Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5f527ba9 authored by Anjali Singhai Jain's avatar Anjali Singhai Jain Committed by Jeff Kirsher
Browse files

i40e: Limit the number of MAC and VLAN addresses that can be added for VFs 



If the VF is privileged/trusted it can do as it may please including
but not limited to hogging resources and playing unfair.
But if the VF is not privileged/trusted it still can add some number
(8) of MAC and VLAN addresses.
Other restrictions with respect to Port VLAN and normal VLAN still apply
to not privileged/trusted VF.

Change-Id: I3a9529201b184c8873e1ad2e300aff468c9e6296
Signed-off-by: default avatarAnjali Singhai Jain <anjali.singhai@intel.com>
Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
parent 692fb0a7

drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c

+23 −2
Original line number Diff line number Diff line
@@ -1831,6 +1831,10 @@ static int i40e_vc_get_stats_msg(struct i40e_vf *vf, u8 *msg, u16 msglen) 
				      (u8 *)&stats, sizeof(stats));

}



/* If the VF is not trusted restrict the number of MAC/VLAN it can program */

#define I40E_VC_MAX_MAC_ADDR_PER_VF 8

#define I40E_VC_MAX_VLAN_PER_VF 8



/**

 * i40e_check_vf_permission

 * @vf: pointer to the VF info
@@ -1863,6 +1867,11 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf, u8 *macaddr) 
		dev_err(&pf->pdev->dev,

			"VF attempting to override administratively set MAC address, reload the VF driver to resume normal operation\n");

		ret = -EPERM;

	} else if ((vf->num_mac >= I40E_VC_MAX_MAC_ADDR_PER_VF) &&

		   !test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps)) {

		dev_err(&pf->pdev->dev,

			"VF is not trusted, switch the VF to trusted to add more functionality\n");

		ret = -EPERM;

	}

	return ret;

}
@@ -1924,6 +1933,8 @@ static int i40e_vc_add_mac_addr_msg(struct i40e_vf *vf, u8 *msg, u16 msglen) 
			ret = I40E_ERR_PARAM;

			spin_unlock_bh(&vsi->mac_filter_list_lock);

			goto error_param;

		} else {

			vf->num_mac++;

		}

	}

	spin_unlock_bh(&vsi->mac_filter_list_lock);
@@ -1982,6 +1993,8 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg, u16 msglen) 
			ret = I40E_ERR_INVALID_MAC_ADDR;

			spin_unlock_bh(&vsi->mac_filter_list_lock);

			goto error_param;

		} else {

			vf->num_mac--;

		}



	spin_unlock_bh(&vsi->mac_filter_list_lock);
@@ -2016,8 +2029,13 @@ static int i40e_vc_add_vlan_msg(struct i40e_vf *vf, u8 *msg, u16 msglen) 
	i40e_status aq_ret = 0;

	int i;



	if ((vf->num_vlan >= I40E_VC_MAX_VLAN_PER_VF) &&

	    !test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps)) {

		dev_err(&pf->pdev->dev,

			"VF is not trusted, switch the VF to trusted to add more VLAN addresses\n");

		goto error_param;

	}

	if (!test_bit(I40E_VF_STAT_ACTIVE, &vf->vf_states) ||

	    !test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps) ||

	    !i40e_vc_isvalid_vsi_id(vf, vsi_id)) {

		aq_ret = I40E_ERR_PARAM;

		goto error_param;
@@ -2041,6 +2059,8 @@ static int i40e_vc_add_vlan_msg(struct i40e_vf *vf, u8 *msg, u16 msglen) 
	for (i = 0; i < vfl->num_elements; i++) {

		/* add new VLAN filter */

		int ret = i40e_vsi_add_vlan(vsi, vfl->vlan_id[i]);

		if (!ret)

			vf->num_vlan++;



		if (test_bit(I40E_VF_STAT_UC_PROMISC, &vf->vf_states))

			i40e_aq_set_vsi_uc_promisc_on_vlan(&pf->hw, vsi->seid,
@@ -2083,7 +2103,6 @@ static int i40e_vc_remove_vlan_msg(struct i40e_vf *vf, u8 *msg, u16 msglen) 
	int i;



	if (!test_bit(I40E_VF_STAT_ACTIVE, &vf->vf_states) ||

	    !test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps) ||

	    !i40e_vc_isvalid_vsi_id(vf, vsi_id)) {

		aq_ret = I40E_ERR_PARAM;

		goto error_param;
@@ -2104,6 +2123,8 @@ static int i40e_vc_remove_vlan_msg(struct i40e_vf *vf, u8 *msg, u16 msglen) 


	for (i = 0; i < vfl->num_elements; i++) {

		int ret = i40e_vsi_kill_vlan(vsi, vfl->vlan_id[i]);

		if (!ret)

			vf->num_vlan--;



		if (test_bit(I40E_VF_STAT_UC_PROMISC, &vf->vf_states))

			i40e_aq_set_vsi_uc_promisc_on_vlan(&pf->hw, vsi->seid,

drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h

+3 −0
Original line number Diff line number Diff line
@@ -111,6 +111,9 @@ struct i40e_vf { 
	bool link_forced;

	bool link_up;		/* only valid if VF link is forced */

	bool spoofchk;

	u16 num_mac;

	u16 num_vlan;



	/* RDMA Client */

	struct i40e_virtchnl_iwarp_qvlist_info *qvlist_info;

};