Page MenuHomeFreeBSD
Files F169052811

D59022.diff
No OneTemporary
Actions

D59022.diff
View Options

Index: share/man/man4/ice.4
===================================================================
--- share/man/man4/ice.4
+++ share/man/man4/ice.4
@@ -1107,9 +1107,13 @@
.Dq allow-set-mac
will be set to true.
.It mac-anti-spoof Pq bool
-Prevent the VF from sending Ethernet frames with a source address
-that does not match its own.
+Prevent the VF from sending Ethernet frames whose source address does not
+match a MAC address installed for that VF.
Enabled by default.
+The policy is enforced in hardware and replayed after PF and device resets.
+If firmware cannot install it during VF creation, the SR-IOV configuration
+request fails.
+If replay fails during reconstruction, the configured VF remains inactive.
.It allow-set-mac Pq bool
Allow the VF to set its own Ethernet MAC address.
Disallowed by default.
Index: sys/dev/ice/ice_iov.c
===================================================================
--- sys/dev/ice/ice_iov.c
+++ sys/dev/ice/ice_iov.c
@@ -65,6 +65,8 @@
#endif /* DRIVER_FAILPOINTS */
static struct ice_vf *ice_iov_get_vf(struct ice_softc *sc, int vf_num);
+static int ice_iov_configure_mac_anti_spoof(struct ice_softc *sc,
+ struct ice_vf *vf);
static void ice_iov_ready_vf(struct ice_softc *sc, struct ice_vf *vf);
static void ice_reset_vf(struct ice_softc *sc, struct ice_vf *vf,
bool trigger_vflr);
@@ -253,6 +255,47 @@
return &sc->vfs[vf_num];
}
+/**
+ * ice_iov_configure_mac_anti_spoof - Apply a VF's source-MAC policy
+ * @sc: device softc structure
+ * @vf: VF whose VSI security policy should be configured
+ *
+ * PF and device resets discard the hardware VSI context, so callers must
+ * replay this policy after creating or rebuilding the VF's VSI.
+ */
+static int
+ice_iov_configure_mac_anti_spoof(struct ice_softc *sc, struct ice_vf *vf)
+{
+ struct ice_vsi_ctx ctx = { 0 };
+ struct ice_vsi *vsi = vf->vsi;
+ struct ice_hw *hw = &sc->hw;
+ bool enable;
+ int status;
+
+ enable = (atomic_load_acq_32(&vf->vf_flags) &
+ VF_FLAG_MAC_ANTI_SPOOF) != 0;
+ ctx.info.sec_flags = vsi->info.sec_flags;
+ ctx.info.valid_sections =
+ CPU_TO_LE16(ICE_AQ_VSI_PROP_SECURITY_VALID);
+ if (enable)
+ ctx.info.sec_flags |= ICE_AQ_VSI_SEC_FLAG_ENA_MAC_ANTI_SPOOF;
+ else
+ ctx.info.sec_flags &= ~ICE_AQ_VSI_SEC_FLAG_ENA_MAC_ANTI_SPOOF;
+
+ status = ice_update_vsi(hw, vsi->idx, &ctx, NULL);
+ if (status != 0) {
+ device_printf(sc->dev,
+ "Unable to configure VF %u MAC anti-spoof %s, "
+ "err %s aq_err %s\n", vf->vf_num,
+ enable ? "on" : "off", ice_status_str(status),
+ ice_aq_str(hw->adminq.sq_last_status));
+ return (EIO);
+ }
+
+ vsi->info.sec_flags = ctx.info.sec_flags;
+ return (0);
+}
+
/**
* ice_iov_add_vf - Called by the OS for each VF to create
* @sc: device softc structure
@@ -447,6 +490,9 @@
}
ICE_IOV_FAIL_POINT(sc, vfnum, add_after_vsi_init, error,
release_imap);
+ error = ice_iov_configure_mac_anti_spoof(sc, vf);
+ if (error != 0)
+ goto release_imap;
/* Add the broadcast address */
error = ice_add_vsi_mac_filter(vsi, broadcastaddr);
@@ -772,6 +818,9 @@
return (error);
}
vsi->hw_stats.cur = accumulated_stats;
+ error = ice_iov_configure_mac_anti_spoof(sc, vf);
+ if (error != 0)
+ return (error);
status = ice_replay_vsi(hw, vsi->idx);
if (status != 0) {

File Metadata

Mime Type
text/plain
Expires
Tue, Sep 1, 6:33 AM (14 h, 9 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
37183716
Default Alt Text
D59022.diff (3 KB)

Event Timeline