[PATCH v2 4/4] hv_netvsc: Restrict configurations on isolated guests
From: "Andrea Parri (Microsoft)" <parri.andrea@gmail.com>
Date: 2021-01-26 11:58:45
Also in:
lkml, netdev
Subsystem:
hyper-v/azure core and drivers, networking drivers, the rest · Maintainers:
"K. Y. Srinivasan", Haiyang Zhang, Wei Liu, Dexuan Cui, Long Li, Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Restrict the NVSP protocol version(s) that will be negotiated with the host to be NVSP_PROTOCOL_VERSION_61 or greater if the guest is running isolated. Moreover, do not advertise the SR-IOV capability and ignore NVSP_MSG_4_TYPE_SEND_VF_ASSOCIATION messages in isolated guests, which are not supposed to support SR-IOV. This reduces the footprint of the code that will be exercised by Confidential VMs and hence the exposure to bugs and vulnerabilities. Signed-off-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com> Acked-by: Jakub Kicinski <kuba@kernel.org> Cc: "David S. Miller" <davem@davemloft.net> Cc: Jakub Kicinski <kuba@kernel.org> Cc: netdev@vger.kernel.org --- drivers/net/hyperv/netvsc.c | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-)
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 1510a236aa341..afd92b4aa21fe 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c@@ -22,6 +22,7 @@ #include <linux/prefetch.h> #include <asm/sync_bitops.h> +#include <asm/mshyperv.h> #include "hyperv_net.h" #include "netvsc_trace.h"
@@ -544,7 +545,10 @@ static int negotiate_nvsp_ver(struct hv_device *device, init_packet->msg.v2_msg.send_ndis_config.capability.ieee8021q = 1; if (nvsp_ver >= NVSP_PROTOCOL_VERSION_5) { - init_packet->msg.v2_msg.send_ndis_config.capability.sriov = 1; + if (!hv_is_isolation_supported()) + init_packet->msg.v2_msg.send_ndis_config.capability.sriov = 1; + else + netdev_info(ndev, "SR-IOV not advertised by guests on the host supporting isolation\n"); /* Teaming bit is needed to receive link speed updates */ init_packet->msg.v2_msg.send_ndis_config.capability.teaming = 1;
@@ -563,6 +567,13 @@ static int negotiate_nvsp_ver(struct hv_device *device, return ret; } +static bool nvsp_is_valid_version(u32 version) +{ + if (hv_is_isolation_supported()) + return version >= NVSP_PROTOCOL_VERSION_61; + return true; +} + static int netvsc_connect_vsp(struct hv_device *device, struct netvsc_device *net_device, const struct netvsc_device_info *device_info)
@@ -579,12 +590,19 @@ static int netvsc_connect_vsp(struct hv_device *device, init_packet = &net_device->channel_init_pkt; /* Negotiate the latest NVSP protocol supported */ - for (i = ARRAY_SIZE(ver_list) - 1; i >= 0; i--) + for (i = ARRAY_SIZE(ver_list) - 1; i >= 0; i--) { if (negotiate_nvsp_ver(device, net_device, init_packet, ver_list[i]) == 0) { + if (!nvsp_is_valid_version(ver_list[i])) { + netdev_err(ndev, "Invalid NVSP version 0x%x (expected >= 0x%x) from the host with isolation supported\n", + ver_list[i], NVSP_PROTOCOL_VERSION_61); + ret = -EPROTO; + goto cleanup; + } net_device->nvsp_version = ver_list[i]; break; } + } if (i < 0) { ret = -EPROTO;
@@ -1357,7 +1375,10 @@ static void netvsc_receive_inband(struct net_device *ndev, break; case NVSP_MSG4_TYPE_SEND_VF_ASSOCIATION: - netvsc_send_vf(ndev, nvmsg, msglen); + if (!hv_is_isolation_supported()) + netvsc_send_vf(ndev, nvmsg, msglen); + else + netdev_err(ndev, "Ignore VF_ASSOCIATION msg from the host supporting isolation\n"); break; } }
--
2.25.1