1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * drivers/net/macsec.c - MACsec device
5 * Copyright (c) 2015 Sabrina Dubroca <sd@queasysnail.net>
8 #include <linux/types.h>
9 #include <linux/skbuff.h>
10 #include <linux/socket.h>
11 #include <linux/module.h>
12 #include <crypto/aead.h>
13 #include <linux/etherdevice.h>
14 #include <linux/netdevice.h>
15 #include <linux/rtnetlink.h>
16 #include <linux/refcount.h>
17 #include <net/genetlink.h>
19 #include <net/gro_cells.h>
20 #include <net/macsec.h>
21 #include <linux/phy.h>
22 #include <linux/byteorder/generic.h>
23 #include <linux/if_arp.h>
25 #include <uapi/linux/if_macsec.h>
27 #define MACSEC_SCI_LEN 8
29 /* SecTAG length = macsec_eth_header without the optional SCI */
30 #define MACSEC_TAG_LEN 6
32 struct macsec_eth_header
{
36 #if defined(__LITTLE_ENDIAN_BITFIELD)
39 #elif defined(__BIG_ENDIAN_BITFIELD)
43 #error "Please fix <asm/byteorder.h>"
46 u8 secure_channel_id
[8]; /* optional */
49 #define MACSEC_TCI_VERSION 0x80
50 #define MACSEC_TCI_ES 0x40 /* end station */
51 #define MACSEC_TCI_SC 0x20 /* SCI present */
52 #define MACSEC_TCI_SCB 0x10 /* epon */
53 #define MACSEC_TCI_E 0x08 /* encryption */
54 #define MACSEC_TCI_C 0x04 /* changed text */
55 #define MACSEC_AN_MASK 0x03 /* association number */
56 #define MACSEC_TCI_CONFID (MACSEC_TCI_E | MACSEC_TCI_C)
58 /* minimum secure data length deemed "not short", see IEEE 802.1AE-2006 9.7 */
59 #define MIN_NON_SHORT_LEN 48
61 #define GCM_AES_IV_LEN 12
62 #define DEFAULT_ICV_LEN 16
64 #define for_each_rxsc(secy, sc) \
65 for (sc = rcu_dereference_bh(secy->rx_sc); \
67 sc = rcu_dereference_bh(sc->next))
68 #define for_each_rxsc_rtnl(secy, sc) \
69 for (sc = rtnl_dereference(secy->rx_sc); \
71 sc = rtnl_dereference(sc->next))
73 #define pn_same_half(pn1, pn2) (!(((pn1) >> 31) ^ ((pn2) >> 31)))
77 u8 short_secure_channel_id
[4];
85 u8 secure_channel_id
[8];
91 #define MACSEC_VALIDATE_DEFAULT MACSEC_VALIDATE_STRICT
93 struct pcpu_secy_stats
{
94 struct macsec_dev_stats stats
;
95 struct u64_stats_sync syncp
;
99 * struct macsec_dev - private data
101 * @real_dev: pointer to underlying netdevice
102 * @stats: MACsec device stats
103 * @secys: linked list of SecY's on the underlying device
104 * @gro_cells: pointer to the Generic Receive Offload cell
105 * @offload: status of offloading on the MACsec device
108 struct macsec_secy secy
;
109 struct net_device
*real_dev
;
110 struct pcpu_secy_stats __percpu
*stats
;
111 struct list_head secys
;
112 struct gro_cells gro_cells
;
113 enum macsec_offload offload
;
117 * struct macsec_rxh_data - rx_handler private argument
118 * @secys: linked list of SecY's on this underlying device
120 struct macsec_rxh_data
{
121 struct list_head secys
;
124 static struct macsec_dev
*macsec_priv(const struct net_device
*dev
)
126 return (struct macsec_dev
*)netdev_priv(dev
);
129 static struct macsec_rxh_data
*macsec_data_rcu(const struct net_device
*dev
)
131 return rcu_dereference_bh(dev
->rx_handler_data
);
134 static struct macsec_rxh_data
*macsec_data_rtnl(const struct net_device
*dev
)
136 return rtnl_dereference(dev
->rx_handler_data
);
140 struct aead_request
*req
;
142 struct macsec_tx_sa
*tx_sa
;
143 struct macsec_rx_sa
*rx_sa
;
150 static struct macsec_rx_sa
*macsec_rxsa_get(struct macsec_rx_sa __rcu
*ptr
)
152 struct macsec_rx_sa
*sa
= rcu_dereference_bh(ptr
);
154 if (!sa
|| !sa
->active
)
157 if (!refcount_inc_not_zero(&sa
->refcnt
))
163 static void free_rx_sc_rcu(struct rcu_head
*head
)
165 struct macsec_rx_sc
*rx_sc
= container_of(head
, struct macsec_rx_sc
, rcu_head
);
167 free_percpu(rx_sc
->stats
);
171 static struct macsec_rx_sc
*macsec_rxsc_get(struct macsec_rx_sc
*sc
)
173 return refcount_inc_not_zero(&sc
->refcnt
) ? sc
: NULL
;
176 static void macsec_rxsc_put(struct macsec_rx_sc
*sc
)
178 if (refcount_dec_and_test(&sc
->refcnt
))
179 call_rcu(&sc
->rcu_head
, free_rx_sc_rcu
);
182 static void free_rxsa(struct rcu_head
*head
)
184 struct macsec_rx_sa
*sa
= container_of(head
, struct macsec_rx_sa
, rcu
);
186 crypto_free_aead(sa
->key
.tfm
);
187 free_percpu(sa
->stats
);
191 static void macsec_rxsa_put(struct macsec_rx_sa
*sa
)
193 if (refcount_dec_and_test(&sa
->refcnt
))
194 call_rcu(&sa
->rcu
, free_rxsa
);
197 static struct macsec_tx_sa
*macsec_txsa_get(struct macsec_tx_sa __rcu
*ptr
)
199 struct macsec_tx_sa
*sa
= rcu_dereference_bh(ptr
);
201 if (!sa
|| !sa
->active
)
204 if (!refcount_inc_not_zero(&sa
->refcnt
))
210 static void free_txsa(struct rcu_head
*head
)
212 struct macsec_tx_sa
*sa
= container_of(head
, struct macsec_tx_sa
, rcu
);
214 crypto_free_aead(sa
->key
.tfm
);
215 free_percpu(sa
->stats
);
219 static void macsec_txsa_put(struct macsec_tx_sa
*sa
)
221 if (refcount_dec_and_test(&sa
->refcnt
))
222 call_rcu(&sa
->rcu
, free_txsa
);
225 static struct macsec_cb
*macsec_skb_cb(struct sk_buff
*skb
)
227 BUILD_BUG_ON(sizeof(struct macsec_cb
) > sizeof(skb
->cb
));
228 return (struct macsec_cb
*)skb
->cb
;
231 #define MACSEC_PORT_ES (htons(0x0001))
232 #define MACSEC_PORT_SCB (0x0000)
233 #define MACSEC_UNDEF_SCI ((__force sci_t)0xffffffffffffffffULL)
234 #define MACSEC_UNDEF_SSCI ((__force ssci_t)0xffffffff)
236 #define MACSEC_GCM_AES_128_SAK_LEN 16
237 #define MACSEC_GCM_AES_256_SAK_LEN 32
239 #define DEFAULT_SAK_LEN MACSEC_GCM_AES_128_SAK_LEN
240 #define DEFAULT_XPN false
241 #define DEFAULT_SEND_SCI true
242 #define DEFAULT_ENCRYPT false
243 #define DEFAULT_ENCODING_SA 0
245 static bool send_sci(const struct macsec_secy
*secy
)
247 const struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
249 return tx_sc
->send_sci
||
250 (secy
->n_rx_sc
> 1 && !tx_sc
->end_station
&& !tx_sc
->scb
);
253 static sci_t
make_sci(u8
*addr
, __be16 port
)
257 memcpy(&sci
, addr
, ETH_ALEN
);
258 memcpy(((char *)&sci
) + ETH_ALEN
, &port
, sizeof(port
));
263 static sci_t
macsec_frame_sci(struct macsec_eth_header
*hdr
, bool sci_present
)
268 memcpy(&sci
, hdr
->secure_channel_id
,
269 sizeof(hdr
->secure_channel_id
));
271 sci
= make_sci(hdr
->eth
.h_source
, MACSEC_PORT_ES
);
276 static unsigned int macsec_sectag_len(bool sci_present
)
278 return MACSEC_TAG_LEN
+ (sci_present
? MACSEC_SCI_LEN
: 0);
281 static unsigned int macsec_hdr_len(bool sci_present
)
283 return macsec_sectag_len(sci_present
) + ETH_HLEN
;
286 static unsigned int macsec_extra_len(bool sci_present
)
288 return macsec_sectag_len(sci_present
) + sizeof(__be16
);
291 /* Fill SecTAG according to IEEE 802.1AE-2006 10.5.3 */
292 static void macsec_fill_sectag(struct macsec_eth_header
*h
,
293 const struct macsec_secy
*secy
, u32 pn
,
296 const struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
298 memset(&h
->tci_an
, 0, macsec_sectag_len(sci_present
));
299 h
->eth
.h_proto
= htons(ETH_P_MACSEC
);
302 h
->tci_an
|= MACSEC_TCI_SC
;
303 memcpy(&h
->secure_channel_id
, &secy
->sci
,
304 sizeof(h
->secure_channel_id
));
306 if (tx_sc
->end_station
)
307 h
->tci_an
|= MACSEC_TCI_ES
;
309 h
->tci_an
|= MACSEC_TCI_SCB
;
312 h
->packet_number
= htonl(pn
);
314 /* with GCM, C/E clear for !encrypt, both set for encrypt */
316 h
->tci_an
|= MACSEC_TCI_CONFID
;
317 else if (secy
->icv_len
!= DEFAULT_ICV_LEN
)
318 h
->tci_an
|= MACSEC_TCI_C
;
320 h
->tci_an
|= tx_sc
->encoding_sa
;
323 static void macsec_set_shortlen(struct macsec_eth_header
*h
, size_t data_len
)
325 if (data_len
< MIN_NON_SHORT_LEN
)
326 h
->short_length
= data_len
;
329 /* Checks if a MACsec interface is being offloaded to an hardware engine */
330 static bool macsec_is_offloaded(struct macsec_dev
*macsec
)
332 if (macsec
->offload
== MACSEC_OFFLOAD_MAC
||
333 macsec
->offload
== MACSEC_OFFLOAD_PHY
)
339 /* Checks if underlying layers implement MACsec offloading functions. */
340 static bool macsec_check_offload(enum macsec_offload offload
,
341 struct macsec_dev
*macsec
)
343 if (!macsec
|| !macsec
->real_dev
)
346 if (offload
== MACSEC_OFFLOAD_PHY
)
347 return macsec
->real_dev
->phydev
&&
348 macsec
->real_dev
->phydev
->macsec_ops
;
349 else if (offload
== MACSEC_OFFLOAD_MAC
)
350 return macsec
->real_dev
->features
& NETIF_F_HW_MACSEC
&&
351 macsec
->real_dev
->macsec_ops
;
356 static const struct macsec_ops
*__macsec_get_ops(enum macsec_offload offload
,
357 struct macsec_dev
*macsec
,
358 struct macsec_context
*ctx
)
361 memset(ctx
, 0, sizeof(*ctx
));
362 ctx
->offload
= offload
;
364 if (offload
== MACSEC_OFFLOAD_PHY
)
365 ctx
->phydev
= macsec
->real_dev
->phydev
;
366 else if (offload
== MACSEC_OFFLOAD_MAC
)
367 ctx
->netdev
= macsec
->real_dev
;
370 if (offload
== MACSEC_OFFLOAD_PHY
)
371 return macsec
->real_dev
->phydev
->macsec_ops
;
373 return macsec
->real_dev
->macsec_ops
;
376 /* Returns a pointer to the MACsec ops struct if any and updates the MACsec
377 * context device reference if provided.
379 static const struct macsec_ops
*macsec_get_ops(struct macsec_dev
*macsec
,
380 struct macsec_context
*ctx
)
382 if (!macsec_check_offload(macsec
->offload
, macsec
))
385 return __macsec_get_ops(macsec
->offload
, macsec
, ctx
);
388 /* validate MACsec packet according to IEEE 802.1AE-2018 9.12 */
389 static bool macsec_validate_skb(struct sk_buff
*skb
, u16 icv_len
, bool xpn
)
391 struct macsec_eth_header
*h
= (struct macsec_eth_header
*)skb
->data
;
392 int len
= skb
->len
- 2 * ETH_ALEN
;
393 int extra_len
= macsec_extra_len(!!(h
->tci_an
& MACSEC_TCI_SC
)) + icv_len
;
395 /* a) It comprises at least 17 octets */
399 /* b) MACsec EtherType: already checked */
401 /* c) V bit is clear */
402 if (h
->tci_an
& MACSEC_TCI_VERSION
)
405 /* d) ES or SCB => !SC */
406 if ((h
->tci_an
& MACSEC_TCI_ES
|| h
->tci_an
& MACSEC_TCI_SCB
) &&
407 (h
->tci_an
& MACSEC_TCI_SC
))
410 /* e) Bits 7 and 8 of octet 4 of the SecTAG are clear */
414 /* rx.pn != 0 if not XPN (figure 10-5 with 802.11AEbw-2013 amendment) */
415 if (!h
->packet_number
&& !xpn
)
418 /* length check, f) g) h) i) */
420 return len
== extra_len
+ h
->short_length
;
421 return len
>= extra_len
+ MIN_NON_SHORT_LEN
;
424 #define MACSEC_NEEDED_HEADROOM (macsec_extra_len(true))
425 #define MACSEC_NEEDED_TAILROOM MACSEC_STD_ICV_LEN
427 static void macsec_fill_iv_xpn(unsigned char *iv
, ssci_t ssci
, u64 pn
,
430 struct gcm_iv_xpn
*gcm_iv
= (struct gcm_iv_xpn
*)iv
;
432 gcm_iv
->ssci
= ssci
^ salt
.ssci
;
433 gcm_iv
->pn
= cpu_to_be64(pn
) ^ salt
.pn
;
436 static void macsec_fill_iv(unsigned char *iv
, sci_t sci
, u32 pn
)
438 struct gcm_iv
*gcm_iv
= (struct gcm_iv
*)iv
;
441 gcm_iv
->pn
= htonl(pn
);
444 static struct macsec_eth_header
*macsec_ethhdr(struct sk_buff
*skb
)
446 return (struct macsec_eth_header
*)skb_mac_header(skb
);
449 static sci_t
dev_to_sci(struct net_device
*dev
, __be16 port
)
451 return make_sci(dev
->dev_addr
, port
);
454 static void __macsec_pn_wrapped(struct macsec_secy
*secy
,
455 struct macsec_tx_sa
*tx_sa
)
457 pr_debug("PN wrapped, transitioning to !oper\n");
458 tx_sa
->active
= false;
459 if (secy
->protect_frames
)
460 secy
->operational
= false;
463 void macsec_pn_wrapped(struct macsec_secy
*secy
, struct macsec_tx_sa
*tx_sa
)
465 spin_lock_bh(&tx_sa
->lock
);
466 __macsec_pn_wrapped(secy
, tx_sa
);
467 spin_unlock_bh(&tx_sa
->lock
);
469 EXPORT_SYMBOL_GPL(macsec_pn_wrapped
);
471 static pn_t
tx_sa_update_pn(struct macsec_tx_sa
*tx_sa
,
472 struct macsec_secy
*secy
)
476 spin_lock_bh(&tx_sa
->lock
);
478 pn
= tx_sa
->next_pn_halves
;
482 tx_sa
->next_pn_halves
.lower
++;
484 if (tx_sa
->next_pn
== 0)
485 __macsec_pn_wrapped(secy
, tx_sa
);
486 spin_unlock_bh(&tx_sa
->lock
);
491 static void macsec_encrypt_finish(struct sk_buff
*skb
, struct net_device
*dev
)
493 struct macsec_dev
*macsec
= netdev_priv(dev
);
495 skb
->dev
= macsec
->real_dev
;
496 skb_reset_mac_header(skb
);
497 skb
->protocol
= eth_hdr(skb
)->h_proto
;
500 static void macsec_count_tx(struct sk_buff
*skb
, struct macsec_tx_sc
*tx_sc
,
501 struct macsec_tx_sa
*tx_sa
)
503 struct pcpu_tx_sc_stats
*txsc_stats
= this_cpu_ptr(tx_sc
->stats
);
505 u64_stats_update_begin(&txsc_stats
->syncp
);
506 if (tx_sc
->encrypt
) {
507 txsc_stats
->stats
.OutOctetsEncrypted
+= skb
->len
;
508 txsc_stats
->stats
.OutPktsEncrypted
++;
509 this_cpu_inc(tx_sa
->stats
->OutPktsEncrypted
);
511 txsc_stats
->stats
.OutOctetsProtected
+= skb
->len
;
512 txsc_stats
->stats
.OutPktsProtected
++;
513 this_cpu_inc(tx_sa
->stats
->OutPktsProtected
);
515 u64_stats_update_end(&txsc_stats
->syncp
);
518 static void count_tx(struct net_device
*dev
, int ret
, int len
)
520 if (likely(ret
== NET_XMIT_SUCCESS
|| ret
== NET_XMIT_CN
)) {
521 struct pcpu_sw_netstats
*stats
= this_cpu_ptr(dev
->tstats
);
523 u64_stats_update_begin(&stats
->syncp
);
525 stats
->tx_bytes
+= len
;
526 u64_stats_update_end(&stats
->syncp
);
530 static void macsec_encrypt_done(struct crypto_async_request
*base
, int err
)
532 struct sk_buff
*skb
= base
->data
;
533 struct net_device
*dev
= skb
->dev
;
534 struct macsec_dev
*macsec
= macsec_priv(dev
);
535 struct macsec_tx_sa
*sa
= macsec_skb_cb(skb
)->tx_sa
;
538 aead_request_free(macsec_skb_cb(skb
)->req
);
541 macsec_encrypt_finish(skb
, dev
);
542 macsec_count_tx(skb
, &macsec
->secy
.tx_sc
, macsec_skb_cb(skb
)->tx_sa
);
544 ret
= dev_queue_xmit(skb
);
545 count_tx(dev
, ret
, len
);
546 rcu_read_unlock_bh();
552 static struct aead_request
*macsec_alloc_req(struct crypto_aead
*tfm
,
554 struct scatterlist
**sg
,
557 size_t size
, iv_offset
, sg_offset
;
558 struct aead_request
*req
;
561 size
= sizeof(struct aead_request
) + crypto_aead_reqsize(tfm
);
563 size
+= GCM_AES_IV_LEN
;
565 size
= ALIGN(size
, __alignof__(struct scatterlist
));
567 size
+= sizeof(struct scatterlist
) * num_frags
;
569 tmp
= kmalloc(size
, GFP_ATOMIC
);
573 *iv
= (unsigned char *)(tmp
+ iv_offset
);
574 *sg
= (struct scatterlist
*)(tmp
+ sg_offset
);
577 aead_request_set_tfm(req
, tfm
);
582 static struct sk_buff
*macsec_encrypt(struct sk_buff
*skb
,
583 struct net_device
*dev
)
586 struct scatterlist
*sg
;
587 struct sk_buff
*trailer
;
590 struct macsec_eth_header
*hh
;
591 size_t unprotected_len
;
592 struct aead_request
*req
;
593 struct macsec_secy
*secy
;
594 struct macsec_tx_sc
*tx_sc
;
595 struct macsec_tx_sa
*tx_sa
;
596 struct macsec_dev
*macsec
= macsec_priv(dev
);
600 secy
= &macsec
->secy
;
601 tx_sc
= &secy
->tx_sc
;
603 /* 10.5.1 TX SA assignment */
604 tx_sa
= macsec_txsa_get(tx_sc
->sa
[tx_sc
->encoding_sa
]);
606 secy
->operational
= false;
608 return ERR_PTR(-EINVAL
);
611 if (unlikely(skb_headroom(skb
) < MACSEC_NEEDED_HEADROOM
||
612 skb_tailroom(skb
) < MACSEC_NEEDED_TAILROOM
)) {
613 struct sk_buff
*nskb
= skb_copy_expand(skb
,
614 MACSEC_NEEDED_HEADROOM
,
615 MACSEC_NEEDED_TAILROOM
,
621 macsec_txsa_put(tx_sa
);
623 return ERR_PTR(-ENOMEM
);
626 skb
= skb_unshare(skb
, GFP_ATOMIC
);
628 macsec_txsa_put(tx_sa
);
629 return ERR_PTR(-ENOMEM
);
633 unprotected_len
= skb
->len
;
635 sci_present
= send_sci(secy
);
636 hh
= skb_push(skb
, macsec_extra_len(sci_present
));
637 memmove(hh
, eth
, 2 * ETH_ALEN
);
639 pn
= tx_sa_update_pn(tx_sa
, secy
);
640 if (pn
.full64
== 0) {
641 macsec_txsa_put(tx_sa
);
643 return ERR_PTR(-ENOLINK
);
645 macsec_fill_sectag(hh
, secy
, pn
.lower
, sci_present
);
646 macsec_set_shortlen(hh
, unprotected_len
- 2 * ETH_ALEN
);
648 skb_put(skb
, secy
->icv_len
);
650 if (skb
->len
- ETH_HLEN
> macsec_priv(dev
)->real_dev
->mtu
) {
651 struct pcpu_secy_stats
*secy_stats
= this_cpu_ptr(macsec
->stats
);
653 u64_stats_update_begin(&secy_stats
->syncp
);
654 secy_stats
->stats
.OutPktsTooLong
++;
655 u64_stats_update_end(&secy_stats
->syncp
);
657 macsec_txsa_put(tx_sa
);
659 return ERR_PTR(-EINVAL
);
662 ret
= skb_cow_data(skb
, 0, &trailer
);
663 if (unlikely(ret
< 0)) {
664 macsec_txsa_put(tx_sa
);
669 req
= macsec_alloc_req(tx_sa
->key
.tfm
, &iv
, &sg
, ret
);
671 macsec_txsa_put(tx_sa
);
673 return ERR_PTR(-ENOMEM
);
677 macsec_fill_iv_xpn(iv
, tx_sa
->ssci
, pn
.full64
, tx_sa
->key
.salt
);
679 macsec_fill_iv(iv
, secy
->sci
, pn
.lower
);
681 sg_init_table(sg
, ret
);
682 ret
= skb_to_sgvec(skb
, sg
, 0, skb
->len
);
683 if (unlikely(ret
< 0)) {
684 aead_request_free(req
);
685 macsec_txsa_put(tx_sa
);
690 if (tx_sc
->encrypt
) {
691 int len
= skb
->len
- macsec_hdr_len(sci_present
) -
693 aead_request_set_crypt(req
, sg
, sg
, len
, iv
);
694 aead_request_set_ad(req
, macsec_hdr_len(sci_present
));
696 aead_request_set_crypt(req
, sg
, sg
, 0, iv
);
697 aead_request_set_ad(req
, skb
->len
- secy
->icv_len
);
700 macsec_skb_cb(skb
)->req
= req
;
701 macsec_skb_cb(skb
)->tx_sa
= tx_sa
;
702 aead_request_set_callback(req
, 0, macsec_encrypt_done
, skb
);
705 ret
= crypto_aead_encrypt(req
);
706 if (ret
== -EINPROGRESS
) {
708 } else if (ret
!= 0) {
711 aead_request_free(req
);
712 macsec_txsa_put(tx_sa
);
713 return ERR_PTR(-EINVAL
);
717 aead_request_free(req
);
718 macsec_txsa_put(tx_sa
);
723 static bool macsec_post_decrypt(struct sk_buff
*skb
, struct macsec_secy
*secy
, u32 pn
)
725 struct macsec_rx_sa
*rx_sa
= macsec_skb_cb(skb
)->rx_sa
;
726 struct pcpu_rx_sc_stats
*rxsc_stats
= this_cpu_ptr(rx_sa
->sc
->stats
);
727 struct macsec_eth_header
*hdr
= macsec_ethhdr(skb
);
730 spin_lock(&rx_sa
->lock
);
731 if (rx_sa
->next_pn_halves
.lower
>= secy
->replay_window
)
732 lowest_pn
= rx_sa
->next_pn_halves
.lower
- secy
->replay_window
;
734 /* Now perform replay protection check again
735 * (see IEEE 802.1AE-2006 figure 10-5)
737 if (secy
->replay_protect
&& pn
< lowest_pn
&&
738 (!secy
->xpn
|| pn_same_half(pn
, lowest_pn
))) {
739 spin_unlock(&rx_sa
->lock
);
740 u64_stats_update_begin(&rxsc_stats
->syncp
);
741 rxsc_stats
->stats
.InPktsLate
++;
742 u64_stats_update_end(&rxsc_stats
->syncp
);
746 if (secy
->validate_frames
!= MACSEC_VALIDATE_DISABLED
) {
747 u64_stats_update_begin(&rxsc_stats
->syncp
);
748 if (hdr
->tci_an
& MACSEC_TCI_E
)
749 rxsc_stats
->stats
.InOctetsDecrypted
+= skb
->len
;
751 rxsc_stats
->stats
.InOctetsValidated
+= skb
->len
;
752 u64_stats_update_end(&rxsc_stats
->syncp
);
755 if (!macsec_skb_cb(skb
)->valid
) {
756 spin_unlock(&rx_sa
->lock
);
759 if (hdr
->tci_an
& MACSEC_TCI_C
||
760 secy
->validate_frames
== MACSEC_VALIDATE_STRICT
) {
761 u64_stats_update_begin(&rxsc_stats
->syncp
);
762 rxsc_stats
->stats
.InPktsNotValid
++;
763 u64_stats_update_end(&rxsc_stats
->syncp
);
767 u64_stats_update_begin(&rxsc_stats
->syncp
);
768 if (secy
->validate_frames
== MACSEC_VALIDATE_CHECK
) {
769 rxsc_stats
->stats
.InPktsInvalid
++;
770 this_cpu_inc(rx_sa
->stats
->InPktsInvalid
);
771 } else if (pn
< lowest_pn
) {
772 rxsc_stats
->stats
.InPktsDelayed
++;
774 rxsc_stats
->stats
.InPktsUnchecked
++;
776 u64_stats_update_end(&rxsc_stats
->syncp
);
778 u64_stats_update_begin(&rxsc_stats
->syncp
);
779 if (pn
< lowest_pn
) {
780 rxsc_stats
->stats
.InPktsDelayed
++;
782 rxsc_stats
->stats
.InPktsOK
++;
783 this_cpu_inc(rx_sa
->stats
->InPktsOK
);
785 u64_stats_update_end(&rxsc_stats
->syncp
);
787 // Instead of "pn >=" - to support pn overflow in xpn
788 if (pn
+ 1 > rx_sa
->next_pn_halves
.lower
) {
789 rx_sa
->next_pn_halves
.lower
= pn
+ 1;
790 } else if (secy
->xpn
&&
791 !pn_same_half(pn
, rx_sa
->next_pn_halves
.lower
)) {
792 rx_sa
->next_pn_halves
.upper
++;
793 rx_sa
->next_pn_halves
.lower
= pn
+ 1;
796 spin_unlock(&rx_sa
->lock
);
802 static void macsec_reset_skb(struct sk_buff
*skb
, struct net_device
*dev
)
804 skb
->pkt_type
= PACKET_HOST
;
805 skb
->protocol
= eth_type_trans(skb
, dev
);
807 skb_reset_network_header(skb
);
808 if (!skb_transport_header_was_set(skb
))
809 skb_reset_transport_header(skb
);
810 skb_reset_mac_len(skb
);
813 static void macsec_finalize_skb(struct sk_buff
*skb
, u8 icv_len
, u8 hdr_len
)
815 skb
->ip_summed
= CHECKSUM_NONE
;
816 memmove(skb
->data
+ hdr_len
, skb
->data
, 2 * ETH_ALEN
);
817 skb_pull(skb
, hdr_len
);
818 pskb_trim_unique(skb
, skb
->len
- icv_len
);
821 static void count_rx(struct net_device
*dev
, int len
)
823 struct pcpu_sw_netstats
*stats
= this_cpu_ptr(dev
->tstats
);
825 u64_stats_update_begin(&stats
->syncp
);
827 stats
->rx_bytes
+= len
;
828 u64_stats_update_end(&stats
->syncp
);
831 static void macsec_decrypt_done(struct crypto_async_request
*base
, int err
)
833 struct sk_buff
*skb
= base
->data
;
834 struct net_device
*dev
= skb
->dev
;
835 struct macsec_dev
*macsec
= macsec_priv(dev
);
836 struct macsec_rx_sa
*rx_sa
= macsec_skb_cb(skb
)->rx_sa
;
837 struct macsec_rx_sc
*rx_sc
= rx_sa
->sc
;
841 aead_request_free(macsec_skb_cb(skb
)->req
);
844 macsec_skb_cb(skb
)->valid
= true;
847 pn
= ntohl(macsec_ethhdr(skb
)->packet_number
);
848 if (!macsec_post_decrypt(skb
, &macsec
->secy
, pn
)) {
849 rcu_read_unlock_bh();
854 macsec_finalize_skb(skb
, macsec
->secy
.icv_len
,
855 macsec_extra_len(macsec_skb_cb(skb
)->has_sci
));
856 macsec_reset_skb(skb
, macsec
->secy
.netdev
);
859 if (gro_cells_receive(&macsec
->gro_cells
, skb
) == NET_RX_SUCCESS
)
862 rcu_read_unlock_bh();
865 macsec_rxsa_put(rx_sa
);
866 macsec_rxsc_put(rx_sc
);
870 static struct sk_buff
*macsec_decrypt(struct sk_buff
*skb
,
871 struct net_device
*dev
,
872 struct macsec_rx_sa
*rx_sa
,
874 struct macsec_secy
*secy
)
877 struct scatterlist
*sg
;
878 struct sk_buff
*trailer
;
880 struct aead_request
*req
;
881 struct macsec_eth_header
*hdr
;
883 u16 icv_len
= secy
->icv_len
;
885 macsec_skb_cb(skb
)->valid
= false;
886 skb
= skb_share_check(skb
, GFP_ATOMIC
);
888 return ERR_PTR(-ENOMEM
);
890 ret
= skb_cow_data(skb
, 0, &trailer
);
891 if (unlikely(ret
< 0)) {
895 req
= macsec_alloc_req(rx_sa
->key
.tfm
, &iv
, &sg
, ret
);
898 return ERR_PTR(-ENOMEM
);
901 hdr
= (struct macsec_eth_header
*)skb
->data
;
902 hdr_pn
= ntohl(hdr
->packet_number
);
905 pn_t recovered_pn
= rx_sa
->next_pn_halves
;
907 recovered_pn
.lower
= hdr_pn
;
908 if (hdr_pn
< rx_sa
->next_pn_halves
.lower
&&
909 !pn_same_half(hdr_pn
, rx_sa
->next_pn_halves
.lower
))
910 recovered_pn
.upper
++;
912 macsec_fill_iv_xpn(iv
, rx_sa
->ssci
, recovered_pn
.full64
,
915 macsec_fill_iv(iv
, sci
, hdr_pn
);
918 sg_init_table(sg
, ret
);
919 ret
= skb_to_sgvec(skb
, sg
, 0, skb
->len
);
920 if (unlikely(ret
< 0)) {
921 aead_request_free(req
);
926 if (hdr
->tci_an
& MACSEC_TCI_E
) {
927 /* confidentiality: ethernet + macsec header
928 * authenticated, encrypted payload
930 int len
= skb
->len
- macsec_hdr_len(macsec_skb_cb(skb
)->has_sci
);
932 aead_request_set_crypt(req
, sg
, sg
, len
, iv
);
933 aead_request_set_ad(req
, macsec_hdr_len(macsec_skb_cb(skb
)->has_sci
));
934 skb
= skb_unshare(skb
, GFP_ATOMIC
);
936 aead_request_free(req
);
937 return ERR_PTR(-ENOMEM
);
940 /* integrity only: all headers + data authenticated */
941 aead_request_set_crypt(req
, sg
, sg
, icv_len
, iv
);
942 aead_request_set_ad(req
, skb
->len
- icv_len
);
945 macsec_skb_cb(skb
)->req
= req
;
947 aead_request_set_callback(req
, 0, macsec_decrypt_done
, skb
);
950 ret
= crypto_aead_decrypt(req
);
951 if (ret
== -EINPROGRESS
) {
953 } else if (ret
!= 0) {
954 /* decryption/authentication failed
955 * 10.6 if validateFrames is disabled, deliver anyway
957 if (ret
!= -EBADMSG
) {
962 macsec_skb_cb(skb
)->valid
= true;
966 aead_request_free(req
);
971 static struct macsec_rx_sc
*find_rx_sc(struct macsec_secy
*secy
, sci_t sci
)
973 struct macsec_rx_sc
*rx_sc
;
975 for_each_rxsc(secy
, rx_sc
) {
976 if (rx_sc
->sci
== sci
)
983 static struct macsec_rx_sc
*find_rx_sc_rtnl(struct macsec_secy
*secy
, sci_t sci
)
985 struct macsec_rx_sc
*rx_sc
;
987 for_each_rxsc_rtnl(secy
, rx_sc
) {
988 if (rx_sc
->sci
== sci
)
995 static enum rx_handler_result
handle_not_macsec(struct sk_buff
*skb
)
997 /* Deliver to the uncontrolled port by default */
998 enum rx_handler_result ret
= RX_HANDLER_PASS
;
999 struct ethhdr
*hdr
= eth_hdr(skb
);
1000 struct macsec_rxh_data
*rxd
;
1001 struct macsec_dev
*macsec
;
1004 rxd
= macsec_data_rcu(skb
->dev
);
1006 list_for_each_entry_rcu(macsec
, &rxd
->secys
, secys
) {
1007 struct sk_buff
*nskb
;
1008 struct pcpu_secy_stats
*secy_stats
= this_cpu_ptr(macsec
->stats
);
1009 struct net_device
*ndev
= macsec
->secy
.netdev
;
1011 /* If h/w offloading is enabled, HW decodes frames and strips
1012 * the SecTAG, so we have to deduce which port to deliver to.
1014 if (macsec_is_offloaded(macsec
) && netif_running(ndev
)) {
1015 if (ether_addr_equal_64bits(hdr
->h_dest
,
1017 /* exact match, divert skb to this port */
1019 skb
->pkt_type
= PACKET_HOST
;
1020 ret
= RX_HANDLER_ANOTHER
;
1022 } else if (is_multicast_ether_addr_64bits(
1024 /* multicast frame, deliver on this port too */
1025 nskb
= skb_clone(skb
, GFP_ATOMIC
);
1030 if (ether_addr_equal_64bits(hdr
->h_dest
,
1032 nskb
->pkt_type
= PACKET_BROADCAST
;
1034 nskb
->pkt_type
= PACKET_MULTICAST
;
1041 /* 10.6 If the management control validateFrames is not
1042 * Strict, frames without a SecTAG are received, counted, and
1043 * delivered to the Controlled Port
1045 if (macsec
->secy
.validate_frames
== MACSEC_VALIDATE_STRICT
) {
1046 u64_stats_update_begin(&secy_stats
->syncp
);
1047 secy_stats
->stats
.InPktsNoTag
++;
1048 u64_stats_update_end(&secy_stats
->syncp
);
1052 /* deliver on this port */
1053 nskb
= skb_clone(skb
, GFP_ATOMIC
);
1059 if (netif_rx(nskb
) == NET_RX_SUCCESS
) {
1060 u64_stats_update_begin(&secy_stats
->syncp
);
1061 secy_stats
->stats
.InPktsUntagged
++;
1062 u64_stats_update_end(&secy_stats
->syncp
);
1071 static rx_handler_result_t
macsec_handle_frame(struct sk_buff
**pskb
)
1073 struct sk_buff
*skb
= *pskb
;
1074 struct net_device
*dev
= skb
->dev
;
1075 struct macsec_eth_header
*hdr
;
1076 struct macsec_secy
*secy
= NULL
;
1077 struct macsec_rx_sc
*rx_sc
;
1078 struct macsec_rx_sa
*rx_sa
;
1079 struct macsec_rxh_data
*rxd
;
1080 struct macsec_dev
*macsec
;
1085 struct pcpu_rx_sc_stats
*rxsc_stats
;
1086 struct pcpu_secy_stats
*secy_stats
;
1090 if (skb_headroom(skb
) < ETH_HLEN
)
1093 hdr
= macsec_ethhdr(skb
);
1094 if (hdr
->eth
.h_proto
!= htons(ETH_P_MACSEC
))
1095 return handle_not_macsec(skb
);
1097 skb
= skb_unshare(skb
, GFP_ATOMIC
);
1100 return RX_HANDLER_CONSUMED
;
1102 pulled_sci
= pskb_may_pull(skb
, macsec_extra_len(true));
1104 if (!pskb_may_pull(skb
, macsec_extra_len(false)))
1108 hdr
= macsec_ethhdr(skb
);
1110 /* Frames with a SecTAG that has the TCI E bit set but the C
1111 * bit clear are discarded, as this reserved encoding is used
1112 * to identify frames with a SecTAG that are not to be
1113 * delivered to the Controlled Port.
1115 if ((hdr
->tci_an
& (MACSEC_TCI_C
| MACSEC_TCI_E
)) == MACSEC_TCI_E
)
1116 return RX_HANDLER_PASS
;
1118 /* now, pull the extra length */
1119 if (hdr
->tci_an
& MACSEC_TCI_SC
) {
1124 /* ethernet header is part of crypto processing */
1125 skb_push(skb
, ETH_HLEN
);
1127 macsec_skb_cb(skb
)->has_sci
= !!(hdr
->tci_an
& MACSEC_TCI_SC
);
1128 macsec_skb_cb(skb
)->assoc_num
= hdr
->tci_an
& MACSEC_AN_MASK
;
1129 sci
= macsec_frame_sci(hdr
, macsec_skb_cb(skb
)->has_sci
);
1132 rxd
= macsec_data_rcu(skb
->dev
);
1134 list_for_each_entry_rcu(macsec
, &rxd
->secys
, secys
) {
1135 struct macsec_rx_sc
*sc
= find_rx_sc(&macsec
->secy
, sci
);
1137 sc
= sc
? macsec_rxsc_get(sc
) : NULL
;
1140 secy
= &macsec
->secy
;
1150 macsec
= macsec_priv(dev
);
1151 secy_stats
= this_cpu_ptr(macsec
->stats
);
1152 rxsc_stats
= this_cpu_ptr(rx_sc
->stats
);
1154 if (!macsec_validate_skb(skb
, secy
->icv_len
, secy
->xpn
)) {
1155 u64_stats_update_begin(&secy_stats
->syncp
);
1156 secy_stats
->stats
.InPktsBadTag
++;
1157 u64_stats_update_end(&secy_stats
->syncp
);
1161 rx_sa
= macsec_rxsa_get(rx_sc
->sa
[macsec_skb_cb(skb
)->assoc_num
]);
1163 /* 10.6.1 if the SA is not in use */
1165 /* If validateFrames is Strict or the C bit in the
1166 * SecTAG is set, discard
1168 if (hdr
->tci_an
& MACSEC_TCI_C
||
1169 secy
->validate_frames
== MACSEC_VALIDATE_STRICT
) {
1170 u64_stats_update_begin(&rxsc_stats
->syncp
);
1171 rxsc_stats
->stats
.InPktsNotUsingSA
++;
1172 u64_stats_update_end(&rxsc_stats
->syncp
);
1176 /* not Strict, the frame (with the SecTAG and ICV
1177 * removed) is delivered to the Controlled Port.
1179 u64_stats_update_begin(&rxsc_stats
->syncp
);
1180 rxsc_stats
->stats
.InPktsUnusedSA
++;
1181 u64_stats_update_end(&rxsc_stats
->syncp
);
1185 /* First, PN check to avoid decrypting obviously wrong packets */
1186 hdr_pn
= ntohl(hdr
->packet_number
);
1187 if (secy
->replay_protect
) {
1190 spin_lock(&rx_sa
->lock
);
1191 late
= rx_sa
->next_pn_halves
.lower
>= secy
->replay_window
&&
1192 hdr_pn
< (rx_sa
->next_pn_halves
.lower
- secy
->replay_window
);
1195 late
= late
&& pn_same_half(rx_sa
->next_pn_halves
.lower
, hdr_pn
);
1196 spin_unlock(&rx_sa
->lock
);
1199 u64_stats_update_begin(&rxsc_stats
->syncp
);
1200 rxsc_stats
->stats
.InPktsLate
++;
1201 u64_stats_update_end(&rxsc_stats
->syncp
);
1206 macsec_skb_cb(skb
)->rx_sa
= rx_sa
;
1208 /* Disabled && !changed text => skip validation */
1209 if (hdr
->tci_an
& MACSEC_TCI_C
||
1210 secy
->validate_frames
!= MACSEC_VALIDATE_DISABLED
)
1211 skb
= macsec_decrypt(skb
, dev
, rx_sa
, sci
, secy
);
1214 /* the decrypt callback needs the reference */
1215 if (PTR_ERR(skb
) != -EINPROGRESS
) {
1216 macsec_rxsa_put(rx_sa
);
1217 macsec_rxsc_put(rx_sc
);
1221 return RX_HANDLER_CONSUMED
;
1224 if (!macsec_post_decrypt(skb
, secy
, hdr_pn
))
1228 macsec_finalize_skb(skb
, secy
->icv_len
,
1229 macsec_extra_len(macsec_skb_cb(skb
)->has_sci
));
1230 macsec_reset_skb(skb
, secy
->netdev
);
1233 macsec_rxsa_put(rx_sa
);
1234 macsec_rxsc_put(rx_sc
);
1238 ret
= gro_cells_receive(&macsec
->gro_cells
, skb
);
1239 if (ret
== NET_RX_SUCCESS
)
1242 macsec
->secy
.netdev
->stats
.rx_dropped
++;
1247 return RX_HANDLER_CONSUMED
;
1250 macsec_rxsa_put(rx_sa
);
1252 macsec_rxsc_put(rx_sc
);
1257 return RX_HANDLER_CONSUMED
;
1260 /* 10.6.1 if the SC is not found */
1261 cbit
= !!(hdr
->tci_an
& MACSEC_TCI_C
);
1263 macsec_finalize_skb(skb
, DEFAULT_ICV_LEN
,
1264 macsec_extra_len(macsec_skb_cb(skb
)->has_sci
));
1266 list_for_each_entry_rcu(macsec
, &rxd
->secys
, secys
) {
1267 struct sk_buff
*nskb
;
1269 secy_stats
= this_cpu_ptr(macsec
->stats
);
1271 /* If validateFrames is Strict or the C bit in the
1272 * SecTAG is set, discard
1275 macsec
->secy
.validate_frames
== MACSEC_VALIDATE_STRICT
) {
1276 u64_stats_update_begin(&secy_stats
->syncp
);
1277 secy_stats
->stats
.InPktsNoSCI
++;
1278 u64_stats_update_end(&secy_stats
->syncp
);
1282 /* not strict, the frame (with the SecTAG and ICV
1283 * removed) is delivered to the Controlled Port.
1285 nskb
= skb_clone(skb
, GFP_ATOMIC
);
1289 macsec_reset_skb(nskb
, macsec
->secy
.netdev
);
1291 ret
= netif_rx(nskb
);
1292 if (ret
== NET_RX_SUCCESS
) {
1293 u64_stats_update_begin(&secy_stats
->syncp
);
1294 secy_stats
->stats
.InPktsUnknownSCI
++;
1295 u64_stats_update_end(&secy_stats
->syncp
);
1297 macsec
->secy
.netdev
->stats
.rx_dropped
++;
1303 return RX_HANDLER_PASS
;
1306 static struct crypto_aead
*macsec_alloc_tfm(char *key
, int key_len
, int icv_len
)
1308 struct crypto_aead
*tfm
;
1311 /* Pick a sync gcm(aes) cipher to ensure order is preserved. */
1312 tfm
= crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC
);
1317 ret
= crypto_aead_setkey(tfm
, key
, key_len
);
1321 ret
= crypto_aead_setauthsize(tfm
, icv_len
);
1327 crypto_free_aead(tfm
);
1328 return ERR_PTR(ret
);
1331 static int init_rx_sa(struct macsec_rx_sa
*rx_sa
, char *sak
, int key_len
,
1334 rx_sa
->stats
= alloc_percpu(struct macsec_rx_sa_stats
);
1338 rx_sa
->key
.tfm
= macsec_alloc_tfm(sak
, key_len
, icv_len
);
1339 if (IS_ERR(rx_sa
->key
.tfm
)) {
1340 free_percpu(rx_sa
->stats
);
1341 return PTR_ERR(rx_sa
->key
.tfm
);
1344 rx_sa
->ssci
= MACSEC_UNDEF_SSCI
;
1345 rx_sa
->active
= false;
1347 refcount_set(&rx_sa
->refcnt
, 1);
1348 spin_lock_init(&rx_sa
->lock
);
1353 static void clear_rx_sa(struct macsec_rx_sa
*rx_sa
)
1355 rx_sa
->active
= false;
1357 macsec_rxsa_put(rx_sa
);
1360 static void free_rx_sc(struct macsec_rx_sc
*rx_sc
)
1364 for (i
= 0; i
< MACSEC_NUM_AN
; i
++) {
1365 struct macsec_rx_sa
*sa
= rtnl_dereference(rx_sc
->sa
[i
]);
1367 RCU_INIT_POINTER(rx_sc
->sa
[i
], NULL
);
1372 macsec_rxsc_put(rx_sc
);
1375 static struct macsec_rx_sc
*del_rx_sc(struct macsec_secy
*secy
, sci_t sci
)
1377 struct macsec_rx_sc
*rx_sc
, __rcu
**rx_scp
;
1379 for (rx_scp
= &secy
->rx_sc
, rx_sc
= rtnl_dereference(*rx_scp
);
1381 rx_scp
= &rx_sc
->next
, rx_sc
= rtnl_dereference(*rx_scp
)) {
1382 if (rx_sc
->sci
== sci
) {
1385 rcu_assign_pointer(*rx_scp
, rx_sc
->next
);
1393 static struct macsec_rx_sc
*create_rx_sc(struct net_device
*dev
, sci_t sci
)
1395 struct macsec_rx_sc
*rx_sc
;
1396 struct macsec_dev
*macsec
;
1397 struct net_device
*real_dev
= macsec_priv(dev
)->real_dev
;
1398 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(real_dev
);
1399 struct macsec_secy
*secy
;
1401 list_for_each_entry(macsec
, &rxd
->secys
, secys
) {
1402 if (find_rx_sc_rtnl(&macsec
->secy
, sci
))
1403 return ERR_PTR(-EEXIST
);
1406 rx_sc
= kzalloc(sizeof(*rx_sc
), GFP_KERNEL
);
1408 return ERR_PTR(-ENOMEM
);
1410 rx_sc
->stats
= netdev_alloc_pcpu_stats(struct pcpu_rx_sc_stats
);
1411 if (!rx_sc
->stats
) {
1413 return ERR_PTR(-ENOMEM
);
1417 rx_sc
->active
= true;
1418 refcount_set(&rx_sc
->refcnt
, 1);
1420 secy
= &macsec_priv(dev
)->secy
;
1421 rcu_assign_pointer(rx_sc
->next
, secy
->rx_sc
);
1422 rcu_assign_pointer(secy
->rx_sc
, rx_sc
);
1430 static int init_tx_sa(struct macsec_tx_sa
*tx_sa
, char *sak
, int key_len
,
1433 tx_sa
->stats
= alloc_percpu(struct macsec_tx_sa_stats
);
1437 tx_sa
->key
.tfm
= macsec_alloc_tfm(sak
, key_len
, icv_len
);
1438 if (IS_ERR(tx_sa
->key
.tfm
)) {
1439 free_percpu(tx_sa
->stats
);
1440 return PTR_ERR(tx_sa
->key
.tfm
);
1443 tx_sa
->ssci
= MACSEC_UNDEF_SSCI
;
1444 tx_sa
->active
= false;
1445 refcount_set(&tx_sa
->refcnt
, 1);
1446 spin_lock_init(&tx_sa
->lock
);
1451 static void clear_tx_sa(struct macsec_tx_sa
*tx_sa
)
1453 tx_sa
->active
= false;
1455 macsec_txsa_put(tx_sa
);
1458 static struct genl_family macsec_fam
;
1460 static struct net_device
*get_dev_from_nl(struct net
*net
,
1461 struct nlattr
**attrs
)
1463 int ifindex
= nla_get_u32(attrs
[MACSEC_ATTR_IFINDEX
]);
1464 struct net_device
*dev
;
1466 dev
= __dev_get_by_index(net
, ifindex
);
1468 return ERR_PTR(-ENODEV
);
1470 if (!netif_is_macsec(dev
))
1471 return ERR_PTR(-ENODEV
);
1476 static enum macsec_offload
nla_get_offload(const struct nlattr
*nla
)
1478 return (__force
enum macsec_offload
)nla_get_u8(nla
);
1481 static sci_t
nla_get_sci(const struct nlattr
*nla
)
1483 return (__force sci_t
)nla_get_u64(nla
);
1486 static int nla_put_sci(struct sk_buff
*skb
, int attrtype
, sci_t value
,
1489 return nla_put_u64_64bit(skb
, attrtype
, (__force u64
)value
, padattr
);
1492 static ssci_t
nla_get_ssci(const struct nlattr
*nla
)
1494 return (__force ssci_t
)nla_get_u32(nla
);
1497 static int nla_put_ssci(struct sk_buff
*skb
, int attrtype
, ssci_t value
)
1499 return nla_put_u32(skb
, attrtype
, (__force u64
)value
);
1502 static struct macsec_tx_sa
*get_txsa_from_nl(struct net
*net
,
1503 struct nlattr
**attrs
,
1504 struct nlattr
**tb_sa
,
1505 struct net_device
**devp
,
1506 struct macsec_secy
**secyp
,
1507 struct macsec_tx_sc
**scp
,
1510 struct net_device
*dev
;
1511 struct macsec_secy
*secy
;
1512 struct macsec_tx_sc
*tx_sc
;
1513 struct macsec_tx_sa
*tx_sa
;
1515 if (!tb_sa
[MACSEC_SA_ATTR_AN
])
1516 return ERR_PTR(-EINVAL
);
1518 *assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1520 dev
= get_dev_from_nl(net
, attrs
);
1522 return ERR_CAST(dev
);
1524 if (*assoc_num
>= MACSEC_NUM_AN
)
1525 return ERR_PTR(-EINVAL
);
1527 secy
= &macsec_priv(dev
)->secy
;
1528 tx_sc
= &secy
->tx_sc
;
1530 tx_sa
= rtnl_dereference(tx_sc
->sa
[*assoc_num
]);
1532 return ERR_PTR(-ENODEV
);
1540 static struct macsec_rx_sc
*get_rxsc_from_nl(struct net
*net
,
1541 struct nlattr
**attrs
,
1542 struct nlattr
**tb_rxsc
,
1543 struct net_device
**devp
,
1544 struct macsec_secy
**secyp
)
1546 struct net_device
*dev
;
1547 struct macsec_secy
*secy
;
1548 struct macsec_rx_sc
*rx_sc
;
1551 dev
= get_dev_from_nl(net
, attrs
);
1553 return ERR_CAST(dev
);
1555 secy
= &macsec_priv(dev
)->secy
;
1557 if (!tb_rxsc
[MACSEC_RXSC_ATTR_SCI
])
1558 return ERR_PTR(-EINVAL
);
1560 sci
= nla_get_sci(tb_rxsc
[MACSEC_RXSC_ATTR_SCI
]);
1561 rx_sc
= find_rx_sc_rtnl(secy
, sci
);
1563 return ERR_PTR(-ENODEV
);
1571 static struct macsec_rx_sa
*get_rxsa_from_nl(struct net
*net
,
1572 struct nlattr
**attrs
,
1573 struct nlattr
**tb_rxsc
,
1574 struct nlattr
**tb_sa
,
1575 struct net_device
**devp
,
1576 struct macsec_secy
**secyp
,
1577 struct macsec_rx_sc
**scp
,
1580 struct macsec_rx_sc
*rx_sc
;
1581 struct macsec_rx_sa
*rx_sa
;
1583 if (!tb_sa
[MACSEC_SA_ATTR_AN
])
1584 return ERR_PTR(-EINVAL
);
1586 *assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1587 if (*assoc_num
>= MACSEC_NUM_AN
)
1588 return ERR_PTR(-EINVAL
);
1590 rx_sc
= get_rxsc_from_nl(net
, attrs
, tb_rxsc
, devp
, secyp
);
1592 return ERR_CAST(rx_sc
);
1594 rx_sa
= rtnl_dereference(rx_sc
->sa
[*assoc_num
]);
1596 return ERR_PTR(-ENODEV
);
1602 static const struct nla_policy macsec_genl_policy
[NUM_MACSEC_ATTR
] = {
1603 [MACSEC_ATTR_IFINDEX
] = { .type
= NLA_U32
},
1604 [MACSEC_ATTR_RXSC_CONFIG
] = { .type
= NLA_NESTED
},
1605 [MACSEC_ATTR_SA_CONFIG
] = { .type
= NLA_NESTED
},
1606 [MACSEC_ATTR_OFFLOAD
] = { .type
= NLA_NESTED
},
1609 static const struct nla_policy macsec_genl_rxsc_policy
[NUM_MACSEC_RXSC_ATTR
] = {
1610 [MACSEC_RXSC_ATTR_SCI
] = { .type
= NLA_U64
},
1611 [MACSEC_RXSC_ATTR_ACTIVE
] = { .type
= NLA_U8
},
1614 static const struct nla_policy macsec_genl_sa_policy
[NUM_MACSEC_SA_ATTR
] = {
1615 [MACSEC_SA_ATTR_AN
] = { .type
= NLA_U8
},
1616 [MACSEC_SA_ATTR_ACTIVE
] = { .type
= NLA_U8
},
1617 [MACSEC_SA_ATTR_PN
] = NLA_POLICY_MIN_LEN(4),
1618 [MACSEC_SA_ATTR_KEYID
] = { .type
= NLA_BINARY
,
1619 .len
= MACSEC_KEYID_LEN
, },
1620 [MACSEC_SA_ATTR_KEY
] = { .type
= NLA_BINARY
,
1621 .len
= MACSEC_MAX_KEY_LEN
, },
1622 [MACSEC_SA_ATTR_SSCI
] = { .type
= NLA_U32
},
1623 [MACSEC_SA_ATTR_SALT
] = { .type
= NLA_BINARY
,
1624 .len
= MACSEC_SALT_LEN
, },
1627 static const struct nla_policy macsec_genl_offload_policy
[NUM_MACSEC_OFFLOAD_ATTR
] = {
1628 [MACSEC_OFFLOAD_ATTR_TYPE
] = { .type
= NLA_U8
},
1631 /* Offloads an operation to a device driver */
1632 static int macsec_offload(int (* const func
)(struct macsec_context
*),
1633 struct macsec_context
*ctx
)
1637 if (unlikely(!func
))
1640 if (ctx
->offload
== MACSEC_OFFLOAD_PHY
)
1641 mutex_lock(&ctx
->phydev
->lock
);
1643 /* Phase I: prepare. The drive should fail here if there are going to be
1644 * issues in the commit phase.
1646 ctx
->prepare
= true;
1651 /* Phase II: commit. This step cannot fail. */
1652 ctx
->prepare
= false;
1654 /* This should never happen: commit is not allowed to fail */
1656 WARN(1, "MACsec offloading commit failed (%d)\n", ret
);
1659 if (ctx
->offload
== MACSEC_OFFLOAD_PHY
)
1660 mutex_unlock(&ctx
->phydev
->lock
);
1665 static int parse_sa_config(struct nlattr
**attrs
, struct nlattr
**tb_sa
)
1667 if (!attrs
[MACSEC_ATTR_SA_CONFIG
])
1670 if (nla_parse_nested_deprecated(tb_sa
, MACSEC_SA_ATTR_MAX
, attrs
[MACSEC_ATTR_SA_CONFIG
], macsec_genl_sa_policy
, NULL
))
1676 static int parse_rxsc_config(struct nlattr
**attrs
, struct nlattr
**tb_rxsc
)
1678 if (!attrs
[MACSEC_ATTR_RXSC_CONFIG
])
1681 if (nla_parse_nested_deprecated(tb_rxsc
, MACSEC_RXSC_ATTR_MAX
, attrs
[MACSEC_ATTR_RXSC_CONFIG
], macsec_genl_rxsc_policy
, NULL
))
1687 static bool validate_add_rxsa(struct nlattr
**attrs
)
1689 if (!attrs
[MACSEC_SA_ATTR_AN
] ||
1690 !attrs
[MACSEC_SA_ATTR_KEY
] ||
1691 !attrs
[MACSEC_SA_ATTR_KEYID
])
1694 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_AN
]) >= MACSEC_NUM_AN
)
1697 if (attrs
[MACSEC_SA_ATTR_PN
] &&
1698 *(u64
*)nla_data(attrs
[MACSEC_SA_ATTR_PN
]) == 0)
1701 if (attrs
[MACSEC_SA_ATTR_ACTIVE
]) {
1702 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_ACTIVE
]) > 1)
1706 if (nla_len(attrs
[MACSEC_SA_ATTR_KEYID
]) != MACSEC_KEYID_LEN
)
1712 static int macsec_add_rxsa(struct sk_buff
*skb
, struct genl_info
*info
)
1714 struct net_device
*dev
;
1715 struct nlattr
**attrs
= info
->attrs
;
1716 struct macsec_secy
*secy
;
1717 struct macsec_rx_sc
*rx_sc
;
1718 struct macsec_rx_sa
*rx_sa
;
1719 unsigned char assoc_num
;
1721 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
1722 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
1725 if (!attrs
[MACSEC_ATTR_IFINDEX
])
1728 if (parse_sa_config(attrs
, tb_sa
))
1731 if (parse_rxsc_config(attrs
, tb_rxsc
))
1734 if (!validate_add_rxsa(tb_sa
))
1738 rx_sc
= get_rxsc_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, &dev
, &secy
);
1739 if (IS_ERR(rx_sc
)) {
1741 return PTR_ERR(rx_sc
);
1744 assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1746 if (nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]) != secy
->key_len
) {
1747 pr_notice("macsec: nl: add_rxsa: bad key length: %d != %d\n",
1748 nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]), secy
->key_len
);
1753 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
1754 if (nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
1755 pr_notice("macsec: nl: add_rxsa: bad pn length: %d != %d\n",
1756 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
1762 if (!tb_sa
[MACSEC_SA_ATTR_SSCI
] || !tb_sa
[MACSEC_SA_ATTR_SALT
]) {
1767 if (nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]) != MACSEC_SALT_LEN
) {
1768 pr_notice("macsec: nl: add_rxsa: bad salt length: %d != %d\n",
1769 nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]),
1770 MACSEC_SA_ATTR_SALT
);
1776 rx_sa
= rtnl_dereference(rx_sc
->sa
[assoc_num
]);
1782 rx_sa
= kmalloc(sizeof(*rx_sa
), GFP_KERNEL
);
1788 err
= init_rx_sa(rx_sa
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
1789 secy
->key_len
, secy
->icv_len
);
1796 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
1797 spin_lock_bh(&rx_sa
->lock
);
1798 rx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
1799 spin_unlock_bh(&rx_sa
->lock
);
1802 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
1803 rx_sa
->active
= !!nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
1807 /* If h/w offloading is available, propagate to the device */
1808 if (macsec_is_offloaded(netdev_priv(dev
))) {
1809 const struct macsec_ops
*ops
;
1810 struct macsec_context ctx
;
1812 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
1818 ctx
.sa
.assoc_num
= assoc_num
;
1819 ctx
.sa
.rx_sa
= rx_sa
;
1821 memcpy(ctx
.sa
.key
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
1824 err
= macsec_offload(ops
->mdo_add_rxsa
, &ctx
);
1830 rx_sa
->ssci
= nla_get_ssci(tb_sa
[MACSEC_SA_ATTR_SSCI
]);
1831 nla_memcpy(rx_sa
->key
.salt
.bytes
, tb_sa
[MACSEC_SA_ATTR_SALT
],
1835 nla_memcpy(rx_sa
->key
.id
, tb_sa
[MACSEC_SA_ATTR_KEYID
], MACSEC_KEYID_LEN
);
1836 rcu_assign_pointer(rx_sc
->sa
[assoc_num
], rx_sa
);
1848 static bool validate_add_rxsc(struct nlattr
**attrs
)
1850 if (!attrs
[MACSEC_RXSC_ATTR_SCI
])
1853 if (attrs
[MACSEC_RXSC_ATTR_ACTIVE
]) {
1854 if (nla_get_u8(attrs
[MACSEC_RXSC_ATTR_ACTIVE
]) > 1)
1861 static int macsec_add_rxsc(struct sk_buff
*skb
, struct genl_info
*info
)
1863 struct net_device
*dev
;
1864 sci_t sci
= MACSEC_UNDEF_SCI
;
1865 struct nlattr
**attrs
= info
->attrs
;
1866 struct macsec_rx_sc
*rx_sc
;
1867 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
1868 struct macsec_secy
*secy
;
1872 if (!attrs
[MACSEC_ATTR_IFINDEX
])
1875 if (parse_rxsc_config(attrs
, tb_rxsc
))
1878 if (!validate_add_rxsc(tb_rxsc
))
1882 dev
= get_dev_from_nl(genl_info_net(info
), attrs
);
1885 return PTR_ERR(dev
);
1888 secy
= &macsec_priv(dev
)->secy
;
1889 sci
= nla_get_sci(tb_rxsc
[MACSEC_RXSC_ATTR_SCI
]);
1891 rx_sc
= create_rx_sc(dev
, sci
);
1892 if (IS_ERR(rx_sc
)) {
1894 return PTR_ERR(rx_sc
);
1897 was_active
= rx_sc
->active
;
1898 if (tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
])
1899 rx_sc
->active
= !!nla_get_u8(tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
]);
1901 if (macsec_is_offloaded(netdev_priv(dev
))) {
1902 const struct macsec_ops
*ops
;
1903 struct macsec_context ctx
;
1905 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
1914 ret
= macsec_offload(ops
->mdo_add_rxsc
, &ctx
);
1924 rx_sc
->active
= was_active
;
1929 static bool validate_add_txsa(struct nlattr
**attrs
)
1931 if (!attrs
[MACSEC_SA_ATTR_AN
] ||
1932 !attrs
[MACSEC_SA_ATTR_PN
] ||
1933 !attrs
[MACSEC_SA_ATTR_KEY
] ||
1934 !attrs
[MACSEC_SA_ATTR_KEYID
])
1937 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_AN
]) >= MACSEC_NUM_AN
)
1940 if (nla_get_u32(attrs
[MACSEC_SA_ATTR_PN
]) == 0)
1943 if (attrs
[MACSEC_SA_ATTR_ACTIVE
]) {
1944 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_ACTIVE
]) > 1)
1948 if (nla_len(attrs
[MACSEC_SA_ATTR_KEYID
]) != MACSEC_KEYID_LEN
)
1954 static int macsec_add_txsa(struct sk_buff
*skb
, struct genl_info
*info
)
1956 struct net_device
*dev
;
1957 struct nlattr
**attrs
= info
->attrs
;
1958 struct macsec_secy
*secy
;
1959 struct macsec_tx_sc
*tx_sc
;
1960 struct macsec_tx_sa
*tx_sa
;
1961 unsigned char assoc_num
;
1963 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
1964 bool was_operational
;
1967 if (!attrs
[MACSEC_ATTR_IFINDEX
])
1970 if (parse_sa_config(attrs
, tb_sa
))
1973 if (!validate_add_txsa(tb_sa
))
1977 dev
= get_dev_from_nl(genl_info_net(info
), attrs
);
1980 return PTR_ERR(dev
);
1983 secy
= &macsec_priv(dev
)->secy
;
1984 tx_sc
= &secy
->tx_sc
;
1986 assoc_num
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_AN
]);
1988 if (nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]) != secy
->key_len
) {
1989 pr_notice("macsec: nl: add_txsa: bad key length: %d != %d\n",
1990 nla_len(tb_sa
[MACSEC_SA_ATTR_KEY
]), secy
->key_len
);
1995 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
1996 if (nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
1997 pr_notice("macsec: nl: add_txsa: bad pn length: %d != %d\n",
1998 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
2004 if (!tb_sa
[MACSEC_SA_ATTR_SSCI
] || !tb_sa
[MACSEC_SA_ATTR_SALT
]) {
2009 if (nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]) != MACSEC_SALT_LEN
) {
2010 pr_notice("macsec: nl: add_txsa: bad salt length: %d != %d\n",
2011 nla_len(tb_sa
[MACSEC_SA_ATTR_SALT
]),
2012 MACSEC_SA_ATTR_SALT
);
2018 tx_sa
= rtnl_dereference(tx_sc
->sa
[assoc_num
]);
2024 tx_sa
= kmalloc(sizeof(*tx_sa
), GFP_KERNEL
);
2030 err
= init_tx_sa(tx_sa
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
2031 secy
->key_len
, secy
->icv_len
);
2038 spin_lock_bh(&tx_sa
->lock
);
2039 tx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
2040 spin_unlock_bh(&tx_sa
->lock
);
2042 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
2043 tx_sa
->active
= !!nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
2045 was_operational
= secy
->operational
;
2046 if (assoc_num
== tx_sc
->encoding_sa
&& tx_sa
->active
)
2047 secy
->operational
= true;
2049 /* If h/w offloading is available, propagate to the device */
2050 if (macsec_is_offloaded(netdev_priv(dev
))) {
2051 const struct macsec_ops
*ops
;
2052 struct macsec_context ctx
;
2054 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2060 ctx
.sa
.assoc_num
= assoc_num
;
2061 ctx
.sa
.tx_sa
= tx_sa
;
2063 memcpy(ctx
.sa
.key
, nla_data(tb_sa
[MACSEC_SA_ATTR_KEY
]),
2066 err
= macsec_offload(ops
->mdo_add_txsa
, &ctx
);
2072 tx_sa
->ssci
= nla_get_ssci(tb_sa
[MACSEC_SA_ATTR_SSCI
]);
2073 nla_memcpy(tx_sa
->key
.salt
.bytes
, tb_sa
[MACSEC_SA_ATTR_SALT
],
2077 nla_memcpy(tx_sa
->key
.id
, tb_sa
[MACSEC_SA_ATTR_KEYID
], MACSEC_KEYID_LEN
);
2078 rcu_assign_pointer(tx_sc
->sa
[assoc_num
], tx_sa
);
2085 secy
->operational
= was_operational
;
2091 static int macsec_del_rxsa(struct sk_buff
*skb
, struct genl_info
*info
)
2093 struct nlattr
**attrs
= info
->attrs
;
2094 struct net_device
*dev
;
2095 struct macsec_secy
*secy
;
2096 struct macsec_rx_sc
*rx_sc
;
2097 struct macsec_rx_sa
*rx_sa
;
2099 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2100 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2103 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2106 if (parse_sa_config(attrs
, tb_sa
))
2109 if (parse_rxsc_config(attrs
, tb_rxsc
))
2113 rx_sa
= get_rxsa_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, tb_sa
,
2114 &dev
, &secy
, &rx_sc
, &assoc_num
);
2115 if (IS_ERR(rx_sa
)) {
2117 return PTR_ERR(rx_sa
);
2120 if (rx_sa
->active
) {
2125 /* If h/w offloading is available, propagate to the device */
2126 if (macsec_is_offloaded(netdev_priv(dev
))) {
2127 const struct macsec_ops
*ops
;
2128 struct macsec_context ctx
;
2130 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2136 ctx
.sa
.assoc_num
= assoc_num
;
2137 ctx
.sa
.rx_sa
= rx_sa
;
2140 ret
= macsec_offload(ops
->mdo_del_rxsa
, &ctx
);
2145 RCU_INIT_POINTER(rx_sc
->sa
[assoc_num
], NULL
);
2157 static int macsec_del_rxsc(struct sk_buff
*skb
, struct genl_info
*info
)
2159 struct nlattr
**attrs
= info
->attrs
;
2160 struct net_device
*dev
;
2161 struct macsec_secy
*secy
;
2162 struct macsec_rx_sc
*rx_sc
;
2164 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2167 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2170 if (parse_rxsc_config(attrs
, tb_rxsc
))
2173 if (!tb_rxsc
[MACSEC_RXSC_ATTR_SCI
])
2177 dev
= get_dev_from_nl(genl_info_net(info
), info
->attrs
);
2180 return PTR_ERR(dev
);
2183 secy
= &macsec_priv(dev
)->secy
;
2184 sci
= nla_get_sci(tb_rxsc
[MACSEC_RXSC_ATTR_SCI
]);
2186 rx_sc
= del_rx_sc(secy
, sci
);
2192 /* If h/w offloading is available, propagate to the device */
2193 if (macsec_is_offloaded(netdev_priv(dev
))) {
2194 const struct macsec_ops
*ops
;
2195 struct macsec_context ctx
;
2197 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2205 ret
= macsec_offload(ops
->mdo_del_rxsc
, &ctx
);
2220 static int macsec_del_txsa(struct sk_buff
*skb
, struct genl_info
*info
)
2222 struct nlattr
**attrs
= info
->attrs
;
2223 struct net_device
*dev
;
2224 struct macsec_secy
*secy
;
2225 struct macsec_tx_sc
*tx_sc
;
2226 struct macsec_tx_sa
*tx_sa
;
2228 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2231 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2234 if (parse_sa_config(attrs
, tb_sa
))
2238 tx_sa
= get_txsa_from_nl(genl_info_net(info
), attrs
, tb_sa
,
2239 &dev
, &secy
, &tx_sc
, &assoc_num
);
2240 if (IS_ERR(tx_sa
)) {
2242 return PTR_ERR(tx_sa
);
2245 if (tx_sa
->active
) {
2250 /* If h/w offloading is available, propagate to the device */
2251 if (macsec_is_offloaded(netdev_priv(dev
))) {
2252 const struct macsec_ops
*ops
;
2253 struct macsec_context ctx
;
2255 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2261 ctx
.sa
.assoc_num
= assoc_num
;
2262 ctx
.sa
.tx_sa
= tx_sa
;
2265 ret
= macsec_offload(ops
->mdo_del_txsa
, &ctx
);
2270 RCU_INIT_POINTER(tx_sc
->sa
[assoc_num
], NULL
);
2282 static bool validate_upd_sa(struct nlattr
**attrs
)
2284 if (!attrs
[MACSEC_SA_ATTR_AN
] ||
2285 attrs
[MACSEC_SA_ATTR_KEY
] ||
2286 attrs
[MACSEC_SA_ATTR_KEYID
] ||
2287 attrs
[MACSEC_SA_ATTR_SSCI
] ||
2288 attrs
[MACSEC_SA_ATTR_SALT
])
2291 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_AN
]) >= MACSEC_NUM_AN
)
2294 if (attrs
[MACSEC_SA_ATTR_PN
] && nla_get_u32(attrs
[MACSEC_SA_ATTR_PN
]) == 0)
2297 if (attrs
[MACSEC_SA_ATTR_ACTIVE
]) {
2298 if (nla_get_u8(attrs
[MACSEC_SA_ATTR_ACTIVE
]) > 1)
2305 static int macsec_upd_txsa(struct sk_buff
*skb
, struct genl_info
*info
)
2307 struct nlattr
**attrs
= info
->attrs
;
2308 struct net_device
*dev
;
2309 struct macsec_secy
*secy
;
2310 struct macsec_tx_sc
*tx_sc
;
2311 struct macsec_tx_sa
*tx_sa
;
2313 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2314 bool was_operational
, was_active
;
2320 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2323 if (parse_sa_config(attrs
, tb_sa
))
2326 if (!validate_upd_sa(tb_sa
))
2330 tx_sa
= get_txsa_from_nl(genl_info_net(info
), attrs
, tb_sa
,
2331 &dev
, &secy
, &tx_sc
, &assoc_num
);
2332 if (IS_ERR(tx_sa
)) {
2334 return PTR_ERR(tx_sa
);
2337 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2340 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
2341 if (nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
2342 pr_notice("macsec: nl: upd_txsa: bad pn length: %d != %d\n",
2343 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
2348 spin_lock_bh(&tx_sa
->lock
);
2349 prev_pn
= tx_sa
->next_pn_halves
;
2350 tx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
2351 spin_unlock_bh(&tx_sa
->lock
);
2354 was_active
= tx_sa
->active
;
2355 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
2356 tx_sa
->active
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
2358 was_operational
= secy
->operational
;
2359 if (assoc_num
== tx_sc
->encoding_sa
)
2360 secy
->operational
= tx_sa
->active
;
2362 /* If h/w offloading is available, propagate to the device */
2363 if (macsec_is_offloaded(netdev_priv(dev
))) {
2364 const struct macsec_ops
*ops
;
2365 struct macsec_context ctx
;
2367 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2373 ctx
.sa
.assoc_num
= assoc_num
;
2374 ctx
.sa
.tx_sa
= tx_sa
;
2377 ret
= macsec_offload(ops
->mdo_upd_txsa
, &ctx
);
2387 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2388 spin_lock_bh(&tx_sa
->lock
);
2389 tx_sa
->next_pn_halves
= prev_pn
;
2390 spin_unlock_bh(&tx_sa
->lock
);
2392 tx_sa
->active
= was_active
;
2393 secy
->operational
= was_operational
;
2398 static int macsec_upd_rxsa(struct sk_buff
*skb
, struct genl_info
*info
)
2400 struct nlattr
**attrs
= info
->attrs
;
2401 struct net_device
*dev
;
2402 struct macsec_secy
*secy
;
2403 struct macsec_rx_sc
*rx_sc
;
2404 struct macsec_rx_sa
*rx_sa
;
2406 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2407 struct nlattr
*tb_sa
[MACSEC_SA_ATTR_MAX
+ 1];
2414 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2417 if (parse_rxsc_config(attrs
, tb_rxsc
))
2420 if (parse_sa_config(attrs
, tb_sa
))
2423 if (!validate_upd_sa(tb_sa
))
2427 rx_sa
= get_rxsa_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, tb_sa
,
2428 &dev
, &secy
, &rx_sc
, &assoc_num
);
2429 if (IS_ERR(rx_sa
)) {
2431 return PTR_ERR(rx_sa
);
2434 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2437 pn_len
= secy
->xpn
? MACSEC_XPN_PN_LEN
: MACSEC_DEFAULT_PN_LEN
;
2438 if (nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]) != pn_len
) {
2439 pr_notice("macsec: nl: upd_rxsa: bad pn length: %d != %d\n",
2440 nla_len(tb_sa
[MACSEC_SA_ATTR_PN
]), pn_len
);
2445 spin_lock_bh(&rx_sa
->lock
);
2446 prev_pn
= rx_sa
->next_pn_halves
;
2447 rx_sa
->next_pn
= nla_get_u64(tb_sa
[MACSEC_SA_ATTR_PN
]);
2448 spin_unlock_bh(&rx_sa
->lock
);
2451 was_active
= rx_sa
->active
;
2452 if (tb_sa
[MACSEC_SA_ATTR_ACTIVE
])
2453 rx_sa
->active
= nla_get_u8(tb_sa
[MACSEC_SA_ATTR_ACTIVE
]);
2455 /* If h/w offloading is available, propagate to the device */
2456 if (macsec_is_offloaded(netdev_priv(dev
))) {
2457 const struct macsec_ops
*ops
;
2458 struct macsec_context ctx
;
2460 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2466 ctx
.sa
.assoc_num
= assoc_num
;
2467 ctx
.sa
.rx_sa
= rx_sa
;
2470 ret
= macsec_offload(ops
->mdo_upd_rxsa
, &ctx
);
2479 if (tb_sa
[MACSEC_SA_ATTR_PN
]) {
2480 spin_lock_bh(&rx_sa
->lock
);
2481 rx_sa
->next_pn_halves
= prev_pn
;
2482 spin_unlock_bh(&rx_sa
->lock
);
2484 rx_sa
->active
= was_active
;
2489 static int macsec_upd_rxsc(struct sk_buff
*skb
, struct genl_info
*info
)
2491 struct nlattr
**attrs
= info
->attrs
;
2492 struct net_device
*dev
;
2493 struct macsec_secy
*secy
;
2494 struct macsec_rx_sc
*rx_sc
;
2495 struct nlattr
*tb_rxsc
[MACSEC_RXSC_ATTR_MAX
+ 1];
2496 unsigned int prev_n_rx_sc
;
2500 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2503 if (parse_rxsc_config(attrs
, tb_rxsc
))
2506 if (!validate_add_rxsc(tb_rxsc
))
2510 rx_sc
= get_rxsc_from_nl(genl_info_net(info
), attrs
, tb_rxsc
, &dev
, &secy
);
2511 if (IS_ERR(rx_sc
)) {
2513 return PTR_ERR(rx_sc
);
2516 was_active
= rx_sc
->active
;
2517 prev_n_rx_sc
= secy
->n_rx_sc
;
2518 if (tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
]) {
2519 bool new = !!nla_get_u8(tb_rxsc
[MACSEC_RXSC_ATTR_ACTIVE
]);
2521 if (rx_sc
->active
!= new)
2522 secy
->n_rx_sc
+= new ? 1 : -1;
2524 rx_sc
->active
= new;
2527 /* If h/w offloading is available, propagate to the device */
2528 if (macsec_is_offloaded(netdev_priv(dev
))) {
2529 const struct macsec_ops
*ops
;
2530 struct macsec_context ctx
;
2532 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
2541 ret
= macsec_offload(ops
->mdo_upd_rxsc
, &ctx
);
2551 secy
->n_rx_sc
= prev_n_rx_sc
;
2552 rx_sc
->active
= was_active
;
2557 static bool macsec_is_configured(struct macsec_dev
*macsec
)
2559 struct macsec_secy
*secy
= &macsec
->secy
;
2560 struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
2563 if (secy
->n_rx_sc
> 0)
2566 for (i
= 0; i
< MACSEC_NUM_AN
; i
++)
2573 static int macsec_upd_offload(struct sk_buff
*skb
, struct genl_info
*info
)
2575 struct nlattr
*tb_offload
[MACSEC_OFFLOAD_ATTR_MAX
+ 1];
2576 enum macsec_offload offload
, prev_offload
;
2577 int (*func
)(struct macsec_context
*ctx
);
2578 struct nlattr
**attrs
= info
->attrs
;
2579 struct net_device
*dev
;
2580 const struct macsec_ops
*ops
;
2581 struct macsec_context ctx
;
2582 struct macsec_dev
*macsec
;
2585 if (!attrs
[MACSEC_ATTR_IFINDEX
])
2588 if (!attrs
[MACSEC_ATTR_OFFLOAD
])
2591 if (nla_parse_nested_deprecated(tb_offload
, MACSEC_OFFLOAD_ATTR_MAX
,
2592 attrs
[MACSEC_ATTR_OFFLOAD
],
2593 macsec_genl_offload_policy
, NULL
))
2596 dev
= get_dev_from_nl(genl_info_net(info
), attrs
);
2598 return PTR_ERR(dev
);
2599 macsec
= macsec_priv(dev
);
2601 if (!tb_offload
[MACSEC_OFFLOAD_ATTR_TYPE
])
2604 offload
= nla_get_u8(tb_offload
[MACSEC_OFFLOAD_ATTR_TYPE
]);
2605 if (macsec
->offload
== offload
)
2608 /* Check if the offloading mode is supported by the underlying layers */
2609 if (offload
!= MACSEC_OFFLOAD_OFF
&&
2610 !macsec_check_offload(offload
, macsec
))
2613 /* Check if the net device is busy. */
2614 if (netif_running(dev
))
2619 prev_offload
= macsec
->offload
;
2620 macsec
->offload
= offload
;
2622 /* Check if the device already has rules configured: we do not support
2625 if (macsec_is_configured(macsec
)) {
2630 ops
= __macsec_get_ops(offload
== MACSEC_OFFLOAD_OFF
? prev_offload
: offload
,
2637 if (prev_offload
== MACSEC_OFFLOAD_OFF
)
2638 func
= ops
->mdo_add_secy
;
2640 func
= ops
->mdo_del_secy
;
2642 ctx
.secy
= &macsec
->secy
;
2643 ret
= macsec_offload(func
, &ctx
);
2647 /* Force features update, since they are different for SW MACSec and
2648 * HW offloading cases.
2650 netdev_update_features(dev
);
2656 macsec
->offload
= prev_offload
;
2662 static void get_tx_sa_stats(struct net_device
*dev
, int an
,
2663 struct macsec_tx_sa
*tx_sa
,
2664 struct macsec_tx_sa_stats
*sum
)
2666 struct macsec_dev
*macsec
= macsec_priv(dev
);
2669 /* If h/w offloading is available, propagate to the device */
2670 if (macsec_is_offloaded(macsec
)) {
2671 const struct macsec_ops
*ops
;
2672 struct macsec_context ctx
;
2674 ops
= macsec_get_ops(macsec
, &ctx
);
2676 ctx
.sa
.assoc_num
= an
;
2677 ctx
.sa
.tx_sa
= tx_sa
;
2678 ctx
.stats
.tx_sa_stats
= sum
;
2679 ctx
.secy
= &macsec_priv(dev
)->secy
;
2680 macsec_offload(ops
->mdo_get_tx_sa_stats
, &ctx
);
2685 for_each_possible_cpu(cpu
) {
2686 const struct macsec_tx_sa_stats
*stats
=
2687 per_cpu_ptr(tx_sa
->stats
, cpu
);
2689 sum
->OutPktsProtected
+= stats
->OutPktsProtected
;
2690 sum
->OutPktsEncrypted
+= stats
->OutPktsEncrypted
;
2694 static int copy_tx_sa_stats(struct sk_buff
*skb
, struct macsec_tx_sa_stats
*sum
)
2696 if (nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_OUT_PKTS_PROTECTED
,
2697 sum
->OutPktsProtected
) ||
2698 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_OUT_PKTS_ENCRYPTED
,
2699 sum
->OutPktsEncrypted
))
2705 static void get_rx_sa_stats(struct net_device
*dev
,
2706 struct macsec_rx_sc
*rx_sc
, int an
,
2707 struct macsec_rx_sa
*rx_sa
,
2708 struct macsec_rx_sa_stats
*sum
)
2710 struct macsec_dev
*macsec
= macsec_priv(dev
);
2713 /* If h/w offloading is available, propagate to the device */
2714 if (macsec_is_offloaded(macsec
)) {
2715 const struct macsec_ops
*ops
;
2716 struct macsec_context ctx
;
2718 ops
= macsec_get_ops(macsec
, &ctx
);
2720 ctx
.sa
.assoc_num
= an
;
2721 ctx
.sa
.rx_sa
= rx_sa
;
2722 ctx
.stats
.rx_sa_stats
= sum
;
2723 ctx
.secy
= &macsec_priv(dev
)->secy
;
2725 macsec_offload(ops
->mdo_get_rx_sa_stats
, &ctx
);
2730 for_each_possible_cpu(cpu
) {
2731 const struct macsec_rx_sa_stats
*stats
=
2732 per_cpu_ptr(rx_sa
->stats
, cpu
);
2734 sum
->InPktsOK
+= stats
->InPktsOK
;
2735 sum
->InPktsInvalid
+= stats
->InPktsInvalid
;
2736 sum
->InPktsNotValid
+= stats
->InPktsNotValid
;
2737 sum
->InPktsNotUsingSA
+= stats
->InPktsNotUsingSA
;
2738 sum
->InPktsUnusedSA
+= stats
->InPktsUnusedSA
;
2742 static int copy_rx_sa_stats(struct sk_buff
*skb
,
2743 struct macsec_rx_sa_stats
*sum
)
2745 if (nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_OK
, sum
->InPktsOK
) ||
2746 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_INVALID
,
2747 sum
->InPktsInvalid
) ||
2748 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_VALID
,
2749 sum
->InPktsNotValid
) ||
2750 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_NOT_USING_SA
,
2751 sum
->InPktsNotUsingSA
) ||
2752 nla_put_u32(skb
, MACSEC_SA_STATS_ATTR_IN_PKTS_UNUSED_SA
,
2753 sum
->InPktsUnusedSA
))
2759 static void get_rx_sc_stats(struct net_device
*dev
,
2760 struct macsec_rx_sc
*rx_sc
,
2761 struct macsec_rx_sc_stats
*sum
)
2763 struct macsec_dev
*macsec
= macsec_priv(dev
);
2766 /* If h/w offloading is available, propagate to the device */
2767 if (macsec_is_offloaded(macsec
)) {
2768 const struct macsec_ops
*ops
;
2769 struct macsec_context ctx
;
2771 ops
= macsec_get_ops(macsec
, &ctx
);
2773 ctx
.stats
.rx_sc_stats
= sum
;
2774 ctx
.secy
= &macsec_priv(dev
)->secy
;
2776 macsec_offload(ops
->mdo_get_rx_sc_stats
, &ctx
);
2781 for_each_possible_cpu(cpu
) {
2782 const struct pcpu_rx_sc_stats
*stats
;
2783 struct macsec_rx_sc_stats tmp
;
2786 stats
= per_cpu_ptr(rx_sc
->stats
, cpu
);
2788 start
= u64_stats_fetch_begin_irq(&stats
->syncp
);
2789 memcpy(&tmp
, &stats
->stats
, sizeof(tmp
));
2790 } while (u64_stats_fetch_retry_irq(&stats
->syncp
, start
));
2792 sum
->InOctetsValidated
+= tmp
.InOctetsValidated
;
2793 sum
->InOctetsDecrypted
+= tmp
.InOctetsDecrypted
;
2794 sum
->InPktsUnchecked
+= tmp
.InPktsUnchecked
;
2795 sum
->InPktsDelayed
+= tmp
.InPktsDelayed
;
2796 sum
->InPktsOK
+= tmp
.InPktsOK
;
2797 sum
->InPktsInvalid
+= tmp
.InPktsInvalid
;
2798 sum
->InPktsLate
+= tmp
.InPktsLate
;
2799 sum
->InPktsNotValid
+= tmp
.InPktsNotValid
;
2800 sum
->InPktsNotUsingSA
+= tmp
.InPktsNotUsingSA
;
2801 sum
->InPktsUnusedSA
+= tmp
.InPktsUnusedSA
;
2805 static int copy_rx_sc_stats(struct sk_buff
*skb
, struct macsec_rx_sc_stats
*sum
)
2807 if (nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_OCTETS_VALIDATED
,
2808 sum
->InOctetsValidated
,
2809 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2810 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_OCTETS_DECRYPTED
,
2811 sum
->InOctetsDecrypted
,
2812 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2813 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNCHECKED
,
2814 sum
->InPktsUnchecked
,
2815 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2816 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_DELAYED
,
2818 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2819 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_OK
,
2821 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2822 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_INVALID
,
2824 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2825 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_LATE
,
2827 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2828 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_VALID
,
2829 sum
->InPktsNotValid
,
2830 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2831 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_NOT_USING_SA
,
2832 sum
->InPktsNotUsingSA
,
2833 MACSEC_RXSC_STATS_ATTR_PAD
) ||
2834 nla_put_u64_64bit(skb
, MACSEC_RXSC_STATS_ATTR_IN_PKTS_UNUSED_SA
,
2835 sum
->InPktsUnusedSA
,
2836 MACSEC_RXSC_STATS_ATTR_PAD
))
2842 static void get_tx_sc_stats(struct net_device
*dev
,
2843 struct macsec_tx_sc_stats
*sum
)
2845 struct macsec_dev
*macsec
= macsec_priv(dev
);
2848 /* If h/w offloading is available, propagate to the device */
2849 if (macsec_is_offloaded(macsec
)) {
2850 const struct macsec_ops
*ops
;
2851 struct macsec_context ctx
;
2853 ops
= macsec_get_ops(macsec
, &ctx
);
2855 ctx
.stats
.tx_sc_stats
= sum
;
2856 ctx
.secy
= &macsec_priv(dev
)->secy
;
2857 macsec_offload(ops
->mdo_get_tx_sc_stats
, &ctx
);
2862 for_each_possible_cpu(cpu
) {
2863 const struct pcpu_tx_sc_stats
*stats
;
2864 struct macsec_tx_sc_stats tmp
;
2867 stats
= per_cpu_ptr(macsec_priv(dev
)->secy
.tx_sc
.stats
, cpu
);
2869 start
= u64_stats_fetch_begin_irq(&stats
->syncp
);
2870 memcpy(&tmp
, &stats
->stats
, sizeof(tmp
));
2871 } while (u64_stats_fetch_retry_irq(&stats
->syncp
, start
));
2873 sum
->OutPktsProtected
+= tmp
.OutPktsProtected
;
2874 sum
->OutPktsEncrypted
+= tmp
.OutPktsEncrypted
;
2875 sum
->OutOctetsProtected
+= tmp
.OutOctetsProtected
;
2876 sum
->OutOctetsEncrypted
+= tmp
.OutOctetsEncrypted
;
2880 static int copy_tx_sc_stats(struct sk_buff
*skb
, struct macsec_tx_sc_stats
*sum
)
2882 if (nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_PKTS_PROTECTED
,
2883 sum
->OutPktsProtected
,
2884 MACSEC_TXSC_STATS_ATTR_PAD
) ||
2885 nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_PKTS_ENCRYPTED
,
2886 sum
->OutPktsEncrypted
,
2887 MACSEC_TXSC_STATS_ATTR_PAD
) ||
2888 nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_PROTECTED
,
2889 sum
->OutOctetsProtected
,
2890 MACSEC_TXSC_STATS_ATTR_PAD
) ||
2891 nla_put_u64_64bit(skb
, MACSEC_TXSC_STATS_ATTR_OUT_OCTETS_ENCRYPTED
,
2892 sum
->OutOctetsEncrypted
,
2893 MACSEC_TXSC_STATS_ATTR_PAD
))
2899 static void get_secy_stats(struct net_device
*dev
, struct macsec_dev_stats
*sum
)
2901 struct macsec_dev
*macsec
= macsec_priv(dev
);
2904 /* If h/w offloading is available, propagate to the device */
2905 if (macsec_is_offloaded(macsec
)) {
2906 const struct macsec_ops
*ops
;
2907 struct macsec_context ctx
;
2909 ops
= macsec_get_ops(macsec
, &ctx
);
2911 ctx
.stats
.dev_stats
= sum
;
2912 ctx
.secy
= &macsec_priv(dev
)->secy
;
2913 macsec_offload(ops
->mdo_get_dev_stats
, &ctx
);
2918 for_each_possible_cpu(cpu
) {
2919 const struct pcpu_secy_stats
*stats
;
2920 struct macsec_dev_stats tmp
;
2923 stats
= per_cpu_ptr(macsec_priv(dev
)->stats
, cpu
);
2925 start
= u64_stats_fetch_begin_irq(&stats
->syncp
);
2926 memcpy(&tmp
, &stats
->stats
, sizeof(tmp
));
2927 } while (u64_stats_fetch_retry_irq(&stats
->syncp
, start
));
2929 sum
->OutPktsUntagged
+= tmp
.OutPktsUntagged
;
2930 sum
->InPktsUntagged
+= tmp
.InPktsUntagged
;
2931 sum
->OutPktsTooLong
+= tmp
.OutPktsTooLong
;
2932 sum
->InPktsNoTag
+= tmp
.InPktsNoTag
;
2933 sum
->InPktsBadTag
+= tmp
.InPktsBadTag
;
2934 sum
->InPktsUnknownSCI
+= tmp
.InPktsUnknownSCI
;
2935 sum
->InPktsNoSCI
+= tmp
.InPktsNoSCI
;
2936 sum
->InPktsOverrun
+= tmp
.InPktsOverrun
;
2940 static int copy_secy_stats(struct sk_buff
*skb
, struct macsec_dev_stats
*sum
)
2942 if (nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_OUT_PKTS_UNTAGGED
,
2943 sum
->OutPktsUntagged
,
2944 MACSEC_SECY_STATS_ATTR_PAD
) ||
2945 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_UNTAGGED
,
2946 sum
->InPktsUntagged
,
2947 MACSEC_SECY_STATS_ATTR_PAD
) ||
2948 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_OUT_PKTS_TOO_LONG
,
2949 sum
->OutPktsTooLong
,
2950 MACSEC_SECY_STATS_ATTR_PAD
) ||
2951 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_TAG
,
2953 MACSEC_SECY_STATS_ATTR_PAD
) ||
2954 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_BAD_TAG
,
2956 MACSEC_SECY_STATS_ATTR_PAD
) ||
2957 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_UNKNOWN_SCI
,
2958 sum
->InPktsUnknownSCI
,
2959 MACSEC_SECY_STATS_ATTR_PAD
) ||
2960 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_NO_SCI
,
2962 MACSEC_SECY_STATS_ATTR_PAD
) ||
2963 nla_put_u64_64bit(skb
, MACSEC_SECY_STATS_ATTR_IN_PKTS_OVERRUN
,
2965 MACSEC_SECY_STATS_ATTR_PAD
))
2971 static int nla_put_secy(struct macsec_secy
*secy
, struct sk_buff
*skb
)
2973 struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
2974 struct nlattr
*secy_nest
= nla_nest_start_noflag(skb
,
2981 switch (secy
->key_len
) {
2982 case MACSEC_GCM_AES_128_SAK_LEN
:
2983 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_128
: MACSEC_DEFAULT_CIPHER_ID
;
2985 case MACSEC_GCM_AES_256_SAK_LEN
:
2986 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_256
: MACSEC_CIPHER_ID_GCM_AES_256
;
2992 if (nla_put_sci(skb
, MACSEC_SECY_ATTR_SCI
, secy
->sci
,
2993 MACSEC_SECY_ATTR_PAD
) ||
2994 nla_put_u64_64bit(skb
, MACSEC_SECY_ATTR_CIPHER_SUITE
,
2995 csid
, MACSEC_SECY_ATTR_PAD
) ||
2996 nla_put_u8(skb
, MACSEC_SECY_ATTR_ICV_LEN
, secy
->icv_len
) ||
2997 nla_put_u8(skb
, MACSEC_SECY_ATTR_OPER
, secy
->operational
) ||
2998 nla_put_u8(skb
, MACSEC_SECY_ATTR_PROTECT
, secy
->protect_frames
) ||
2999 nla_put_u8(skb
, MACSEC_SECY_ATTR_REPLAY
, secy
->replay_protect
) ||
3000 nla_put_u8(skb
, MACSEC_SECY_ATTR_VALIDATE
, secy
->validate_frames
) ||
3001 nla_put_u8(skb
, MACSEC_SECY_ATTR_ENCRYPT
, tx_sc
->encrypt
) ||
3002 nla_put_u8(skb
, MACSEC_SECY_ATTR_INC_SCI
, tx_sc
->send_sci
) ||
3003 nla_put_u8(skb
, MACSEC_SECY_ATTR_ES
, tx_sc
->end_station
) ||
3004 nla_put_u8(skb
, MACSEC_SECY_ATTR_SCB
, tx_sc
->scb
) ||
3005 nla_put_u8(skb
, MACSEC_SECY_ATTR_ENCODING_SA
, tx_sc
->encoding_sa
))
3008 if (secy
->replay_protect
) {
3009 if (nla_put_u32(skb
, MACSEC_SECY_ATTR_WINDOW
, secy
->replay_window
))
3013 nla_nest_end(skb
, secy_nest
);
3017 nla_nest_cancel(skb
, secy_nest
);
3021 static noinline_for_stack
int
3022 dump_secy(struct macsec_secy
*secy
, struct net_device
*dev
,
3023 struct sk_buff
*skb
, struct netlink_callback
*cb
)
3025 struct macsec_tx_sc_stats tx_sc_stats
= {0, };
3026 struct macsec_tx_sa_stats tx_sa_stats
= {0, };
3027 struct macsec_rx_sc_stats rx_sc_stats
= {0, };
3028 struct macsec_rx_sa_stats rx_sa_stats
= {0, };
3029 struct macsec_dev
*macsec
= netdev_priv(dev
);
3030 struct macsec_dev_stats dev_stats
= {0, };
3031 struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
3032 struct nlattr
*txsa_list
, *rxsc_list
;
3033 struct macsec_rx_sc
*rx_sc
;
3034 struct nlattr
*attr
;
3038 hdr
= genlmsg_put(skb
, NETLINK_CB(cb
->skb
).portid
, cb
->nlh
->nlmsg_seq
,
3039 &macsec_fam
, NLM_F_MULTI
, MACSEC_CMD_GET_TXSC
);
3043 genl_dump_check_consistent(cb
, hdr
);
3045 if (nla_put_u32(skb
, MACSEC_ATTR_IFINDEX
, dev
->ifindex
))
3046 goto nla_put_failure
;
3048 attr
= nla_nest_start_noflag(skb
, MACSEC_ATTR_OFFLOAD
);
3050 goto nla_put_failure
;
3051 if (nla_put_u8(skb
, MACSEC_OFFLOAD_ATTR_TYPE
, macsec
->offload
))
3052 goto nla_put_failure
;
3053 nla_nest_end(skb
, attr
);
3055 if (nla_put_secy(secy
, skb
))
3056 goto nla_put_failure
;
3058 attr
= nla_nest_start_noflag(skb
, MACSEC_ATTR_TXSC_STATS
);
3060 goto nla_put_failure
;
3062 get_tx_sc_stats(dev
, &tx_sc_stats
);
3063 if (copy_tx_sc_stats(skb
, &tx_sc_stats
)) {
3064 nla_nest_cancel(skb
, attr
);
3065 goto nla_put_failure
;
3067 nla_nest_end(skb
, attr
);
3069 attr
= nla_nest_start_noflag(skb
, MACSEC_ATTR_SECY_STATS
);
3071 goto nla_put_failure
;
3072 get_secy_stats(dev
, &dev_stats
);
3073 if (copy_secy_stats(skb
, &dev_stats
)) {
3074 nla_nest_cancel(skb
, attr
);
3075 goto nla_put_failure
;
3077 nla_nest_end(skb
, attr
);
3079 txsa_list
= nla_nest_start_noflag(skb
, MACSEC_ATTR_TXSA_LIST
);
3081 goto nla_put_failure
;
3082 for (i
= 0, j
= 1; i
< MACSEC_NUM_AN
; i
++) {
3083 struct macsec_tx_sa
*tx_sa
= rtnl_dereference(tx_sc
->sa
[i
]);
3084 struct nlattr
*txsa_nest
;
3091 txsa_nest
= nla_nest_start_noflag(skb
, j
++);
3093 nla_nest_cancel(skb
, txsa_list
);
3094 goto nla_put_failure
;
3097 attr
= nla_nest_start_noflag(skb
, MACSEC_SA_ATTR_STATS
);
3099 nla_nest_cancel(skb
, txsa_nest
);
3100 nla_nest_cancel(skb
, txsa_list
);
3101 goto nla_put_failure
;
3103 memset(&tx_sa_stats
, 0, sizeof(tx_sa_stats
));
3104 get_tx_sa_stats(dev
, i
, tx_sa
, &tx_sa_stats
);
3105 if (copy_tx_sa_stats(skb
, &tx_sa_stats
)) {
3106 nla_nest_cancel(skb
, attr
);
3107 nla_nest_cancel(skb
, txsa_nest
);
3108 nla_nest_cancel(skb
, txsa_list
);
3109 goto nla_put_failure
;
3111 nla_nest_end(skb
, attr
);
3114 pn
= tx_sa
->next_pn
;
3115 pn_len
= MACSEC_XPN_PN_LEN
;
3117 pn
= tx_sa
->next_pn_halves
.lower
;
3118 pn_len
= MACSEC_DEFAULT_PN_LEN
;
3121 if (nla_put_u8(skb
, MACSEC_SA_ATTR_AN
, i
) ||
3122 nla_put(skb
, MACSEC_SA_ATTR_PN
, pn_len
, &pn
) ||
3123 nla_put(skb
, MACSEC_SA_ATTR_KEYID
, MACSEC_KEYID_LEN
, tx_sa
->key
.id
) ||
3124 (secy
->xpn
&& nla_put_ssci(skb
, MACSEC_SA_ATTR_SSCI
, tx_sa
->ssci
)) ||
3125 nla_put_u8(skb
, MACSEC_SA_ATTR_ACTIVE
, tx_sa
->active
)) {
3126 nla_nest_cancel(skb
, txsa_nest
);
3127 nla_nest_cancel(skb
, txsa_list
);
3128 goto nla_put_failure
;
3131 nla_nest_end(skb
, txsa_nest
);
3133 nla_nest_end(skb
, txsa_list
);
3135 rxsc_list
= nla_nest_start_noflag(skb
, MACSEC_ATTR_RXSC_LIST
);
3137 goto nla_put_failure
;
3140 for_each_rxsc_rtnl(secy
, rx_sc
) {
3142 struct nlattr
*rxsa_list
;
3143 struct nlattr
*rxsc_nest
= nla_nest_start_noflag(skb
, j
++);
3146 nla_nest_cancel(skb
, rxsc_list
);
3147 goto nla_put_failure
;
3150 if (nla_put_u8(skb
, MACSEC_RXSC_ATTR_ACTIVE
, rx_sc
->active
) ||
3151 nla_put_sci(skb
, MACSEC_RXSC_ATTR_SCI
, rx_sc
->sci
,
3152 MACSEC_RXSC_ATTR_PAD
)) {
3153 nla_nest_cancel(skb
, rxsc_nest
);
3154 nla_nest_cancel(skb
, rxsc_list
);
3155 goto nla_put_failure
;
3158 attr
= nla_nest_start_noflag(skb
, MACSEC_RXSC_ATTR_STATS
);
3160 nla_nest_cancel(skb
, rxsc_nest
);
3161 nla_nest_cancel(skb
, rxsc_list
);
3162 goto nla_put_failure
;
3164 memset(&rx_sc_stats
, 0, sizeof(rx_sc_stats
));
3165 get_rx_sc_stats(dev
, rx_sc
, &rx_sc_stats
);
3166 if (copy_rx_sc_stats(skb
, &rx_sc_stats
)) {
3167 nla_nest_cancel(skb
, attr
);
3168 nla_nest_cancel(skb
, rxsc_nest
);
3169 nla_nest_cancel(skb
, rxsc_list
);
3170 goto nla_put_failure
;
3172 nla_nest_end(skb
, attr
);
3174 rxsa_list
= nla_nest_start_noflag(skb
,
3175 MACSEC_RXSC_ATTR_SA_LIST
);
3177 nla_nest_cancel(skb
, rxsc_nest
);
3178 nla_nest_cancel(skb
, rxsc_list
);
3179 goto nla_put_failure
;
3182 for (i
= 0, k
= 1; i
< MACSEC_NUM_AN
; i
++) {
3183 struct macsec_rx_sa
*rx_sa
= rtnl_dereference(rx_sc
->sa
[i
]);
3184 struct nlattr
*rxsa_nest
;
3191 rxsa_nest
= nla_nest_start_noflag(skb
, k
++);
3193 nla_nest_cancel(skb
, rxsa_list
);
3194 nla_nest_cancel(skb
, rxsc_nest
);
3195 nla_nest_cancel(skb
, rxsc_list
);
3196 goto nla_put_failure
;
3199 attr
= nla_nest_start_noflag(skb
,
3200 MACSEC_SA_ATTR_STATS
);
3202 nla_nest_cancel(skb
, rxsa_list
);
3203 nla_nest_cancel(skb
, rxsc_nest
);
3204 nla_nest_cancel(skb
, rxsc_list
);
3205 goto nla_put_failure
;
3207 memset(&rx_sa_stats
, 0, sizeof(rx_sa_stats
));
3208 get_rx_sa_stats(dev
, rx_sc
, i
, rx_sa
, &rx_sa_stats
);
3209 if (copy_rx_sa_stats(skb
, &rx_sa_stats
)) {
3210 nla_nest_cancel(skb
, attr
);
3211 nla_nest_cancel(skb
, rxsa_list
);
3212 nla_nest_cancel(skb
, rxsc_nest
);
3213 nla_nest_cancel(skb
, rxsc_list
);
3214 goto nla_put_failure
;
3216 nla_nest_end(skb
, attr
);
3219 pn
= rx_sa
->next_pn
;
3220 pn_len
= MACSEC_XPN_PN_LEN
;
3222 pn
= rx_sa
->next_pn_halves
.lower
;
3223 pn_len
= MACSEC_DEFAULT_PN_LEN
;
3226 if (nla_put_u8(skb
, MACSEC_SA_ATTR_AN
, i
) ||
3227 nla_put(skb
, MACSEC_SA_ATTR_PN
, pn_len
, &pn
) ||
3228 nla_put(skb
, MACSEC_SA_ATTR_KEYID
, MACSEC_KEYID_LEN
, rx_sa
->key
.id
) ||
3229 (secy
->xpn
&& nla_put_ssci(skb
, MACSEC_SA_ATTR_SSCI
, rx_sa
->ssci
)) ||
3230 nla_put_u8(skb
, MACSEC_SA_ATTR_ACTIVE
, rx_sa
->active
)) {
3231 nla_nest_cancel(skb
, rxsa_nest
);
3232 nla_nest_cancel(skb
, rxsc_nest
);
3233 nla_nest_cancel(skb
, rxsc_list
);
3234 goto nla_put_failure
;
3236 nla_nest_end(skb
, rxsa_nest
);
3239 nla_nest_end(skb
, rxsa_list
);
3240 nla_nest_end(skb
, rxsc_nest
);
3243 nla_nest_end(skb
, rxsc_list
);
3245 genlmsg_end(skb
, hdr
);
3250 genlmsg_cancel(skb
, hdr
);
3254 static int macsec_generation
= 1; /* protected by RTNL */
3256 static int macsec_dump_txsc(struct sk_buff
*skb
, struct netlink_callback
*cb
)
3258 struct net
*net
= sock_net(skb
->sk
);
3259 struct net_device
*dev
;
3262 dev_idx
= cb
->args
[0];
3267 cb
->seq
= macsec_generation
;
3269 for_each_netdev(net
, dev
) {
3270 struct macsec_secy
*secy
;
3275 if (!netif_is_macsec(dev
))
3278 secy
= &macsec_priv(dev
)->secy
;
3279 if (dump_secy(secy
, dev
, skb
, cb
) < 0)
3291 static const struct genl_small_ops macsec_genl_ops
[] = {
3293 .cmd
= MACSEC_CMD_GET_TXSC
,
3294 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3295 .dumpit
= macsec_dump_txsc
,
3298 .cmd
= MACSEC_CMD_ADD_RXSC
,
3299 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3300 .doit
= macsec_add_rxsc
,
3301 .flags
= GENL_ADMIN_PERM
,
3304 .cmd
= MACSEC_CMD_DEL_RXSC
,
3305 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3306 .doit
= macsec_del_rxsc
,
3307 .flags
= GENL_ADMIN_PERM
,
3310 .cmd
= MACSEC_CMD_UPD_RXSC
,
3311 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3312 .doit
= macsec_upd_rxsc
,
3313 .flags
= GENL_ADMIN_PERM
,
3316 .cmd
= MACSEC_CMD_ADD_TXSA
,
3317 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3318 .doit
= macsec_add_txsa
,
3319 .flags
= GENL_ADMIN_PERM
,
3322 .cmd
= MACSEC_CMD_DEL_TXSA
,
3323 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3324 .doit
= macsec_del_txsa
,
3325 .flags
= GENL_ADMIN_PERM
,
3328 .cmd
= MACSEC_CMD_UPD_TXSA
,
3329 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3330 .doit
= macsec_upd_txsa
,
3331 .flags
= GENL_ADMIN_PERM
,
3334 .cmd
= MACSEC_CMD_ADD_RXSA
,
3335 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3336 .doit
= macsec_add_rxsa
,
3337 .flags
= GENL_ADMIN_PERM
,
3340 .cmd
= MACSEC_CMD_DEL_RXSA
,
3341 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3342 .doit
= macsec_del_rxsa
,
3343 .flags
= GENL_ADMIN_PERM
,
3346 .cmd
= MACSEC_CMD_UPD_RXSA
,
3347 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3348 .doit
= macsec_upd_rxsa
,
3349 .flags
= GENL_ADMIN_PERM
,
3352 .cmd
= MACSEC_CMD_UPD_OFFLOAD
,
3353 .validate
= GENL_DONT_VALIDATE_STRICT
| GENL_DONT_VALIDATE_DUMP
,
3354 .doit
= macsec_upd_offload
,
3355 .flags
= GENL_ADMIN_PERM
,
3359 static struct genl_family macsec_fam __ro_after_init
= {
3360 .name
= MACSEC_GENL_NAME
,
3362 .version
= MACSEC_GENL_VERSION
,
3363 .maxattr
= MACSEC_ATTR_MAX
,
3364 .policy
= macsec_genl_policy
,
3366 .module
= THIS_MODULE
,
3367 .small_ops
= macsec_genl_ops
,
3368 .n_small_ops
= ARRAY_SIZE(macsec_genl_ops
),
3371 static netdev_tx_t
macsec_start_xmit(struct sk_buff
*skb
,
3372 struct net_device
*dev
)
3374 struct macsec_dev
*macsec
= netdev_priv(dev
);
3375 struct macsec_secy
*secy
= &macsec
->secy
;
3376 struct pcpu_secy_stats
*secy_stats
;
3379 if (macsec_is_offloaded(netdev_priv(dev
))) {
3380 skb
->dev
= macsec
->real_dev
;
3381 return dev_queue_xmit(skb
);
3385 if (!secy
->protect_frames
) {
3386 secy_stats
= this_cpu_ptr(macsec
->stats
);
3387 u64_stats_update_begin(&secy_stats
->syncp
);
3388 secy_stats
->stats
.OutPktsUntagged
++;
3389 u64_stats_update_end(&secy_stats
->syncp
);
3390 skb
->dev
= macsec
->real_dev
;
3392 ret
= dev_queue_xmit(skb
);
3393 count_tx(dev
, ret
, len
);
3397 if (!secy
->operational
) {
3399 dev
->stats
.tx_dropped
++;
3400 return NETDEV_TX_OK
;
3403 skb
= macsec_encrypt(skb
, dev
);
3405 if (PTR_ERR(skb
) != -EINPROGRESS
)
3406 dev
->stats
.tx_dropped
++;
3407 return NETDEV_TX_OK
;
3410 macsec_count_tx(skb
, &macsec
->secy
.tx_sc
, macsec_skb_cb(skb
)->tx_sa
);
3412 macsec_encrypt_finish(skb
, dev
);
3414 ret
= dev_queue_xmit(skb
);
3415 count_tx(dev
, ret
, len
);
3419 #define SW_MACSEC_FEATURES \
3420 (NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST)
3422 /* If h/w offloading is enabled, use real device features save for
3423 * VLAN_FEATURES - they require additional ops
3424 * HW_MACSEC - no reason to report it
3426 #define REAL_DEV_FEATURES(dev) \
3427 ((dev)->features & ~(NETIF_F_VLAN_FEATURES | NETIF_F_HW_MACSEC))
3429 static int macsec_dev_init(struct net_device
*dev
)
3431 struct macsec_dev
*macsec
= macsec_priv(dev
);
3432 struct net_device
*real_dev
= macsec
->real_dev
;
3435 dev
->tstats
= netdev_alloc_pcpu_stats(struct pcpu_sw_netstats
);
3439 err
= gro_cells_init(&macsec
->gro_cells
, dev
);
3441 free_percpu(dev
->tstats
);
3445 if (macsec_is_offloaded(macsec
)) {
3446 dev
->features
= REAL_DEV_FEATURES(real_dev
);
3448 dev
->features
= real_dev
->features
& SW_MACSEC_FEATURES
;
3449 dev
->features
|= NETIF_F_LLTX
| NETIF_F_GSO_SOFTWARE
;
3452 dev
->needed_headroom
= real_dev
->needed_headroom
+
3453 MACSEC_NEEDED_HEADROOM
;
3454 dev
->needed_tailroom
= real_dev
->needed_tailroom
+
3455 MACSEC_NEEDED_TAILROOM
;
3457 if (is_zero_ether_addr(dev
->dev_addr
))
3458 eth_hw_addr_inherit(dev
, real_dev
);
3459 if (is_zero_ether_addr(dev
->broadcast
))
3460 memcpy(dev
->broadcast
, real_dev
->broadcast
, dev
->addr_len
);
3465 static void macsec_dev_uninit(struct net_device
*dev
)
3467 struct macsec_dev
*macsec
= macsec_priv(dev
);
3469 gro_cells_destroy(&macsec
->gro_cells
);
3470 free_percpu(dev
->tstats
);
3473 static netdev_features_t
macsec_fix_features(struct net_device
*dev
,
3474 netdev_features_t features
)
3476 struct macsec_dev
*macsec
= macsec_priv(dev
);
3477 struct net_device
*real_dev
= macsec
->real_dev
;
3479 if (macsec_is_offloaded(macsec
))
3480 return REAL_DEV_FEATURES(real_dev
);
3482 features
&= (real_dev
->features
& SW_MACSEC_FEATURES
) |
3483 NETIF_F_GSO_SOFTWARE
| NETIF_F_SOFT_FEATURES
;
3484 features
|= NETIF_F_LLTX
;
3489 static int macsec_dev_open(struct net_device
*dev
)
3491 struct macsec_dev
*macsec
= macsec_priv(dev
);
3492 struct net_device
*real_dev
= macsec
->real_dev
;
3495 err
= dev_uc_add(real_dev
, dev
->dev_addr
);
3499 if (dev
->flags
& IFF_ALLMULTI
) {
3500 err
= dev_set_allmulti(real_dev
, 1);
3505 if (dev
->flags
& IFF_PROMISC
) {
3506 err
= dev_set_promiscuity(real_dev
, 1);
3508 goto clear_allmulti
;
3511 /* If h/w offloading is available, propagate to the device */
3512 if (macsec_is_offloaded(macsec
)) {
3513 const struct macsec_ops
*ops
;
3514 struct macsec_context ctx
;
3516 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
3519 goto clear_allmulti
;
3522 ctx
.secy
= &macsec
->secy
;
3523 err
= macsec_offload(ops
->mdo_dev_open
, &ctx
);
3525 goto clear_allmulti
;
3528 if (netif_carrier_ok(real_dev
))
3529 netif_carrier_on(dev
);
3533 if (dev
->flags
& IFF_ALLMULTI
)
3534 dev_set_allmulti(real_dev
, -1);
3536 dev_uc_del(real_dev
, dev
->dev_addr
);
3537 netif_carrier_off(dev
);
3541 static int macsec_dev_stop(struct net_device
*dev
)
3543 struct macsec_dev
*macsec
= macsec_priv(dev
);
3544 struct net_device
*real_dev
= macsec
->real_dev
;
3546 netif_carrier_off(dev
);
3548 /* If h/w offloading is available, propagate to the device */
3549 if (macsec_is_offloaded(macsec
)) {
3550 const struct macsec_ops
*ops
;
3551 struct macsec_context ctx
;
3553 ops
= macsec_get_ops(macsec
, &ctx
);
3555 ctx
.secy
= &macsec
->secy
;
3556 macsec_offload(ops
->mdo_dev_stop
, &ctx
);
3560 dev_mc_unsync(real_dev
, dev
);
3561 dev_uc_unsync(real_dev
, dev
);
3563 if (dev
->flags
& IFF_ALLMULTI
)
3564 dev_set_allmulti(real_dev
, -1);
3566 if (dev
->flags
& IFF_PROMISC
)
3567 dev_set_promiscuity(real_dev
, -1);
3569 dev_uc_del(real_dev
, dev
->dev_addr
);
3574 static void macsec_dev_change_rx_flags(struct net_device
*dev
, int change
)
3576 struct net_device
*real_dev
= macsec_priv(dev
)->real_dev
;
3578 if (!(dev
->flags
& IFF_UP
))
3581 if (change
& IFF_ALLMULTI
)
3582 dev_set_allmulti(real_dev
, dev
->flags
& IFF_ALLMULTI
? 1 : -1);
3584 if (change
& IFF_PROMISC
)
3585 dev_set_promiscuity(real_dev
,
3586 dev
->flags
& IFF_PROMISC
? 1 : -1);
3589 static void macsec_dev_set_rx_mode(struct net_device
*dev
)
3591 struct net_device
*real_dev
= macsec_priv(dev
)->real_dev
;
3593 dev_mc_sync(real_dev
, dev
);
3594 dev_uc_sync(real_dev
, dev
);
3597 static int macsec_set_mac_address(struct net_device
*dev
, void *p
)
3599 struct macsec_dev
*macsec
= macsec_priv(dev
);
3600 struct net_device
*real_dev
= macsec
->real_dev
;
3601 struct sockaddr
*addr
= p
;
3604 if (!is_valid_ether_addr(addr
->sa_data
))
3605 return -EADDRNOTAVAIL
;
3607 if (!(dev
->flags
& IFF_UP
))
3610 err
= dev_uc_add(real_dev
, addr
->sa_data
);
3614 dev_uc_del(real_dev
, dev
->dev_addr
);
3617 ether_addr_copy(dev
->dev_addr
, addr
->sa_data
);
3618 macsec
->secy
.sci
= dev_to_sci(dev
, MACSEC_PORT_ES
);
3620 /* If h/w offloading is available, propagate to the device */
3621 if (macsec_is_offloaded(macsec
)) {
3622 const struct macsec_ops
*ops
;
3623 struct macsec_context ctx
;
3625 ops
= macsec_get_ops(macsec
, &ctx
);
3627 ctx
.secy
= &macsec
->secy
;
3628 macsec_offload(ops
->mdo_upd_secy
, &ctx
);
3635 static int macsec_change_mtu(struct net_device
*dev
, int new_mtu
)
3637 struct macsec_dev
*macsec
= macsec_priv(dev
);
3638 unsigned int extra
= macsec
->secy
.icv_len
+ macsec_extra_len(true);
3640 if (macsec
->real_dev
->mtu
- extra
< new_mtu
)
3648 static void macsec_get_stats64(struct net_device
*dev
,
3649 struct rtnl_link_stats64
*s
)
3654 dev_fetch_sw_netstats(s
, dev
->tstats
);
3656 s
->rx_dropped
= dev
->stats
.rx_dropped
;
3657 s
->tx_dropped
= dev
->stats
.tx_dropped
;
3660 static int macsec_get_iflink(const struct net_device
*dev
)
3662 return macsec_priv(dev
)->real_dev
->ifindex
;
3665 static const struct net_device_ops macsec_netdev_ops
= {
3666 .ndo_init
= macsec_dev_init
,
3667 .ndo_uninit
= macsec_dev_uninit
,
3668 .ndo_open
= macsec_dev_open
,
3669 .ndo_stop
= macsec_dev_stop
,
3670 .ndo_fix_features
= macsec_fix_features
,
3671 .ndo_change_mtu
= macsec_change_mtu
,
3672 .ndo_set_rx_mode
= macsec_dev_set_rx_mode
,
3673 .ndo_change_rx_flags
= macsec_dev_change_rx_flags
,
3674 .ndo_set_mac_address
= macsec_set_mac_address
,
3675 .ndo_start_xmit
= macsec_start_xmit
,
3676 .ndo_get_stats64
= macsec_get_stats64
,
3677 .ndo_get_iflink
= macsec_get_iflink
,
3680 static const struct device_type macsec_type
= {
3684 static const struct nla_policy macsec_rtnl_policy
[IFLA_MACSEC_MAX
+ 1] = {
3685 [IFLA_MACSEC_SCI
] = { .type
= NLA_U64
},
3686 [IFLA_MACSEC_PORT
] = { .type
= NLA_U16
},
3687 [IFLA_MACSEC_ICV_LEN
] = { .type
= NLA_U8
},
3688 [IFLA_MACSEC_CIPHER_SUITE
] = { .type
= NLA_U64
},
3689 [IFLA_MACSEC_WINDOW
] = { .type
= NLA_U32
},
3690 [IFLA_MACSEC_ENCODING_SA
] = { .type
= NLA_U8
},
3691 [IFLA_MACSEC_ENCRYPT
] = { .type
= NLA_U8
},
3692 [IFLA_MACSEC_PROTECT
] = { .type
= NLA_U8
},
3693 [IFLA_MACSEC_INC_SCI
] = { .type
= NLA_U8
},
3694 [IFLA_MACSEC_ES
] = { .type
= NLA_U8
},
3695 [IFLA_MACSEC_SCB
] = { .type
= NLA_U8
},
3696 [IFLA_MACSEC_REPLAY_PROTECT
] = { .type
= NLA_U8
},
3697 [IFLA_MACSEC_VALIDATION
] = { .type
= NLA_U8
},
3700 static void macsec_free_netdev(struct net_device
*dev
)
3702 struct macsec_dev
*macsec
= macsec_priv(dev
);
3704 free_percpu(macsec
->stats
);
3705 free_percpu(macsec
->secy
.tx_sc
.stats
);
3709 static void macsec_setup(struct net_device
*dev
)
3713 dev
->max_mtu
= ETH_MAX_MTU
;
3714 dev
->priv_flags
|= IFF_NO_QUEUE
;
3715 dev
->netdev_ops
= &macsec_netdev_ops
;
3716 dev
->needs_free_netdev
= true;
3717 dev
->priv_destructor
= macsec_free_netdev
;
3718 SET_NETDEV_DEVTYPE(dev
, &macsec_type
);
3720 eth_zero_addr(dev
->broadcast
);
3723 static int macsec_changelink_common(struct net_device
*dev
,
3724 struct nlattr
*data
[])
3726 struct macsec_secy
*secy
;
3727 struct macsec_tx_sc
*tx_sc
;
3729 secy
= &macsec_priv(dev
)->secy
;
3730 tx_sc
= &secy
->tx_sc
;
3732 if (data
[IFLA_MACSEC_ENCODING_SA
]) {
3733 struct macsec_tx_sa
*tx_sa
;
3735 tx_sc
->encoding_sa
= nla_get_u8(data
[IFLA_MACSEC_ENCODING_SA
]);
3736 tx_sa
= rtnl_dereference(tx_sc
->sa
[tx_sc
->encoding_sa
]);
3738 secy
->operational
= tx_sa
&& tx_sa
->active
;
3741 if (data
[IFLA_MACSEC_WINDOW
])
3742 secy
->replay_window
= nla_get_u32(data
[IFLA_MACSEC_WINDOW
]);
3744 if (data
[IFLA_MACSEC_ENCRYPT
])
3745 tx_sc
->encrypt
= !!nla_get_u8(data
[IFLA_MACSEC_ENCRYPT
]);
3747 if (data
[IFLA_MACSEC_PROTECT
])
3748 secy
->protect_frames
= !!nla_get_u8(data
[IFLA_MACSEC_PROTECT
]);
3750 if (data
[IFLA_MACSEC_INC_SCI
])
3751 tx_sc
->send_sci
= !!nla_get_u8(data
[IFLA_MACSEC_INC_SCI
]);
3753 if (data
[IFLA_MACSEC_ES
])
3754 tx_sc
->end_station
= !!nla_get_u8(data
[IFLA_MACSEC_ES
]);
3756 if (data
[IFLA_MACSEC_SCB
])
3757 tx_sc
->scb
= !!nla_get_u8(data
[IFLA_MACSEC_SCB
]);
3759 if (data
[IFLA_MACSEC_REPLAY_PROTECT
])
3760 secy
->replay_protect
= !!nla_get_u8(data
[IFLA_MACSEC_REPLAY_PROTECT
]);
3762 if (data
[IFLA_MACSEC_VALIDATION
])
3763 secy
->validate_frames
= nla_get_u8(data
[IFLA_MACSEC_VALIDATION
]);
3765 if (data
[IFLA_MACSEC_CIPHER_SUITE
]) {
3766 switch (nla_get_u64(data
[IFLA_MACSEC_CIPHER_SUITE
])) {
3767 case MACSEC_CIPHER_ID_GCM_AES_128
:
3768 case MACSEC_DEFAULT_CIPHER_ID
:
3769 secy
->key_len
= MACSEC_GCM_AES_128_SAK_LEN
;
3772 case MACSEC_CIPHER_ID_GCM_AES_256
:
3773 secy
->key_len
= MACSEC_GCM_AES_256_SAK_LEN
;
3776 case MACSEC_CIPHER_ID_GCM_AES_XPN_128
:
3777 secy
->key_len
= MACSEC_GCM_AES_128_SAK_LEN
;
3780 case MACSEC_CIPHER_ID_GCM_AES_XPN_256
:
3781 secy
->key_len
= MACSEC_GCM_AES_256_SAK_LEN
;
3792 static int macsec_changelink(struct net_device
*dev
, struct nlattr
*tb
[],
3793 struct nlattr
*data
[],
3794 struct netlink_ext_ack
*extack
)
3796 struct macsec_dev
*macsec
= macsec_priv(dev
);
3797 struct macsec_tx_sc tx_sc
;
3798 struct macsec_secy secy
;
3804 if (data
[IFLA_MACSEC_CIPHER_SUITE
] ||
3805 data
[IFLA_MACSEC_ICV_LEN
] ||
3806 data
[IFLA_MACSEC_SCI
] ||
3807 data
[IFLA_MACSEC_PORT
])
3810 /* Keep a copy of unmodified secy and tx_sc, in case the offload
3811 * propagation fails, to revert macsec_changelink_common.
3813 memcpy(&secy
, &macsec
->secy
, sizeof(secy
));
3814 memcpy(&tx_sc
, &macsec
->secy
.tx_sc
, sizeof(tx_sc
));
3816 ret
= macsec_changelink_common(dev
, data
);
3820 /* If h/w offloading is available, propagate to the device */
3821 if (macsec_is_offloaded(macsec
)) {
3822 const struct macsec_ops
*ops
;
3823 struct macsec_context ctx
;
3826 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
3832 ctx
.secy
= &macsec
->secy
;
3833 ret
= macsec_offload(ops
->mdo_upd_secy
, &ctx
);
3841 memcpy(&macsec
->secy
.tx_sc
, &tx_sc
, sizeof(tx_sc
));
3842 memcpy(&macsec
->secy
, &secy
, sizeof(secy
));
3847 static void macsec_del_dev(struct macsec_dev
*macsec
)
3851 while (macsec
->secy
.rx_sc
) {
3852 struct macsec_rx_sc
*rx_sc
= rtnl_dereference(macsec
->secy
.rx_sc
);
3854 rcu_assign_pointer(macsec
->secy
.rx_sc
, rx_sc
->next
);
3858 for (i
= 0; i
< MACSEC_NUM_AN
; i
++) {
3859 struct macsec_tx_sa
*sa
= rtnl_dereference(macsec
->secy
.tx_sc
.sa
[i
]);
3862 RCU_INIT_POINTER(macsec
->secy
.tx_sc
.sa
[i
], NULL
);
3868 static void macsec_common_dellink(struct net_device
*dev
, struct list_head
*head
)
3870 struct macsec_dev
*macsec
= macsec_priv(dev
);
3871 struct net_device
*real_dev
= macsec
->real_dev
;
3873 unregister_netdevice_queue(dev
, head
);
3874 list_del_rcu(&macsec
->secys
);
3875 macsec_del_dev(macsec
);
3876 netdev_upper_dev_unlink(real_dev
, dev
);
3878 macsec_generation
++;
3881 static void macsec_dellink(struct net_device
*dev
, struct list_head
*head
)
3883 struct macsec_dev
*macsec
= macsec_priv(dev
);
3884 struct net_device
*real_dev
= macsec
->real_dev
;
3885 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(real_dev
);
3887 /* If h/w offloading is available, propagate to the device */
3888 if (macsec_is_offloaded(macsec
)) {
3889 const struct macsec_ops
*ops
;
3890 struct macsec_context ctx
;
3892 ops
= macsec_get_ops(netdev_priv(dev
), &ctx
);
3894 ctx
.secy
= &macsec
->secy
;
3895 macsec_offload(ops
->mdo_del_secy
, &ctx
);
3899 macsec_common_dellink(dev
, head
);
3901 if (list_empty(&rxd
->secys
)) {
3902 netdev_rx_handler_unregister(real_dev
);
3907 static int register_macsec_dev(struct net_device
*real_dev
,
3908 struct net_device
*dev
)
3910 struct macsec_dev
*macsec
= macsec_priv(dev
);
3911 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(real_dev
);
3916 rxd
= kmalloc(sizeof(*rxd
), GFP_KERNEL
);
3920 INIT_LIST_HEAD(&rxd
->secys
);
3922 err
= netdev_rx_handler_register(real_dev
, macsec_handle_frame
,
3930 list_add_tail_rcu(&macsec
->secys
, &rxd
->secys
);
3934 static bool sci_exists(struct net_device
*dev
, sci_t sci
)
3936 struct macsec_rxh_data
*rxd
= macsec_data_rtnl(dev
);
3937 struct macsec_dev
*macsec
;
3939 list_for_each_entry(macsec
, &rxd
->secys
, secys
) {
3940 if (macsec
->secy
.sci
== sci
)
3947 static int macsec_add_dev(struct net_device
*dev
, sci_t sci
, u8 icv_len
)
3949 struct macsec_dev
*macsec
= macsec_priv(dev
);
3950 struct macsec_secy
*secy
= &macsec
->secy
;
3952 macsec
->stats
= netdev_alloc_pcpu_stats(struct pcpu_secy_stats
);
3956 secy
->tx_sc
.stats
= netdev_alloc_pcpu_stats(struct pcpu_tx_sc_stats
);
3957 if (!secy
->tx_sc
.stats
) {
3958 free_percpu(macsec
->stats
);
3962 if (sci
== MACSEC_UNDEF_SCI
)
3963 sci
= dev_to_sci(dev
, MACSEC_PORT_ES
);
3966 secy
->operational
= true;
3967 secy
->key_len
= DEFAULT_SAK_LEN
;
3968 secy
->icv_len
= icv_len
;
3969 secy
->validate_frames
= MACSEC_VALIDATE_DEFAULT
;
3970 secy
->protect_frames
= true;
3971 secy
->replay_protect
= false;
3972 secy
->xpn
= DEFAULT_XPN
;
3975 secy
->tx_sc
.active
= true;
3976 secy
->tx_sc
.encoding_sa
= DEFAULT_ENCODING_SA
;
3977 secy
->tx_sc
.encrypt
= DEFAULT_ENCRYPT
;
3978 secy
->tx_sc
.send_sci
= DEFAULT_SEND_SCI
;
3979 secy
->tx_sc
.end_station
= false;
3980 secy
->tx_sc
.scb
= false;
3985 static struct lock_class_key macsec_netdev_addr_lock_key
;
3987 static int macsec_newlink(struct net
*net
, struct net_device
*dev
,
3988 struct nlattr
*tb
[], struct nlattr
*data
[],
3989 struct netlink_ext_ack
*extack
)
3991 struct macsec_dev
*macsec
= macsec_priv(dev
);
3992 rx_handler_func_t
*rx_handler
;
3993 u8 icv_len
= DEFAULT_ICV_LEN
;
3994 struct net_device
*real_dev
;
4000 real_dev
= __dev_get_by_index(net
, nla_get_u32(tb
[IFLA_LINK
]));
4003 if (real_dev
->type
!= ARPHRD_ETHER
)
4006 dev
->priv_flags
|= IFF_MACSEC
;
4008 macsec
->real_dev
= real_dev
;
4010 if (data
&& data
[IFLA_MACSEC_OFFLOAD
])
4011 macsec
->offload
= nla_get_offload(data
[IFLA_MACSEC_OFFLOAD
]);
4013 /* MACsec offloading is off by default */
4014 macsec
->offload
= MACSEC_OFFLOAD_OFF
;
4016 /* Check if the offloading mode is supported by the underlying layers */
4017 if (macsec
->offload
!= MACSEC_OFFLOAD_OFF
&&
4018 !macsec_check_offload(macsec
->offload
, macsec
))
4021 if (data
&& data
[IFLA_MACSEC_ICV_LEN
])
4022 icv_len
= nla_get_u8(data
[IFLA_MACSEC_ICV_LEN
]);
4023 mtu
= real_dev
->mtu
- icv_len
- macsec_extra_len(true);
4029 rx_handler
= rtnl_dereference(real_dev
->rx_handler
);
4030 if (rx_handler
&& rx_handler
!= macsec_handle_frame
)
4033 err
= register_netdevice(dev
);
4037 netdev_lockdep_set_classes(dev
);
4038 lockdep_set_class(&dev
->addr_list_lock
,
4039 &macsec_netdev_addr_lock_key
);
4041 err
= netdev_upper_dev_link(real_dev
, dev
, extack
);
4045 /* need to be already registered so that ->init has run and
4046 * the MAC addr is set
4048 if (data
&& data
[IFLA_MACSEC_SCI
])
4049 sci
= nla_get_sci(data
[IFLA_MACSEC_SCI
]);
4050 else if (data
&& data
[IFLA_MACSEC_PORT
])
4051 sci
= dev_to_sci(dev
, nla_get_be16(data
[IFLA_MACSEC_PORT
]));
4053 sci
= dev_to_sci(dev
, MACSEC_PORT_ES
);
4055 if (rx_handler
&& sci_exists(real_dev
, sci
)) {
4060 err
= macsec_add_dev(dev
, sci
, icv_len
);
4065 err
= macsec_changelink_common(dev
, data
);
4070 /* If h/w offloading is available, propagate to the device */
4071 if (macsec_is_offloaded(macsec
)) {
4072 const struct macsec_ops
*ops
;
4073 struct macsec_context ctx
;
4075 ops
= macsec_get_ops(macsec
, &ctx
);
4077 ctx
.secy
= &macsec
->secy
;
4078 err
= macsec_offload(ops
->mdo_add_secy
, &ctx
);
4084 err
= register_macsec_dev(real_dev
, dev
);
4088 netif_stacked_transfer_operstate(real_dev
, dev
);
4089 linkwatch_fire_event(dev
);
4091 macsec_generation
++;
4096 macsec_del_dev(macsec
);
4098 netdev_upper_dev_unlink(real_dev
, dev
);
4100 unregister_netdevice(dev
);
4104 static int macsec_validate_attr(struct nlattr
*tb
[], struct nlattr
*data
[],
4105 struct netlink_ext_ack
*extack
)
4107 u64 csid
= MACSEC_DEFAULT_CIPHER_ID
;
4108 u8 icv_len
= DEFAULT_ICV_LEN
;
4115 if (data
[IFLA_MACSEC_CIPHER_SUITE
])
4116 csid
= nla_get_u64(data
[IFLA_MACSEC_CIPHER_SUITE
]);
4118 if (data
[IFLA_MACSEC_ICV_LEN
]) {
4119 icv_len
= nla_get_u8(data
[IFLA_MACSEC_ICV_LEN
]);
4120 if (icv_len
!= DEFAULT_ICV_LEN
) {
4121 char dummy_key
[DEFAULT_SAK_LEN
] = { 0 };
4122 struct crypto_aead
*dummy_tfm
;
4124 dummy_tfm
= macsec_alloc_tfm(dummy_key
,
4127 if (IS_ERR(dummy_tfm
))
4128 return PTR_ERR(dummy_tfm
);
4129 crypto_free_aead(dummy_tfm
);
4134 case MACSEC_CIPHER_ID_GCM_AES_128
:
4135 case MACSEC_CIPHER_ID_GCM_AES_256
:
4136 case MACSEC_CIPHER_ID_GCM_AES_XPN_128
:
4137 case MACSEC_CIPHER_ID_GCM_AES_XPN_256
:
4138 case MACSEC_DEFAULT_CIPHER_ID
:
4139 if (icv_len
< MACSEC_MIN_ICV_LEN
||
4140 icv_len
> MACSEC_STD_ICV_LEN
)
4147 if (data
[IFLA_MACSEC_ENCODING_SA
]) {
4148 if (nla_get_u8(data
[IFLA_MACSEC_ENCODING_SA
]) >= MACSEC_NUM_AN
)
4152 for (flag
= IFLA_MACSEC_ENCODING_SA
+ 1;
4153 flag
< IFLA_MACSEC_VALIDATION
;
4156 if (nla_get_u8(data
[flag
]) > 1)
4161 es
= data
[IFLA_MACSEC_ES
] ? nla_get_u8(data
[IFLA_MACSEC_ES
]) : false;
4162 sci
= data
[IFLA_MACSEC_INC_SCI
] ? nla_get_u8(data
[IFLA_MACSEC_INC_SCI
]) : false;
4163 scb
= data
[IFLA_MACSEC_SCB
] ? nla_get_u8(data
[IFLA_MACSEC_SCB
]) : false;
4165 if ((sci
&& (scb
|| es
)) || (scb
&& es
))
4168 if (data
[IFLA_MACSEC_VALIDATION
] &&
4169 nla_get_u8(data
[IFLA_MACSEC_VALIDATION
]) > MACSEC_VALIDATE_MAX
)
4172 if ((data
[IFLA_MACSEC_REPLAY_PROTECT
] &&
4173 nla_get_u8(data
[IFLA_MACSEC_REPLAY_PROTECT
])) &&
4174 !data
[IFLA_MACSEC_WINDOW
])
4180 static struct net
*macsec_get_link_net(const struct net_device
*dev
)
4182 return dev_net(macsec_priv(dev
)->real_dev
);
4185 static size_t macsec_get_size(const struct net_device
*dev
)
4187 return nla_total_size_64bit(8) + /* IFLA_MACSEC_SCI */
4188 nla_total_size(1) + /* IFLA_MACSEC_ICV_LEN */
4189 nla_total_size_64bit(8) + /* IFLA_MACSEC_CIPHER_SUITE */
4190 nla_total_size(4) + /* IFLA_MACSEC_WINDOW */
4191 nla_total_size(1) + /* IFLA_MACSEC_ENCODING_SA */
4192 nla_total_size(1) + /* IFLA_MACSEC_ENCRYPT */
4193 nla_total_size(1) + /* IFLA_MACSEC_PROTECT */
4194 nla_total_size(1) + /* IFLA_MACSEC_INC_SCI */
4195 nla_total_size(1) + /* IFLA_MACSEC_ES */
4196 nla_total_size(1) + /* IFLA_MACSEC_SCB */
4197 nla_total_size(1) + /* IFLA_MACSEC_REPLAY_PROTECT */
4198 nla_total_size(1) + /* IFLA_MACSEC_VALIDATION */
4202 static int macsec_fill_info(struct sk_buff
*skb
,
4203 const struct net_device
*dev
)
4205 struct macsec_secy
*secy
= &macsec_priv(dev
)->secy
;
4206 struct macsec_tx_sc
*tx_sc
= &secy
->tx_sc
;
4209 switch (secy
->key_len
) {
4210 case MACSEC_GCM_AES_128_SAK_LEN
:
4211 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_128
: MACSEC_DEFAULT_CIPHER_ID
;
4213 case MACSEC_GCM_AES_256_SAK_LEN
:
4214 csid
= secy
->xpn
? MACSEC_CIPHER_ID_GCM_AES_XPN_256
: MACSEC_CIPHER_ID_GCM_AES_256
;
4217 goto nla_put_failure
;
4220 if (nla_put_sci(skb
, IFLA_MACSEC_SCI
, secy
->sci
,
4222 nla_put_u8(skb
, IFLA_MACSEC_ICV_LEN
, secy
->icv_len
) ||
4223 nla_put_u64_64bit(skb
, IFLA_MACSEC_CIPHER_SUITE
,
4224 csid
, IFLA_MACSEC_PAD
) ||
4225 nla_put_u8(skb
, IFLA_MACSEC_ENCODING_SA
, tx_sc
->encoding_sa
) ||
4226 nla_put_u8(skb
, IFLA_MACSEC_ENCRYPT
, tx_sc
->encrypt
) ||
4227 nla_put_u8(skb
, IFLA_MACSEC_PROTECT
, secy
->protect_frames
) ||
4228 nla_put_u8(skb
, IFLA_MACSEC_INC_SCI
, tx_sc
->send_sci
) ||
4229 nla_put_u8(skb
, IFLA_MACSEC_ES
, tx_sc
->end_station
) ||
4230 nla_put_u8(skb
, IFLA_MACSEC_SCB
, tx_sc
->scb
) ||
4231 nla_put_u8(skb
, IFLA_MACSEC_REPLAY_PROTECT
, secy
->replay_protect
) ||
4232 nla_put_u8(skb
, IFLA_MACSEC_VALIDATION
, secy
->validate_frames
) ||
4234 goto nla_put_failure
;
4236 if (secy
->replay_protect
) {
4237 if (nla_put_u32(skb
, IFLA_MACSEC_WINDOW
, secy
->replay_window
))
4238 goto nla_put_failure
;
4247 static struct rtnl_link_ops macsec_link_ops __read_mostly
= {
4249 .priv_size
= sizeof(struct macsec_dev
),
4250 .maxtype
= IFLA_MACSEC_MAX
,
4251 .policy
= macsec_rtnl_policy
,
4252 .setup
= macsec_setup
,
4253 .validate
= macsec_validate_attr
,
4254 .newlink
= macsec_newlink
,
4255 .changelink
= macsec_changelink
,
4256 .dellink
= macsec_dellink
,
4257 .get_size
= macsec_get_size
,
4258 .fill_info
= macsec_fill_info
,
4259 .get_link_net
= macsec_get_link_net
,
4262 static bool is_macsec_master(struct net_device
*dev
)
4264 return rcu_access_pointer(dev
->rx_handler
) == macsec_handle_frame
;
4267 static int macsec_notify(struct notifier_block
*this, unsigned long event
,
4270 struct net_device
*real_dev
= netdev_notifier_info_to_dev(ptr
);
4273 if (!is_macsec_master(real_dev
))
4279 case NETDEV_CHANGE
: {
4280 struct macsec_dev
*m
, *n
;
4281 struct macsec_rxh_data
*rxd
;
4283 rxd
= macsec_data_rtnl(real_dev
);
4284 list_for_each_entry_safe(m
, n
, &rxd
->secys
, secys
) {
4285 struct net_device
*dev
= m
->secy
.netdev
;
4287 netif_stacked_transfer_operstate(real_dev
, dev
);
4291 case NETDEV_UNREGISTER
: {
4292 struct macsec_dev
*m
, *n
;
4293 struct macsec_rxh_data
*rxd
;
4295 rxd
= macsec_data_rtnl(real_dev
);
4296 list_for_each_entry_safe(m
, n
, &rxd
->secys
, secys
) {
4297 macsec_common_dellink(m
->secy
.netdev
, &head
);
4300 netdev_rx_handler_unregister(real_dev
);
4303 unregister_netdevice_many(&head
);
4306 case NETDEV_CHANGEMTU
: {
4307 struct macsec_dev
*m
;
4308 struct macsec_rxh_data
*rxd
;
4310 rxd
= macsec_data_rtnl(real_dev
);
4311 list_for_each_entry(m
, &rxd
->secys
, secys
) {
4312 struct net_device
*dev
= m
->secy
.netdev
;
4313 unsigned int mtu
= real_dev
->mtu
- (m
->secy
.icv_len
+
4314 macsec_extra_len(true));
4317 dev_set_mtu(dev
, mtu
);
4325 static struct notifier_block macsec_notifier
= {
4326 .notifier_call
= macsec_notify
,
4329 static int __init
macsec_init(void)
4333 pr_info("MACsec IEEE 802.1AE\n");
4334 err
= register_netdevice_notifier(&macsec_notifier
);
4338 err
= rtnl_link_register(&macsec_link_ops
);
4342 err
= genl_register_family(&macsec_fam
);
4349 rtnl_link_unregister(&macsec_link_ops
);
4351 unregister_netdevice_notifier(&macsec_notifier
);
4355 static void __exit
macsec_exit(void)
4357 genl_unregister_family(&macsec_fam
);
4358 rtnl_link_unregister(&macsec_link_ops
);
4359 unregister_netdevice_notifier(&macsec_notifier
);
4363 module_init(macsec_init
);
4364 module_exit(macsec_exit
);
4366 MODULE_ALIAS_RTNL_LINK("macsec");
4367 MODULE_ALIAS_GENL_FAMILY("macsec");
4369 MODULE_DESCRIPTION("MACsec IEEE 802.1AE");
4370 MODULE_LICENSE("GPL v2");