TELCODOCS-2036: Procedure added for MLX secure boot

Author: Padraig O'Grady

modules/nw-sriov-nic-mlx-secure-boot.adoc

@@ -0,0 +1,94 @@
+// Module included in the following assemblies:
+//
+// * networking/hardware_networks/configuring-sriov-device.adoc
+
+[id="nw-sriov-nic-mlx-secure-boot_{context}"]
+= MLX Secure Boot
+
+In some cases, you might want to split virtual functions (VFs) from the same physical function (PF) into multiple resource pools.
+For example, you might want some of the VFs to load with the default driver and the remaining VFs load with the `vfio-pci` driver.
+In such a deployment, the `pfNames` selector in your SriovNetworkNodePolicy custom resource (CR) can be used to specify a range of VFs for a pool using the following format: `<pfname>#<first_vf>-<last_vf>`.
+
+For example, the following YAML shows the selector for an interface named `netpf0` with VF `2` through `7`:
+
+[source,yaml]
+----
+pfNames: ["netpf0#2-7"]
+----
+
+* `netpf0` is the PF interface name.
+* `2` is the first VF index (0-based) that is included in the range.
+* `7` is the last VF index (0-based) that is included in the range.
+
+You can select VFs from the same PF by using different policy CRs if the following requirements are met:
+
+* The `numVfs` value must be identical for policies that select the same PF.
+* The VF index must be in the range of `0` to `<numVfs>-1`. For example, if you have a policy with `numVfs` set to `8`, then the `<first_vf>` value must not be smaller than `0`, and the `<last_vf>` must not be larger than `7`.
+* The VFs ranges in different policies must not overlap.
+* The `<first_vf>` must not be larger than the `<last_vf>`.
+
+The following example illustrates NIC partitioning for an SR-IOV device.
+
+The policy `policy-net-1` defines a resource pool `net-1` that contains the VF `0` of PF `netpf0` with the default VF driver.
+The policy `policy-net-1-dpdk` defines a resource pool `net-1-dpdk` that contains the VF `8` to `15` of PF `netpf0` with the `vfio` VF driver.
+
+Policy `policy-net-1`:
+
+[source,yaml]
+----
+apiVersion: sriovnetwork.openshift.io/v1
+kind: SriovNetworkNodePolicy
+metadata:
+  name: policy-net-1
+  namespace: openshift-sriov-network-operator
+spec:
+  resourceName: net1
+  nodeSelector:
+    feature.node.kubernetes.io/network-sriov.capable: "true"
+  numVfs: 16
+  nicSelector:
+    pfNames: ["netpf0#0-0"]
+  deviceType: netdevice
+----
+
+Policy `policy-net-1-dpdk`:
+
+[source,yaml]
+----
+apiVersion: sriovnetwork.openshift.io/v1
+kind: SriovNetworkNodePolicy
+metadata:
+  name: policy-net-1-dpdk
+  namespace: openshift-sriov-network-operator
+spec:
+  resourceName: net1dpdk
+  nodeSelector:
+    feature.node.kubernetes.io/network-sriov.capable: "true"
+  numVfs: 16
+  nicSelector:
+    pfNames: ["netpf0#8-15"]
+  deviceType: vfio-pci
+----
+
+.Verifying that the interface is successfully partitioned
+Confirm that the interface partitioned to virtual functions (VFs) for the SR-IOV device by running the following command.
+
+[source,terminal]
+----
+$ ip link show <interface> <1>
+----
+
+<1> Replace `<interface>` with the interface that you specified when partitioning to VFs for the SR-IOV device, for example, `ens3f1`.
+
+.Example output
+[source,terminal]
+----
+5: ens3f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
+link/ether 3c:fd:fe:d1:bc:01 brd ff:ff:ff:ff:ff:ff
+
+vf 0     link/ether 5a:e7:88:25:ea:a0 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
+vf 1     link/ether 3e:1d:36:d7:3d:49 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
+vf 2     link/ether ce:09:56:97:df:f9 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
+vf 3     link/ether 5e:91:cf:88:d1:38 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
+vf 4     link/ether e6:06:a1:96:2f:de brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state auto, trust off
+----

networking/hardware_networks/configuring-sriov-device.adoc

@@ -15,6 +15,9 @@ include::modules/nw-sriov-networknodepolicy-object.adoc[leveloffset=+1]
 
 // A direct companion to nw-sriov-networknodepolicy-object
 // Virtual function (VF) partitioning for SR-IOV devices
+
+include::modules/nw-sriov-nic-mlx-secure-boot.adoc[leveloffset=+2]
+
 include::modules/nw-sriov-nic-partitioning.adoc[leveloffset=+2]
 
 // Configuring SR-IOV network devices