ice: Enforce VF MAC anti-spoof policyHEADmain

The SR-IOV schema enables MAC anti-spoofing by default, but the driver
never programs the VSI security section.  A VF can therefore transmit
with an arbitrary source address despite the configured policy.

Program ICE_AQ_VSI_SEC_FLAG_ENA_MAC_ANTI_SPOOF when the VF VSI is
created, and replay the policy when the VSI is rebuilt after a PF or
device reset.  Fail VF creation or rebuild when firmware cannot install
the security policy so an unprotected VF is never published as active.

Validated on E810 hardware with host-attached and Linux passthrough
VFs.  Traffic using the assigned source MAC passed while otherwise
identical forged-source frames were dropped.  After a PF reset, assigned
traffic resumed and zero of ten forged frames reached the peer.

An injected MAC anti-spoof update failure left the VF inactive.
Destroying and recreating the SR-IOV configuration restored the policy
and traffic.

MFC after:	2 weeks
Sponsored by:	BBOX.io
Differential Revision:	https://reviews.freebsd.org/D59022

0 files changed, 0 insertions, 0 deletions