> -----Original Message-----
> From: Jose Ignacio Tornos Martinez <[email protected]>
> Sent: Thursday, April 23, 2026 3:04 PM
> To: [email protected]
> Cc: [email protected]; Kitszel, Przemyslaw
> <[email protected]>; Loktionov, Aleksandr
> <[email protected]>; Keller, Jacob E
> <[email protected]>; [email protected];
> [email protected]; Nguyen, Anthony L
> <[email protected]>; [email protected];
> [email protected]; [email protected]; [email protected]; Jose Ignacio
> Tornos Martinez <[email protected]>
> Subject: [PATCH net v4 2/4] i40e: skip unnecessary VF reset when
> setting trust
>
> The current implementation triggers a VF reset when changing the trust
> setting, causing a ~10 second delay during bonding setup.
>
> In all the cases, the reset causes a ~10 second delay during which:
> - VF must reinitialize completely
> - Any in-progress operations (like bonding enslave) fail with timeouts
> - VF is unavailable
>
> When granting trust, no reset is needed - we can just set the
> capability flag to allow privileged operations.
>
> When revoking trust, we need to:
> 1. Clear the capability flag to block privileged operations 2. Disable
> promiscuous mode if it was enabled (trusted VFs can enable it) 3. Only
> reset if ADQ is enabled (to clean up cloud filters)
>
> When we do reset (ADQ case), we reset first to clear VF_STATE_ACTIVE
> (which blocks new cloud filter additions), then delete existing cloud
> filters safely. This avoids the race condition where VF could add
> filters during deletion.
>
> When we don't reset, we manually handle capability flag and
> promiscuous mode via helper function, eliminating the delay.
>
> Signed-off-by: Jose Ignacio Tornos Martinez <[email protected]>
> ---
> v4: Address AI review (sashiko.dev) from Simon Horman:
> - Manually set/clear capability flag when not resetting
> - Explicitly disable promiscuous mode when revoking trust
> - Fix cloud filter race: reset FIRST (clears VF_STATE_ACTIVE),
> delete filters AFTER (no race window)
> - Add helper function i40e_setup_vf_trust() for non-reset path
> v3: https://lore.kernel.org/all/20260414110006.124286-3-
> [email protected]/
>
> .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 42 ++++++++++++++----
> -
> 1 file changed, 32 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> index a26c3d47ec15..69f68fec6809 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
> @@ -4943,6 +4943,30 @@ int i40e_ndo_set_vf_spoofchk(struct net_device
> *netdev, int vf_id, bool enable)
> return ret;
> }
>
> +/**
> + * i40e_setup_vf_trust - Enable/disable VF trust mode without reset
> + * @vf: VF to configure
> + * @setting: trust setting
> + *
> + * Manually handle capability flag and promiscuous mode when changing
> +trust
> + * without performing a VF reset.
> + * When reset is performed, this is not necessary as the reset
> +procedure
> + * already handles this.
> + **/
> +static void i40e_setup_vf_trust(struct i40e_vf *vf, bool setting) {
> + if (setting) {
> + set_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps);
> + } else {
> + clear_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps);
> +
> + if (test_bit(I40E_VF_STATE_UC_PROMISC, &vf->vf_states)
> ||
> + test_bit(I40E_VF_STATE_MC_PROMISC, &vf->vf_states))
> + i40e_config_vf_promiscuous_mode(vf, vf-
> >lan_vsi_idx,
> + false, false);
> + }
> +}
> +
> /**
> * i40e_ndo_set_vf_trust
> * @netdev: network interface device structure of the pf @@ -4987,19
> +5011,17 @@ int i40e_ndo_set_vf_trust(struct net_device *netdev, int
> vf_id, bool setting)
> set_bit(__I40E_MACVLAN_SYNC_PENDING, pf->state);
> pf->vsi[vf->lan_vsi_idx]->flags |=
> I40E_VSI_FLAG_FILTER_CHANGED;
>
> - i40e_vc_reset_vf(vf, true);
> + /* Reset only if revoking trust with ADQ (for cloud filter
> cleanup) */
> + if (vf->adq_enabled && !setting) {
> + i40e_vc_reset_vf(vf, true);
> + i40e_del_all_cloud_filters(vf);
> + } else {
> + i40e_setup_vf_trust(vf, setting);
> + }
> +
> dev_info(&pf->pdev->dev, "VF %u is now %strusted\n",
> vf_id, setting ? "" : "un");
>
> - if (vf->adq_enabled) {
> - if (!vf->trusted) {
> - dev_info(&pf->pdev->dev,
> - "VF %u no longer Trusted, deleting all
> cloud filters\n",
> - vf_id);
> - i40e_del_all_cloud_filters(vf);
> - }
> - }
> -
> out:
> clear_bit(__I40E_VIRTCHNL_OP_PENDING, pf->state);
> return ret;
> --
> 2.53.0
Reviewed-by: Aleksandr Loktionov <[email protected]>
