1771 lines · c
1// SPDX-License-Identifier: GPL-2.0-only2/* Atlantic Network Driver3 * Copyright (C) 2020 Marvell International Ltd.4 */5 6#include "aq_macsec.h"7#include "aq_nic.h"8#include <linux/rtnetlink.h>9 10#include "macsec/macsec_api.h"11#define AQ_MACSEC_KEY_LEN_128_BIT 1612#define AQ_MACSEC_KEY_LEN_192_BIT 2413#define AQ_MACSEC_KEY_LEN_256_BIT 3214 15enum aq_clear_type {16 /* update HW configuration */17 AQ_CLEAR_HW = BIT(0),18 /* update SW configuration (busy bits, pointers) */19 AQ_CLEAR_SW = BIT(1),20 /* update both HW and SW configuration */21 AQ_CLEAR_ALL = AQ_CLEAR_HW | AQ_CLEAR_SW,22};23 24static int aq_clear_txsc(struct aq_nic_s *nic, const int txsc_idx,25 enum aq_clear_type clear_type);26static int aq_clear_txsa(struct aq_nic_s *nic, struct aq_macsec_txsc *aq_txsc,27 const int sa_num, enum aq_clear_type clear_type);28static int aq_clear_rxsc(struct aq_nic_s *nic, const int rxsc_idx,29 enum aq_clear_type clear_type);30static int aq_clear_rxsa(struct aq_nic_s *nic, struct aq_macsec_rxsc *aq_rxsc,31 const int sa_num, enum aq_clear_type clear_type);32static int aq_clear_secy(struct aq_nic_s *nic, const struct macsec_secy *secy,33 enum aq_clear_type clear_type);34static int aq_apply_macsec_cfg(struct aq_nic_s *nic);35static int aq_apply_secy_cfg(struct aq_nic_s *nic,36 const struct macsec_secy *secy);37 38static void aq_ether_addr_to_mac(u32 mac[2], const unsigned char *emac)39{40 u32 tmp[2] = { 0 };41 42 memcpy(((u8 *)tmp) + 2, emac, ETH_ALEN);43 44 mac[0] = swab32(tmp[1]);45 mac[1] = swab32(tmp[0]);46}47 48/* There's a 1:1 mapping between SecY and TX SC */49static int aq_get_txsc_idx_from_secy(struct aq_macsec_cfg *macsec_cfg,50 const struct macsec_secy *secy)51{52 int i;53 54 if (unlikely(!secy))55 return -1;56 57 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {58 if (macsec_cfg->aq_txsc[i].sw_secy == secy)59 return i;60 }61 return -1;62}63 64static int aq_get_rxsc_idx_from_rxsc(struct aq_macsec_cfg *macsec_cfg,65 const struct macsec_rx_sc *rxsc)66{67 int i;68 69 if (unlikely(!rxsc))70 return -1;71 72 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {73 if (macsec_cfg->aq_rxsc[i].sw_rxsc == rxsc)74 return i;75 }76 77 return -1;78}79 80static int aq_get_txsc_idx_from_sc_idx(const enum aq_macsec_sc_sa sc_sa,81 const int sc_idx)82{83 switch (sc_sa) {84 case aq_macsec_sa_sc_4sa_8sc:85 return sc_idx >> 2;86 case aq_macsec_sa_sc_2sa_16sc:87 return sc_idx >> 1;88 case aq_macsec_sa_sc_1sa_32sc:89 return sc_idx;90 default:91 WARN_ONCE(true, "Invalid sc_sa");92 }93 return -1;94}95 96/* Rotate keys u32[8] */97static void aq_rotate_keys(u32 (*key)[8], const int key_len)98{99 u32 tmp[8] = { 0 };100 101 memcpy(&tmp, key, sizeof(tmp));102 memset(*key, 0, sizeof(*key));103 104 if (key_len == AQ_MACSEC_KEY_LEN_128_BIT) {105 (*key)[0] = swab32(tmp[3]);106 (*key)[1] = swab32(tmp[2]);107 (*key)[2] = swab32(tmp[1]);108 (*key)[3] = swab32(tmp[0]);109 } else if (key_len == AQ_MACSEC_KEY_LEN_192_BIT) {110 (*key)[0] = swab32(tmp[5]);111 (*key)[1] = swab32(tmp[4]);112 (*key)[2] = swab32(tmp[3]);113 (*key)[3] = swab32(tmp[2]);114 (*key)[4] = swab32(tmp[1]);115 (*key)[5] = swab32(tmp[0]);116 } else if (key_len == AQ_MACSEC_KEY_LEN_256_BIT) {117 (*key)[0] = swab32(tmp[7]);118 (*key)[1] = swab32(tmp[6]);119 (*key)[2] = swab32(tmp[5]);120 (*key)[3] = swab32(tmp[4]);121 (*key)[4] = swab32(tmp[3]);122 (*key)[5] = swab32(tmp[2]);123 (*key)[6] = swab32(tmp[1]);124 (*key)[7] = swab32(tmp[0]);125 } else {126 pr_warn("Rotate_keys: invalid key_len\n");127 }128}129 130#define STATS_2x32_TO_64(stat_field) \131 (((u64)stat_field[1] << 32) | stat_field[0])132 133static int aq_get_macsec_common_stats(struct aq_hw_s *hw,134 struct aq_macsec_common_stats *stats)135{136 struct aq_mss_ingress_common_counters ingress_counters;137 struct aq_mss_egress_common_counters egress_counters;138 int ret;139 140 /* MACSEC counters */141 ret = aq_mss_get_ingress_common_counters(hw, &ingress_counters);142 if (unlikely(ret))143 return ret;144 145 stats->in.ctl_pkts = STATS_2x32_TO_64(ingress_counters.ctl_pkts);146 stats->in.tagged_miss_pkts =147 STATS_2x32_TO_64(ingress_counters.tagged_miss_pkts);148 stats->in.untagged_miss_pkts =149 STATS_2x32_TO_64(ingress_counters.untagged_miss_pkts);150 stats->in.notag_pkts = STATS_2x32_TO_64(ingress_counters.notag_pkts);151 stats->in.untagged_pkts =152 STATS_2x32_TO_64(ingress_counters.untagged_pkts);153 stats->in.bad_tag_pkts =154 STATS_2x32_TO_64(ingress_counters.bad_tag_pkts);155 stats->in.no_sci_pkts = STATS_2x32_TO_64(ingress_counters.no_sci_pkts);156 stats->in.unknown_sci_pkts =157 STATS_2x32_TO_64(ingress_counters.unknown_sci_pkts);158 stats->in.ctrl_prt_pass_pkts =159 STATS_2x32_TO_64(ingress_counters.ctrl_prt_pass_pkts);160 stats->in.unctrl_prt_pass_pkts =161 STATS_2x32_TO_64(ingress_counters.unctrl_prt_pass_pkts);162 stats->in.ctrl_prt_fail_pkts =163 STATS_2x32_TO_64(ingress_counters.ctrl_prt_fail_pkts);164 stats->in.unctrl_prt_fail_pkts =165 STATS_2x32_TO_64(ingress_counters.unctrl_prt_fail_pkts);166 stats->in.too_long_pkts =167 STATS_2x32_TO_64(ingress_counters.too_long_pkts);168 stats->in.igpoc_ctl_pkts =169 STATS_2x32_TO_64(ingress_counters.igpoc_ctl_pkts);170 stats->in.ecc_error_pkts =171 STATS_2x32_TO_64(ingress_counters.ecc_error_pkts);172 stats->in.unctrl_hit_drop_redir =173 STATS_2x32_TO_64(ingress_counters.unctrl_hit_drop_redir);174 175 ret = aq_mss_get_egress_common_counters(hw, &egress_counters);176 if (unlikely(ret))177 return ret;178 stats->out.ctl_pkts = STATS_2x32_TO_64(egress_counters.ctl_pkt);179 stats->out.unknown_sa_pkts =180 STATS_2x32_TO_64(egress_counters.unknown_sa_pkts);181 stats->out.untagged_pkts =182 STATS_2x32_TO_64(egress_counters.untagged_pkts);183 stats->out.too_long = STATS_2x32_TO_64(egress_counters.too_long);184 stats->out.ecc_error_pkts =185 STATS_2x32_TO_64(egress_counters.ecc_error_pkts);186 stats->out.unctrl_hit_drop_redir =187 STATS_2x32_TO_64(egress_counters.unctrl_hit_drop_redir);188 189 return 0;190}191 192static int aq_get_rxsa_stats(struct aq_hw_s *hw, const int sa_idx,193 struct aq_macsec_rx_sa_stats *stats)194{195 struct aq_mss_ingress_sa_counters i_sa_counters;196 int ret;197 198 ret = aq_mss_get_ingress_sa_counters(hw, &i_sa_counters, sa_idx);199 if (unlikely(ret))200 return ret;201 202 stats->untagged_hit_pkts =203 STATS_2x32_TO_64(i_sa_counters.untagged_hit_pkts);204 stats->ctrl_hit_drop_redir_pkts =205 STATS_2x32_TO_64(i_sa_counters.ctrl_hit_drop_redir_pkts);206 stats->not_using_sa = STATS_2x32_TO_64(i_sa_counters.not_using_sa);207 stats->unused_sa = STATS_2x32_TO_64(i_sa_counters.unused_sa);208 stats->not_valid_pkts = STATS_2x32_TO_64(i_sa_counters.not_valid_pkts);209 stats->invalid_pkts = STATS_2x32_TO_64(i_sa_counters.invalid_pkts);210 stats->ok_pkts = STATS_2x32_TO_64(i_sa_counters.ok_pkts);211 stats->late_pkts = STATS_2x32_TO_64(i_sa_counters.late_pkts);212 stats->delayed_pkts = STATS_2x32_TO_64(i_sa_counters.delayed_pkts);213 stats->unchecked_pkts = STATS_2x32_TO_64(i_sa_counters.unchecked_pkts);214 stats->validated_octets =215 STATS_2x32_TO_64(i_sa_counters.validated_octets);216 stats->decrypted_octets =217 STATS_2x32_TO_64(i_sa_counters.decrypted_octets);218 219 return 0;220}221 222static int aq_get_txsa_stats(struct aq_hw_s *hw, const int sa_idx,223 struct aq_macsec_tx_sa_stats *stats)224{225 struct aq_mss_egress_sa_counters e_sa_counters;226 int ret;227 228 ret = aq_mss_get_egress_sa_counters(hw, &e_sa_counters, sa_idx);229 if (unlikely(ret))230 return ret;231 232 stats->sa_hit_drop_redirect =233 STATS_2x32_TO_64(e_sa_counters.sa_hit_drop_redirect);234 stats->sa_protected2_pkts =235 STATS_2x32_TO_64(e_sa_counters.sa_protected2_pkts);236 stats->sa_protected_pkts =237 STATS_2x32_TO_64(e_sa_counters.sa_protected_pkts);238 stats->sa_encrypted_pkts =239 STATS_2x32_TO_64(e_sa_counters.sa_encrypted_pkts);240 241 return 0;242}243 244static int aq_get_txsa_next_pn(struct aq_hw_s *hw, const int sa_idx, u32 *pn)245{246 struct aq_mss_egress_sa_record sa_rec;247 int ret;248 249 ret = aq_mss_get_egress_sa_record(hw, &sa_rec, sa_idx);250 if (likely(!ret))251 *pn = sa_rec.next_pn;252 253 return ret;254}255 256static int aq_get_rxsa_next_pn(struct aq_hw_s *hw, const int sa_idx, u32 *pn)257{258 struct aq_mss_ingress_sa_record sa_rec;259 int ret;260 261 ret = aq_mss_get_ingress_sa_record(hw, &sa_rec, sa_idx);262 if (likely(!ret))263 *pn = (!sa_rec.sat_nextpn) ? sa_rec.next_pn : 0;264 265 return ret;266}267 268static int aq_get_txsc_stats(struct aq_hw_s *hw, const int sc_idx,269 struct aq_macsec_tx_sc_stats *stats)270{271 struct aq_mss_egress_sc_counters e_sc_counters;272 int ret;273 274 ret = aq_mss_get_egress_sc_counters(hw, &e_sc_counters, sc_idx);275 if (unlikely(ret))276 return ret;277 278 stats->sc_protected_pkts =279 STATS_2x32_TO_64(e_sc_counters.sc_protected_pkts);280 stats->sc_encrypted_pkts =281 STATS_2x32_TO_64(e_sc_counters.sc_encrypted_pkts);282 stats->sc_protected_octets =283 STATS_2x32_TO_64(e_sc_counters.sc_protected_octets);284 stats->sc_encrypted_octets =285 STATS_2x32_TO_64(e_sc_counters.sc_encrypted_octets);286 287 return 0;288}289 290static int aq_mdo_dev_open(struct macsec_context *ctx)291{292 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);293 int ret = 0;294 295 if (netif_carrier_ok(nic->ndev))296 ret = aq_apply_secy_cfg(nic, ctx->secy);297 298 return ret;299}300 301static int aq_mdo_dev_stop(struct macsec_context *ctx)302{303 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);304 int i;305 306 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {307 if (nic->macsec_cfg->txsc_idx_busy & BIT(i))308 aq_clear_secy(nic, nic->macsec_cfg->aq_txsc[i].sw_secy,309 AQ_CLEAR_HW);310 }311 312 return 0;313}314 315static int aq_set_txsc(struct aq_nic_s *nic, const int txsc_idx)316{317 struct aq_macsec_txsc *aq_txsc = &nic->macsec_cfg->aq_txsc[txsc_idx];318 struct aq_mss_egress_class_record tx_class_rec = { 0 };319 const struct macsec_secy *secy = aq_txsc->sw_secy;320 struct aq_mss_egress_sc_record sc_rec = { 0 };321 unsigned int sc_idx = aq_txsc->hw_sc_idx;322 struct aq_hw_s *hw = nic->aq_hw;323 int ret = 0;324 325 aq_ether_addr_to_mac(tx_class_rec.mac_sa, secy->netdev->dev_addr);326 327 put_unaligned_be64((__force u64)secy->sci, tx_class_rec.sci);328 tx_class_rec.sci_mask = 0;329 330 tx_class_rec.sa_mask = 0x3f;331 332 tx_class_rec.action = 0; /* forward to SA/SC table */333 tx_class_rec.valid = 1;334 335 tx_class_rec.sc_idx = sc_idx;336 337 tx_class_rec.sc_sa = nic->macsec_cfg->sc_sa;338 339 ret = aq_mss_set_egress_class_record(hw, &tx_class_rec, txsc_idx);340 if (ret)341 return ret;342 343 sc_rec.protect = secy->protect_frames;344 if (secy->tx_sc.encrypt)345 sc_rec.tci |= BIT(1);346 if (secy->tx_sc.scb)347 sc_rec.tci |= BIT(2);348 if (secy->tx_sc.send_sci)349 sc_rec.tci |= BIT(3);350 if (secy->tx_sc.end_station)351 sc_rec.tci |= BIT(4);352 /* The C bit is clear if and only if the Secure Data is353 * exactly the same as the User Data and the ICV is 16 octets long.354 */355 if (!(secy->icv_len == 16 && !secy->tx_sc.encrypt))356 sc_rec.tci |= BIT(0);357 358 sc_rec.an_roll = 0;359 360 switch (secy->key_len) {361 case AQ_MACSEC_KEY_LEN_128_BIT:362 sc_rec.sak_len = 0;363 break;364 case AQ_MACSEC_KEY_LEN_192_BIT:365 sc_rec.sak_len = 1;366 break;367 case AQ_MACSEC_KEY_LEN_256_BIT:368 sc_rec.sak_len = 2;369 break;370 default:371 WARN_ONCE(true, "Invalid sc_sa");372 return -EINVAL;373 }374 375 sc_rec.curr_an = secy->tx_sc.encoding_sa;376 sc_rec.valid = 1;377 sc_rec.fresh = 1;378 379 return aq_mss_set_egress_sc_record(hw, &sc_rec, sc_idx);380}381 382static u32 aq_sc_idx_max(const enum aq_macsec_sc_sa sc_sa)383{384 u32 result = 0;385 386 switch (sc_sa) {387 case aq_macsec_sa_sc_4sa_8sc:388 result = 8;389 break;390 case aq_macsec_sa_sc_2sa_16sc:391 result = 16;392 break;393 case aq_macsec_sa_sc_1sa_32sc:394 result = 32;395 break;396 default:397 break;398 }399 400 return result;401}402 403static u32 aq_to_hw_sc_idx(const u32 sc_idx, const enum aq_macsec_sc_sa sc_sa)404{405 switch (sc_sa) {406 case aq_macsec_sa_sc_4sa_8sc:407 return sc_idx << 2;408 case aq_macsec_sa_sc_2sa_16sc:409 return sc_idx << 1;410 case aq_macsec_sa_sc_1sa_32sc:411 return sc_idx;412 default:413 WARN_ONCE(true, "Invalid sc_sa");414 }415 416 return sc_idx;417}418 419static enum aq_macsec_sc_sa sc_sa_from_num_an(const int num_an)420{421 enum aq_macsec_sc_sa sc_sa = aq_macsec_sa_sc_not_used;422 423 switch (num_an) {424 case 4:425 sc_sa = aq_macsec_sa_sc_4sa_8sc;426 break;427 case 2:428 sc_sa = aq_macsec_sa_sc_2sa_16sc;429 break;430 case 1:431 sc_sa = aq_macsec_sa_sc_1sa_32sc;432 break;433 default:434 break;435 }436 437 return sc_sa;438}439 440static int aq_mdo_add_secy(struct macsec_context *ctx)441{442 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);443 struct aq_macsec_cfg *cfg = nic->macsec_cfg;444 const struct macsec_secy *secy = ctx->secy;445 enum aq_macsec_sc_sa sc_sa;446 u32 txsc_idx;447 int ret = 0;448 449 if (secy->xpn)450 return -EOPNOTSUPP;451 452 sc_sa = sc_sa_from_num_an(MACSEC_NUM_AN);453 if (sc_sa == aq_macsec_sa_sc_not_used)454 return -EINVAL;455 456 if (hweight32(cfg->txsc_idx_busy) >= aq_sc_idx_max(sc_sa))457 return -ENOSPC;458 459 txsc_idx = ffz(cfg->txsc_idx_busy);460 if (txsc_idx == AQ_MACSEC_MAX_SC)461 return -ENOSPC;462 463 cfg->sc_sa = sc_sa;464 cfg->aq_txsc[txsc_idx].hw_sc_idx = aq_to_hw_sc_idx(txsc_idx, sc_sa);465 cfg->aq_txsc[txsc_idx].sw_secy = secy;466 467 if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev))468 ret = aq_set_txsc(nic, txsc_idx);469 470 set_bit(txsc_idx, &cfg->txsc_idx_busy);471 472 return ret;473}474 475static int aq_mdo_upd_secy(struct macsec_context *ctx)476{477 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);478 const struct macsec_secy *secy = ctx->secy;479 int txsc_idx;480 int ret = 0;481 482 txsc_idx = aq_get_txsc_idx_from_secy(nic->macsec_cfg, secy);483 if (txsc_idx < 0)484 return -ENOENT;485 486 if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev))487 ret = aq_set_txsc(nic, txsc_idx);488 489 return ret;490}491 492static int aq_clear_txsc(struct aq_nic_s *nic, const int txsc_idx,493 enum aq_clear_type clear_type)494{495 struct aq_macsec_txsc *tx_sc = &nic->macsec_cfg->aq_txsc[txsc_idx];496 struct aq_mss_egress_class_record tx_class_rec = { 0 };497 struct aq_mss_egress_sc_record sc_rec = { 0 };498 struct aq_hw_s *hw = nic->aq_hw;499 int ret = 0;500 int sa_num;501 502 for_each_set_bit (sa_num, &tx_sc->tx_sa_idx_busy, AQ_MACSEC_MAX_SA) {503 ret = aq_clear_txsa(nic, tx_sc, sa_num, clear_type);504 if (ret)505 return ret;506 }507 508 if (clear_type & AQ_CLEAR_HW) {509 ret = aq_mss_set_egress_class_record(hw, &tx_class_rec,510 txsc_idx);511 if (ret)512 return ret;513 514 sc_rec.fresh = 1;515 ret = aq_mss_set_egress_sc_record(hw, &sc_rec,516 tx_sc->hw_sc_idx);517 if (ret)518 return ret;519 }520 521 if (clear_type & AQ_CLEAR_SW) {522 clear_bit(txsc_idx, &nic->macsec_cfg->txsc_idx_busy);523 nic->macsec_cfg->aq_txsc[txsc_idx].sw_secy = NULL;524 }525 526 return ret;527}528 529static int aq_mdo_del_secy(struct macsec_context *ctx)530{531 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);532 int ret = 0;533 534 if (!nic->macsec_cfg)535 return 0;536 537 ret = aq_clear_secy(nic, ctx->secy, AQ_CLEAR_ALL);538 539 return ret;540}541 542static int aq_update_txsa(struct aq_nic_s *nic, const unsigned int sc_idx,543 const struct macsec_secy *secy,544 const struct macsec_tx_sa *tx_sa,545 const unsigned char *key, const unsigned char an)546{547 const u32 next_pn = tx_sa->next_pn_halves.lower;548 struct aq_mss_egress_sakey_record key_rec;549 const unsigned int sa_idx = sc_idx | an;550 struct aq_mss_egress_sa_record sa_rec;551 struct aq_hw_s *hw = nic->aq_hw;552 int ret = 0;553 554 memset(&sa_rec, 0, sizeof(sa_rec));555 sa_rec.valid = tx_sa->active;556 sa_rec.fresh = 1;557 sa_rec.next_pn = next_pn;558 559 ret = aq_mss_set_egress_sa_record(hw, &sa_rec, sa_idx);560 if (ret)561 return ret;562 563 if (!key)564 return ret;565 566 memset(&key_rec, 0, sizeof(key_rec));567 memcpy(&key_rec.key, key, secy->key_len);568 569 aq_rotate_keys(&key_rec.key, secy->key_len);570 571 ret = aq_mss_set_egress_sakey_record(hw, &key_rec, sa_idx);572 573 memzero_explicit(&key_rec, sizeof(key_rec));574 return ret;575}576 577static int aq_mdo_add_txsa(struct macsec_context *ctx)578{579 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);580 struct aq_macsec_cfg *cfg = nic->macsec_cfg;581 const struct macsec_secy *secy = ctx->secy;582 struct aq_macsec_txsc *aq_txsc;583 int txsc_idx;584 int ret = 0;585 586 txsc_idx = aq_get_txsc_idx_from_secy(cfg, secy);587 if (txsc_idx < 0)588 return -EINVAL;589 590 aq_txsc = &cfg->aq_txsc[txsc_idx];591 set_bit(ctx->sa.assoc_num, &aq_txsc->tx_sa_idx_busy);592 593 memcpy(aq_txsc->tx_sa_key[ctx->sa.assoc_num], ctx->sa.key,594 secy->key_len);595 596 if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev))597 ret = aq_update_txsa(nic, aq_txsc->hw_sc_idx, secy,598 ctx->sa.tx_sa, ctx->sa.key,599 ctx->sa.assoc_num);600 601 return ret;602}603 604static int aq_mdo_upd_txsa(struct macsec_context *ctx)605{606 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);607 struct aq_macsec_cfg *cfg = nic->macsec_cfg;608 const struct macsec_secy *secy = ctx->secy;609 struct aq_macsec_txsc *aq_txsc;610 int txsc_idx;611 int ret = 0;612 613 txsc_idx = aq_get_txsc_idx_from_secy(cfg, secy);614 if (txsc_idx < 0)615 return -EINVAL;616 617 aq_txsc = &cfg->aq_txsc[txsc_idx];618 if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev))619 ret = aq_update_txsa(nic, aq_txsc->hw_sc_idx, secy,620 ctx->sa.tx_sa, NULL, ctx->sa.assoc_num);621 622 return ret;623}624 625static int aq_clear_txsa(struct aq_nic_s *nic, struct aq_macsec_txsc *aq_txsc,626 const int sa_num, enum aq_clear_type clear_type)627{628 const int sa_idx = aq_txsc->hw_sc_idx | sa_num;629 struct aq_hw_s *hw = nic->aq_hw;630 int ret = 0;631 632 if (clear_type & AQ_CLEAR_SW)633 clear_bit(sa_num, &aq_txsc->tx_sa_idx_busy);634 635 if ((clear_type & AQ_CLEAR_HW) && netif_carrier_ok(nic->ndev)) {636 struct aq_mss_egress_sakey_record key_rec;637 struct aq_mss_egress_sa_record sa_rec;638 639 memset(&sa_rec, 0, sizeof(sa_rec));640 sa_rec.fresh = 1;641 642 ret = aq_mss_set_egress_sa_record(hw, &sa_rec, sa_idx);643 if (ret)644 return ret;645 646 memset(&key_rec, 0, sizeof(key_rec));647 return aq_mss_set_egress_sakey_record(hw, &key_rec, sa_idx);648 }649 650 return 0;651}652 653static int aq_mdo_del_txsa(struct macsec_context *ctx)654{655 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);656 struct aq_macsec_cfg *cfg = nic->macsec_cfg;657 int txsc_idx;658 int ret = 0;659 660 txsc_idx = aq_get_txsc_idx_from_secy(cfg, ctx->secy);661 if (txsc_idx < 0)662 return -EINVAL;663 664 ret = aq_clear_txsa(nic, &cfg->aq_txsc[txsc_idx], ctx->sa.assoc_num,665 AQ_CLEAR_ALL);666 667 return ret;668}669 670static int aq_rxsc_validate_frames(const enum macsec_validation_type validate)671{672 switch (validate) {673 case MACSEC_VALIDATE_DISABLED:674 return 2;675 case MACSEC_VALIDATE_CHECK:676 return 1;677 case MACSEC_VALIDATE_STRICT:678 return 0;679 default:680 WARN_ONCE(true, "Invalid validation type");681 }682 683 return 0;684}685 686static int aq_set_rxsc(struct aq_nic_s *nic, const u32 rxsc_idx)687{688 const struct aq_macsec_rxsc *aq_rxsc =689 &nic->macsec_cfg->aq_rxsc[rxsc_idx];690 struct aq_mss_ingress_preclass_record pre_class_record;691 const struct macsec_rx_sc *rx_sc = aq_rxsc->sw_rxsc;692 const struct macsec_secy *secy = aq_rxsc->sw_secy;693 const u32 hw_sc_idx = aq_rxsc->hw_sc_idx;694 struct aq_mss_ingress_sc_record sc_record;695 struct aq_hw_s *hw = nic->aq_hw;696 int ret = 0;697 698 memset(&pre_class_record, 0, sizeof(pre_class_record));699 put_unaligned_be64((__force u64)rx_sc->sci, pre_class_record.sci);700 pre_class_record.sci_mask = 0xff;701 /* match all MACSEC ethertype packets */702 pre_class_record.eth_type = ETH_P_MACSEC;703 pre_class_record.eth_type_mask = 0x3;704 705 aq_ether_addr_to_mac(pre_class_record.mac_sa, (char *)&rx_sc->sci);706 pre_class_record.sa_mask = 0x3f;707 708 pre_class_record.an_mask = nic->macsec_cfg->sc_sa;709 pre_class_record.sc_idx = hw_sc_idx;710 /* strip SecTAG & forward for decryption */711 pre_class_record.action = 0x0;712 pre_class_record.valid = 1;713 714 ret = aq_mss_set_ingress_preclass_record(hw, &pre_class_record,715 2 * rxsc_idx + 1);716 if (ret)717 return ret;718 719 /* If SCI is absent, then match by SA alone */720 pre_class_record.sci_mask = 0;721 pre_class_record.sci_from_table = 1;722 723 ret = aq_mss_set_ingress_preclass_record(hw, &pre_class_record,724 2 * rxsc_idx);725 if (ret)726 return ret;727 728 memset(&sc_record, 0, sizeof(sc_record));729 sc_record.validate_frames =730 aq_rxsc_validate_frames(secy->validate_frames);731 if (secy->replay_protect) {732 sc_record.replay_protect = 1;733 sc_record.anti_replay_window = secy->replay_window;734 }735 sc_record.valid = 1;736 sc_record.fresh = 1;737 738 ret = aq_mss_set_ingress_sc_record(hw, &sc_record, hw_sc_idx);739 if (ret)740 return ret;741 742 return ret;743}744 745static int aq_mdo_add_rxsc(struct macsec_context *ctx)746{747 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);748 struct aq_macsec_cfg *cfg = nic->macsec_cfg;749 const u32 rxsc_idx_max = aq_sc_idx_max(cfg->sc_sa);750 u32 rxsc_idx;751 int ret = 0;752 753 if (hweight32(cfg->rxsc_idx_busy) >= rxsc_idx_max)754 return -ENOSPC;755 756 rxsc_idx = ffz(cfg->rxsc_idx_busy);757 if (rxsc_idx >= rxsc_idx_max)758 return -ENOSPC;759 760 cfg->aq_rxsc[rxsc_idx].hw_sc_idx = aq_to_hw_sc_idx(rxsc_idx,761 cfg->sc_sa);762 cfg->aq_rxsc[rxsc_idx].sw_secy = ctx->secy;763 cfg->aq_rxsc[rxsc_idx].sw_rxsc = ctx->rx_sc;764 765 if (netif_carrier_ok(nic->ndev) && netif_running(ctx->secy->netdev))766 ret = aq_set_rxsc(nic, rxsc_idx);767 768 if (ret < 0)769 return ret;770 771 set_bit(rxsc_idx, &cfg->rxsc_idx_busy);772 773 return 0;774}775 776static int aq_mdo_upd_rxsc(struct macsec_context *ctx)777{778 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);779 int rxsc_idx;780 int ret = 0;781 782 rxsc_idx = aq_get_rxsc_idx_from_rxsc(nic->macsec_cfg, ctx->rx_sc);783 if (rxsc_idx < 0)784 return -ENOENT;785 786 if (netif_carrier_ok(nic->ndev) && netif_running(ctx->secy->netdev))787 ret = aq_set_rxsc(nic, rxsc_idx);788 789 return ret;790}791 792static int aq_clear_rxsc(struct aq_nic_s *nic, const int rxsc_idx,793 enum aq_clear_type clear_type)794{795 struct aq_macsec_rxsc *rx_sc = &nic->macsec_cfg->aq_rxsc[rxsc_idx];796 struct aq_hw_s *hw = nic->aq_hw;797 int ret = 0;798 int sa_num;799 800 for_each_set_bit (sa_num, &rx_sc->rx_sa_idx_busy, AQ_MACSEC_MAX_SA) {801 ret = aq_clear_rxsa(nic, rx_sc, sa_num, clear_type);802 if (ret)803 return ret;804 }805 806 if (clear_type & AQ_CLEAR_HW) {807 struct aq_mss_ingress_preclass_record pre_class_record;808 struct aq_mss_ingress_sc_record sc_record;809 810 memset(&pre_class_record, 0, sizeof(pre_class_record));811 memset(&sc_record, 0, sizeof(sc_record));812 813 ret = aq_mss_set_ingress_preclass_record(hw, &pre_class_record,814 2 * rxsc_idx);815 if (ret)816 return ret;817 818 ret = aq_mss_set_ingress_preclass_record(hw, &pre_class_record,819 2 * rxsc_idx + 1);820 if (ret)821 return ret;822 823 sc_record.fresh = 1;824 ret = aq_mss_set_ingress_sc_record(hw, &sc_record,825 rx_sc->hw_sc_idx);826 if (ret)827 return ret;828 }829 830 if (clear_type & AQ_CLEAR_SW) {831 clear_bit(rxsc_idx, &nic->macsec_cfg->rxsc_idx_busy);832 rx_sc->sw_secy = NULL;833 rx_sc->sw_rxsc = NULL;834 }835 836 return ret;837}838 839static int aq_mdo_del_rxsc(struct macsec_context *ctx)840{841 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);842 enum aq_clear_type clear_type = AQ_CLEAR_SW;843 int rxsc_idx;844 int ret = 0;845 846 rxsc_idx = aq_get_rxsc_idx_from_rxsc(nic->macsec_cfg, ctx->rx_sc);847 if (rxsc_idx < 0)848 return -ENOENT;849 850 if (netif_carrier_ok(nic->ndev))851 clear_type = AQ_CLEAR_ALL;852 853 ret = aq_clear_rxsc(nic, rxsc_idx, clear_type);854 855 return ret;856}857 858static int aq_update_rxsa(struct aq_nic_s *nic, const unsigned int sc_idx,859 const struct macsec_secy *secy,860 const struct macsec_rx_sa *rx_sa,861 const unsigned char *key, const unsigned char an)862{863 struct aq_mss_ingress_sakey_record sa_key_record;864 const u32 next_pn = rx_sa->next_pn_halves.lower;865 struct aq_mss_ingress_sa_record sa_record;866 struct aq_hw_s *hw = nic->aq_hw;867 const int sa_idx = sc_idx | an;868 int ret = 0;869 870 memset(&sa_record, 0, sizeof(sa_record));871 sa_record.valid = rx_sa->active;872 sa_record.fresh = 1;873 sa_record.next_pn = next_pn;874 875 ret = aq_mss_set_ingress_sa_record(hw, &sa_record, sa_idx);876 if (ret)877 return ret;878 879 if (!key)880 return ret;881 882 memset(&sa_key_record, 0, sizeof(sa_key_record));883 memcpy(&sa_key_record.key, key, secy->key_len);884 885 switch (secy->key_len) {886 case AQ_MACSEC_KEY_LEN_128_BIT:887 sa_key_record.key_len = 0;888 break;889 case AQ_MACSEC_KEY_LEN_192_BIT:890 sa_key_record.key_len = 1;891 break;892 case AQ_MACSEC_KEY_LEN_256_BIT:893 sa_key_record.key_len = 2;894 break;895 default:896 return -1;897 }898 899 aq_rotate_keys(&sa_key_record.key, secy->key_len);900 901 ret = aq_mss_set_ingress_sakey_record(hw, &sa_key_record, sa_idx);902 903 memzero_explicit(&sa_key_record, sizeof(sa_key_record));904 return ret;905}906 907static int aq_mdo_add_rxsa(struct macsec_context *ctx)908{909 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);910 const struct macsec_rx_sc *rx_sc = ctx->sa.rx_sa->sc;911 const struct macsec_secy *secy = ctx->secy;912 struct aq_macsec_rxsc *aq_rxsc;913 int rxsc_idx;914 int ret = 0;915 916 rxsc_idx = aq_get_rxsc_idx_from_rxsc(nic->macsec_cfg, rx_sc);917 if (rxsc_idx < 0)918 return -EINVAL;919 920 aq_rxsc = &nic->macsec_cfg->aq_rxsc[rxsc_idx];921 set_bit(ctx->sa.assoc_num, &aq_rxsc->rx_sa_idx_busy);922 923 memcpy(aq_rxsc->rx_sa_key[ctx->sa.assoc_num], ctx->sa.key,924 secy->key_len);925 926 if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev))927 ret = aq_update_rxsa(nic, aq_rxsc->hw_sc_idx, secy,928 ctx->sa.rx_sa, ctx->sa.key,929 ctx->sa.assoc_num);930 931 return ret;932}933 934static int aq_mdo_upd_rxsa(struct macsec_context *ctx)935{936 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);937 const struct macsec_rx_sc *rx_sc = ctx->sa.rx_sa->sc;938 struct aq_macsec_cfg *cfg = nic->macsec_cfg;939 const struct macsec_secy *secy = ctx->secy;940 int rxsc_idx;941 int ret = 0;942 943 rxsc_idx = aq_get_rxsc_idx_from_rxsc(cfg, rx_sc);944 if (rxsc_idx < 0)945 return -EINVAL;946 947 if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev))948 ret = aq_update_rxsa(nic, cfg->aq_rxsc[rxsc_idx].hw_sc_idx,949 secy, ctx->sa.rx_sa, NULL,950 ctx->sa.assoc_num);951 952 return ret;953}954 955static int aq_clear_rxsa(struct aq_nic_s *nic, struct aq_macsec_rxsc *aq_rxsc,956 const int sa_num, enum aq_clear_type clear_type)957{958 int sa_idx = aq_rxsc->hw_sc_idx | sa_num;959 struct aq_hw_s *hw = nic->aq_hw;960 int ret = 0;961 962 if (clear_type & AQ_CLEAR_SW)963 clear_bit(sa_num, &aq_rxsc->rx_sa_idx_busy);964 965 if ((clear_type & AQ_CLEAR_HW) && netif_carrier_ok(nic->ndev)) {966 struct aq_mss_ingress_sakey_record sa_key_record;967 struct aq_mss_ingress_sa_record sa_record;968 969 memset(&sa_key_record, 0, sizeof(sa_key_record));970 memset(&sa_record, 0, sizeof(sa_record));971 sa_record.fresh = 1;972 ret = aq_mss_set_ingress_sa_record(hw, &sa_record, sa_idx);973 if (ret)974 return ret;975 976 return aq_mss_set_ingress_sakey_record(hw, &sa_key_record,977 sa_idx);978 }979 980 return ret;981}982 983static int aq_mdo_del_rxsa(struct macsec_context *ctx)984{985 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);986 const struct macsec_rx_sc *rx_sc = ctx->sa.rx_sa->sc;987 struct aq_macsec_cfg *cfg = nic->macsec_cfg;988 int rxsc_idx;989 int ret = 0;990 991 rxsc_idx = aq_get_rxsc_idx_from_rxsc(cfg, rx_sc);992 if (rxsc_idx < 0)993 return -EINVAL;994 995 ret = aq_clear_rxsa(nic, &cfg->aq_rxsc[rxsc_idx], ctx->sa.assoc_num,996 AQ_CLEAR_ALL);997 998 return ret;999}1000 1001static int aq_mdo_get_dev_stats(struct macsec_context *ctx)1002{1003 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);1004 struct aq_macsec_common_stats *stats = &nic->macsec_cfg->stats;1005 struct aq_hw_s *hw = nic->aq_hw;1006 1007 aq_get_macsec_common_stats(hw, stats);1008 1009 ctx->stats.dev_stats->OutPktsUntagged = stats->out.untagged_pkts;1010 ctx->stats.dev_stats->InPktsUntagged = stats->in.untagged_pkts;1011 ctx->stats.dev_stats->OutPktsTooLong = stats->out.too_long;1012 ctx->stats.dev_stats->InPktsNoTag = stats->in.notag_pkts;1013 ctx->stats.dev_stats->InPktsBadTag = stats->in.bad_tag_pkts;1014 ctx->stats.dev_stats->InPktsUnknownSCI = stats->in.unknown_sci_pkts;1015 ctx->stats.dev_stats->InPktsNoSCI = stats->in.no_sci_pkts;1016 ctx->stats.dev_stats->InPktsOverrun = 0;1017 1018 return 0;1019}1020 1021static int aq_mdo_get_tx_sc_stats(struct macsec_context *ctx)1022{1023 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);1024 struct aq_macsec_tx_sc_stats *stats;1025 struct aq_hw_s *hw = nic->aq_hw;1026 struct aq_macsec_txsc *aq_txsc;1027 int txsc_idx;1028 1029 txsc_idx = aq_get_txsc_idx_from_secy(nic->macsec_cfg, ctx->secy);1030 if (txsc_idx < 0)1031 return -ENOENT;1032 1033 aq_txsc = &nic->macsec_cfg->aq_txsc[txsc_idx];1034 stats = &aq_txsc->stats;1035 aq_get_txsc_stats(hw, aq_txsc->hw_sc_idx, stats);1036 1037 ctx->stats.tx_sc_stats->OutPktsProtected = stats->sc_protected_pkts;1038 ctx->stats.tx_sc_stats->OutPktsEncrypted = stats->sc_encrypted_pkts;1039 ctx->stats.tx_sc_stats->OutOctetsProtected = stats->sc_protected_octets;1040 ctx->stats.tx_sc_stats->OutOctetsEncrypted = stats->sc_encrypted_octets;1041 1042 return 0;1043}1044 1045static int aq_mdo_get_tx_sa_stats(struct macsec_context *ctx)1046{1047 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);1048 struct aq_macsec_cfg *cfg = nic->macsec_cfg;1049 struct aq_macsec_tx_sa_stats *stats;1050 struct aq_hw_s *hw = nic->aq_hw;1051 const struct macsec_secy *secy;1052 struct aq_macsec_txsc *aq_txsc;1053 struct macsec_tx_sa *tx_sa;1054 unsigned int sa_idx;1055 int txsc_idx;1056 u32 next_pn;1057 int ret;1058 1059 txsc_idx = aq_get_txsc_idx_from_secy(cfg, ctx->secy);1060 if (txsc_idx < 0)1061 return -EINVAL;1062 1063 aq_txsc = &cfg->aq_txsc[txsc_idx];1064 sa_idx = aq_txsc->hw_sc_idx | ctx->sa.assoc_num;1065 stats = &aq_txsc->tx_sa_stats[ctx->sa.assoc_num];1066 ret = aq_get_txsa_stats(hw, sa_idx, stats);1067 if (ret)1068 return ret;1069 1070 ctx->stats.tx_sa_stats->OutPktsProtected = stats->sa_protected_pkts;1071 ctx->stats.tx_sa_stats->OutPktsEncrypted = stats->sa_encrypted_pkts;1072 1073 secy = aq_txsc->sw_secy;1074 tx_sa = rcu_dereference_bh(secy->tx_sc.sa[ctx->sa.assoc_num]);1075 ret = aq_get_txsa_next_pn(hw, sa_idx, &next_pn);1076 if (ret == 0) {1077 spin_lock_bh(&tx_sa->lock);1078 tx_sa->next_pn = next_pn;1079 spin_unlock_bh(&tx_sa->lock);1080 }1081 1082 return ret;1083}1084 1085static int aq_mdo_get_rx_sc_stats(struct macsec_context *ctx)1086{1087 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);1088 struct aq_macsec_cfg *cfg = nic->macsec_cfg;1089 struct aq_macsec_rx_sa_stats *stats;1090 struct aq_hw_s *hw = nic->aq_hw;1091 struct aq_macsec_rxsc *aq_rxsc;1092 unsigned int sa_idx;1093 int rxsc_idx;1094 int ret = 0;1095 int i;1096 1097 rxsc_idx = aq_get_rxsc_idx_from_rxsc(cfg, ctx->rx_sc);1098 if (rxsc_idx < 0)1099 return -ENOENT;1100 1101 aq_rxsc = &cfg->aq_rxsc[rxsc_idx];1102 for (i = 0; i < MACSEC_NUM_AN; i++) {1103 if (!test_bit(i, &aq_rxsc->rx_sa_idx_busy))1104 continue;1105 1106 stats = &aq_rxsc->rx_sa_stats[i];1107 sa_idx = aq_rxsc->hw_sc_idx | i;1108 ret = aq_get_rxsa_stats(hw, sa_idx, stats);1109 if (ret)1110 break;1111 1112 ctx->stats.rx_sc_stats->InOctetsValidated +=1113 stats->validated_octets;1114 ctx->stats.rx_sc_stats->InOctetsDecrypted +=1115 stats->decrypted_octets;1116 ctx->stats.rx_sc_stats->InPktsUnchecked +=1117 stats->unchecked_pkts;1118 ctx->stats.rx_sc_stats->InPktsDelayed += stats->delayed_pkts;1119 ctx->stats.rx_sc_stats->InPktsOK += stats->ok_pkts;1120 ctx->stats.rx_sc_stats->InPktsInvalid += stats->invalid_pkts;1121 ctx->stats.rx_sc_stats->InPktsLate += stats->late_pkts;1122 ctx->stats.rx_sc_stats->InPktsNotValid += stats->not_valid_pkts;1123 ctx->stats.rx_sc_stats->InPktsNotUsingSA += stats->not_using_sa;1124 ctx->stats.rx_sc_stats->InPktsUnusedSA += stats->unused_sa;1125 }1126 1127 return ret;1128}1129 1130static int aq_mdo_get_rx_sa_stats(struct macsec_context *ctx)1131{1132 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);1133 struct aq_macsec_cfg *cfg = nic->macsec_cfg;1134 struct aq_macsec_rx_sa_stats *stats;1135 struct aq_hw_s *hw = nic->aq_hw;1136 struct aq_macsec_rxsc *aq_rxsc;1137 struct macsec_rx_sa *rx_sa;1138 unsigned int sa_idx;1139 int rxsc_idx;1140 u32 next_pn;1141 int ret;1142 1143 rxsc_idx = aq_get_rxsc_idx_from_rxsc(cfg, ctx->rx_sc);1144 if (rxsc_idx < 0)1145 return -EINVAL;1146 1147 aq_rxsc = &cfg->aq_rxsc[rxsc_idx];1148 stats = &aq_rxsc->rx_sa_stats[ctx->sa.assoc_num];1149 sa_idx = aq_rxsc->hw_sc_idx | ctx->sa.assoc_num;1150 ret = aq_get_rxsa_stats(hw, sa_idx, stats);1151 if (ret)1152 return ret;1153 1154 ctx->stats.rx_sa_stats->InPktsOK = stats->ok_pkts;1155 ctx->stats.rx_sa_stats->InPktsInvalid = stats->invalid_pkts;1156 ctx->stats.rx_sa_stats->InPktsNotValid = stats->not_valid_pkts;1157 ctx->stats.rx_sa_stats->InPktsNotUsingSA = stats->not_using_sa;1158 ctx->stats.rx_sa_stats->InPktsUnusedSA = stats->unused_sa;1159 1160 rx_sa = rcu_dereference_bh(aq_rxsc->sw_rxsc->sa[ctx->sa.assoc_num]);1161 ret = aq_get_rxsa_next_pn(hw, sa_idx, &next_pn);1162 if (ret == 0) {1163 spin_lock_bh(&rx_sa->lock);1164 rx_sa->next_pn = next_pn;1165 spin_unlock_bh(&rx_sa->lock);1166 }1167 1168 return ret;1169}1170 1171static int apply_txsc_cfg(struct aq_nic_s *nic, const int txsc_idx)1172{1173 struct aq_macsec_txsc *aq_txsc = &nic->macsec_cfg->aq_txsc[txsc_idx];1174 const struct macsec_secy *secy = aq_txsc->sw_secy;1175 struct macsec_tx_sa *tx_sa;1176 int ret = 0;1177 int i;1178 1179 if (!netif_running(secy->netdev))1180 return ret;1181 1182 ret = aq_set_txsc(nic, txsc_idx);1183 if (ret)1184 return ret;1185 1186 for (i = 0; i < MACSEC_NUM_AN; i++) {1187 tx_sa = rcu_dereference_bh(secy->tx_sc.sa[i]);1188 if (tx_sa) {1189 ret = aq_update_txsa(nic, aq_txsc->hw_sc_idx, secy,1190 tx_sa, aq_txsc->tx_sa_key[i], i);1191 if (ret)1192 return ret;1193 }1194 }1195 1196 return ret;1197}1198 1199static int apply_rxsc_cfg(struct aq_nic_s *nic, const int rxsc_idx)1200{1201 struct aq_macsec_rxsc *aq_rxsc = &nic->macsec_cfg->aq_rxsc[rxsc_idx];1202 const struct macsec_secy *secy = aq_rxsc->sw_secy;1203 struct macsec_rx_sa *rx_sa;1204 int ret = 0;1205 int i;1206 1207 if (!netif_running(secy->netdev))1208 return ret;1209 1210 ret = aq_set_rxsc(nic, rxsc_idx);1211 if (ret)1212 return ret;1213 1214 for (i = 0; i < MACSEC_NUM_AN; i++) {1215 rx_sa = rcu_dereference_bh(aq_rxsc->sw_rxsc->sa[i]);1216 if (rx_sa) {1217 ret = aq_update_rxsa(nic, aq_rxsc->hw_sc_idx, secy,1218 rx_sa, aq_rxsc->rx_sa_key[i], i);1219 if (ret)1220 return ret;1221 }1222 }1223 1224 return ret;1225}1226 1227static int aq_clear_secy(struct aq_nic_s *nic, const struct macsec_secy *secy,1228 enum aq_clear_type clear_type)1229{1230 struct macsec_rx_sc *rx_sc;1231 int txsc_idx;1232 int rxsc_idx;1233 int ret = 0;1234 1235 txsc_idx = aq_get_txsc_idx_from_secy(nic->macsec_cfg, secy);1236 if (txsc_idx >= 0) {1237 ret = aq_clear_txsc(nic, txsc_idx, clear_type);1238 if (ret)1239 return ret;1240 }1241 1242 for (rx_sc = rcu_dereference_bh(secy->rx_sc); rx_sc;1243 rx_sc = rcu_dereference_bh(rx_sc->next)) {1244 rxsc_idx = aq_get_rxsc_idx_from_rxsc(nic->macsec_cfg, rx_sc);1245 if (rxsc_idx < 0)1246 continue;1247 1248 ret = aq_clear_rxsc(nic, rxsc_idx, clear_type);1249 if (ret)1250 return ret;1251 }1252 1253 return ret;1254}1255 1256static int aq_apply_secy_cfg(struct aq_nic_s *nic,1257 const struct macsec_secy *secy)1258{1259 struct macsec_rx_sc *rx_sc;1260 int txsc_idx;1261 int rxsc_idx;1262 int ret = 0;1263 1264 txsc_idx = aq_get_txsc_idx_from_secy(nic->macsec_cfg, secy);1265 if (txsc_idx >= 0)1266 apply_txsc_cfg(nic, txsc_idx);1267 1268 for (rx_sc = rcu_dereference_bh(secy->rx_sc); rx_sc && rx_sc->active;1269 rx_sc = rcu_dereference_bh(rx_sc->next)) {1270 rxsc_idx = aq_get_rxsc_idx_from_rxsc(nic->macsec_cfg, rx_sc);1271 if (unlikely(rxsc_idx < 0))1272 continue;1273 1274 ret = apply_rxsc_cfg(nic, rxsc_idx);1275 if (ret)1276 return ret;1277 }1278 1279 return ret;1280}1281 1282static int aq_apply_macsec_cfg(struct aq_nic_s *nic)1283{1284 int ret = 0;1285 int i;1286 1287 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {1288 if (nic->macsec_cfg->txsc_idx_busy & BIT(i)) {1289 ret = apply_txsc_cfg(nic, i);1290 if (ret)1291 return ret;1292 }1293 }1294 1295 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {1296 if (nic->macsec_cfg->rxsc_idx_busy & BIT(i)) {1297 ret = apply_rxsc_cfg(nic, i);1298 if (ret)1299 return ret;1300 }1301 }1302 1303 return ret;1304}1305 1306static int aq_sa_from_sa_idx(const enum aq_macsec_sc_sa sc_sa, const int sa_idx)1307{1308 switch (sc_sa) {1309 case aq_macsec_sa_sc_4sa_8sc:1310 return sa_idx & 3;1311 case aq_macsec_sa_sc_2sa_16sc:1312 return sa_idx & 1;1313 case aq_macsec_sa_sc_1sa_32sc:1314 return 0;1315 default:1316 WARN_ONCE(true, "Invalid sc_sa");1317 }1318 return -EINVAL;1319}1320 1321static int aq_sc_idx_from_sa_idx(const enum aq_macsec_sc_sa sc_sa,1322 const int sa_idx)1323{1324 switch (sc_sa) {1325 case aq_macsec_sa_sc_4sa_8sc:1326 return sa_idx & ~3;1327 case aq_macsec_sa_sc_2sa_16sc:1328 return sa_idx & ~1;1329 case aq_macsec_sa_sc_1sa_32sc:1330 return sa_idx;1331 default:1332 WARN_ONCE(true, "Invalid sc_sa");1333 }1334 return -EINVAL;1335}1336 1337static void aq_check_txsa_expiration(struct aq_nic_s *nic)1338{1339 u32 egress_sa_expired, egress_sa_threshold_expired;1340 struct aq_macsec_cfg *cfg = nic->macsec_cfg;1341 struct aq_hw_s *hw = nic->aq_hw;1342 struct aq_macsec_txsc *aq_txsc;1343 const struct macsec_secy *secy;1344 int sc_idx = 0, txsc_idx = 0;1345 enum aq_macsec_sc_sa sc_sa;1346 struct macsec_tx_sa *tx_sa;1347 unsigned char an = 0;1348 int ret;1349 int i;1350 1351 sc_sa = cfg->sc_sa;1352 1353 ret = aq_mss_get_egress_sa_expired(hw, &egress_sa_expired);1354 if (unlikely(ret))1355 return;1356 1357 ret = aq_mss_get_egress_sa_threshold_expired(hw,1358 &egress_sa_threshold_expired);1359 1360 for (i = 0; i < AQ_MACSEC_MAX_SA; i++) {1361 if (egress_sa_expired & BIT(i)) {1362 an = aq_sa_from_sa_idx(sc_sa, i);1363 sc_idx = aq_sc_idx_from_sa_idx(sc_sa, i);1364 txsc_idx = aq_get_txsc_idx_from_sc_idx(sc_sa, sc_idx);1365 if (txsc_idx < 0)1366 continue;1367 1368 aq_txsc = &cfg->aq_txsc[txsc_idx];1369 if (!(cfg->txsc_idx_busy & BIT(txsc_idx))) {1370 netdev_warn(nic->ndev,1371 "PN threshold expired on invalid TX SC");1372 continue;1373 }1374 1375 secy = aq_txsc->sw_secy;1376 if (!netif_running(secy->netdev)) {1377 netdev_warn(nic->ndev,1378 "PN threshold expired on down TX SC");1379 continue;1380 }1381 1382 if (unlikely(!(aq_txsc->tx_sa_idx_busy & BIT(an)))) {1383 netdev_warn(nic->ndev,1384 "PN threshold expired on invalid TX SA");1385 continue;1386 }1387 1388 tx_sa = rcu_dereference_bh(secy->tx_sc.sa[an]);1389 macsec_pn_wrapped((struct macsec_secy *)secy, tx_sa);1390 }1391 }1392 1393 aq_mss_set_egress_sa_expired(hw, egress_sa_expired);1394 if (likely(!ret))1395 aq_mss_set_egress_sa_threshold_expired(hw,1396 egress_sa_threshold_expired);1397}1398 1399#define AQ_LOCKED_MDO_DEF(mdo) \1400static int aq_locked_mdo_##mdo(struct macsec_context *ctx) \1401{ \1402 struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev); \1403 int ret; \1404 mutex_lock(&nic->macsec_mutex); \1405 ret = aq_mdo_##mdo(ctx); \1406 mutex_unlock(&nic->macsec_mutex); \1407 return ret; \1408}1409 1410AQ_LOCKED_MDO_DEF(dev_open)1411AQ_LOCKED_MDO_DEF(dev_stop)1412AQ_LOCKED_MDO_DEF(add_secy)1413AQ_LOCKED_MDO_DEF(upd_secy)1414AQ_LOCKED_MDO_DEF(del_secy)1415AQ_LOCKED_MDO_DEF(add_rxsc)1416AQ_LOCKED_MDO_DEF(upd_rxsc)1417AQ_LOCKED_MDO_DEF(del_rxsc)1418AQ_LOCKED_MDO_DEF(add_rxsa)1419AQ_LOCKED_MDO_DEF(upd_rxsa)1420AQ_LOCKED_MDO_DEF(del_rxsa)1421AQ_LOCKED_MDO_DEF(add_txsa)1422AQ_LOCKED_MDO_DEF(upd_txsa)1423AQ_LOCKED_MDO_DEF(del_txsa)1424AQ_LOCKED_MDO_DEF(get_dev_stats)1425AQ_LOCKED_MDO_DEF(get_tx_sc_stats)1426AQ_LOCKED_MDO_DEF(get_tx_sa_stats)1427AQ_LOCKED_MDO_DEF(get_rx_sc_stats)1428AQ_LOCKED_MDO_DEF(get_rx_sa_stats)1429 1430const struct macsec_ops aq_macsec_ops = {1431 .mdo_dev_open = aq_locked_mdo_dev_open,1432 .mdo_dev_stop = aq_locked_mdo_dev_stop,1433 .mdo_add_secy = aq_locked_mdo_add_secy,1434 .mdo_upd_secy = aq_locked_mdo_upd_secy,1435 .mdo_del_secy = aq_locked_mdo_del_secy,1436 .mdo_add_rxsc = aq_locked_mdo_add_rxsc,1437 .mdo_upd_rxsc = aq_locked_mdo_upd_rxsc,1438 .mdo_del_rxsc = aq_locked_mdo_del_rxsc,1439 .mdo_add_rxsa = aq_locked_mdo_add_rxsa,1440 .mdo_upd_rxsa = aq_locked_mdo_upd_rxsa,1441 .mdo_del_rxsa = aq_locked_mdo_del_rxsa,1442 .mdo_add_txsa = aq_locked_mdo_add_txsa,1443 .mdo_upd_txsa = aq_locked_mdo_upd_txsa,1444 .mdo_del_txsa = aq_locked_mdo_del_txsa,1445 .mdo_get_dev_stats = aq_locked_mdo_get_dev_stats,1446 .mdo_get_tx_sc_stats = aq_locked_mdo_get_tx_sc_stats,1447 .mdo_get_tx_sa_stats = aq_locked_mdo_get_tx_sa_stats,1448 .mdo_get_rx_sc_stats = aq_locked_mdo_get_rx_sc_stats,1449 .mdo_get_rx_sa_stats = aq_locked_mdo_get_rx_sa_stats,1450};1451 1452int aq_macsec_init(struct aq_nic_s *nic)1453{1454 struct aq_macsec_cfg *cfg;1455 u32 caps_lo;1456 1457 if (!nic->aq_fw_ops->get_link_capabilities)1458 return 0;1459 1460 caps_lo = nic->aq_fw_ops->get_link_capabilities(nic->aq_hw);1461 1462 if (!(caps_lo & BIT(CAPS_LO_MACSEC)))1463 return 0;1464 1465 nic->macsec_cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);1466 if (!nic->macsec_cfg)1467 return -ENOMEM;1468 1469 nic->ndev->features |= NETIF_F_HW_MACSEC;1470 nic->ndev->macsec_ops = &aq_macsec_ops;1471 mutex_init(&nic->macsec_mutex);1472 1473 return 0;1474}1475 1476void aq_macsec_free(struct aq_nic_s *nic)1477{1478 kfree(nic->macsec_cfg);1479 nic->macsec_cfg = NULL;1480}1481 1482int aq_macsec_enable(struct aq_nic_s *nic)1483{1484 u32 ctl_ether_types[1] = { ETH_P_PAE };1485 struct macsec_msg_fw_response resp = { 0 };1486 struct macsec_msg_fw_request msg = { 0 };1487 struct aq_hw_s *hw = nic->aq_hw;1488 int num_ctl_ether_types = 0;1489 int index = 0, tbl_idx;1490 int ret;1491 1492 if (!nic->macsec_cfg)1493 return 0;1494 1495 mutex_lock(&nic->macsec_mutex);1496 1497 if (nic->aq_fw_ops->send_macsec_req) {1498 struct macsec_cfg_request cfg = { 0 };1499 1500 cfg.enabled = 1;1501 cfg.egress_threshold = 0xffffffff;1502 cfg.ingress_threshold = 0xffffffff;1503 cfg.interrupts_enabled = 1;1504 1505 msg.msg_type = macsec_cfg_msg;1506 msg.cfg = cfg;1507 1508 ret = nic->aq_fw_ops->send_macsec_req(hw, &msg, &resp);1509 if (ret)1510 goto unlock;1511 }1512 1513 /* Init Ethertype bypass filters */1514 for (index = 0; index < ARRAY_SIZE(ctl_ether_types); index++) {1515 struct aq_mss_ingress_prectlf_record rx_prectlf_rec;1516 struct aq_mss_egress_ctlf_record tx_ctlf_rec;1517 1518 if (ctl_ether_types[index] == 0)1519 continue;1520 1521 memset(&tx_ctlf_rec, 0, sizeof(tx_ctlf_rec));1522 tx_ctlf_rec.eth_type = ctl_ether_types[index];1523 tx_ctlf_rec.match_type = 4; /* Match eth_type only */1524 tx_ctlf_rec.match_mask = 0xf; /* match for eth_type */1525 tx_ctlf_rec.action = 0; /* Bypass MACSEC modules */1526 tbl_idx = NUMROWS_EGRESSCTLFRECORD - num_ctl_ether_types - 1;1527 aq_mss_set_egress_ctlf_record(hw, &tx_ctlf_rec, tbl_idx);1528 1529 memset(&rx_prectlf_rec, 0, sizeof(rx_prectlf_rec));1530 rx_prectlf_rec.eth_type = ctl_ether_types[index];1531 rx_prectlf_rec.match_type = 4; /* Match eth_type only */1532 rx_prectlf_rec.match_mask = 0xf; /* match for eth_type */1533 rx_prectlf_rec.action = 0; /* Bypass MACSEC modules */1534 tbl_idx =1535 NUMROWS_INGRESSPRECTLFRECORD - num_ctl_ether_types - 1;1536 aq_mss_set_ingress_prectlf_record(hw, &rx_prectlf_rec, tbl_idx);1537 1538 num_ctl_ether_types++;1539 }1540 1541 ret = aq_apply_macsec_cfg(nic);1542 1543unlock:1544 mutex_unlock(&nic->macsec_mutex);1545 return ret;1546}1547 1548void aq_macsec_work(struct aq_nic_s *nic)1549{1550 if (!nic->macsec_cfg)1551 return;1552 1553 if (!netif_carrier_ok(nic->ndev))1554 return;1555 1556 mutex_lock(&nic->macsec_mutex);1557 aq_check_txsa_expiration(nic);1558 mutex_unlock(&nic->macsec_mutex);1559}1560 1561int aq_macsec_rx_sa_cnt(struct aq_nic_s *nic)1562{1563 struct aq_macsec_cfg *cfg = nic->macsec_cfg;1564 int i, cnt = 0;1565 1566 if (!cfg)1567 return 0;1568 1569 mutex_lock(&nic->macsec_mutex);1570 1571 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {1572 if (!test_bit(i, &cfg->rxsc_idx_busy))1573 continue;1574 cnt += hweight_long(cfg->aq_rxsc[i].rx_sa_idx_busy);1575 }1576 1577 mutex_unlock(&nic->macsec_mutex);1578 return cnt;1579}1580 1581int aq_macsec_tx_sc_cnt(struct aq_nic_s *nic)1582{1583 int cnt;1584 1585 if (!nic->macsec_cfg)1586 return 0;1587 1588 mutex_lock(&nic->macsec_mutex);1589 cnt = hweight_long(nic->macsec_cfg->txsc_idx_busy);1590 mutex_unlock(&nic->macsec_mutex);1591 1592 return cnt;1593}1594 1595int aq_macsec_tx_sa_cnt(struct aq_nic_s *nic)1596{1597 struct aq_macsec_cfg *cfg = nic->macsec_cfg;1598 int i, cnt = 0;1599 1600 if (!cfg)1601 return 0;1602 1603 mutex_lock(&nic->macsec_mutex);1604 1605 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {1606 if (!test_bit(i, &cfg->txsc_idx_busy))1607 continue;1608 cnt += hweight_long(cfg->aq_txsc[i].tx_sa_idx_busy);1609 }1610 1611 mutex_unlock(&nic->macsec_mutex);1612 return cnt;1613}1614 1615static int aq_macsec_update_stats(struct aq_nic_s *nic)1616{1617 struct aq_macsec_cfg *cfg = nic->macsec_cfg;1618 struct aq_hw_s *hw = nic->aq_hw;1619 struct aq_macsec_txsc *aq_txsc;1620 struct aq_macsec_rxsc *aq_rxsc;1621 int i, sa_idx, assoc_num;1622 int ret = 0;1623 1624 aq_get_macsec_common_stats(hw, &cfg->stats);1625 1626 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {1627 if (!(cfg->txsc_idx_busy & BIT(i)))1628 continue;1629 aq_txsc = &cfg->aq_txsc[i];1630 1631 ret = aq_get_txsc_stats(hw, aq_txsc->hw_sc_idx,1632 &aq_txsc->stats);1633 if (ret)1634 return ret;1635 1636 for (assoc_num = 0; assoc_num < MACSEC_NUM_AN; assoc_num++) {1637 if (!test_bit(assoc_num, &aq_txsc->tx_sa_idx_busy))1638 continue;1639 sa_idx = aq_txsc->hw_sc_idx | assoc_num;1640 ret = aq_get_txsa_stats(hw, sa_idx,1641 &aq_txsc->tx_sa_stats[assoc_num]);1642 if (ret)1643 return ret;1644 }1645 }1646 1647 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {1648 if (!(test_bit(i, &cfg->rxsc_idx_busy)))1649 continue;1650 aq_rxsc = &cfg->aq_rxsc[i];1651 1652 for (assoc_num = 0; assoc_num < MACSEC_NUM_AN; assoc_num++) {1653 if (!test_bit(assoc_num, &aq_rxsc->rx_sa_idx_busy))1654 continue;1655 sa_idx = aq_rxsc->hw_sc_idx | assoc_num;1656 1657 ret = aq_get_rxsa_stats(hw, sa_idx,1658 &aq_rxsc->rx_sa_stats[assoc_num]);1659 if (ret)1660 return ret;1661 }1662 }1663 1664 return ret;1665}1666 1667u64 *aq_macsec_get_stats(struct aq_nic_s *nic, u64 *data)1668{1669 struct aq_macsec_cfg *cfg = nic->macsec_cfg;1670 struct aq_macsec_common_stats *common_stats;1671 struct aq_macsec_tx_sc_stats *txsc_stats;1672 struct aq_macsec_tx_sa_stats *txsa_stats;1673 struct aq_macsec_rx_sa_stats *rxsa_stats;1674 struct aq_macsec_txsc *aq_txsc;1675 struct aq_macsec_rxsc *aq_rxsc;1676 unsigned int assoc_num;1677 unsigned int sc_num;1678 unsigned int i = 0U;1679 1680 if (!cfg)1681 return data;1682 1683 mutex_lock(&nic->macsec_mutex);1684 1685 aq_macsec_update_stats(nic);1686 1687 common_stats = &cfg->stats;1688 data[i] = common_stats->in.ctl_pkts;1689 data[++i] = common_stats->in.tagged_miss_pkts;1690 data[++i] = common_stats->in.untagged_miss_pkts;1691 data[++i] = common_stats->in.notag_pkts;1692 data[++i] = common_stats->in.untagged_pkts;1693 data[++i] = common_stats->in.bad_tag_pkts;1694 data[++i] = common_stats->in.no_sci_pkts;1695 data[++i] = common_stats->in.unknown_sci_pkts;1696 data[++i] = common_stats->in.ctrl_prt_pass_pkts;1697 data[++i] = common_stats->in.unctrl_prt_pass_pkts;1698 data[++i] = common_stats->in.ctrl_prt_fail_pkts;1699 data[++i] = common_stats->in.unctrl_prt_fail_pkts;1700 data[++i] = common_stats->in.too_long_pkts;1701 data[++i] = common_stats->in.igpoc_ctl_pkts;1702 data[++i] = common_stats->in.ecc_error_pkts;1703 data[++i] = common_stats->in.unctrl_hit_drop_redir;1704 data[++i] = common_stats->out.ctl_pkts;1705 data[++i] = common_stats->out.unknown_sa_pkts;1706 data[++i] = common_stats->out.untagged_pkts;1707 data[++i] = common_stats->out.too_long;1708 data[++i] = common_stats->out.ecc_error_pkts;1709 data[++i] = common_stats->out.unctrl_hit_drop_redir;1710 1711 for (sc_num = 0; sc_num < AQ_MACSEC_MAX_SC; sc_num++) {1712 if (!(test_bit(sc_num, &cfg->txsc_idx_busy)))1713 continue;1714 1715 aq_txsc = &cfg->aq_txsc[sc_num];1716 txsc_stats = &aq_txsc->stats;1717 1718 data[++i] = txsc_stats->sc_protected_pkts;1719 data[++i] = txsc_stats->sc_encrypted_pkts;1720 data[++i] = txsc_stats->sc_protected_octets;1721 data[++i] = txsc_stats->sc_encrypted_octets;1722 1723 for (assoc_num = 0; assoc_num < MACSEC_NUM_AN; assoc_num++) {1724 if (!test_bit(assoc_num, &aq_txsc->tx_sa_idx_busy))1725 continue;1726 1727 txsa_stats = &aq_txsc->tx_sa_stats[assoc_num];1728 1729 data[++i] = txsa_stats->sa_hit_drop_redirect;1730 data[++i] = txsa_stats->sa_protected2_pkts;1731 data[++i] = txsa_stats->sa_protected_pkts;1732 data[++i] = txsa_stats->sa_encrypted_pkts;1733 }1734 }1735 1736 for (sc_num = 0; sc_num < AQ_MACSEC_MAX_SC; sc_num++) {1737 if (!(test_bit(sc_num, &cfg->rxsc_idx_busy)))1738 continue;1739 1740 aq_rxsc = &cfg->aq_rxsc[sc_num];1741 1742 for (assoc_num = 0; assoc_num < MACSEC_NUM_AN; assoc_num++) {1743 if (!test_bit(assoc_num, &aq_rxsc->rx_sa_idx_busy))1744 continue;1745 1746 rxsa_stats = &aq_rxsc->rx_sa_stats[assoc_num];1747 1748 data[++i] = rxsa_stats->untagged_hit_pkts;1749 data[++i] = rxsa_stats->ctrl_hit_drop_redir_pkts;1750 data[++i] = rxsa_stats->not_using_sa;1751 data[++i] = rxsa_stats->unused_sa;1752 data[++i] = rxsa_stats->not_valid_pkts;1753 data[++i] = rxsa_stats->invalid_pkts;1754 data[++i] = rxsa_stats->ok_pkts;1755 data[++i] = rxsa_stats->late_pkts;1756 data[++i] = rxsa_stats->delayed_pkts;1757 data[++i] = rxsa_stats->unchecked_pkts;1758 data[++i] = rxsa_stats->validated_octets;1759 data[++i] = rxsa_stats->decrypted_octets;1760 }1761 }1762 1763 i++;1764 1765 data += i;1766 1767 mutex_unlock(&nic->macsec_mutex);1768 1769 return data;1770}1771