Received-SPF: pass (google.com: domain of linux-kernel+bounces-92912-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
Date: Tue, 5 Mar 2024 11:54:50 -0800
From: Jakub Kicinski <kuba@kernel.org>
To: Larysa Zaremba <larysa.zaremba@intel.com>
Cc: Jiri Pirko <jiri@resnulli.us>, <intel-wired-lan@lists.osuosl.org>,
 <netdev@vger.kernel.org>, <linux-kernel@vger.kernel.org>, Mateusz Pacuszka
 <mateuszx.pacuszka@intel.com>, Tony Nguyen <anthony.l.nguyen@intel.com>,
 Lukasz Plachno <lukasz.plachno@intel.com>, Jakub Buchocki
 <jakubx.buchocki@intel.com>, Pawel Kaminski <pawel.kaminski@intel.com>,
 Przemek Kitszel <przemyslaw.kitszel@intel.com>, Michal Swiatkowski
 <michal.swiatkowski@linux.intel.com>, Mateusz Polchlopek
 <mateusz.polchlopek@intel.com>, "David S. Miller" <davem@davemloft.net>,
 Eric Dumazet <edumazet@google.com>, Paolo Abeni <pabeni@redhat.com>, "Pawel
 Chmielewski" <pawel.chmielewski@intel.com>, Jesse Brandeburg
 <jesse.brandeburg@intel.com>
Subject: Re: [PATCH iwl-net 0/5] ice: LLDP support for VFs
Message-ID: <20240305115450.577c161e@kernel.org>
In-Reply-To: <ZeJ3u2x3Ihs8WQJn@lzaremba-mobl.ger.corp.intel.com>
References: <20240228155957.408036-1-larysa.zaremba@intel.com>
	<20240228084745.2c0fef0e@kernel.org>
	<ZeBMRXUjVSwUHxU-@nanopsycho>
	<20240229072813.5d7614c3@kernel.org>
	<ZeDb8Dr8mBvov9fc@lzaremba-mobl.ger.corp.intel.com>
	<20240301090836.185e3b79@kernel.org>
	<ZeJ3u2x3Ihs8WQJn@lzaremba-mobl.ger.corp.intel.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Sat, 2 Mar 2024 01:50:03 +0100 Larysa Zaremba wrote:
> For RX: match on Ethertype and mirror, every trusted VF should be able to scan 
> neighbors.
> 
> For TX this is more complicated and is done not through eswitch, but through 
> modifying security options, so do not think this would work with tc. So private 
> flags are the best option? Our requirements say only a single VSI can transmit 
> LLDP.

It is doable theoretically, tho, right? Driver can detect that all
eswitch VF/PF ports but one have a "drop LLDP" rule and update the
security option correctly?