64 #define for_each_rxsc(secy, sc)				\  argument
65 	for (sc = rcu_dereference_bh(secy->rx_sc);	\
68 #define for_each_rxsc_rtnl(secy, sc)			\  argument
69 	for (sc = rtnl_dereference(secy->rx_sc);	\
107 	struct macsec_secy secy;  member
244 static bool send_sci(const struct macsec_secy *secy)  in send_sci()  argument
246 	const struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in send_sci()
249 		(secy->n_rx_sc > 1 && !tx_sc->end_station && !tx_sc->scb);  in send_sci()
292 			       const struct macsec_secy *secy, u32 pn,  in macsec_fill_sectag()  argument
295 	const struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in macsec_fill_sectag()
302 		memcpy(&h->secure_channel_id, &secy->sci,  in macsec_fill_sectag()
316 	else if (secy->icv_len != DEFAULT_ICV_LEN)  in macsec_fill_sectag()
453 static void __macsec_pn_wrapped(struct macsec_secy *secy,  in __macsec_pn_wrapped()  argument
458 	if (secy->protect_frames)  in __macsec_pn_wrapped()
459 		secy->operational = false;  in __macsec_pn_wrapped()
462 void macsec_pn_wrapped(struct macsec_secy *secy, struct macsec_tx_sa *tx_sa)  in macsec_pn_wrapped()  argument
465 	__macsec_pn_wrapped(secy, tx_sa);  in macsec_pn_wrapped()
471 			    struct macsec_secy *secy)  in tx_sa_update_pn()  argument
478 	if (secy->xpn)  in tx_sa_update_pn()
484 		__macsec_pn_wrapped(secy, tx_sa);  in tx_sa_update_pn()
541 	macsec_count_tx(skb, &macsec->secy.tx_sc, macsec_skb_cb(skb)->tx_sa);  in macsec_encrypt_done()
592 	struct macsec_secy *secy;  in macsec_encrypt()  local
599 	secy = &macsec->secy;  in macsec_encrypt()
600 	tx_sc = &secy->tx_sc;  in macsec_encrypt()
605 		secy->operational = false;  in macsec_encrypt()
634 	sci_present = send_sci(secy);  in macsec_encrypt()
638 	pn = tx_sa_update_pn(tx_sa, secy);  in macsec_encrypt()
644 	macsec_fill_sectag(hh, secy, pn.lower, sci_present);  in macsec_encrypt()
647 	skb_put(skb, secy->icv_len);  in macsec_encrypt()
675 	if (secy->xpn)  in macsec_encrypt()
678 		macsec_fill_iv(iv, secy->sci, pn.lower);  in macsec_encrypt()
691 			  secy->icv_len;  in macsec_encrypt()
696 		aead_request_set_ad(req, skb->len - secy->icv_len);  in macsec_encrypt()
722 static bool macsec_post_decrypt(struct sk_buff *skb, struct macsec_secy *secy, u32 pn)  in macsec_post_decrypt()  argument
730 	if (rx_sa->next_pn_halves.lower >= secy->replay_window)  in macsec_post_decrypt()
731 		lowest_pn = rx_sa->next_pn_halves.lower - secy->replay_window;  in macsec_post_decrypt()
736 	if (secy->replay_protect && pn < lowest_pn &&  in macsec_post_decrypt()
737 	    (!secy->xpn || pn_same_half(pn, lowest_pn))) {  in macsec_post_decrypt()
745 	if (secy->validate_frames != MACSEC_VALIDATE_DISABLED) {  in macsec_post_decrypt()
759 		    secy->validate_frames == MACSEC_VALIDATE_STRICT) {  in macsec_post_decrypt()
767 		if (secy->validate_frames == MACSEC_VALIDATE_CHECK) {  in macsec_post_decrypt()
789 		} else if (secy->xpn &&  in macsec_post_decrypt()
847 	if (!macsec_post_decrypt(skb, &macsec->secy, pn)) {  in macsec_decrypt_done()
853 	macsec_finalize_skb(skb, macsec->secy.icv_len,  in macsec_decrypt_done()
855 	macsec_reset_skb(skb, macsec->secy.netdev);  in macsec_decrypt_done()
873 				      struct macsec_secy *secy)  in macsec_decrypt()  argument
882 	u16 icv_len = secy->icv_len;  in macsec_decrypt()
903 	if (secy->xpn) {  in macsec_decrypt()
970 static struct macsec_rx_sc *find_rx_sc(struct macsec_secy *secy, sci_t sci)  in find_rx_sc()  argument
974 	for_each_rxsc(secy, rx_sc) {  in find_rx_sc()
982 static struct macsec_rx_sc *find_rx_sc_rtnl(struct macsec_secy *secy, sci_t sci)  in find_rx_sc_rtnl()  argument
986 	for_each_rxsc_rtnl(secy, rx_sc) {  in find_rx_sc_rtnl()
1008 		struct net_device *ndev = macsec->secy.netdev;  in handle_not_macsec()
1044 		if (macsec->secy.validate_frames == MACSEC_VALIDATE_STRICT) {  in handle_not_macsec()
1075 	struct macsec_secy *secy = NULL;  in macsec_handle_frame()  local
1134 		struct macsec_rx_sc *sc = find_rx_sc(&macsec->secy, sci);  in macsec_handle_frame()
1139 			secy = &macsec->secy;  in macsec_handle_frame()
1145 	if (!secy)  in macsec_handle_frame()
1148 	dev = secy->netdev;  in macsec_handle_frame()
1153 	if (!macsec_validate_skb(skb, secy->icv_len, secy->xpn)) {  in macsec_handle_frame()
1168 		    secy->validate_frames == MACSEC_VALIDATE_STRICT) {  in macsec_handle_frame()
1186 	if (secy->replay_protect) {  in macsec_handle_frame()
1190 		late = rx_sa->next_pn_halves.lower >= secy->replay_window &&  in macsec_handle_frame()
1191 		       hdr_pn < (rx_sa->next_pn_halves.lower - secy->replay_window);  in macsec_handle_frame()
1193 		if (secy->xpn)  in macsec_handle_frame()
1209 	    secy->validate_frames != MACSEC_VALIDATE_DISABLED)  in macsec_handle_frame()
1210 		skb = macsec_decrypt(skb, dev, rx_sa, sci, secy);  in macsec_handle_frame()
1223 	if (!macsec_post_decrypt(skb, secy, hdr_pn))  in macsec_handle_frame()
1227 	macsec_finalize_skb(skb, secy->icv_len,  in macsec_handle_frame()
1229 	macsec_reset_skb(skb, secy->netdev);  in macsec_handle_frame()
1241 		macsec->secy.netdev->stats.rx_dropped++;  in macsec_handle_frame()
1274 		    macsec->secy.validate_frames == MACSEC_VALIDATE_STRICT) {  in macsec_handle_frame()
1288 		macsec_reset_skb(nskb, macsec->secy.netdev);  in macsec_handle_frame()
1296 			macsec->secy.netdev->stats.rx_dropped++;  in macsec_handle_frame()
1374 static struct macsec_rx_sc *del_rx_sc(struct macsec_secy *secy, sci_t sci)  in del_rx_sc()  argument
1378 	for (rx_scp = &secy->rx_sc, rx_sc = rtnl_dereference(*rx_scp);  in del_rx_sc()
1383 				secy->n_rx_sc--;  in del_rx_sc()
1398 	struct macsec_secy *secy;  in create_rx_sc()  local
1401 		if (find_rx_sc_rtnl(&macsec->secy, sci))  in create_rx_sc()
1419 	secy = &macsec_priv(dev)->secy;  in create_rx_sc()
1420 	rcu_assign_pointer(rx_sc->next, secy->rx_sc);  in create_rx_sc()
1421 	rcu_assign_pointer(secy->rx_sc, rx_sc);  in create_rx_sc()
1424 		secy->n_rx_sc++;  in create_rx_sc()
1510 	struct macsec_secy *secy;  in get_txsa_from_nl()  local
1526 	secy = &macsec_priv(dev)->secy;  in get_txsa_from_nl()
1527 	tx_sc = &secy->tx_sc;  in get_txsa_from_nl()
1535 	*secyp = secy;  in get_txsa_from_nl()
1546 	struct macsec_secy *secy;  in get_rxsc_from_nl()  local
1554 	secy = &macsec_priv(dev)->secy;  in get_rxsc_from_nl()
1560 	rx_sc = find_rx_sc_rtnl(secy, sci);  in get_rxsc_from_nl()
1564 	*secyp = secy;  in get_rxsc_from_nl()
1715 	struct macsec_secy *secy;  in macsec_add_rxsa()  local
1737 	rx_sc = get_rxsc_from_nl(genl_info_net(info), attrs, tb_rxsc, &dev, &secy);  in macsec_add_rxsa()
1745 	if (nla_len(tb_sa[MACSEC_SA_ATTR_KEY]) != secy->key_len) {  in macsec_add_rxsa()
1747 			  nla_len(tb_sa[MACSEC_SA_ATTR_KEY]), secy->key_len);  in macsec_add_rxsa()
1752 	pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;  in macsec_add_rxsa()
1760 	if (secy->xpn) {  in macsec_add_rxsa()
1788 			 secy->key_len, secy->icv_len);  in macsec_add_rxsa()
1819 		ctx.secy = secy;  in macsec_add_rxsa()
1828 	if (secy->xpn) {  in macsec_add_rxsa()
1867 	struct macsec_secy *secy;  in macsec_add_rxsc()  local
1887 	secy = &macsec_priv(dev)->secy;  in macsec_add_rxsc()
1911 		ctx.secy = secy;  in macsec_add_rxsc()
1957 	struct macsec_secy *secy;  in macsec_add_txsa()  local
1982 	secy = &macsec_priv(dev)->secy;  in macsec_add_txsa()
1983 	tx_sc = &secy->tx_sc;  in macsec_add_txsa()
1987 	if (nla_len(tb_sa[MACSEC_SA_ATTR_KEY]) != secy->key_len) {  in macsec_add_txsa()
1989 			  nla_len(tb_sa[MACSEC_SA_ATTR_KEY]), secy->key_len);  in macsec_add_txsa()
1994 	pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;  in macsec_add_txsa()
2002 	if (secy->xpn) {  in macsec_add_txsa()
2030 			 secy->key_len, secy->icv_len);  in macsec_add_txsa()
2044 	was_operational = secy->operational;  in macsec_add_txsa()
2046 		secy->operational = true;  in macsec_add_txsa()
2061 		ctx.secy = secy;  in macsec_add_txsa()
2070 	if (secy->xpn) {  in macsec_add_txsa()
2084 	secy->operational = was_operational;  in macsec_add_txsa()
2094 	struct macsec_secy *secy;  in macsec_del_rxsa()  local
2113 				 &dev, &secy, &rx_sc, &assoc_num);  in macsec_del_rxsa()
2137 		ctx.secy = secy;  in macsec_del_rxsa()
2160 	struct macsec_secy *secy;  in macsec_del_rxsc()  local
2182 	secy = &macsec_priv(dev)->secy;  in macsec_del_rxsc()
2185 	rx_sc = del_rx_sc(secy, sci);  in macsec_del_rxsc()
2203 		ctx.secy = secy;  in macsec_del_rxsc()
2223 	struct macsec_secy *secy;  in macsec_del_txsa()  local
2238 				 &dev, &secy, &tx_sc, &assoc_num);  in macsec_del_txsa()
2262 		ctx.secy = secy;  in macsec_del_txsa()
2308 	struct macsec_secy *secy;  in macsec_upd_txsa()  local
2330 				 &dev, &secy, &tx_sc, &assoc_num);  in macsec_upd_txsa()
2339 		pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;  in macsec_upd_txsa()
2357 	was_operational = secy->operational;  in macsec_upd_txsa()
2359 		secy->operational = tx_sa->active;  in macsec_upd_txsa()
2374 		ctx.secy = secy;  in macsec_upd_txsa()
2392 	secy->operational = was_operational;  in macsec_upd_txsa()
2401 	struct macsec_secy *secy;  in macsec_upd_rxsa()  local
2427 				 &dev, &secy, &rx_sc, &assoc_num);  in macsec_upd_rxsa()
2436 		pn_len = secy->xpn ? MACSEC_XPN_PN_LEN : MACSEC_DEFAULT_PN_LEN;  in macsec_upd_rxsa()
2467 		ctx.secy = secy;  in macsec_upd_rxsa()
2492 	struct macsec_secy *secy;  in macsec_upd_rxsc()  local
2509 	rx_sc = get_rxsc_from_nl(genl_info_net(info), attrs, tb_rxsc, &dev, &secy);  in macsec_upd_rxsc()
2516 	prev_n_rx_sc = secy->n_rx_sc;  in macsec_upd_rxsc()
2521 			secy->n_rx_sc += new ? 1 : -1;  in macsec_upd_rxsc()
2538 		ctx.secy = secy;  in macsec_upd_rxsc()
2550 	secy->n_rx_sc = prev_n_rx_sc;  in macsec_upd_rxsc()
2558 	struct macsec_secy *secy = &macsec->secy;  in macsec_is_configured()  local
2559 	struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in macsec_is_configured()
2562 	if (secy->n_rx_sc > 0)  in macsec_is_configured()
2641 	ctx.secy = &macsec->secy;  in macsec_upd_offload()
2678 			ctx.secy = &macsec_priv(dev)->secy;  in get_tx_sa_stats()
2722 			ctx.secy = &macsec_priv(dev)->secy;  in get_rx_sa_stats()
2773 			ctx.secy = &macsec_priv(dev)->secy;  in get_rx_sc_stats()
2855 			ctx.secy = &macsec_priv(dev)->secy;  in get_tx_sc_stats()
2866 		stats = per_cpu_ptr(macsec_priv(dev)->secy.tx_sc.stats, cpu);  in get_tx_sc_stats()
2911 			ctx.secy = &macsec_priv(dev)->secy;  in get_secy_stats()
2970 static int nla_put_secy(struct macsec_secy *secy, struct sk_buff *skb)  in nla_put_secy()  argument
2972 	struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in nla_put_secy()
2980 	switch (secy->key_len) {  in nla_put_secy()
2982 		csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_128 : MACSEC_DEFAULT_CIPHER_ID;  in nla_put_secy()
2985 		csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_256 : MACSEC_CIPHER_ID_GCM_AES_256;  in nla_put_secy()
2991 	if (nla_put_sci(skb, MACSEC_SECY_ATTR_SCI, secy->sci,  in nla_put_secy()
2995 	    nla_put_u8(skb, MACSEC_SECY_ATTR_ICV_LEN, secy->icv_len) ||  in nla_put_secy()
2996 	    nla_put_u8(skb, MACSEC_SECY_ATTR_OPER, secy->operational) ||  in nla_put_secy()
2997 	    nla_put_u8(skb, MACSEC_SECY_ATTR_PROTECT, secy->protect_frames) ||  in nla_put_secy()
2998 	    nla_put_u8(skb, MACSEC_SECY_ATTR_REPLAY, secy->replay_protect) ||  in nla_put_secy()
2999 	    nla_put_u8(skb, MACSEC_SECY_ATTR_VALIDATE, secy->validate_frames) ||  in nla_put_secy()
3007 	if (secy->replay_protect) {  in nla_put_secy()
3008 		if (nla_put_u32(skb, MACSEC_SECY_ATTR_WINDOW, secy->replay_window))  in nla_put_secy()
3021 dump_secy(struct macsec_secy *secy, struct net_device *dev,  in dump_secy()  argument
3030 	struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in dump_secy()
3054 	if (nla_put_secy(secy, skb))  in dump_secy()
3112 		if (secy->xpn) {  in dump_secy()
3123 		    (secy->xpn && nla_put_ssci(skb, MACSEC_SA_ATTR_SSCI, tx_sa->ssci)) ||  in dump_secy()
3139 	for_each_rxsc_rtnl(secy, rx_sc) {  in dump_secy()
3217 			if (secy->xpn) {  in dump_secy()
3228 			    (secy->xpn && nla_put_ssci(skb, MACSEC_SA_ATTR_SSCI, rx_sa->ssci)) ||  in dump_secy()
3269 		struct macsec_secy *secy;  in macsec_dump_txsc()  local
3277 		secy = &macsec_priv(dev)->secy;  in macsec_dump_txsc()
3278 		if (dump_secy(secy, dev, skb, cb) < 0)  in macsec_dump_txsc()
3374 	struct macsec_secy *secy = &macsec->secy;  in macsec_start_xmit()  local
3384 	if (!secy->protect_frames) {  in macsec_start_xmit()
3396 	if (!secy->operational) {  in macsec_start_xmit()
3409 	macsec_count_tx(skb, &macsec->secy.tx_sc, macsec_skb_cb(skb)->tx_sa);  in macsec_start_xmit()
3521 		ctx.secy = &macsec->secy;  in macsec_dev_open()
3554 			ctx.secy = &macsec->secy;  in macsec_dev_stop()
3617 	macsec->secy.sci = dev_to_sci(dev, MACSEC_PORT_ES);  in macsec_set_mac_address()
3626 			ctx.secy = &macsec->secy;  in macsec_set_mac_address()
3637 	unsigned int extra = macsec->secy.icv_len + macsec_extra_len(true);  in macsec_change_mtu()
3704 	free_percpu(macsec->secy.tx_sc.stats);  in macsec_free_netdev()
3725 	struct macsec_secy *secy;  in macsec_changelink_common()  local
3728 	secy = &macsec_priv(dev)->secy;  in macsec_changelink_common()
3729 	tx_sc = &secy->tx_sc;  in macsec_changelink_common()
3737 		secy->operational = tx_sa && tx_sa->active;  in macsec_changelink_common()
3741 		secy->replay_window = nla_get_u32(data[IFLA_MACSEC_WINDOW]);  in macsec_changelink_common()
3747 		secy->protect_frames = !!nla_get_u8(data[IFLA_MACSEC_PROTECT]);  in macsec_changelink_common()
3759 		secy->replay_protect = !!nla_get_u8(data[IFLA_MACSEC_REPLAY_PROTECT]);  in macsec_changelink_common()
3762 		secy->validate_frames = nla_get_u8(data[IFLA_MACSEC_VALIDATION]);  in macsec_changelink_common()
3768 			secy->key_len = MACSEC_GCM_AES_128_SAK_LEN;  in macsec_changelink_common()
3769 			secy->xpn = false;  in macsec_changelink_common()
3772 			secy->key_len = MACSEC_GCM_AES_256_SAK_LEN;  in macsec_changelink_common()
3773 			secy->xpn = false;  in macsec_changelink_common()
3776 			secy->key_len = MACSEC_GCM_AES_128_SAK_LEN;  in macsec_changelink_common()
3777 			secy->xpn = true;  in macsec_changelink_common()
3780 			secy->key_len = MACSEC_GCM_AES_256_SAK_LEN;  in macsec_changelink_common()
3781 			secy->xpn = true;  in macsec_changelink_common()
3797 	struct macsec_secy secy;  in macsec_changelink()  local
3812 	memcpy(&secy, &macsec->secy, sizeof(secy));  in macsec_changelink()
3813 	memcpy(&tx_sc, &macsec->secy.tx_sc, sizeof(tx_sc));  in macsec_changelink()
3831 		ctx.secy = &macsec->secy;  in macsec_changelink()
3840 	memcpy(&macsec->secy.tx_sc, &tx_sc, sizeof(tx_sc));  in macsec_changelink()
3841 	memcpy(&macsec->secy, &secy, sizeof(secy));  in macsec_changelink()
3850 	while (macsec->secy.rx_sc) {  in macsec_del_dev()
3851 		struct macsec_rx_sc *rx_sc = rtnl_dereference(macsec->secy.rx_sc);  in macsec_del_dev()
3853 		rcu_assign_pointer(macsec->secy.rx_sc, rx_sc->next);  in macsec_del_dev()
3858 		struct macsec_tx_sa *sa = rtnl_dereference(macsec->secy.tx_sc.sa[i]);  in macsec_del_dev()
3861 			RCU_INIT_POINTER(macsec->secy.tx_sc.sa[i], NULL);  in macsec_del_dev()
3893 			ctx.secy = &macsec->secy;  in macsec_dellink()
3939 		if (macsec->secy.sci == sci)  in sci_exists()
3949 	struct macsec_secy *secy = &macsec->secy;  in macsec_add_dev()  local
3955 	secy->tx_sc.stats = netdev_alloc_pcpu_stats(struct pcpu_tx_sc_stats);  in macsec_add_dev()
3956 	if (!secy->tx_sc.stats) {  in macsec_add_dev()
3964 	secy->netdev = dev;  in macsec_add_dev()
3965 	secy->operational = true;  in macsec_add_dev()
3966 	secy->key_len = DEFAULT_SAK_LEN;  in macsec_add_dev()
3967 	secy->icv_len = icv_len;  in macsec_add_dev()
3968 	secy->validate_frames = MACSEC_VALIDATE_DEFAULT;  in macsec_add_dev()
3969 	secy->protect_frames = true;  in macsec_add_dev()
3970 	secy->replay_protect = false;  in macsec_add_dev()
3971 	secy->xpn = DEFAULT_XPN;  in macsec_add_dev()
3973 	secy->sci = sci;  in macsec_add_dev()
3974 	secy->tx_sc.active = true;  in macsec_add_dev()
3975 	secy->tx_sc.encoding_sa = DEFAULT_ENCODING_SA;  in macsec_add_dev()
3976 	secy->tx_sc.encrypt = DEFAULT_ENCRYPT;  in macsec_add_dev()
3977 	secy->tx_sc.send_sci = DEFAULT_SEND_SCI;  in macsec_add_dev()
3978 	secy->tx_sc.end_station = false;  in macsec_add_dev()
3979 	secy->tx_sc.scb = false;  in macsec_add_dev()
4076 			ctx.secy = &macsec->secy;  in macsec_newlink()
4204 	struct macsec_secy *secy = &macsec_priv(dev)->secy;  in macsec_fill_info()  local
4205 	struct macsec_tx_sc *tx_sc = &secy->tx_sc;  in macsec_fill_info()
4208 	switch (secy->key_len) {  in macsec_fill_info()
4210 		csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_128 : MACSEC_DEFAULT_CIPHER_ID;  in macsec_fill_info()
4213 		csid = secy->xpn ? MACSEC_CIPHER_ID_GCM_AES_XPN_256 : MACSEC_CIPHER_ID_GCM_AES_256;  in macsec_fill_info()
4219 	if (nla_put_sci(skb, IFLA_MACSEC_SCI, secy->sci,  in macsec_fill_info()
4221 	    nla_put_u8(skb, IFLA_MACSEC_ICV_LEN, secy->icv_len) ||  in macsec_fill_info()
4226 	    nla_put_u8(skb, IFLA_MACSEC_PROTECT, secy->protect_frames) ||  in macsec_fill_info()
4230 	    nla_put_u8(skb, IFLA_MACSEC_REPLAY_PROTECT, secy->replay_protect) ||  in macsec_fill_info()
4231 	    nla_put_u8(skb, IFLA_MACSEC_VALIDATION, secy->validate_frames) ||  in macsec_fill_info()
4235 	if (secy->replay_protect) {  in macsec_fill_info()
4236 		if (nla_put_u32(skb, IFLA_MACSEC_WINDOW, secy->replay_window))  in macsec_fill_info()
4284 			struct net_device *dev = m->secy.netdev;  in macsec_notify()
4296 			macsec_common_dellink(m->secy.netdev, &head);  in macsec_notify()
4311 			struct net_device *dev = m->secy.netdev;  in macsec_notify()
4312 			unsigned int mtu = real_dev->mtu - (m->secy.icv_len +  in macsec_notify()