1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright (c) 2018, Intel Corporation. */ 3 4 #include "ice_common.h" 5 #include "ice_vf_mbx.h" 6 7 /** 8 * ice_aq_send_msg_to_vf 9 * @hw: pointer to the hardware structure 10 * @vfid: VF ID to send msg 11 * @v_opcode: opcodes for VF-PF communication 12 * @v_retval: return error code 13 * @msg: pointer to the msg buffer 14 * @msglen: msg length 15 * @cd: pointer to command details 16 * 17 * Send message to VF driver (0x0802) using mailbox 18 * queue and asynchronously sending message via 19 * ice_sq_send_cmd() function 20 */ 21 int 22 ice_aq_send_msg_to_vf(struct ice_hw *hw, u16 vfid, u32 v_opcode, u32 v_retval, 23 u8 *msg, u16 msglen, struct ice_sq_cd *cd) 24 { 25 struct ice_aqc_pf_vf_msg *cmd; 26 struct ice_aq_desc desc; 27 28 ice_fill_dflt_direct_cmd_desc(&desc, ice_mbx_opc_send_msg_to_vf); 29 30 cmd = &desc.params.virt; 31 cmd->id = cpu_to_le32(vfid); 32 33 desc.cookie_high = cpu_to_le32(v_opcode); 34 desc.cookie_low = cpu_to_le32(v_retval); 35 36 if (msglen) 37 desc.flags |= cpu_to_le16(ICE_AQ_FLAG_RD); 38 39 return ice_sq_send_cmd(hw, &hw->mailboxq, &desc, msg, msglen, cd); 40 } 41 42 static const u32 ice_legacy_aq_to_vc_speed[15] = { 43 VIRTCHNL_LINK_SPEED_100MB, /* BIT(0) */ 44 VIRTCHNL_LINK_SPEED_100MB, 45 VIRTCHNL_LINK_SPEED_1GB, 46 VIRTCHNL_LINK_SPEED_1GB, 47 VIRTCHNL_LINK_SPEED_1GB, 48 VIRTCHNL_LINK_SPEED_10GB, 49 VIRTCHNL_LINK_SPEED_20GB, 50 VIRTCHNL_LINK_SPEED_25GB, 51 VIRTCHNL_LINK_SPEED_40GB, 52 VIRTCHNL_LINK_SPEED_40GB, 53 VIRTCHNL_LINK_SPEED_40GB, 54 VIRTCHNL_LINK_SPEED_UNKNOWN, 55 VIRTCHNL_LINK_SPEED_UNKNOWN, 56 VIRTCHNL_LINK_SPEED_UNKNOWN, 57 VIRTCHNL_LINK_SPEED_UNKNOWN /* BIT(14) */ 58 }; 59 60 /** 61 * ice_conv_link_speed_to_virtchnl 62 * @adv_link_support: determines the format of the returned link speed 63 * @link_speed: variable containing the link_speed to be converted 64 * 65 * Convert link speed supported by HW to link speed supported by virtchnl. 66 * If adv_link_support is true, then return link speed in Mbps. Else return 67 * link speed as a VIRTCHNL_LINK_SPEED_* casted to a u32. Note that the caller 68 * needs to cast back to an enum virtchnl_link_speed in the case where 69 * adv_link_support is false, but when adv_link_support is true the caller can 70 * expect the speed in Mbps. 71 */ 72 u32 ice_conv_link_speed_to_virtchnl(bool adv_link_support, u16 link_speed) 73 { 74 u32 speed; 75 76 if (adv_link_support) { 77 /* convert a BIT() value into an array index */ 78 speed = ice_get_link_speed(fls(link_speed) - 1); 79 } else { 80 /* Virtchnl speeds are not defined for every speed supported in 81 * the hardware. To maintain compatibility with older AVF 82 * drivers, while reporting the speed the new speed values are 83 * resolved to the closest known virtchnl speeds 84 */ 85 speed = ice_legacy_aq_to_vc_speed[fls(link_speed) - 1]; 86 } 87 88 return speed; 89 } 90 91 /* The mailbox overflow detection algorithm helps to check if there 92 * is a possibility of a malicious VF transmitting too many MBX messages to the 93 * PF. 94 * 1. The mailbox snapshot structure, ice_mbx_snapshot, is initialized during 95 * driver initialization in ice_init_hw() using ice_mbx_init_snapshot(). 96 * The struct ice_mbx_snapshot helps to track and traverse a static window of 97 * messages within the mailbox queue while looking for a malicious VF. 98 * 99 * 2. When the caller starts processing its mailbox queue in response to an 100 * interrupt, the structure ice_mbx_snapshot is expected to be cleared before 101 * the algorithm can be run for the first time for that interrupt. This can be 102 * done via ice_mbx_reset_snapshot(). 103 * 104 * 3. For every message read by the caller from the MBX Queue, the caller must 105 * call the detection algorithm's entry function ice_mbx_vf_state_handler(). 106 * Before every call to ice_mbx_vf_state_handler() the struct ice_mbx_data is 107 * filled as it is required to be passed to the algorithm. 108 * 109 * 4. Every time a message is read from the MBX queue, a VFId is received which 110 * is passed to the state handler. The boolean output is_malvf of the state 111 * handler ice_mbx_vf_state_handler() serves as an indicator to the caller 112 * whether this VF is malicious or not. 113 * 114 * 5. When a VF is identified to be malicious, the caller can send a message 115 * to the system administrator. The caller can invoke ice_mbx_report_malvf() 116 * to help determine if a malicious VF is to be reported or not. This function 117 * requires the caller to maintain a global bitmap to track all malicious VFs 118 * and pass that to ice_mbx_report_malvf() along with the VFID which was identified 119 * to be malicious by ice_mbx_vf_state_handler(). 120 * 121 * 6. The global bitmap maintained by PF can be cleared completely if PF is in 122 * reset or the bit corresponding to a VF can be cleared if that VF is in reset. 123 * When a VF is shut down and brought back up, we assume that the new VF 124 * brought up is not malicious and hence report it if found malicious. 125 * 126 * 7. The function ice_mbx_reset_snapshot() is called to reset the information 127 * in ice_mbx_snapshot for every new mailbox interrupt handled. 128 * 129 * 8. The memory allocated for variables in ice_mbx_snapshot is de-allocated 130 * when driver is unloaded. 131 */ 132 #define ICE_RQ_DATA_MASK(rq_data) ((rq_data) & PF_MBX_ARQH_ARQH_M) 133 /* Using the highest value for an unsigned 16-bit value 0xFFFF to indicate that 134 * the max messages check must be ignored in the algorithm 135 */ 136 #define ICE_IGNORE_MAX_MSG_CNT 0xFFFF 137 138 /** 139 * ice_mbx_traverse - Pass through mailbox snapshot 140 * @hw: pointer to the HW struct 141 * @new_state: new algorithm state 142 * 143 * Traversing the mailbox static snapshot without checking 144 * for malicious VFs. 145 */ 146 static void 147 ice_mbx_traverse(struct ice_hw *hw, 148 enum ice_mbx_snapshot_state *new_state) 149 { 150 struct ice_mbx_snap_buffer_data *snap_buf; 151 u32 num_iterations; 152 153 snap_buf = &hw->mbx_snapshot.mbx_buf; 154 155 /* As mailbox buffer is circular, applying a mask 156 * on the incremented iteration count. 157 */ 158 num_iterations = ICE_RQ_DATA_MASK(++snap_buf->num_iterations); 159 160 /* Checking either of the below conditions to exit snapshot traversal: 161 * Condition-1: If the number of iterations in the mailbox is equal to 162 * the mailbox head which would indicate that we have reached the end 163 * of the static snapshot. 164 * Condition-2: If the maximum messages serviced in the mailbox for a 165 * given interrupt is the highest possible value then there is no need 166 * to check if the number of messages processed is equal to it. If not 167 * check if the number of messages processed is greater than or equal 168 * to the maximum number of mailbox entries serviced in current work item. 169 */ 170 if (num_iterations == snap_buf->head || 171 (snap_buf->max_num_msgs_mbx < ICE_IGNORE_MAX_MSG_CNT && 172 ++snap_buf->num_msg_proc >= snap_buf->max_num_msgs_mbx)) 173 *new_state = ICE_MAL_VF_DETECT_STATE_NEW_SNAPSHOT; 174 } 175 176 /** 177 * ice_mbx_detect_malvf - Detect malicious VF in snapshot 178 * @hw: pointer to the HW struct 179 * @vf_id: relative virtual function ID 180 * @new_state: new algorithm state 181 * @is_malvf: boolean output to indicate if VF is malicious 182 * 183 * This function tracks the number of asynchronous messages 184 * sent per VF and marks the VF as malicious if it exceeds 185 * the permissible number of messages to send. 186 */ 187 static int 188 ice_mbx_detect_malvf(struct ice_hw *hw, u16 vf_id, 189 enum ice_mbx_snapshot_state *new_state, 190 bool *is_malvf) 191 { 192 struct ice_mbx_snapshot *snap = &hw->mbx_snapshot; 193 194 if (vf_id >= snap->mbx_vf.vfcntr_len) 195 return -EIO; 196 197 /* increment the message count in the VF array */ 198 snap->mbx_vf.vf_cntr[vf_id]++; 199 200 if (snap->mbx_vf.vf_cntr[vf_id] >= ICE_ASYNC_VF_MSG_THRESHOLD) 201 *is_malvf = true; 202 203 /* continue to iterate through the mailbox snapshot */ 204 ice_mbx_traverse(hw, new_state); 205 206 return 0; 207 } 208 209 /** 210 * ice_mbx_reset_snapshot - Reset mailbox snapshot structure 211 * @snap: pointer to mailbox snapshot structure in the ice_hw struct 212 * 213 * Reset the mailbox snapshot structure and clear VF counter array. 214 */ 215 static void ice_mbx_reset_snapshot(struct ice_mbx_snapshot *snap) 216 { 217 u32 vfcntr_len; 218 219 if (!snap || !snap->mbx_vf.vf_cntr) 220 return; 221 222 /* Clear VF counters. */ 223 vfcntr_len = snap->mbx_vf.vfcntr_len; 224 if (vfcntr_len) 225 memset(snap->mbx_vf.vf_cntr, 0, 226 (vfcntr_len * sizeof(*snap->mbx_vf.vf_cntr))); 227 228 /* Reset mailbox snapshot for a new capture. */ 229 memset(&snap->mbx_buf, 0, sizeof(snap->mbx_buf)); 230 snap->mbx_buf.state = ICE_MAL_VF_DETECT_STATE_NEW_SNAPSHOT; 231 } 232 233 /** 234 * ice_mbx_vf_state_handler - Handle states of the overflow algorithm 235 * @hw: pointer to the HW struct 236 * @mbx_data: pointer to structure containing mailbox data 237 * @vf_id: relative virtual function (VF) ID 238 * @is_malvf: boolean output to indicate if VF is malicious 239 * 240 * The function serves as an entry point for the malicious VF 241 * detection algorithm by handling the different states and state 242 * transitions of the algorithm: 243 * New snapshot: This state is entered when creating a new static 244 * snapshot. The data from any previous mailbox snapshot is 245 * cleared and a new capture of the mailbox head and tail is 246 * logged. This will be the new static snapshot to detect 247 * asynchronous messages sent by VFs. On capturing the snapshot 248 * and depending on whether the number of pending messages in that 249 * snapshot exceed the watermark value, the state machine enters 250 * traverse or detect states. 251 * Traverse: If pending message count is below watermark then iterate 252 * through the snapshot without any action on VF. 253 * Detect: If pending message count exceeds watermark traverse 254 * the static snapshot and look for a malicious VF. 255 */ 256 int 257 ice_mbx_vf_state_handler(struct ice_hw *hw, 258 struct ice_mbx_data *mbx_data, u16 vf_id, 259 bool *is_malvf) 260 { 261 struct ice_mbx_snapshot *snap = &hw->mbx_snapshot; 262 struct ice_mbx_snap_buffer_data *snap_buf; 263 struct ice_ctl_q_info *cq = &hw->mailboxq; 264 enum ice_mbx_snapshot_state new_state; 265 int status = 0; 266 267 if (!is_malvf || !mbx_data) 268 return -EINVAL; 269 270 /* When entering the mailbox state machine assume that the VF 271 * is not malicious until detected. 272 */ 273 *is_malvf = false; 274 275 /* Checking if max messages allowed to be processed while servicing current 276 * interrupt is not less than the defined AVF message threshold. 277 */ 278 if (mbx_data->max_num_msgs_mbx <= ICE_ASYNC_VF_MSG_THRESHOLD) 279 return -EINVAL; 280 281 /* The watermark value should not be lesser than the threshold limit 282 * set for the number of asynchronous messages a VF can send to mailbox 283 * nor should it be greater than the maximum number of messages in the 284 * mailbox serviced in current interrupt. 285 */ 286 if (mbx_data->async_watermark_val < ICE_ASYNC_VF_MSG_THRESHOLD || 287 mbx_data->async_watermark_val > mbx_data->max_num_msgs_mbx) 288 return -EINVAL; 289 290 new_state = ICE_MAL_VF_DETECT_STATE_INVALID; 291 snap_buf = &snap->mbx_buf; 292 293 switch (snap_buf->state) { 294 case ICE_MAL_VF_DETECT_STATE_NEW_SNAPSHOT: 295 /* Clear any previously held data in mailbox snapshot structure. */ 296 ice_mbx_reset_snapshot(snap); 297 298 /* Collect the pending ARQ count, number of messages processed and 299 * the maximum number of messages allowed to be processed from the 300 * Mailbox for current interrupt. 301 */ 302 snap_buf->num_pending_arq = mbx_data->num_pending_arq; 303 snap_buf->num_msg_proc = mbx_data->num_msg_proc; 304 snap_buf->max_num_msgs_mbx = mbx_data->max_num_msgs_mbx; 305 306 /* Capture a new static snapshot of the mailbox by logging the 307 * head and tail of snapshot and set num_iterations to the tail 308 * value to mark the start of the iteration through the snapshot. 309 */ 310 snap_buf->head = ICE_RQ_DATA_MASK(cq->rq.next_to_clean + 311 mbx_data->num_pending_arq); 312 snap_buf->tail = ICE_RQ_DATA_MASK(cq->rq.next_to_clean - 1); 313 snap_buf->num_iterations = snap_buf->tail; 314 315 /* Pending ARQ messages returned by ice_clean_rq_elem 316 * is the difference between the head and tail of the 317 * mailbox queue. Comparing this value against the watermark 318 * helps to check if we potentially have malicious VFs. 319 */ 320 if (snap_buf->num_pending_arq >= 321 mbx_data->async_watermark_val) { 322 new_state = ICE_MAL_VF_DETECT_STATE_DETECT; 323 status = ice_mbx_detect_malvf(hw, vf_id, &new_state, is_malvf); 324 } else { 325 new_state = ICE_MAL_VF_DETECT_STATE_TRAVERSE; 326 ice_mbx_traverse(hw, &new_state); 327 } 328 break; 329 330 case ICE_MAL_VF_DETECT_STATE_TRAVERSE: 331 new_state = ICE_MAL_VF_DETECT_STATE_TRAVERSE; 332 ice_mbx_traverse(hw, &new_state); 333 break; 334 335 case ICE_MAL_VF_DETECT_STATE_DETECT: 336 new_state = ICE_MAL_VF_DETECT_STATE_DETECT; 337 status = ice_mbx_detect_malvf(hw, vf_id, &new_state, is_malvf); 338 break; 339 340 default: 341 new_state = ICE_MAL_VF_DETECT_STATE_INVALID; 342 status = -EIO; 343 } 344 345 snap_buf->state = new_state; 346 347 return status; 348 } 349 350 /** 351 * ice_mbx_report_malvf - Track and note malicious VF 352 * @hw: pointer to the HW struct 353 * @all_malvfs: all malicious VFs tracked by PF 354 * @bitmap_len: length of bitmap in bits 355 * @vf_id: relative virtual function ID of the malicious VF 356 * @report_malvf: boolean to indicate if malicious VF must be reported 357 * 358 * This function will update a bitmap that keeps track of the malicious 359 * VFs attached to the PF. A malicious VF must be reported only once if 360 * discovered between VF resets or loading so the function checks 361 * the input vf_id against the bitmap to verify if the VF has been 362 * detected in any previous mailbox iterations. 363 */ 364 int 365 ice_mbx_report_malvf(struct ice_hw *hw, unsigned long *all_malvfs, 366 u16 bitmap_len, u16 vf_id, bool *report_malvf) 367 { 368 if (!all_malvfs || !report_malvf) 369 return -EINVAL; 370 371 *report_malvf = false; 372 373 if (bitmap_len < hw->mbx_snapshot.mbx_vf.vfcntr_len) 374 return -EINVAL; 375 376 if (vf_id >= bitmap_len) 377 return -EIO; 378 379 /* If the vf_id is found in the bitmap set bit and boolean to true */ 380 if (!test_and_set_bit(vf_id, all_malvfs)) 381 *report_malvf = true; 382 383 return 0; 384 } 385 386 /** 387 * ice_mbx_clear_malvf - Clear VF bitmap and counter for VF ID 388 * @snap: pointer to the mailbox snapshot structure 389 * @all_malvfs: all malicious VFs tracked by PF 390 * @bitmap_len: length of bitmap in bits 391 * @vf_id: relative virtual function ID of the malicious VF 392 * 393 * In case of a VF reset, this function can be called to clear 394 * the bit corresponding to the VF ID in the bitmap tracking all 395 * malicious VFs attached to the PF. The function also clears the 396 * VF counter array at the index of the VF ID. This is to ensure 397 * that the new VF loaded is not considered malicious before going 398 * through the overflow detection algorithm. 399 */ 400 int 401 ice_mbx_clear_malvf(struct ice_mbx_snapshot *snap, unsigned long *all_malvfs, 402 u16 bitmap_len, u16 vf_id) 403 { 404 if (!snap || !all_malvfs) 405 return -EINVAL; 406 407 if (bitmap_len < snap->mbx_vf.vfcntr_len) 408 return -EINVAL; 409 410 /* Ensure VF ID value is not larger than bitmap or VF counter length */ 411 if (vf_id >= bitmap_len || vf_id >= snap->mbx_vf.vfcntr_len) 412 return -EIO; 413 414 /* Clear VF ID bit in the bitmap tracking malicious VFs attached to PF */ 415 clear_bit(vf_id, all_malvfs); 416 417 /* Clear the VF counter in the mailbox snapshot structure for that VF ID. 418 * This is to ensure that if a VF is unloaded and a new one brought back 419 * up with the same VF ID for a snapshot currently in traversal or detect 420 * state the counter for that VF ID does not increment on top of existing 421 * values in the mailbox overflow detection algorithm. 422 */ 423 snap->mbx_vf.vf_cntr[vf_id] = 0; 424 425 return 0; 426 } 427 428 /** 429 * ice_mbx_init_snapshot - Initialize mailbox snapshot structure 430 * @hw: pointer to the hardware structure 431 * @vf_count: number of VFs allocated on a PF 432 * 433 * Clear the mailbox snapshot structure and allocate memory 434 * for the VF counter array based on the number of VFs allocated 435 * on that PF. 436 * 437 * Assumption: This function will assume ice_get_caps() has already been 438 * called to ensure that the vf_count can be compared against the number 439 * of VFs supported as defined in the functional capabilities of the device. 440 */ 441 int ice_mbx_init_snapshot(struct ice_hw *hw, u16 vf_count) 442 { 443 struct ice_mbx_snapshot *snap = &hw->mbx_snapshot; 444 445 /* Ensure that the number of VFs allocated is non-zero and 446 * is not greater than the number of supported VFs defined in 447 * the functional capabilities of the PF. 448 */ 449 if (!vf_count || vf_count > hw->func_caps.num_allocd_vfs) 450 return -EINVAL; 451 452 snap->mbx_vf.vf_cntr = devm_kcalloc(ice_hw_to_dev(hw), vf_count, 453 sizeof(*snap->mbx_vf.vf_cntr), 454 GFP_KERNEL); 455 if (!snap->mbx_vf.vf_cntr) 456 return -ENOMEM; 457 458 /* Setting the VF counter length to the number of allocated 459 * VFs for given PF's functional capabilities. 460 */ 461 snap->mbx_vf.vfcntr_len = vf_count; 462 463 /* Clear mbx_buf in the mailbox snaphot structure and setting the 464 * mailbox snapshot state to a new capture. 465 */ 466 memset(&snap->mbx_buf, 0, sizeof(snap->mbx_buf)); 467 snap->mbx_buf.state = ICE_MAL_VF_DETECT_STATE_NEW_SNAPSHOT; 468 469 return 0; 470 } 471 472 /** 473 * ice_mbx_deinit_snapshot - Free mailbox snapshot structure 474 * @hw: pointer to the hardware structure 475 * 476 * Clear the mailbox snapshot structure and free the VF counter array. 477 */ 478 void ice_mbx_deinit_snapshot(struct ice_hw *hw) 479 { 480 struct ice_mbx_snapshot *snap = &hw->mbx_snapshot; 481 482 /* Free VF counter array and reset VF counter length */ 483 devm_kfree(ice_hw_to_dev(hw), snap->mbx_vf.vf_cntr); 484 snap->mbx_vf.vfcntr_len = 0; 485 486 /* Clear mbx_buf in the mailbox snaphot structure */ 487 memset(&snap->mbx_buf, 0, sizeof(snap->mbx_buf)); 488 } 489