git: 9bd865a67c22 - main - ice: Allow VSI loopback in VEB mode

The branch main has been updated by kbowling:

URL: https://cgit.FreeBSD.org/src/commit/?id=9bd865a67c22aa19c99aaee58fd98c03c5ac0bab

commit 9bd865a67c22aa19c99aaee58fd98c03c5ac0bab
Author:     Kevin Bowling <kbowling@FreeBSD.org>
AuthorDate: 2026-11-01 21:09:57 +0000
Commit:     Kevin Bowling <kbowling@FreeBSD.org>
CommitDate: 2026-11-01 21:47:18 +0000

    ice: Allow VSI loopback in VEB mode
    
    The embedded switch installs local forwarding rules with loopback enabled,
    but their source VSI must also permit loopback. Without that permission,
    traffic between host-attached VFs can trigger Tx data MDD events instead
    of reaching the destination VSI.
    
    Set ICE_AQ_VSI_SW_FLAG_ALLOW_LB when initializing a VSI in VEB mode, matching
    the forwarding rules to the VSI permission. Keep MAC anti-spoof checking
    enabled.
    
    Validated on E810 with native iavf and DPDK VFs, together with the absolute
    VF number correction. Local forwarding and queue/reset recovery passed;
    spoofed source MACs were still rejected and isolated.
    
    Fixes:          bc761988b724 ("ice: Add host SR-IOV support")
    MFC after:      2 weeks
    Sponsored by:   BBOX.io
---
 sys/dev/ice/ice_lib.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sys/dev/ice/ice_lib.c b/sys/dev/ice/ice_lib.c
index 96c58d78509d..8253f39f6d95 100644
--- a/sys/dev/ice/ice_lib.c
+++ b/sys/dev/ice/ice_lib.c
@@ -783,6 +783,9 @@ ice_initialize_vsi(struct ice_vsi *vsi)
 	}
 
 	ice_set_default_vsi_ctx(&ctx);
+	/* Match VSI loopback permission to the switch forwarding mode. */
+	if (hw->evb_veb)
+		ctx.info.sw_flags |= ICE_AQ_VSI_SW_FLAG_ALLOW_LB;
 	ice_set_rss_vsi_ctx(&ctx, vsi->type);
 
 	/* XXX: VSIs of other types may need different port info? */