Commit 6d23efab authored by Paul Greenwalt's avatar Paul Greenwalt Committed by Ye Bin
Browse files

ice: add E830 HW VF mailbox message limit support 

stable inclusion
from stable-v6.6.81
commit 52a98adcc48ed8d7834243a2b4c38f92b1770722
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVSV
CVE: CVE-2025-21883

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=52a98adcc48ed8d7834243a2b4c38f92b1770722



--------------------------------

[ Upstream commit 59f4d59b25aec39a015c0949f4ec235c7a839c44 ]

E830 adds hardware support to prevent the VF from overflowing the PF
mailbox with VIRTCHNL messages. E830 will use the hardware feature
(ICE_F_MBX_LIMIT) instead of the software solution ice_is_malicious_vf().

To prevent a VF from overflowing the PF, the PF sets the number of
messages per VF that can be in the PF's mailbox queue
(ICE_MBX_OVERFLOW_WATERMARK). When the PF processes a message from a VF,
the PF decrements the per VF message count using the E830_MBX_VF_DEC_TRIG
register.

Signed-off-by: default avatarPaul Greenwalt <paul.greenwalt@intel.com>
Reviewed-by: default avatarAlexander Lobakin <aleksander.lobakin@intel.com>
Tested-by: default avatarRafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
Stable-dep-of: 79990cf5e7ad ("ice: Fix deinitializing VF in error path")
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarYe Bin <yebin10@huawei.com>
parent 0c1bc63a

drivers/net/ethernet/intel/ice/ice.h

+1 −0
Original line number Diff line number Diff line
@@ -202,6 +202,7 @@ enum ice_feature { 
	ICE_F_GNSS,

	ICE_F_ROCE_LAG,

	ICE_F_SRIOV_LAG,

	ICE_F_MBX_LIMIT,

	ICE_F_MAX

};

drivers/net/ethernet/intel/ice/ice_hw_autogen.h

+3 −0
Original line number Diff line number Diff line
@@ -528,5 +528,8 @@ 
#define E830_PRTMAC_CL01_QNT_THR_CL0_M		GENMASK(15, 0)

#define VFINT_DYN_CTLN(_i)			(0x00003800 + ((_i) * 4))

#define VFINT_DYN_CTLN_CLEARPBA_M		BIT(1)

#define E830_MBX_PF_IN_FLIGHT_VF_MSGS_THRESH	0x00234000

#define E830_MBX_VF_DEC_TRIG(_VF)		(0x00233800 + (_VF) * 4)

#define E830_MBX_VF_IN_FLIGHT_MSGS_AT_PF_CNT(_VF)	(0x00233000 + (_VF) * 4)



#endif /* _ICE_HW_AUTOGEN_H_ */

drivers/net/ethernet/intel/ice/ice_lib.c

+3 −0
Original line number Diff line number Diff line
@@ -4023,6 +4023,9 @@ void ice_init_feature_support(struct ice_pf *pf) 
	default:

		break;

	}



	if (pf->hw.mac_type == ICE_MAC_E830)

		ice_set_feature_support(pf, ICE_F_MBX_LIMIT);

}



/**

drivers/net/ethernet/intel/ice/ice_main.c

+18 −6
Original line number Diff line number Diff line
@@ -1514,12 +1514,20 @@ static int __ice_clean_ctrlq(struct ice_pf *pf, enum ice_ctl_q q_type) 
			ice_vf_lan_overflow_event(pf, &event);

			break;

		case ice_mbx_opc_send_msg_to_pf:

			if (ice_is_feature_supported(pf, ICE_F_MBX_LIMIT)) {

				ice_vc_process_vf_msg(pf, &event, NULL);

				ice_mbx_vf_dec_trig_e830(hw, &event);

			} else {

				u16 val = hw->mailboxq.num_rq_entries;



				data.max_num_msgs_mbx = val;

				val = ICE_MBX_OVERFLOW_WATERMARK;

				data.async_watermark_val = val;

				data.num_msg_proc = i;

				data.num_pending_arq = pending;

			data.max_num_msgs_mbx = hw->mailboxq.num_rq_entries;

			data.async_watermark_val = ICE_MBX_OVERFLOW_WATERMARK;



				ice_vc_process_vf_msg(pf, &event, &data);

			}

			break;

		case ice_aqc_opc_fw_logging:

			ice_output_fw_log(hw, &event.desc, event.msg_buf);
@@ -3920,6 +3928,10 @@ static int ice_init_pf(struct ice_pf *pf) 


	mutex_init(&pf->vfs.table_lock);

	hash_init(pf->vfs.table);

	if (ice_is_feature_supported(pf, ICE_F_MBX_LIMIT))

		wr32(&pf->hw, E830_MBX_PF_IN_FLIGHT_VF_MSGS_THRESH,

		     ICE_MBX_OVERFLOW_WATERMARK);

	else

		ice_mbx_init_snapshot(&pf->hw);



	return 0;

drivers/net/ethernet/intel/ice/ice_sriov.c

+2 −1
Original line number Diff line number Diff line
@@ -195,6 +195,7 @@ void ice_free_vfs(struct ice_pf *pf) 
		}



		/* clear malicious info since the VF is getting released */

		if (!ice_is_feature_supported(pf, ICE_F_MBX_LIMIT))

			list_del(&vf->mbx_info.list_entry);



		mutex_unlock(&vf->cfg_lock);