Re: [PATCH iwl-net] ice: do not classify EAPOL MAC address as LLDP

[Przemek Kitszel <przemyslaw.kitszel@intel.com>]

On 11/4/26 11:00 PM, Petr Oros wrote:
> 01:80:c2:00:00:03 (Nearest Non-TPMR Bridge) is also the 802.1X PAE
> group address used by EAPOL, and the virtchnl MAC filter API carries no
> ethertype to tell the two apart. ice_vc_can_add_mac() therefore rejects
> it on untrusted VFs, which fails the whole ADD_ETH_ADDR request and
> breaks 802.1X authentication:
> 
> [  128.447213] ice 0000:17:00.2: An untrusted VF 0 is attempting to configure an LLDP multicast address
> [  128.447301] iavf 0000:17:11.0: Failed to add MAC filter, error IAVF_ERR_ADMIN_QUEUE_ERROR
> 
> Drop 0x03 from ice_is_mc_lldp_eth_addr() and treat it as a regular
> multicast MAC. Trusted VFs still get the ETH_P_LLDP forwarding rule
> through the other two LLDP addresses and the rule does not match on
> the destination MAC anyway.
> 
> Fixes: 2296345416b0 ("ice: receive LLDP on trusted VFs")
> Signed-off-by: Petr Oros <poros@redhat.com>

Thank you!
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>

> ---
>   drivers/net/ethernet/intel/ice/virt/virtchnl.c | 7 ++++---
>   1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/ice/virt/virtchnl.c b/drivers/net/ethernet/intel/ice/virt/virtchnl.c
> index ca8018e3dd4288..27f0e1dee24642 100644
> --- a/drivers/net/ethernet/intel/ice/virt/virtchnl.c
> +++ b/drivers/net/ethernet/intel/ice/virt/virtchnl.c
> @@ -744,8 +744,9 @@ ice_vfhw_mac_add(struct ice_vf *vf, struct virtchnl_ether_addr *vc_ether_addr)
>    * ice_is_mc_lldp_eth_addr - check if the given MAC is a multicast LLDP address
>    * @mac: address to check
>    *
> - * Return: true if the address is one of the three possible LLDP multicast
> - *	   addresses, false otherwise.
> + * Return: true if the address is one of the LLDP multicast addresses
> + *	   handled by this driver (Nearest Bridge or Nearest Customer Bridge),
> + *	   false otherwise.
>    */
>   static bool ice_is_mc_lldp_eth_addr(const u8 *mac)
>   {
> @@ -754,7 +755,7 @@ static bool ice_is_mc_lldp_eth_addr(const u8 *mac)
>   	if (memcmp(mac, lldp_mac_base, sizeof(lldp_mac_base)))
>   		return false;
>   
> -	return (mac[5] == 0x0e || mac[5] == 0x03 || mac[5] == 0x00);
> +	return (mac[5] == 0x0e || mac[5] == 0x00);
>   }
>   
>   /**