MACSEC_VALIDATION
]);
3766 if (data
[IFLA_MACSEC_CIPHER_SUITE
]) {
3767 switch (nla_get_u64(data
[IFLA_MACSEC_CIPHER_SUITE
])) {
3768 case MACSEC_CIPHER_ID_GCM_AES_128
:
3769 case MACSEC_DEFAULT_CIPHER_ID
:
3770 secy
->key_len
= MACSEC_GCM_AES_128_SAK_LEN
;
3773 case MACSEC_CIPHER_ID_GCM_AES_256
:
3774 secy
->key_len
= MACSEC_GCM_AES_256_SAK_LEN
;
3777 case MACSEC_CIPHER_ID_GCM_AES_XPN_128
:
3778 secy
->key_len
= MACSEC_GCM_AES_128_SAK_LEN
;
3781 case MACSEC_CIPHER_ID_GCM_AES_XPN_256
:
3782 secy
->key_len
= MACSEC_GCM_AES_256_SAK_LEN
;
3793 static int macsec_changelink(struct net_device
*dev
, struct nlattr
*tb
[],
3794 struct nlattr
*data
[],
3795 struct netlink_ext_ack
*extack
)
3797 struct macsec_dev
*macsec
= macsec_priv(dev
);
3798 struct macsec_tx_sc tx_sc
;
3799 struct macsec_secy secy
;
3805 if (data
[IFLA_MACSEC_CIPHER_SUITE
] ||
3806 data
[IFLA_MACSEC_ICV_LEN
] ||
3807 data
[IFLA_MACSEC_SCI
] ||
3808 data
[IFLA_MACSEC_PORT
])
3811 /* Keep a copy of unmodified secy and tx_sc, in case the offload
3812 * propagation fails, to revert macsec_changelink_common.
3814 memcpy(&secy
, &macsec
->secy
, sizeof(secy
));
3815 memcpy(&tx_sc
, &macsec
->secy
.tx_sc
, sizeof(tx_sc
));
3817 ret
= macsec_changelink_common(dev
, data
);
3821 /* If h/w offloading is available, propagate to the device */
3822 if (macsec_is_offloaded(macsec
)) {
3823 const struct macsec_ops
*ops
;
3824 struct macsec_context ctx
;
3827 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
3833 ctx
.secy
= &macsec
->secy
;
3834 ret
= macsec_offload(ops
->mdo_upd_secy
, &ctx
);
3842 memcpy(&macsec
->secy
.tx_sc
, &tx_sc
, sizeof(tx_sc
));
3843 memcpy(&macsec
->secy
, &secy
, sizeof(secy
));
3848 static void macsec_del_dev(struct macsec_dev
*macsec
)
3852 while (macsec
->secy
.rx_sc
) {
3853 struct macsec_rx_sc
*rx_sc
= rtnl_dereference(macsec
->secy
.rx_sc
);
3855 rcu_assign_pointer(macsec
->secy
.rx_sc
, rx_sc
->next
);
3859 for (i
= 0; i
< MACSEC_NUM_AN
; i
++) {
3860 struct macsec_tx_sa
*sa
= rtnl_dereference(macsec
->secy
.tx_sc
.sa
[i
]);
3863 RCU_INIT_POINTER(macsec
->secy
.tx_sc
.sa
[i
], NULL
);
3869 static void macsec_common_dellink(struct net_device
*dev
, struct list_head
*head
)
3871 struct macsec_dev
*macsec
= macsec_priv(dev
);
3872 struct net_device
*real_dev
= macsec
->real_dev
;
3874 /* If h/w offloading is available, propagate to the device */
3875 if (macsec_is_offloaded(macsec
)) {
3876 const struct macsec_ops
*ops
;
3877 struct macsec_context ctx
;
3879 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
3881 ctx
.secy
= &macsec
->secy
;
3882 macsec_offload(ops
->mdo_del_secy
, &ctx
);
3886 unregister_netdevice_queue(dev
, head
);
3887 list_del_rcu(&macsec
->secys
);
3888 macsec_del_dev(macsec
);
3889 netdev_upper_dev_unlink(real_dev
, dev
);
3891 macsec_generation
++;
3894 static void macsec_dellink(struct net_device
*dev
, struct list_head
*head
)
3896 struct macsec_dev
*macsec
= macsec_priv(dev
);
3897 struct net_device
*real_dev
= macsec
->real_dev
;
3898 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(real_dev
);
3900 macsec_common_dellink(dev
, head
);
3902 if (list_empty(&rxd
->secys
)) {
3903 netdev_rx_handler_unregister(real_dev
);
3908 static int register_macsec_dev(struct net_device
*real_dev
,
3909 struct net_device
*dev
)
3911 struct macsec_dev
*macsec
= macsec_priv(dev
);
3912 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(real_dev
);
3917 rxd
= kmalloc(sizeof(*rxd
), GFP_KERNEL
);
3921 INIT_LIST_HEAD(&rxd
->secys
);
3923 err
= netdev_rx_handler_register(real_dev
, macsec_handle_frame
,
3931 list_add_tail_rcu(&macsec
->secys
, &rxd
->secys
);
3935 static bool sci_exists(struct net_device
*dev
, sci_t sci
)
3937 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(dev
);
3938 struct macsec_dev
*macsec
;
3940 list_for_each_entry(macsec
, &rxd
->secys
, secys
) {
3941 if (macsec
->secy
.sci
== sci
)
3948 static int macsec_add_dev(struct net_device
*dev
, sci_t sci
, u8 icv_len
)
3950 struct macsec_dev
*macsec
= macsec_priv(dev
);
3951 struct macsec_secy
*secy
= &macsec
->secy
;
3953 macsec
->stats
= netdev_alloc_pcpu_stats(struct pcpu_secy_stats
);
3957 secy
->tx_sc
.stats
= netdev_alloc_pcpu_stats(struct pcpu_tx_sc_stats
);
3958 if (!secy
->tx_sc
.stats
) {
3959 free_percpu(macsec
->stats
);
3963 if (sci
== MACSEC_UNDEF_SCI
)
3964 sci
= dev_to_sci(dev
, MACSEC_PORT_ES
);
3967 secy
->operational
= true;
3968 secy
->key_len
= DEFAULT_SAK_LEN
;
3969 secy
->icv_len
= icv_len
;
3970 secy
->validate_frames
= MACSEC_VALIDATE_DEFAULT
;
3971 secy
->protect_frames
= true;
3972 secy
->replay_protect
= false;
3973 secy
->xpn
= DEFAULT_XPN
;
3976 secy
->tx_sc
.active
= true;
3977 secy
->tx_sc
.encoding_sa
= DEFAULT_ENCODING_SA
;
3978 secy
->tx_sc
.encrypt
= DEFAULT_ENCRYPT
;
3979 secy
->tx_sc
.send_sci
= DEFAULT_SEND_SCI
;
3980 secy
->tx_sc
.end_station
= false;
3981 secy
->tx_sc
.scb
= false;
3986 static struct lock_class_key macsec_netdev_addr_lock_key
;
3988 static int macsec_newlink(struct net
*net
, struct net_device
*dev
,
3989 struct nlattr
*tb
[], struct nlattr
*data
[],
3990 struct netlink_ext_ack
*extack
)
3992 struct macsec_dev
*macsec
= macsec_priv(dev
);
3993 rx_handler_func_t
*rx_handler
;
3994 u8 icv_len
= DEFAULT_ICV_LEN
;
3995 struct net_device
*real_dev
;
4001 real_dev
= __dev_get_by_index(net
, nla_get_u32(tb
[IFLA_LINK
]));
4004 if (real_dev
->type
!= ARPHRD_ETHER
)
4007 dev
->priv_flags
|= IFF_MACSEC
;
4009 macsec
->real_dev
= real_dev
;
4011 if (data
&& data
[IFLA_MACSEC_OFFLOAD
])
4012 macsec
->offload
= nla_get_offload(data
[IFLA_MACSEC_OFFLOAD
]);
4014 /* MACsec offloading is off by default */
4015 macsec
->offload
= MACSEC_OFFLOAD_OFF
;
4017 /* Check if the offloading mode is supported by the underlying layers */
4018 if (macsec
->offload
!= MACSEC_OFFLOAD_OFF
&&
4019 !macsec_check_offload(macsec
->offload
, macsec
))
4022 /* send_sci must be set to true when transmit sci explicitly is set */
4023 if ((data
&& data
[IFLA_MACSEC_SCI
]) &&
4024 (data
&& data
[IFLA_MACSEC_INC_SCI
])) {
4025 u8 send_sci
= !!nla_get_u8(data
[IFLA_MACSEC_INC_SCI
]);
4031 if (data
&& data
[IFLA_MACSEC_ICV_LEN
])
4032 icv_len
= nla_get_u8(data
[IFLA_MACSEC_ICV_LEN
]);
4033 mtu
= real_dev
->mtu
- icv_len
- macsec_extra_len(true);
4039 rx_handler
= rtnl_dereference(real_dev
->rx_handler
);
4040 if (rx_handler
&& rx_handler
!= macsec_handle_frame
)
4043 err
= register_netdevice(dev
);
4047 netdev_lockdep_set_classes(dev
);
4048 lockdep_set_class(&dev
->addr_list_lock
,
4049 &macsec_netdev_addr_lock_key
);
4051 err
= netdev_upper_dev_link(real_dev
, dev
, extack
);
4055 /* need to be already registered so that ->init has run and
4056 * the MAC addr is set
4058 if (data
&& data
[IFLA_MACSEC_SCI
])
4059 sci
= nla_get_sci(data
[IFLA_MACSEC_SCI
]);
4060 else if (data
&& data
[IFLA_MACSEC_PORT
])
4061 sci
= dev_to_sci(dev
, nla_get_be16(data
[IFLA_MACSEC_PORT
]));
4063 sci
= dev_to_sci(dev
, MACSEC_PORT_ES
);
4065 if (rx_handler
&& sci_exists(real_dev
, sci
)) {
4070 err
= macsec_add_dev(dev
, sci
, icv_len
);
4075 err
= macsec_changelink_common(dev
, data
);
4080 /* If h/w offloading is available, propagate to the device */
4081 if (macsec_is_offloaded(macsec
)) {
4082 const struct macsec_ops
*ops
;
4083 struct macsec_context ctx
;
4085 ops
= macsec_get_ops(macsec
, &ctx
);
4087 ctx
.secy
= &macsec
->secy
;
4088 err
= macsec_offload(ops
->mdo_add_secy
, &ctx
);
4094 err
= register_macsec_dev(real_dev
, dev
);
4098 netif_stacked_transfer_operstate(real_dev
, dev
);
4099 linkwatch_fire_event(dev
);
4101 macsec_generation
++;
4106 macsec_del_dev(macsec
);
4108 netdev_upper_dev_unlink(real_dev
, dev
);
4110 unregister_netdevice(dev
);
4114 static int macsec_validate_attr(struct nlattr
*tb
[], struct nlattr
*data
[],
4115 struct netlink_ext_ack
*extack
)
4117 u64 csid
= MACSEC_DEFAULT_CIPHER_ID
;
4118 u8 icv_len
= DEFAULT_ICV_LEN
;
4125 if (data
[IFLA_MACSEC_CIPHER_SUITE
])
4126 csid
= nla_get_u64(data
[IFLA_MACSEC_CIPHER_SUITE
]);
4128 if (data
[IFLA_MACSEC_ICV_LEN
]) {
4129 icv_len
= nla_get_u8(data
[IFLA_MACSEC_ICV_LEN
]);
4130 if (icv_len
!= DEFAULT_ICV_LEN
) {
4131 char dummy_key
[DEFAULT_SAK_LEN
] = { 0 };
4132 struct crypto_aead
*dummy_tfm
;
4134 dummy_tfm
= macsec_alloc_tfm(dummy_key
,
4137 if (IS_ERR(dummy_tfm
))
4138 return PTR_ERR(dummy_tfm
);
4139 crypto_free_aead(dummy_tfm
);
4144 case MACSEC_CIPHER_ID_GCM_AES_128
:
4145 case MACSEC_CIPHER_ID_GCM_AES_256
:
4146 case MACSEC_CIPHER_ID_GCM_AES_XPN_128
:
4147 case MACSEC_CIPHER_ID_GCM_AES_XPN_256
:
4148 case MACSEC_DEFAULT_CIPHER_ID
:
4149 if (icv_len
< MACSEC_MIN_ICV_LEN
||
4150 icv_len
> MACSEC_STD_ICV_LEN
)
4157 if (data
[IFLA_MACSEC_ENCODING_SA
]) {
4158 if (nla_get_u8(data
[IFLA_MACSEC_ENCODING_SA
]) >= MACSEC_NUM_AN
)
4162 for (flag
= IFLA_MACSEC_ENCODING_SA
+ 1;
4163 flag
< IFLA_MACSEC_VALIDATION
;
4166 if (nla_get_u8(data
[flag
]) > 1)
4171 es
= data
[IFLA_MACSEC_ES
] ? nla_get_u8(data
[IFLA_MACSEC_ES
]) : false;
4172 sci
= data
[IFLA_MACSEC_INC_SCI
] ? nla_get_u8(data
[IFLA_MACSEC_INC_SCI
]) : false;
4173 scb
= data
[IFLA_MACSEC_SCB
] ? nla_get_u8(data
[IFLA_MACSEC_SCB
]) : false;
4175 if ((sci
&& (scb
|| es
)) || (scb
&& es
))
4178 if (data
[IFLA_MACSEC_VALIDATION
] &&
4179 nla_get_u8(data
[IFLA_MACSEC_VALIDATION
]) > MACSEC_VALIDATE_MAX
)
4182 if ((data
[IFLA_MACSEC_REPLAY_PROTECT
] &&
4183 nla_get_u8(data
[IFLA_MACSEC_REPLAY_PROTECT
])) &&
4184 !data
[IFLA_MACSEC_WINDOW
])
4190 static struct net
*macsec_get_link_net(const struct net_device
*dev
)
4192 return dev_net(macsec_priv(dev
)->real_dev
);
4195 static size_t macsec_get_size(const struct net_device
*dev
)
4197 return nla_total_size_64bit(8) + /* IFLA_MACSEC_SCI */
4198 nla_total_size(1) + /* IFLA_MACSEC_ICV_LEN */
4199 nla_total_size_64bit(8) + /* IFLA_MACSEC_CIPHER_SUITE */
4200 nla_total_size(4) + /* IFLA_MACSEC_WINDOW */
4201 nla_total_size(1) + /* IFLA_MACSEC_ENCODING_SA */
4202 nla_total_size(1) + /* IFLA_MACSEC_ENCRYPT */
4203 nla_total_size(1) + /* IFLA_MACSEC_PROTECT */
4204 nla_total_size(1) + /* IFLA_MACSEC_INC_SCI */
4205 nla_total_size(1) + /* IFLA_MACSEC_ES */
4206 nla_total_size(1) + /* IFLA_MACSEC_SCB */
4207 nla_total_size(1) + /* IFLA_MACSEC_REPLAY_PROTECT */
4208 nla_total_size(1) + /* IFLA_MACSEC_VALIDATION */
4212 static int macsec_fill_info(struct sk_buff
*skb
,
4213 const struct net_device
*dev
)
4215 struct macsec_secy
*secy
= &macsec_priv(dev
)->secy
;
4216 struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
4219 switch (secy
->key_len
) {
4220 case MACSEC_GCM_AES_128_SAK_LEN
:
4221 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_128
: MACSEC_DEFAULT_CIPHER_ID
;
4223 case MACSEC_GCM_AES_256_SAK_LEN
:
4224 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_256
: MACSEC_CIPHER_ID_GCM_AES_256
;
4227 goto nla_put_failure
;
4230 if (nla_put_sci(skb
, IFLA_MACSEC_SCI
, secy
->sci
,
4232 nla_put_u8(skb
, IFLA_MACSEC_ICV_LEN
, secy
->icv_len
) ||
4233 nla_put_u64_64bit(skb
, IFLA_MACSEC_CIPHER_SUITE
,
4234 csid
, IFLA_MACSEC_PAD
) ||
4235 nla_put_u8(skb
, IFLA_MACSEC_ENCODING_SA
, tx_sc
->encoding_sa
) ||
4236 nla_put_u8(skb
, IFLA_MACSEC_ENCRYPT
, tx_sc
->encrypt
) ||
4237 nla_put_u8(skb
, IFLA_MACSEC_PROTECT
, secy
->protect_frames
) ||
4238 nla_put_u8(skb
, IFLA_MACSEC_INC_SCI
, tx_sc
->send_sci
) ||
4239 nla_put_u8(skb
, IFLA_MACSEC_ES
, tx_sc
->end_station
) ||
4240 nla_put_u8(skb
, IFLA_MACSEC_SCB
, tx_sc
->scb
) ||
4241 nla_put_u8(skb
, IFLA_MACSEC_REPLAY_PROTECT
, secy
->replay_protect
) ||
4242 nla_put_u8(skb
, IFLA_MACSEC_VALIDATION
, secy
->validate_frames
) ||
4244 goto nla_put_failure
;
4246 if (secy
->replay_protect
) {
4247 if (nla_put_u32(skb
, IFLA_MACSEC_WINDOW
, secy
->replay_window
))
4248 goto nla_put_failure
;
4257 static struct rtnl_link_ops macsec_link_ops __read_mostly
= {
4259 .priv_size
= sizeof(struct macsec_dev
),
4260 .maxtype
= IFLA_MACSEC_MAX
,
4261 .policy
= macsec_rtnl_policy
,
4262 .setup
= macsec_setup
,
4263 .validate
= macsec_validate_attr
,
4264 .newlink
= macsec_newlink
,
4265 .changelink
= macsec_changelink
,
4266 .dellink
= macsec_dellink
,
4267 .get_size
= macsec_get_size
,
4268 .fill_info
= macsec_fill_info
,
4269 .get_link_net
= macsec_get_link_net
,
4272 static bool is_macsec_master(struct net_device
*dev
)
4274 return rcu_access_pointer(dev
->rx_handler
) == macsec_handle_frame
;
4277 static int macsec_notify(struct notifier_block
*this, unsigned long event
,
4280 struct net_device
*real_dev
= netdev_notifier_info_to_dev(ptr
);
4283 if (!is_macsec_master(real_dev
))
4289 case NETDEV_CHANGE
: {
4290 struct macsec_dev
*m
, *n
;
4291 struct macsec_rxh_data
*rxd
;
4293 rxd
= macsec_data_rtnl(real_dev
);
4294 list_for_each_entry_safe(m
, n
, &rxd
->secys
, secys
) {
4295 struct net_device
*dev
= m
->secy
.netdev
;
4297 netif_stacked_transfer_operstate(real_dev
, dev
);
4301 case NETDEV_UNREGISTER
: {
4302 struct macsec_dev
*m
, *n
;
4303 struct macsec_rxh_data
*rxd
;
4305 rxd
= macsec_data_rtnl(real_dev
);
4306 list_for_each_entry_safe(m
, n
, &rxd
->secys
, secys
) {
4307 macsec_common_dellink(m
->secy
.netdev
, &head
);
4310 netdev_rx_handler_unregister(real_dev
);
4313 unregister_netdevice_many(&head
);
4316 case NETDEV_CHANGEMTU
: {
4317 struct macsec_dev
*m
;
4318 struct macsec_rxh_data
*rxd
;
4320 rxd
= macsec_data_rtnl(real_dev
);
4321 list_for_each_entry(m
, &rxd
->secys
, secys
) {
4322 struct net_device
*dev
= m
->secy
.netdev
;
4323 unsigned int mtu
= real_dev
->mtu
- (m
->secy
.icv_len
+
4324 macsec_extra_len(true));
4327 dev_set_mtu(dev
, mtu
);
4335 static struct notifier_block macsec_notifier
= {
4336 .notifier_call
= macsec_notify
,
4339 static int __init
macsec_init(void)
4343 pr_info("MACsec IEEE 802.1AE\n");
4344 err
= register_netdevice_notifier(&macsec_notifier
);
4348 err
= rtnl_link_register(&macsec_link_ops
);
4352 err
= genl_register_family(&macsec_fam
);
4359 rtnl_link_unregister(&macsec_link_ops
);
4361 unregister_netdevice_notifier(&macsec_notifier
);
4365 static void __exit
macsec_exit(void)
4367 genl_unregister_family(&macsec_fam
);
4368 rtnl_link_unregister(&macsec_link_ops
);
4369 unregister_netdevice_notifier(&macsec_notifier
);
4373 module_init(macsec_init
);
4374 module_exit(macsec_exit
);
4376 MODULE_ALIAS_RTNL_LINK("macsec");
4377 MODULE_ALIAS_GENL_FAMILY("macsec");
4379 MODULE_DESCRIPTION("MACsec IEEE 802.1AE");
4380 MODULE_LICENSE("GPL v2");