64 #define for_each_rxsc(secy, sc)				\  argument
65 	for (sc = rcu_dereference_bh(secy->rx_sc);	\
68 #define for_each_rxsc_rtnl(secy, sc)			\  argument
69 	for (sc = rtnl_dereference(secy->rx_sc);	\
109 	struct macsec_secy secy;  member
248 static bool send_sci(const struct macsec_secy *secy)  in send_sci()  argument
250 	const struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in send_sci()
253 		(secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb);  in send_sci()
296 			       const struct macsec_secy *secy, u32 pn,  in macsec_fill_sectag()  argument
299 	const struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in macsec_fill_sectag()
306 		memcpy(&h->secure_channel_id, &secy->sci,  in macsec_fill_sectag()
320 	else if (secy->icv_len != DEFAULT_ICV_LEN)  in macsec_fill_sectag()
452 static void __macsec_pn_wrapped(struct macsec_secy *secy,  in __macsec_pn_wrapped()  argument
457 	if (secy->protect_frames)  in __macsec_pn_wrapped()
458 		secy->operational = false;  in __macsec_pn_wrapped()
461 void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa)  in macsec_pn_wrapped()  argument
464 	__macsec_pn_wrapped(secy, tx_sa);  in macsec_pn_wrapped()
470 			    struct macsec_secy *secy)  in tx_sa_update_pn()  argument
477 	if (secy->xpn)  in tx_sa_update_pn()
483 		__macsec_pn_wrapped(secy, tx_sa);  in tx_sa_update_pn()
540 	macsec_count_tx(skb, &macsec->secy.tx_sc, macsec_skb_cb(skb)->tx_sa);  in macsec_encrypt_done()
591 	struct macsec_secy *secy;  in macsec_encrypt()  local
598 	secy = &macsec->secy;  in macsec_encrypt()
599 	tx_sc = &secy->tx_sc;  in macsec_encrypt()
604 		secy->operational = false;  in macsec_encrypt()
633 	sci_present = send_sci(secy);  in macsec_encrypt()
637 	pn = tx_sa_update_pn(tx_sa, secy);  in macsec_encrypt()
643 	macsec_fill_sectag(hh, secy, pn.lower, sci_present);  in macsec_encrypt()
646 	skb_put(skb, secy->icv_len);  in macsec_encrypt()
674 	if (secy->xpn)  in macsec_encrypt()
677 		macsec_fill_iv(iv, secy->sci, pn.lower);  in macsec_encrypt()
690 			  secy->icv_len;  in macsec_encrypt()
695 		aead_request_set_ad(req, skb->len - secy->icv_len);  in macsec_encrypt()
721 static bool macsec_post_decrypt(struct sk_buff *skb, struct macsec_secy *secy, u32 pn)  in macsec_post_decrypt()  argument
729 	if (rx_sa->next_pn_halves.lower >= secy->replay_window)  in macsec_post_decrypt()
730 		lowest_pn = rx_sa->next_pn_halves.lower - secy->replay_window;  in macsec_post_decrypt()
735 	if (secy->replay_protect && pn < lowest_pn &&  in macsec_post_decrypt()
736 	    (!secy->xpn || pn_same_half(pn, lowest_pn))) {  in macsec_post_decrypt()
744 	if (secy->validate_frames != MACSEC_VALIDATE_DISABLED) {  in macsec_post_decrypt()
758 		    secy->validate_frames == MACSEC_VALIDATE_STRICT) {  in macsec_post_decrypt()
766 		if (secy->validate_frames == MACSEC_VALIDATE_CHECK) {  in macsec_post_decrypt()
788 		} else if (secy->xpn &&  in macsec_post_decrypt()
846 	if (!macsec_post_decrypt(skb, &macsec->secy, pn)) {  in macsec_decrypt_done()
852 	macsec_finalize_skb(skb, macsec->secy.icv_len,  in macsec_decrypt_done()
854 	macsec_reset_skb(skb, macsec->secy.netdev);  in macsec_decrypt_done()
872 				      struct macsec_secy *secy)  in macsec_decrypt()  argument
881 	u16 icv_len = secy->icv_len;  in macsec_decrypt()
902 	if (secy->xpn) {  in macsec_decrypt()
969 static struct macsec_rx_sc *find_rx_sc(struct macsec_secy *secy, sci_t sci)  in find_rx_sc()  argument
973 	for_each_rxsc(secy, rx_sc) {  in find_rx_sc()
981 static struct macsec_rx_sc *find_rx_sc_rtnl(struct macsec_secy *secy, sci_t sci)  in find_rx_sc_rtnl()  argument
985 	for_each_rxsc_rtnl(secy, rx_sc) {  in find_rx_sc_rtnl()
1007 		struct net_device *ndev = macsec->secy.netdev;  in handle_not_macsec()
1043 		if (macsec->secy.validate_frames == MACSEC_VALIDATE_STRICT) {  in handle_not_macsec()
1074 	struct macsec_secy *secy = NULL;  in macsec_handle_frame()  local
1133 		struct macsec_rx_sc *sc = find_rx_sc(&macsec->secy, sci);  in macsec_handle_frame()
1138 			secy = &macsec->secy;  in macsec_handle_frame()
1144 	if (!secy)  in macsec_handle_frame()
1147 	dev = secy->netdev;  in macsec_handle_frame()
1152 	if (!macsec_validate_skb(skb, secy->icv_len, secy->xpn)) {  in macsec_handle_frame()
1167 		    secy->validate_frames == MACSEC_VALIDATE_STRICT) {  in macsec_handle_frame()
1185 	if (secy->replay_protect) {  in macsec_handle_frame()
1189 		late = rx_sa->next_pn_halves.lower >= secy->replay_window &&  in macsec_handle_frame()
1190 		       hdr_pn < (rx_sa->next_pn_halves.lower - secy->replay_window);  in macsec_handle_frame()
1192 		if (secy->xpn)  in macsec_handle_frame()
1208 	    secy->validate_frames != MACSEC_VALIDATE_DISABLED)  in macsec_handle_frame()
1209 		skb = macsec_decrypt(skb, dev, rx_sa, sci, secy);  in macsec_handle_frame()
1222 	if (!macsec_post_decrypt(skb, secy, hdr_pn))  in macsec_handle_frame()
1226 	macsec_finalize_skb(skb, secy->icv_len,  in macsec_handle_frame()
1228 	macsec_reset_skb(skb, secy->netdev);  in macsec_handle_frame()
1240 		macsec->secy.netdev->stats.rx_dropped++;  in macsec_handle_frame()
1273 		    macsec->secy.validate_frames == MACSEC_VALIDATE_STRICT) {  in macsec_handle_frame()
1287 		macsec_reset_skb(nskb, macsec->secy.netdev);  in macsec_handle_frame()
1295 			macsec->secy.netdev->stats.rx_dropped++;  in macsec_handle_frame()
1373 static struct macsec_rx_sc *del_rx_sc(struct macsec_secy *secy, sci_t sci)  in del_rx_sc()  argument
1377 	for (rx_scp = &secy->rx_sc, rx_sc = rtnl_dereference(*rx_scp);  in del_rx_sc()
1382 				secy->n_rx_sc--;  in del_rx_sc()
1397 	struct macsec_secy *secy;  in create_rx_sc()  local
1400 		if (find_rx_sc_rtnl(&macsec->secy, sci))  in create_rx_sc()
1418 	secy = &macsec_priv(dev)->secy;  in create_rx_sc()
1419 	rcu_assign_pointer(rx_sc->next, secy->rx_sc);  in create_rx_sc()
1420 	rcu_assign_pointer(secy->rx_sc, rx_sc);  in create_rx_sc()
1423 		secy->n_rx_sc++;  in create_rx_sc()
1509 	struct macsec_secy *secy;  in get_txsa_from_nl()  local
1525 	secy = &macsec_priv(dev)->secy;  in get_txsa_from_nl()
1526 	tx_sc = &secy->tx_sc;  in get_txsa_from_nl()
1534 	*secyp = secy;  in get_txsa_from_nl()
1545 	struct macsec_secy *secy;  in get_rxsc_from_nl()  local
1553 	secy = &macsec_priv(dev)->secy;  in get_rxsc_from_nl()
1559 	rx_sc = find_rx_sc_rtnl(secy, sci);  in get_rxsc_from_nl()
1563 	*secyp = secy;  in get_rxsc_from_nl()
1714 	struct macsec_secy *secy;  in macsec_add_rxsa()  local
1736 	rx_sc = get_rxsc_from_nl(genl_info_net(info), attrs, tb_rxsc, &dev, &secy);  in macsec_add_rxsa()
1744 	if (nla_len(tb_sa[MACSEC_SA_ATTR_KEY]) != secy->key_len) {  in macsec_add_rxsa()
1746 			  nla_len(tb_sa[MACSEC_SA_ATTR_KEY]), secy->key_len);  in macsec_add_rxsa()
1751 	pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;  in macsec_add_rxsa()
1760 	if (secy->xpn) {  in macsec_add_rxsa()
1788 			 secy->key_len, secy->icv_len);  in macsec_add_rxsa()
1819 		ctx.secy = secy;  in macsec_add_rxsa()
1821 		       secy->key_len);  in macsec_add_rxsa()
1828 	if (secy->xpn) {  in macsec_add_rxsa()
1867 	struct macsec_secy *secy;  in macsec_add_rxsc()  local
1887 	secy = &macsec_priv(dev)->secy;  in macsec_add_rxsc()
1911 		ctx.secy = secy;  in macsec_add_rxsc()
1957 	struct macsec_secy *secy;  in macsec_add_txsa()  local
1982 	secy = &macsec_priv(dev)->secy;  in macsec_add_txsa()
1983 	tx_sc = &secy->tx_sc;  in macsec_add_txsa()
1987 	if (nla_len(tb_sa[MACSEC_SA_ATTR_KEY]) != secy->key_len) {  in macsec_add_txsa()
1989 			  nla_len(tb_sa[MACSEC_SA_ATTR_KEY]), secy->key_len);  in macsec_add_txsa()
1994 	pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;  in macsec_add_txsa()
2002 	if (secy->xpn) {  in macsec_add_txsa()
2030 			 secy->key_len, secy->icv_len);  in macsec_add_txsa()
2044 	was_operational = secy->operational;  in macsec_add_txsa()
2046 		secy->operational = true;  in macsec_add_txsa()
2061 		ctx.secy = secy;  in macsec_add_txsa()
2063 		       secy->key_len);  in macsec_add_txsa()
2070 	if (secy->xpn) {  in macsec_add_txsa()
2084 	secy->operational = was_operational;  in macsec_add_txsa()
2094 	struct macsec_secy *secy;  in macsec_del_rxsa()  local
2113 				 &dev, &secy, &rx_sc, &assoc_num);  in macsec_del_rxsa()
2137 		ctx.secy = secy;  in macsec_del_rxsa()
2160 	struct macsec_secy *secy;  in macsec_del_rxsc()  local
2182 	secy = &macsec_priv(dev)->secy;  in macsec_del_rxsc()
2185 	rx_sc = del_rx_sc(secy, sci);  in macsec_del_rxsc()
2203 		ctx.secy = secy;  in macsec_del_rxsc()
2223 	struct macsec_secy *secy;  in macsec_del_txsa()  local
2238 				 &dev, &secy, &tx_sc, &assoc_num);  in macsec_del_txsa()
2262 		ctx.secy = secy;  in macsec_del_txsa()
2308 	struct macsec_secy *secy;  in macsec_upd_txsa()  local
2330 				 &dev, &secy, &tx_sc, &assoc_num);  in macsec_upd_txsa()
2339 		pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;  in macsec_upd_txsa()
2357 	was_operational = secy->operational;  in macsec_upd_txsa()
2359 		secy->operational = tx_sa->active;  in macsec_upd_txsa()
2374 		ctx.secy = secy;  in macsec_upd_txsa()
2392 	secy->operational = was_operational;  in macsec_upd_txsa()
2401 	struct macsec_secy *secy;  in macsec_upd_rxsa()  local
2427 				 &dev, &secy, &rx_sc, &assoc_num);  in macsec_upd_rxsa()
2436 		pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;  in macsec_upd_rxsa()
2467 		ctx.secy = secy;  in macsec_upd_rxsa()
2492 	struct macsec_secy *secy;  in macsec_upd_rxsc()  local
2509 	rx_sc = get_rxsc_from_nl(genl_info_net(info), attrs, tb_rxsc, &dev, &secy);  in macsec_upd_rxsc()
2516 	prev_n_rx_sc = secy->n_rx_sc;  in macsec_upd_rxsc()
2521 			secy->n_rx_sc += new ? 1 : -1;  in macsec_upd_rxsc()
2538 		ctx.secy = secy;  in macsec_upd_rxsc()
2550 	secy->n_rx_sc = prev_n_rx_sc;  in macsec_upd_rxsc()
2558 	struct macsec_secy *secy = &macsec->secy;  in macsec_is_configured()  local
2559 	struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in macsec_is_configured()
2562 	if (secy->n_rx_sc > 0)  in macsec_is_configured()
2641 	ctx.secy = &macsec->secy;  in macsec_upd_offload()
2678 			ctx.secy = &macsec_priv(dev)->secy;  in get_tx_sa_stats()
2722 			ctx.secy = &macsec_priv(dev)->secy;  in get_rx_sa_stats()
2773 			ctx.secy = &macsec_priv(dev)->secy;  in get_rx_sc_stats()
2855 			ctx.secy = &macsec_priv(dev)->secy;  in get_tx_sc_stats()
2866 		stats = per_cpu_ptr(macsec_priv(dev)->secy.tx_sc.stats, cpu);  in get_tx_sc_stats()
2911 			ctx.secy = &macsec_priv(dev)->secy;  in get_secy_stats()
2970 static int nla_put_secy(struct macsec_secy *secy, struct sk_buff *skb)  in nla_put_secy()  argument
2972 	struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in nla_put_secy()
2980 	switch (secy->key_len) {  in nla_put_secy()
2982 		csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_128 : MACSEC_DEFAULT_CIPHER_ID;  in nla_put_secy()
2985 		csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_256 : MACSEC_CIPHER_ID_GCM_AES_256;  in nla_put_secy()
2991 	if (nla_put_sci(skb, MACSEC_SECY_ATTR_SCI, secy->sci,  in nla_put_secy()
2995 	    nla_put_u8(skb, MACSEC_SECY_ATTR_ICV_LEN, secy->icv_len) ||  in nla_put_secy()
2996 	    nla_put_u8(skb, MACSEC_SECY_ATTR_OPER, secy->operational) ||  in nla_put_secy()
2997 	    nla_put_u8(skb, MACSEC_SECY_ATTR_PROTECT, secy->protect_frames) ||  in nla_put_secy()
2998 	    nla_put_u8(skb, MACSEC_SECY_ATTR_REPLAY, secy->replay_protect) ||  in nla_put_secy()
2999 	    nla_put_u8(skb, MACSEC_SECY_ATTR_VALIDATE, secy->validate_frames) ||  in nla_put_secy()
3007 	if (secy->replay_protect) {  in nla_put_secy()
3008 		if (nla_put_u32(skb, MACSEC_SECY_ATTR_WINDOW, secy->replay_window))  in nla_put_secy()
3021 dump_secy(struct macsec_secy *secy, struct net_device *dev,  in dump_secy()  argument
3030 	struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in dump_secy()
3054 	if (nla_put_secy(secy, skb))  in dump_secy()
3112 		if (secy->xpn) {  in dump_secy()
3123 		    (secy->xpn && nla_put_ssci(skb, MACSEC_SA_ATTR_SSCI, tx_sa->ssci)) ||  in dump_secy()
3139 	for_each_rxsc_rtnl(secy, rx_sc) {  in dump_secy()
3217 			if (secy->xpn) {  in dump_secy()
3228 			    (secy->xpn && nla_put_ssci(skb, MACSEC_SA_ATTR_SSCI, rx_sa->ssci)) ||  in dump_secy()
3269 		struct macsec_secy *secy;  in macsec_dump_txsc()  local
3277 		secy = &macsec_priv(dev)->secy;  in macsec_dump_txsc()
3278 		if (dump_secy(secy, dev, skb, cb) < 0)  in macsec_dump_txsc()
3374 	struct macsec_secy *secy = &macsec->secy;  in macsec_start_xmit()  local
3384 	if (!secy->protect_frames) {  in macsec_start_xmit()
3396 	if (!secy->operational) {  in macsec_start_xmit()
3409 	macsec_count_tx(skb, &macsec->secy.tx_sc, macsec_skb_cb(skb)->tx_sa);  in macsec_start_xmit()
3524 		ctx.secy = &macsec->secy;  in macsec_dev_open()
3557 			ctx.secy = &macsec->secy;  in macsec_dev_stop()
3628 			ctx.secy = &macsec->secy;  in macsec_set_mac_address()
3639 	unsigned int extra = macsec->secy.icv_len + macsec_extra_len(true);  in macsec_change_mtu()
3706 	free_percpu(macsec->secy.tx_sc.stats);  in macsec_free_netdev()
3729 	struct macsec_secy *secy;  in macsec_changelink_common()  local
3732 	secy = &macsec_priv(dev)->secy;  in macsec_changelink_common()
3733 	tx_sc = &secy->tx_sc;  in macsec_changelink_common()
3741 		secy->operational = tx_sa && tx_sa->active;  in macsec_changelink_common()
3748 		secy->protect_frames = !!nla_get_u8(data[IFLA_MACSEC_PROTECT]);  in macsec_changelink_common()
3760 		secy->replay_protect = !!nla_get_u8(data[IFLA_MACSEC_REPLAY_PROTECT]);  in macsec_changelink_common()
3763 		secy->validate_frames = nla_get_u8(data[IFLA_MACSEC_VALIDATION]);  in macsec_changelink_common()
3769 			secy->key_len = MACSEC_GCM_AES_128_SAK_LEN;  in macsec_changelink_common()
3770 			secy->xpn = false;  in macsec_changelink_common()
3773 			secy->key_len = MACSEC_GCM_AES_256_SAK_LEN;  in macsec_changelink_common()
3774 			secy->xpn = false;  in macsec_changelink_common()
3777 			secy->key_len = MACSEC_GCM_AES_128_SAK_LEN;  in macsec_changelink_common()
3778 			secy->xpn = true;  in macsec_changelink_common()
3781 			secy->key_len = MACSEC_GCM_AES_256_SAK_LEN;  in macsec_changelink_common()
3782 			secy->xpn = true;  in macsec_changelink_common()
3790 		secy->replay_window = nla_get_u32(data[IFLA_MACSEC_WINDOW]);  in macsec_changelink_common()
3794 		if (secy->xpn &&  in macsec_changelink_common()
3795 		    secy->replay_window > MACSEC_XPN_MAX_REPLAY_WINDOW)  in macsec_changelink_common()
3808 	struct macsec_secy secy;  in macsec_changelink()  local
3823 	memcpy(&secy, &macsec->secy, sizeof(secy));  in macsec_changelink()
3824 	memcpy(&tx_sc, &macsec->secy.tx_sc, sizeof(tx_sc));  in macsec_changelink()
3842 		ctx.secy = &macsec->secy;  in macsec_changelink()
3851 	memcpy(&macsec->secy.tx_sc, &tx_sc, sizeof(tx_sc));  in macsec_changelink()
3852 	memcpy(&macsec->secy, &secy, sizeof(secy));  in macsec_changelink()
3861 	while (macsec->secy.rx_sc) {  in macsec_del_dev()
3862 		struct macsec_rx_sc *rx_sc = rtnl_dereference(macsec->secy.rx_sc);  in macsec_del_dev()
3864 		rcu_assign_pointer(macsec->secy.rx_sc, rx_sc->next);  in macsec_del_dev()
3869 		struct macsec_tx_sa *sa = rtnl_dereference(macsec->secy.tx_sc.sa[i]);  in macsec_del_dev()
3872 			RCU_INIT_POINTER(macsec->secy.tx_sc.sa[i], NULL);  in macsec_del_dev()
3890 			ctx.secy = &macsec->secy;  in macsec_common_dellink()
3950 		if (macsec->secy.sci == sci)  in sci_exists()
3965 	struct macsec_secy *secy = &macsec->secy;  in macsec_add_dev()  local
3971 	secy->tx_sc.stats = netdev_alloc_pcpu_stats(struct pcpu_tx_sc_stats);  in macsec_add_dev()
3972 	if (!secy->tx_sc.stats) {  in macsec_add_dev()
3980 	secy->netdev = dev;  in macsec_add_dev()
3981 	secy->operational = true;  in macsec_add_dev()
3982 	secy->key_len = DEFAULT_SAK_LEN;  in macsec_add_dev()
3983 	secy->icv_len = icv_len;  in macsec_add_dev()
3984 	secy->validate_frames = MACSEC_VALIDATE_DEFAULT;  in macsec_add_dev()
3985 	secy->protect_frames = true;  in macsec_add_dev()
3986 	secy->replay_protect = false;  in macsec_add_dev()
3987 	secy->xpn = DEFAULT_XPN;  in macsec_add_dev()
3989 	secy->sci = sci;  in macsec_add_dev()
3990 	secy->tx_sc.active = true;  in macsec_add_dev()
3991 	secy->tx_sc.encoding_sa = DEFAULT_ENCODING_SA;  in macsec_add_dev()
3992 	secy->tx_sc.encrypt = DEFAULT_ENCRYPT;  in macsec_add_dev()
3993 	secy->tx_sc.send_sci = DEFAULT_SEND_SCI;  in macsec_add_dev()
3994 	secy->tx_sc.end_station = false;  in macsec_add_dev()
3995 	secy->tx_sc.scb = false;  in macsec_add_dev()
4101 			ctx.secy = &macsec->secy;  in macsec_newlink()
4229 	struct macsec_secy *secy = &macsec_priv(dev)->secy;  in macsec_fill_info()  local
4230 	struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in macsec_fill_info()
4233 	switch (secy->key_len) {  in macsec_fill_info()
4235 		csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_128 : MACSEC_DEFAULT_CIPHER_ID;  in macsec_fill_info()
4238 		csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_256 : MACSEC_CIPHER_ID_GCM_AES_256;  in macsec_fill_info()
4244 	if (nla_put_sci(skb, IFLA_MACSEC_SCI, secy->sci,  in macsec_fill_info()
4246 	    nla_put_u8(skb, IFLA_MACSEC_ICV_LEN, secy->icv_len) ||  in macsec_fill_info()
4251 	    nla_put_u8(skb, IFLA_MACSEC_PROTECT, secy->protect_frames) ||  in macsec_fill_info()
4255 	    nla_put_u8(skb, IFLA_MACSEC_REPLAY_PROTECT, secy->replay_protect) ||  in macsec_fill_info()
4256 	    nla_put_u8(skb, IFLA_MACSEC_VALIDATION, secy->validate_frames) ||  in macsec_fill_info()
4260 	if (secy->replay_protect) {  in macsec_fill_info()
4261 		if (nla_put_u32(skb, IFLA_MACSEC_WINDOW, secy->replay_window))  in macsec_fill_info()
4309 			struct net_device *dev = m->secy.netdev;  in macsec_notify()
4321 			macsec_common_dellink(m->secy.netdev, &head);  in macsec_notify()
4336 			struct net_device *dev = m->secy.netdev;  in macsec_notify()
4337 			unsigned int mtu = real_dev->mtu - (m->secy.icv_len +  in macsec_notify()