Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a985b6c3 authored by Greg Rose's avatar Greg Rose Committed by Jeff Kirsher
Browse files

ixgbe: Add anti-spoofing feature support 



Add support for the anti-spoofing feature in the HW.  Packets from
VF devices with spoofed MAC addresses or VLAN tags will be blocked
and a counter incremented.  During the watchdog timer the spoofed
packet dropped counter is read and if it is non-zero then a warning
message is displayed on the host VMM's console.

Signed-off-by: default avatarGreg Rose <gregory.v.rose@intel.com>
Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
parent 3377eba7

drivers/net/ixgbe/ixgbe_82599.c

+2 −0
Original line number Diff line number Diff line
@@ -2165,6 +2165,8 @@ static struct ixgbe_mac_operations mac_ops_82599 = { 
	.fc_enable              = &ixgbe_fc_enable_generic,

	.init_uta_tables        = &ixgbe_init_uta_tables_generic,

	.setup_sfp              = &ixgbe_setup_sfp_modules_82599,

	.set_mac_anti_spoofing  = &ixgbe_set_mac_anti_spoofing,

	.set_vlan_anti_spoofing = &ixgbe_set_vlan_anti_spoofing,

};



static struct ixgbe_eeprom_operations eeprom_ops_82599 = {

drivers/net/ixgbe/ixgbe_common.c

+64 −0
Original line number Diff line number Diff line
@@ -2809,3 +2809,67 @@ s32 ixgbe_get_wwn_prefix_generic(struct ixgbe_hw *hw, u16 *wwnn_prefix, 
wwn_prefix_out:

	return 0;

}



/**

 *  ixgbe_set_mac_anti_spoofing - Enable/Disable MAC anti-spoofing

 *  @hw: pointer to hardware structure

 *  @enable: enable or disable switch for anti-spoofing

 *  @pf: Physical Function pool - do not enable anti-spoofing for the PF

 *

 **/

void ixgbe_set_mac_anti_spoofing(struct ixgbe_hw *hw, bool enable, int pf)

{

	int j;

	int pf_target_reg = pf >> 3;

	int pf_target_shift = pf % 8;

	u32 pfvfspoof = 0;



	if (hw->mac.type == ixgbe_mac_82598EB)

		return;



	if (enable)

		pfvfspoof = IXGBE_SPOOF_MACAS_MASK;



	/*

	 * PFVFSPOOF register array is size 8 with 8 bits assigned to

	 * MAC anti-spoof enables in each register array element.

	 */

	for (j = 0; j < IXGBE_PFVFSPOOF_REG_COUNT; j++)

		IXGBE_WRITE_REG(hw, IXGBE_PFVFSPOOF(j), pfvfspoof);



	/* If not enabling anti-spoofing then done */

	if (!enable)

		return;



	/*

	 * The PF should be allowed to spoof so that it can support

	 * emulation mode NICs.  Reset the bit assigned to the PF

	 */

	pfvfspoof = IXGBE_READ_REG(hw, IXGBE_PFVFSPOOF(pf_target_reg));

	pfvfspoof ^= (1 << pf_target_shift);

	IXGBE_WRITE_REG(hw, IXGBE_PFVFSPOOF(pf_target_reg), pfvfspoof);

}



/**

 *  ixgbe_set_vlan_anti_spoofing - Enable/Disable VLAN anti-spoofing

 *  @hw: pointer to hardware structure

 *  @enable: enable or disable switch for VLAN anti-spoofing

 *  @pf: Virtual Function pool - VF Pool to set for VLAN anti-spoofing

 *

 **/

void ixgbe_set_vlan_anti_spoofing(struct ixgbe_hw *hw, bool enable, int vf)

{

	int vf_target_reg = vf >> 3;

	int vf_target_shift = vf % 8 + IXGBE_SPOOF_VLANAS_SHIFT;

	u32 pfvfspoof;



	if (hw->mac.type == ixgbe_mac_82598EB)

		return;



	pfvfspoof = IXGBE_READ_REG(hw, IXGBE_PFVFSPOOF(vf_target_reg));

	if (enable)

		pfvfspoof |= (1 << vf_target_shift);

	else

		pfvfspoof &= ~(1 << vf_target_shift);

	IXGBE_WRITE_REG(hw, IXGBE_PFVFSPOOF(vf_target_reg), pfvfspoof);

}

drivers/net/ixgbe/ixgbe_common.h

+2 −0
Original line number Diff line number Diff line
@@ -88,6 +88,8 @@ s32 ixgbe_get_wwn_prefix_generic(struct ixgbe_hw *hw, u16 *wwnn_prefix, 
                                 u16 *wwpn_prefix);

s32 ixgbe_blink_led_start_generic(struct ixgbe_hw *hw, u32 index);

s32 ixgbe_blink_led_stop_generic(struct ixgbe_hw *hw, u32 index);

void ixgbe_set_mac_anti_spoofing(struct ixgbe_hw *hw, bool enable, int pf);

void ixgbe_set_vlan_anti_spoofing(struct ixgbe_hw *hw, bool enable, int vf);



#define IXGBE_WRITE_REG(a, reg, value) writel((value), ((a)->hw_addr + (reg)))

drivers/net/ixgbe/ixgbe_main.c

+24 −0
Original line number Diff line number Diff line
@@ -3132,6 +3132,9 @@ static void ixgbe_configure_virtualization(struct ixgbe_adapter *adapter) 


	/* enable Tx loopback for VF/PF communication */

	IXGBE_WRITE_REG(hw, IXGBE_PFDTXGSWC, IXGBE_PFDTXGSWC_VT_LBEN);

	/* Enable MAC Anti-Spoofing */

	hw->mac.ops.set_mac_anti_spoofing(hw, (adapter->num_vfs != 0),

					  adapter->num_vfs);

}



static void ixgbe_set_rx_buffer_len(struct ixgbe_adapter *adapter)
@@ -5960,6 +5963,26 @@ static void ixgbe_fdir_reinit_task(struct work_struct *work) 
	netif_tx_start_all_queues(adapter->netdev);

}



static void ixgbe_spoof_check(struct ixgbe_adapter *adapter)

{

	u32 ssvpc;



	/* Do not perform spoof check for 82598 */

	if (adapter->hw.mac.type == ixgbe_mac_82598EB)

		return;



	ssvpc = IXGBE_READ_REG(&adapter->hw, IXGBE_SSVPC);



	/*

	 * ssvpc register is cleared on read, if zero then no

	 * spoofed packets in the last interval.

	 */

	if (!ssvpc)

		return;



	e_warn(drv, "%d Spoofed packets detected\n", ssvpc);

}



static DEFINE_MUTEX(ixgbe_watchdog_lock);



/**
@@ -6080,6 +6103,7 @@ static void ixgbe_watchdog_task(struct work_struct *work) 
		}

	}



	ixgbe_spoof_check(adapter);

	ixgbe_update_stats(adapter);

	mutex_unlock(&ixgbe_watchdog_lock);

}

drivers/net/ixgbe/ixgbe_sriov.c

+10 −2
Original line number Diff line number Diff line
@@ -215,6 +215,11 @@ static inline void ixgbe_vf_reset_msg(struct ixgbe_adapter *adapter, u32 vf) 
	reg |= (reg | (1 << vf_shift));

	IXGBE_WRITE_REG(hw, IXGBE_VFRE(reg_offset), reg);



	/* Enable counting of spoofed packets in the SSVPC register */

	reg = IXGBE_READ_REG(hw, IXGBE_VMECM(reg_offset));

	reg |= (1 << vf_shift);

	IXGBE_WRITE_REG(hw, IXGBE_VMECM(reg_offset), reg);



	ixgbe_vf_reset_event(adapter, vf);

}
@@ -412,6 +417,7 @@ int ixgbe_ndo_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos) 
{

	int err = 0;

	struct ixgbe_adapter *adapter = netdev_priv(netdev);

	struct ixgbe_hw *hw = &adapter->hw;



	if ((vf >= adapter->num_vfs) || (vlan > 4095) || (qos > 7))

		return -EINVAL;
@@ -420,7 +426,8 @@ int ixgbe_ndo_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos) 
		if (err)

			goto out;

		ixgbe_set_vmvir(adapter, vlan | (qos << VLAN_PRIO_SHIFT), vf);

		ixgbe_set_vmolr(&adapter->hw, vf, false);

		ixgbe_set_vmolr(hw, vf, false);

		hw->mac.ops.set_vlan_anti_spoofing(hw, true, vf);

		adapter->vfinfo[vf].pf_vlan = vlan;

		adapter->vfinfo[vf].pf_qos = qos;

		dev_info(&adapter->pdev->dev,
@@ -437,7 +444,8 @@ int ixgbe_ndo_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos) 
		err = ixgbe_set_vf_vlan(adapter, false,

					adapter->vfinfo[vf].pf_vlan, vf);

		ixgbe_set_vmvir(adapter, vlan, vf);

		ixgbe_set_vmolr(&adapter->hw, vf, true);

		ixgbe_set_vmolr(hw, vf, true);

		hw->mac.ops.set_vlan_anti_spoofing(hw, false, vf);

		adapter->vfinfo[vf].pf_vlan = 0;

		adapter->vfinfo[vf].pf_qos = 0;

       }