aq_macsec.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/* Atlantic Network Driver
   3 * Copyright (C) 2020 Marvell International Ltd.
   4 */
   5
   6#include "aq_macsec.h"
   7#include "aq_nic.h"
   8#include <linux/rtnetlink.h>
   9
  10#include "macsec/macsec_api.h"
  11#define AQ_MACSEC_KEY_LEN_128_BIT 16
  12#define AQ_MACSEC_KEY_LEN_192_BIT 24
  13#define AQ_MACSEC_KEY_LEN_256_BIT 32
  14
  15enum aq_clear_type {
  16	/* update HW configuration */
  17	AQ_CLEAR_HW = BIT(0),
  18	/* update SW configuration (busy bits, pointers) */
  19	AQ_CLEAR_SW = BIT(1),
  20	/* update both HW and SW configuration */
  21	AQ_CLEAR_ALL = AQ_CLEAR_HW | AQ_CLEAR_SW,
  22};
  23
  24static int aq_clear_txsc(struct aq_nic_s *nic, const int txsc_idx,
  25			 enum aq_clear_type clear_type);
  26static int aq_clear_txsa(struct aq_nic_s *nic, struct aq_macsec_txsc *aq_txsc,
  27			 const int sa_num, enum aq_clear_type clear_type);
  28static int aq_clear_rxsc(struct aq_nic_s *nic, const int rxsc_idx,
  29			 enum aq_clear_type clear_type);
  30static int aq_clear_rxsa(struct aq_nic_s *nic, struct aq_macsec_rxsc *aq_rxsc,
  31			 const int sa_num, enum aq_clear_type clear_type);
  32static int aq_clear_secy(struct aq_nic_s *nic, const struct macsec_secy *secy,
  33			 enum aq_clear_type clear_type);
  34static int aq_apply_macsec_cfg(struct aq_nic_s *nic);
  35static int aq_apply_secy_cfg(struct aq_nic_s *nic,
  36			     const struct macsec_secy *secy);
  37
  38static void aq_ether_addr_to_mac(u32 mac[2], const unsigned char *emac)
  39{
  40	u32 tmp[2] = { 0 };
  41
  42	memcpy(((u8 *)tmp) + 2, emac, ETH_ALEN);
  43
  44	mac[0] = swab32(tmp[1]);
  45	mac[1] = swab32(tmp[0]);
  46}
  47
  48/* There's a 1:1 mapping between SecY and TX SC */
  49static int aq_get_txsc_idx_from_secy(struct aq_macsec_cfg *macsec_cfg,
  50				     const struct macsec_secy *secy)
  51{
  52	int i;
  53
  54	if (unlikely(!secy))
  55		return -1;
  56
  57	for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {
  58		if (macsec_cfg->aq_txsc[i].sw_secy == secy)
  59			return i;
  60	}
  61	return -1;
  62}
  63
  64static int aq_get_rxsc_idx_from_rxsc(struct aq_macsec_cfg *macsec_cfg,
  65				     const struct macsec_rx_sc *rxsc)
  66{
  67	int i;
  68
  69	if (unlikely(!rxsc))
  70		return -1;
  71
  72	for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {
  73		if (macsec_cfg->aq_rxsc[i].sw_rxsc == rxsc)
  74			return i;
  75	}
  76
  77	return -1;
  78}
  79
  80static int aq_get_txsc_idx_from_sc_idx(const enum aq_macsec_sc_sa sc_sa,
  81				       const int sc_idx)
  82{
  83	switch (sc_sa) {
  84	case aq_macsec_sa_sc_4sa_8sc:
  85		return sc_idx >> 2;
  86	case aq_macsec_sa_sc_2sa_16sc:
  87		return sc_idx >> 1;
  88	case aq_macsec_sa_sc_1sa_32sc:
  89		return sc_idx;
  90	default:
  91		WARN_ONCE(true, "Invalid sc_sa");
  92	}
  93	return -1;
  94}
  95
  96/* Rotate keys u32[8] */
  97static void aq_rotate_keys(u32 (*key)[8], const int key_len)
  98{
  99	u32 tmp[8] = { 0 };
 100
 101	memcpy(&tmp, key, sizeof(tmp));
 102	memset(*key, 0, sizeof(*key));
 103
 104	if (key_len == AQ_MACSEC_KEY_LEN_128_BIT) {
 105		(*key)[0] = swab32(tmp[3]);
 106		(*key)[1] = swab32(tmp[2]);
 107		(*key)[2] = swab32(tmp[1]);
 108		(*key)[3] = swab32(tmp[0]);
 109	} else if (key_len == AQ_MACSEC_KEY_LEN_192_BIT) {
 110		(*key)[0] = swab32(tmp[5]);
 111		(*key)[1] = swab32(tmp[4]);
 112		(*key)[2] = swab32(tmp[3]);
 113		(*key)[3] = swab32(tmp[2]);
 114		(*key)[4] = swab32(tmp[1]);
 115		(*key)[5] = swab32(tmp[0]);
 116	} else if (key_len == AQ_MACSEC_KEY_LEN_256_BIT) {
 117		(*key)[0] = swab32(tmp[7]);
 118		(*key)[1] = swab32(tmp[6]);
 119		(*key)[2] = swab32(tmp[5]);
 120		(*key)[3] = swab32(tmp[4]);
 121		(*key)[4] = swab32(tmp[3]);
 122		(*key)[5] = swab32(tmp[2]);
 123		(*key)[6] = swab32(tmp[1]);
 124		(*key)[7] = swab32(tmp[0]);
 125	} else {
 126		pr_warn("Rotate_keys: invalid key_len\n");
 127	}
 128}
 129
 130#define STATS_2x32_TO_64(stat_field)                                           \
 131	(((u64)stat_field[1] << 32) | stat_field[0])
 132
 133static int aq_get_macsec_common_stats(struct aq_hw_s *hw,
 134				      struct aq_macsec_common_stats *stats)
 135{
 136	struct aq_mss_ingress_common_counters ingress_counters;
 137	struct aq_mss_egress_common_counters egress_counters;
 138	int ret;
 139
 140	/* MACSEC counters */
 141	ret = aq_mss_get_ingress_common_counters(hw, &ingress_counters);
 142	if (unlikely(ret))
 143		return ret;
 144
 145	stats->in.ctl_pkts = STATS_2x32_TO_64(ingress_counters.ctl_pkts);
 146	stats->in.tagged_miss_pkts =
 147		STATS_2x32_TO_64(ingress_counters.tagged_miss_pkts);
 148	stats->in.untagged_miss_pkts =
 149		STATS_2x32_TO_64(ingress_counters.untagged_miss_pkts);
 150	stats->in.notag_pkts = STATS_2x32_TO_64(ingress_counters.notag_pkts);
 151	stats->in.untagged_pkts =
 152		STATS_2x32_TO_64(ingress_counters.untagged_pkts);
 153	stats->in.bad_tag_pkts =
 154		STATS_2x32_TO_64(ingress_counters.bad_tag_pkts);
 155	stats->in.no_sci_pkts = STATS_2x32_TO_64(ingress_counters.no_sci_pkts);
 156	stats->in.unknown_sci_pkts =
 157		STATS_2x32_TO_64(ingress_counters.unknown_sci_pkts);
 158	stats->in.ctrl_prt_pass_pkts =
 159		STATS_2x32_TO_64(ingress_counters.ctrl_prt_pass_pkts);
 160	stats->in.unctrl_prt_pass_pkts =
 161		STATS_2x32_TO_64(ingress_counters.unctrl_prt_pass_pkts);
 162	stats->in.ctrl_prt_fail_pkts =
 163		STATS_2x32_TO_64(ingress_counters.ctrl_prt_fail_pkts);
 164	stats->in.unctrl_prt_fail_pkts =
 165		STATS_2x32_TO_64(ingress_counters.unctrl_prt_fail_pkts);
 166	stats->in.too_long_pkts =
 167		STATS_2x32_TO_64(ingress_counters.too_long_pkts);
 168	stats->in.igpoc_ctl_pkts =
 169		STATS_2x32_TO_64(ingress_counters.igpoc_ctl_pkts);
 170	stats->in.ecc_error_pkts =
 171		STATS_2x32_TO_64(ingress_counters.ecc_error_pkts);
 172	stats->in.unctrl_hit_drop_redir =
 173		STATS_2x32_TO_64(ingress_counters.unctrl_hit_drop_redir);
 174
 175	ret = aq_mss_get_egress_common_counters(hw, &egress_counters);
 176	if (unlikely(ret))
 177		return ret;
 178	stats->out.ctl_pkts = STATS_2x32_TO_64(egress_counters.ctl_pkt);
 179	stats->out.unknown_sa_pkts =
 180		STATS_2x32_TO_64(egress_counters.unknown_sa_pkts);
 181	stats->out.untagged_pkts =
 182		STATS_2x32_TO_64(egress_counters.untagged_pkts);
 183	stats->out.too_long = STATS_2x32_TO_64(egress_counters.too_long);
 184	stats->out.ecc_error_pkts =
 185		STATS_2x32_TO_64(egress_counters.ecc_error_pkts);
 186	stats->out.unctrl_hit_drop_redir =
 187		STATS_2x32_TO_64(egress_counters.unctrl_hit_drop_redir);
 188
 189	return 0;
 190}
 191
 192static int aq_get_rxsa_stats(struct aq_hw_s *hw, const int sa_idx,
 193			     struct aq_macsec_rx_sa_stats *stats)
 194{
 195	struct aq_mss_ingress_sa_counters i_sa_counters;
 196	int ret;
 197
 198	ret = aq_mss_get_ingress_sa_counters(hw, &i_sa_counters, sa_idx);
 199	if (unlikely(ret))
 200		return ret;
 201
 202	stats->untagged_hit_pkts =
 203		STATS_2x32_TO_64(i_sa_counters.untagged_hit_pkts);
 204	stats->ctrl_hit_drop_redir_pkts =
 205		STATS_2x32_TO_64(i_sa_counters.ctrl_hit_drop_redir_pkts);
 206	stats->not_using_sa = STATS_2x32_TO_64(i_sa_counters.not_using_sa);
 207	stats->unused_sa = STATS_2x32_TO_64(i_sa_counters.unused_sa);
 208	stats->not_valid_pkts = STATS_2x32_TO_64(i_sa_counters.not_valid_pkts);
 209	stats->invalid_pkts = STATS_2x32_TO_64(i_sa_counters.invalid_pkts);
 210	stats->ok_pkts = STATS_2x32_TO_64(i_sa_counters.ok_pkts);
 211	stats->late_pkts = STATS_2x32_TO_64(i_sa_counters.late_pkts);
 212	stats->delayed_pkts = STATS_2x32_TO_64(i_sa_counters.delayed_pkts);
 213	stats->unchecked_pkts = STATS_2x32_TO_64(i_sa_counters.unchecked_pkts);
 214	stats->validated_octets =
 215		STATS_2x32_TO_64(i_sa_counters.validated_octets);
 216	stats->decrypted_octets =
 217		STATS_2x32_TO_64(i_sa_counters.decrypted_octets);
 218
 219	return 0;
 220}
 221
 222static int aq_get_txsa_stats(struct aq_hw_s *hw, const int sa_idx,
 223			     struct aq_macsec_tx_sa_stats *stats)
 224{
 225	struct aq_mss_egress_sa_counters e_sa_counters;
 226	int ret;
 227
 228	ret = aq_mss_get_egress_sa_counters(hw, &e_sa_counters, sa_idx);
 229	if (unlikely(ret))
 230		return ret;
 231
 232	stats->sa_hit_drop_redirect =
 233		STATS_2x32_TO_64(e_sa_counters.sa_hit_drop_redirect);
 234	stats->sa_protected2_pkts =
 235		STATS_2x32_TO_64(e_sa_counters.sa_protected2_pkts);
 236	stats->sa_protected_pkts =
 237		STATS_2x32_TO_64(e_sa_counters.sa_protected_pkts);
 238	stats->sa_encrypted_pkts =
 239		STATS_2x32_TO_64(e_sa_counters.sa_encrypted_pkts);
 240
 241	return 0;
 242}
 243
 244static int aq_get_txsa_next_pn(struct aq_hw_s *hw, const int sa_idx, u32 *pn)
 245{
 246	struct aq_mss_egress_sa_record sa_rec;
 247	int ret;
 248
 249	ret = aq_mss_get_egress_sa_record(hw, &sa_rec, sa_idx);
 250	if (likely(!ret))
 251		*pn = sa_rec.next_pn;
 252
 253	return ret;
 254}
 255
 256static int aq_get_rxsa_next_pn(struct aq_hw_s *hw, const int sa_idx, u32 *pn)
 257{
 258	struct aq_mss_ingress_sa_record sa_rec;
 259	int ret;
 260
 261	ret = aq_mss_get_ingress_sa_record(hw, &sa_rec, sa_idx);
 262	if (likely(!ret))
 263		*pn = (!sa_rec.sat_nextpn) ? sa_rec.next_pn : 0;
 264
 265	return ret;
 266}
 267
 268static int aq_get_txsc_stats(struct aq_hw_s *hw, const int sc_idx,
 269			     struct aq_macsec_tx_sc_stats *stats)
 270{
 271	struct aq_mss_egress_sc_counters e_sc_counters;
 272	int ret;
 273
 274	ret = aq_mss_get_egress_sc_counters(hw, &e_sc_counters, sc_idx);
 275	if (unlikely(ret))
 276		return ret;
 277
 278	stats->sc_protected_pkts =
 279		STATS_2x32_TO_64(e_sc_counters.sc_protected_pkts);
 280	stats->sc_encrypted_pkts =
 281		STATS_2x32_TO_64(e_sc_counters.sc_encrypted_pkts);
 282	stats->sc_protected_octets =
 283		STATS_2x32_TO_64(e_sc_counters.sc_protected_octets);
 284	stats->sc_encrypted_octets =
 285		STATS_2x32_TO_64(e_sc_counters.sc_encrypted_octets);
 286
 287	return 0;
 288}
 289
 290static int aq_mdo_dev_open(struct macsec_context *ctx)
 291{
 292	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
 293	int ret = 0;
 294
 295	if (netif_carrier_ok(nic->ndev))
 296		ret = aq_apply_secy_cfg(nic, ctx->secy);
 297
 298	return ret;
 299}
 300
 301static int aq_mdo_dev_stop(struct macsec_context *ctx)
 302{
 303	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
 304	int i;
 305
 306	for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {
 307		if (nic->macsec_cfg->txsc_idx_busy & BIT(i))
 308			aq_clear_secy(nic, nic->macsec_cfg->aq_txsc[i].sw_secy,
 309				      AQ_CLEAR_HW);
 310	}
 311
 312	return 0;
 313}
 314
 315static int aq_set_txsc(struct aq_nic_s *nic, const int txsc_idx)
 316{
 317	struct aq_macsec_txsc *aq_txsc = &nic->macsec_cfg->aq_txsc[txsc_idx];
 318	struct aq_mss_egress_class_record tx_class_rec = { 0 };
 319	const struct macsec_secy *secy = aq_txsc->sw_secy;
 320	struct aq_mss_egress_sc_record sc_rec = { 0 };
 321	unsigned int sc_idx = aq_txsc->hw_sc_idx;
 322	struct aq_hw_s *hw = nic->aq_hw;
 323	int ret = 0;
 324
 325	aq_ether_addr_to_mac(tx_class_rec.mac_sa, secy->netdev->dev_addr);
 326
 327	put_unaligned_be64((__force u64)secy->sci, tx_class_rec.sci);
 328	tx_class_rec.sci_mask = 0;
 329
 330	tx_class_rec.sa_mask = 0x3f;
 331
 332	tx_class_rec.action = 0; /* forward to SA/SC table */
 333	tx_class_rec.valid = 1;
 334
 335	tx_class_rec.sc_idx = sc_idx;
 336
 337	tx_class_rec.sc_sa = nic->macsec_cfg->sc_sa;
 338
 339	ret = aq_mss_set_egress_class_record(hw, &tx_class_rec, txsc_idx);
 340	if (ret)
 341		return ret;
 342
 343	sc_rec.protect = secy->protect_frames;
 344	if (secy->tx_sc.encrypt)
 345		sc_rec.tci |= BIT(1);
 346	if (secy->tx_sc.scb)
 347		sc_rec.tci |= BIT(2);
 348	if (secy->tx_sc.send_sci)
 349		sc_rec.tci |= BIT(3);
 350	if (secy->tx_sc.end_station)
 351		sc_rec.tci |= BIT(4);
 352	/* The C bit is clear if and only if the Secure Data is
 353	 * exactly the same as the User Data and the ICV is 16 octets long.
 354	 */
 355	if (!(secy->icv_len == 16 && !secy->tx_sc.encrypt))
 356		sc_rec.tci |= BIT(0);
 357
 358	sc_rec.an_roll = 0;
 359
 360	switch (secy->key_len) {
 361	case AQ_MACSEC_KEY_LEN_128_BIT:
 362		sc_rec.sak_len = 0;
 363		break;
 364	case AQ_MACSEC_KEY_LEN_192_BIT:
 365		sc_rec.sak_len = 1;
 366		break;
 367	case AQ_MACSEC_KEY_LEN_256_BIT:
 368		sc_rec.sak_len = 2;
 369		break;
 370	default:
 371		WARN_ONCE(true, "Invalid sc_sa");
 372		return -EINVAL;
 373	}
 374
 375	sc_rec.curr_an = secy->tx_sc.encoding_sa;
 376	sc_rec.valid = 1;
 377	sc_rec.fresh = 1;
 378
 379	return aq_mss_set_egress_sc_record(hw, &sc_rec, sc_idx);
 380}
 381
 382static u32 aq_sc_idx_max(const enum aq_macsec_sc_sa sc_sa)
 383{
 384	u32 result = 0;
 385
 386	switch (sc_sa) {
 387	case aq_macsec_sa_sc_4sa_8sc:
 388		result = 8;
 389		break;
 390	case aq_macsec_sa_sc_2sa_16sc:
 391		result = 16;
 392		break;
 393	case aq_macsec_sa_sc_1sa_32sc:
 394		result = 32;
 395		break;
 396	default:
 397		break;
 398	}
 399
 400	return result;
 401}
 402
 403static u32 aq_to_hw_sc_idx(const u32 sc_idx, const enum aq_macsec_sc_sa sc_sa)
 404{
 405	switch (sc_sa) {
 406	case aq_macsec_sa_sc_4sa_8sc:
 407		return sc_idx << 2;
 408	case aq_macsec_sa_sc_2sa_16sc:
 409		return sc_idx << 1;
 410	case aq_macsec_sa_sc_1sa_32sc:
 411		return sc_idx;
 412	default:
 413		WARN_ONCE(true, "Invalid sc_sa");
 414	}
 415
 416	return sc_idx;
 417}
 418
 419static enum aq_macsec_sc_sa sc_sa_from_num_an(const int num_an)
 420{
 421	enum aq_macsec_sc_sa sc_sa = aq_macsec_sa_sc_not_used;
 422
 423	switch (num_an) {
 424	case 4:
 425		sc_sa = aq_macsec_sa_sc_4sa_8sc;
 426		break;
 427	case 2:
 428		sc_sa = aq_macsec_sa_sc_2sa_16sc;
 429		break;
 430	case 1:
 431		sc_sa = aq_macsec_sa_sc_1sa_32sc;
 432		break;
 433	default:
 434		break;
 435	}
 436
 437	return sc_sa;
 438}
 439
 440static int aq_mdo_add_secy(struct macsec_context *ctx)
 441{
 442	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
 443	struct aq_macsec_cfg *cfg = nic->macsec_cfg;
 444	const struct macsec_secy *secy = ctx->secy;
 445	enum aq_macsec_sc_sa sc_sa;
 446	u32 txsc_idx;
 447	int ret = 0;
 448
 449	if (secy->xpn)
 450		return -EOPNOTSUPP;
 451
 452	sc_sa = sc_sa_from_num_an(MACSEC_NUM_AN);
 453	if (sc_sa == aq_macsec_sa_sc_not_used)
 454		return -EINVAL;
 455
 456	if (hweight32(cfg->txsc_idx_busy) >= aq_sc_idx_max(sc_sa))
 457		return -ENOSPC;
 458
 459	txsc_idx = ffz(cfg->txsc_idx_busy);
 460	if (txsc_idx == AQ_MACSEC_MAX_SC)
 461		return -ENOSPC;
 462
 463	cfg->sc_sa = sc_sa;
 464	cfg->aq_txsc[txsc_idx].hw_sc_idx = aq_to_hw_sc_idx(txsc_idx, sc_sa);
 465	cfg->aq_txsc[txsc_idx].sw_secy = secy;
 466
 467	if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev))
 468		ret = aq_set_txsc(nic, txsc_idx);
 469
 470	set_bit(txsc_idx, &cfg->txsc_idx_busy);
 471
 472	return ret;
 473}
 474
 475static int aq_mdo_upd_secy(struct macsec_context *ctx)
 476{
 477	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
 478	const struct macsec_secy *secy = ctx->secy;
 479	int txsc_idx;
 480	int ret = 0;
 481
 482	txsc_idx = aq_get_txsc_idx_from_secy(nic->macsec_cfg, secy);
 483	if (txsc_idx < 0)
 484		return -ENOENT;
 485
 486	if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev))
 487		ret = aq_set_txsc(nic, txsc_idx);
 488
 489	return ret;
 490}
 491
 492static int aq_clear_txsc(struct aq_nic_s *nic, const int txsc_idx,
 493			 enum aq_clear_type clear_type)
 494{
 495	struct aq_macsec_txsc *tx_sc = &nic->macsec_cfg->aq_txsc[txsc_idx];
 496	struct aq_mss_egress_class_record tx_class_rec = { 0 };
 497	struct aq_mss_egress_sc_record sc_rec = { 0 };
 498	struct aq_hw_s *hw = nic->aq_hw;
 499	int ret = 0;
 500	int sa_num;
 501
 502	for_each_set_bit (sa_num, &tx_sc->tx_sa_idx_busy, AQ_MACSEC_MAX_SA) {
 503		ret = aq_clear_txsa(nic, tx_sc, sa_num, clear_type);
 504		if (ret)
 505			return ret;
 506	}
 507
 508	if (clear_type & AQ_CLEAR_HW) {
 509		ret = aq_mss_set_egress_class_record(hw, &tx_class_rec,
 510						     txsc_idx);
 511		if (ret)
 512			return ret;
 513
 514		sc_rec.fresh = 1;
 515		ret = aq_mss_set_egress_sc_record(hw, &sc_rec,
 516						  tx_sc->hw_sc_idx);
 517		if (ret)
 518			return ret;
 519	}
 520
 521	if (clear_type & AQ_CLEAR_SW) {
 522		clear_bit(txsc_idx, &nic->macsec_cfg->txsc_idx_busy);
 523		nic->macsec_cfg->aq_txsc[txsc_idx].sw_secy = NULL;
 524	}
 525
 526	return ret;
 527}
 528
 529static int aq_mdo_del_secy(struct macsec_context *ctx)
 530{
 531	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
 532	int ret = 0;
 533
 534	if (!nic->macsec_cfg)
 535		return 0;
 536
 537	ret = aq_clear_secy(nic, ctx->secy, AQ_CLEAR_ALL);
 538
 539	return ret;
 540}
 541
 542static int aq_update_txsa(struct aq_nic_s *nic, const unsigned int sc_idx,
 543			  const struct macsec_secy *secy,
 544			  const struct macsec_tx_sa *tx_sa,
 545			  const unsigned char *key, const unsigned char an)
 546{
 547	const u32 next_pn = tx_sa->next_pn_halves.lower;
 548	struct aq_mss_egress_sakey_record key_rec;
 549	const unsigned int sa_idx = sc_idx | an;
 550	struct aq_mss_egress_sa_record sa_rec;
 551	struct aq_hw_s *hw = nic->aq_hw;
 552	int ret = 0;
 553
 554	memset(&sa_rec, 0, sizeof(sa_rec));
 555	sa_rec.valid = tx_sa->active;
 556	sa_rec.fresh = 1;
 557	sa_rec.next_pn = next_pn;
 558
 559	ret = aq_mss_set_egress_sa_record(hw, &sa_rec, sa_idx);
 560	if (ret)
 561		return ret;
 562
 563	if (!key)
 564		return ret;
 565
 566	memset(&key_rec, 0, sizeof(key_rec));
 567	memcpy(&key_rec.key, key, secy->key_len);
 568
 569	aq_rotate_keys(&key_rec.key, secy->key_len);
 570
 571	ret = aq_mss_set_egress_sakey_record(hw, &key_rec, sa_idx);
 572
 573	memzero_explicit(&key_rec, sizeof(key_rec));
 574	return ret;
 575}
 576
 577static int aq_mdo_add_txsa(struct macsec_context *ctx)
 578{
 579	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
 580	struct aq_macsec_cfg *cfg = nic->macsec_cfg;
 581	const struct macsec_secy *secy = ctx->secy;
 582	struct aq_macsec_txsc *aq_txsc;
 583	int txsc_idx;
 584	int ret = 0;
 585
 586	txsc_idx = aq_get_txsc_idx_from_secy(cfg, secy);
 587	if (txsc_idx < 0)
 588		return -EINVAL;
 589
 590	aq_txsc = &cfg->aq_txsc[txsc_idx];
 591	set_bit(ctx->sa.assoc_num, &aq_txsc->tx_sa_idx_busy);
 592
 593	memcpy(aq_txsc->tx_sa_key[ctx->sa.assoc_num], ctx->sa.key,
 594	       secy->key_len);
 595
 596	if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev))
 597		ret = aq_update_txsa(nic, aq_txsc->hw_sc_idx, secy,
 598				     ctx->sa.tx_sa, ctx->sa.key,
 599				     ctx->sa.assoc_num);
 600
 601	return ret;
 602}
 603
 604static int aq_mdo_upd_txsa(struct macsec_context *ctx)
 605{
 606	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
 607	struct aq_macsec_cfg *cfg = nic->macsec_cfg;
 608	const struct macsec_secy *secy = ctx->secy;
 609	struct aq_macsec_txsc *aq_txsc;
 610	int txsc_idx;
 611	int ret = 0;
 612
 613	txsc_idx = aq_get_txsc_idx_from_secy(cfg, secy);
 614	if (txsc_idx < 0)
 615		return -EINVAL;
 616
 617	aq_txsc = &cfg->aq_txsc[txsc_idx];
 618	if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev))
 619		ret = aq_update_txsa(nic, aq_txsc->hw_sc_idx, secy,
 620				     ctx->sa.tx_sa, NULL, ctx->sa.assoc_num);
 621
 622	return ret;
 623}
 624
 625static int aq_clear_txsa(struct aq_nic_s *nic, struct aq_macsec_txsc *aq_txsc,
 626			 const int sa_num, enum aq_clear_type clear_type)
 627{
 628	const int sa_idx = aq_txsc->hw_sc_idx | sa_num;
 629	struct aq_hw_s *hw = nic->aq_hw;
 630	int ret = 0;
 631
 632	if (clear_type & AQ_CLEAR_SW)
 633		clear_bit(sa_num, &aq_txsc->tx_sa_idx_busy);
 634
 635	if ((clear_type & AQ_CLEAR_HW) && netif_carrier_ok(nic->ndev)) {
 636		struct aq_mss_egress_sakey_record key_rec;
 637		struct aq_mss_egress_sa_record sa_rec;
 638
 639		memset(&sa_rec, 0, sizeof(sa_rec));
 640		sa_rec.fresh = 1;
 641
 642		ret = aq_mss_set_egress_sa_record(hw, &sa_rec, sa_idx);
 643		if (ret)
 644			return ret;
 645
 646		memset(&key_rec, 0, sizeof(key_rec));
 647		return aq_mss_set_egress_sakey_record(hw, &key_rec, sa_idx);
 648	}
 649
 650	return 0;
 651}
 652
 653static int aq_mdo_del_txsa(struct macsec_context *ctx)
 654{
 655	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
 656	struct aq_macsec_cfg *cfg = nic->macsec_cfg;
 657	int txsc_idx;
 658	int ret = 0;
 659
 660	txsc_idx = aq_get_txsc_idx_from_secy(cfg, ctx->secy);
 661	if (txsc_idx < 0)
 662		return -EINVAL;
 663
 664	ret = aq_clear_txsa(nic, &cfg->aq_txsc[txsc_idx], ctx->sa.assoc_num,
 665			    AQ_CLEAR_ALL);
 666
 667	return ret;
 668}
 669
 670static int aq_rxsc_validate_frames(const enum macsec_validation_type validate)
 671{
 672	switch (validate) {
 673	case MACSEC_VALIDATE_DISABLED:
 674		return 2;
 675	case MACSEC_VALIDATE_CHECK:
 676		return 1;
 677	case MACSEC_VALIDATE_STRICT:
 678		return 0;
 679	default:
 680		WARN_ONCE(true, "Invalid validation type");
 681	}
 682
 683	return 0;
 684}
 685
 686static int aq_set_rxsc(struct aq_nic_s *nic, const u32 rxsc_idx)
 687{
 688	const struct aq_macsec_rxsc *aq_rxsc =
 689		&nic->macsec_cfg->aq_rxsc[rxsc_idx];
 690	struct aq_mss_ingress_preclass_record pre_class_record;
 691	const struct macsec_rx_sc *rx_sc = aq_rxsc->sw_rxsc;
 692	const struct macsec_secy *secy = aq_rxsc->sw_secy;
 693	const u32 hw_sc_idx = aq_rxsc->hw_sc_idx;
 694	struct aq_mss_ingress_sc_record sc_record;
 695	struct aq_hw_s *hw = nic->aq_hw;
 696	int ret = 0;
 697
 698	memset(&pre_class_record, 0, sizeof(pre_class_record));
 699	put_unaligned_be64((__force u64)rx_sc->sci, pre_class_record.sci);
 700	pre_class_record.sci_mask = 0xff;
 701	/* match all MACSEC ethertype packets */
 702	pre_class_record.eth_type = ETH_P_MACSEC;
 703	pre_class_record.eth_type_mask = 0x3;
 704
 705	aq_ether_addr_to_mac(pre_class_record.mac_sa, (char *)&rx_sc->sci);
 706	pre_class_record.sa_mask = 0x3f;
 707
 708	pre_class_record.an_mask = nic->macsec_cfg->sc_sa;
 709	pre_class_record.sc_idx = hw_sc_idx;
 710	/* strip SecTAG & forward for decryption */
 711	pre_class_record.action = 0x0;
 712	pre_class_record.valid = 1;
 713
 714	ret = aq_mss_set_ingress_preclass_record(hw, &pre_class_record,
 715						 2 * rxsc_idx + 1);
 716	if (ret)
 717		return ret;
 718
 719	/* If SCI is absent, then match by SA alone */
 720	pre_class_record.sci_mask = 0;
 721	pre_class_record.sci_from_table = 1;
 722
 723	ret = aq_mss_set_ingress_preclass_record(hw, &pre_class_record,
 724						 2 * rxsc_idx);
 725	if (ret)
 726		return ret;
 727
 728	memset(&sc_record, 0, sizeof(sc_record));
 729	sc_record.validate_frames =
 730		aq_rxsc_validate_frames(secy->validate_frames);
 731	if (secy->replay_protect) {
 732		sc_record.replay_protect = 1;
 733		sc_record.anti_replay_window = secy->replay_window;
 734	}
 735	sc_record.valid = 1;
 736	sc_record.fresh = 1;
 737
 738	ret = aq_mss_set_ingress_sc_record(hw, &sc_record, hw_sc_idx);
 739	if (ret)
 740		return ret;
 741
 742	return ret;
 743}
 744
 745static int aq_mdo_add_rxsc(struct macsec_context *ctx)
 746{
 747	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
 748	struct aq_macsec_cfg *cfg = nic->macsec_cfg;
 749	const u32 rxsc_idx_max = aq_sc_idx_max(cfg->sc_sa);
 750	u32 rxsc_idx;
 751	int ret = 0;
 752
 753	if (hweight32(cfg->rxsc_idx_busy) >= rxsc_idx_max)
 754		return -ENOSPC;
 755
 756	rxsc_idx = ffz(cfg->rxsc_idx_busy);
 757	if (rxsc_idx >= rxsc_idx_max)
 758		return -ENOSPC;
 759
 760	cfg->aq_rxsc[rxsc_idx].hw_sc_idx = aq_to_hw_sc_idx(rxsc_idx,
 761							   cfg->sc_sa);
 762	cfg->aq_rxsc[rxsc_idx].sw_secy = ctx->secy;
 763	cfg->aq_rxsc[rxsc_idx].sw_rxsc = ctx->rx_sc;
 764
 765	if (netif_carrier_ok(nic->ndev) && netif_running(ctx->secy->netdev))
 766		ret = aq_set_rxsc(nic, rxsc_idx);
 767
 768	if (ret < 0)
 769		return ret;
 770
 771	set_bit(rxsc_idx, &cfg->rxsc_idx_busy);
 772
 773	return 0;
 774}
 775
 776static int aq_mdo_upd_rxsc(struct macsec_context *ctx)
 777{
 778	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
 779	int rxsc_idx;
 780	int ret = 0;
 781
 782	rxsc_idx = aq_get_rxsc_idx_from_rxsc(nic->macsec_cfg, ctx->rx_sc);
 783	if (rxsc_idx < 0)
 784		return -ENOENT;
 785
 786	if (netif_carrier_ok(nic->ndev) && netif_running(ctx->secy->netdev))
 787		ret = aq_set_rxsc(nic, rxsc_idx);
 788
 789	return ret;
 790}
 791
 792static int aq_clear_rxsc(struct aq_nic_s *nic, const int rxsc_idx,
 793			 enum aq_clear_type clear_type)
 794{
 795	struct aq_macsec_rxsc *rx_sc = &nic->macsec_cfg->aq_rxsc[rxsc_idx];
 796	struct aq_hw_s *hw = nic->aq_hw;
 797	int ret = 0;
 798	int sa_num;
 799
 800	for_each_set_bit (sa_num, &rx_sc->rx_sa_idx_busy, AQ_MACSEC_MAX_SA) {
 801		ret = aq_clear_rxsa(nic, rx_sc, sa_num, clear_type);
 802		if (ret)
 803			return ret;
 804	}
 805
 806	if (clear_type & AQ_CLEAR_HW) {
 807		struct aq_mss_ingress_preclass_record pre_class_record;
 808		struct aq_mss_ingress_sc_record sc_record;
 809
 810		memset(&pre_class_record, 0, sizeof(pre_class_record));
 811		memset(&sc_record, 0, sizeof(sc_record));
 812
 813		ret = aq_mss_set_ingress_preclass_record(hw, &pre_class_record,
 814							 2 * rxsc_idx);
 815		if (ret)
 816			return ret;
 817
 818		ret = aq_mss_set_ingress_preclass_record(hw, &pre_class_record,
 819							 2 * rxsc_idx + 1);
 820		if (ret)
 821			return ret;
 822
 823		sc_record.fresh = 1;
 824		ret = aq_mss_set_ingress_sc_record(hw, &sc_record,
 825						   rx_sc->hw_sc_idx);
 826		if (ret)
 827			return ret;
 828	}
 829
 830	if (clear_type & AQ_CLEAR_SW) {
 831		clear_bit(rxsc_idx, &nic->macsec_cfg->rxsc_idx_busy);
 832		rx_sc->sw_secy = NULL;
 833		rx_sc->sw_rxsc = NULL;
 834	}
 835
 836	return ret;
 837}
 838
 839static int aq_mdo_del_rxsc(struct macsec_context *ctx)
 840{
 841	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
 842	enum aq_clear_type clear_type = AQ_CLEAR_SW;
 843	int rxsc_idx;
 844	int ret = 0;
 845
 846	rxsc_idx = aq_get_rxsc_idx_from_rxsc(nic->macsec_cfg, ctx->rx_sc);
 847	if (rxsc_idx < 0)
 848		return -ENOENT;
 849
 850	if (netif_carrier_ok(nic->ndev))
 851		clear_type = AQ_CLEAR_ALL;
 852
 853	ret = aq_clear_rxsc(nic, rxsc_idx, clear_type);
 854
 855	return ret;
 856}
 857
 858static int aq_update_rxsa(struct aq_nic_s *nic, const unsigned int sc_idx,
 859			  const struct macsec_secy *secy,
 860			  const struct macsec_rx_sa *rx_sa,
 861			  const unsigned char *key, const unsigned char an)
 862{
 863	struct aq_mss_ingress_sakey_record sa_key_record;
 864	const u32 next_pn = rx_sa->next_pn_halves.lower;
 865	struct aq_mss_ingress_sa_record sa_record;
 866	struct aq_hw_s *hw = nic->aq_hw;
 867	const int sa_idx = sc_idx | an;
 868	int ret = 0;
 869
 870	memset(&sa_record, 0, sizeof(sa_record));
 871	sa_record.valid = rx_sa->active;
 872	sa_record.fresh = 1;
 873	sa_record.next_pn = next_pn;
 874
 875	ret = aq_mss_set_ingress_sa_record(hw, &sa_record, sa_idx);
 876	if (ret)
 877		return ret;
 878
 879	if (!key)
 880		return ret;
 881
 882	memset(&sa_key_record, 0, sizeof(sa_key_record));
 883	memcpy(&sa_key_record.key, key, secy->key_len);
 884
 885	switch (secy->key_len) {
 886	case AQ_MACSEC_KEY_LEN_128_BIT:
 887		sa_key_record.key_len = 0;
 888		break;
 889	case AQ_MACSEC_KEY_LEN_192_BIT:
 890		sa_key_record.key_len = 1;
 891		break;
 892	case AQ_MACSEC_KEY_LEN_256_BIT:
 893		sa_key_record.key_len = 2;
 894		break;
 895	default:
 896		return -1;
 897	}
 898
 899	aq_rotate_keys(&sa_key_record.key, secy->key_len);
 900
 901	ret = aq_mss_set_ingress_sakey_record(hw, &sa_key_record, sa_idx);
 902
 903	memzero_explicit(&sa_key_record, sizeof(sa_key_record));
 904	return ret;
 905}
 906
 907static int aq_mdo_add_rxsa(struct macsec_context *ctx)
 908{
 909	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
 910	const struct macsec_rx_sc *rx_sc = ctx->sa.rx_sa->sc;
 911	const struct macsec_secy *secy = ctx->secy;
 912	struct aq_macsec_rxsc *aq_rxsc;
 913	int rxsc_idx;
 914	int ret = 0;
 915
 916	rxsc_idx = aq_get_rxsc_idx_from_rxsc(nic->macsec_cfg, rx_sc);
 917	if (rxsc_idx < 0)
 918		return -EINVAL;
 919
 920	aq_rxsc = &nic->macsec_cfg->aq_rxsc[rxsc_idx];
 921	set_bit(ctx->sa.assoc_num, &aq_rxsc->rx_sa_idx_busy);
 922
 923	memcpy(aq_rxsc->rx_sa_key[ctx->sa.assoc_num], ctx->sa.key,
 924	       secy->key_len);
 925
 926	if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev))
 927		ret = aq_update_rxsa(nic, aq_rxsc->hw_sc_idx, secy,
 928				     ctx->sa.rx_sa, ctx->sa.key,
 929				     ctx->sa.assoc_num);
 930
 931	return ret;
 932}
 933
 934static int aq_mdo_upd_rxsa(struct macsec_context *ctx)
 935{
 936	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
 937	const struct macsec_rx_sc *rx_sc = ctx->sa.rx_sa->sc;
 938	struct aq_macsec_cfg *cfg = nic->macsec_cfg;
 939	const struct macsec_secy *secy = ctx->secy;
 940	int rxsc_idx;
 941	int ret = 0;
 942
 943	rxsc_idx = aq_get_rxsc_idx_from_rxsc(cfg, rx_sc);
 944	if (rxsc_idx < 0)
 945		return -EINVAL;
 946
 947	if (netif_carrier_ok(nic->ndev) && netif_running(secy->netdev))
 948		ret = aq_update_rxsa(nic, cfg->aq_rxsc[rxsc_idx].hw_sc_idx,
 949				     secy, ctx->sa.rx_sa, NULL,
 950				     ctx->sa.assoc_num);
 951
 952	return ret;
 953}
 954
 955static int aq_clear_rxsa(struct aq_nic_s *nic, struct aq_macsec_rxsc *aq_rxsc,
 956			 const int sa_num, enum aq_clear_type clear_type)
 957{
 958	int sa_idx = aq_rxsc->hw_sc_idx | sa_num;
 959	struct aq_hw_s *hw = nic->aq_hw;
 960	int ret = 0;
 961
 962	if (clear_type & AQ_CLEAR_SW)
 963		clear_bit(sa_num, &aq_rxsc->rx_sa_idx_busy);
 964
 965	if ((clear_type & AQ_CLEAR_HW) && netif_carrier_ok(nic->ndev)) {
 966		struct aq_mss_ingress_sakey_record sa_key_record;
 967		struct aq_mss_ingress_sa_record sa_record;
 968
 969		memset(&sa_key_record, 0, sizeof(sa_key_record));
 970		memset(&sa_record, 0, sizeof(sa_record));
 971		sa_record.fresh = 1;
 972		ret = aq_mss_set_ingress_sa_record(hw, &sa_record, sa_idx);
 973		if (ret)
 974			return ret;
 975
 976		return aq_mss_set_ingress_sakey_record(hw, &sa_key_record,
 977						       sa_idx);
 978	}
 979
 980	return ret;
 981}
 982
 983static int aq_mdo_del_rxsa(struct macsec_context *ctx)
 984{
 985	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
 986	const struct macsec_rx_sc *rx_sc = ctx->sa.rx_sa->sc;
 987	struct aq_macsec_cfg *cfg = nic->macsec_cfg;
 988	int rxsc_idx;
 989	int ret = 0;
 990
 991	rxsc_idx = aq_get_rxsc_idx_from_rxsc(cfg, rx_sc);
 992	if (rxsc_idx < 0)
 993		return -EINVAL;
 994
 995	ret = aq_clear_rxsa(nic, &cfg->aq_rxsc[rxsc_idx], ctx->sa.assoc_num,
 996			    AQ_CLEAR_ALL);
 997
 998	return ret;
 999}
1000
1001static int aq_mdo_get_dev_stats(struct macsec_context *ctx)
1002{
1003	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
1004	struct aq_macsec_common_stats *stats = &nic->macsec_cfg->stats;
1005	struct aq_hw_s *hw = nic->aq_hw;
1006
1007	aq_get_macsec_common_stats(hw, stats);
1008
1009	ctx->stats.dev_stats->OutPktsUntagged = stats->out.untagged_pkts;
1010	ctx->stats.dev_stats->InPktsUntagged = stats->in.untagged_pkts;
1011	ctx->stats.dev_stats->OutPktsTooLong = stats->out.too_long;
1012	ctx->stats.dev_stats->InPktsNoTag = stats->in.notag_pkts;
1013	ctx->stats.dev_stats->InPktsBadTag = stats->in.bad_tag_pkts;
1014	ctx->stats.dev_stats->InPktsUnknownSCI = stats->in.unknown_sci_pkts;
1015	ctx->stats.dev_stats->InPktsNoSCI = stats->in.no_sci_pkts;
1016	ctx->stats.dev_stats->InPktsOverrun = 0;
1017
1018	return 0;
1019}
1020
1021static int aq_mdo_get_tx_sc_stats(struct macsec_context *ctx)
1022{
1023	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
1024	struct aq_macsec_tx_sc_stats *stats;
1025	struct aq_hw_s *hw = nic->aq_hw;
1026	struct aq_macsec_txsc *aq_txsc;
1027	int txsc_idx;
1028
1029	txsc_idx = aq_get_txsc_idx_from_secy(nic->macsec_cfg, ctx->secy);
1030	if (txsc_idx < 0)
1031		return -ENOENT;
1032
1033	aq_txsc = &nic->macsec_cfg->aq_txsc[txsc_idx];
1034	stats = &aq_txsc->stats;
1035	aq_get_txsc_stats(hw, aq_txsc->hw_sc_idx, stats);
1036
1037	ctx->stats.tx_sc_stats->OutPktsProtected = stats->sc_protected_pkts;
1038	ctx->stats.tx_sc_stats->OutPktsEncrypted = stats->sc_encrypted_pkts;
1039	ctx->stats.tx_sc_stats->OutOctetsProtected = stats->sc_protected_octets;
1040	ctx->stats.tx_sc_stats->OutOctetsEncrypted = stats->sc_encrypted_octets;
1041
1042	return 0;
1043}
1044
1045static int aq_mdo_get_tx_sa_stats(struct macsec_context *ctx)
1046{
1047	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
1048	struct aq_macsec_cfg *cfg = nic->macsec_cfg;
1049	struct aq_macsec_tx_sa_stats *stats;
1050	struct aq_hw_s *hw = nic->aq_hw;
1051	const struct macsec_secy *secy;
1052	struct aq_macsec_txsc *aq_txsc;
1053	struct macsec_tx_sa *tx_sa;
1054	unsigned int sa_idx;
1055	int txsc_idx;
1056	u32 next_pn;
1057	int ret;
1058
1059	txsc_idx = aq_get_txsc_idx_from_secy(cfg, ctx->secy);
1060	if (txsc_idx < 0)
1061		return -EINVAL;
1062
1063	aq_txsc = &cfg->aq_txsc[txsc_idx];
1064	sa_idx = aq_txsc->hw_sc_idx | ctx->sa.assoc_num;
1065	stats = &aq_txsc->tx_sa_stats[ctx->sa.assoc_num];
1066	ret = aq_get_txsa_stats(hw, sa_idx, stats);
1067	if (ret)
1068		return ret;
1069
1070	ctx->stats.tx_sa_stats->OutPktsProtected = stats->sa_protected_pkts;
1071	ctx->stats.tx_sa_stats->OutPktsEncrypted = stats->sa_encrypted_pkts;
1072
1073	secy = aq_txsc->sw_secy;
1074	tx_sa = rcu_dereference_bh(secy->tx_sc.sa[ctx->sa.assoc_num]);
1075	ret = aq_get_txsa_next_pn(hw, sa_idx, &next_pn);
1076	if (ret == 0) {
1077		spin_lock_bh(&tx_sa->lock);
1078		tx_sa->next_pn = next_pn;
1079		spin_unlock_bh(&tx_sa->lock);
1080	}
1081
1082	return ret;
1083}
1084
1085static int aq_mdo_get_rx_sc_stats(struct macsec_context *ctx)
1086{
1087	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
1088	struct aq_macsec_cfg *cfg = nic->macsec_cfg;
1089	struct aq_macsec_rx_sa_stats *stats;
1090	struct aq_hw_s *hw = nic->aq_hw;
1091	struct aq_macsec_rxsc *aq_rxsc;
1092	unsigned int sa_idx;
1093	int rxsc_idx;
1094	int ret = 0;
1095	int i;
1096
1097	rxsc_idx = aq_get_rxsc_idx_from_rxsc(cfg, ctx->rx_sc);
1098	if (rxsc_idx < 0)
1099		return -ENOENT;
1100
1101	aq_rxsc = &cfg->aq_rxsc[rxsc_idx];
1102	for (i = 0; i < MACSEC_NUM_AN; i++) {
1103		if (!test_bit(i, &aq_rxsc->rx_sa_idx_busy))
1104			continue;
1105
1106		stats = &aq_rxsc->rx_sa_stats[i];
1107		sa_idx = aq_rxsc->hw_sc_idx | i;
1108		ret = aq_get_rxsa_stats(hw, sa_idx, stats);
1109		if (ret)
1110			break;
1111
1112		ctx->stats.rx_sc_stats->InOctetsValidated +=
1113			stats->validated_octets;
1114		ctx->stats.rx_sc_stats->InOctetsDecrypted +=
1115			stats->decrypted_octets;
1116		ctx->stats.rx_sc_stats->InPktsUnchecked +=
1117			stats->unchecked_pkts;
1118		ctx->stats.rx_sc_stats->InPktsDelayed += stats->delayed_pkts;
1119		ctx->stats.rx_sc_stats->InPktsOK += stats->ok_pkts;
1120		ctx->stats.rx_sc_stats->InPktsInvalid += stats->invalid_pkts;
1121		ctx->stats.rx_sc_stats->InPktsLate += stats->late_pkts;
1122		ctx->stats.rx_sc_stats->InPktsNotValid += stats->not_valid_pkts;
1123		ctx->stats.rx_sc_stats->InPktsNotUsingSA += stats->not_using_sa;
1124		ctx->stats.rx_sc_stats->InPktsUnusedSA += stats->unused_sa;
1125	}
1126
1127	return ret;
1128}
1129
1130static int aq_mdo_get_rx_sa_stats(struct macsec_context *ctx)
1131{
1132	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);
1133	struct aq_macsec_cfg *cfg = nic->macsec_cfg;
1134	struct aq_macsec_rx_sa_stats *stats;
1135	struct aq_hw_s *hw = nic->aq_hw;
1136	struct aq_macsec_rxsc *aq_rxsc;
1137	struct macsec_rx_sa *rx_sa;
1138	unsigned int sa_idx;
1139	int rxsc_idx;
1140	u32 next_pn;
1141	int ret;
1142
1143	rxsc_idx = aq_get_rxsc_idx_from_rxsc(cfg, ctx->rx_sc);
1144	if (rxsc_idx < 0)
1145		return -EINVAL;
1146
1147	aq_rxsc = &cfg->aq_rxsc[rxsc_idx];
1148	stats = &aq_rxsc->rx_sa_stats[ctx->sa.assoc_num];
1149	sa_idx = aq_rxsc->hw_sc_idx | ctx->sa.assoc_num;
1150	ret = aq_get_rxsa_stats(hw, sa_idx, stats);
1151	if (ret)
1152		return ret;
1153
1154	ctx->stats.rx_sa_stats->InPktsOK = stats->ok_pkts;
1155	ctx->stats.rx_sa_stats->InPktsInvalid = stats->invalid_pkts;
1156	ctx->stats.rx_sa_stats->InPktsNotValid = stats->not_valid_pkts;
1157	ctx->stats.rx_sa_stats->InPktsNotUsingSA = stats->not_using_sa;
1158	ctx->stats.rx_sa_stats->InPktsUnusedSA = stats->unused_sa;
1159
1160	rx_sa = rcu_dereference_bh(aq_rxsc->sw_rxsc->sa[ctx->sa.assoc_num]);
1161	ret = aq_get_rxsa_next_pn(hw, sa_idx, &next_pn);
1162	if (ret == 0) {
1163		spin_lock_bh(&rx_sa->lock);
1164		rx_sa->next_pn = next_pn;
1165		spin_unlock_bh(&rx_sa->lock);
1166	}
1167
1168	return ret;
1169}
1170
1171static int apply_txsc_cfg(struct aq_nic_s *nic, const int txsc_idx)
1172{
1173	struct aq_macsec_txsc *aq_txsc = &nic->macsec_cfg->aq_txsc[txsc_idx];
1174	const struct macsec_secy *secy = aq_txsc->sw_secy;
1175	struct macsec_tx_sa *tx_sa;
1176	int ret = 0;
1177	int i;
1178
1179	if (!netif_running(secy->netdev))
1180		return ret;
1181
1182	ret = aq_set_txsc(nic, txsc_idx);
1183	if (ret)
1184		return ret;
1185
1186	for (i = 0; i < MACSEC_NUM_AN; i++) {
1187		tx_sa = rcu_dereference_bh(secy->tx_sc.sa[i]);
1188		if (tx_sa) {
1189			ret = aq_update_txsa(nic, aq_txsc->hw_sc_idx, secy,
1190					     tx_sa, aq_txsc->tx_sa_key[i], i);
1191			if (ret)
1192				return ret;
1193		}
1194	}
1195
1196	return ret;
1197}
1198
1199static int apply_rxsc_cfg(struct aq_nic_s *nic, const int rxsc_idx)
1200{
1201	struct aq_macsec_rxsc *aq_rxsc = &nic->macsec_cfg->aq_rxsc[rxsc_idx];
1202	const struct macsec_secy *secy = aq_rxsc->sw_secy;
1203	struct macsec_rx_sa *rx_sa;
1204	int ret = 0;
1205	int i;
1206
1207	if (!netif_running(secy->netdev))
1208		return ret;
1209
1210	ret = aq_set_rxsc(nic, rxsc_idx);
1211	if (ret)
1212		return ret;
1213
1214	for (i = 0; i < MACSEC_NUM_AN; i++) {
1215		rx_sa = rcu_dereference_bh(aq_rxsc->sw_rxsc->sa[i]);
1216		if (rx_sa) {
1217			ret = aq_update_rxsa(nic, aq_rxsc->hw_sc_idx, secy,
1218					     rx_sa, aq_rxsc->rx_sa_key[i], i);
1219			if (ret)
1220				return ret;
1221		}
1222	}
1223
1224	return ret;
1225}
1226
1227static int aq_clear_secy(struct aq_nic_s *nic, const struct macsec_secy *secy,
1228			 enum aq_clear_type clear_type)
1229{
1230	struct macsec_rx_sc *rx_sc;
1231	int txsc_idx;
1232	int rxsc_idx;
1233	int ret = 0;
1234
1235	txsc_idx = aq_get_txsc_idx_from_secy(nic->macsec_cfg, secy);
1236	if (txsc_idx >= 0) {
1237		ret = aq_clear_txsc(nic, txsc_idx, clear_type);
1238		if (ret)
1239			return ret;
1240	}
1241
1242	for (rx_sc = rcu_dereference_bh(secy->rx_sc); rx_sc;
1243	     rx_sc = rcu_dereference_bh(rx_sc->next)) {
1244		rxsc_idx = aq_get_rxsc_idx_from_rxsc(nic->macsec_cfg, rx_sc);
1245		if (rxsc_idx < 0)
1246			continue;
1247
1248		ret = aq_clear_rxsc(nic, rxsc_idx, clear_type);
1249		if (ret)
1250			return ret;
1251	}
1252
1253	return ret;
1254}
1255
1256static int aq_apply_secy_cfg(struct aq_nic_s *nic,
1257			     const struct macsec_secy *secy)
1258{
1259	struct macsec_rx_sc *rx_sc;
1260	int txsc_idx;
1261	int rxsc_idx;
1262	int ret = 0;
1263
1264	txsc_idx = aq_get_txsc_idx_from_secy(nic->macsec_cfg, secy);
1265	if (txsc_idx >= 0)
1266		apply_txsc_cfg(nic, txsc_idx);
1267
1268	for (rx_sc = rcu_dereference_bh(secy->rx_sc); rx_sc && rx_sc->active;
1269	     rx_sc = rcu_dereference_bh(rx_sc->next)) {
1270		rxsc_idx = aq_get_rxsc_idx_from_rxsc(nic->macsec_cfg, rx_sc);
1271		if (unlikely(rxsc_idx < 0))
1272			continue;
1273
1274		ret = apply_rxsc_cfg(nic, rxsc_idx);
1275		if (ret)
1276			return ret;
1277	}
1278
1279	return ret;
1280}
1281
1282static int aq_apply_macsec_cfg(struct aq_nic_s *nic)
1283{
1284	int ret = 0;
1285	int i;
1286
1287	for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {
1288		if (nic->macsec_cfg->txsc_idx_busy & BIT(i)) {
1289			ret = apply_txsc_cfg(nic, i);
1290			if (ret)
1291				return ret;
1292		}
1293	}
1294
1295	for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {
1296		if (nic->macsec_cfg->rxsc_idx_busy & BIT(i)) {
1297			ret = apply_rxsc_cfg(nic, i);
1298			if (ret)
1299				return ret;
1300		}
1301	}
1302
1303	return ret;
1304}
1305
1306static int aq_sa_from_sa_idx(const enum aq_macsec_sc_sa sc_sa, const int sa_idx)
1307{
1308	switch (sc_sa) {
1309	case aq_macsec_sa_sc_4sa_8sc:
1310		return sa_idx & 3;
1311	case aq_macsec_sa_sc_2sa_16sc:
1312		return sa_idx & 1;
1313	case aq_macsec_sa_sc_1sa_32sc:
1314		return 0;
1315	default:
1316		WARN_ONCE(true, "Invalid sc_sa");
1317	}
1318	return -EINVAL;
1319}
1320
1321static int aq_sc_idx_from_sa_idx(const enum aq_macsec_sc_sa sc_sa,
1322				 const int sa_idx)
1323{
1324	switch (sc_sa) {
1325	case aq_macsec_sa_sc_4sa_8sc:
1326		return sa_idx & ~3;
1327	case aq_macsec_sa_sc_2sa_16sc:
1328		return sa_idx & ~1;
1329	case aq_macsec_sa_sc_1sa_32sc:
1330		return sa_idx;
1331	default:
1332		WARN_ONCE(true, "Invalid sc_sa");
1333	}
1334	return -EINVAL;
1335}
1336
1337static void aq_check_txsa_expiration(struct aq_nic_s *nic)
1338{
1339	u32 egress_sa_expired, egress_sa_threshold_expired;
1340	struct aq_macsec_cfg *cfg = nic->macsec_cfg;
1341	struct aq_hw_s *hw = nic->aq_hw;
1342	struct aq_macsec_txsc *aq_txsc;
1343	const struct macsec_secy *secy;
1344	int sc_idx = 0, txsc_idx = 0;
1345	enum aq_macsec_sc_sa sc_sa;
1346	struct macsec_tx_sa *tx_sa;
1347	unsigned char an = 0;
1348	int ret;
1349	int i;
1350
1351	sc_sa = cfg->sc_sa;
1352
1353	ret = aq_mss_get_egress_sa_expired(hw, &egress_sa_expired);
1354	if (unlikely(ret))
1355		return;
1356
1357	ret = aq_mss_get_egress_sa_threshold_expired(hw,
1358		&egress_sa_threshold_expired);
1359
1360	for (i = 0; i < AQ_MACSEC_MAX_SA; i++) {
1361		if (egress_sa_expired & BIT(i)) {
1362			an = aq_sa_from_sa_idx(sc_sa, i);
1363			sc_idx = aq_sc_idx_from_sa_idx(sc_sa, i);
1364			txsc_idx = aq_get_txsc_idx_from_sc_idx(sc_sa, sc_idx);
1365			if (txsc_idx < 0)
1366				continue;
1367
1368			aq_txsc = &cfg->aq_txsc[txsc_idx];
1369			if (!(cfg->txsc_idx_busy & BIT(txsc_idx))) {
1370				netdev_warn(nic->ndev,
1371					"PN threshold expired on invalid TX SC");
1372				continue;
1373			}
1374
1375			secy = aq_txsc->sw_secy;
1376			if (!netif_running(secy->netdev)) {
1377				netdev_warn(nic->ndev,
1378					"PN threshold expired on down TX SC");
1379				continue;
1380			}
1381
1382			if (unlikely(!(aq_txsc->tx_sa_idx_busy & BIT(an)))) {
1383				netdev_warn(nic->ndev,
1384					"PN threshold expired on invalid TX SA");
1385				continue;
1386			}
1387
1388			tx_sa = rcu_dereference_bh(secy->tx_sc.sa[an]);
1389			macsec_pn_wrapped((struct macsec_secy *)secy, tx_sa);
1390		}
1391	}
1392
1393	aq_mss_set_egress_sa_expired(hw, egress_sa_expired);
1394	if (likely(!ret))
1395		aq_mss_set_egress_sa_threshold_expired(hw,
1396			egress_sa_threshold_expired);
1397}
1398
1399#define AQ_LOCKED_MDO_DEF(mdo)						\
1400static int aq_locked_mdo_##mdo(struct macsec_context *ctx)		\
1401{									\
1402	struct aq_nic_s *nic = macsec_netdev_priv(ctx->netdev);		\
1403	int ret;							\
1404	mutex_lock(&nic->macsec_mutex);					\
1405	ret = aq_mdo_##mdo(ctx);					\
1406	mutex_unlock(&nic->macsec_mutex);				\
1407	return ret;							\
1408}
1409
1410AQ_LOCKED_MDO_DEF(dev_open)
1411AQ_LOCKED_MDO_DEF(dev_stop)
1412AQ_LOCKED_MDO_DEF(add_secy)
1413AQ_LOCKED_MDO_DEF(upd_secy)
1414AQ_LOCKED_MDO_DEF(del_secy)
1415AQ_LOCKED_MDO_DEF(add_rxsc)
1416AQ_LOCKED_MDO_DEF(upd_rxsc)
1417AQ_LOCKED_MDO_DEF(del_rxsc)
1418AQ_LOCKED_MDO_DEF(add_rxsa)
1419AQ_LOCKED_MDO_DEF(upd_rxsa)
1420AQ_LOCKED_MDO_DEF(del_rxsa)
1421AQ_LOCKED_MDO_DEF(add_txsa)
1422AQ_LOCKED_MDO_DEF(upd_txsa)
1423AQ_LOCKED_MDO_DEF(del_txsa)
1424AQ_LOCKED_MDO_DEF(get_dev_stats)
1425AQ_LOCKED_MDO_DEF(get_tx_sc_stats)
1426AQ_LOCKED_MDO_DEF(get_tx_sa_stats)
1427AQ_LOCKED_MDO_DEF(get_rx_sc_stats)
1428AQ_LOCKED_MDO_DEF(get_rx_sa_stats)
1429
1430const struct macsec_ops aq_macsec_ops = {
1431	.mdo_dev_open = aq_locked_mdo_dev_open,
1432	.mdo_dev_stop = aq_locked_mdo_dev_stop,
1433	.mdo_add_secy = aq_locked_mdo_add_secy,
1434	.mdo_upd_secy = aq_locked_mdo_upd_secy,
1435	.mdo_del_secy = aq_locked_mdo_del_secy,
1436	.mdo_add_rxsc = aq_locked_mdo_add_rxsc,
1437	.mdo_upd_rxsc = aq_locked_mdo_upd_rxsc,
1438	.mdo_del_rxsc = aq_locked_mdo_del_rxsc,
1439	.mdo_add_rxsa = aq_locked_mdo_add_rxsa,
1440	.mdo_upd_rxsa = aq_locked_mdo_upd_rxsa,
1441	.mdo_del_rxsa = aq_locked_mdo_del_rxsa,
1442	.mdo_add_txsa = aq_locked_mdo_add_txsa,
1443	.mdo_upd_txsa = aq_locked_mdo_upd_txsa,
1444	.mdo_del_txsa = aq_locked_mdo_del_txsa,
1445	.mdo_get_dev_stats = aq_locked_mdo_get_dev_stats,
1446	.mdo_get_tx_sc_stats = aq_locked_mdo_get_tx_sc_stats,
1447	.mdo_get_tx_sa_stats = aq_locked_mdo_get_tx_sa_stats,
1448	.mdo_get_rx_sc_stats = aq_locked_mdo_get_rx_sc_stats,
1449	.mdo_get_rx_sa_stats = aq_locked_mdo_get_rx_sa_stats,
1450};
1451
1452int aq_macsec_init(struct aq_nic_s *nic)
1453{
1454	struct aq_macsec_cfg *cfg;
1455	u32 caps_lo;
1456
1457	if (!nic->aq_fw_ops->get_link_capabilities)
1458		return 0;
1459
1460	caps_lo = nic->aq_fw_ops->get_link_capabilities(nic->aq_hw);
1461
1462	if (!(caps_lo & BIT(CAPS_LO_MACSEC)))
1463		return 0;
1464
1465	nic->macsec_cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
1466	if (!nic->macsec_cfg)
1467		return -ENOMEM;
1468
1469	nic->ndev->features |= NETIF_F_HW_MACSEC;
1470	nic->ndev->macsec_ops = &aq_macsec_ops;
1471	mutex_init(&nic->macsec_mutex);
1472
1473	return 0;
1474}
1475
1476void aq_macsec_free(struct aq_nic_s *nic)
1477{
1478	kfree(nic->macsec_cfg);
1479	nic->macsec_cfg = NULL;
1480}
1481
1482int aq_macsec_enable(struct aq_nic_s *nic)
1483{
1484	u32 ctl_ether_types[1] = { ETH_P_PAE };
1485	struct macsec_msg_fw_response resp = { 0 };
1486	struct macsec_msg_fw_request msg = { 0 };
1487	struct aq_hw_s *hw = nic->aq_hw;
1488	int num_ctl_ether_types = 0;
1489	int index = 0, tbl_idx;
1490	int ret;
1491
1492	if (!nic->macsec_cfg)
1493		return 0;
1494
1495	mutex_lock(&nic->macsec_mutex);
1496
1497	if (nic->aq_fw_ops->send_macsec_req) {
1498		struct macsec_cfg_request cfg = { 0 };
1499
1500		cfg.enabled = 1;
1501		cfg.egress_threshold = 0xffffffff;
1502		cfg.ingress_threshold = 0xffffffff;
1503		cfg.interrupts_enabled = 1;
1504
1505		msg.msg_type = macsec_cfg_msg;
1506		msg.cfg = cfg;
1507
1508		ret = nic->aq_fw_ops->send_macsec_req(hw, &msg, &resp);
1509		if (ret)
1510			goto unlock;
1511	}
1512
1513	/* Init Ethertype bypass filters */
1514	for (index = 0; index < ARRAY_SIZE(ctl_ether_types); index++) {
1515		struct aq_mss_ingress_prectlf_record rx_prectlf_rec;
1516		struct aq_mss_egress_ctlf_record tx_ctlf_rec;
1517
1518		if (ctl_ether_types[index] == 0)
1519			continue;
1520
1521		memset(&tx_ctlf_rec, 0, sizeof(tx_ctlf_rec));
1522		tx_ctlf_rec.eth_type = ctl_ether_types[index];
1523		tx_ctlf_rec.match_type = 4; /* Match eth_type only */
1524		tx_ctlf_rec.match_mask = 0xf; /* match for eth_type */
1525		tx_ctlf_rec.action = 0; /* Bypass MACSEC modules */
1526		tbl_idx = NUMROWS_EGRESSCTLFRECORD - num_ctl_ether_types - 1;
1527		aq_mss_set_egress_ctlf_record(hw, &tx_ctlf_rec, tbl_idx);
1528
1529		memset(&rx_prectlf_rec, 0, sizeof(rx_prectlf_rec));
1530		rx_prectlf_rec.eth_type = ctl_ether_types[index];
1531		rx_prectlf_rec.match_type = 4; /* Match eth_type only */
1532		rx_prectlf_rec.match_mask = 0xf; /* match for eth_type */
1533		rx_prectlf_rec.action = 0; /* Bypass MACSEC modules */
1534		tbl_idx =
1535			NUMROWS_INGRESSPRECTLFRECORD - num_ctl_ether_types - 1;
1536		aq_mss_set_ingress_prectlf_record(hw, &rx_prectlf_rec, tbl_idx);
1537
1538		num_ctl_ether_types++;
1539	}
1540
1541	ret = aq_apply_macsec_cfg(nic);
1542
1543unlock:
1544	mutex_unlock(&nic->macsec_mutex);
1545	return ret;
1546}
1547
1548void aq_macsec_work(struct aq_nic_s *nic)
1549{
1550	if (!nic->macsec_cfg)
1551		return;
1552
1553	if (!netif_carrier_ok(nic->ndev))
1554		return;
1555
1556	mutex_lock(&nic->macsec_mutex);
1557	aq_check_txsa_expiration(nic);
1558	mutex_unlock(&nic->macsec_mutex);
1559}
1560
1561int aq_macsec_rx_sa_cnt(struct aq_nic_s *nic)
1562{
1563	struct aq_macsec_cfg *cfg = nic->macsec_cfg;
1564	int i, cnt = 0;
1565
1566	if (!cfg)
1567		return 0;
1568
1569	mutex_lock(&nic->macsec_mutex);
1570
1571	for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {
1572		if (!test_bit(i, &cfg->rxsc_idx_busy))
1573			continue;
1574		cnt += hweight_long(cfg->aq_rxsc[i].rx_sa_idx_busy);
1575	}
1576
1577	mutex_unlock(&nic->macsec_mutex);
1578	return cnt;
1579}
1580
1581int aq_macsec_tx_sc_cnt(struct aq_nic_s *nic)
1582{
1583	int cnt;
1584
1585	if (!nic->macsec_cfg)
1586		return 0;
1587
1588	mutex_lock(&nic->macsec_mutex);
1589	cnt = hweight_long(nic->macsec_cfg->txsc_idx_busy);
1590	mutex_unlock(&nic->macsec_mutex);
1591
1592	return cnt;
1593}
1594
1595int aq_macsec_tx_sa_cnt(struct aq_nic_s *nic)
1596{
1597	struct aq_macsec_cfg *cfg = nic->macsec_cfg;
1598	int i, cnt = 0;
1599
1600	if (!cfg)
1601		return 0;
1602
1603	mutex_lock(&nic->macsec_mutex);
1604
1605	for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {
1606		if (!test_bit(i, &cfg->txsc_idx_busy))
1607			continue;
1608		cnt += hweight_long(cfg->aq_txsc[i].tx_sa_idx_busy);
1609	}
1610
1611	mutex_unlock(&nic->macsec_mutex);
1612	return cnt;
1613}
1614
1615static int aq_macsec_update_stats(struct aq_nic_s *nic)
1616{
1617	struct aq_macsec_cfg *cfg = nic->macsec_cfg;
1618	struct aq_hw_s *hw = nic->aq_hw;
1619	struct aq_macsec_txsc *aq_txsc;
1620	struct aq_macsec_rxsc *aq_rxsc;
1621	int i, sa_idx, assoc_num;
1622	int ret = 0;
1623
1624	aq_get_macsec_common_stats(hw, &cfg->stats);
1625
1626	for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {
1627		if (!(cfg->txsc_idx_busy & BIT(i)))
1628			continue;
1629		aq_txsc = &cfg->aq_txsc[i];
1630
1631		ret = aq_get_txsc_stats(hw, aq_txsc->hw_sc_idx,
1632					&aq_txsc->stats);
1633		if (ret)
1634			return ret;
1635
1636		for (assoc_num = 0; assoc_num < MACSEC_NUM_AN; assoc_num++) {
1637			if (!test_bit(assoc_num, &aq_txsc->tx_sa_idx_busy))
1638				continue;
1639			sa_idx = aq_txsc->hw_sc_idx | assoc_num;
1640			ret = aq_get_txsa_stats(hw, sa_idx,
1641					      &aq_txsc->tx_sa_stats[assoc_num]);
1642			if (ret)
1643				return ret;
1644		}
1645	}
1646
1647	for (i = 0; i < AQ_MACSEC_MAX_SC; i++) {
1648		if (!(test_bit(i, &cfg->rxsc_idx_busy)))
1649			continue;
1650		aq_rxsc = &cfg->aq_rxsc[i];
1651
1652		for (assoc_num = 0; assoc_num < MACSEC_NUM_AN; assoc_num++) {
1653			if (!test_bit(assoc_num, &aq_rxsc->rx_sa_idx_busy))
1654				continue;
1655			sa_idx = aq_rxsc->hw_sc_idx | assoc_num;
1656
1657			ret = aq_get_rxsa_stats(hw, sa_idx,
1658					      &aq_rxsc->rx_sa_stats[assoc_num]);
1659			if (ret)
1660				return ret;
1661		}
1662	}
1663
1664	return ret;
1665}
1666
1667u64 *aq_macsec_get_stats(struct aq_nic_s *nic, u64 *data)
1668{
1669	struct aq_macsec_cfg *cfg = nic->macsec_cfg;
1670	struct aq_macsec_common_stats *common_stats;
1671	struct aq_macsec_tx_sc_stats *txsc_stats;
1672	struct aq_macsec_tx_sa_stats *txsa_stats;
1673	struct aq_macsec_rx_sa_stats *rxsa_stats;
1674	struct aq_macsec_txsc *aq_txsc;
1675	struct aq_macsec_rxsc *aq_rxsc;
1676	unsigned int assoc_num;
1677	unsigned int sc_num;
1678	unsigned int i = 0U;
1679
1680	if (!cfg)
1681		return data;
1682
1683	mutex_lock(&nic->macsec_mutex);
1684
1685	aq_macsec_update_stats(nic);
1686
1687	common_stats = &cfg->stats;
1688	data[i] = common_stats->in.ctl_pkts;
1689	data[++i] = common_stats->in.tagged_miss_pkts;
1690	data[++i] = common_stats->in.untagged_miss_pkts;
1691	data[++i] = common_stats->in.notag_pkts;
1692	data[++i] = common_stats->in.untagged_pkts;
1693	data[++i] = common_stats->in.bad_tag_pkts;
1694	data[++i] = common_stats->in.no_sci_pkts;
1695	data[++i] = common_stats->in.unknown_sci_pkts;
1696	data[++i] = common_stats->in.ctrl_prt_pass_pkts;
1697	data[++i] = common_stats->in.unctrl_prt_pass_pkts;
1698	data[++i] = common_stats->in.ctrl_prt_fail_pkts;
1699	data[++i] = common_stats->in.unctrl_prt_fail_pkts;
1700	data[++i] = common_stats->in.too_long_pkts;
1701	data[++i] = common_stats->in.igpoc_ctl_pkts;
1702	data[++i] = common_stats->in.ecc_error_pkts;
1703	data[++i] = common_stats->in.unctrl_hit_drop_redir;
1704	data[++i] = common_stats->out.ctl_pkts;
1705	data[++i] = common_stats->out.unknown_sa_pkts;
1706	data[++i] = common_stats->out.untagged_pkts;
1707	data[++i] = common_stats->out.too_long;
1708	data[++i] = common_stats->out.ecc_error_pkts;
1709	data[++i] = common_stats->out.unctrl_hit_drop_redir;
1710
1711	for (sc_num = 0; sc_num < AQ_MACSEC_MAX_SC; sc_num++) {
1712		if (!(test_bit(sc_num, &cfg->txsc_idx_busy)))
1713			continue;
1714
1715		aq_txsc = &cfg->aq_txsc[sc_num];
1716		txsc_stats = &aq_txsc->stats;
1717
1718		data[++i] = txsc_stats->sc_protected_pkts;
1719		data[++i] = txsc_stats->sc_encrypted_pkts;
1720		data[++i] = txsc_stats->sc_protected_octets;
1721		data[++i] = txsc_stats->sc_encrypted_octets;
1722
1723		for (assoc_num = 0; assoc_num < MACSEC_NUM_AN; assoc_num++) {
1724			if (!test_bit(assoc_num, &aq_txsc->tx_sa_idx_busy))
1725				continue;
1726
1727			txsa_stats = &aq_txsc->tx_sa_stats[assoc_num];
1728
1729			data[++i] = txsa_stats->sa_hit_drop_redirect;
1730			data[++i] = txsa_stats->sa_protected2_pkts;
1731			data[++i] = txsa_stats->sa_protected_pkts;
1732			data[++i] = txsa_stats->sa_encrypted_pkts;
1733		}
1734	}
1735
1736	for (sc_num = 0; sc_num < AQ_MACSEC_MAX_SC; sc_num++) {
1737		if (!(test_bit(sc_num, &cfg->rxsc_idx_busy)))
1738			continue;
1739
1740		aq_rxsc = &cfg->aq_rxsc[sc_num];
1741
1742		for (assoc_num = 0; assoc_num < MACSEC_NUM_AN; assoc_num++) {
1743			if (!test_bit(assoc_num, &aq_rxsc->rx_sa_idx_busy))
1744				continue;
1745
1746			rxsa_stats = &aq_rxsc->rx_sa_stats[assoc_num];
1747
1748			data[++i] = rxsa_stats->untagged_hit_pkts;
1749			data[++i] = rxsa_stats->ctrl_hit_drop_redir_pkts;
1750			data[++i] = rxsa_stats->not_using_sa;
1751			data[++i] = rxsa_stats->unused_sa;
1752			data[++i] = rxsa_stats->not_valid_pkts;
1753			data[++i] = rxsa_stats->invalid_pkts;
1754			data[++i] = rxsa_stats->ok_pkts;
1755			data[++i] = rxsa_stats->late_pkts;
1756			data[++i] = rxsa_stats->delayed_pkts;
1757			data[++i] = rxsa_stats->unchecked_pkts;
1758			data[++i] = rxsa_stats->validated_octets;
1759			data[++i] = rxsa_stats->decrypted_octets;
1760		}
1761	}
1762
1763	i++;
1764
1765	data += i;
1766
1767	mutex_unlock(&nic->macsec_mutex);
1768
1769	return data;
1770}