From patchwork Wed Jul 27 03:30:12 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Cengiz Can X-Patchwork-Id: 1661066 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=APLpKC5q; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4Lszw55cksz9s1l for ; Wed, 27 Jul 2022 13:36:21 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1oGXqJ-0003qN-1k; Wed, 27 Jul 2022 03:36:15 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1oGXqH-0003qF-30 for kernel-team@lists.ubuntu.com; Wed, 27 Jul 2022 03:36:13 +0000 Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id D15723F0DA for ; Wed, 27 Jul 2022 03:36:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1658892972; bh=C03q99EymKtr87S9qn78hfuS6InJhNv6efUwUSGsM0Y=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=APLpKC5qzQDsreqrymjK3OOUL+QnmiXCQ+agTkBXsRyU40Z8oD8XZk5etNxm+iYCh dqZSwOzKamTzfpKXviG7q/KT7EDSnqY3G7nX+F8h+8aDoWTccd+aQgR1XVfjlfZXBl 6zt25K8yElCm0ymY0iZ/yzaEB9dV7RQo7h+6njg31rK32RjoQ73mh3VJWLTKm3vbbP YK4PJt67+++cYSrprzkkrUNGy59WoJcnpmSE5AlmfpB9V5UVcKpx2vltZccj5Yy167 tsVvyRzlqU4ZbzfNyhg7/Wk8WNEIL8eC2olMyRv0SGsV+ccnSG8g7qthm+1lHMY+UE DImd9OblyqK0A== Received: by mail-wr1-f70.google.com with SMTP id e19-20020adfa453000000b0021eb66639cbso589586wra.6 for ; Tue, 26 Jul 2022 20:36:12 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=C03q99EymKtr87S9qn78hfuS6InJhNv6efUwUSGsM0Y=; b=c4l6Q7xMWnrv92JGZWAdAn7s8clXfzRzbTKU1hbTvmouGgGMSODt3lB0MpndhJmur/ /wXTr3O/BZu6a7kkGAj0W0VYJsp6CWtEN+F7TA5bKL5dJt3A+1Gp5Dn++3GA0cYHzerQ zxmcBQxmbPuSUmM64RH6+/gpz4W2zyTVoABRa2r2P6zhei9nnfszDMjgTw5eYrTO1K0o tXGkayyXddNx+qbcrpC/kudC7IEEpFASU3v1vKMx2c575zmXFlGyg5AAPswCB0+tzf1L hQiqAyN+NZ49B+AgADWL6Up65EHoWzf02R50afTFNjA3m3m6F6aC1wzuDLompPS2mjdA QJ4g== X-Gm-Message-State: AJIora+36adbIK0lbqWt6lxvgs5oeEENJ6myZCaHanoyaO9Kk2Ntfk7d i4ij/ToBzKMhD+0Mq2qME5S+sTikDkBv6NMkwyQV8lpMib1AYn1KvAory1ja9bTAentgQnsszXR AYwEk8JSqb5H05/4AewJvYvxc/R/VZ6KjW+HvmBHHiw== X-Received: by 2002:a05:600c:3d06:b0:3a3:58f6:9d96 with SMTP id bh6-20020a05600c3d0600b003a358f69d96mr1327229wmb.195.1658892972119; Tue, 26 Jul 2022 20:36:12 -0700 (PDT) X-Google-Smtp-Source: AGRyM1shVKKdfxWv0ixmEy9m2k090KJ/1QQ8+XroNaUxZ+Ncn6T9qpsR9DDHmlkJf46czxYfP/N9Zg== X-Received: by 2002:a05:600c:3d06:b0:3a3:58f6:9d96 with SMTP id bh6-20020a05600c3d0600b003a358f69d96mr1327220wmb.195.1658892971827; Tue, 26 Jul 2022 20:36:11 -0700 (PDT) Received: from localhost ([176.217.102.98]) by smtp.gmail.com with ESMTPSA id bg2-20020a05600c3c8200b003a35ec4bf4fsm767003wmb.20.2022.07.26.20.36.10 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 Jul 2022 20:36:11 -0700 (PDT) From: Cengiz Can To: kernel-team@lists.ubuntu.com Subject: [SRU Focal PATCH 2/3] ixgbe: add improvement for MDD response functionality Date: Wed, 27 Jul 2022 06:30:12 +0300 Message-Id: <20220727033008.305450-3-cengiz.can@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220727033008.305450-1-cengiz.can@canonical.com> References: <20220727033008.305450-1-cengiz.can@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Slawomir Mrozowicz The 82599 PF driver disable VF driver after a special MDD event occurs. Adds the option for administrators to control whether VFs are automatically disabled after several MDD events. The automatically disabling is now the default mode for 82599 PF driver, as it is more reliable. This addresses CVE-2021-33061. Signed-off-by: Slawomir Mrozowicz Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen CVE-2021-33061 (backported from commit 008ca35f6e87be1d60b6af3d1ae247c6d5c2531d) [cengizcan: we don't have commit dc221851ffd1 ("ixgbe: convert to new udp_tunnel_nic infra") from 5.9 so change context accordingly] Signed-off-by: Cengiz Can --- drivers/net/ethernet/intel/ixgbe/ixgbe.h | 4 +++ .../net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 21 ++++++++++++++ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 28 ++++++++++++++++++- 3 files changed, 52 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe.h index 4da26e8817e40..4cb413f495a55 100644 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h @@ -184,6 +184,7 @@ struct vf_data_storage { u8 trusted; int xcast_mode; unsigned int vf_api; + u8 primary_abort_count; }; enum ixgbevf_xcast_modes { @@ -555,6 +556,8 @@ struct ixgbe_mac_addr { #define IXGBE_TRY_LINK_TIMEOUT (4 * HZ) #define IXGBE_SFP_POLL_JIFFIES (2 * HZ) /* SFP poll every 2 seconds */ +#define IXGBE_PRIMARY_ABORT_LIMIT 5 + /* board specific private data structure */ struct ixgbe_adapter { unsigned long active_vlans[BITS_TO_LONGS(VLAN_N_VID)]; @@ -616,6 +619,7 @@ struct ixgbe_adapter { #define IXGBE_FLAG2_RX_LEGACY BIT(16) #define IXGBE_FLAG2_IPSEC_ENABLED BIT(17) #define IXGBE_FLAG2_VF_IPSEC_ENABLED BIT(18) +#define IXGBE_FLAG2_AUTO_DISABLE_VF BIT(19) /* Tx fast path data */ int num_tx_queues; diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c index 7c52ae8ac005b..0a1e5f2b57c22 100644 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c @@ -138,6 +138,8 @@ static const char ixgbe_priv_flags_strings[][ETH_GSTRING_LEN] = { "legacy-rx", #define IXGBE_PRIV_FLAGS_VF_IPSEC_EN BIT(1) "vf-ipsec", +#define IXGBE_PRIV_FLAGS_AUTO_DISABLE_VF BIT(2) + "mdd-disable-vf", }; #define IXGBE_PRIV_FLAGS_STR_LEN ARRAY_SIZE(ixgbe_priv_flags_strings) @@ -3416,6 +3418,9 @@ static u32 ixgbe_get_priv_flags(struct net_device *netdev) if (adapter->flags2 & IXGBE_FLAG2_VF_IPSEC_ENABLED) priv_flags |= IXGBE_PRIV_FLAGS_VF_IPSEC_EN; + if (adapter->flags2 & IXGBE_FLAG2_AUTO_DISABLE_VF) + priv_flags |= IXGBE_PRIV_FLAGS_AUTO_DISABLE_VF; + return priv_flags; } @@ -3423,6 +3428,7 @@ static int ixgbe_set_priv_flags(struct net_device *netdev, u32 priv_flags) { struct ixgbe_adapter *adapter = netdev_priv(netdev); unsigned int flags2 = adapter->flags2; + unsigned int i; flags2 &= ~IXGBE_FLAG2_RX_LEGACY; if (priv_flags & IXGBE_PRIV_FLAGS_LEGACY_RX) @@ -3432,6 +3438,21 @@ static int ixgbe_set_priv_flags(struct net_device *netdev, u32 priv_flags) if (priv_flags & IXGBE_PRIV_FLAGS_VF_IPSEC_EN) flags2 |= IXGBE_FLAG2_VF_IPSEC_ENABLED; + flags2 &= ~IXGBE_FLAG2_AUTO_DISABLE_VF; + if (priv_flags & IXGBE_PRIV_FLAGS_AUTO_DISABLE_VF) { + if (adapter->hw.mac.type == ixgbe_mac_82599EB) { + /* Reset primary abort counter */ + for (i = 0; i < adapter->num_vfs; i++) + adapter->vfinfo[i].primary_abort_count = 0; + + flags2 |= IXGBE_FLAG2_AUTO_DISABLE_VF; + } else { + e_info(probe, + "Cannot set private flags: Operation not supported\n"); + return -EOPNOTSUPP; + } + } + if (flags2 != adapter->flags2) { adapter->flags2 = flags2; diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c index 4e3a379c310a5..94a2c9ff5be89 100644 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c @@ -7625,6 +7625,27 @@ static void ixgbe_watchdog_flush_tx(struct ixgbe_adapter *adapter) } #ifdef CONFIG_PCI_IOV +static void ixgbe_bad_vf_abort(struct ixgbe_adapter *adapter, u32 vf) +{ + struct ixgbe_hw *hw = &adapter->hw; + + if (adapter->hw.mac.type == ixgbe_mac_82599EB && + adapter->flags2 & IXGBE_FLAG2_AUTO_DISABLE_VF) { + adapter->vfinfo[vf].primary_abort_count++; + if (adapter->vfinfo[vf].primary_abort_count == + IXGBE_PRIMARY_ABORT_LIMIT) { + ixgbe_set_vf_link_state(adapter, vf, + IFLA_VF_LINK_STATE_DISABLE); + adapter->vfinfo[vf].primary_abort_count = 0; + + e_info(drv, + "Malicious Driver Detection event detected on PF %d VF %d MAC: %pM mdd-disable-vf=on", + hw->bus.func, vf, + adapter->vfinfo[vf].vf_mac_addresses); + } + } +} + static void ixgbe_check_for_bad_vf(struct ixgbe_adapter *adapter) { struct ixgbe_hw *hw = &adapter->hw; @@ -7656,8 +7677,10 @@ static void ixgbe_check_for_bad_vf(struct ixgbe_adapter *adapter) continue; pci_read_config_word(vfdev, PCI_STATUS, &status_reg); if (status_reg != IXGBE_FAILED_READ_CFG_WORD && - status_reg & PCI_STATUS_REC_MASTER_ABORT) + status_reg & PCI_STATUS_REC_MASTER_ABORT) { + ixgbe_bad_vf_abort(adapter, vf); pcie_flr(vfdev); + } } } @@ -10875,6 +10898,9 @@ static int ixgbe_probe(struct pci_dev *pdev, const struct pci_device_id *ent) if (err) goto err_sw_init; + if (adapter->hw.mac.type == ixgbe_mac_82599EB) + adapter->flags2 |= IXGBE_FLAG2_AUTO_DISABLE_VF; + /* Make sure the SWFW semaphore is in a valid state */ if (hw->mac.ops.init_swfw_sync) hw->mac.ops.init_swfw_sync(hw);