On Wed, Oct 30, 2019 at 12:21 AM Thomas Monjalon <tho...@monjalon.net> wrote: > > In a virtual environment, the network controller may have to configure > some SR-IOV VF parameters for security reasons.
Just to understand, Could you explain more details/examples for security reasons? > > When the PF (host port) is driven by DPDK (OVS-DPDK case), > we face two different cases: > - driver is bifurcated (Mellanox case), > so the VF can be configured via the kernel. > - driver is on top of UIO or VFIO, so DPDK API is required, Not true. Both UIO and VFIO are NOT allowed to create SRIOV VF from the PF device. It is only allowed through igb-uio out of tree driver without iommu support. > and PMD-specific APIs were used. > This new generic API will avoid vendors fragmentation. The API is good. But I have concerns about the vendor implementation of this API. It can support only vendors with bifurcated driver(Mellanox case). or using igb_uio(non iommu case) but not the devices with VFIO(Which is the first-class citizen). All the control plane control stuff to replace Linux with "port representor" logic will be of the mercy of an "out of tree" driver either with igb_uio or http://patches.dpdk.org/patch/58810/ I am _not against_ on DPDK supports port representor or controlling netdev VF traffic, but if we have taken that path then DPDK should have the infrastructure to support for all driver models like VFIO(Addressed in [1]) I would have this question when DPDK starts supporting port representor(but I was not aware that kernel security issue on netdev ports controlled by DPDK in non-bifurcated driver case and concise effort block such scheme by kernel [2]) [1] http://patches.dpdk.org/patch/58810/ [2] https://patchwork.kernel.org/patch/10522381/ > > Some PMD-specific API could migrate to this generic model. > As an example, the default MAC address configuration is demonstrated > for a VF mapped to mlx5 representor port. > > As it breaks the ABI, I propose to merge this API in DPDK 19.11-rc2. > > I am sorry I had not send a patch since proposing a RFC in August. > (I gave priority to the summit and the -rc1 release) > > > Thomas Monjalon (3): > ethdev: identify SR-IOV VF from host > ethdev: set VF MAC address from host > net/mlx5: set VF MAC address from host > > drivers/net/mlx5/mlx5.c | 6 +++ > drivers/net/mlx5/mlx5.h | 1 + > drivers/net/mlx5/mlx5_mac.c | 19 ++++++++ > lib/librte_ethdev/rte_ethdev.c | 55 +++++++++++++++++++++--- > lib/librte_ethdev/rte_ethdev.h | 38 ++++++++++++++++ > lib/librte_ethdev/rte_ethdev_core.h | 1 + > lib/librte_ethdev/rte_ethdev_version.map | 1 + > 7 files changed, 114 insertions(+), 7 deletions(-) > > -- > 2.23.0 >
