git: e779914354db - main - ixl: Validate VF virtchnl configuration

The branch main has been updated by kbowling:

URL: https://cgit.FreeBSD.org/src/commit/?id=e779914354db5cb3a20f4ec894d08b0f81d05ba2

commit e779914354db5cb3a20f4ec894d08b0f81d05ba2
Author:     Kevin Bowling <[email protected]>
AuthorDate: 2026-08-10 03:15:17 +0000
Commit:     Kevin Bowling <[email protected]>
CommitDate: 2026-08-10 09:17:25 +0000

    ixl: Validate VF virtchnl configuration
    
    Bound variable-length virtchnl messages before computing their expected
    length, following the newer Intel virtchnl implementation.
    
    Validate VF ring sizes and alignments before programming HMC contexts.
    DPDK uses 128-byte ring alignment and 64 through 8160 descriptors;
    the virtchnl ABI further specifies TX multiples of 8 and RX multiples
    of 32.  Preserve the 4096-descriptor limit on X722.
    
    Validate queue bitmaps before changing any rings, validate all queue
    and interrupt contexts before applying a request, and reject invalid
    RSS table entries.  Also avoid sending an ACK after VLAN-strip setup
    fails and reply to delete-VLAN errors with the correct opcode.
    
    These checks prevent malformed or oversized requests from an untrusted
    VF from partially programming resources outside its allocation.
    
    MFC after:      2 weeks
---
 sys/dev/ixl/ixl_pf_iov.c | 156 ++++++++++++++++++++++++++++++++---------------
 sys/dev/ixl/virtchnl.h   |  70 +++++++++++++++++----
 2 files changed, 165 insertions(+), 61 deletions(-)

diff --git a/sys/dev/ixl/ixl_pf_iov.c b/sys/dev/ixl/ixl_pf_iov.c
index e749797fa700..b360955e25b2 100644
--- a/sys/dev/ixl/ixl_pf_iov.c
+++ b/sys/dev/ixl/ixl_pf_iov.c
@@ -58,6 +58,8 @@ static void	ixl_vf_reset_msg(struct ixl_pf *pf, struct ixl_vf *vf, void *msg, ui
 static void	ixl_vf_get_resources_msg(struct ixl_pf *pf, struct ixl_vf *vf, void *msg, uint16_t msg_size);
 static int	ixl_vf_config_tx_queue(struct ixl_pf *pf, struct ixl_vf *vf, struct virtchnl_txq_info *info);
 static int	ixl_vf_config_rx_queue(struct ixl_pf *pf, struct ixl_vf *vf, struct virtchnl_rxq_info *info);
+static bool	ixl_vf_tx_queue_valid(struct ixl_pf *pf, const struct virtchnl_txq_info *info);
+static bool	ixl_vf_rx_queue_valid(struct ixl_pf *pf, const struct virtchnl_rxq_info *info);
 static void	ixl_vf_config_vsi_msg(struct ixl_pf *pf, struct ixl_vf *vf, void *msg, uint16_t msg_size);
 static void	ixl_vf_set_qctl(struct ixl_pf *pf, const struct virtchnl_vector_map *vector, enum i40e_queue_type cur_type, uint16_t cur_queue,
     enum i40e_queue_type *last_type, uint16_t *last_queue);
@@ -77,6 +79,8 @@ static int	ixl_config_pf_vsi_loopback(struct ixl_pf *pf, bool enable);
 
 static int	ixl_adminq_err_to_errno(enum i40e_admin_queue_err err);
 
+#define IXL_VF_MAX_RING_XL710	8160
+
 /*
  * TODO: Move pieces of this into iflib and call the rest in a handler?
  *
@@ -599,6 +603,33 @@ ixl_vf_config_tx_queue(struct ixl_pf *pf, struct ixl_vf *vf,
 	return (0);
 }
 
+static uint32_t
+ixl_vf_max_ring(const struct i40e_hw *hw)
+{
+
+	if (hw->mac.type == I40E_MAC_XL710)
+		return (IXL_VF_MAX_RING_XL710);
+	return (IXL_MAX_RING);
+}
+
+static bool
+ixl_vf_tx_queue_valid(struct ixl_pf *pf,
+    const struct virtchnl_txq_info *info)
+{
+
+	if (info->ring_len < IXL_MIN_RING ||
+	    info->ring_len > ixl_vf_max_ring(&pf->hw) ||
+	    info->ring_len % 8 != 0 ||
+	    info->dma_ring_addr == 0 ||
+	    info->dma_ring_addr % IXL_TX_CTX_BASE_UNITS != 0 ||
+	    info->headwb_enabled > 1)
+		return (false);
+	if (info->headwb_enabled != 0 &&
+	    (info->dma_headwb_addr == 0 || info->dma_headwb_addr % 4 != 0))
+		return (false);
+	return (true);
+}
+
 static int
 ixl_vf_config_rx_queue(struct ixl_pf *pf, struct ixl_vf *vf,
     struct virtchnl_rxq_info *info)
@@ -666,6 +697,33 @@ ixl_vf_config_rx_queue(struct ixl_pf *pf, struct ixl_vf *vf,
 	return (0);
 }
 
+static bool
+ixl_vf_rx_queue_valid(struct ixl_pf *pf,
+    const struct virtchnl_rxq_info *info)
+{
+
+	if (info->ring_len < IXL_MIN_RING ||
+	    info->ring_len > ixl_vf_max_ring(&pf->hw) ||
+	    info->ring_len % IXL_RING_INCREMENT != 0 ||
+	    info->dma_ring_addr == 0 ||
+	    info->dma_ring_addr % IXL_RX_CTX_BASE_UNITS != 0)
+		return (false);
+	if (info->databuffer_size == 0 ||
+	    info->databuffer_size > IXL_VF_MAX_BUFFER ||
+	    info->databuffer_size % (1U << I40E_RXQ_CTX_DBUFF_SHIFT) != 0)
+		return (false);
+	if (info->max_pkt_size > IXL_VF_MAX_FRAME ||
+	    info->max_pkt_size < ETHER_MIN_LEN)
+		return (false);
+	if (info->splithdr_enabled > 1)
+		return (false);
+	if (info->splithdr_enabled != 0 &&
+	    (info->hdr_size == 0 || info->hdr_size > IXL_VF_MAX_HDR_BUFFER ||
+	    info->hdr_size % (1U << I40E_RXQ_CTX_HBUFF_SHIFT) != 0))
+		return (false);
+	return (true);
+}
+
 static void
 ixl_vf_config_vsi_msg(struct ixl_pf *pf, struct ixl_vf *vf, void *msg,
     uint16_t msg_size)
@@ -697,12 +755,18 @@ ixl_vf_config_vsi_msg(struct ixl_pf *pf, struct ixl_vf *vf, void *msg,
 		if (pair->txq.vsi_id != vf->vsi.vsi_num ||
 		    pair->rxq.vsi_id != vf->vsi.vsi_num ||
 		    pair->txq.queue_id != pair->rxq.queue_id ||
-		    pair->txq.queue_id >= vf->vsi.num_tx_queues) {
+		    pair->txq.queue_id >= vf->vsi.num_tx_queues ||
+		    !ixl_vf_tx_queue_valid(pf, &pair->txq) ||
+		    !ixl_vf_rx_queue_valid(pf, &pair->rxq)) {
 
 			i40e_send_vf_nack(pf, vf,
 			    VIRTCHNL_OP_CONFIG_VSI_QUEUES, I40E_ERR_PARAM);
 			return;
 		}
+	}
+
+	for (i = 0; i < info->num_queue_pairs; i++) {
+		pair = &info->qpair[i];
 
 		if (ixl_vf_config_tx_queue(pf, vf, &pair->txq) != 0) {
 			i40e_send_vf_nack(pf, vf,
@@ -854,9 +918,11 @@ ixl_vf_config_irq_msg(struct ixl_pf *pf, struct ixl_vf *vf, void *msg,
 			return;
 		}
 
-		ixl_vf_config_vector(pf, vf, vector);
 	}
 
+	for (i = 0; i < map->num_vectors; i++)
+		ixl_vf_config_vector(pf, vf, &map->vecmap[i]);
+
 	ixl_send_vf_ack(pf, vf, VIRTCHNL_OP_CONFIG_IRQ_MAP);
 }
 
@@ -865,29 +931,33 @@ ixl_vf_enable_queues_msg(struct ixl_pf *pf, struct ixl_vf *vf, void *msg,
     uint16_t msg_size)
 {
 	struct virtchnl_queue_select *select;
+	uint32_t queue_mask;
 	int error = 0;
 
 	select = msg;
 
+	queue_mask = (1U << vf->qtag.num_active) - 1;
 	if (select->vsi_id != vf->vsi.vsi_num ||
-	    select->rx_queues == 0 || select->tx_queues == 0) {
+	    (select->rx_queues == 0 && select->tx_queues == 0) ||
+	    ((select->rx_queues | select->tx_queues) & ~queue_mask) != 0) {
 		i40e_send_vf_nack(pf, vf, VIRTCHNL_OP_ENABLE_QUEUES,
 		    I40E_ERR_PARAM);
 		return;
 	}
+	for (int i = 0; i < vf->qtag.num_active; i++) {
+		if (((select->tx_queues & (1U << i)) != 0 &&
+		    !ixl_pf_qmgr_is_queue_configured(&vf->qtag, i, true)) ||
+		    ((select->rx_queues & (1U << i)) != 0 &&
+		    !ixl_pf_qmgr_is_queue_configured(&vf->qtag, i, false))) {
+			i40e_send_vf_nack(pf, vf, VIRTCHNL_OP_ENABLE_QUEUES,
+			    I40E_ERR_PARAM);
+			return;
+		}
+	}
 
 	/* Enable TX rings selected by the VF */
-	for (int i = 0; i < 32; i++) {
-		if ((1 << i) & select->tx_queues) {
-			/* Warn if queue is out of VF allocation range */
-			if (i >= vf->vsi.num_tx_queues) {
-				device_printf(pf->dev, "VF %d: TX ring %d is outside of VF VSI allocation!\n",
-				    vf->vf_num, i);
-				break;
-			}
-			/* Skip this queue if it hasn't been configured */
-			if (!ixl_pf_qmgr_is_queue_configured(&vf->qtag, i, true))
-				continue;
+	for (int i = 0; i < vf->qtag.num_active; i++) {
+		if ((1U << i) & select->tx_queues) {
 			/* Warn if this queue is already marked as enabled */
 			if (ixl_pf_qmgr_is_queue_enabled(&vf->qtag, i, true))
 				ixl_dbg_iov(pf, "VF %d: TX ring %d is already enabled!\n",
@@ -902,17 +972,8 @@ ixl_vf_enable_queues_msg(struct ixl_pf *pf, struct ixl_vf *vf, void *msg,
 	}
 
 	/* Enable RX rings selected by the VF */
-	for (int i = 0; i < 32; i++) {
-		if ((1 << i) & select->rx_queues) {
-			/* Warn if queue is out of VF allocation range */
-			if (i >= vf->vsi.num_rx_queues) {
-				device_printf(pf->dev, "VF %d: RX ring %d is outside of VF VSI allocation!\n",
-				    vf->vf_num, i);
-				break;
-			}
-			/* Skip this queue if it hasn't been configured */
-			if (!ixl_pf_qmgr_is_queue_configured(&vf->qtag, i, false))
-				continue;
+	for (int i = 0; i < vf->qtag.num_active; i++) {
+		if ((1U << i) & select->rx_queues) {
 			/* Warn if this queue is already marked as enabled */
 			if (ixl_pf_qmgr_is_queue_enabled(&vf->qtag, i, false))
 				ixl_dbg_iov(pf, "VF %d: RX ring %d is already enabled!\n",
@@ -939,26 +1000,23 @@ ixl_vf_disable_queues_msg(struct ixl_pf *pf, struct ixl_vf *vf,
     void *msg, uint16_t msg_size)
 {
 	struct virtchnl_queue_select *select;
+	uint32_t queue_mask;
 	int error = 0;
 
 	select = msg;
 
+	queue_mask = (1U << vf->qtag.num_active) - 1;
 	if (select->vsi_id != vf->vsi.vsi_num ||
-	    select->rx_queues == 0 || select->tx_queues == 0) {
+	    (select->rx_queues == 0 && select->tx_queues == 0) ||
+	    ((select->rx_queues | select->tx_queues) & ~queue_mask) != 0) {
 		i40e_send_vf_nack(pf, vf, VIRTCHNL_OP_DISABLE_QUEUES,
 		    I40E_ERR_PARAM);
 		return;
 	}
 
 	/* Disable TX rings selected by the VF */
-	for (int i = 0; i < 32; i++) {
-		if ((1 << i) & select->tx_queues) {
-			/* Warn if queue is out of VF allocation range */
-			if (i >= vf->vsi.num_tx_queues) {
-				device_printf(pf->dev, "VF %d: TX ring %d is outside of VF VSI allocation!\n",
-				    vf->vf_num, i);
-				break;
-			}
+	for (int i = 0; i < vf->qtag.num_active; i++) {
+		if ((1U << i) & select->tx_queues) {
 			/* Skip this queue if it hasn't been configured */
 			if (!ixl_pf_qmgr_is_queue_configured(&vf->qtag, i, true))
 				continue;
@@ -977,14 +1035,8 @@ ixl_vf_disable_queues_msg(struct ixl_pf *pf, struct ixl_vf *vf,
 	}
 
 	/* Enable RX rings selected by the VF */
-	for (int i = 0; i < 32; i++) {
-		if ((1 << i) & select->rx_queues) {
-			/* Warn if queue is out of VF allocation range */
-			if (i >= vf->vsi.num_rx_queues) {
-				device_printf(pf->dev, "VF %d: RX ring %d is outside of VF VSI allocation!\n",
-				    vf->vf_num, i);
-				break;
-			}
+	for (int i = 0; i < vf->qtag.num_active; i++) {
+		if ((1U << i) & select->rx_queues) {
 			/* Skip this queue if it hasn't been configured */
 			if (!ixl_pf_qmgr_is_queue_configured(&vf->qtag, i, false))
 				continue;
@@ -1147,6 +1199,7 @@ ixl_vf_add_vlan_msg(struct ixl_pf *pf, struct ixl_vf *vf, void *msg,
 	if (code != I40E_SUCCESS) {
 		i40e_send_vf_nack(pf, vf, VIRTCHNL_OP_ADD_VLAN,
 		    I40E_ERR_PARAM);
+		return;
 	}
 
 	for (i = 0; i < filter_list->num_elements; i++)
@@ -1172,14 +1225,14 @@ ixl_vf_del_vlan_msg(struct ixl_pf *pf, struct ixl_vf *vf, void *msg,
 
 	for (i = 0; i < filter_list->num_elements; i++) {
 		if (filter_list->vlan_id[i] > EVL_VLID_MASK) {
-			i40e_send_vf_nack(pf, vf, VIRTCHNL_OP_ADD_VLAN,
+			i40e_send_vf_nack(pf, vf, VIRTCHNL_OP_DEL_VLAN,
 			    I40E_ERR_PARAM);
 			return;
 		}
 	}
 
 	if (!(vf->vf_flags & VF_FLAG_VLAN_CAP)) {
-		i40e_send_vf_nack(pf, vf, VIRTCHNL_OP_ADD_VLAN,
+		i40e_send_vf_nack(pf, vf, VIRTCHNL_OP_DEL_VLAN,
 		    I40E_ERR_PARAM);
 		return;
 	}
@@ -1271,8 +1324,8 @@ ixl_vf_config_rss_key_msg(struct ixl_pf *pf, struct ixl_vf *vf, void *msg,
 
 	key = msg;
 
-	if (key->key_len > 52) {
-		device_printf(pf->dev, "VF %d: Key size in msg (%d) is greater than max key size (%d)\n",
+	if (key->key_len != 52) {
+		device_printf(pf->dev, "VF %d: Key size in msg (%d) does not match required size (%d)\n",
 		    vf->vf_num, key->key_len, 52);
 		i40e_send_vf_nack(pf, vf, VIRTCHNL_OP_CONFIG_RSS_KEY,
 		    I40E_ERR_PARAM);
@@ -1327,13 +1380,20 @@ ixl_vf_config_rss_lut_msg(struct ixl_pf *pf, struct ixl_vf *vf, void *msg,
 
 	lut = msg;
 
-	if (lut->lut_entries > 64) {
-		device_printf(pf->dev, "VF %d: # of LUT entries in msg (%d) is greater than max (%d)\n",
+	if (lut->lut_entries != 64) {
+		device_printf(pf->dev, "VF %d: # of LUT entries in msg (%d) does not match required size (%d)\n",
 		    vf->vf_num, lut->lut_entries, 64);
 		i40e_send_vf_nack(pf, vf, VIRTCHNL_OP_CONFIG_RSS_LUT,
 		    I40E_ERR_PARAM);
 		return;
 	}
+	for (int i = 0; i < lut->lut_entries; i++) {
+		if (lut->lut[i] >= vf->vsi.num_rx_queues) {
+			i40e_send_vf_nack(pf, vf, VIRTCHNL_OP_CONFIG_RSS_LUT,
+			    I40E_ERR_PARAM);
+			return;
+		}
+	}
 
 	if (lut->vsi_id != vf->vsi.vsi_num) {
 		device_printf(pf->dev, "VF %d: VSI id in recvd message (%d) does not match expected id (%d)\n",
diff --git a/sys/dev/ixl/virtchnl.h b/sys/dev/ixl/virtchnl.h
index f1b5777fd07b..aa8e5862fee3 100644
--- a/sys/dev/ixl/virtchnl.h
+++ b/sys/dev/ixl/virtchnl.h
@@ -594,6 +594,28 @@ enum virtchnl_vfr_states {
 	VIRTCHNL_VFR_VFACTIVE,
 };
 
+/*
+ * Since VF messages are limited by u16 size, bound the number of nested
+ * elements that can be described by a single virtual channel message.
+ */
+enum virtchnl_vector_limits {
+	VIRTCHNL_OP_CONFIG_VSI_QUEUES_MAX =
+	    ((u16)(~0) - sizeof(struct virtchnl_vsi_queue_config_info)) /
+	    sizeof(struct virtchnl_queue_pair_info),
+	VIRTCHNL_OP_CONFIG_IRQ_MAP_MAX =
+	    ((u16)(~0) - sizeof(struct virtchnl_irq_map_info)) /
+	    sizeof(struct virtchnl_vector_map),
+	VIRTCHNL_OP_ADD_DEL_ETH_ADDR_MAX =
+	    ((u16)(~0) - sizeof(struct virtchnl_ether_addr_list)) /
+	    sizeof(struct virtchnl_ether_addr),
+	VIRTCHNL_OP_ADD_DEL_VLAN_MAX =
+	    ((u16)(~0) - sizeof(struct virtchnl_vlan_filter_list)) /
+	    sizeof(u16),
+	VIRTCHNL_OP_CONFIG_IWARP_IRQ_MAP_MAX =
+	    ((u16)(~0) - sizeof(struct virtchnl_iwarp_qvlist_info)) /
+	    sizeof(struct virtchnl_iwarp_qv_info),
+};
+
 /**
  * virtchnl_vc_validate_vf_msg
  * @ver: Virtchnl version info
@@ -608,7 +630,7 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode,
 			    u8 *msg, u16 msglen)
 {
 	bool err_msg_format = FALSE;
-	int valid_len = 0;
+	u32 valid_len = 0;
 
 	/* Validate message length. */
 	switch (v_opcode) {
@@ -632,11 +654,15 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode,
 		if (msglen >= valid_len) {
 			struct virtchnl_vsi_queue_config_info *vqc =
 			    (struct virtchnl_vsi_queue_config_info *)msg;
-			valid_len += (vqc->num_queue_pairs *
-				      sizeof(struct
-					     virtchnl_queue_pair_info));
-			if (vqc->num_queue_pairs == 0)
+			if (vqc->num_queue_pairs == 0 ||
+			    vqc->num_queue_pairs >
+			    VIRTCHNL_OP_CONFIG_VSI_QUEUES_MAX) {
 				err_msg_format = TRUE;
+				break;
+			}
+
+			valid_len += vqc->num_queue_pairs *
+			    sizeof(struct virtchnl_queue_pair_info);
 		}
 		break;
 	case VIRTCHNL_OP_CONFIG_IRQ_MAP:
@@ -644,10 +670,14 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode,
 		if (msglen >= valid_len) {
 			struct virtchnl_irq_map_info *vimi =
 			    (struct virtchnl_irq_map_info *)msg;
-			valid_len += (vimi->num_vectors *
-				      sizeof(struct virtchnl_vector_map));
-			if (vimi->num_vectors == 0)
+			if (vimi->num_vectors == 0 ||
+			    vimi->num_vectors > VIRTCHNL_OP_CONFIG_IRQ_MAP_MAX) {
 				err_msg_format = TRUE;
+				break;
+			}
+
+			valid_len += vimi->num_vectors *
+			    sizeof(struct virtchnl_vector_map);
 		}
 		break;
 	case VIRTCHNL_OP_ENABLE_QUEUES:
@@ -660,10 +690,15 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode,
 		if (msglen >= valid_len) {
 			struct virtchnl_ether_addr_list *veal =
 			    (struct virtchnl_ether_addr_list *)msg;
+			if (veal->num_elements == 0 ||
+			    veal->num_elements >
+			    VIRTCHNL_OP_ADD_DEL_ETH_ADDR_MAX) {
+				err_msg_format = TRUE;
+				break;
+			}
+
 			valid_len += veal->num_elements *
 			    sizeof(struct virtchnl_ether_addr);
-			if (veal->num_elements == 0)
-				err_msg_format = TRUE;
 		}
 		break;
 	case VIRTCHNL_OP_ADD_VLAN:
@@ -672,9 +707,13 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode,
 		if (msglen >= valid_len) {
 			struct virtchnl_vlan_filter_list *vfl =
 			    (struct virtchnl_vlan_filter_list *)msg;
-			valid_len += vfl->num_elements * sizeof(u16);
-			if (vfl->num_elements == 0)
+			if (vfl->num_elements == 0 ||
+			    vfl->num_elements > VIRTCHNL_OP_ADD_DEL_VLAN_MAX) {
 				err_msg_format = TRUE;
+				break;
+			}
+
+			valid_len += vfl->num_elements * sizeof(u16);
 		}
 		break;
 	case VIRTCHNL_OP_CONFIG_PROMISCUOUS_MODE:
@@ -700,7 +739,8 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode,
 		if (msglen >= valid_len) {
 			struct virtchnl_iwarp_qvlist_info *qv =
 				(struct virtchnl_iwarp_qvlist_info *)msg;
-			if (qv->num_vectors == 0) {
+			if (qv->num_vectors == 0 || qv->num_vectors >
+			    VIRTCHNL_OP_CONFIG_IWARP_IRQ_MAP_MAX) {
 				err_msg_format = TRUE;
 				break;
 			}
@@ -713,6 +753,8 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode,
 		if (msglen >= valid_len) {
 			struct virtchnl_rss_key *vrk =
 				(struct virtchnl_rss_key *)msg;
+			if (vrk->key_len == 0)
+				break;
 			valid_len += vrk->key_len - 1;
 		}
 		break;
@@ -721,6 +763,8 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode,
 		if (msglen >= valid_len) {
 			struct virtchnl_rss_lut *vrl =
 				(struct virtchnl_rss_lut *)msg;
+			if (vrl->lut_entries == 0)
+				break;
 			valid_len += vrl->lut_entries - 1;
 		}
 		break;