1 // SPDX-License-Identifier: GPL-2.0-only 2 /* Atlantic Network Driver 3 * Copyright (C) 2020 Marvell International Ltd. 4 */ 5 6 #include "aq_macsec.h" 7 #include "aq_nic.h" 8 #include <linux/rtnetlink.h> 9 10 #include "macsec/macsec_api.h" 11 #define AQ_MACSEC_KEY_LEN_128_BIT 16 12 #define AQ_MACSEC_KEY_LEN_192_BIT 24 13 #define AQ_MACSEC_KEY_LEN_256_BIT 32 14 15 enum aq_clear_type { 16 /* update HW configuration */ 17 AQ_CLEAR_HW = BIT(0), 18 /* update SW configuration (busy bits, pointers) */ 19 AQ_CLEAR_SW = BIT(1), 20 /* update both HW and SW configuration */ 21 AQ_CLEAR_ALL = AQ_CLEAR_HW | AQ_CLEAR_SW, 22 }; 23 24 static int aq_clear_txsc(struct aq_nic_s *nic, const int txsc_idx, 25 enum aq_clear_type clear_type); 26 static int aq_clear_txsa(struct aq_nic_s *nic, struct aq_macsec_txsc *aq_txsc, 27 const int sa_num, enum aq_clear_type clear_type); 28 static int aq_clear_rxsc(struct aq_nic_s *nic, const int rxsc_idx, 29 enum aq_clear_type clear_type); 30 static int aq_clear_rxsa(struct aq_nic_s *nic, struct aq_macsec_rxsc *aq_rxsc, 31 const int sa_num, enum aq_clear_type clear_type); 32 static int aq_clear_secy(struct aq_nic_s *nic, const struct macsec_secy *secy, 33 enum aq_clear_type clear_type); 34 static int aq_apply_macsec_cfg(struct aq_nic_s *nic); 35 static int aq_apply_secy_cfg(struct aq_nic_s *nic, 36 const struct macsec_secy *secy); 37 38 static void aq_ether_addr_to_mac(u32 mac[2], const unsigned char *emac) 39 { 40 u32 tmp[2] = { 0 }; 41 42 memcpy(((u8 *)tmp) + 2, emac, ETH_ALEN); 43 44 mac[0] = swab32(tmp[1]); 45 mac[1] = swab32(tmp[0]); 46 } 47 48 /* There's a 1:1 mapping between SecY and TX SC */ 49 static int aq_get_txsc_idx_from_secy(struct aq_macsec_cfg *macsec_cfg, 50 const struct macsec_secy *secy) 51 { 52 int i; 53 54 if (unlikely(!secy)) 55 return -1; 56 57 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) { 58 if (macsec_cfg->aq_txsc[i].sw_secy == secy) 59 return i; 60 } 61 return -1; 62 } 63 64 static int aq_get_rxsc_idx_from_rxsc(struct aq_macsec_cfg *macsec_cfg, 65 const struct macsec_rx_sc *rxsc) 66 { 67 int i; 68 69 if (unlikely(!rxsc)) 70 return -1; 71 72 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) { 73 if (macsec_cfg->aq_rxsc[i].sw_rxsc == rxsc) 74 return i; 75 } 76 77 return -1; 78 } 79 80 static int aq_get_txsc_idx_from_sc_idx(const enum aq_macsec_sc_sa sc_sa, 81 const int sc_idx) 82 { 83 switch (sc_sa) { 84 case aq_macsec_sa_sc_4sa_8sc: 85 return sc_idx >> 2; 86 case aq_macsec_sa_sc_2sa_16sc: 87 return sc_idx >> 1; 88 case aq_macsec_sa_sc_1sa_32sc: 89 return sc_idx; 90 default: 91 WARN_ONCE(true, "Invalid sc_sa"); 92 } 93 return -1; 94 } 95 96 /* Rotate keys u32[8] */ 97 static void aq_rotate_keys(u32 (*key)[8], const int key_len) 98 { 99 u32 tmp[8] = { 0 }; 100 101 memcpy(&tmp, key, sizeof(tmp)); 102 memset(*key, 0, sizeof(*key)); 103 104 if (key_len == AQ_MACSEC_KEY_LEN_128_BIT) { 105 (*key)[0] = swab32(tmp[3]); 106 (*key)[1] = swab32(tmp[2]); 107 (*key)[2] = swab32(tmp[1]); 108 (*key)[3] = swab32(tmp[0]); 109 } else if (key_len == AQ_MACSEC_KEY_LEN_192_BIT) { 110 (*key)[0] = swab32(tmp[5]); 111 (*key)[1] = swab32(tmp[4]); 112 (*key)[2] = swab32(tmp[3]); 113 (*key)[3] = swab32(tmp[2]); 114 (*key)[4] = swab32(tmp[1]); 115 (*key)[5] = swab32(tmp[0]); 116 } else if (key_len == AQ_MACSEC_KEY_LEN_256_BIT) { 117 (*key)[0] = swab32(tmp[7]); 118 (*key)[1] = swab32(tmp[6]); 119 (*key)[2] = swab32(tmp[5]); 120 (*key)[3] = swab32(tmp[4]); 121 (*key)[4] = swab32(tmp[3]); 122 (*key)[5] = swab32(tmp[2]); 123 (*key)[6] = swab32(tmp[1]); 124 (*key)[7] = swab32(tmp[0]); 125 } else { 126 pr_warn("Rotate_keys: invalid key_len\n"); 127 } 128 } 129 130 #define STATS_2x32_TO_64(stat_field) \ 131 (((u64)stat_field[1] << 32) | stat_field[0]) 132 133 static int aq_get_macsec_common_stats(struct aq_hw_s *hw, 134 struct aq_macsec_common_stats *stats) 135 { 136 struct aq_mss_ingress_common_counters ingress_counters; 137 struct aq_mss_egress_common_counters egress_counters; 138 int ret; 139 140 /* MACSEC counters */ 141 ret = aq_mss_get_ingress_common_counters(hw, &ingress_counters); 142 if (unlikely(ret)) 143 return ret; 144 145 stats->in.ctl_pkts = STATS_2x32_TO_64(ingress_counters.ctl_pkts); 146 stats->in.tagged_miss_pkts = 147 STATS_2x32_TO_64(ingress_counters.tagged_miss_pkts); 148 stats->in.untagged_miss_pkts = 149 STATS_2x32_TO_64(ingress_counters.untagged_miss_pkts); 150 stats->in.notag_pkts = STATS_2x32_TO_64(ingress_counters.notag_pkts); 151 stats->in.untagged_pkts = 152 STATS_2x32_TO_64(ingress_counters.untagged_pkts); 153 stats->in.bad_tag_pkts = 154 STATS_2x32_TO_64(ingress_counters.bad_tag_pkts); 155 stats->in.no_sci_pkts = STATS_2x32_TO_64(ingress_counters.no_sci_pkts); 156 stats->in.unknown_sci_pkts = 157 STATS_2x32_TO_64(ingress_counters.unknown_sci_pkts); 158 stats->in.ctrl_prt_pass_pkts = 159 STATS_2x32_TO_64(ingress_counters.ctrl_prt_pass_pkts); 160 stats->in.unctrl_prt_pass_pkts = 161 STATS_2x32_TO_64(ingress_counters.unctrl_prt_pass_pkts); 162 stats->in.ctrl_prt_fail_pkts = 163 STATS_2x32_TO_64(ingress_counters.ctrl_prt_fail_pkts); 164 stats->in.unctrl_prt_fail_pkts = 165 STATS_2x32_TO_64(ingress_counters.unctrl_prt_fail_pkts); 166 stats->in.too_long_pkts = 167 STATS_2x32_TO_64(ingress_counters.too_long_pkts); 168 stats->in.igpoc_ctl_pkts = 169 STATS_2x32_TO_64(ingress_counters.igpoc_ctl_pkts); 170 stats->in.ecc_error_pkts = 171 STATS_2x32_TO_64(ingress_counters.ecc_error_pkts); 172 stats->in.unctrl_hit_drop_redir = 173 STATS_2x32_TO_64(ingress_counters.unctrl_hit_drop_redir); 174 175 ret = aq_mss_get_egress_common_counters(hw, &egress_counters); 176 if (unlikely(ret)) 177 return ret; 178 stats->out.ctl_pkts = STATS_2x32_TO_64(egress_counters.ctl_pkt); 179 stats->out.unknown_sa_pkts = 180 STATS_2x32_TO_64(egress_counters.unknown_sa_pkts); 181 stats->out.untagged_pkts = 182 STATS_2x32_TO_64(egress_counters.untagged_pkts); 183 stats->out.too_long = STATS_2x32_TO_64(egress_counters.too_long); 184 stats->out.ecc_error_pkts = 185 STATS_2x32_TO_64(egress_counters.ecc_error_pkts); 186 stats->out.unctrl_hit_drop_redir = 187 STATS_2x32_TO_64(egress_counters.unctrl_hit_drop_redir); 188 189 return 0; 190 } 191 192 static int aq_get_rxsa_stats(struct aq_hw_s *hw, const int sa_idx, 193 struct aq_macsec_rx_sa_stats *stats) 194 { 195 struct aq_mss_ingress_sa_counters i_sa_counters; 196 int ret; 197 198 ret = aq_mss_get_ingress_sa_counters(hw, &i_sa_counters, sa_idx); 199 if (unlikely(ret)) 200 return ret; 201 202 stats->untagged_hit_pkts = 203 STATS_2x32_TO_64(i_sa_counters.untagged_hit_pkts); 204 stats->ctrl_hit_drop_redir_pkts = 205 STATS_2x32_TO_64(i_sa_counters.ctrl_hit_drop_redir_pkts); 206 stats->not_using_sa = STATS_2x32_TO_64(i_sa_counters.not_using_sa); 207 stats->unused_sa = STATS_2x32_TO_64(i_sa_counters.unused_sa); 208 stats->not_valid_pkts = STATS_2x32_TO_64(i_sa_counters.not_valid_pkts); 209 stats->invalid_pkts = STATS_2x32_TO_64(i_sa_counters.invalid_pkts); 210 stats->ok_pkts = STATS_2x32_TO_64(i_sa_counters.ok_pkts); 211 stats->late_pkts = STATS_2x32_TO_64(i_sa_counters.late_pkts); 212 stats->delayed_pkts = STATS_2x32_TO_64(i_sa_counters.delayed_pkts); 213 stats->unchecked_pkts = STATS_2x32_TO_64(i_sa_counters.unchecked_pkts); 214 stats->validated_octets = 215 STATS_2x32_TO_64(i_sa_counters.validated_octets); 216 stats->decrypted_octets = 217 STATS_2x32_TO_64(i_sa_counters.decrypted_octets); 218 219 return 0; 220 } 221 222 static int aq_get_txsa_stats(struct aq_hw_s *hw, const int sa_idx, 223 struct aq_macsec_tx_sa_stats *stats) 224 { 225 struct aq_mss_egress_sa_counters e_sa_counters; 226 int ret; 227 228 ret = aq_mss_get_egress_sa_counters(hw, &e_sa_counters, sa_idx); 229 if (unlikely(ret)) 230 return ret; 231 232 stats->sa_hit_drop_redirect = 233 STATS_2x32_TO_64(e_sa_counters.sa_hit_drop_redirect); 234 stats->sa_protected2_pkts = 235 STATS_2x32_TO_64(e_sa_counters.sa_protected2_pkts); 236 stats->sa_protected_pkts = 237 STATS_2x32_TO_64(e_sa_counters.sa_protected_pkts); 238 stats->sa_encrypted_pkts = 239 STATS_2x32_TO_64(e_sa_counters.sa_encrypted_pkts); 240 241 return 0; 242 } 243 244 static int aq_get_txsa_next_pn(struct aq_hw_s *hw, const int sa_idx, u32 *pn) 245 { 246 struct aq_mss_egress_sa_record sa_rec; 247 int ret; 248 249 ret = aq_mss_get_egress_sa_record(hw, &sa_rec, sa_idx); 250 if (likely(!ret)) 251 *pn = sa_rec.next_pn; 252 253 return ret; 254 } 255 256 static int aq_get_rxsa_next_pn(struct aq_hw_s *hw, const int sa_idx, u32 *pn) 257 { 258 struct aq_mss_ingress_sa_record sa_rec; 259 int ret; 260 261 ret = aq_mss_get_ingress_sa_record(hw, &sa_rec, sa_idx); 262 if (likely(!ret)) 263 *pn = (!sa_rec.sat_nextpn) ? sa_rec.next_pn : 0; 264 265 return ret; 266 } 267 268 static int aq_get_txsc_stats(struct aq_hw_s *hw, const int sc_idx, 269 struct aq_macsec_tx_sc_stats *stats) 270 { 271 struct aq_mss_egress_sc_counters e_sc_counters; 272 int ret; 273 274 ret = aq_mss_get_egress_sc_counters(hw, &e_sc_counters, sc_idx); 275 if (unlikely(ret)) 276 return ret; 277 278 stats->sc_protected_pkts = 279 STATS_2x32_TO_64(e_sc_counters.sc_protected_pkts); 280 stats->sc_encrypted_pkts = 281 STATS_2x32_TO_64(e_sc_counters.sc_encrypted_pkts); 282 stats->sc_protected_octets = 283 STATS_2x32_TO_64(e_sc_counters.sc_protected_octets); 284 stats->sc_encrypted_octets = 285 STATS_2x32_TO_64(e_sc_counters.sc_encrypted_octets); 286 287 return 0; 288 } 289 290 static int aq_mdo_dev_open(struct macsec_context *ctx) 291 { 292 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 293 int ret = 0; 294 295 if (netif_carrier_ok(nic->ndev)) 296 ret = aq_apply_secy_cfg(nic, ctx->secy); 297 298 return ret; 299 } 300 301 static int aq_mdo_dev_stop(struct macsec_context *ctx) 302 { 303 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 304 int i; 305 306 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) { 307 if (nic->macsec_cfg->txsc_idx_busy & BIT(i)) 308 aq_clear_secy(nic, nic->macsec_cfg->aq_txsc[i].sw_secy, 309 AQ_CLEAR_HW); 310 } 311 312 return 0; 313 } 314 315 static int aq_set_txsc(struct aq_nic_s *nic, const int txsc_idx) 316 { 317 struct aq_macsec_txsc *aq_txsc = &nic->macsec_cfg->aq_txsc[txsc_idx]; 318 struct aq_mss_egress_class_record tx_class_rec = { 0 }; 319 const struct macsec_secy *secy = aq_txsc->sw_secy; 320 struct aq_mss_egress_sc_record sc_rec = { 0 }; 321 unsigned int sc_idx = aq_txsc->hw_sc_idx; 322 struct aq_hw_s *hw = nic->aq_hw; 323 int ret = 0; 324 325 aq_ether_addr_to_mac(tx_class_rec.mac_sa, secy->netdev->dev_addr); 326 327 put_unaligned_be64((__force u64)secy->sci, tx_class_rec.sci); 328 tx_class_rec.sci_mask = 0; 329 330 tx_class_rec.sa_mask = 0x3f; 331 332 tx_class_rec.action = 0; /* forward to SA/SC table */ 333 tx_class_rec.valid = 1; 334 335 tx_class_rec.sc_idx = sc_idx; 336 337 tx_class_rec.sc_sa = nic->macsec_cfg->sc_sa; 338 339 ret = aq_mss_set_egress_class_record(hw, &tx_class_rec, txsc_idx); 340 if (ret) 341 return ret; 342 343 sc_rec.protect = secy->protect_frames; 344 if (secy->tx_sc.encrypt) 345 sc_rec.tci |= BIT(1); 346 if (secy->tx_sc.scb) 347 sc_rec.tci |= BIT(2); 348 if (secy->tx_sc.send_sci) 349 sc_rec.tci |= BIT(3); 350 if (secy->tx_sc.end_station) 351 sc_rec.tci |= BIT(4); 352 /* The C bit is clear if and only if the Secure Data is 353 * exactly the same as the User Data and the ICV is 16 octets long. 354 */ 355 if (!(secy->icv_len == 16 && !secy->tx_sc.encrypt)) 356 sc_rec.tci |= BIT(0); 357 358 sc_rec.an_roll = 0; 359 360 switch (secy->key_len) { 361 case AQ_MACSEC_KEY_LEN_128_BIT: 362 sc_rec.sak_len = 0; 363 break; 364 case AQ_MACSEC_KEY_LEN_192_BIT: 365 sc_rec.sak_len = 1; 366 break; 367 case AQ_MACSEC_KEY_LEN_256_BIT: 368 sc_rec.sak_len = 2; 369 break; 370 default: 371 WARN_ONCE(true, "Invalid sc_sa"); 372 return -EINVAL; 373 } 374 375 sc_rec.curr_an = secy->tx_sc.encoding_sa; 376 sc_rec.valid = 1; 377 sc_rec.fresh = 1; 378 379 return aq_mss_set_egress_sc_record(hw, &sc_rec, sc_idx); 380 } 381 382 static u32 aq_sc_idx_max(const enum aq_macsec_sc_sa sc_sa) 383 { 384 u32 result = 0; 385 386 switch (sc_sa) { 387 case aq_macsec_sa_sc_4sa_8sc: 388 result = 8; 389 break; 390 case aq_macsec_sa_sc_2sa_16sc: 391 result = 16; 392 break; 393 case aq_macsec_sa_sc_1sa_32sc: 394 result = 32; 395 break; 396 default: 397 break; 398 } 399 400 return result; 401 } 402 403 static u32 aq_to_hw_sc_idx(const u32 sc_idx, const enum aq_macsec_sc_sa sc_sa) 404 { 405 switch (sc_sa) { 406 case aq_macsec_sa_sc_4sa_8sc: 407 return sc_idx << 2; 408 case aq_macsec_sa_sc_2sa_16sc: 409 return sc_idx << 1; 410 case aq_macsec_sa_sc_1sa_32sc: 411 return sc_idx; 412 default: 413 WARN_ONCE(true, "Invalid sc_sa"); 414 } 415 416 return sc_idx; 417 } 418 419 static enum aq_macsec_sc_sa sc_sa_from_num_an(const int num_an) 420 { 421 enum aq_macsec_sc_sa sc_sa = aq_macsec_sa_sc_not_used; 422 423 switch (num_an) { 424 case 4: 425 sc_sa = aq_macsec_sa_sc_4sa_8sc; 426 break; 427 case 2: 428 sc_sa = aq_macsec_sa_sc_2sa_16sc; 429 break; 430 case 1: 431 sc_sa = aq_macsec_sa_sc_1sa_32sc; 432 break; 433 default: 434 break; 435 } 436 437 return sc_sa; 438 } 439 440 static int aq_mdo_add_secy(struct macsec_context *ctx) 441 { 442 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 443 struct aq_macsec_cfg *cfg = nic->macsec_cfg; 444 const struct macsec_secy *secy = ctx->secy; 445 enum aq_macsec_sc_sa sc_sa; 446 u32 txsc_idx; 447 int ret = 0; 448 449 if (secy->xpn) 450 return -EOPNOTSUPP; 451 452 sc_sa = sc_sa_from_num_an(MACSEC_NUM_AN); 453 if (sc_sa == aq_macsec_sa_sc_not_used) 454 return -EINVAL; 455 456 if (hweight32(cfg->txsc_idx_busy) >= aq_sc_idx_max(sc_sa)) 457 return -ENOSPC; 458 459 txsc_idx = ffz(cfg->txsc_idx_busy); 460 if (txsc_idx == AQ_MACSEC_MAX_SC) 461 return -ENOSPC; 462 463 cfg->sc_sa = sc_sa; 464 cfg->aq_txsc[txsc_idx].hw_sc_idx = aq_to_hw_sc_idx(txsc_idx, sc_sa); 465 cfg->aq_txsc[txsc_idx].sw_secy = secy; 466 467 if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev)) 468 ret = aq_set_txsc(nic, txsc_idx); 469 470 set_bit(txsc_idx, &cfg->txsc_idx_busy); 471 472 return ret; 473 } 474 475 static int aq_mdo_upd_secy(struct macsec_context *ctx) 476 { 477 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 478 const struct macsec_secy *secy = ctx->secy; 479 int txsc_idx; 480 int ret = 0; 481 482 txsc_idx = aq_get_txsc_idx_from_secy(nic->macsec_cfg, secy); 483 if (txsc_idx < 0) 484 return -ENOENT; 485 486 if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev)) 487 ret = aq_set_txsc(nic, txsc_idx); 488 489 return ret; 490 } 491 492 static int aq_clear_txsc(struct aq_nic_s *nic, const int txsc_idx, 493 enum aq_clear_type clear_type) 494 { 495 struct aq_macsec_txsc *tx_sc = &nic->macsec_cfg->aq_txsc[txsc_idx]; 496 struct aq_mss_egress_class_record tx_class_rec = { 0 }; 497 struct aq_mss_egress_sc_record sc_rec = { 0 }; 498 struct aq_hw_s *hw = nic->aq_hw; 499 int ret = 0; 500 int sa_num; 501 502 for_each_set_bit (sa_num, &tx_sc->tx_sa_idx_busy, AQ_MACSEC_MAX_SA) { 503 ret = aq_clear_txsa(nic, tx_sc, sa_num, clear_type); 504 if (ret) 505 return ret; 506 } 507 508 if (clear_type & AQ_CLEAR_HW) { 509 ret = aq_mss_set_egress_class_record(hw, &tx_class_rec, 510 txsc_idx); 511 if (ret) 512 return ret; 513 514 sc_rec.fresh = 1; 515 ret = aq_mss_set_egress_sc_record(hw, &sc_rec, 516 tx_sc->hw_sc_idx); 517 if (ret) 518 return ret; 519 } 520 521 if (clear_type & AQ_CLEAR_SW) { 522 clear_bit(txsc_idx, &nic->macsec_cfg->txsc_idx_busy); 523 nic->macsec_cfg->aq_txsc[txsc_idx].sw_secy = NULL; 524 } 525 526 return ret; 527 } 528 529 static int aq_mdo_del_secy(struct macsec_context *ctx) 530 { 531 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 532 int ret = 0; 533 534 if (!nic->macsec_cfg) 535 return 0; 536 537 ret = aq_clear_secy(nic, ctx->secy, AQ_CLEAR_ALL); 538 539 return ret; 540 } 541 542 static int aq_update_txsa(struct aq_nic_s *nic, const unsigned int sc_idx, 543 const struct macsec_secy *secy, 544 const struct macsec_tx_sa *tx_sa, 545 const unsigned char *key, const unsigned char an) 546 { 547 const u32 next_pn = tx_sa->next_pn_halves.lower; 548 struct aq_mss_egress_sakey_record key_rec; 549 const unsigned int sa_idx = sc_idx | an; 550 struct aq_mss_egress_sa_record sa_rec; 551 struct aq_hw_s *hw = nic->aq_hw; 552 int ret = 0; 553 554 memset(&sa_rec, 0, sizeof(sa_rec)); 555 sa_rec.valid = tx_sa->active; 556 sa_rec.fresh = 1; 557 sa_rec.next_pn = next_pn; 558 559 ret = aq_mss_set_egress_sa_record(hw, &sa_rec, sa_idx); 560 if (ret) 561 return ret; 562 563 if (!key) 564 return ret; 565 566 memset(&key_rec, 0, sizeof(key_rec)); 567 memcpy(&key_rec.key, key, secy->key_len); 568 569 aq_rotate_keys(&key_rec.key, secy->key_len); 570 571 ret = aq_mss_set_egress_sakey_record(hw, &key_rec, sa_idx); 572 573 return ret; 574 } 575 576 static int aq_mdo_add_txsa(struct macsec_context *ctx) 577 { 578 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 579 struct aq_macsec_cfg *cfg = nic->macsec_cfg; 580 const struct macsec_secy *secy = ctx->secy; 581 struct aq_macsec_txsc *aq_txsc; 582 int txsc_idx; 583 int ret = 0; 584 585 txsc_idx = aq_get_txsc_idx_from_secy(cfg, secy); 586 if (txsc_idx < 0) 587 return -EINVAL; 588 589 aq_txsc = &cfg->aq_txsc[txsc_idx]; 590 set_bit(ctx->sa.assoc_num, &aq_txsc->tx_sa_idx_busy); 591 592 memcpy(aq_txsc->tx_sa_key[ctx->sa.assoc_num], ctx->sa.key, 593 secy->key_len); 594 595 if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev)) 596 ret = aq_update_txsa(nic, aq_txsc->hw_sc_idx, secy, 597 ctx->sa.tx_sa, ctx->sa.key, 598 ctx->sa.assoc_num); 599 600 return ret; 601 } 602 603 static int aq_mdo_upd_txsa(struct macsec_context *ctx) 604 { 605 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 606 struct aq_macsec_cfg *cfg = nic->macsec_cfg; 607 const struct macsec_secy *secy = ctx->secy; 608 struct aq_macsec_txsc *aq_txsc; 609 int txsc_idx; 610 int ret = 0; 611 612 txsc_idx = aq_get_txsc_idx_from_secy(cfg, secy); 613 if (txsc_idx < 0) 614 return -EINVAL; 615 616 aq_txsc = &cfg->aq_txsc[txsc_idx]; 617 if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev)) 618 ret = aq_update_txsa(nic, aq_txsc->hw_sc_idx, secy, 619 ctx->sa.tx_sa, NULL, ctx->sa.assoc_num); 620 621 return ret; 622 } 623 624 static int aq_clear_txsa(struct aq_nic_s *nic, struct aq_macsec_txsc *aq_txsc, 625 const int sa_num, enum aq_clear_type clear_type) 626 { 627 const int sa_idx = aq_txsc->hw_sc_idx | sa_num; 628 struct aq_hw_s *hw = nic->aq_hw; 629 int ret = 0; 630 631 if (clear_type & AQ_CLEAR_SW) 632 clear_bit(sa_num, &aq_txsc->tx_sa_idx_busy); 633 634 if ((clear_type & AQ_CLEAR_HW) && netif_carrier_ok(nic->ndev)) { 635 struct aq_mss_egress_sakey_record key_rec; 636 struct aq_mss_egress_sa_record sa_rec; 637 638 memset(&sa_rec, 0, sizeof(sa_rec)); 639 sa_rec.fresh = 1; 640 641 ret = aq_mss_set_egress_sa_record(hw, &sa_rec, sa_idx); 642 if (ret) 643 return ret; 644 645 memset(&key_rec, 0, sizeof(key_rec)); 646 return aq_mss_set_egress_sakey_record(hw, &key_rec, sa_idx); 647 } 648 649 return 0; 650 } 651 652 static int aq_mdo_del_txsa(struct macsec_context *ctx) 653 { 654 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 655 struct aq_macsec_cfg *cfg = nic->macsec_cfg; 656 int txsc_idx; 657 int ret = 0; 658 659 txsc_idx = aq_get_txsc_idx_from_secy(cfg, ctx->secy); 660 if (txsc_idx < 0) 661 return -EINVAL; 662 663 ret = aq_clear_txsa(nic, &cfg->aq_txsc[txsc_idx], ctx->sa.assoc_num, 664 AQ_CLEAR_ALL); 665 666 return ret; 667 } 668 669 static int aq_rxsc_validate_frames(const enum macsec_validation_type validate) 670 { 671 switch (validate) { 672 case MACSEC_VALIDATE_DISABLED: 673 return 2; 674 case MACSEC_VALIDATE_CHECK: 675 return 1; 676 case MACSEC_VALIDATE_STRICT: 677 return 0; 678 default: 679 WARN_ONCE(true, "Invalid validation type"); 680 } 681 682 return 0; 683 } 684 685 static int aq_set_rxsc(struct aq_nic_s *nic, const u32 rxsc_idx) 686 { 687 const struct aq_macsec_rxsc *aq_rxsc = 688 &nic->macsec_cfg->aq_rxsc[rxsc_idx]; 689 struct aq_mss_ingress_preclass_record pre_class_record; 690 const struct macsec_rx_sc *rx_sc = aq_rxsc->sw_rxsc; 691 const struct macsec_secy *secy = aq_rxsc->sw_secy; 692 const u32 hw_sc_idx = aq_rxsc->hw_sc_idx; 693 struct aq_mss_ingress_sc_record sc_record; 694 struct aq_hw_s *hw = nic->aq_hw; 695 int ret = 0; 696 697 memset(&pre_class_record, 0, sizeof(pre_class_record)); 698 put_unaligned_be64((__force u64)rx_sc->sci, pre_class_record.sci); 699 pre_class_record.sci_mask = 0xff; 700 /* match all MACSEC ethertype packets */ 701 pre_class_record.eth_type = ETH_P_MACSEC; 702 pre_class_record.eth_type_mask = 0x3; 703 704 aq_ether_addr_to_mac(pre_class_record.mac_sa, (char *)&rx_sc->sci); 705 pre_class_record.sa_mask = 0x3f; 706 707 pre_class_record.an_mask = nic->macsec_cfg->sc_sa; 708 pre_class_record.sc_idx = hw_sc_idx; 709 /* strip SecTAG & forward for decryption */ 710 pre_class_record.action = 0x0; 711 pre_class_record.valid = 1; 712 713 ret = aq_mss_set_ingress_preclass_record(hw, &pre_class_record, 714 2 * rxsc_idx + 1); 715 if (ret) 716 return ret; 717 718 /* If SCI is absent, then match by SA alone */ 719 pre_class_record.sci_mask = 0; 720 pre_class_record.sci_from_table = 1; 721 722 ret = aq_mss_set_ingress_preclass_record(hw, &pre_class_record, 723 2 * rxsc_idx); 724 if (ret) 725 return ret; 726 727 memset(&sc_record, 0, sizeof(sc_record)); 728 sc_record.validate_frames = 729 aq_rxsc_validate_frames(secy->validate_frames); 730 if (secy->replay_protect) { 731 sc_record.replay_protect = 1; 732 sc_record.anti_replay_window = secy->replay_window; 733 } 734 sc_record.valid = 1; 735 sc_record.fresh = 1; 736 737 ret = aq_mss_set_ingress_sc_record(hw, &sc_record, hw_sc_idx); 738 if (ret) 739 return ret; 740 741 return ret; 742 } 743 744 static int aq_mdo_add_rxsc(struct macsec_context *ctx) 745 { 746 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 747 struct aq_macsec_cfg *cfg = nic->macsec_cfg; 748 const u32 rxsc_idx_max = aq_sc_idx_max(cfg->sc_sa); 749 u32 rxsc_idx; 750 int ret = 0; 751 752 if (hweight32(cfg->rxsc_idx_busy) >= rxsc_idx_max) 753 return -ENOSPC; 754 755 rxsc_idx = ffz(cfg->rxsc_idx_busy); 756 if (rxsc_idx >= rxsc_idx_max) 757 return -ENOSPC; 758 759 cfg->aq_rxsc[rxsc_idx].hw_sc_idx = aq_to_hw_sc_idx(rxsc_idx, 760 cfg->sc_sa); 761 cfg->aq_rxsc[rxsc_idx].sw_secy = ctx->secy; 762 cfg->aq_rxsc[rxsc_idx].sw_rxsc = ctx->rx_sc; 763 764 if (netif_carrier_ok(nic->ndev) && netif_running(ctx->secy->netdev)) 765 ret = aq_set_rxsc(nic, rxsc_idx); 766 767 if (ret < 0) 768 return ret; 769 770 set_bit(rxsc_idx, &cfg->rxsc_idx_busy); 771 772 return 0; 773 } 774 775 static int aq_mdo_upd_rxsc(struct macsec_context *ctx) 776 { 777 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 778 int rxsc_idx; 779 int ret = 0; 780 781 rxsc_idx = aq_get_rxsc_idx_from_rxsc(nic->macsec_cfg, ctx->rx_sc); 782 if (rxsc_idx < 0) 783 return -ENOENT; 784 785 if (netif_carrier_ok(nic->ndev) && netif_running(ctx->secy->netdev)) 786 ret = aq_set_rxsc(nic, rxsc_idx); 787 788 return ret; 789 } 790 791 static int aq_clear_rxsc(struct aq_nic_s *nic, const int rxsc_idx, 792 enum aq_clear_type clear_type) 793 { 794 struct aq_macsec_rxsc *rx_sc = &nic->macsec_cfg->aq_rxsc[rxsc_idx]; 795 struct aq_hw_s *hw = nic->aq_hw; 796 int ret = 0; 797 int sa_num; 798 799 for_each_set_bit (sa_num, &rx_sc->rx_sa_idx_busy, AQ_MACSEC_MAX_SA) { 800 ret = aq_clear_rxsa(nic, rx_sc, sa_num, clear_type); 801 if (ret) 802 return ret; 803 } 804 805 if (clear_type & AQ_CLEAR_HW) { 806 struct aq_mss_ingress_preclass_record pre_class_record; 807 struct aq_mss_ingress_sc_record sc_record; 808 809 memset(&pre_class_record, 0, sizeof(pre_class_record)); 810 memset(&sc_record, 0, sizeof(sc_record)); 811 812 ret = aq_mss_set_ingress_preclass_record(hw, &pre_class_record, 813 2 * rxsc_idx); 814 if (ret) 815 return ret; 816 817 ret = aq_mss_set_ingress_preclass_record(hw, &pre_class_record, 818 2 * rxsc_idx + 1); 819 if (ret) 820 return ret; 821 822 sc_record.fresh = 1; 823 ret = aq_mss_set_ingress_sc_record(hw, &sc_record, 824 rx_sc->hw_sc_idx); 825 if (ret) 826 return ret; 827 } 828 829 if (clear_type & AQ_CLEAR_SW) { 830 clear_bit(rxsc_idx, &nic->macsec_cfg->rxsc_idx_busy); 831 rx_sc->sw_secy = NULL; 832 rx_sc->sw_rxsc = NULL; 833 } 834 835 return ret; 836 } 837 838 static int aq_mdo_del_rxsc(struct macsec_context *ctx) 839 { 840 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 841 enum aq_clear_type clear_type = AQ_CLEAR_SW; 842 int rxsc_idx; 843 int ret = 0; 844 845 rxsc_idx = aq_get_rxsc_idx_from_rxsc(nic->macsec_cfg, ctx->rx_sc); 846 if (rxsc_idx < 0) 847 return -ENOENT; 848 849 if (netif_carrier_ok(nic->ndev)) 850 clear_type = AQ_CLEAR_ALL; 851 852 ret = aq_clear_rxsc(nic, rxsc_idx, clear_type); 853 854 return ret; 855 } 856 857 static int aq_update_rxsa(struct aq_nic_s *nic, const unsigned int sc_idx, 858 const struct macsec_secy *secy, 859 const struct macsec_rx_sa *rx_sa, 860 const unsigned char *key, const unsigned char an) 861 { 862 struct aq_mss_ingress_sakey_record sa_key_record; 863 const u32 next_pn = rx_sa->next_pn_halves.lower; 864 struct aq_mss_ingress_sa_record sa_record; 865 struct aq_hw_s *hw = nic->aq_hw; 866 const int sa_idx = sc_idx | an; 867 int ret = 0; 868 869 memset(&sa_record, 0, sizeof(sa_record)); 870 sa_record.valid = rx_sa->active; 871 sa_record.fresh = 1; 872 sa_record.next_pn = next_pn; 873 874 ret = aq_mss_set_ingress_sa_record(hw, &sa_record, sa_idx); 875 if (ret) 876 return ret; 877 878 if (!key) 879 return ret; 880 881 memset(&sa_key_record, 0, sizeof(sa_key_record)); 882 memcpy(&sa_key_record.key, key, secy->key_len); 883 884 switch (secy->key_len) { 885 case AQ_MACSEC_KEY_LEN_128_BIT: 886 sa_key_record.key_len = 0; 887 break; 888 case AQ_MACSEC_KEY_LEN_192_BIT: 889 sa_key_record.key_len = 1; 890 break; 891 case AQ_MACSEC_KEY_LEN_256_BIT: 892 sa_key_record.key_len = 2; 893 break; 894 default: 895 return -1; 896 } 897 898 aq_rotate_keys(&sa_key_record.key, secy->key_len); 899 900 ret = aq_mss_set_ingress_sakey_record(hw, &sa_key_record, sa_idx); 901 902 return ret; 903 } 904 905 static int aq_mdo_add_rxsa(struct macsec_context *ctx) 906 { 907 const struct macsec_rx_sc *rx_sc = ctx->sa.rx_sa->sc; 908 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 909 const struct macsec_secy *secy = ctx->secy; 910 struct aq_macsec_rxsc *aq_rxsc; 911 int rxsc_idx; 912 int ret = 0; 913 914 rxsc_idx = aq_get_rxsc_idx_from_rxsc(nic->macsec_cfg, rx_sc); 915 if (rxsc_idx < 0) 916 return -EINVAL; 917 918 aq_rxsc = &nic->macsec_cfg->aq_rxsc[rxsc_idx]; 919 set_bit(ctx->sa.assoc_num, &aq_rxsc->rx_sa_idx_busy); 920 921 memcpy(aq_rxsc->rx_sa_key[ctx->sa.assoc_num], ctx->sa.key, 922 secy->key_len); 923 924 if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev)) 925 ret = aq_update_rxsa(nic, aq_rxsc->hw_sc_idx, secy, 926 ctx->sa.rx_sa, ctx->sa.key, 927 ctx->sa.assoc_num); 928 929 return ret; 930 } 931 932 static int aq_mdo_upd_rxsa(struct macsec_context *ctx) 933 { 934 const struct macsec_rx_sc *rx_sc = ctx->sa.rx_sa->sc; 935 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 936 struct aq_macsec_cfg *cfg = nic->macsec_cfg; 937 const struct macsec_secy *secy = ctx->secy; 938 int rxsc_idx; 939 int ret = 0; 940 941 rxsc_idx = aq_get_rxsc_idx_from_rxsc(cfg, rx_sc); 942 if (rxsc_idx < 0) 943 return -EINVAL; 944 945 if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev)) 946 ret = aq_update_rxsa(nic, cfg->aq_rxsc[rxsc_idx].hw_sc_idx, 947 secy, ctx->sa.rx_sa, NULL, 948 ctx->sa.assoc_num); 949 950 return ret; 951 } 952 953 static int aq_clear_rxsa(struct aq_nic_s *nic, struct aq_macsec_rxsc *aq_rxsc, 954 const int sa_num, enum aq_clear_type clear_type) 955 { 956 int sa_idx = aq_rxsc->hw_sc_idx | sa_num; 957 struct aq_hw_s *hw = nic->aq_hw; 958 int ret = 0; 959 960 if (clear_type & AQ_CLEAR_SW) 961 clear_bit(sa_num, &aq_rxsc->rx_sa_idx_busy); 962 963 if ((clear_type & AQ_CLEAR_HW) && netif_carrier_ok(nic->ndev)) { 964 struct aq_mss_ingress_sakey_record sa_key_record; 965 struct aq_mss_ingress_sa_record sa_record; 966 967 memset(&sa_key_record, 0, sizeof(sa_key_record)); 968 memset(&sa_record, 0, sizeof(sa_record)); 969 sa_record.fresh = 1; 970 ret = aq_mss_set_ingress_sa_record(hw, &sa_record, sa_idx); 971 if (ret) 972 return ret; 973 974 return aq_mss_set_ingress_sakey_record(hw, &sa_key_record, 975 sa_idx); 976 } 977 978 return ret; 979 } 980 981 static int aq_mdo_del_rxsa(struct macsec_context *ctx) 982 { 983 const struct macsec_rx_sc *rx_sc = ctx->sa.rx_sa->sc; 984 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 985 struct aq_macsec_cfg *cfg = nic->macsec_cfg; 986 int rxsc_idx; 987 int ret = 0; 988 989 rxsc_idx = aq_get_rxsc_idx_from_rxsc(cfg, rx_sc); 990 if (rxsc_idx < 0) 991 return -EINVAL; 992 993 ret = aq_clear_rxsa(nic, &cfg->aq_rxsc[rxsc_idx], ctx->sa.assoc_num, 994 AQ_CLEAR_ALL); 995 996 return ret; 997 } 998 999 static int aq_mdo_get_dev_stats(struct macsec_context *ctx) 1000 { 1001 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 1002 struct aq_macsec_common_stats *stats = &nic->macsec_cfg->stats; 1003 struct aq_hw_s *hw = nic->aq_hw; 1004 1005 aq_get_macsec_common_stats(hw, stats); 1006 1007 ctx->stats.dev_stats->OutPktsUntagged = stats->out.untagged_pkts; 1008 ctx->stats.dev_stats->InPktsUntagged = stats->in.untagged_pkts; 1009 ctx->stats.dev_stats->OutPktsTooLong = stats->out.too_long; 1010 ctx->stats.dev_stats->InPktsNoTag = stats->in.notag_pkts; 1011 ctx->stats.dev_stats->InPktsBadTag = stats->in.bad_tag_pkts; 1012 ctx->stats.dev_stats->InPktsUnknownSCI = stats->in.unknown_sci_pkts; 1013 ctx->stats.dev_stats->InPktsNoSCI = stats->in.no_sci_pkts; 1014 ctx->stats.dev_stats->InPktsOverrun = 0; 1015 1016 return 0; 1017 } 1018 1019 static int aq_mdo_get_tx_sc_stats(struct macsec_context *ctx) 1020 { 1021 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 1022 struct aq_macsec_tx_sc_stats *stats; 1023 struct aq_hw_s *hw = nic->aq_hw; 1024 struct aq_macsec_txsc *aq_txsc; 1025 int txsc_idx; 1026 1027 txsc_idx = aq_get_txsc_idx_from_secy(nic->macsec_cfg, ctx->secy); 1028 if (txsc_idx < 0) 1029 return -ENOENT; 1030 1031 aq_txsc = &nic->macsec_cfg->aq_txsc[txsc_idx]; 1032 stats = &aq_txsc->stats; 1033 aq_get_txsc_stats(hw, aq_txsc->hw_sc_idx, stats); 1034 1035 ctx->stats.tx_sc_stats->OutPktsProtected = stats->sc_protected_pkts; 1036 ctx->stats.tx_sc_stats->OutPktsEncrypted = stats->sc_encrypted_pkts; 1037 ctx->stats.tx_sc_stats->OutOctetsProtected = stats->sc_protected_octets; 1038 ctx->stats.tx_sc_stats->OutOctetsEncrypted = stats->sc_encrypted_octets; 1039 1040 return 0; 1041 } 1042 1043 static int aq_mdo_get_tx_sa_stats(struct macsec_context *ctx) 1044 { 1045 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 1046 struct aq_macsec_cfg *cfg = nic->macsec_cfg; 1047 struct aq_macsec_tx_sa_stats *stats; 1048 struct aq_hw_s *hw = nic->aq_hw; 1049 const struct macsec_secy *secy; 1050 struct aq_macsec_txsc *aq_txsc; 1051 struct macsec_tx_sa *tx_sa; 1052 unsigned int sa_idx; 1053 int txsc_idx; 1054 u32 next_pn; 1055 int ret; 1056 1057 txsc_idx = aq_get_txsc_idx_from_secy(cfg, ctx->secy); 1058 if (txsc_idx < 0) 1059 return -EINVAL; 1060 1061 aq_txsc = &cfg->aq_txsc[txsc_idx]; 1062 sa_idx = aq_txsc->hw_sc_idx | ctx->sa.assoc_num; 1063 stats = &aq_txsc->tx_sa_stats[ctx->sa.assoc_num]; 1064 ret = aq_get_txsa_stats(hw, sa_idx, stats); 1065 if (ret) 1066 return ret; 1067 1068 ctx->stats.tx_sa_stats->OutPktsProtected = stats->sa_protected_pkts; 1069 ctx->stats.tx_sa_stats->OutPktsEncrypted = stats->sa_encrypted_pkts; 1070 1071 secy = aq_txsc->sw_secy; 1072 tx_sa = rcu_dereference_bh(secy->tx_sc.sa[ctx->sa.assoc_num]); 1073 ret = aq_get_txsa_next_pn(hw, sa_idx, &next_pn); 1074 if (ret == 0) { 1075 spin_lock_bh(&tx_sa->lock); 1076 tx_sa->next_pn = next_pn; 1077 spin_unlock_bh(&tx_sa->lock); 1078 } 1079 1080 return ret; 1081 } 1082 1083 static int aq_mdo_get_rx_sc_stats(struct macsec_context *ctx) 1084 { 1085 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 1086 struct aq_macsec_cfg *cfg = nic->macsec_cfg; 1087 struct aq_macsec_rx_sa_stats *stats; 1088 struct aq_hw_s *hw = nic->aq_hw; 1089 struct aq_macsec_rxsc *aq_rxsc; 1090 unsigned int sa_idx; 1091 int rxsc_idx; 1092 int ret = 0; 1093 int i; 1094 1095 rxsc_idx = aq_get_rxsc_idx_from_rxsc(cfg, ctx->rx_sc); 1096 if (rxsc_idx < 0) 1097 return -ENOENT; 1098 1099 aq_rxsc = &cfg->aq_rxsc[rxsc_idx]; 1100 for (i = 0; i < MACSEC_NUM_AN; i++) { 1101 if (!test_bit(i, &aq_rxsc->rx_sa_idx_busy)) 1102 continue; 1103 1104 stats = &aq_rxsc->rx_sa_stats[i]; 1105 sa_idx = aq_rxsc->hw_sc_idx | i; 1106 ret = aq_get_rxsa_stats(hw, sa_idx, stats); 1107 if (ret) 1108 break; 1109 1110 ctx->stats.rx_sc_stats->InOctetsValidated += 1111 stats->validated_octets; 1112 ctx->stats.rx_sc_stats->InOctetsDecrypted += 1113 stats->decrypted_octets; 1114 ctx->stats.rx_sc_stats->InPktsUnchecked += 1115 stats->unchecked_pkts; 1116 ctx->stats.rx_sc_stats->InPktsDelayed += stats->delayed_pkts; 1117 ctx->stats.rx_sc_stats->InPktsOK += stats->ok_pkts; 1118 ctx->stats.rx_sc_stats->InPktsInvalid += stats->invalid_pkts; 1119 ctx->stats.rx_sc_stats->InPktsLate += stats->late_pkts; 1120 ctx->stats.rx_sc_stats->InPktsNotValid += stats->not_valid_pkts; 1121 ctx->stats.rx_sc_stats->InPktsNotUsingSA += stats->not_using_sa; 1122 ctx->stats.rx_sc_stats->InPktsUnusedSA += stats->unused_sa; 1123 } 1124 1125 return ret; 1126 } 1127 1128 static int aq_mdo_get_rx_sa_stats(struct macsec_context *ctx) 1129 { 1130 struct aq_nic_s *nic = netdev_priv(ctx->netdev); 1131 struct aq_macsec_cfg *cfg = nic->macsec_cfg; 1132 struct aq_macsec_rx_sa_stats *stats; 1133 struct aq_hw_s *hw = nic->aq_hw; 1134 struct aq_macsec_rxsc *aq_rxsc; 1135 struct macsec_rx_sa *rx_sa; 1136 unsigned int sa_idx; 1137 int rxsc_idx; 1138 u32 next_pn; 1139 int ret; 1140 1141 rxsc_idx = aq_get_rxsc_idx_from_rxsc(cfg, ctx->rx_sc); 1142 if (rxsc_idx < 0) 1143 return -EINVAL; 1144 1145 aq_rxsc = &cfg->aq_rxsc[rxsc_idx]; 1146 stats = &aq_rxsc->rx_sa_stats[ctx->sa.assoc_num]; 1147 sa_idx = aq_rxsc->hw_sc_idx | ctx->sa.assoc_num; 1148 ret = aq_get_rxsa_stats(hw, sa_idx, stats); 1149 if (ret) 1150 return ret; 1151 1152 ctx->stats.rx_sa_stats->InPktsOK = stats->ok_pkts; 1153 ctx->stats.rx_sa_stats->InPktsInvalid = stats->invalid_pkts; 1154 ctx->stats.rx_sa_stats->InPktsNotValid = stats->not_valid_pkts; 1155 ctx->stats.rx_sa_stats->InPktsNotUsingSA = stats->not_using_sa; 1156 ctx->stats.rx_sa_stats->InPktsUnusedSA = stats->unused_sa; 1157 1158 rx_sa = rcu_dereference_bh(aq_rxsc->sw_rxsc->sa[ctx->sa.assoc_num]); 1159 ret = aq_get_rxsa_next_pn(hw, sa_idx, &next_pn); 1160 if (ret == 0) { 1161 spin_lock_bh(&rx_sa->lock); 1162 rx_sa->next_pn = next_pn; 1163 spin_unlock_bh(&rx_sa->lock); 1164 } 1165 1166 return ret; 1167 } 1168 1169 static int apply_txsc_cfg(struct aq_nic_s *nic, const int txsc_idx) 1170 { 1171 struct aq_macsec_txsc *aq_txsc = &nic->macsec_cfg->aq_txsc[txsc_idx]; 1172 const struct macsec_secy *secy = aq_txsc->sw_secy; 1173 struct macsec_tx_sa *tx_sa; 1174 int ret = 0; 1175 int i; 1176 1177 if (!netif_running(secy->netdev)) 1178 return ret; 1179 1180 ret = aq_set_txsc(nic, txsc_idx); 1181 if (ret) 1182 return ret; 1183 1184 for (i = 0; i < MACSEC_NUM_AN; i++) { 1185 tx_sa = rcu_dereference_bh(secy->tx_sc.sa[i]); 1186 if (tx_sa) { 1187 ret = aq_update_txsa(nic, aq_txsc->hw_sc_idx, secy, 1188 tx_sa, aq_txsc->tx_sa_key[i], i); 1189 if (ret) 1190 return ret; 1191 } 1192 } 1193 1194 return ret; 1195 } 1196 1197 static int apply_rxsc_cfg(struct aq_nic_s *nic, const int rxsc_idx) 1198 { 1199 struct aq_macsec_rxsc *aq_rxsc = &nic->macsec_cfg->aq_rxsc[rxsc_idx]; 1200 const struct macsec_secy *secy = aq_rxsc->sw_secy; 1201 struct macsec_rx_sa *rx_sa; 1202 int ret = 0; 1203 int i; 1204 1205 if (!netif_running(secy->netdev)) 1206 return ret; 1207 1208 ret = aq_set_rxsc(nic, rxsc_idx); 1209 if (ret) 1210 return ret; 1211 1212 for (i = 0; i < MACSEC_NUM_AN; i++) { 1213 rx_sa = rcu_dereference_bh(aq_rxsc->sw_rxsc->sa[i]); 1214 if (rx_sa) { 1215 ret = aq_update_rxsa(nic, aq_rxsc->hw_sc_idx, secy, 1216 rx_sa, aq_rxsc->rx_sa_key[i], i); 1217 if (ret) 1218 return ret; 1219 } 1220 } 1221 1222 return ret; 1223 } 1224 1225 static int aq_clear_secy(struct aq_nic_s *nic, const struct macsec_secy *secy, 1226 enum aq_clear_type clear_type) 1227 { 1228 struct macsec_rx_sc *rx_sc; 1229 int txsc_idx; 1230 int rxsc_idx; 1231 int ret = 0; 1232 1233 txsc_idx = aq_get_txsc_idx_from_secy(nic->macsec_cfg, secy); 1234 if (txsc_idx >= 0) { 1235 ret = aq_clear_txsc(nic, txsc_idx, clear_type); 1236 if (ret) 1237 return ret; 1238 } 1239 1240 for (rx_sc = rcu_dereference_bh(secy->rx_sc); rx_sc; 1241 rx_sc = rcu_dereference_bh(rx_sc->next)) { 1242 rxsc_idx = aq_get_rxsc_idx_from_rxsc(nic->macsec_cfg, rx_sc); 1243 if (rxsc_idx < 0) 1244 continue; 1245 1246 ret = aq_clear_rxsc(nic, rxsc_idx, clear_type); 1247 if (ret) 1248 return ret; 1249 } 1250 1251 return ret; 1252 } 1253 1254 static int aq_apply_secy_cfg(struct aq_nic_s *nic, 1255 const struct macsec_secy *secy) 1256 { 1257 struct macsec_rx_sc *rx_sc; 1258 int txsc_idx; 1259 int rxsc_idx; 1260 int ret = 0; 1261 1262 txsc_idx = aq_get_txsc_idx_from_secy(nic->macsec_cfg, secy); 1263 if (txsc_idx >= 0) 1264 apply_txsc_cfg(nic, txsc_idx); 1265 1266 for (rx_sc = rcu_dereference_bh(secy->rx_sc); rx_sc && rx_sc->active; 1267 rx_sc = rcu_dereference_bh(rx_sc->next)) { 1268 rxsc_idx = aq_get_rxsc_idx_from_rxsc(nic->macsec_cfg, rx_sc); 1269 if (unlikely(rxsc_idx < 0)) 1270 continue; 1271 1272 ret = apply_rxsc_cfg(nic, rxsc_idx); 1273 if (ret) 1274 return ret; 1275 } 1276 1277 return ret; 1278 } 1279 1280 static int aq_apply_macsec_cfg(struct aq_nic_s *nic) 1281 { 1282 int ret = 0; 1283 int i; 1284 1285 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) { 1286 if (nic->macsec_cfg->txsc_idx_busy & BIT(i)) { 1287 ret = apply_txsc_cfg(nic, i); 1288 if (ret) 1289 return ret; 1290 } 1291 } 1292 1293 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) { 1294 if (nic->macsec_cfg->rxsc_idx_busy & BIT(i)) { 1295 ret = apply_rxsc_cfg(nic, i); 1296 if (ret) 1297 return ret; 1298 } 1299 } 1300 1301 return ret; 1302 } 1303 1304 static int aq_sa_from_sa_idx(const enum aq_macsec_sc_sa sc_sa, const int sa_idx) 1305 { 1306 switch (sc_sa) { 1307 case aq_macsec_sa_sc_4sa_8sc: 1308 return sa_idx & 3; 1309 case aq_macsec_sa_sc_2sa_16sc: 1310 return sa_idx & 1; 1311 case aq_macsec_sa_sc_1sa_32sc: 1312 return 0; 1313 default: 1314 WARN_ONCE(true, "Invalid sc_sa"); 1315 } 1316 return -EINVAL; 1317 } 1318 1319 static int aq_sc_idx_from_sa_idx(const enum aq_macsec_sc_sa sc_sa, 1320 const int sa_idx) 1321 { 1322 switch (sc_sa) { 1323 case aq_macsec_sa_sc_4sa_8sc: 1324 return sa_idx & ~3; 1325 case aq_macsec_sa_sc_2sa_16sc: 1326 return sa_idx & ~1; 1327 case aq_macsec_sa_sc_1sa_32sc: 1328 return sa_idx; 1329 default: 1330 WARN_ONCE(true, "Invalid sc_sa"); 1331 } 1332 return -EINVAL; 1333 } 1334 1335 static void aq_check_txsa_expiration(struct aq_nic_s *nic) 1336 { 1337 u32 egress_sa_expired, egress_sa_threshold_expired; 1338 struct aq_macsec_cfg *cfg = nic->macsec_cfg; 1339 struct aq_hw_s *hw = nic->aq_hw; 1340 struct aq_macsec_txsc *aq_txsc; 1341 const struct macsec_secy *secy; 1342 int sc_idx = 0, txsc_idx = 0; 1343 enum aq_macsec_sc_sa sc_sa; 1344 struct macsec_tx_sa *tx_sa; 1345 unsigned char an = 0; 1346 int ret; 1347 int i; 1348 1349 sc_sa = cfg->sc_sa; 1350 1351 ret = aq_mss_get_egress_sa_expired(hw, &egress_sa_expired); 1352 if (unlikely(ret)) 1353 return; 1354 1355 ret = aq_mss_get_egress_sa_threshold_expired(hw, 1356 &egress_sa_threshold_expired); 1357 1358 for (i = 0; i < AQ_MACSEC_MAX_SA; i++) { 1359 if (egress_sa_expired & BIT(i)) { 1360 an = aq_sa_from_sa_idx(sc_sa, i); 1361 sc_idx = aq_sc_idx_from_sa_idx(sc_sa, i); 1362 txsc_idx = aq_get_txsc_idx_from_sc_idx(sc_sa, sc_idx); 1363 if (txsc_idx < 0) 1364 continue; 1365 1366 aq_txsc = &cfg->aq_txsc[txsc_idx]; 1367 if (!(cfg->txsc_idx_busy & BIT(txsc_idx))) { 1368 netdev_warn(nic->ndev, 1369 "PN threshold expired on invalid TX SC"); 1370 continue; 1371 } 1372 1373 secy = aq_txsc->sw_secy; 1374 if (!netif_running(secy->netdev)) { 1375 netdev_warn(nic->ndev, 1376 "PN threshold expired on down TX SC"); 1377 continue; 1378 } 1379 1380 if (unlikely(!(aq_txsc->tx_sa_idx_busy & BIT(an)))) { 1381 netdev_warn(nic->ndev, 1382 "PN threshold expired on invalid TX SA"); 1383 continue; 1384 } 1385 1386 tx_sa = rcu_dereference_bh(secy->tx_sc.sa[an]); 1387 macsec_pn_wrapped((struct macsec_secy *)secy, tx_sa); 1388 } 1389 } 1390 1391 aq_mss_set_egress_sa_expired(hw, egress_sa_expired); 1392 if (likely(!ret)) 1393 aq_mss_set_egress_sa_threshold_expired(hw, 1394 egress_sa_threshold_expired); 1395 } 1396 1397 const struct macsec_ops aq_macsec_ops = { 1398 .mdo_dev_open = aq_mdo_dev_open, 1399 .mdo_dev_stop = aq_mdo_dev_stop, 1400 .mdo_add_secy = aq_mdo_add_secy, 1401 .mdo_upd_secy = aq_mdo_upd_secy, 1402 .mdo_del_secy = aq_mdo_del_secy, 1403 .mdo_add_rxsc = aq_mdo_add_rxsc, 1404 .mdo_upd_rxsc = aq_mdo_upd_rxsc, 1405 .mdo_del_rxsc = aq_mdo_del_rxsc, 1406 .mdo_add_rxsa = aq_mdo_add_rxsa, 1407 .mdo_upd_rxsa = aq_mdo_upd_rxsa, 1408 .mdo_del_rxsa = aq_mdo_del_rxsa, 1409 .mdo_add_txsa = aq_mdo_add_txsa, 1410 .mdo_upd_txsa = aq_mdo_upd_txsa, 1411 .mdo_del_txsa = aq_mdo_del_txsa, 1412 .mdo_get_dev_stats = aq_mdo_get_dev_stats, 1413 .mdo_get_tx_sc_stats = aq_mdo_get_tx_sc_stats, 1414 .mdo_get_tx_sa_stats = aq_mdo_get_tx_sa_stats, 1415 .mdo_get_rx_sc_stats = aq_mdo_get_rx_sc_stats, 1416 .mdo_get_rx_sa_stats = aq_mdo_get_rx_sa_stats, 1417 }; 1418 1419 int aq_macsec_init(struct aq_nic_s *nic) 1420 { 1421 struct aq_macsec_cfg *cfg; 1422 u32 caps_lo; 1423 1424 if (!nic->aq_fw_ops->get_link_capabilities) 1425 return 0; 1426 1427 caps_lo = nic->aq_fw_ops->get_link_capabilities(nic->aq_hw); 1428 1429 if (!(caps_lo & BIT(CAPS_LO_MACSEC))) 1430 return 0; 1431 1432 nic->macsec_cfg = kzalloc(sizeof(*cfg), GFP_KERNEL); 1433 if (!nic->macsec_cfg) 1434 return -ENOMEM; 1435 1436 nic->ndev->features |= NETIF_F_HW_MACSEC; 1437 nic->ndev->macsec_ops = &aq_macsec_ops; 1438 1439 return 0; 1440 } 1441 1442 void aq_macsec_free(struct aq_nic_s *nic) 1443 { 1444 kfree(nic->macsec_cfg); 1445 nic->macsec_cfg = NULL; 1446 } 1447 1448 int aq_macsec_enable(struct aq_nic_s *nic) 1449 { 1450 u32 ctl_ether_types[1] = { ETH_P_PAE }; 1451 struct macsec_msg_fw_response resp = { 0 }; 1452 struct macsec_msg_fw_request msg = { 0 }; 1453 struct aq_hw_s *hw = nic->aq_hw; 1454 int num_ctl_ether_types = 0; 1455 int index = 0, tbl_idx; 1456 int ret; 1457 1458 if (!nic->macsec_cfg) 1459 return 0; 1460 1461 rtnl_lock(); 1462 1463 if (nic->aq_fw_ops->send_macsec_req) { 1464 struct macsec_cfg_request cfg = { 0 }; 1465 1466 cfg.enabled = 1; 1467 cfg.egress_threshold = 0xffffffff; 1468 cfg.ingress_threshold = 0xffffffff; 1469 cfg.interrupts_enabled = 1; 1470 1471 msg.msg_type = macsec_cfg_msg; 1472 msg.cfg = cfg; 1473 1474 ret = nic->aq_fw_ops->send_macsec_req(hw, &msg, &resp); 1475 if (ret) 1476 goto unlock; 1477 } 1478 1479 /* Init Ethertype bypass filters */ 1480 for (index = 0; index < ARRAY_SIZE(ctl_ether_types); index++) { 1481 struct aq_mss_ingress_prectlf_record rx_prectlf_rec; 1482 struct aq_mss_egress_ctlf_record tx_ctlf_rec; 1483 1484 if (ctl_ether_types[index] == 0) 1485 continue; 1486 1487 memset(&tx_ctlf_rec, 0, sizeof(tx_ctlf_rec)); 1488 tx_ctlf_rec.eth_type = ctl_ether_types[index]; 1489 tx_ctlf_rec.match_type = 4; /* Match eth_type only */ 1490 tx_ctlf_rec.match_mask = 0xf; /* match for eth_type */ 1491 tx_ctlf_rec.action = 0; /* Bypass MACSEC modules */ 1492 tbl_idx = NUMROWS_EGRESSCTLFRECORD - num_ctl_ether_types - 1; 1493 aq_mss_set_egress_ctlf_record(hw, &tx_ctlf_rec, tbl_idx); 1494 1495 memset(&rx_prectlf_rec, 0, sizeof(rx_prectlf_rec)); 1496 rx_prectlf_rec.eth_type = ctl_ether_types[index]; 1497 rx_prectlf_rec.match_type = 4; /* Match eth_type only */ 1498 rx_prectlf_rec.match_mask = 0xf; /* match for eth_type */ 1499 rx_prectlf_rec.action = 0; /* Bypass MACSEC modules */ 1500 tbl_idx = 1501 NUMROWS_INGRESSPRECTLFRECORD - num_ctl_ether_types - 1; 1502 aq_mss_set_ingress_prectlf_record(hw, &rx_prectlf_rec, tbl_idx); 1503 1504 num_ctl_ether_types++; 1505 } 1506 1507 ret = aq_apply_macsec_cfg(nic); 1508 1509 unlock: 1510 rtnl_unlock(); 1511 return ret; 1512 } 1513 1514 void aq_macsec_work(struct aq_nic_s *nic) 1515 { 1516 if (!nic->macsec_cfg) 1517 return; 1518 1519 if (!netif_carrier_ok(nic->ndev)) 1520 return; 1521 1522 rtnl_lock(); 1523 aq_check_txsa_expiration(nic); 1524 rtnl_unlock(); 1525 } 1526 1527 int aq_macsec_rx_sa_cnt(struct aq_nic_s *nic) 1528 { 1529 struct aq_macsec_cfg *cfg = nic->macsec_cfg; 1530 int i, cnt = 0; 1531 1532 if (!cfg) 1533 return 0; 1534 1535 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) { 1536 if (!test_bit(i, &cfg->rxsc_idx_busy)) 1537 continue; 1538 cnt += hweight_long(cfg->aq_rxsc[i].rx_sa_idx_busy); 1539 } 1540 1541 return cnt; 1542 } 1543 1544 int aq_macsec_tx_sc_cnt(struct aq_nic_s *nic) 1545 { 1546 if (!nic->macsec_cfg) 1547 return 0; 1548 1549 return hweight_long(nic->macsec_cfg->txsc_idx_busy); 1550 } 1551 1552 int aq_macsec_tx_sa_cnt(struct aq_nic_s *nic) 1553 { 1554 struct aq_macsec_cfg *cfg = nic->macsec_cfg; 1555 int i, cnt = 0; 1556 1557 if (!cfg) 1558 return 0; 1559 1560 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) { 1561 if (!test_bit(i, &cfg->txsc_idx_busy)) 1562 continue; 1563 cnt += hweight_long(cfg->aq_txsc[i].tx_sa_idx_busy); 1564 } 1565 1566 return cnt; 1567 } 1568 1569 static int aq_macsec_update_stats(struct aq_nic_s *nic) 1570 { 1571 struct aq_macsec_cfg *cfg = nic->macsec_cfg; 1572 struct aq_hw_s *hw = nic->aq_hw; 1573 struct aq_macsec_txsc *aq_txsc; 1574 struct aq_macsec_rxsc *aq_rxsc; 1575 int i, sa_idx, assoc_num; 1576 int ret = 0; 1577 1578 aq_get_macsec_common_stats(hw, &cfg->stats); 1579 1580 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) { 1581 if (!(cfg->txsc_idx_busy & BIT(i))) 1582 continue; 1583 aq_txsc = &cfg->aq_txsc[i]; 1584 1585 ret = aq_get_txsc_stats(hw, aq_txsc->hw_sc_idx, 1586 &aq_txsc->stats); 1587 if (ret) 1588 return ret; 1589 1590 for (assoc_num = 0; assoc_num < MACSEC_NUM_AN; assoc_num++) { 1591 if (!test_bit(assoc_num, &aq_txsc->tx_sa_idx_busy)) 1592 continue; 1593 sa_idx = aq_txsc->hw_sc_idx | assoc_num; 1594 ret = aq_get_txsa_stats(hw, sa_idx, 1595 &aq_txsc->tx_sa_stats[assoc_num]); 1596 if (ret) 1597 return ret; 1598 } 1599 } 1600 1601 for (i = 0; i < AQ_MACSEC_MAX_SC; i++) { 1602 if (!(test_bit(i, &cfg->rxsc_idx_busy))) 1603 continue; 1604 aq_rxsc = &cfg->aq_rxsc[i]; 1605 1606 for (assoc_num = 0; assoc_num < MACSEC_NUM_AN; assoc_num++) { 1607 if (!test_bit(assoc_num, &aq_rxsc->rx_sa_idx_busy)) 1608 continue; 1609 sa_idx = aq_rxsc->hw_sc_idx | assoc_num; 1610 1611 ret = aq_get_rxsa_stats(hw, sa_idx, 1612 &aq_rxsc->rx_sa_stats[assoc_num]); 1613 if (ret) 1614 return ret; 1615 } 1616 } 1617 1618 return ret; 1619 } 1620 1621 u64 *aq_macsec_get_stats(struct aq_nic_s *nic, u64 *data) 1622 { 1623 struct aq_macsec_cfg *cfg = nic->macsec_cfg; 1624 struct aq_macsec_common_stats *common_stats; 1625 struct aq_macsec_tx_sc_stats *txsc_stats; 1626 struct aq_macsec_tx_sa_stats *txsa_stats; 1627 struct aq_macsec_rx_sa_stats *rxsa_stats; 1628 struct aq_macsec_txsc *aq_txsc; 1629 struct aq_macsec_rxsc *aq_rxsc; 1630 unsigned int assoc_num; 1631 unsigned int sc_num; 1632 unsigned int i = 0U; 1633 1634 if (!cfg) 1635 return data; 1636 1637 aq_macsec_update_stats(nic); 1638 1639 common_stats = &cfg->stats; 1640 data[i] = common_stats->in.ctl_pkts; 1641 data[++i] = common_stats->in.tagged_miss_pkts; 1642 data[++i] = common_stats->in.untagged_miss_pkts; 1643 data[++i] = common_stats->in.notag_pkts; 1644 data[++i] = common_stats->in.untagged_pkts; 1645 data[++i] = common_stats->in.bad_tag_pkts; 1646 data[++i] = common_stats->in.no_sci_pkts; 1647 data[++i] = common_stats->in.unknown_sci_pkts; 1648 data[++i] = common_stats->in.ctrl_prt_pass_pkts; 1649 data[++i] = common_stats->in.unctrl_prt_pass_pkts; 1650 data[++i] = common_stats->in.ctrl_prt_fail_pkts; 1651 data[++i] = common_stats->in.unctrl_prt_fail_pkts; 1652 data[++i] = common_stats->in.too_long_pkts; 1653 data[++i] = common_stats->in.igpoc_ctl_pkts; 1654 data[++i] = common_stats->in.ecc_error_pkts; 1655 data[++i] = common_stats->in.unctrl_hit_drop_redir; 1656 data[++i] = common_stats->out.ctl_pkts; 1657 data[++i] = common_stats->out.unknown_sa_pkts; 1658 data[++i] = common_stats->out.untagged_pkts; 1659 data[++i] = common_stats->out.too_long; 1660 data[++i] = common_stats->out.ecc_error_pkts; 1661 data[++i] = common_stats->out.unctrl_hit_drop_redir; 1662 1663 for (sc_num = 0; sc_num < AQ_MACSEC_MAX_SC; sc_num++) { 1664 if (!(test_bit(sc_num, &cfg->txsc_idx_busy))) 1665 continue; 1666 1667 aq_txsc = &cfg->aq_txsc[sc_num]; 1668 txsc_stats = &aq_txsc->stats; 1669 1670 data[++i] = txsc_stats->sc_protected_pkts; 1671 data[++i] = txsc_stats->sc_encrypted_pkts; 1672 data[++i] = txsc_stats->sc_protected_octets; 1673 data[++i] = txsc_stats->sc_encrypted_octets; 1674 1675 for (assoc_num = 0; assoc_num < MACSEC_NUM_AN; assoc_num++) { 1676 if (!test_bit(assoc_num, &aq_txsc->tx_sa_idx_busy)) 1677 continue; 1678 1679 txsa_stats = &aq_txsc->tx_sa_stats[assoc_num]; 1680 1681 data[++i] = txsa_stats->sa_hit_drop_redirect; 1682 data[++i] = txsa_stats->sa_protected2_pkts; 1683 data[++i] = txsa_stats->sa_protected_pkts; 1684 data[++i] = txsa_stats->sa_encrypted_pkts; 1685 } 1686 } 1687 1688 for (sc_num = 0; sc_num < AQ_MACSEC_MAX_SC; sc_num++) { 1689 if (!(test_bit(sc_num, &cfg->rxsc_idx_busy))) 1690 continue; 1691 1692 aq_rxsc = &cfg->aq_rxsc[sc_num]; 1693 1694 for (assoc_num = 0; assoc_num < MACSEC_NUM_AN; assoc_num++) { 1695 if (!test_bit(assoc_num, &aq_rxsc->rx_sa_idx_busy)) 1696 continue; 1697 1698 rxsa_stats = &aq_rxsc->rx_sa_stats[assoc_num]; 1699 1700 data[++i] = rxsa_stats->untagged_hit_pkts; 1701 data[++i] = rxsa_stats->ctrl_hit_drop_redir_pkts; 1702 data[++i] = rxsa_stats->not_using_sa; 1703 data[++i] = rxsa_stats->unused_sa; 1704 data[++i] = rxsa_stats->not_valid_pkts; 1705 data[++i] = rxsa_stats->invalid_pkts; 1706 data[++i] = rxsa_stats->ok_pkts; 1707 data[++i] = rxsa_stats->late_pkts; 1708 data[++i] = rxsa_stats->delayed_pkts; 1709 data[++i] = rxsa_stats->unchecked_pkts; 1710 data[++i] = rxsa_stats->validated_octets; 1711 data[++i] = rxsa_stats->decrypted_octets; 1712 } 1713 } 1714 1715 i++; 1716 1717 data += i; 1718 1719 return data; 1720 } 1721