67 #define for_each_rxsc(secy, sc)			\  argument
68 	for (sc = rcu_dereference_bh(secy->rx_sc);	\
71 #define for_each_rxsc_rtnl(secy, sc)			\  argument
72 	for (sc = rtnl_dereference(secy->rx_sc);	\
269 	struct macsec_secy secy;  member
404 static bool send_sci(const struct macsec_secy *secy)  in send_sci()  argument
406 	const struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in send_sci()
409 		(secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb);  in send_sci()
452 			       const struct macsec_secy *secy, u32 pn,  in macsec_fill_sectag()  argument
455 	const struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in macsec_fill_sectag()
462 		memcpy(&h->secure_channel_id, &secy->sci,  in macsec_fill_sectag()
476 	else if (secy->icv_len != DEFAULT_ICV_LEN)  in macsec_fill_sectag()
540 static u32 tx_sa_update_pn(struct macsec_tx_sa *tx_sa, struct macsec_secy *secy)  in tx_sa_update_pn()  argument
551 		if (secy->protect_frames)  in tx_sa_update_pn()
552 			secy->operational = false;  in tx_sa_update_pn()
610 	macsec_count_tx(skb, &macsec->secy.tx_sc, macsec_skb_cb(skb)->tx_sa);  in macsec_encrypt_done()
661 	struct macsec_secy *secy;  in macsec_encrypt()  local
668 	secy = &macsec->secy;  in macsec_encrypt()
669 	tx_sc = &secy->tx_sc;  in macsec_encrypt()
674 		secy->operational = false;  in macsec_encrypt()
703 	sci_present = send_sci(secy);  in macsec_encrypt()
707 	pn = tx_sa_update_pn(tx_sa, secy);  in macsec_encrypt()
713 	macsec_fill_sectag(hh, secy, pn, sci_present);  in macsec_encrypt()
716 	skb_put(skb, secy->icv_len);  in macsec_encrypt()
744 	macsec_fill_iv(iv, secy->sci, pn);  in macsec_encrypt()
757 			  secy->icv_len;  in macsec_encrypt()
762 		aead_request_set_ad(req, skb->len - secy->icv_len);  in macsec_encrypt()
788 static bool macsec_post_decrypt(struct sk_buff *skb, struct macsec_secy *secy, u32 pn)  in macsec_post_decrypt()  argument
796 	if (rx_sa->next_pn >= secy->replay_window)  in macsec_post_decrypt()
797 		lowest_pn = rx_sa->next_pn - secy->replay_window;  in macsec_post_decrypt()
802 	if (secy->replay_protect && pn < lowest_pn) {  in macsec_post_decrypt()
810 	if (secy->validate_frames != MACSEC_VALIDATE_DISABLED) {  in macsec_post_decrypt()
824 		    secy->validate_frames == MACSEC_VALIDATE_STRICT) {  in macsec_post_decrypt()
832 		if (secy->validate_frames == MACSEC_VALIDATE_CHECK) {  in macsec_post_decrypt()
904 	if (!macsec_post_decrypt(skb, &macsec->secy, pn)) {  in macsec_decrypt_done()
910 	macsec_finalize_skb(skb, macsec->secy.icv_len,  in macsec_decrypt_done()
912 	macsec_reset_skb(skb, macsec->secy.netdev);  in macsec_decrypt_done()
930 				      struct macsec_secy *secy)  in macsec_decrypt()  argument
938 	u16 icv_len = secy->icv_len;  in macsec_decrypt()
1012 static struct macsec_rx_sc *find_rx_sc(struct macsec_secy *secy, sci_t sci)  in find_rx_sc()  argument
1016 	for_each_rxsc(secy, rx_sc) {  in find_rx_sc()
1024 static struct macsec_rx_sc *find_rx_sc_rtnl(struct macsec_secy *secy, sci_t sci)  in find_rx_sc_rtnl()  argument
1028 	for_each_rxsc_rtnl(secy, rx_sc) {  in find_rx_sc_rtnl()
1052 		if (macsec->secy.validate_frames == MACSEC_VALIDATE_STRICT) {  in handle_not_macsec()
1064 		nskb->dev = macsec->secy.netdev;  in handle_not_macsec()
1081 	struct macsec_secy *secy = NULL;  in macsec_handle_frame()  local
1144 		struct macsec_rx_sc *sc = find_rx_sc(&macsec->secy, sci);  in macsec_handle_frame()
1148 			secy = &macsec->secy;  in macsec_handle_frame()
1154 	if (!secy)  in macsec_handle_frame()
1157 	dev = secy->netdev;  in macsec_handle_frame()
1162 	if (!macsec_validate_skb(skb, secy->icv_len)) {  in macsec_handle_frame()
1177 		    secy->validate_frames == MACSEC_VALIDATE_STRICT) {  in macsec_handle_frame()
1195 	if (secy->replay_protect) {  in macsec_handle_frame()
1199 		late = rx_sa->next_pn >= secy->replay_window &&  in macsec_handle_frame()
1200 		       pn < (rx_sa->next_pn - secy->replay_window);  in macsec_handle_frame()
1215 	    secy->validate_frames != MACSEC_VALIDATE_DISABLED)  in macsec_handle_frame()
1216 		skb = macsec_decrypt(skb, dev, rx_sa, sci, secy);  in macsec_handle_frame()
1229 	if (!macsec_post_decrypt(skb, secy, pn))  in macsec_handle_frame()
1233 	macsec_finalize_skb(skb, secy->icv_len,  in macsec_handle_frame()
1235 	macsec_reset_skb(skb, secy->netdev);  in macsec_handle_frame()
1245 		macsec->secy.netdev->stats.rx_dropped++;  in macsec_handle_frame()
1278 		    macsec->secy.validate_frames == MACSEC_VALIDATE_STRICT) {  in macsec_handle_frame()
1292 		macsec_reset_skb(nskb, macsec->secy.netdev);  in macsec_handle_frame()
1300 			macsec->secy.netdev->stats.rx_dropped++;  in macsec_handle_frame()
1376 static struct macsec_rx_sc *del_rx_sc(struct macsec_secy *secy, sci_t sci)  in del_rx_sc()  argument
1380 	for (rx_scp = &secy->rx_sc, rx_sc = rtnl_dereference(*rx_scp);  in del_rx_sc()
1385 				secy->n_rx_sc--;  in del_rx_sc()
1400 	struct macsec_secy *secy;  in create_rx_sc()  local
1403 		if (find_rx_sc_rtnl(&macsec->secy, sci))  in create_rx_sc()
1421 	secy = &macsec_priv(dev)->secy;  in create_rx_sc()
1422 	rcu_assign_pointer(rx_sc->next, secy->rx_sc);  in create_rx_sc()
1423 	rcu_assign_pointer(secy->rx_sc, rx_sc);  in create_rx_sc()
1426 		secy->n_rx_sc++;  in create_rx_sc()
1496 	struct macsec_secy *secy;  in get_txsa_from_nl()  local
1512 	secy = &macsec_priv(dev)->secy;  in get_txsa_from_nl()
1513 	tx_sc = &secy->tx_sc;  in get_txsa_from_nl()
1521 	*secyp = secy;  in get_txsa_from_nl()
1532 	struct macsec_secy *secy;  in get_rxsc_from_nl()  local
1540 	secy = &macsec_priv(dev)->secy;  in get_rxsc_from_nl()
1546 	rx_sc = find_rx_sc_rtnl(secy, sci);  in get_rxsc_from_nl()
1550 	*secyp = secy;  in get_rxsc_from_nl()
1663 	struct macsec_secy *secy;  in macsec_add_rxsa()  local
1684 	rx_sc = get_rxsc_from_nl(genl_info_net(info), attrs, tb_rxsc, &dev, &secy);  in macsec_add_rxsa()
1692 	if (nla_len(tb_sa[MACSEC_SA_ATTR_KEY]) != secy->key_len) {  in macsec_add_rxsa()
1694 			  nla_len(tb_sa[MACSEC_SA_ATTR_KEY]), secy->key_len);  in macsec_add_rxsa()
1712 			 secy->key_len, secy->icv_len);  in macsec_add_rxsa()
1819 	struct macsec_secy *secy;  in macsec_add_txsa()  local
1842 	secy = &macsec_priv(dev)->secy;  in macsec_add_txsa()
1843 	tx_sc = &secy->tx_sc;  in macsec_add_txsa()
1847 	if (nla_len(tb_sa[MACSEC_SA_ATTR_KEY]) != secy->key_len) {  in macsec_add_txsa()
1849 			  nla_len(tb_sa[MACSEC_SA_ATTR_KEY]), secy->key_len);  in macsec_add_txsa()
1867 			 secy->key_len, secy->icv_len);  in macsec_add_txsa()
1884 		secy->operational = true;  in macsec_add_txsa()
1897 	struct macsec_secy *secy;  in macsec_del_rxsa()  local
1915 				 &dev, &secy, &rx_sc, &assoc_num);  in macsec_del_rxsa()
1938 	struct macsec_secy *secy;  in macsec_del_rxsc()  local
1959 	secy = &macsec_priv(dev)->secy;  in macsec_del_rxsc()
1962 	rx_sc = del_rx_sc(secy, sci);  in macsec_del_rxsc()
1978 	struct macsec_secy *secy;  in macsec_del_txsa()  local
1992 				 &dev, &secy, &tx_sc, &assoc_num);  in macsec_del_txsa()
2036 	struct macsec_secy *secy;  in macsec_upd_txsa()  local
2053 				 &dev, &secy, &tx_sc, &assoc_num);  in macsec_upd_txsa()
2069 		secy->operational = tx_sa->active;  in macsec_upd_txsa()
2080 	struct macsec_secy *secy;  in macsec_upd_rxsa()  local
2101 				 &dev, &secy, &rx_sc, &assoc_num);  in macsec_upd_rxsa()
2124 	struct macsec_secy *secy;  in macsec_upd_rxsc()  local
2138 	rx_sc = get_rxsc_from_nl(genl_info_net(info), attrs, tb_rxsc, &dev, &secy);  in macsec_upd_rxsc()
2148 			secy->n_rx_sc += new ? 1 : -1;  in macsec_upd_rxsc()
2364 static int nla_put_secy(struct macsec_secy *secy, struct sk_buff *skb)  in nla_put_secy()  argument
2366 	struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in nla_put_secy()
2373 	switch (secy->key_len) {  in nla_put_secy()
2384 	if (nla_put_sci(skb, MACSEC_SECY_ATTR_SCI, secy->sci,  in nla_put_secy()
2388 	    nla_put_u8(skb, MACSEC_SECY_ATTR_ICV_LEN, secy->icv_len) ||  in nla_put_secy()
2389 	    nla_put_u8(skb, MACSEC_SECY_ATTR_OPER, secy->operational) ||  in nla_put_secy()
2390 	    nla_put_u8(skb, MACSEC_SECY_ATTR_PROTECT, secy->protect_frames) ||  in nla_put_secy()
2391 	    nla_put_u8(skb, MACSEC_SECY_ATTR_REPLAY, secy->replay_protect) ||  in nla_put_secy()
2392 	    nla_put_u8(skb, MACSEC_SECY_ATTR_VALIDATE, secy->validate_frames) ||  in nla_put_secy()
2400 	if (secy->replay_protect) {  in nla_put_secy()
2401 		if (nla_put_u32(skb, MACSEC_SECY_ATTR_WINDOW, secy->replay_window))  in nla_put_secy()
2413 static int dump_secy(struct macsec_secy *secy, struct net_device *dev,  in dump_secy()  argument
2417 	struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in dump_secy()
2433 	if (nla_put_secy(secy, skb))  in dump_secy()
2502 	for_each_rxsc_rtnl(secy, rx_sc) {  in dump_secy()
2615 		struct macsec_secy *secy;  in macsec_dump_txsc()  local
2623 		secy = &macsec_priv(dev)->secy;  in macsec_dump_txsc()
2624 		if (dump_secy(secy, dev, skb, cb) < 0)  in macsec_dump_txsc()
2713 	struct macsec_secy *secy = &macsec->secy;  in macsec_start_xmit()  local
2718 	if (!secy->protect_frames) {  in macsec_start_xmit()
2730 	if (!secy->operational) {  in macsec_start_xmit()
2743 	macsec_count_tx(skb, &macsec->secy.tx_sc, macsec_skb_cb(skb)->tx_sa);  in macsec_start_xmit()
2918 	unsigned int extra = macsec->secy.icv_len + macsec_extra_len(true);  in macsec_change_mtu()
3013 	free_percpu(macsec->secy.tx_sc.stats);  in macsec_free_netdev()
3035 	struct macsec_secy *secy;  in macsec_changelink_common()  local
3038 	secy = &macsec_priv(dev)->secy;  in macsec_changelink_common()
3039 	tx_sc = &secy->tx_sc;  in macsec_changelink_common()
3047 		secy->operational = tx_sa && tx_sa->active;  in macsec_changelink_common()
3051 		secy->replay_window = nla_get_u32(data[IFLA_MACSEC_WINDOW]);  in macsec_changelink_common()
3057 		secy->protect_frames = !!nla_get_u8(data[IFLA_MACSEC_PROTECT]);  in macsec_changelink_common()
3069 		secy->replay_protect = !!nla_get_u8(data[IFLA_MACSEC_REPLAY_PROTECT]);  in macsec_changelink_common()
3072 		secy->validate_frames = nla_get_u8(data[IFLA_MACSEC_VALIDATION]);  in macsec_changelink_common()
3078 			secy->key_len = MACSEC_GCM_AES_128_SAK_LEN;  in macsec_changelink_common()
3081 			secy->key_len = MACSEC_GCM_AES_256_SAK_LEN;  in macsec_changelink_common()
3111 	while (macsec->secy.rx_sc) {  in macsec_del_dev()
3112 		struct macsec_rx_sc *rx_sc = rtnl_dereference(macsec->secy.rx_sc);  in macsec_del_dev()
3114 		rcu_assign_pointer(macsec->secy.rx_sc, rx_sc->next);  in macsec_del_dev()
3119 		struct macsec_tx_sa *sa = rtnl_dereference(macsec->secy.tx_sc.sa[i]);  in macsec_del_dev()
3122 			RCU_INIT_POINTER(macsec->secy.tx_sc.sa[i], NULL);  in macsec_del_dev()
3188 		if (macsec->secy.sci == sci)  in sci_exists()
3203 	struct macsec_secy *secy = &macsec->secy;  in macsec_add_dev()  local
3209 	secy->tx_sc.stats = netdev_alloc_pcpu_stats(struct pcpu_tx_sc_stats);  in macsec_add_dev()
3210 	if (!secy->tx_sc.stats) {  in macsec_add_dev()
3218 	secy->netdev = dev;  in macsec_add_dev()
3219 	secy->operational = true;  in macsec_add_dev()
3220 	secy->key_len = DEFAULT_SAK_LEN;  in macsec_add_dev()
3221 	secy->icv_len = icv_len;  in macsec_add_dev()
3222 	secy->validate_frames = MACSEC_VALIDATE_DEFAULT;  in macsec_add_dev()
3223 	secy->protect_frames = true;  in macsec_add_dev()
3224 	secy->replay_protect = false;  in macsec_add_dev()
3226 	secy->sci = sci;  in macsec_add_dev()
3227 	secy->tx_sc.active = true;  in macsec_add_dev()
3228 	secy->tx_sc.encoding_sa = DEFAULT_ENCODING_SA;  in macsec_add_dev()
3229 	secy->tx_sc.encrypt = DEFAULT_ENCRYPT;  in macsec_add_dev()
3230 	secy->tx_sc.send_sci = DEFAULT_SEND_SCI;  in macsec_add_dev()
3231 	secy->tx_sc.end_station = false;  in macsec_add_dev()
3232 	secy->tx_sc.scb = false;  in macsec_add_dev()
3423 	struct macsec_secy *secy = &macsec_priv(dev)->secy;  in macsec_fill_info()  local
3424 	struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in macsec_fill_info()
3427 	switch (secy->key_len) {  in macsec_fill_info()
3438 	if (nla_put_sci(skb, IFLA_MACSEC_SCI, secy->sci,  in macsec_fill_info()
3440 	    nla_put_u8(skb, IFLA_MACSEC_ICV_LEN, secy->icv_len) ||  in macsec_fill_info()
3445 	    nla_put_u8(skb, IFLA_MACSEC_PROTECT, secy->protect_frames) ||  in macsec_fill_info()
3449 	    nla_put_u8(skb, IFLA_MACSEC_REPLAY_PROTECT, secy->replay_protect) ||  in macsec_fill_info()
3450 	    nla_put_u8(skb, IFLA_MACSEC_VALIDATION, secy->validate_frames) ||  in macsec_fill_info()
3454 	if (secy->replay_protect) {  in macsec_fill_info()
3455 		if (nla_put_u32(skb, IFLA_MACSEC_WINDOW, secy->replay_window))  in macsec_fill_info()
3501 			macsec_common_dellink(m->secy.netdev, &head);  in macsec_notify()
3516 			struct net_device *dev = m->secy.netdev;  in macsec_notify()
3517 			unsigned int mtu = real_dev->mtu - (m->secy.icv_len +  in macsec_notify()