qed: validate and restrict untrusted VFs vlan promisc mode
commitcbcc44db2c
upstream. Today when VFs are put in promiscuous mode, they can request PF to configure device for them to receive all VLANs traffic regardless of what vlan is configured by the PF (via ip link) and PF allows this config request regardless of whether VF is trusted or not. From security POV, when VLAN is configured for VF through PF (via ip link), honour such config requests from VF only when they are configured to be trusted, otherwise restrict such VFs vlan promisc mode config. Cc: stable@vger.kernel.org Fixes:f990c82c38
("qed*: Add support for ndo_set_vf_trust") Signed-off-by: Manish Chopra <manishc@marvell.com> Signed-off-by: Ariel Elior <aelior@marvell.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Родитель
4d8323922e
Коммит
876a9bdfd9
|
@ -2982,12 +2982,16 @@ static int qed_iov_pre_update_vport(struct qed_hwfn *hwfn,
|
||||||
u8 mask = QED_ACCEPT_UCAST_UNMATCHED | QED_ACCEPT_MCAST_UNMATCHED;
|
u8 mask = QED_ACCEPT_UCAST_UNMATCHED | QED_ACCEPT_MCAST_UNMATCHED;
|
||||||
struct qed_filter_accept_flags *flags = ¶ms->accept_flags;
|
struct qed_filter_accept_flags *flags = ¶ms->accept_flags;
|
||||||
struct qed_public_vf_info *vf_info;
|
struct qed_public_vf_info *vf_info;
|
||||||
|
u16 tlv_mask;
|
||||||
|
|
||||||
|
tlv_mask = BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM) |
|
||||||
|
BIT(QED_IOV_VP_UPDATE_ACCEPT_ANY_VLAN);
|
||||||
|
|
||||||
/* Untrusted VFs can't even be trusted to know that fact.
|
/* Untrusted VFs can't even be trusted to know that fact.
|
||||||
* Simply indicate everything is configured fine, and trace
|
* Simply indicate everything is configured fine, and trace
|
||||||
* configuration 'behind their back'.
|
* configuration 'behind their back'.
|
||||||
*/
|
*/
|
||||||
if (!(*tlvs & BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM)))
|
if (!(*tlvs & tlv_mask))
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
vf_info = qed_iov_get_public_vf_info(hwfn, vfid, true);
|
vf_info = qed_iov_get_public_vf_info(hwfn, vfid, true);
|
||||||
|
@ -3004,6 +3008,13 @@ static int qed_iov_pre_update_vport(struct qed_hwfn *hwfn,
|
||||||
flags->tx_accept_filter &= ~mask;
|
flags->tx_accept_filter &= ~mask;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (params->update_accept_any_vlan_flg) {
|
||||||
|
vf_info->accept_any_vlan = params->accept_any_vlan;
|
||||||
|
|
||||||
|
if (vf_info->forced_vlan && !vf_info->is_trusted_configured)
|
||||||
|
params->accept_any_vlan = false;
|
||||||
|
}
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -5122,6 +5133,12 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)
|
||||||
|
|
||||||
params.update_ctl_frame_check = 1;
|
params.update_ctl_frame_check = 1;
|
||||||
params.mac_chk_en = !vf_info->is_trusted_configured;
|
params.mac_chk_en = !vf_info->is_trusted_configured;
|
||||||
|
params.update_accept_any_vlan_flg = 0;
|
||||||
|
|
||||||
|
if (vf_info->accept_any_vlan && vf_info->forced_vlan) {
|
||||||
|
params.update_accept_any_vlan_flg = 1;
|
||||||
|
params.accept_any_vlan = vf_info->accept_any_vlan;
|
||||||
|
}
|
||||||
|
|
||||||
if (vf_info->rx_accept_mode & mask) {
|
if (vf_info->rx_accept_mode & mask) {
|
||||||
flags->update_rx_mode_config = 1;
|
flags->update_rx_mode_config = 1;
|
||||||
|
@ -5137,13 +5154,20 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)
|
||||||
if (!vf_info->is_trusted_configured) {
|
if (!vf_info->is_trusted_configured) {
|
||||||
flags->rx_accept_filter &= ~mask;
|
flags->rx_accept_filter &= ~mask;
|
||||||
flags->tx_accept_filter &= ~mask;
|
flags->tx_accept_filter &= ~mask;
|
||||||
|
params.accept_any_vlan = false;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (flags->update_rx_mode_config ||
|
if (flags->update_rx_mode_config ||
|
||||||
flags->update_tx_mode_config ||
|
flags->update_tx_mode_config ||
|
||||||
params.update_ctl_frame_check)
|
params.update_ctl_frame_check ||
|
||||||
|
params.update_accept_any_vlan_flg) {
|
||||||
|
DP_VERBOSE(hwfn, QED_MSG_IOV,
|
||||||
|
"vport update config for %s VF[abs 0x%x rel 0x%x]\n",
|
||||||
|
vf_info->is_trusted_configured ? "trusted" : "untrusted",
|
||||||
|
vf->abs_vf_id, vf->relative_vf_id);
|
||||||
qed_sp_vport_update(hwfn, ¶ms,
|
qed_sp_vport_update(hwfn, ¶ms,
|
||||||
QED_SPQ_MODE_EBLOCK, NULL);
|
QED_SPQ_MODE_EBLOCK, NULL);
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -62,6 +62,7 @@ struct qed_public_vf_info {
|
||||||
bool is_trusted_request;
|
bool is_trusted_request;
|
||||||
u8 rx_accept_mode;
|
u8 rx_accept_mode;
|
||||||
u8 tx_accept_mode;
|
u8 tx_accept_mode;
|
||||||
|
bool accept_any_vlan;
|
||||||
};
|
};
|
||||||
|
|
||||||
struct qed_iov_vf_init_params {
|
struct qed_iov_vf_init_params {
|
||||||
|
|
Загрузка…
Ссылка в новой задаче