Commit be96815c authored by Jacob Keller's avatar Jacob Keller Committed by Tony Nguyen
Browse files

ice: call ice_is_malicious_vf() from ice_vc_process_vf_msg() 



The main loop in __ice_clean_ctrlq first checks if a VF might be malicious
before calling ice_vc_process_vf_msg(). This results in duplicate code in
both functions to obtain a reference to the VF, and exports the
ice_is_malicious_vf() from ice_virtchnl.c unnecessarily.

Refactor ice_is_malicious_vf() to be a static function that takes a pointer
to the VF. Call this in ice_vc_process_vf_msg() just after we obtain a
reference to the VF by calling ice_get_vf_by_id.

Pass the mailbox data from the __ice_clean_ctrlq function into
ice_vc_process_vf_msg() instead of calling ice_is_malicious_vf().

This reduces the number of exported functions and avoids the need to obtain
the VF reference twice for every mailbox message.

Note that the state check for ICE_VF_STATE_DIS is kept in
ice_is_malicious_vf() and we call this before checking that state in
ice_vc_process_vf_msg. This is intentional, as we stop responding to VF
messages from a VF once we detect that it may be overflowing the mailbox.
This ensures that we continue to silently ignore the message as before
without responding via ice_vc_send_msg_to_vf().

Signed-off-by: default avatarJacob Keller <jacob.e.keller@intel.com>
Reviewed-by: default avatarMichal Swiatkowski <michal.swiatkowski@linux.intel.com>
Tested-by: default avatarMarek Szlosek <marek.szlosek@intel.com>
Signed-off-by: default avatarTony Nguyen <anthony.l.nguyen@intel.com>
parent c414463a

drivers/net/ethernet/intel/ice/ice_main.c

+1 −2
Original line number Diff line number Diff line
@@ -1517,8 +1517,7 @@ static int __ice_clean_ctrlq(struct ice_pf *pf, enum ice_ctl_q q_type) 
			data.max_num_msgs_mbx = hw->mailboxq.num_rq_entries;

			data.async_watermark_val = ICE_MBX_OVERFLOW_WATERMARK;



			if (!ice_is_malicious_vf(pf, &event, &data))

				ice_vc_process_vf_msg(pf, &event);

			ice_vc_process_vf_msg(pf, &event, &data);

			break;

		case ice_aqc_opc_fw_logging:

			ice_output_fw_log(hw, &event.desc, event.msg_buf);

drivers/net/ethernet/intel/ice/ice_virtchnl.c

+19 −17
Original line number Diff line number Diff line
@@ -3834,27 +3834,26 @@ void ice_virtchnl_set_repr_ops(struct ice_vf *vf) 
}



/**

 * ice_is_malicious_vf - helper function to detect a malicious VF

 * @pf: ptr to struct ice_pf

 * @event: pointer to the AQ event

 * ice_is_malicious_vf - check if this vf might be overflowing mailbox

 * @vf: the VF to check

 * @mbxdata: data about the state of the mailbox

 *

 * Detect if a given VF might be malicious and attempting to overflow the PF

 * mailbox. If so, log a warning message and ignore this event.

 */

bool

ice_is_malicious_vf(struct ice_pf *pf, struct ice_rq_event_info *event,

		    struct ice_mbx_data *mbxdata)

static bool

ice_is_malicious_vf(struct ice_vf *vf, struct ice_mbx_data *mbxdata)

{

	s16 vf_id = le16_to_cpu(event->desc.retval);

	struct device *dev = ice_pf_to_dev(pf);

	bool report_malvf = false;

	struct ice_vf *vf;

	struct device *dev;

	struct ice_pf *pf;

	int status;



	vf = ice_get_vf_by_id(pf, vf_id);

	if (!vf)

		return false;

	pf = vf->pf;

	dev = ice_pf_to_dev(pf);



	if (test_bit(ICE_VF_STATE_DIS, vf->vf_states))

		goto out_put_vf;

		return vf->mbx_info.malicious;



	/* check to see if we have a newly malicious VF */

	status = ice_mbx_vf_state_handler(&pf->hw, mbxdata, &vf->mbx_info,
@@ -3872,9 +3871,6 @@ ice_is_malicious_vf(struct ice_pf *pf, struct ice_rq_event_info *event, 
			 pf_vsi ? pf_vsi->netdev->dev_addr : zero_addr);

	}



out_put_vf:

	ice_put_vf(vf);



	return vf->mbx_info.malicious;

}
@@ -3882,11 +3878,13 @@ ice_is_malicious_vf(struct ice_pf *pf, struct ice_rq_event_info *event, 
 * ice_vc_process_vf_msg - Process request from VF

 * @pf: pointer to the PF structure

 * @event: pointer to the AQ event

 * @mbxdata: information used to detect VF attempting mailbox overflow

 *

 * called from the common asq/arq handler to

 * process request from VF

 */

void ice_vc_process_vf_msg(struct ice_pf *pf, struct ice_rq_event_info *event)

void ice_vc_process_vf_msg(struct ice_pf *pf, struct ice_rq_event_info *event,

			   struct ice_mbx_data *mbxdata)

{

	u32 v_opcode = le32_to_cpu(event->desc.cookie_high);

	s16 vf_id = le16_to_cpu(event->desc.retval);
@@ -3908,6 +3906,10 @@ void ice_vc_process_vf_msg(struct ice_pf *pf, struct ice_rq_event_info *event) 


	mutex_lock(&vf->cfg_lock);



	/* Check if the VF is trying to overflow the mailbox */

	if (ice_is_malicious_vf(vf, mbxdata))

		goto finish;



	/* Check if VF is disabled. */

	if (test_bit(ICE_VF_STATE_DIS, vf->vf_states)) {

		err = -EPERM;

drivers/net/ethernet/intel/ice/ice_virtchnl.h

+4 −13
Original line number Diff line number Diff line
@@ -63,10 +63,8 @@ int 
ice_vc_send_msg_to_vf(struct ice_vf *vf, u32 v_opcode,

		      enum virtchnl_status_code v_retval, u8 *msg, u16 msglen);

bool ice_vc_isvalid_vsi_id(struct ice_vf *vf, u16 vsi_id);

bool

ice_is_malicious_vf(struct ice_pf *pf, struct ice_rq_event_info *event,

void ice_vc_process_vf_msg(struct ice_pf *pf, struct ice_rq_event_info *event,

			   struct ice_mbx_data *mbxdata);

void ice_vc_process_vf_msg(struct ice_pf *pf, struct ice_rq_event_info *event);

#else /* CONFIG_PCI_IOV */

static inline void ice_virtchnl_set_dflt_ops(struct ice_vf *vf) { }

static inline void ice_virtchnl_set_repr_ops(struct ice_vf *vf) { }
@@ -86,16 +84,9 @@ static inline bool ice_vc_isvalid_vsi_id(struct ice_vf *vf, u16 vsi_id) 
	return false;

}



static inline bool

ice_is_malicious_vf(struct ice_pf __always_unused *pf,

		    struct ice_rq_event_info __always_unused *event,

		    struct ice_mbx_data *mbxdata)

{

	return false;

}



static inline void

ice_vc_process_vf_msg(struct ice_pf *pf, struct ice_rq_event_info *event)

ice_vc_process_vf_msg(struct ice_pf *pf, struct ice_rq_event_info *event,

		      struct ice_mbx_data *mbxdata)

{

}

#endif /* !CONFIG_PCI_IOV */