| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 22 Nov 2021 16:43:07 +0200
From: Sunil Rani <sunrani@...dia.com>
To: <netdev@...r.kernel.org>, <davem@...emloft.net>, <kuba@...nel.org>
CC: <parav@...dia.com>, <jiri@...dia.com>, <saeedm@...dia.com>,
Sunil Rani <sunrani@...dia.com>,
Bodong Wang <bodong@...dia.com>, Mark Bloch <mbloch@...dia.com>
Subject: [PATCH net-next 2/2] net/mlx5: SF/VF, Port function trust set support
Add support to mark a given PCI sub-function (SF) or
Virtual function (VF) as a trusted function. The device/firmware
decides how to define privileges and access to resources. Trust
state is queried and cached during function creation. These functions
by default are in untrusted mode.
Function restores to its untrusted state when either user marks it as
untrusted or the function is deleted (SR-IOV disablement or
SF port deletion).
Examples of add, change privilege level and show commands:
$ devlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 88
pci/0000:08:00.0/32768: type eth netdev eth6 flavour pcisf controller 0 pfnum 0 sfnum 88 splittable false
function:
hw_addr 00:00:00:00:00:00 state inactive opstate detached trusted false
$ devlink port function set pci/0000:08:00.0/32768 trusted true
$ devlink port show pci/0000:08:00.0/32768
pci/0000:08:00.0/32768: type eth netdev eth6 flavour pcisf controller 0 pfnum 0 sfnum 88 splittable false
function:
hw_addr 00:00:00:00:00:00 state inactive opstate detached trusted true
Signed-off-by: Sunil Rani <sunrani@...dia.com>
Signed-off-by: Bodong Wang <bodong@...dia.com>
Reviewed-by: Parav Pandit <parav@...dia.com>
Reviewed-by: Saeed Mahameed < saeedm@...dia.com>
Reviewed-by: Mark Bloch <mbloch@...dia.com>
---
.../net/ethernet/mellanox/mlx5/core/devlink.c | 2 +
.../net/ethernet/mellanox/mlx5/core/eswitch.c | 24 ++++
.../net/ethernet/mellanox/mlx5/core/eswitch.h | 11 +-
.../mellanox/mlx5/core/eswitch_offloads.c | 116 ++++++++++++++++++
include/linux/mlx5/driver.h | 1 +
include/linux/mlx5/mlx5_ifc.h | 10 +-
6 files changed, 162 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
index 1c98652b244a..cbf4288a777a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
@@ -298,6 +298,8 @@ static const struct devlink_ops mlx5_devlink_ops = {
.eswitch_encap_mode_get = mlx5_devlink_eswitch_encap_mode_get,
.port_function_hw_addr_get = mlx5_devlink_port_function_hw_addr_get,
.port_function_hw_addr_set = mlx5_devlink_port_function_hw_addr_set,
+ .port_fn_trusted_set = mlx5_devlink_port_function_trusted_set,
+ .port_fn_trusted_get = mlx5_devlink_port_function_trusted_get,
.rate_leaf_tx_share_set = mlx5_esw_devlink_rate_leaf_tx_share_set,
.rate_leaf_tx_max_set = mlx5_esw_devlink_rate_leaf_tx_max_set,
.rate_node_tx_share_set = mlx5_esw_devlink_rate_node_tx_share_set,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index 46532dd42b43..aca52a474af1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -820,6 +820,24 @@ static void esw_vport_cleanup(struct mlx5_eswitch *esw, struct mlx5_vport *vport
esw_vport_cleanup_acl(esw, vport);
}
+static int mlx5_esw_query_hca_trusted(struct mlx5_eswitch *esw,
+ struct mlx5_vport *vport)
+{
+ bool trusted;
+ int err;
+
+ err = mlx5_esw_get_hca_trusted(esw, vport->vport, &trusted);
+ if (err == -EOPNOTSUPP)
+ return 0;
+
+ if (err)
+ return err;
+
+ vport->info.offloads_trusted = trusted;
+
+ return 0;
+}
+
int mlx5_esw_vport_enable(struct mlx5_eswitch *esw, u16 vport_num,
enum mlx5_eswitch_vport_event enabled_events)
{
@@ -857,6 +875,12 @@ int mlx5_esw_vport_enable(struct mlx5_eswitch *esw, u16 vport_num,
goto err_vhca_mapping;
}
+ if (!mlx5_esw_is_manager_vport(esw, vport_num)) {
+ ret = mlx5_esw_query_hca_trusted(esw, vport);
+ if (ret)
+ goto err_vhca_mapping;
+ }
+
/* External controller host PF has factory programmed MAC.
* Read it from the device.
*/
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index 513f741d16c7..116cfa1c7ca8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -150,6 +150,7 @@ struct mlx5_vport_info {
u8 qos;
u8 spoofchk: 1;
u8 trusted: 1;
+ u8 offloads_trusted: 1;
};
/* Vport context events */
@@ -510,7 +511,15 @@ int mlx5_devlink_port_function_hw_addr_get(struct devlink_port *port,
int mlx5_devlink_port_function_hw_addr_set(struct devlink_port *port,
const u8 *hw_addr, int hw_addr_len,
struct netlink_ext_ack *extack);
-
+int mlx5_devlink_port_function_trusted_get(struct devlink_port *port,
+ bool *trusted,
+ struct netlink_ext_ack *extack);
+int mlx5_devlink_port_function_trusted_set(struct devlink_port *port,
+ bool trusted,
+ struct netlink_ext_ack *extack);
+int mlx5_esw_get_hca_trusted(struct mlx5_eswitch *esw,
+ u16 vport_num,
+ bool *trusted);
void *mlx5_eswitch_get_uplink_priv(struct mlx5_eswitch *esw, u8 rep_type);
int mlx5_eswitch_add_vlan_action(struct mlx5_eswitch *esw,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 4bd502ae82b6..0812cf826787 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -3871,6 +3871,122 @@ is_port_function_supported(struct mlx5_eswitch *esw, u16 vport_num)
mlx5_esw_is_sf_vport(esw, vport_num);
}
+static struct mlx5_vport *
+mlx5_dlport_to_vport_get(struct devlink_port *port, struct mlx5_eswitch *esw,
+ struct netlink_ext_ack *extack)
+{
+ u16 vport_num;
+
+ vport_num = mlx5_esw_devlink_port_index_to_vport_num(port->index);
+ if (!is_port_function_supported(esw, vport_num))
+ return ERR_PTR(-EOPNOTSUPP);
+
+ return mlx5_eswitch_get_vport(esw, vport_num);
+}
+
+static int mlx5_esw_set_hca_trusted(struct mlx5_eswitch *esw, u16 vport_num, bool trusted)
+{
+ u32 out[MLX5_ST_SZ_DW(vhca_trust_level)] = {};
+ u32 in[MLX5_ST_SZ_DW(vhca_trust_level)] = {};
+ int sz = MLX5_ST_SZ_BYTES(vhca_trust_level);
+ u16 vhca_id;
+ int err;
+
+ if (!MLX5_CAP_GEN(esw->dev, vhca_trust_level_reg))
+ return -EOPNOTSUPP;
+
+ err = mlx5_esw_query_vport_vhca_id(esw, vport_num, &vhca_id);
+ if (err) {
+ esw_warn(esw->dev, "Getting vhca_id for vport=%u failed err=%d\n",
+ vport_num, err);
+ return err;
+ }
+
+ MLX5_SET(vhca_trust_level, in, vhca_id, vhca_id);
+ MLX5_SET(vhca_trust_level, in, trust_level, trusted);
+
+ return mlx5_core_access_reg(esw->dev, in, sz, out, sz, MLX5_REG_TRUST_LEVEL, 0, 1);
+}
+
+int mlx5_devlink_port_function_trusted_set(struct devlink_port *port,
+ bool trusted,
+ struct netlink_ext_ack *extack)
+{
+ struct mlx5_eswitch *esw;
+ struct mlx5_vport *vport;
+ int err;
+
+ esw = mlx5_devlink_eswitch_get(port->devlink);
+ if (IS_ERR(esw))
+ return PTR_ERR(esw);
+
+ vport = mlx5_dlport_to_vport_get(port, esw, extack);
+ if (IS_ERR(vport)) {
+ NL_SET_ERR_MSG_MOD(extack,
+ "Failed to get vport");
+ return PTR_ERR(vport);
+ }
+
+ err = mlx5_esw_set_hca_trusted(esw, vport->vport, trusted);
+ if (!err)
+ vport->info.offloads_trusted = trusted;
+
+ return err;
+}
+
+int mlx5_esw_get_hca_trusted(struct mlx5_eswitch *esw, u16 vport_num, bool *trusted)
+{
+ u32 out[MLX5_ST_SZ_DW(vhca_trust_level)] = {};
+ u32 in[MLX5_ST_SZ_DW(vhca_trust_level)] = {};
+ int sz = MLX5_ST_SZ_BYTES(vhca_trust_level);
+ u32 trust_level;
+ u16 vhca_id;
+ int err;
+
+ if (!MLX5_CAP_GEN(esw->dev, vhca_trust_level_reg))
+ return -EOPNOTSUPP;
+
+ err = mlx5_esw_query_vport_vhca_id(esw, vport_num, &vhca_id);
+ if (err) {
+ esw_warn(esw->dev, "Query of vhca_id for vport %d failed, err %d\n",
+ vport_num, err);
+ return err;
+ }
+
+ MLX5_SET(vhca_trust_level, in, vhca_id, vhca_id);
+ mlx5_core_access_reg(esw->dev, in, sz, out, sz, MLX5_REG_TRUST_LEVEL, 0, 0);
+ trust_level = MLX5_GET(vhca_trust_level, out, trust_level);
+ *trusted = trust_level & 0x1;
+
+ return 0;
+}
+
+int mlx5_devlink_port_function_trusted_get(struct devlink_port *port,
+ bool *trusted,
+ struct netlink_ext_ack *extack)
+{
+ struct mlx5_eswitch *esw;
+ struct mlx5_vport *vport;
+
+ esw = mlx5_devlink_eswitch_get(port->devlink);
+ if (IS_ERR(esw))
+ return PTR_ERR(esw);
+
+ if (!MLX5_CAP_GEN(esw->dev, vhca_trust_level_reg))
+ return -EOPNOTSUPP;
+
+ vport = mlx5_dlport_to_vport_get(port, esw, extack);
+ if (IS_ERR(vport)) {
+ NL_SET_ERR_MSG_MOD(extack,
+ "Failed to get vport");
+ return PTR_ERR(vport);
+ }
+
+ *trusted = vport->info.offloads_trusted;
+
+ return 0;
+}
+
int mlx5_devlink_port_function_hw_addr_get(struct devlink_port *port,
u8 *hw_addr, int *hw_addr_len,
struct netlink_ext_ack *extack)
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index a623ec635947..ce8e35f59851 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -153,6 +153,7 @@ enum {
MLX5_REG_MIRC = 0x9162,
MLX5_REG_SBCAM = 0xB01F,
MLX5_REG_RESOURCE_DUMP = 0xC000,
+ MLX5_REG_TRUST_LEVEL = 0xC007,
MLX5_REG_DTOR = 0xC00E,
};
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 3636df90899a..c9b39a08aae0 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -1401,7 +1401,8 @@ struct mlx5_ifc_cmd_hca_cap_bits {
u8 reserved_at_120[0xa];
u8 log_max_ra_req_dc[0x6];
- u8 reserved_at_130[0xa];
+ u8 vhca_trust_level_reg[0x1];
+ u8 reserved_at_131[0x9];
u8 log_max_ra_res_dc[0x6];
u8 reserved_at_140[0x6];
@@ -11485,6 +11486,13 @@ struct mlx5_ifc_tls_progress_params_bits {
u8 hw_offset_record_number[0x18];
};
+struct mlx5_ifc_vhca_trust_level_bits {
+ u8 all_vhca[0x1];
+ u8 reserved_0[0xf];
+ u8 vhca_id[0x10];
+ u8 trust_level[0x20];
+};
+
enum {
MLX5_MTT_PERM_READ = 1 << 0,
MLX5_MTT_PERM_WRITE = 1 << 1,
--
2.26.2
Powered by blists - more mailing lists