igb: add VF trust infrastructure

* Add a per-VF value to know if a VF is trusted, by default don't
  trust VFs.

* Implement netdev op to trust VFs (igb_ndo_set_vf_trust) and add
  trust status to ndo_get_vf_config output.

* Allow a trusted VF to change MAC and MAC filters even if MAC
  has been administratively set.

Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h
index 1c6b8d9176a8e0f39815c8fb7d8681a644db2186..55d6f17d57992003e7f3b815adff0308f57c11e1 100644 (file)
--- a/drivers/net/ethernet/intel/igb/igb.h
+++ b/drivers/net/ethernet/intel/igb/igb.h
@@ -109,6 +109,7 @@ struct vf_data_storage {
        u16 pf_qos;
        u16 tx_rate;
        bool spoofchk_enabled;
+       bool trusted;
 };
 
 /* Number of unicast MAC filters reserved for the PF in the RAR registers */

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index b88fae78536951cd76506a78cb19e044762fc943..33f23ce99796b9848b7e8fa3067bbbb48764498c 100644 (file)
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -190,6 +190,8 @@ static int igb_ndo_set_vf_vlan(struct net_device *netdev,
 static int igb_ndo_set_vf_bw(struct net_device *, int, int, int);
 static int igb_ndo_set_vf_spoofchk(struct net_device *netdev, int vf,
                                   bool setting);
+static int igb_ndo_set_vf_trust(struct net_device *netdev, int vf,
+                               bool setting);
 static int igb_ndo_get_vf_config(struct net_device *netdev, int vf,
                                 struct ifla_vf_info *ivi);
 static void igb_check_vf_rate_limit(struct igb_adapter *);
@@ -2527,6 +2529,7 @@ static const struct net_device_ops igb_netdev_ops = {
        .ndo_set_vf_vlan        = igb_ndo_set_vf_vlan,
        .ndo_set_vf_rate        = igb_ndo_set_vf_bw,
        .ndo_set_vf_spoofchk    = igb_ndo_set_vf_spoofchk,
+       .ndo_set_vf_trust       = igb_ndo_set_vf_trust,
        .ndo_get_vf_config      = igb_ndo_get_vf_config,
 #ifdef CONFIG_NET_POLL_CONTROLLER
        .ndo_poll_controller    = igb_netpoll,
@@ -6383,6 +6386,9 @@ static int igb_vf_configure(struct igb_adapter *adapter, int vf)
        /* By default spoof check is enabled for all VFs */
        adapter->vf_data[vf].spoofchk_enabled = true;
 
+       /* By default VFs are not trusted */
+       adapter->vf_data[vf].trusted = false;
+
        return 0;
 }
 
@@ -6940,13 +6946,13 @@ static int igb_set_vf_mac_filter(struct igb_adapter *adapter, const int vf,
                }
                break;
        case E1000_VF_MAC_FILTER_ADD:
-               if (vf_data->flags & IGB_VF_FLAG_PF_SET_MAC) {
+               if ((vf_data->flags & IGB_VF_FLAG_PF_SET_MAC) &&
+                   !vf_data->trusted) {
                        dev_warn(&pdev->dev,
                                 "VF %d requested MAC filter but is administratively denied\n",
                                 vf);
                        return -EINVAL;
                }
-
                if (!is_valid_ether_addr(addr)) {
                        dev_warn(&pdev->dev,
                                 "VF %d attempted to set invalid MAC filter\n",
@@ -6998,7 +7004,8 @@ static int igb_set_vf_mac_addr(struct igb_adapter *adapter, u32 *msg, int vf)
        int ret = 0;
 
        if (!info) {
-               if (vf_data->flags & IGB_VF_FLAG_PF_SET_MAC) {
+               if ((vf_data->flags & IGB_VF_FLAG_PF_SET_MAC) &&
+                   !vf_data->trusted) {
                        dev_warn(&pdev->dev,
                                 "VF %d attempted to override administratively set MAC address\nReload the VF driver to resume operations\n",
                                 vf);
@@ -8934,6 +8941,22 @@ static int igb_ndo_set_vf_spoofchk(struct net_device *netdev, int vf,
        return 0;
 }
 
+static int igb_ndo_set_vf_trust(struct net_device *netdev, int vf, bool setting)
+{
+       struct igb_adapter *adapter = netdev_priv(netdev);
+
+       if (vf >= adapter->vfs_allocated_count)
+               return -EINVAL;
+       if (adapter->vf_data[vf].trusted == setting)
+               return 0;
+
+       adapter->vf_data[vf].trusted = setting;
+
+       dev_info(&adapter->pdev->dev, "VF %u is %strusted\n",
+                vf, setting ? "" : "not ");
+       return 0;
+}
+
 static int igb_ndo_get_vf_config(struct net_device *netdev,
                                 int vf, struct ifla_vf_info *ivi)
 {
@@ -8947,6 +8970,7 @@ static int igb_ndo_get_vf_config(struct net_device *netdev,
        ivi->vlan = adapter->vf_data[vf].pf_vlan;
        ivi->qos = adapter->vf_data[vf].pf_qos;
        ivi->spoofchk = adapter->vf_data[vf].spoofchk_enabled;
+       ivi->trusted = adapter->vf_data[vf].trusted;
        return 0;
 }