[PATCH] PATCH: i40e Improve trusted VF MAC addresses logging when limit is reached

[PATCH] PATCH: i40e Improve trusted VF MAC addresses logging when limit is reached

[David Hill]

When a VF reaches the limit introduced in this commit [1], the host reports
an error in the syslog but doesn't mention which VF reached its limit and
what the limit is actually is which makes troubleshooting of networking
issue a bit tedious.   This commit simply improves this error reporting
by adding which VF number has reached a limit and what that limit is.

Signed-off-by: David Hill <dhill@redhat.com>

[1] commit cfb1d572c986a39fd288f48a6305d81e6f8d04a3
Author: Karen Sornek <karen.sornek@intel.com>
Date:   Thu Jun 17 09:19:26 2021 +0200
---
 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 9b8efdeafbcf..dc0e7a80d83a 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -2953,7 +2953,8 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf,
 		    I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,
 						       hw->num_ports)) {
 			dev_err(&pf->pdev->dev,
-				"Cannot add more MAC addresses, trusted VF exhausted it's resources\n");
+				"Cannot add more MAC addresses, trusted VF %d uses %d out of %d MAC addresses\n", vf->vf_id, i40e_count_filters(vsi) +
+          mac2add_cnt, I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,num_ports)));
 			return -EPERM;
 		}
 	}
-- 
2.50.1


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Re: [PATCH] PATCH: i40e Improve trusted VF MAC addresses logging when limit is reached

[kernel test robot]

Hi David,

kernel test robot noticed the following build errors:

[auto build test ERROR on tnguy-next-queue/dev-queue]
[also build test ERROR on tnguy-net-queue/dev-queue horms-ipvs/master linus/master v6.16 next-20250801]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/David-Hill/PATCH-i40e-Improve-trusted-VF-MAC-addresses-logging-when-limit-is-reached/20250801-213326
base:   https://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue.git dev-queue
patch link:    https://lore.kernel.org/r/20250801133017.2107083-1-dhill%40redhat.com
patch subject: [PATCH] PATCH: i40e Improve trusted VF MAC addresses logging when limit is reached
config: x86_64-buildonly-randconfig-003-20250802 (https://download.01.org/0day-ci/archive/20250802/202508021646.pWqgToeU-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250802/202508021646.pWqgToeU-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202508021646.pWqgToeU-lkp@intel.com/

All errors (new ones prefixed by >>):

>> drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:2957:77: error: use of undeclared identifier 'num_ports'
    2957 |           mac2add_cnt, I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,num_ports)));
         |                                                                             ^
>> drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:2957:77: error: use of undeclared identifier 'num_ports'
>> drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c:2957:88: error: extraneous ')' before ';'
    2957 |           mac2add_cnt, I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,num_ports)));
         |                                                                                        ^
   3 errors generated.


vim +/num_ports +2957 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c

  2870	
  2871	#define I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(vf_num, num_ports)		\
  2872	({	typeof(vf_num) vf_num_ = (vf_num);				\
  2873		typeof(num_ports) num_ports_ = (num_ports);			\
  2874		((I40E_MAX_MACVLAN_PER_PF(num_ports_) - vf_num_ *		\
  2875		I40E_VC_MAX_MAC_ADDR_PER_VF) / vf_num_) +			\
  2876		I40E_VC_MAX_MAC_ADDR_PER_VF; })
  2877	/**
  2878	 * i40e_check_vf_permission
  2879	 * @vf: pointer to the VF info
  2880	 * @al: MAC address list from virtchnl
  2881	 *
  2882	 * Check that the given list of MAC addresses is allowed. Will return -EPERM
  2883	 * if any address in the list is not valid. Checks the following conditions:
  2884	 *
  2885	 * 1) broadcast and zero addresses are never valid
  2886	 * 2) unicast addresses are not allowed if the VMM has administratively set
  2887	 *    the VF MAC address, unless the VF is marked as privileged.
  2888	 * 3) There is enough space to add all the addresses.
  2889	 *
  2890	 * Note that to guarantee consistency, it is expected this function be called
  2891	 * while holding the mac_filter_hash_lock, as otherwise the current number of
  2892	 * addresses might not be accurate.
  2893	 **/
  2894	static inline int i40e_check_vf_permission(struct i40e_vf *vf,
  2895						   struct virtchnl_ether_addr_list *al)
  2896	{
  2897		struct i40e_pf *pf = vf->pf;
  2898		struct i40e_vsi *vsi = pf->vsi[vf->lan_vsi_idx];
  2899		struct i40e_hw *hw = &pf->hw;
  2900		int mac2add_cnt = 0;
  2901		int i;
  2902	
  2903		for (i = 0; i < al->num_elements; i++) {
  2904			struct i40e_mac_filter *f;
  2905			u8 *addr = al->list[i].addr;
  2906	
  2907			if (is_broadcast_ether_addr(addr) ||
  2908			    is_zero_ether_addr(addr)) {
  2909				dev_err(&pf->pdev->dev, "invalid VF MAC addr %pM\n",
  2910					addr);
  2911				return -EINVAL;
  2912			}
  2913	
  2914			/* If the host VMM administrator has set the VF MAC address
  2915			 * administratively via the ndo_set_vf_mac command then deny
  2916			 * permission to the VF to add or delete unicast MAC addresses.
  2917			 * Unless the VF is privileged and then it can do whatever.
  2918			 * The VF may request to set the MAC address filter already
  2919			 * assigned to it so do not return an error in that case.
  2920			 */
  2921			if (!i40e_can_vf_change_mac(vf) &&
  2922			    !is_multicast_ether_addr(addr) &&
  2923			    !ether_addr_equal(addr, vf->default_lan_addr.addr)) {
  2924				dev_err(&pf->pdev->dev,
  2925					"VF attempting to override administratively set MAC address, bring down and up the VF interface to resume normal operation\n");
  2926				return -EPERM;
  2927			}
  2928	
  2929			/*count filters that really will be added*/
  2930			f = i40e_find_mac(vsi, addr);
  2931			if (!f)
  2932				++mac2add_cnt;
  2933		}
  2934	
  2935		/* If this VF is not privileged, then we can't add more than a limited
  2936		 * number of addresses. Check to make sure that the additions do not
  2937		 * push us over the limit.
  2938		 */
  2939		if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps)) {
  2940			if ((i40e_count_filters(vsi) + mac2add_cnt) >
  2941			    I40E_VC_MAX_MAC_ADDR_PER_VF) {
  2942				dev_err(&pf->pdev->dev,
  2943					"Cannot add more MAC addresses, VF is not trusted, switch the VF to trusted to add more functionality\n");
  2944				return -EPERM;
  2945			}
  2946		/* If this VF is trusted, it can use more resources than untrusted.
  2947		 * However to ensure that every trusted VF has appropriate number of
  2948		 * resources, divide whole pool of resources per port and then across
  2949		 * all VFs.
  2950		 */
  2951		} else {
  2952			if ((i40e_count_filters(vsi) + mac2add_cnt) >
  2953			    I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,
  2954							       hw->num_ports)) {
  2955				dev_err(&pf->pdev->dev,
  2956					"Cannot add more MAC addresses, trusted VF %d uses %d out of %d MAC addresses\n", vf->vf_id, i40e_count_filters(vsi) +
> 2957	          mac2add_cnt, I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,num_ports)));
  2958				return -EPERM;
  2959			}
  2960		}
  2961		return 0;
  2962	}
  2963	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

[PATCH] PATCH: i40e Improve trusted VF MAC addresses logging when limit is reached

[David Hill]

When a VF reaches the limit introduced in this commit [1], the host reports
an error in the syslog but doesn't mention which VF reached its limit and
what the limit is actually is which makes troubleshooting of networking
issue a bit tedious.   This commit simply improves this error reporting
by adding which VF number has reached a limit and what that limit is.

Signed-off-by: David Hill <dhill@redhat.com>

[1] commit cfb1d572c986a39fd288f48a6305d81e6f8d04a3
Author: Karen Sornek <karen.sornek@intel.com>
Date:   Thu Jun 17 09:19:26 2021 +0200
---
 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 9b8efdeafbcf..44e3e75e8fb0 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -2953,7 +2953,8 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf,
 		    I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,
 						       hw->num_ports)) {
 			dev_err(&pf->pdev->dev,
-				"Cannot add more MAC addresses, trusted VF exhausted it's resources\n");
+				"Cannot add more MAC addresses, trusted VF %d uses %d out of %d MAC addresses\n", vf->vf_id, i40e_count_filters(vsi) +
+          mac2add_cnt, I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,hw->num_ports));
 			return -EPERM;
 		}
 	}
-- 
2.50.1


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Re: [PATCH] PATCH: i40e Improve trusted VF MAC addresses logging when limit is reached

[Simon Horman]

On Sat, Aug 02, 2025 at 10:13:22AM -0400, David Hill wrote:
> When a VF reaches the limit introduced in this commit [1], the host reports
> an error in the syslog but doesn't mention which VF reached its limit and
> what the limit is actually is which makes troubleshooting of networking
> issue a bit tedious.   This commit simply improves this error reporting
> by adding which VF number has reached a limit and what that limit is.
> 
> Signed-off-by: David Hill <dhill@redhat.com>
> 
> [1] commit cfb1d572c986a39fd288f48a6305d81e6f8d04a3
> Author: Karen Sornek <karen.sornek@intel.com>
> Date:   Thu Jun 17 09:19:26 2021 +0200

Hi David,

Your Signed-off-by, and any other tags, should come at the end of
the commit message. In this case, immediately before the scissors ("---").

And the correct form for a commit citation in a commit message is like
this. Note: There should be 12 or more characters of hash - usually 12 is
enough to prevent a collision with current hashes; And, unlike a Fixes
tag it should be line wrapped as appropriate.

commit cfb1d572c986 ("i40e: Add ensurance of MacVlan resources for every
trusted VF")

> ---
>  drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> index 9b8efdeafbcf..44e3e75e8fb0 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> @@ -2953,7 +2953,8 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf,
>  		    I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,
>  						       hw->num_ports)) {
>  			dev_err(&pf->pdev->dev,
> -				"Cannot add more MAC addresses, trusted VF exhausted it's resources\n");
> +				"Cannot add more MAC addresses, trusted VF %d uses %d out of %d MAC addresses\n", vf->vf_id, i40e_count_filters(vsi) +
> +          mac2add_cnt, I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,hw->num_ports));
>  			return -EPERM;
>  		}
>  	}

I am wondering if we can achieve the same in a slightly less verbose way.
And follow more closely the preference in Networking code to keep lines
to 80 columns wide or less, unless it reduces readability (subjective to to
be sure).

Something like this (compile tested only!):

diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 9b8efdeafbcf..874a0d907496 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -2896,8 +2896,8 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf,
 {
 	struct i40e_pf *pf = vf->pf;
 	struct i40e_vsi *vsi = pf->vsi[vf->lan_vsi_idx];
+	int mac2add_cnt = i40e_count_filters(vsi);
 	struct i40e_hw *hw = &pf->hw;
-	int mac2add_cnt = 0;
 	int i;
 
 	for (i = 0; i < al->num_elements; i++) {
@@ -2937,8 +2937,7 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf,
 	 * push us over the limit.
 	 */
 	if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps)) {
-		if ((i40e_count_filters(vsi) + mac2add_cnt) >
-		    I40E_VC_MAX_MAC_ADDR_PER_VF) {
+		if (mac2add_cnt > I40E_VC_MAX_MAC_ADDR_PER_VF) {
 			dev_err(&pf->pdev->dev,
 				"Cannot add more MAC addresses, VF is not trusted, switch the VF to trusted to add more functionality\n");
 			return -EPERM;
@@ -2949,11 +2948,14 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf,
 	 * all VFs.
 	 */
 	} else {
-		if ((i40e_count_filters(vsi) + mac2add_cnt) >
-		    I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,
-						       hw->num_ports)) {
+		int add_max;
+
+		add_max = I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,
+							     hw->num_ports);
+		if (mac2add_cnt > add_max) {
 			dev_err(&pf->pdev->dev,
-				"Cannot add more MAC addresses, trusted VF exhausted it's resources\n");
+				"Cannot add more MAC addresses, trusted VF %d uses %d out of %d MAC addresses\n",
+				vf->vf_id, mac2add_cnt, add_max);
 			return -EPERM;
 		}
 	}

While sketching-out the above I noticed the dev_err() relating to
undtrusted VFs (around line 2940). And I'm wondering if you think
it makes sense to give it the same treatment that your patch
gives to the dev_err for trusted VFS (around line 2955).

[PATCH] PATCH: i40e Improve trusted VF MAC addresses logging when limit is reached

[David Hill]

When a VF reaches the limit introduced in this commit [1], the host reports
an error in the syslog but doesn't mention which VF reached its limit and
what the limit is actually is which makes troubleshooting of networking
issue a bit tedious.   This commit simply improves this error reporting
by adding which VF number has reached a limit and what that limit is.

[1] commit cfb1d572c986 ("i40e: Add ensurance of MacVlan resources for every
trusted VF")

Signed-off-by: David Hill <dhill@redhat.com>
---
 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 9b8efdeafbcf..eb587e2bb35f 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -2911,6 +2911,8 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf,
 			return -EINVAL;
 		}
 
+		int new_count = i40e_count_filters(vsi) + mac2add_cnt;
+		int max_macvlan = I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs, hw->num_ports);
 		/* If the host VMM administrator has set the VF MAC address
 		 * administratively via the ndo_set_vf_mac command then deny
 		 * permission to the VF to add or delete unicast MAC addresses.
@@ -2937,8 +2939,7 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf,
 	 * push us over the limit.
 	 */
 	if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps)) {
-		if ((i40e_count_filters(vsi) + mac2add_cnt) >
-		    I40E_VC_MAX_MAC_ADDR_PER_VF) {
+		if ( new_count > I40E_VC_MAX_MAC_ADDR_PER_VF) {
 			dev_err(&pf->pdev->dev,
 				"Cannot add more MAC addresses, VF is not trusted, switch the VF to trusted to add more functionality\n");
 			return -EPERM;
@@ -2949,11 +2950,10 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf,
 	 * all VFs.
 	 */
 	} else {
-		if ((i40e_count_filters(vsi) + mac2add_cnt) >
-		    I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,
-						       hw->num_ports)) {
+		if (new_count > max_macvlan) {
 			dev_err(&pf->pdev->dev,
-				"Cannot add more MAC addresses, trusted VF exhausted it's resources\n");
+				"Cannot add more MAC addresses, trusted VF %d uses (%d/%d) MAC addresses\n",
+				vf->vf_id, new_count, max_macvlan);
 			return -EPERM;
 		}
 	}
-- 
2.50.1


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

[PATCH] PATCH: i40e Improve trusted VF MAC addresses logging when limit is reached

[David Hill]

When a VF reaches the limit introduced in this commit [1], the host reports
an error in the syslog but doesn't mention which VF reached its limit and
what the limit is actually is which makes troubleshooting of networking
issue a bit tedious.   This commit simply improves this error reporting
by adding which VF number has reached a limit and what that limit is.

[1] commit cfb1d572c986 ("i40e: Add ensurance of MacVlan resources for every
trusted VF")

Signed-off-by: David Hill <dhill@redhat.com>
---
 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 9b8efdeafbcf..c66c8bbc3993 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -2932,13 +2932,14 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf,
 			++mac2add_cnt;
 	}
 
+	int new_count = i40e_count_filters(vsi) + mac2add_cnt;
+	int max_macvlan = I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs, hw->num_ports);
 	/* If this VF is not privileged, then we can't add more than a limited
 	 * number of addresses. Check to make sure that the additions do not
 	 * push us over the limit.
 	 */
 	if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps)) {
-		if ((i40e_count_filters(vsi) + mac2add_cnt) >
-		    I40E_VC_MAX_MAC_ADDR_PER_VF) {
+		if ( new_count > I40E_VC_MAX_MAC_ADDR_PER_VF) {
 			dev_err(&pf->pdev->dev,
 				"Cannot add more MAC addresses, VF is not trusted, switch the VF to trusted to add more functionality\n");
 			return -EPERM;
@@ -2949,11 +2950,10 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf,
 	 * all VFs.
 	 */
 	} else {
-		if ((i40e_count_filters(vsi) + mac2add_cnt) >
-		    I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,
-						       hw->num_ports)) {
+		if (new_count > max_macvlan) {
 			dev_err(&pf->pdev->dev,
-				"Cannot add more MAC addresses, trusted VF exhausted it's resources\n");
+				"Cannot add more MAC addresses, trusted VF %d uses (%d/%d) MAC addresses\n",
+				vf->vf_id, new_count, max_macvlan);
 			return -EPERM;
 		}
 	}
-- 
2.50.1


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.