|
 |
049c96 |
From 090af3d3a7fe36caa6eceb6bed51491425045ce9 Mon Sep 17 00:00:00 2001
|
|
|
049c96 |
From: Phil Sutter <psutter@redhat.com>
|
|
|
049c96 |
Date: Thu, 16 Jun 2016 16:50:59 +0200
|
|
|
049c96 |
Subject: [PATCH] iplink: Support VF Trust
|
|
|
049c96 |
|
|
|
049c96 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1302119
|
|
|
049c96 |
Upstream Status: iproute2.git commit b6d77d9ee3122
|
|
|
049c96 |
Conflicts: Context changes due to missing other features.
|
|
|
049c96 |
|
|
|
049c96 |
commit b6d77d9ee312246146e9b5ca70a8a1426898b484
|
|
|
049c96 |
Author: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com>
|
|
|
049c96 |
Date: Fri Feb 26 02:40:18 2016 +0000
|
|
|
049c96 |
|
|
|
049c96 |
iplink: Support VF Trust
|
|
|
049c96 |
|
|
|
049c96 |
Add IFLA_VF_TRUST message to trust the VF.
|
|
|
049c96 |
PF can accept some privileged operation from the trusted VF.
|
|
|
049c96 |
For example, ixgbe PF doesn't allow to enable VF promiscuous mode until
|
|
|
049c96 |
the VF is trusted because it may hurt performance.
|
|
|
049c96 |
|
|
|
049c96 |
To trust VF.
|
|
|
049c96 |
# ip link set dev eth0 vf 1 trust on
|
|
|
049c96 |
|
|
|
049c96 |
To untrust VF.
|
|
|
049c96 |
# ip link set dev eth0 vf 1 trust off
|
|
|
049c96 |
|
|
|
049c96 |
Signed-off-by: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com>
|
|
|
049c96 |
---
|
|
|
049c96 |
ip/iplink.c | 13 +++++++++++++
|
|
|
049c96 |
man/man8/ip-link.8.in | 8 +++++++-
|
|
|
049c96 |
2 files changed, 20 insertions(+), 1 deletion(-)
|
|
|
049c96 |
|
|
|
049c96 |
diff --git a/ip/iplink.c b/ip/iplink.c
|
|
|
049c96 |
index 0f91043..84bdc56 100644
|
|
|
049c96 |
--- a/ip/iplink.c
|
|
|
049c96 |
+++ b/ip/iplink.c
|
|
|
049c96 |
@@ -81,6 +81,7 @@ void iplink_usage(void)
|
|
|
049c96 |
fprintf(stderr, " [ spoofchk { on | off} ]\n");
|
|
|
049c96 |
fprintf(stderr, " [ query_rss { on | off} ]\n");
|
|
|
049c96 |
fprintf(stderr, " [ state { auto | enable | disable} ] ]\n");
|
|
|
049c96 |
+ fprintf(stderr, " [ trust { on | off} ] ]\n");
|
|
|
049c96 |
fprintf(stderr, " [ master DEVICE ]\n");
|
|
|
049c96 |
fprintf(stderr, " [ nomaster ]\n");
|
|
|
049c96 |
fprintf(stderr, " [ addrgenmode { eui64 | none } ]\n");
|
|
|
049c96 |
@@ -302,6 +303,18 @@ static int iplink_parse_vf(int vf, int *argcp, char ***argvp,
|
|
|
049c96 |
ivs.vf = vf;
|
|
|
049c96 |
addattr_l(&req->n, sizeof(*req), IFLA_VF_RSS_QUERY_EN, &ivs, sizeof(ivs));
|
|
|
049c96 |
|
|
|
049c96 |
+ } else if (matches(*argv, "trust") == 0) {
|
|
|
049c96 |
+ struct ifla_vf_trust ivt;
|
|
|
049c96 |
+ NEXT_ARG();
|
|
|
049c96 |
+ if (matches(*argv, "on") == 0)
|
|
|
049c96 |
+ ivt.setting = 1;
|
|
|
049c96 |
+ else if (matches(*argv, "off") == 0)
|
|
|
049c96 |
+ ivt.setting = 0;
|
|
|
049c96 |
+ else
|
|
|
049c96 |
+ invarg("Invalid \"trust\" value\n", *argv);
|
|
|
049c96 |
+ ivt.vf = vf;
|
|
|
049c96 |
+ addattr_l(&req->n, sizeof(*req), IFLA_VF_TRUST, &ivt, sizeof(ivt));
|
|
|
049c96 |
+
|
|
|
049c96 |
} else if (matches(*argv, "state") == 0) {
|
|
|
049c96 |
struct ifla_vf_link_state ivl;
|
|
|
049c96 |
NEXT_ARG();
|
|
|
049c96 |
diff --git a/man/man8/ip-link.8.in b/man/man8/ip-link.8.in
|
|
|
049c96 |
index 312be6b..1d052ef 100644
|
|
|
049c96 |
--- a/man/man8/ip-link.8.in
|
|
|
049c96 |
+++ b/man/man8/ip-link.8.in
|
|
|
049c96 |
@@ -118,7 +118,9 @@ ip-link \- network device configuration
|
|
|
049c96 |
.RB "[ " vlan
|
|
|
049c96 |
.IR VLANID " [ "
|
|
|
049c96 |
.B qos
|
|
|
049c96 |
-.IR VLAN-QOS " ] ]"
|
|
|
049c96 |
+.IR VLAN-QOS " ] ] ["
|
|
|
049c96 |
+.B trust { on | off }
|
|
|
049c96 |
+] |
|
|
|
049c96 |
.br
|
|
|
049c96 |
.RB "[ " rate
|
|
|
049c96 |
.IR TXRATE " ]"
|
|
|
049c96 |
@@ -872,6 +874,10 @@ parameter must be specified.
|
|
|
049c96 |
.sp
|
|
|
049c96 |
.BI spoofchk " on|off"
|
|
|
049c96 |
- turn packet spoof checking on or off for the specified VF.
|
|
|
049c96 |
+.sp
|
|
|
049c96 |
+.BI trust " on|off"
|
|
|
049c96 |
+- trust the specified VF user. This enables that VF user can set a specific feature
|
|
|
049c96 |
+which may impact security and/or performance. (e.g. VF multicast promiscuous mode)
|
|
|
049c96 |
.in -8
|
|
|
049c96 |
|
|
|
049c96 |
.TP
|
|
|
049c96 |
--
|
|
|
049c96 |
1.8.3.1
|
|
|
049c96 |
|