openstack
/
openstack
Code Issues Proposed changes

Update git submodules 

* Update kuryr-kubernetes from branch 'master'
  - Set MAC address for VF via netlink message to PF
    
    SR-IOV binding driver uses pyroute2 library to set MAC addresses
    to VFs. This is internally implemented via ioctl(SIOCSIFHWADDR)
    giving it the name of that device. This is equal to calling
    'ip link set dev $VFDEV address $MAC'. However, there is another
    way to set MAC address for VF. It works via netlink RTM_SETLINK
    message to the PF. This is equal to calling
    'ip link set dev $PFDEV vf $VFID mac $MAC'.
    
    How it works:
    * ioctl(SIOCSIFHWADDR) asks the VF driver to set the MAC
      --> VF driver asks PF to set MAC for it
      --> PF sets the MAC for VF.
    * RTM_SETLINK message asks the PF to set MAC for VF
      --> PF sets the MAC for VF.
    
    In case of setting directly via PF, PF additionally sets an
    "administratively changed MAC" flag for that VF in the PF's
    driver, and from that point on (until the PF's driver is
    reloaded) that VF's MAC address can't be changed using the
    method #1.
    
    It's a security feature designed to forbid MAC changing by the
    guest OS/app inside the container.
    
    Above leads to the issue where SR-IOV CNI is not able to set MAC
    address for VF if its MAC was previously administratively set at
    least once (by hands or other software):
    
      ioctl SIOCSIFHWADDR: Cannot assign requested address
    
      kernel: igb 0000:05:00.0:
        VF 0 attempted to override administratively set MAC address
        Reload the VF driver to resume operations
    
    After that CNI fails the whole transaction, i.e. fails to change
    the interface name as well and subsequently fails the binding.
    
    Netlink PF method to change MAC addresses should be used always.
    This will additionally forbid the MAC changing from the inside
    of container.
    
    Change-Id: Ic47672e4ce645d9d37b520b6a412a44ae61036e1
    Closes-Bug: 1825383
    Co-authored-by: Danil Golov <d.golov@samsung.com>
    Signed-off-by: Ilya Maximets <i.maximets@samsung.com>
This commit is contained in:
Ilya Maximets 2019-04-18 16:27:49 +03:00 committed by Gerrit Code Review
parent 76b1ece76c
commit d089a10583
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
kuryr-kubernetes

@ -1 +1 @@
Subproject commit 1a32ae5de810798b3f3b5434e3e61a952b99a0ef
Subproject commit d2b223ffca37ce62b799cdec25e427eb97df1ef6