| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 22 Nov 2021 16:43:06 +0200
From: Sunil Rani <sunrani@...dia.com>
To: <netdev@...r.kernel.org>, <davem@...emloft.net>, <kuba@...nel.org>
CC: <parav@...dia.com>, <jiri@...dia.com>, <saeedm@...dia.com>,
Sunil Rani <sunrani@...dia.com>,
Bodong Wang <bodong@...dia.com>
Subject: [PATCH net-next 1/2] devlink: Add support to set port function as trusted
Add support to mark a given PCI sub-function (SF) or
Virtual function (VF) as a trusted function. The device/firmware
decides how to define privileges and access to resources.
These functions by default are in untrusted mode.
Examples of add, set a function as trusted and show commands:
$ devlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 88
pci/0000:08:00.0/32768: type eth netdev eth6 flavour pcisf controller 0 pfnum 0 sfnum 88 splittable false
function:
hw_addr 00:00:00:00:00:00 state inactive opstate detached trusted false
$ devlink port function set pci/0000:08:00.0/32768 trusted true
$ devlink port show pci/0000:08:00.0/32768
pci/0000:08:00.0/32768: type eth netdev eth6 flavour pcisf controller 0 pfnum 0 sfnum 88 splittable false
function:
hw_addr 00:00:00:00:00:00 state inactive opstate detached trusted true
Signed-off-by: Sunil Rani <sunrani@...dia.com>
Signed-off-by: Bodong Wang <bodong@...dia.com>
Reviewed-by: Parav Pandit <parav@...dia.com>
Reviewed-by: Jiri Pirko <jiri@...dia.com>
---
.../networking/devlink/devlink-port.rst | 4 ++
include/net/devlink.h | 22 ++++++++
include/uapi/linux/devlink.h | 1 +
net/core/devlink.c | 55 +++++++++++++++++++
4 files changed, 82 insertions(+)
diff --git a/Documentation/networking/devlink/devlink-port.rst b/Documentation/networking/devlink/devlink-port.rst
index 7627b1da01f2..bedd9cd411be 100644
--- a/Documentation/networking/devlink/devlink-port.rst
+++ b/Documentation/networking/devlink/devlink-port.rst
@@ -122,6 +122,10 @@ A user may set the hardware address of the function using
'devlink port function set hw_addr' command. For Ethernet port function
this means a MAC address.
+A user can set a function as trusted so that a function has the additional
+privileges. One example is to allow trusted function to query and operate
+the steering database similar to the switchdev device.
+
Subfunction
============
diff --git a/include/net/devlink.h b/include/net/devlink.h
index aab3d007c577..c82b2113d6fd 100644
--- a/include/net/devlink.h
+++ b/include/net/devlink.h
@@ -1461,6 +1461,28 @@ struct devlink_ops {
enum devlink_port_fn_state state,
struct netlink_ext_ack *extack);
+ /**
+ * port_fn_trusted_get() - Get the trusted state of port function
+ * @port: The devlink port
+ * @trusted: Query privilege state
+ * @extack: extack for reporting error messages
+ *
+ * Return: 0 on success, negative value otherwise.
+ */
+ int (*port_fn_trusted_get)(struct devlink_port *port,
+ bool *trusted,
+ struct netlink_ext_ack *extack);
+ /**
+ * port_fn_trusted_set() - Set the trusted state of port function
+ * @port: The devlink port
+ * @trusted: Set privilege state
+ * @extack: extack for reporting error messages
+ *
+ * Return: 0 on success, negative value otherwise.
+ */
+ int (*port_fn_trusted_set)(struct devlink_port *port,
+ bool trusted,
+ struct netlink_ext_ack *extack);
/**
* Rate control callbacks.
*/
diff --git a/include/uapi/linux/devlink.h b/include/uapi/linux/devlink.h
index b897b80770f6..36624a356478 100644
--- a/include/uapi/linux/devlink.h
+++ b/include/uapi/linux/devlink.h
@@ -604,6 +604,7 @@ enum devlink_port_function_attr {
DEVLINK_PORT_FUNCTION_ATTR_HW_ADDR, /* binary */
DEVLINK_PORT_FN_ATTR_STATE, /* u8 */
DEVLINK_PORT_FN_ATTR_OPSTATE, /* u8 */
+ DEVLINK_PORT_FN_ATTR_TRUSTED, /* u8 */
__DEVLINK_PORT_FUNCTION_ATTR_MAX,
DEVLINK_PORT_FUNCTION_ATTR_MAX = __DEVLINK_PORT_FUNCTION_ATTR_MAX - 1
diff --git a/net/core/devlink.c b/net/core/devlink.c
index 5ba4f9434acd..6aaa3a67194a 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -147,6 +147,7 @@ static const struct nla_policy devlink_function_nl_policy[DEVLINK_PORT_FUNCTION_
[DEVLINK_PORT_FN_ATTR_STATE] =
NLA_POLICY_RANGE(NLA_U8, DEVLINK_PORT_FN_STATE_INACTIVE,
DEVLINK_PORT_FN_STATE_ACTIVE),
+ [DEVLINK_PORT_FN_ATTR_TRUSTED] = { .type = NLA_U8 },
};
static DEFINE_XARRAY_FLAGS(devlinks, XA_FLAGS_ALLOC);
@@ -986,6 +987,31 @@ devlink_port_fn_opstate_valid(enum devlink_port_fn_opstate opstate)
opstate == DEVLINK_PORT_FN_OPSTATE_ATTACHED;
}
+static int devlink_port_fn_trusted_fill(const struct devlink_ops *ops,
+ struct devlink_port *port,
+ struct sk_buff *msg,
+ struct netlink_ext_ack *extack,
+ bool *msg_updated)
+{
+ bool trusted;
+ int err;
+
+ if (!ops->port_fn_trusted_get)
+ return 0;
+
+ err = ops->port_fn_trusted_get(port, &trusted, extack);
+ if (err) {
+ if (err == -EOPNOTSUPP)
+ return 0;
+ return err;
+ }
+
+ if (nla_put_u8(msg, DEVLINK_PORT_FN_ATTR_TRUSTED, trusted))
+ return -EMSGSIZE;
+ *msg_updated = true;
+ return 0;
+}
+
static int devlink_port_fn_state_fill(const struct devlink_ops *ops,
struct devlink_port *port,
struct sk_buff *msg,
@@ -1042,6 +1068,9 @@ devlink_nl_port_function_attrs_put(struct sk_buff *msg, struct devlink_port *por
if (err)
goto out;
err = devlink_port_fn_state_fill(ops, port, msg, extack, &msg_updated);
+ if (err)
+ goto out;
+ err = devlink_port_fn_trusted_fill(ops, port, msg, extack, &msg_updated);
out:
if (err || !msg_updated)
nla_nest_cancel(msg, function_attr);
@@ -1434,6 +1463,25 @@ static int devlink_port_function_hw_addr_set(struct devlink_port *port,
extack);
}
+static int devlink_port_fn_trusted_set(struct devlink_port *port,
+ const struct nlattr *attr,
+ struct netlink_ext_ack *extack)
+{
+ const struct devlink_ops *ops;
+ bool trusted;
+
+ if (nla_get_u8(attr) > 1)
+ return -EINVAL;
+
+ trusted = nla_get_u8(attr);
+ ops = port->devlink->ops;
+ if (!ops->port_fn_trusted_set) {
+ NL_SET_ERR_MSG_MOD(extack, "Function does not support trust setting");
+ return -EOPNOTSUPP;
+ }
+ return ops->port_fn_trusted_set(port, trusted, extack);
+}
+
static int devlink_port_fn_state_set(struct devlink_port *port,
const struct nlattr *attr,
struct netlink_ext_ack *extack)
@@ -1471,6 +1519,13 @@ static int devlink_port_function_set(struct devlink_port *port,
if (err)
return err;
}
+
+ attr = tb[DEVLINK_PORT_FN_ATTR_TRUSTED];
+ if (attr) {
+ err = devlink_port_fn_trusted_set(port, attr, extack);
+ if (err)
+ return err;
+ }
/* Keep this as the last function attribute set, so that when
* multiple port function attributes are set along with state,
* Those can be applied first before activating the state.
--
2.26.2
Powered by blists - more mailing lists