[PATCH net] i40e: add devlink param to control VF MAC address limit

[PATCH net] i40e: add devlink param to control VF MAC address limit

[mheib]

From: Mohammad Heib <mheib@redhat.com>

This patch introduces a new devlink runtime parameter
to control whether the VF MAC filter limit feature is
enabled or disabled.

When the parameter is set to non-zero, the driver enforces the per-VF MAC
filter limit calculated from the number of allocated VFs and ports.
When the parameter is unset (zero), no limit is applied and behavior
remains as before commit cfb1d572c986
   ("i40e: Add ensurance of MacVlan resources for every trusted VF").

This implementation allows us to toggle the feature through devlink
while preserving old behavior. In the future, the parameter can be
extended to represent a configurable "max MACs per VF" value, but for
now it acts as a simple on/off switch.

Example command to enable per-vf mac limit:
 - devlink dev param set pci/0000:3b:00.0 name max_mac_per_vf \
	value 1 \
	cmode runtime

Fixes: cfb1d572c986 ("i40e: Add ensurance of MacVlan resources for every trusted VF")
Signed-off-by: Mohammad Heib <mheib@redhat.com>
---
 Documentation/networking/devlink/i40e.rst     | 19 +++++++
 drivers/net/ethernet/intel/i40e/i40e.h        |  4 ++
 .../net/ethernet/intel/i40e/i40e_devlink.c    | 56 ++++++++++++++++++-
 .../ethernet/intel/i40e/i40e_virtchnl_pf.c    | 14 ++++-
 4 files changed, 89 insertions(+), 4 deletions(-)

diff --git a/Documentation/networking/devlink/i40e.rst b/Documentation/networking/devlink/i40e.rst
index d3cb5bb5197e..4bdc7c33b2b3 100644
--- a/Documentation/networking/devlink/i40e.rst
+++ b/Documentation/networking/devlink/i40e.rst
@@ -7,6 +7,25 @@ i40e devlink support
 This document describes the devlink features implemented by the ``i40e``
 device driver.
 
+Parameters
+==========
+
+.. list-table:: Driver specific parameters implemented
+    :widths: 5 5 90
+
+    * - Name
+      - Mode
+      - Description
+    * - ``max_mac_per_vf``
+      - runtime
+      - Determines whether the per-VF MAC filter limit is enforced on i40e devices.
+        When set to 0: no limit is enforced, and each VF can request any
+        number of MAC addresses (legacy behavior).
+        When set to non-zero: the driver enforces a calculated per-VF MAC filter limit
+        based on the number of allocated VFs.
+
+        Default value of ``max_mac_per_vf`` parameter is ``0``.
+
 Info versions
 =============
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h
index 49aa4497efce..4a4cb55b6ce8 100644
--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -574,6 +574,10 @@ struct i40e_pf {
 	struct i40e_vf *vf;
 	int num_alloc_vfs;	/* actual number of VFs allocated */
 	u32 vf_aq_requests;
+	/* If set to none-zero, the device reserves
+	 * a minimum number of MAC filters for each VF.
+	 */
+	u32 max_mac_per_vf;
 	u32 arq_overflows;	/* Not fatal, possibly indicative of problems */
 	struct ratelimit_state mdd_message_rate_limit;
 	/* DCBx/DCBNL capability for PF that indicates
diff --git a/drivers/net/ethernet/intel/i40e/i40e_devlink.c b/drivers/net/ethernet/intel/i40e/i40e_devlink.c
index cc4e9e2addb7..8532e40b5c7d 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_devlink.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_devlink.c
@@ -5,6 +5,42 @@
 #include "i40e.h"
 #include "i40e_devlink.h"
 
+static int i40e_max_mac_per_vf_set(struct devlink *devlink,
+				   u32 id,
+				   struct devlink_param_gset_ctx *ctx,
+				   struct netlink_ext_ack *extack)
+{
+	struct i40e_pf *pf = devlink_priv(devlink);
+
+	pf->max_mac_per_vf = ctx->val.vu32;
+	return 0;
+}
+
+static int i40e_max_mac_per_vf_get(struct devlink *devlink,
+				   u32 id,
+				   struct devlink_param_gset_ctx *ctx)
+{
+	struct i40e_pf *pf = devlink_priv(devlink);
+
+	ctx->val.vu32 = pf->max_mac_per_vf;
+	return 0;
+}
+
+enum i40e_dl_param_id {
+	I40E_DEVLINK_PARAM_ID_BASE = DEVLINK_PARAM_GENERIC_ID_MAX,
+	I40E_DEVLINK_PARAM_ID_MAX_MAC_PER_VF,
+};
+
+static const struct devlink_param i40e_dl_params[] = {
+	DEVLINK_PARAM_DRIVER(I40E_DEVLINK_PARAM_ID_MAX_MAC_PER_VF,
+			     "max_mac_per_vf",
+			     DEVLINK_PARAM_TYPE_U32,
+			     BIT(DEVLINK_PARAM_CMODE_RUNTIME),
+			     i40e_max_mac_per_vf_get,
+			     i40e_max_mac_per_vf_set,
+			     NULL),
+};
+
 static void i40e_info_get_dsn(struct i40e_pf *pf, char *buf, size_t len)
 {
 	u8 dsn[8];
@@ -165,7 +201,19 @@ void i40e_free_pf(struct i40e_pf *pf)
  **/
 void i40e_devlink_register(struct i40e_pf *pf)
 {
-	devlink_register(priv_to_devlink(pf));
+	int err;
+	struct devlink *dl = priv_to_devlink(pf);
+	struct device *dev = &pf->pdev->dev;
+
+	err = devlink_params_register(dl, i40e_dl_params,
+				      ARRAY_SIZE(i40e_dl_params));
+	if (err) {
+		dev_err(dev,
+			"devlink params register failed with error %d", err);
+	}
+
+	devlink_register(dl);
+
 }
 
 /**
@@ -176,7 +224,11 @@ void i40e_devlink_register(struct i40e_pf *pf)
  **/
 void i40e_devlink_unregister(struct i40e_pf *pf)
 {
-	devlink_unregister(priv_to_devlink(pf));
+	struct devlink *dl = priv_to_devlink(pf);
+
+	devlink_unregister(dl);
+	devlink_params_unregister(dl, i40e_dl_params,
+				  ARRAY_SIZE(i40e_dl_params));
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 9b8efdeafbcf..020517b1a3f8 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -2949,9 +2949,19 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf,
 	 * all VFs.
 	 */
 	} else {
-		if ((i40e_count_filters(vsi) + mac2add_cnt) >
+		/* Enforce per-VF MAC filter limit only if enabled by
+		 * user/module param "max_mac_per_vf",
+		 * Currently, the parameter is used as a flag to indicate
+		 * whether the per-VF MAC limit should be enabled or not.
+		 *
+		 * If future work introduces VF MAC limits through devlink
+		 * resources, we can still use "max_mac_per_vf" as a fallback
+		 * for the maximum number of MACs per VF.
+		 */
+		if (((i40e_count_filters(vsi) + mac2add_cnt) >
 		    I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,
-						       hw->num_ports)) {
+						       hw->num_ports)) &&
+						       pf->max_mac_per_vf) {
 			dev_err(&pf->pdev->dev,
 				"Cannot add more MAC addresses, trusted VF exhausted it's resources\n");
 			return -EPERM;
-- 
2.50.1

Re: [PATCH net] i40e: add devlink param to control VF MAC address limit

[Przemek Kitszel]

On 8/22/25 01:39, mheib@redhat.com wrote:
> From: Mohammad Heib <mheib@redhat.com>
> 
> This patch introduces a new devlink runtime parameter
> to control whether the VF MAC filter limit feature is
> enabled or disabled.
> 
> When the parameter is set to non-zero, the driver enforces the per-VF MAC
> filter limit calculated from the number of allocated VFs and ports.
> When the parameter is unset (zero), no limit is applied and behavior
> remains as before commit cfb1d572c986
>     ("i40e: Add ensurance of MacVlan resources for every trusted VF").
> 
> This implementation allows us to toggle the feature through devlink
> while preserving old behavior. In the future, the parameter can be
> extended to represent a configurable "max MACs per VF" value, but for
> now it acts as a simple on/off switch.
> 
> Example command to enable per-vf mac limit:
>   - devlink dev param set pci/0000:3b:00.0 name max_mac_per_vf \
> 	value 1 \
> 	cmode runtime
> 
> Fixes: cfb1d572c986 ("i40e: Add ensurance of MacVlan resources for every trusted VF")
> Signed-off-by: Mohammad Heib <mheib@redhat.com>

thank you for the patch, I have a few questions/objections

1. it git-conflicts with [1], please post your next revision based on
Tony's (fixes) tree dev-queue branch [2]

2a. it is good practice to link to the previous discussions, and CC
individuals involved (Jake, Simon)

2b. for changes that utilize given subsystem (devlink), you need to CC
respective maintainers (Jiri)

3. it would really be better to treat not-zero values as strict limit

4. this idea is not limited to i40e, the parameter should be global
(for all drivers to implement), as it seems generic enough

5. when someone will make a per-given-VF param, this one will not be
deprecated but will still work as a cap (max) value. (Leaving it at
zero will be ofc perfectly fine).

[1] 
https://lore.kernel.org/intel-wired-lan/20250813104552.61027-9-przemyslaw.kitszel@intel.com/T/#mac68de249365b8c4fa83054592dd98f0f789fab4

[2] 
https://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue.git/log/?h=dev-queue

> ---
>   Documentation/networking/devlink/i40e.rst     | 19 +++++++
>   drivers/net/ethernet/intel/i40e/i40e.h        |  4 ++
>   .../net/ethernet/intel/i40e/i40e_devlink.c    | 56 ++++++++++++++++++-
>   .../ethernet/intel/i40e/i40e_virtchnl_pf.c    | 14 ++++-
>   4 files changed, 89 insertions(+), 4 deletions(-)
> 

RE: [Intel-wired-lan] [PATCH net] i40e: add devlink param to control VF MAC address limit

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of mheib@redhat.com
> Sent: Friday, August 22, 2025 1:40 AM
> To: intel-wired-lan@lists.osuosl.org
> Cc: Kitszel, Przemyslaw <przemyslaw.kitszel@intel.com>; Nguyen,
> Anthony L <anthony.l.nguyen@intel.com>; netdev@vger.kernel.org;
> Mohammad Heib <mheib@redhat.com>
> Subject: [Intel-wired-lan] [PATCH net] i40e: add devlink param to
> control VF MAC address limit
> 
> From: Mohammad Heib <mheib@redhat.com>
> 
> This patch introduces a new devlink runtime parameter to control
> whether the VF MAC filter limit feature is enabled or disabled.
> 
> When the parameter is set to non-zero, the driver enforces the per-VF
> MAC filter limit calculated from the number of allocated VFs and
> ports.
> When the parameter is unset (zero), no limit is applied and behavior
> remains as before commit cfb1d572c986
>    ("i40e: Add ensurance of MacVlan resources for every trusted VF").
> 
> This implementation allows us to toggle the feature through devlink
> while preserving old behavior. In the future, the parameter can be
> extended to represent a configurable "max MACs per VF" value, but for
> now it acts as a simple on/off switch.
> 
> Example command to enable per-vf mac limit:
>  - devlink dev param set pci/0000:3b:00.0 name max_mac_per_vf \
> 	value 1 \
> 	cmode runtime
> 
> Fixes: cfb1d572c986 ("i40e: Add ensurance of MacVlan resources for
> every trusted VF")
> Signed-off-by: Mohammad Heib <mheib@redhat.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>

...

> diff --git a/drivers/net/ethernet/intel/i40e/i40e.h
> b/drivers/net/ethernet/intel/i40e/i40e.h
> index 49aa4497efce..4a4cb55b6ce8 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e.h
> +++ b/drivers/net/ethernet/intel/i40e/i40e.h
> @@ -574,6 +574,10 @@ struct i40e_pf {
>  	struct i40e_vf *vf;
>  	int num_alloc_vfs;	/* actual number of VFs allocated */
>  	u32 vf_aq_requests;
> +	/* If set to none-zero, the device reserves
“If set to none‑zero” → non‑zero, othervise fine for me.

...

> 2.50.1

Re: [PATCH net] i40e: add devlink param to control VF MAC address limit

[mohammad heib]

Hi,

Thank you for the review. All comments have been addressed in v2.
On 8/22/25 12:09 PM, Przemek Kitszel wrote:
> On 8/22/25 01:39, mheib@redhat.com wrote:
>> From: Mohammad Heib <mheib@redhat.com>
>>
>> This patch introduces a new devlink runtime parameter
>> to control whether the VF MAC filter limit feature is
>> enabled or disabled.
>>
>> When the parameter is set to non-zero, the driver enforces the per-VF 
>> MAC
>> filter limit calculated from the number of allocated VFs and ports.
>> When the parameter is unset (zero), no limit is applied and behavior
>> remains as before commit cfb1d572c986
>>     ("i40e: Add ensurance of MacVlan resources for every trusted VF").
>>
>> This implementation allows us to toggle the feature through devlink
>> while preserving old behavior. In the future, the parameter can be
>> extended to represent a configurable "max MACs per VF" value, but for
>> now it acts as a simple on/off switch.
>>
>> Example command to enable per-vf mac limit:
>>   - devlink dev param set pci/0000:3b:00.0 name max_mac_per_vf \
>>     value 1 \
>>     cmode runtime
>>
>> Fixes: cfb1d572c986 ("i40e: Add ensurance of MacVlan resources for 
>> every trusted VF")
>> Signed-off-by: Mohammad Heib <mheib@redhat.com>
>
> thank you for the patch, I have a few questions/objections
>
> 1. it git-conflicts with [1], please post your next revision based on
> Tony's (fixes) tree dev-queue branch [2]
>
> 2a. it is good practice to link to the previous discussions, and CC
> individuals involved (Jake, Simon)
>
> 2b. for changes that utilize given subsystem (devlink), you need to CC
> respective maintainers (Jiri)
>
> 3. it would really be better to treat not-zero values as strict limit
>
> 4. this idea is not limited to i40e, the parameter should be global
> (for all drivers to implement), as it seems generic enough
>
> 5. when someone will make a per-given-VF param, this one will not be
> deprecated but will still work as a cap (max) value. (Leaving it at
> zero will be ofc perfectly fine).
Sure, I would be happy to add this to other drivers. Currently, I’m not 
aware of any other driver that has a per-VF MAC limit implemented.
If you know of any, please point me to them.
Otherwise, I will go through the drivers I’m working with and check 
whether they have such a limit or not.
>
> [1] 
> https://lore.kernel.org/intel-wired-lan/20250813104552.61027-9-przemyslaw.kitszel@intel.com/T/#mac68de249365b8c4fa83054592dd98f0f789fab4
>
> [2] 
> https://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue.git/log/?h=dev-queue
>
>> ---
>>   Documentation/networking/devlink/i40e.rst     | 19 +++++++
>>   drivers/net/ethernet/intel/i40e/i40e.h        |  4 ++
>>   .../net/ethernet/intel/i40e/i40e_devlink.c    | 56 ++++++++++++++++++-
>>   .../ethernet/intel/i40e/i40e_virtchnl_pf.c    | 14 ++++-
>>   4 files changed, 89 insertions(+), 4 deletions(-)
>>
>
Thanks,