Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/525260/?format=api
{ "id": 525260, "url": "http://patchwork.ozlabs.org/api/patches/525260/?format=api", "web_url": "http://patchwork.ozlabs.org/project/intel-wired-lan/patch/1443724661-92168-2-git-send-email-catherine.sullivan@intel.com/", "project": { "id": 46, "url": "http://patchwork.ozlabs.org/api/projects/46/?format=api", "name": "Intel Wired Ethernet development", "link_name": "intel-wired-lan", "list_id": "intel-wired-lan.osuosl.org", "list_email": "intel-wired-lan@osuosl.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<1443724661-92168-2-git-send-email-catherine.sullivan@intel.com>", "list_archive_url": null, "date": "2015-10-01T18:37:34", "name": "[next,S18,1/8] i40e/i40evf: Add a workaround to drop all flow control frames", "commit_ref": null, "pull_url": null, "state": "accepted", "archived": false, "hash": "441481dfa0bf3c2664e8957e297d9acd6e1b693d", "submitter": { "id": 13931, "url": "http://patchwork.ozlabs.org/api/people/13931/?format=api", "name": "Catherine Sullivan", "email": "catherine.sullivan@intel.com" }, "delegate": { "id": 68, "url": "http://patchwork.ozlabs.org/api/users/68/?format=api", "username": "jtkirshe", "first_name": "Jeff", "last_name": "Kirsher", "email": "jeffrey.t.kirsher@intel.com" }, "mbox": "http://patchwork.ozlabs.org/project/intel-wired-lan/patch/1443724661-92168-2-git-send-email-catherine.sullivan@intel.com/mbox/", "series": [], "comments": "http://patchwork.ozlabs.org/api/patches/525260/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/525260/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<intel-wired-lan-bounces@lists.osuosl.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "intel-wired-lan@lists.osuosl.org" ], "Delivered-To": [ "patchwork-incoming@bilbo.ozlabs.org", "intel-wired-lan@lists.osuosl.org" ], "Received": [ "from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137])\n\tby ozlabs.org (Postfix) with ESMTP id C2B16140D6E\n\tfor <incoming@patchwork.ozlabs.org>;\n\tFri, 2 Oct 2015 04:37:51 +1000 (AEST)", "from localhost (localhost [127.0.0.1])\n\tby fraxinus.osuosl.org (Postfix) with ESMTP id 1B5E4A36E3;\n\tThu, 1 Oct 2015 18:37:51 +0000 (UTC)", "from fraxinus.osuosl.org ([127.0.0.1])\n\tby localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n\twith ESMTP id Wf4jzLUPqAV0; Thu, 1 Oct 2015 18:37:50 +0000 (UTC)", "from ash.osuosl.org (ash.osuosl.org [140.211.166.34])\n\tby fraxinus.osuosl.org (Postfix) with ESMTP id 7AE46A36CB;\n\tThu, 1 Oct 2015 18:37:50 +0000 (UTC)", "from hemlock.osuosl.org (smtp2.osuosl.org [140.211.166.133])\n\tby ash.osuosl.org (Postfix) with ESMTP id 26AEB1CE788\n\tfor <intel-wired-lan@lists.osuosl.org>;\n\tThu, 1 Oct 2015 18:37:47 +0000 (UTC)", "from localhost (localhost [127.0.0.1])\n\tby hemlock.osuosl.org (Postfix) with ESMTP id 21F3788FBC\n\tfor <intel-wired-lan@lists.osuosl.org>;\n\tThu, 1 Oct 2015 18:37:47 +0000 (UTC)", "from hemlock.osuosl.org ([127.0.0.1])\n\tby localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)\n\twith ESMTP id 07h8Yo56Sh7s for <intel-wired-lan@lists.osuosl.org>;\n\tThu, 1 Oct 2015 18:37:45 +0000 (UTC)", "from mga09.intel.com (mga09.intel.com [134.134.136.24])\n\tby hemlock.osuosl.org (Postfix) with ESMTP id 67DC488058\n\tfor <intel-wired-lan@lists.osuosl.org>;\n\tThu, 1 Oct 2015 18:37:45 +0000 (UTC)", "from orsmga002.jf.intel.com ([10.7.209.21])\n\tby orsmga102.jf.intel.com with ESMTP; 01 Oct 2015 11:37:46 -0700", "from catheri1-tigger.jf.intel.com ([134.134.176.92])\n\tby orsmga002.jf.intel.com with ESMTP; 01 Oct 2015 11:37:43 -0700" ], "X-Virus-Scanned": [ "amavisd-new at osuosl.org", "amavisd-new at osuosl.org" ], "X-Greylist": "domain auto-whitelisted by SQLgrey-1.7.6", "X-ExtLoop1": "1", "X-IronPort-AV": "E=Sophos;i=\"5.17,619,1437462000\"; d=\"scan'208\";a=\"817391654\"", "From": "Catherine Sullivan <catherine.sullivan@intel.com>", "To": "intel-wired-lan@lists.osuosl.org", "Date": "Thu, 1 Oct 2015 14:37:34 -0400", "Message-Id": "<1443724661-92168-2-git-send-email-catherine.sullivan@intel.com>", "X-Mailer": "git-send-email 1.9.3", "In-Reply-To": "<1443724661-92168-1-git-send-email-catherine.sullivan@intel.com>", "References": "<1443724661-92168-1-git-send-email-catherine.sullivan@intel.com>", "Subject": "[Intel-wired-lan] [next PATCH S18 1/8] i40e/i40evf: Add a\n\tworkaround to drop all flow control frames", "X-BeenThere": "intel-wired-lan@lists.osuosl.org", "X-Mailman-Version": "2.1.18-1", "Precedence": "list", "List-Id": "Intel Wired Ethernet Linux Kernel Driver Development\n\t<intel-wired-lan.lists.osuosl.org>", "List-Unsubscribe": "<http://lists.osuosl.org/mailman/options/intel-wired-lan>, \n\t<mailto:intel-wired-lan-request@lists.osuosl.org?subject=unsubscribe>", "List-Archive": "<http://lists.osuosl.org/pipermail/intel-wired-lan/>", "List-Post": "<mailto:intel-wired-lan@lists.osuosl.org>", "List-Help": "<mailto:intel-wired-lan-request@lists.osuosl.org?subject=help>", "List-Subscribe": "<http://lists.osuosl.org/mailman/listinfo/intel-wired-lan>, \n\t<mailto:intel-wired-lan-request@lists.osuosl.org?subject=subscribe>", "MIME-Version": "1.0", "Content-Type": "text/plain; charset=\"us-ascii\"", "Content-Transfer-Encoding": "7bit", "Errors-To": "intel-wired-lan-bounces@lists.osuosl.org", "Sender": "\"Intel-wired-lan\" <intel-wired-lan-bounces@lists.osuosl.org>" }, "content": "From: Anjali Singhai Jain <anjali.singhai@intel.com>\n\nThis patch adds a workaround to drop any flow control frames from being\ntransmitted from any VSI. FW can still send flow control frames if flow\ncontrol is enabled.\n\nWith this patch in place a malicious VF cannot send flow control or PFC\npackets out on the wire.\n\nSigned-off-by: Anjali Singhai Jain <anjali.singhai@intel.com>\nChange-ID: I4303b24e98b93066d2767fec24dfe78be591c277\n---\n drivers/net/ethernet/intel/i40e/i40e_common.c | 22 ++++++++++++++++++++++\n drivers/net/ethernet/intel/i40e/i40e_main.c | 18 ++++++++++++++++++\n drivers/net/ethernet/intel/i40e/i40e_prototype.h | 2 ++\n drivers/net/ethernet/intel/i40evf/i40e_prototype.h | 2 ++\n 4 files changed, 44 insertions(+)", "diff": "diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c\nindex a1cfb16..0958da8 100644\n--- a/drivers/net/ethernet/intel/i40e/i40e_common.c\n+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c\n@@ -3897,6 +3897,28 @@ i40e_status i40e_aq_add_rem_control_packet_filter(struct i40e_hw *hw,\n }\n \n /**\n+ * i40e_add_filter_to_drop_tx_flow_control_frames- filter to drop flow control\n+ * @hw: pointer to the hw struct\n+ * @seid: VSI seid to add ethertype filter from\n+ **/\n+#define I40E_FLOW_CONTROL_ETHTYPE 0x8808\n+void i40e_add_filter_to_drop_tx_flow_control_frames(struct i40e_hw *hw,\n+\t\t\t\t\t\t u16 seid)\n+{\n+\tu16 flag = I40E_AQC_ADD_CONTROL_PACKET_FLAGS_IGNORE_MAC |\n+\t\t I40E_AQC_ADD_CONTROL_PACKET_FLAGS_DROP |\n+\t\t I40E_AQC_ADD_CONTROL_PACKET_FLAGS_TX;\n+\tu16 ethtype = I40E_FLOW_CONTROL_ETHTYPE;\n+\ti40e_status status;\n+\n+\tstatus = i40e_aq_add_rem_control_packet_filter(hw, NULL, ethtype, flag,\n+\t\t\t\t\t\t seid, 0, true, NULL,\n+\t\t\t\t\t\t NULL);\n+\tif (status)\n+\t\thw_dbg(hw, \"Ethtype Filter Add failed: Error pruning Tx flow control frames\\n\");\n+}\n+\n+/**\n * i40e_aq_alternate_read\n * @hw: pointer to the hardware structure\n * @reg_addr0: address of first dword to be read\ndiff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c\nindex eda14cf..d341f56 100644\n--- a/drivers/net/ethernet/intel/i40e/i40e_main.c\n+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c\n@@ -6856,6 +6856,15 @@ static void i40e_reset_and_rebuild(struct i40e_pf *pf, bool reinit)\n \tif (pf->flags & I40E_FLAG_MSIX_ENABLED)\n \t\tret = i40e_setup_misc_vector(pf);\n \n+\t/* Add a filter to drop all Flow control frames from any VSI from being\n+\t * transmitted. By doing so we stop a malicious VF from sending out\n+\t * PAUSE or PFC frames and potentially controlling traffic for other\n+\t * PF/VF VSIs.\n+\t * The FW can still send Flow control frames if enabled.\n+\t */\n+\ti40e_add_filter_to_drop_tx_flow_control_frames(&pf->hw,\n+\t\t\t\t\t\t pf->main_vsi_seid);\n+\n \t/* restart the VSIs that were rebuilt and running before the reset */\n \ti40e_pf_unquiesce_all_vsi(pf);\n \n@@ -10602,6 +10611,15 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)\n \t\t\ti40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status));\n \tpf->hw.phy.phy_types = le32_to_cpu(abilities.phy_type);\n \n+\t/* Add a filter to drop all Flow control frames from any VSI from being\n+\t * transmitted. By doing so we stop a malicious VF from sending out\n+\t * PAUSE or PFC frames and potentially controlling traffic for other\n+\t * PF/VF VSIs.\n+\t * The FW can still send Flow control frames if enabled.\n+\t */\n+\ti40e_add_filter_to_drop_tx_flow_control_frames(&pf->hw,\n+\t\t\t\t\t\t pf->main_vsi_seid);\n+\n \t/* print a string summarizing features */\n \ti40e_print_features(pf);\n \ndiff --git a/drivers/net/ethernet/intel/i40e/i40e_prototype.h b/drivers/net/ethernet/intel/i40e/i40e_prototype.h\nindex 642c9aa5..a17cd55 100644\n--- a/drivers/net/ethernet/intel/i40e/i40e_prototype.h\n+++ b/drivers/net/ethernet/intel/i40e/i40e_prototype.h\n@@ -328,4 +328,6 @@ i40e_status i40e_aq_debug_dump(struct i40e_hw *hw, u8 cluster_id,\n \t\t\t void *buff, u16 *ret_buff_size,\n \t\t\t u8 *ret_next_table, u32 *ret_next_index,\n \t\t\t struct i40e_asq_cmd_details *cmd_details);\n+void i40e_add_filter_to_drop_tx_flow_control_frames(struct i40e_hw *hw,\n+\t\t\t\t\t\t u16 vsi_seid);\n #endif /* _I40E_PROTOTYPE_H_ */\ndiff --git a/drivers/net/ethernet/intel/i40evf/i40e_prototype.h b/drivers/net/ethernet/intel/i40evf/i40e_prototype.h\nindex 8ed0edf..cbd9a1b 100644\n--- a/drivers/net/ethernet/intel/i40evf/i40e_prototype.h\n+++ b/drivers/net/ethernet/intel/i40evf/i40e_prototype.h\n@@ -101,4 +101,6 @@ i40e_status i40e_aq_add_rem_control_packet_filter(struct i40e_hw *hw,\n \t\t\t\tu16 vsi_seid, u16 queue, bool is_add,\n \t\t\t\tstruct i40e_control_filter_stats *stats,\n \t\t\t\tstruct i40e_asq_cmd_details *cmd_details);\n+void i40e_add_filter_to_drop_tx_flow_control_frames(struct i40e_hw *hw,\n+\t\t\t\t\t\t u16 vsi_seid);\n #endif /* _I40E_PROTOTYPE_H_ */\n", "prefixes": [ "next", "S18", "1/8" ] }