ice: Add function to program ethertype based filter rule on VSIs

This patch adds function to program VSI with ethertype based filter rule,
so that all flow control frames would be disallowed from being transmitted
to the client, in order to prevent malicious VSI, especially VF from
sending out PAUSE or PFC frames, and then control other VSIs traffic.

Signed-off-by: Akeem G Abodunrin <akeem.g.abodunrin@intel.com>
Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
index 6f970edf50c79beedd2ef5ae201cfd9fa74968cd..792e6e42030e164dd4800c105792d3e3db1b40d5 100644 (file)
--- a/drivers/net/ethernet/intel/ice/ice.h
+++ b/drivers/net/ethernet/intel/ice/ice.h
@@ -255,6 +255,8 @@ struct ice_vsi {
 
        s16 vf_id;                      /* VF ID for SR-IOV VSIs */
 
+       u16 ethtype;                    /* Ethernet protocol for pause frame */
+
        /* RSS config */
        u16 rss_table_size;     /* HW RSS table size */
        u16 rss_size;           /* Allocated RSS queues */

diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
index 7a88bf639376c20ac3661fc4a981238c819aada2..fbf1eba0cc2afe5c7038209e40ab01925d8d30b0 100644 (file)
--- a/drivers/net/ethernet/intel/ice/ice_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_lib.c
@@ -2250,6 +2250,46 @@ ice_vsi_set_q_vectors_reg_idx(struct ice_vsi *vsi)
        return -EINVAL;
 }
 
+/**
+ * ice_vsi_add_rem_eth_mac - Program VSI ethertype based filter with rule
+ * @vsi: the VSI being configured
+ * @add_rule: boolean value to add or remove ethertype filter rule
+ */
+static void
+ice_vsi_add_rem_eth_mac(struct ice_vsi *vsi, bool add_rule)
+{
+       struct ice_fltr_list_entry *list;
+       struct ice_pf *pf = vsi->back;
+       LIST_HEAD(tmp_add_list);
+       enum ice_status status;
+
+       list = devm_kzalloc(&pf->pdev->dev, sizeof(*list), GFP_KERNEL);
+       if (!list)
+               return;
+
+       list->fltr_info.lkup_type = ICE_SW_LKUP_ETHERTYPE;
+       list->fltr_info.fltr_act = ICE_DROP_PACKET;
+       list->fltr_info.flag = ICE_FLTR_TX;
+       list->fltr_info.src_id = ICE_SRC_ID_VSI;
+       list->fltr_info.vsi_handle = vsi->idx;
+       list->fltr_info.l_data.ethertype_mac.ethertype = vsi->ethtype;
+
+       INIT_LIST_HEAD(&list->list_entry);
+       list_add(&list->list_entry, &tmp_add_list);
+
+       if (add_rule)
+               status = ice_add_eth_mac(&pf->hw, &tmp_add_list);
+       else
+               status = ice_remove_eth_mac(&pf->hw, &tmp_add_list);
+
+       if (status)
+               dev_err(&pf->pdev->dev,
+                       "Failure Adding or Removing Ethertype on VSI %i error: %d\n",
+                       vsi->vsi_num, status);
+
+       ice_free_fltr_list(&pf->pdev->dev, &tmp_add_list);
+}
+
 /**
  * ice_vsi_setup - Set up a VSI by a given type
  * @pf: board private structure
@@ -2285,6 +2325,9 @@ ice_vsi_setup(struct ice_pf *pf, struct ice_port_info *pi,
 
        vsi->port_info = pi;
        vsi->vsw = pf->first_sw;
+       if (vsi->type == ICE_VSI_PF)
+               vsi->ethtype = ETH_P_PAUSE;
+
        if (vsi->type == ICE_VSI_VF)
                vsi->vf_id = vf_id;
 
@@ -2382,6 +2425,15 @@ ice_vsi_setup(struct ice_pf *pf, struct ice_port_info *pi,
                goto unroll_vector_base;
        }
 
+       /* Add switch rule to drop all Tx Flow Control Frames, of look up
+        * type ETHERTYPE from VSIs, and restrict malicious VF from sending
+        * out PAUSE or PFC frames. If enabled, FW can still send FC frames.
+        * The rule is added once for PF VSI in order to create appropriate
+        * recipe, since VSI/VSI list is ignored with drop action...
+        */
+       if (vsi->type == ICE_VSI_PF)
+               ice_vsi_add_rem_eth_mac(vsi, true);
+
        return vsi;
 
 unroll_vector_base:
@@ -2740,6 +2792,9 @@ int ice_vsi_release(struct ice_vsi *vsi)
                pf->num_avail_hw_msix += pf->num_vf_msix;
        }
 
+       if (vsi->type == ICE_VSI_PF)
+               ice_vsi_add_rem_eth_mac(vsi, false);
+
        ice_remove_vsi_fltr(&pf->hw, vsi->idx);
        ice_rm_vsi_lan_cfg(vsi->port_info, vsi->idx);
        ice_vsi_delete(vsi);

diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c
index 81f44939c859738f708cabc87346f20efbc23ee6..9f1f595ae7e67ba9d107d560786be660b9c6fcf6 100644 (file)
--- a/drivers/net/ethernet/intel/ice/ice_switch.c
+++ b/drivers/net/ethernet/intel/ice/ice_switch.c
@@ -1969,6 +1969,65 @@ ice_add_vlan(struct ice_hw *hw, struct list_head *v_list)
        return 0;
 }
 
+/**
+ * ice_add_eth_mac - Add ethertype and MAC based filter rule
+ * @hw: pointer to the hardware structure
+ * @em_list: list of ether type MAC filter, MAC is optional
+ */
+enum ice_status
+ice_add_eth_mac(struct ice_hw *hw, struct list_head *em_list)
+{
+       struct ice_fltr_list_entry *em_list_itr;
+
+       if (!em_list || !hw)
+               return ICE_ERR_PARAM;
+
+       list_for_each_entry(em_list_itr, em_list, list_entry) {
+               enum ice_sw_lkup_type l_type =
+                       em_list_itr->fltr_info.lkup_type;
+
+               if (l_type != ICE_SW_LKUP_ETHERTYPE_MAC &&
+                   l_type != ICE_SW_LKUP_ETHERTYPE)
+                       return ICE_ERR_PARAM;
+
+               em_list_itr->fltr_info.flag = ICE_FLTR_TX;
+               em_list_itr->status = ice_add_rule_internal(hw, l_type,
+                                                           em_list_itr);
+               if (em_list_itr->status)
+                       return em_list_itr->status;
+       }
+       return 0;
+}
+
+/**
+ * ice_remove_eth_mac - Remove an ethertype (or MAC) based filter rule
+ * @hw: pointer to the hardware structure
+ * @em_list: list of ethertype or ethertype MAC entries
+ */
+enum ice_status
+ice_remove_eth_mac(struct ice_hw *hw, struct list_head *em_list)
+{
+       struct ice_fltr_list_entry *em_list_itr, *tmp;
+
+       if (!em_list || !hw)
+               return ICE_ERR_PARAM;
+
+       list_for_each_entry_safe(em_list_itr, tmp, em_list, list_entry) {
+               enum ice_sw_lkup_type l_type =
+                       em_list_itr->fltr_info.lkup_type;
+
+               if (l_type != ICE_SW_LKUP_ETHERTYPE_MAC &&
+                   l_type != ICE_SW_LKUP_ETHERTYPE)
+                       return ICE_ERR_PARAM;
+
+               em_list_itr->status = ice_remove_rule_internal(hw, l_type,
+                                                              em_list_itr);
+               if (em_list_itr->status)
+                       return em_list_itr->status;
+       }
+       return 0;
+}
+
 /**
  * ice_rem_sw_rule_info
  * @hw: pointer to the hardware structure

diff --git a/drivers/net/ethernet/intel/ice/ice_switch.h b/drivers/net/ethernet/intel/ice/ice_switch.h
index 88eb4be4d5a497434d97943fef4be57e2b3eb589..732b0b9b2e156616c984763f41490ef607dc446a 100644 (file)
--- a/drivers/net/ethernet/intel/ice/ice_switch.h
+++ b/drivers/net/ethernet/intel/ice/ice_switch.h
@@ -218,6 +218,10 @@ enum ice_status ice_get_initial_sw_cfg(struct ice_hw *hw);
 enum ice_status ice_update_sw_rule_bridge_mode(struct ice_hw *hw);
 enum ice_status ice_add_mac(struct ice_hw *hw, struct list_head *m_lst);
 enum ice_status ice_remove_mac(struct ice_hw *hw, struct list_head *m_lst);
+enum ice_status
+ice_add_eth_mac(struct ice_hw *hw, struct list_head *em_list);
+enum ice_status
+ice_remove_eth_mac(struct ice_hw *hw, struct list_head *em_list);
 void ice_remove_vsi_fltr(struct ice_hw *hw, u16 vsi_handle);
 enum ice_status
 ice_add_vlan(struct ice_hw *hw, struct list_head *m_list);